Theoretical Computer Science 281 (2002) 1
www.elsevier.com/locate/tcs
Preface With the publication of this Special Volume, the Theoretical Computer Science community wishes to celebrate the career and achievements of Maurice Nivat on the occasion of his retirement and, at the same time, wishes to express to him its deep gratitude for the contributions that he has given us which have done so much to foster the growth of the )eld. Throughout his long career, Maurice Nivat has been one of the most in*uential )gures in the history of Theoretical Computer Science. His prominence stems in equal measure from the many important results he has produced in a diverse variety of research )elds, from the generations of scholars he has educated, and from the role that he has played in helping our discipline reach scienti)c maturity and respect among older disciplines. A great deal of this has been achieved through the energy and intellectual vision that Maurice Nivat has provided as founder and editor-in-chief of Theoretical Computer Science, the journal that he directed over the last twenty-)ve years and that, since its inception in 1975, has progressively risen to its current stature as one of the leading international computer science journals. This volume consists of three parts. The )rst part contains two contributions that retrace some of Maurice’s remarkable scienti)c achievements and his role in shaping Theoretical Computer Science as a new mathematical discipline. The second part, and by far the largest, is dedicated to new scienti)c contributions, ranging over many aspects of theoretical computer science. Indeed, the guest editor, Pierre-Louis Curien, intended that the scienti)c contributions to this volume should mirror the diversity of )elds to which Maurice Nivat has contributed, from formal languages to discrete geometry all the way through to semantics and concurrency. Some contributors are former students of Maurice, while others are fellow scholars who have shared great experiences collaborating with Maurice, some are colleagues of his generation, while others are in their thirties; this also is part of the diversity, of the breadth, and of the liveliness of the whole area covered by the journal Theoretical Computer Science. Finally, the third part is a “clin d’oeil” to the many other passions of Maurice, that will lead the reader from the mysteries of Indian esoterism to the more terrestrian hidden beauties of the Postscript language. We thank all the authors for their scienti)c contributions to this Special Volume; the Guest Editor, Pierre-Louis Curien, for coordinating this impressive volume; and our publisher, Elsevier, in the person of Arjen Sevenster, for having provided all the needed support for such an exceptional e
c 2002 Published by Elsevier Science B.V. 0304-3975/02/$ - see front matter PII: S 0 3 0 4 - 3 9 7 5 ( 0 2 ) 0 0 0 0 3 - 8
Theoretical Computer Science 281 (2002) 3 – 23
www.elsevier.com/locate/tcs
Une breve biographie scienti"que de Maurice Nivat Pierre-Louis Curien PPS-Case 7014, Univ. Paris 7, 2 pl. Jussieu, F-75251 Paris Cedex 05, France
1. An even shorter biography Maurice Nivat was born on December 21, 1937. His parents were both high-school teachers—his father in French, Latin, and Greek, his mother in Mathematics. Maurice grew up in the city of Clermont-Ferrand. His elder brother, who has recently retired from the University of Geneva, became a scholar in Slavic studies. His younger sister, Aline Bonami, is a mathematician whose speciality is harmonic analysis. Maurice is married to Paule Nivat, who has just retired from a position of professor of statistics at University Paris 13. He has three children, Dominique, Jean-Luc, and Catherine, and 10 grand-children (so far). Since 1983, he has been a Corresponding Member of the Acad9emie des Sciences. In 1997 he was made doctor honoris causa of the University of Bologna. Maurice and his family moved to Paris in 1954, where Maurice prepared for the Ecole Normale Sup9erieure’s entrance examination, where he was admitted in 1956. In 1959, he began to work at the Institut Blaise Pascal, which was the newly set up computing centre of the CNRS (National Centre of Scienti"c Research). There he met Louis Nolin, and started to learn about programming languages (Lisp, Algol) and compilers. Maurice would then meet Marcel-Paul SchButzenberger and begin research work under his supervision. From 1965 to 1969, Maurice held positions in the Universities of Grenoble and then of Rennes. Maurice gained his “These d’Etat” in 1967 [28]. In 1969, he was appointed as professor at the University of Paris, a position that he has held until now. During the early 1970s, in parallel with his scienti"c work, Maurice began to devote much time and energy to building research teams, both at IRIA and at the university. IRIA (Institut de Recherche en Informatique et Automatique) had been created by the French government in 1967. In 1970, Nivat and SchButzenberger gave an inHuential talk at IRIA where they proposed the name “Informatique Th9eorique” to designate all the research on automata and formal languages, on programming languages, and on E-mail address:
[email protected] (P.-L. Curien). 0304-3975/02/$ - see front matter PII: S 0 3 0 4 - 3 9 7 5 ( 0 2 ) 0 0 0 0 4 - X
4
P.-L. Curien / Theoretical Computer Science 281 (2002) 3 – 23
algorithms. Shortly after, Maurice created a research project at IRIA, which would be joined by Philippe Flajolet, Jean-Marc Steyaert, Bruno Courcelle, G9erard Huet, JeanJacques L9evy, and G9erard Berry. During this period, research at IRIA was very lively, and bene"ted from a fruitful interaction with young researchers like Gilles Kahn, Jean Vuillemin, and G9erard Huet who had learned advanced programming practice in the USA. Maurice’s project lasted for about 10 years. In the 1980s, new closely cooperating INRIA (the “N”—for National—was added in 1980) projects, such as Formel (Huet), VLSI (Vuillemin), and Para (L9evy), have arisen out of this research community. At the University of Paris (and then at the Universities Paris 7 and Paris 6), with SchButzenberger and Nolin, Maurice built a research team, and a few years later he was at the centre of the creation of LITP (Laboratoire d’Informatique Th9eorique et Programmation) in 1975, of which he would be co-director until 1985, "rst with Jacques Arsac, then with Bernard Robinet. Maurice also launched the “Ecoles de Printemps d’Informatique Th9eorique”, which have been held each year since 1973. These convivial spring schools played an important role in the creation of a national community in theoretical computer science. During this decade, Maurice was no less active internationally. He created essential vehicles for the European computer science research community. He founded the EATCS (European Association for Theoretical Computer Science), with the help of Jaco de Bakker, Corrado BBohm, and Mike Paterson. He organized the "rst ICALP (International Colloquium on Automata, Languages and Programming) at IRIA in 1972 (see the text of Arto Salomaa and Grzegorz Rozenberg in this volume). Finally, he created the journal TCS which started to appear in 1976 (we refer to the editorials of Giorgio Ausiello, Don Sannella, and Mike Misolve, and of Maurice Nivat in the TCS Vol. 250, for some recollections of the beginnings of the journal and of its expansion over the years). The inHuence of Maurice on international scienti"c publishing extends much beyond this journal (and its more practice-oriented cousin Science of Computer Programming, and the more recent Electronic Notes in Theoretical Computer Science). For instance, together with Engeler, Huet, Jouannaud, Milner, and Wirsing, Maurice has been a member of the editorial board of the series Progress in Theoretical Computer Science (Pitman, and then BirkhaBuser), directed by the late Ron Book, a great friend of Maurice. During the early 1980s, Maurice was intensively involved in the promotion and the organization of research in computer science at the national level. He launched the PRC programmes (Programmes de Recherche Concert9es) that gave a decisive impulse to the research community in this country.. 1.1. Scienti,c works (I) Formal language theory: In his thesis, Maurice gave an algebraic characterization of rational transducers, on which many later works of the “French school” of formal languages are based. The notions of rational cone and of hierarchy are already present [29]. Then, Maurice initiated a study of languages de"ned by congruences [17], which later led to the works of G9eraud S9enizergues (see his contribution to the volume). Maurice and his students Luc Boasson, JoProy Beauquier, and Jean-Michel Autebert
P.-L. Curien / Theoretical Computer Science 281 (2002) 3 – 23
5
worked extensively on understanding the structure (and the generators [7]) of contextfree languages. A remarkable complexity measure, which has been much used since, was proposed in [12]. A synthetic account of many of these results can be found in Jean Berstel’s book [11]. In the late 1970s, in connection with his work on semantics, Maurice began to study in"nite words [31]. He introduced the notion of the centre of a language and uncovered some of the underlying topological properties. During these years, the research carried out in France in this area became quite well-known internationally, and this is certainly largely due to ideas whose origin can be found in Maurice’s works. (II) Semantics: Maurice’s interest in semantics goes back to a meeting of the IFIP WG 2.2 in Colchester in 1969, on the semantics of programming languages—a subject that was just starting at the time. Maurice learned from David Park and Mike Paterson about program schemes. This led to a large body of work for Maurice and a number of students (Laurent Kott, G9erard Boudol, Irene Guessarian, Bruno Courcelle, Guy Cousineau, Jean-Marie RiQet). First, Maurice extended a well-known theorem of SchButzenberger by characterizing the set of terms generated by a context-free tree grammar as the smallest solution of this grammar considered as a system of equations on sets of terms. Then he showed that when the grammar represents a (recursive) program scheme, this algebraic solution in turn characterizes its semantics: the interpretation of the solution coincides with the operational semantics of the given program scheme [30]. The subject of “algebraic semantics” [18] developed progressively (see the book of Irene Guessarian [24]), based on the construction of an in"nite algebraic object—similar to the BBohm tree of a -term—that factorizes the semantics of a program scheme. This algebraic object characterizes the semantic equivalence class of the associated program scheme, and in some cases (such as for the “rational” program schemes), it allows us to design algorithms for deciding this equivalence. The investigations of in"nite trees—for themselves—culminated in Bruno Courcelle’s thesis (see [19]). Subsequently Maurice set out to generalize his results to the non-deterministic case. Serious diRculties arose here, as denotational semantics did not oPer a satisfying notion of power-domain. Nivat and Arnold introduced the use of metric spaces [1]: in this framework, they de"ned a "xpoint semantics of non-deterministic program schemes. This metric space approach to semantics (a synthetic exposition of which can be found in [33]) has since been followed by various authors, and in particular by the group of Jaco de Bakker in Holland. However it is fair to say that this was not a complete success, as the coincidence with operational semantics (as proposed by G9erard Boudol [13] following works by G9erard Berry and Jean-Jacques L9evy [16]) does not hold any more, except in some special cases. This “chapter” of Maurice’s scienti"c activity ends with the publication of [34], based on a joint French-US meeting held in Fontainebleau in 1982. Next, Maurice addressed the semantics of parallelism. The initial insight was in his study of in"nite words viewed as in"nite behaviours of processes, which was to generate numerous works under the supervision of Maurice: those of FranScoise Gire, Daniele Beauquier, Hugues Fauconnier, Paul Gastin, and Andreas Podelski. For more details about this period of his scienti"c activity, we refer to the contribution of Andr9e
6
P.-L. Curien / Theoretical Computer Science 281 (2002) 3 – 23
Arnold in this volume. Certainly, Maurice was a pioneer of model-checking when he worked on the synchronization of automata [32]. (III) Tilings and discrete tomography: In the mid-1980s, after his national responsibilities were over, Maurice changed his research direction once more. He turned his attention to the study of discrete geometrical objects, while keeping an active interest in concurrency and tree languages. Some young researchers advised by Maurice in this area are Alain Daurat, Yann G9erard, and Laurent Vuillon. One of his former students, Ahmed Saoudi, who unfortunately died since, has pushed much Maurice in this direction. With Daniele Beauquier, Maurice "rst worked on the decidability of the problem of whether a given "nite set of polyominoes forms a plane code. The problem turned out to be diRcult, but they "nally obtained a negative answer in 1993–1994 (yet to be published). In [8], the two authors tackled the problem of tiling the plane by translated instances of a single tile. They showed that such tilings are possible if and only if this tile is a pseudo-hexagon, and moreover that the tiling is then half-periodic (i.e., invariant under some translations). Beauquier and Nivat have thus found an interesting solvable family of tiling problems. In [9], Maurice and his co-authors showed that for general regions of the square lattice the tiling problem is NP-complete for horizontal dominoes and vertical trominoes, and for any other pair of bars where either has length ¿2. Recently, by using a similar approach, Moore and Robson [27] proved some additional results of this kind. Maurice is also among the pioneers of discrete tomography, which deals with the reconstruction of discrete geometrical objects from multiple X-ray projections [25]. Maurice tackled the problem of reconstructing binary matrices that are only accessible through a "nite number of projections counted with multiplicities along some lines. For the much studied case of two projections (horizontal and vertical), existence and uniqueness results are known [35]. But as the number of solutions can be rather large in general, the researchers interested in this problem have looked at particular cases. In [5,6] (see also [20] for a synthetic presentation), Maurice, in joint work with Elena Barcucci, Alberto Del Lungo, and Renzo Pinzani, provided some polynomial-time algorithms to reconstruct binary matrices having some convexity and=or connectivity properties. These works have been extended by several authors [3,15,26]. The problem of reconstructing binary matrices from three or more X-rays is NP-complete [21]. Maurice and his co-authors have found an interesting class of polyominoes (having convexity and connectivity properties, again) for which the problem is solvable in polynomial time [4]. An extension of this result to the reconstruction of convex lattice sets has been given in [14]. Discrete Tomography is a relative young and actively studied "eld, and Maurice is one of its most active promoters. During recent years, Maurice and Peter Gritzmann have organized two international meetings devoted to this "eld. Thus, the spectrum of Maurice’s scienti"c works has covered (so far!) all the three areas that he had cited as the cornerstones of Theoretical Computer Science: the theory of formal languages and automata, programming languages, and algorithms. More widely, the contributions of Maurice to the whole computer science community, nationally and internationally, are immense.
P.-L. Curien / Theoretical Computer Science 281 (2002) 3 – 23
7
2. Quelques dates En d9ecembre 1997 se tenait a l’Ecole Normale Sup9erieure un Jubil9e en l’honneur de Maurice Nivat. Cette r9eunion amicale, dont l’initiative revient a Jean-Eric Pin, fut organis9ee par Andr9e Arnold et Jean-Marc Steyaert, avec l’aide de Paule Nivat. Quatre ans plus tard, Maurice a quitt9e ses fonctions de r9edacteur en chef de la revue Theoretical Computer Science, et s’apprˆete a prendre sa retraite de professeur a la "n de l’ann9ee universitaire en cours. Ce volume lui est d9edi9e, et les lignes qui suivent tentent de retracer quelques faits marquants de sa carriere. Maurice Nivat est n9e le 21 d9ecembre 1937. Ses parents sont tous deux professeurs de lyc9ee: le pere, normalien, enseigne le franScais-latin-grec, la mere les math9ematiques. Maurice grandit a Clermont-Ferrand. La r9eussite scolaire est un objet d’attention tout particulier dans la famille, qui sera combl9ee de ce point de vue: les trois enfants seront normaliens. Le frere aˆYn9e Georges est slavisant. Il vient de prendre sa retraite de professeur d’universit9e a Geneve. Sa sZur cadette, Aline Bonami, est math9ematicienne, sp9ecialiste d’analyse harmonique. Au grenier, le jeune Maurice d9evore les livres qui avaient appartenu a son grand-pere architecte: ce goˆut pour l’architecture, et singulierement les styles architecturaux de chaque in"me r9egion de France, ne le quittera jamais. Maurice est mari9e a Paule Nivat, professeur de statistiques a l’universit9e Paris 13, qui vient de prendre sa retraite. Il a trois enfants: Dominique (1960, e9 conomiste), Jean-Luc (1963, informaticien), et Catherine (1967, m9etallurgiste). Il a aujourd’hui dix petits-enfants. Il est chevalier dans l’ordre de la L9egion d’Honneur et oRcier dans celui du M9erite. Il est membre correspondant de l’Acad9emie des Sciences depuis 1983, et docteur honoris causa de l’Universit9e de Bologne depuis 1997. 3. Annees d’apprentissage Maurice obtient brillamment son baccalaur9eat en 1954, avec plus de 18 de moyenne: un exploit r9egional! Son professeur de math9ematiques en Math Elem, Monsieur Dumas, l’a initi9e a la g9eom9etrie des coniques. La famille se d9eplace alors vers Paris; Maurice rentre en Classes Pr9eparatoires au lyc9ee Jeanson de Sailly. Il est admis au concours d’entr9ee a l’Ecole Normale Sup9erieure en 1956. Il se laisse d’abord s9eduire par la physique: il fr9equente un an le laboratoire de Pierre Aigrain, mais n’arrivant pas a faire e9 mettre d’ondes a un klystron capricieux, il pr9efere en rester la. En ce temps la, il n’y avait pas de maˆYtrise. Il fallait passer pour la licence trois certi"cats, auxquels s’ajoutaient des cours d’option. En premiere ann9ee, Maurice passe Calcul DiP9erentiel et Physique G9en9erale, en fournissant un travail tres mod9er9e. Car il rattrapait le temps: il allait voir jusqu’a trois "lms par jour! En option, en deuxieme ann9ee, il passe (et rate) Topologie G9en9erale de Gustave Choquet. Comme il e9 tait d’usage, les normaliens n’allaient pas aux cours, d9el9eguant l’un des leurs pour tenir les autres au courant. En lieu de quoi ils travaillaient ensemble assez s9erieusement la Topologie G9en9erale de Bourbaki, tres a l’oppos9e du style de Choquet, lequel pr9ef9erait l’intuition g9eom9etrique, les contre-exemples... Maurice remet copie blanche a l’examen. Ses condisciples ne font
8
P.-L. Curien / Theoretical Computer Science 281 (2002) 3 – 23
pas d’9etincelles non plus. Cet e9 chec collectif sert de leScon, et a certainement contribu9e a la diversi"cation des vocations! Pierre L9ena se tournera vers l’astrophysique, Jean Bretagnolle vers les probabilit9es. Il restait a passer M9ecanique G9en9erale. Ici l’9echec est plus p9enalisant. Maurice est suspendu un an sans traitement. Pour gagner un peu d’argent, il donnera des colles a Jeanson. Re-9echec a M9ecanique G9en9erale. Il travaille peu... La direction de l’Ecole Normale s’en e9 meut. Il est reScu et sermonn9e par le sous-directeur pour les sciences, Albert Kirrmann. Henri Cartan, directeur des math9ematiques d’alors pour les normaliens, lui fait trois propositions: 1. Faire de la th9eorie des carapaces avec lui (th9eorie qu’il d9eveloppait pour les normaliens, et qui n’a pas surv9ecu). 2. Faire de la m9ecanique c9eleste (nonobstant ses d9emˆel9es avec la “terrestre”). 3. Travailler au nouveau Centre de Calcul du CNRS, l’Institut Blaise Pascal, dirig9e par Ren9e de Possel. Maurice choisit la solution 3. De Possel est un personnage extraverti, jovial mais distant en mˆeme temps. Maurice est calculateur adjoint (il est toujours suspendu de l’Ecole). L’Institut Blaise Pascal est dans les caves de l’IHP. Plusieurs dames y travaillent, ex9ecutant des calculs sur les machines a manivelles. Au Centre de Calcul, Maurice rencontre Louis Nolin, avec lequel il nouera une amiti9e ind9efectible jusqu’a la mort de ce dernier, survenue en janvier 1997. A parte: D’origine modeste, Louis Nolin a commenc9e sa formation par des e9 tudes de philosophie avant de rencontrer l’informatique. Il fallait dans les ann9ee 60 (et a vrai dire jusqu’a l’avenement des PRC, voir plus bas) beaucoup de courage pour entreprendre de concevoir et mettre en Zuvre des langages de programmation a l’universit9e: ni moyens, ni reconnaissance de la discipline. Nolin a donc d’abord conScu des langages de programmation sur le papier. Son langage ATF (“a tout faire”!) a inspir9e Excel, un langage d9evelopp9e plus tard au laboratoire LCR de la Thomson (voir plus bas). Louis Nolin avait une passion pour les machines-outils et pour les vins en g9en9eral et ceux de sa r9egion en particulier (Bergerac). Sa "gure discrete mais chaleureuse reste pr9esente a l’esprit de tous ceux qui l’ont cˆotoy9e au LITP. Maurice rencontre aussi Andr9e Lentin. Il fait ses premiers expos9es sur Lisp, Algol, au s9eminaire anim9e par FranScois G9enuys (IBM) qui se tient a l’Institut d’Astrophysique. Maurice sera d’ailleurs plus tard coauteur d’un livre sur Algol [2]. Le s9eminaire est fr9equent9e par des physiciens (dont Jacques Arsac, qui a commenc9e par l’astrophysique, et Bernard Vauquois qui deviendra sp9ecialiste du traitement automatique des langues a Grenoble), et aussi des logiciens: Lacombe, Porte. Maurice fr9equente e9 galement le s9eminaire de Lacombe, qui s’int9eresse a la d9emonstration automatique. Il est devenu informaticien (mˆeme si le mot n’existe pas encore—il sera cr9ee9 au milieu des ann9ees 60). Il passe en"n M9ecanique G9en9erale, malgr9e un 2,5 a l’9ecrit, rattrap9e a l’oral. Ceci permet a Maurice d’ˆetre r9eint9egr9e a l’ENS, ou il pr9epare l’agr9egation de math9ematiques, qu’il obtient en 1961. La pr9eparation est assur9ee par Henri Cartan, dont les conseils et critiques sont tres formateurs. Il fr9equente alors les e9 leves d’une autre promotion, mais les connaˆYt peu: il est d9eja mari9e. De ces ann9ees normaliennes, Maurice gardera un attachement constant pour Choquet et Cartan.
P.-L. Curien / Theoretical Computer Science 281 (2002) 3 – 23
9
4. A la rencontre de Sch utzenberger A la rentr9ee universitaire de 1961, De Possel propose a Maurice un poste d’assistant. En le comptant, il y a alors en tout et pour tout sept assistants a la Facult9e des Sciences de Paris! Maurice aurait pu aussi rentrer au CNRS, mais il n’a pas encore d’id9ee de ce que peut eˆ tre la recherche, tandis qu’il peut ais9ement imaginer a quoi peut ressembler le m9etier d’enseignant. Il assure les Travaux Dirig9es de De Possel (polynomes de Tchebytchev), ainsi que des Travaux Pratiques (calcul sur les machines du Centre de Calcul de racines r9eelles d’9equation du troisieme degr9e). Il est un assistant heureux: peu de travail, une paix royale, un peu d’administration. A parte: De Possel poursuivait une carriere universitaire a Alger avant d’ˆetre rapatri9e et de prendre la responsabilit9e du Centre de Calcul. Il tient tous les lundis une sorte de salon, ou l’on parle de tout: il mange d’9enormes sandwichs, propose des problemes ou des d9e"s que les participants a ces r9eunions sont invit9es a r9esoudre sur le champ. Maurice fait son service militaire d’octobre 1962 a mars 1964. Un mois a Brest, deux mois a Toulon, et le reste dans un laboratoire du Service Technique des Constructions et Armes Navales, a Paris. Souvenir d’une machine Bull qui ne fonctionne pas... Maurice fait aussi l’exp9erience de la manie du secret. Il ne connaˆYtra jamais l’id9ee qu’un ing9enieur de ce centre venu le voir rue du Maroc (ou s’9etait transport9e l’Institut Blaise Pascal) renoncera a lui communiquer par peur d’oreilles qui traˆYneraient. Par le jeu des relations normaliennes, Maurice rentre aussi comme Conseiller a la CSF (qui deviendra Thomson-CSF), y fr9equente Jean-Pierre Vasseur, puis plus tard Gilles Ruggiu. Plusieurs jeunes chercheurs aiguill9es par Maurice y feront tout ou partie de leur these de troisieme cycle ou d’Etat: Patrice Enjalbert, Guy Cousineau, Fr9ed9eric Boussinot. Maurice souhaite rencontrer Marcel-Paul SchButzenberger. C’est Lentin, dont la these, fort e9 l9egamment calligraphi9ee, portera sur les e9 quations dans les monoBYdes, qui le connaˆYt le mieux. Maurice attendra un an avant de le voir. Il est alors en poste a Poitiers, mais passe beaucoup de temps aux USA. Nolin et Nivat lui pr9esentent un compilateur pour ALGOL bas9e sur une notion d’automate a taquets. SchButzenberger e9 coute, puis parle, et ne cessera plus de fasciner Maurice... Il lui propose de travailler sur la th9eorie des codes. Il a une conjecture sur la g9en9eration des codes "nis par surcodages, conjecture que Yves C9esari prouvera fausse plus tard. Maurice va commencer la recherche. Pour aborder ces rivages ardus, en dehors des sentiers battus, il faut beaucoup d’9energie, de rage mˆeme, et Maurice n’en manque pas, endurci par de dures e9 preuves familiales (suicide de sa premiere femme en 1965). A parte: SchButzenberger est un “self-made man”. Il a vingt ans au d9ebut de la seconde guerre mondiale. Il est communiste, tendance Tillon, se fait pour la bonne cause faussaire. Membre du cabinet de Tillon jusqu’a la mise a l’9ecart de ce dernier par le Parti Communiste, il b9en9e"cie de la loi autorisant des e9 tudes acc9el9er9ees pour les r9esistants. Il fait sa m9edecine, et part travailler pour l’OMS (Asie du Sud-Est, Pakistan...). La-bas il fait aussi des math9ematiques. Il invente les groupes qui portent son nom. Il fait de la th9eorie des treillis, trouve ind9ependamment le th9eoreme des vari9et9es de BirkhoP. Ses travaux sont publi9es aux CRAS. Puis SchButzenberger rentre en France, passe une these en th9eorie des probabilit9es, et est nomm9e professeur a Poitiers. En
10
P.-L. Curien / Theoretical Computer Science 281 (2002) 3 – 23
1957–1958, il part aux USA: il voulait faire de l’9epid9emiologie au Harvard Medical School. La, il rencontre Zellig Harris (linguiste formel), et son e9 leve Noam Chomsky. Mais il s’int9eresse aussi a la th9eorie des codes (Shannon, HuPman). Bref, il est curieux de tout! Il y a d9eja quelques ann9ees que la th9eorie des automates est un sujet tres actif, depuis le th9eoreme de Kleene de 1953 (reliant automates et expressions r9egulieres) [26]. Apres Rabin, Scott et d’autres, SchButzenberger rattrape le temps perdu, publie beaucoup avec Chomsky (transducteurs). Il est nomm9e a Paris au milieu des ann9ees 60. Il prend des e9 leves: Dominique Foata, Maurice Nivat, Jean Berstel, Jean-FranScois Perrot, Michel Fliess, Robert Cori, G9erard Viennot, Dominique Perrin, Christian ChoPrut. Et aussi Maurice Gross, qui s’orientera vers la linguistique. En mai 68, SchButzenberger retrouve des e9 lans de communiste tendance libertaire. Mais il est en mˆeme temps farouchement e9 litiste. De cette contradiction r9esultera une r9esolution: il ne prendra plus d’9eleves. Mais l’9ecole de pens9ee se poursuit: Perrot sera le directeur de these de Jacques Sakarovitch et de Jean-Eric Pin; Berstel de Christophe Reutenauer, ... SchButzenberger reste naturellement scienti"quement tres actif et continue d’exercer fortement son inHuence scienti"que.. A la “g9en9eration” suivante, Daniel Krob par exemple a ainsi eu la chance de communiquer r9egulierement avec lui. Marcel-Paul SchButzenberger est mort en 1996. En 1964, Maurice va a une Ecole de Printemps a Ravello (sur la th9eorie des codes). Il partage son logement avec Corrado BBohm. Site superbe. A Paris, il apprend de la th9eorie des langages, et tel un grand frere donne des petits cours a ses cadets Jean Berstel, Jean-FranScois Perrot, Michel Fliess. Il y avait alors un chapitre important: celui des s9eries formelles en variables non commutatives et de leurs applications a la combinatoire. SchButzenberger tenait un s9eminaire hebdomadaire dans les caves de l’IHP, diRcile a suivre, mˆeme pour les quelques initi9es. De 1965 a 1967, Maurice est Charg9e de Conf9erences a Grenoble; puis, de 1967 a 1969, a Rennes. Il a deux e9 leves a Grenoble: Philippe Butzbach (qui vient malheureusement de mourir) et Michele Benois, et un a Rennes, Yves Cochet (aujourd’hui ministre de l’Environnement, devenu e9 cologiste dans son mode de vie avant mˆeme la constitution de mouvements e9 cologistes). Avec ses e9 leves grenoblois, Maurice s’int9eresse a la r9ee9 criture de mots. Les problemes sont diRciles, et fort peu e9 tudi9es alors. Certaines questions n’ont trouv9e de r9eponses que beaucoup plus tard. Par exemple, c’est seulement au milieu des ann9ee 80 que Squier [36] montrera en utilisant l’homologie que certaines th9eories e9 quationnelles n’admettent aucune pr9esentation orient9ee qui soit conHuente et nZth9erienne. Peu de gens s’int9eressaient a la r9ee9 criture: l’engouement autour de Knuth-Bendix, c’est une dizaine d’ann9ees plus tard. Maurice identi"ait ainsi d9eja la notion de systeme conHuent (quasi-parfait dans sa terminologie). En 1967, Maurice soutient sa these d’Etat [28]. SchButzenberger e9 tait un peu inquiet. Le jury ne manquait pas de math9ematiciens prestigieux parmi lesquels Lelong, conseiller de De Gaulle, et pr9esident d’un Comit9e de Sages qui avait recommand9e la cr9eation de l’IRIA, et Ehresmann, le pere franScais de la th9eorie des cat9egories. Qu’allaient-ils penser de ces travaux aux marges de la math9ematique? La soutenance est un peu perturb9ee par une pol9emique qui surgit a propos de la deuxieme these. Maurice devait commenter une note e9 nonScant un r9esultat r9ecent en th9eorie de la mesure. Cartan, qui e9 tait dans la salle, dit que le r9esultat est faux... Faute de temps,
P.-L. Curien / Theoretical Computer Science 281 (2002) 3 – 23
11
il n’y aura pas de questions. Mais le jury fait des compliments, SchButzenberger est rassur9e. En 1969, Maurice se pr9epare a devenir professeur a Strasbourg, quand un poste suppl9ementaire en informatique se d9egage a la Facult9e des Sciences de Paris. Il y suit de pres Louis Nolin. Ce dernier avait e9 t9e e9 vinc9e brutalement en 1967 de l’Institut Blaise Pascal: il e9 tait le bouc e9 missaire d’un rapport d’9evaluation s9evere. Louis Nolin se r9efugie a l’IRIA pour y pr9eparer sa these, qu’il r9edigera a Montr9eal, et qu’il passera discretement a l’IHP, en pleine d9ebˆacle du mouvement e9 tudiant de mai 68. Il est recrut9e professeur la mˆeme ann9ee. Maurice d9ecouvre la s9emantique des langages de programmation a une r9eunion du WG 2.2 de l’IFIP a Colchester, en septembre 1969: Dana Scott, Robin Milner, Christopher Strachey, Peter Landin, David Park y participent. C’est avec ce dernier, et avec Mike Paterson, tous deux a Warwick, que Maurice aura le plus d’atomes crochus: Paterson lui parle des sch9emas de programmes, sur lesquels Maurice travaillera dans les ann9ees 70 avec ses e9 leves (Laurent Kott, G9erard Boudol, Irene Guessarian, Bruno Courcelle, Guy Cousineau, Jean-Marie RiQet). Landin est fort brillant et impressionne Scott.
5. L’“ecole humaine” de Maurice C’est au d9ebut des ann9ees 70 que, parallelement a ses travaux, Maurice commence a consacrer en pionnier beaucoup de temps et d’9energie a construire des e9 quipes de recherche, a l’IRIA et a Paris 7, institutions toutes deux fraˆYchement cr9ee9 es. A parte: Quand les Chinois "rent exploser leur bombe H avant les FranScais, les militaires ont invoqu9e le manque d’ordinateurs. De Gaulle commande alors un CDC6600, et les Am9ericains font l’embargo. D’ou le Plan Calcul, ensemble de dispositions visant a doter la France d’une industrie informatique autonome. L’IRIA, cr9ee9 "n 1967 et install9e a Rocquencourt dans des casernements lib9er9es par l’OTAN, devait eˆ tre l’un des fers de lance de ce plan. Les premieres ann9ees de l’IRIA (1968–1971) sont un peu balbutiantes. Le pilotage scienti"que est assur9e par un directoire, qui comprend notamment, autour de l’Ing9enieur G9en9eral Boucher: Michel Laudet, Jacque-Louis Lions, Pierre Faurre, Marcel-Paul SchButzenberger, Andr9e Lichnerowiz. Lions prend les rˆenes en 1972. (disparition du Directoire). 5.1. IRIA En 1970, SchButzenberger introduit Maurice a l’IRIA. Tous deux donnent une conf9erence a l’IRIA, proposant la d9enomination d’Informatique Th9eorique pour d9esigner les recherches sur les automates et langages formels, sur les langages de programmation et sur les algorithmes. Des le d9ebut, l’IRIA est organis9e en projets. Celui de SchButzenberger, “Automates et Langages Formels” ne dure que quelques ann9ees. Maurice cr9ee en 1971 un projet “S9emantique Formalis9ee des Langages de Programmation”. Plusieurs facteurs se conjuguent ici. Maurice vient d’attraper le virus de la
12
P.-L. Curien / Theoretical Computer Science 281 (2002) 3 – 23
s9emantique a Colchester. Les travaux en th9eorie des langages commenScaient a buter sur des problemes diRciles pour lesquels il semblait raisonnable de laisser passer du temps et d’attendre que d’autres id9ees viennent d’ailleurs. Le contexte de l’IRIA l’engageait a proposer des themes dont les perspectives d’application seraient plus faciles a d9efendre. Il commenScait ainsi a militer pour sensibiliser les th9eoriciens aux applications, et r9eciproquement, combat qu’il devra mener maintes et maintes fois, et ce au sein mˆeme de son entourage scienti"que imm9ediat. Le projet de Maurice accueillera Philippe Flajolet et Jean-Marc Steyaert, Bruno Courcelle, G9erard Huet (qui avait fait un PhD aux Etats-Unis), G9erard Berry, et aussi pour une courte p9eriode Jean-Jacques L9evy (qui avait commenc9e par les “Operating Systems”, dans le projet de Krakowiak, Kayser et B9etourn9e). La th9ematique reScoit vite le renfort d’autres jeunes chercheurs revenus des USA: Jean-Marie Cadiou, Gilles Kahn, Jean Vuillemin. Ces derniers fondent en 1973 le projet “Analyse des Algorithmes, Validit9e des Programmes”. Cette confrontation entre une e9 cole franScaise tres th9eoricienne et aux allures parfois un peu sectaires, sans doute imprim9ees par la personnalit9e forte mais altiere de SchButzenberger, et des chercheurs ramenant des Etats-Unis une avance certaine dans le mariage entre une bonne th9eorie et une v9eritable activit9e de programmation ne pouvait se faire sans certains heurts. Fort heureusement, des passerelles se sont rapidement e9 tablies, et de fructueuses collaborations se sont nou9ees: Kahn et Huet, Vuillemin et Flajolet... De nouveaux projets naissent: “Conception et R9ealisation d’Outils d’Aide a la Programmation” (CROAP) (Kahn et Huet) et “Analyse et Optimisation des Algorithmes” (Vuillemin, rejoint par Flajolet). Les Ecoles de Printemps (cf. infra) ont notamment servi a croiser abondamment le “groupe de Paris 7” et le “groupe du bˆatiment 8” (lequel abritait— et abrite encore avec le bˆatiment 11—ces projets—et ceux qui en sont issus). Le projet de Maurice, rebaptis9e “Th9eorie de la Programmation”, durera jusqu’a 1979 (mais il restera conseiller de Lions, puis de son successeur, Alain Bensoussan, jusqu’en 1996). En 1980, l’IRIA prend un “N” (pour National), et, par essaimage, de nouveaux projets collaborant e9 troitement verront le jour, notamment: Formel (Huet), VLSI (Vuillemin), Para (L9evy). 5.2. La cr3eation du LITP Quand Maurice est nomm9e a Paris, c’est encore la Facult9e des Sciences. Il est int9egr9e dans l’Institut de Programmation, structure universitaire cr9ee9 e quelques ann9ees plus tˆot pour compl9ementer le dispositif du Centre de Calcul. Initialement, l’Institut de Programmation devait servir a former les cadres techniques dont le CNRS aurait besoin pour entretenir les parcs de machines naissants. Puis Arsac nomm9e professeur est appel9e a la direction de l’Institut de Programmation au milieu des ann9ees 60. En collaboration avec les deux autres centres informatiques universitaires qui se d9eveloppaient alors a Grenoble (Kuntzman) et Toulouse (Laudet), Arsac obtient la cr9eation d’un cursus national de licence et maˆYtrise en informatique. Les maˆYtrises venaient d’ailleurs d’ˆetre instaur9ees (r9eforme Fouchet). Mais la fondation de Paris 6 et de Paris 7 se pr9epare. Le
P.-L. Curien / Theoretical Computer Science 281 (2002) 3 – 23
13
cursus informatique complet se poursuivra a Paris 6, tandis qu’a Paris 7 l’enseignement de l’informatique commencera sous forme de cours a option pour les e9 tudiants de math9ematiques. Il faudra attendre le milieu des ann9ees 80 pour que Paris 7 se dote a son tour d’une licence et maˆYtrise en informatique. Le groupe form9e par SchButzenbergerNivat-Nolin ira a Paris 7. Une structure CNRS (ERA) est cr9ee9 e autour de ce petit noyau. Le premier budget annuel reScu du CNRS e9 tait de 2000F, ce qui mˆeme pour l’9epoque e9 tait fort peu: de quoi tenir des r9eunions a Fontainebleau... Ce laboratoire ne s’appelait pas encore LITP, mais on pourrait parler d’un “premier LITP”, car pour beaucoup, l’ˆage d’or de ce laboratoire s’identi"e bien avec la d9ecennie 1970. Tous les membres de l’9equipe se r9eunissaient une journ9ee par mois, salle Dussane a l’ENS, et mangeaient ensemble dans un restaurant du quartier. JoProy Beauquier se souvient de la premiere de ces r9eunions: “il y avait une atmosphere extraordinaire et un enthousiasme perceptible”. Dans le mˆeme esprit, Maurice lance les Ecoles de Printemps d’Informatique Th3eorique, qui ont jou9e un rˆole primordial dans la constitution d’un v9eritable r9eseau: ces r9eunions de l’ensemble des informaticiens th9eoriciens une semaine par an dans un lieu agr9eable ont largement contribu9e a souder la communaut9e. Telle e9 tudiante y a trouv9e sa vocation de chercheur, tel autre y a fait ses premieres armes. La convivialit9e, la tres faible moyenne d’ˆage des participants et les multiples libations et plantureux repas ont contribu9e a la cr9eation de la famille! Dans ces occasions, la presse r9egionale est de la partie e9 galement. L’organisation mat9erielle de ces e9 coles a longtemps e9 t9e assur9ee par un professeur de l’ENSTA, Jean-Pierre Crestin. Au moment de renouveler le jeune laboratoire, quatre ans plus tard, Maurice Zuvre a l’9elargir, a"n de r9eunir des th9eoriciens et des programmeurs, r9epartis sur les deux universit9es Paris 6 et 7. Son pari, qui sera gagn9e, e9 tait d’atteindre une meilleure visibilit9e, et aussi de favoriser des rencontres entre th9eoriciens et praticiens de l’informatique (Fig. 1). De fait, le laboratoire est tres rapidement connu en France et dans le monde, et les "nancements publics deviennent plus substantiels. Ainsi est cr9ee9 le LITP (Laboratoire d’Informatique Th9eorique et Programmation, UA 248), en 1975. Maurice en sera le co-directeur jusqu’en 1985, avec Jacques Arsac puis avec Bernard Robinet. La gestion administrative du LITP a e9 t9e assur9ee par Paulette Le Louet depuis le milieu des ann9ee 70 jusqu’a son d9epart a la retraite en 1996. Sa sZur cadette, Nicole Robinet, a un record de long9evit9e plus grand. encore, puisqu’aujourd’hui encore en activit9e a Paris 6, elle est arriv9ee au d9ebut des ann9ees 60 pour assurer le secr9etariat de l’Institut de Programmation naissant. A partir des ann9ees 80, l’histoire du LITP est malheureusement travers9ee de conHits, complexe alchimie d’oppositions de styles, d’orientations, et de comp9etition entre les deux universit9es sur lequel le laboratoire est implant9e. Le LITP a disparu en 1997. Mais le spectre de l’informatique fondamentale, appuy9e sur les deux pˆoles de l’algorithmique et de la programmation, est aujourd’hui en quelque sorte r9eincarn9e a Paris 7, ou ont e9 t9e cr9ee9 s en 1997 le LIAFA (Laboratoire d’Informatique Algorithmique Fondamentale et Appliqu9ee) et en 1999 l’Equipe PPS (Preuves, Programmes et Systemes). Inlassable p9elerin, Maurice oPrira un actif soutien aux partisans de ce renouveau, r9edigeant notamment de sa plume un beau texte a l’appui de la demande de cr9eation du LIAFA.
14
P.-L. Curien / Theoretical Computer Science 281 (2002) 3 – 23
Langages alg3ebriques, Bonascre (J.-P. Crestin et M. Nivat), 1973 Complexit3e des algorithmes, Ile de Berder (Ph. Flajolet), 1974 Mono9:des syntactiques, Vic-sur-Cere (J.-F. Perrot), 1975 S3emantique des langages de programmation, Molines-en-Queyrac (M. Nivat), 1976 S3eries formelles, Vieux-Boucau-les-Bains (J. Berstel), 1977 -calcul, La Chˆatre (B. Robinet), 1978 Th3eorie des codes, Jougne (D. Perrin), 1979 Parall3elisme, Colleville (G. Roucairol), 1980 Langages alg3ebriques, Murol (L. Boasson), 1981 Compilation, Bareges (L. Nolin), 1982 Algorithmique, Ile de R9e (M. Fontet), 1983 Automates et mots in,nis, Le Mont Dore (D. Perrin) 1984 Logique combinatoire et -calcul, Val d’Ajol, (G. Cousineau et P.-L. Curien), 1985 R3eseaux d’automates, Argeles-sur-Mer (C. ChoPrut), 1986 Linguistique et informatique, Ile d’Ol9eron (M. Gross et D. Perrin), 1987 Automates ,nis et applications, Ramatuelle (J.-E. Pin), 1988 Logique et informatique, Albi (B. Courcelle), 1989 S3emantique des syst;emes de processus concurrents, La-Roche-Posay (I. Guessarian), 1990 Math3ematiques et informatique th3eorique, M9ejanes-Le-Cap (S. GrigorieP), 1991 Parall3elisme, Les Sables d’Or les Pins (M. Cosnard et Y. Robert), 1992 R3ee3 criture de termes, Font-Romeu (H. Comon et J.-P. Jouannaud), 1993 Programmation logique avec contraintes, Chatillon-sur-Seine (A. Podelski), 1994 G3eom3etrie et topologie discr;ete, Super Lioran (J.-P. R9eveilles et D. Richard), 1995 Automates cellulaires, Saissac (J. Mazoyer), 1996 Algorithmique, Longefoy (D. Krob et M. Morvan), 1997 Alg;ebres Max-Plus et applications en informatique et automatique, Ile de Noirmoutier (S. Gaubert, J.-J. Loiseau, J. Mairesse, J.-E. Pin), 1998 Codage et cryptographie, Batz-sur-mer (A. Canteaut, C. Carlet, P. Charpin, M. Girault, B. Vall9ee), 1999 Pavages du plan, Branville (B. Durand, M. Nivat, L. Vuillon), 2000 Arithm3etique des ordinateurs, Prapoutel-Les-Sept-Laux (C. Frougny et J.-M. MBuller), 2001 S3emantique des langages de programmation, Agay (P.-L. Curien, V. Padovani, J.-M. RiQet), 2002 Fig. 1. Liste des ecoles de printemps d’informatique th9eorique.
5.3. L’informatique th3eorique europ3eenne Mais revenons au d9ebut des ann9ees 70. Maurice ne d9eborde pas seulement d’activit9e sur la scene nationale. Il va forger des outils essentiels pour la communaut9e de recherche europ9eenne en informatique. Il rencontre le prince Caracciolo di Fiorino, qui Zuvre a l’OCDE et a la Commission Europ9eenne. Il se voit con"er la r9edaction d’un rapport
P.-L. Curien / Theoretical Computer Science 281 (2002) 3 – 23
15
OCDE sur l’Informatique, qui aura la plus grande inHuence ... sur le gouvernement polonais (l’un des premiers pays a adopter le mot informatique, comme dans la revue Fundamentae Informaticae). A Bruxelles, le prince plaidait en vain la cr9eation d’un Institut du Software, mais une id9ee moins ambitieuse eut plus de succes: il suggere a Maurice la cr9eation d’une Association Europ9eeenne d’Informatique Th9eorique, qui serait soutenue par Bruxelles. Il n’y aura pas de soutien de la Commission Europ9eenne, mais l’EATCS (European Association for Theoretical Computer Science) est fond9ee comme association de droit belge. Le groupe fondateur comprend autour de Maurice: Jaco de Bakker, Corrado BBohm, Mike Paterson. Le premier “International Colloquium on Automata, Languages and Programming” (ICALP) est organis9e en 1972 a l’IRIA. Beaucoup de vedettes sont la: Rabin, Paterson, Scott, Meyer, Eilenberg,... . On trouvera plus loin davantage d’informations sur l’EATCS et l’ICALP dans le texte d’Arto Salomaa et Grzegorz Rozenberg. Plus tard, Maurice cr9eera aussi l’Association FranScaise d’Informatique Th9eorique (AFIT), avec l’aide de Paul Gastin et Brigitte Rozoy. 5.4. Naissance de TCS Fruit de conversations avec Inar Fredrikson, e9 diteur chez North Holland, le journal paraˆYt depuis 1976. Dans toute son histoire, il n’a subi que deux attaques, auxquelles il a r9esist9e sans diRcult9e, l’une e9 manant de collegues d’outre-atlantique qui ont d9emarch9e aupres de North Holland pour tenter d’empˆecher la cr9eation d’un tel titre en Europe, et dix ans plus tard de la part de collegues hostiles a l’informatique th9eorique. Nous renvoyons aux e9 ditoriaux de Giorgio Ausiello, Don Sannella et Mike Misolve, et de Maurice Nivat, dans le num9ero 250 de TCS, pour plus d’9el9ements sur la revue et sur sa prodigieuse expansion depuis un quart de siecle. L’inHuence de Maurice sur le milieu international de l’9edition scienti"que d9epasse de beaucoup ce journal (auquel il faut ajouter Science of Computer Programming, un cousin plus orient9e vers la pratique de la programmation, et plus r9ecemment les Electronic Notes in Theoretical Computer Science). Maurice faisait par exemple partie, avec Engeler, Huet, Jouannaud, Milner et Wirsing du Comit9e Editorial de la s9erie Progress in Theoretical Computer Science (Pitman, repris par BirkhaBuser) dirig9ee par le regrett9e Ron Book, grand ami de Maurice. 6. Des langages algebriques a( la semantique Je reprendrai plus loin l’expos9e des r9ealisations de Maurice pour l’informatique franScaise et europ9enne, mais je souhaite ne pas perdre le "l du temps. Parlons donc un peu des travaux scienti"ques de Maurice depuis la "n des ann9ee 60 jusqu’au d9ebut des ann9ees 80. 6.1. Th3eorie des langages Dans sa these, Maurice avait e9 tabli une caract9erisation alg9ebrique des transductions rationnelles. Celle-ci est a la base de nombreux d9eveloppements ult9erieurs de l’“9ecole
16
P.-L. Curien / Theoretical Computer Science 281 (2002) 3 – 23
franScaise” de th9eorie des langages. Les notions de cˆone rationnel et de hi9erarchie sont d9eja la [29]. Peu de temps apres, Maurice entame l’9etude des langages d9e"nis par congruence [17]; cette e9 tude conduira beaucoup plus tard aux travaux de G9eraud S9enizergues (voir la contribution de ce dernier dans ce volume). Un ePort continu est poursuivi par Maurice et ses e9 leves (Luc Boasson, JoProy Beauquier, Jean-Michel Autebert) en vue de comprendre la structure (et notamment les g9en9erateurs [7]) des langages alg9ebriques, ou “context-free”, et menera en particulier a la d9ecouverte d’une mesure de complexit9e remarquable [12] qui a e9 t9e beaucoup utilis9ee. Un expos9e synth9etique d’un certain nombre de ces r9esultats peut eˆ tre trouv9e dans le livre de Jean Berstel [11]. En"n, a la "n des ann9ees 70, et en relation avec le d9eveloppement de ses travaux en s9emantique (cf. infra), Maurice entamera l’9etude des mots in"nis engendr9es par une grammaire alg9ebrique [31]. Il introduit la notion de centre d’un langage et met en e9 vidence les propri9et9es topologiques sous-jacentes. Grˆace a ce foisonnement d’id9ees neuves, la France s’est taill9ee une r9eputation internationale sur ces sujets et bon nombre de chercheurs du domaine lui sont redevables d’id9ees fondatrices dont il est l’auteur. 6.2. De la s3emantique alg3ebrique a; celle du parall3elisme Rappelons que Maurice d9ecouvre les sch9emas de programmes a Colchester. Il e9 tend d’abord un fameux th9eoreme de SchButzenberger, caract9erisant l’ensemble des termes engendr9es par une grammaire alg9ebrique (d’arbres) comme la plus petite solution de cette grammaire, consid9er9ee comme un systeme d’9equations sur les ensembles de termes. Puis il montre que, dans le cas ou la grammaire repr9esente un sch9ema de programme (r9ecursif), cette solution alg9ebrique caract9erise a son tour la s9emantique du sch9ema de programme, au sens ou l’interpr9etation de cette solution coBYncide avec la s9emantique op9erationnelle du sch9ema de programme consid9er9e [30]. Peu a peu se d9egage ainsi la “s9emantique alg9ebrique” [18] (voir aussi l’ouvrage [24] d’Irene Guessarian), qui repose sur la construction d’un objet alg9ebrique in"ni— similaire a l’arbre de BBohm d’un lambda-terme—qui factorise la s9emantique d’un sch9ema de programme. Cet objet alg9ebrique caract9erise ainsi la classe d’9equivalence s9emantique du sch9ema de programme auquel il est associ9e. Ceci permet dans certains cas (sch9emas de programmes “rationnels” par exemple) de donner des algorithmes pour d9ecider de cette e9 quivalence. L’9etude des arbres in"nis—pour eux-mˆemes—culmine avec la these de Bruno Courcelle (voir [19]). Maurice entreprend ensuite de g9en9eraliser ses r9esultats au cas non-d9eterministe. Les diRcult9es s’averent s9erieuses, notamment parce que la s9emantique d9enotationnelle est impuissante a d9e"nir une notion satisfaisante de “power-domain”. En collaboration avec Andr9e Arnold, il introduit alors l’utilisation des espaces topologiques, et plus particulierement des espaces m9etriques [1], a"n de d9e"nir, toujours dans l’esprit du th9eoreme de SchButzenberger—c’est-a-dire par point "xe—, l’objet s9emantique associ9e a un sch9ema de programme non-d9eterministe. Cette faScon de voir la s9emantique, via les espaces m9etriques, dont l’expos9e le plus synth9etique est [33], sera reprise par de nombreux auteurs par la suite, notamment par le groupe de Jaco de Bakker en Hollande.
P.-L. Curien / Theoretical Computer Science 281 (2002) 3 – 23
17
Mais il est juste de dire que le succes ici n’est pas complet, car la coBYncidence avec la s9emantique op9erationnelle (telle que d9e"nie par G9erard Boudol [13] a la suite des travaux de G9erard Berry et Jean-Jacques L9evy [10]) ne subsiste que dans certains cas particuliers. Ce “chapitre” de l’activit9e scienti"que de Maurice se clˆot avec la publication de [34], qui collecte les communications faites a un s9eminaire francoam9ericain tenu a Fontainebleau en 1982. Il va ensuite s’int9eresser a la s9emantique du parall9elisme. L’articulation technique est ici fournie par l’9etude des mots in"nis vus comme des comportements in"nis de processus, qui engendrera de nombreux travaux men9es sous la direction de Maurice: ceux de FranScoise Gire, Daniele Beauquier, Hugues Fauconnier, Paul Gastin, Andreas Podelski. L’activit9e de consultant de Maurice a la Thomson joue aussi un rˆole d9eterminant: au tournant des ann9ees 70=80, Ruggiu organise a Corbeville des r9eunions r9egulieres avec quelques ing9enieurs travaillant sur la programmation des centraux t9el9ephoniques. Ces rencontres ont favoris9e la maturation des travaux de Maurice [32], et—a la suite— d’Andr9e Arnold, sur la synchronisation d’automates. Pour plus de d9etails sur cette p9eriode de l’activit9e de Maurice, nous renvoyons a la contribution d’Andr9e Arnold dans le pr9esent volume. Disons seulement que dans ce domaine, il a e9 t9e en bonne part un pr9ecurseur, faisant du “model-checking” avant l’heure. Il a aussi a cette e9 poque beaucoup discut9e de concurrence avec des chercheurs venus d’horizons pratiques, tels que G9erard Roucairol, que Maurice avait invit9e a fonder une e9 quipe sur le parall9elisme au LITP, ou Jean-Pierre Verjus (Rennes). 7. Travaux d’Hercule En 1982, par l’interm9ediaire de Lions, Maurice est charg9e par Chevenement et Savary, respectivement ministres de la Recherche et de l’Education, de la r9edaction d’un rapport sur la "liere e9 lectronique. Cette tˆache prendra pres d’un an. Maurice consulte beaucoup. La rapport s’intitule “Savoir et Savoir-faire en Informatique”. Lorsqu’il est termin9e, Fabius a succ9ed9e a Chevenement, a la tˆete d’un ministere de la Recherche et de l’Industrie. Maurice ira tout de mˆeme pr9esenter son rapport a Chevenement, lequel, tout a sa libert9e politique retrouv9ee, lui oPrira en tˆete-a-tˆete un long et impressionnant discours de g9eopolitique. Fabius propose a Maurice de pr9esider le Conseil Scienti"que du Programme Mobilisateur de la Filiere Electronique. Maurice met en place les Programmes de Recherche Coordonn9es (PRC), qui seront pendant quelques ann9ees richement dot9es et donneront un fantastique coup de fouet a la recherche franScaise. Dans les domaines qui nous sont proches, les projets suivants se d9eploient: • Programmation (Robert Cori), • Math9ematiques pour l’Informatique (Dominique Perrin, puis Philippe Flajolet). • C3 (Coop9eration, Concurrence, Communication) (Jean-Pierre Verjus). • BD3 (Bases de donn9ees) (Delobel). • Informatique linguistique (Maurice Gross). C’est aussi a ce moment qu’intervient la "n du monopole de Bull, qui empˆechait les laboratoires de s’acheter des machines Unix. Les PRC ont permis l’achat des premiers VAX, qui e9 taient des machines coˆuteuses. Toutes les e9 quipes utilisaient la mˆeme ma-
18
P.-L. Curien / Theoretical Computer Science 281 (2002) 3 – 23
chine a travers le r9eseau TRANSPAC (qui venait d’ˆetre mis en service), ce qui a contribu9e a faire nouer des collaborations et a souder des communaut9es. Ce travail important et pro"table se d9eroulait ind9ependamment d’une p9erip9etie grandiloquente, le Centre Mondial de l’Informatique, lubie d’un journaliste politicien, JeanJacques Servan-Schreiber, qui prenait son essor sous de hautes protections politiques (DePerre, Mitterrand). Appel9es en gourous, Seymour Papert (ancien th9eoricien des langages formels devenu apˆotre de l’IA au MIT) et Raj Reddy (directeur du Centre de Robotique de CMU) promettaient la suppression des universit9es, ou ce qui revient au mˆeme leur distribution sur les plus in"mes coins du territoire ou les villages de la brousse africaine, tout le savoir pouvant eˆ tre enferm9e sur un disque dur, et pouvant eˆ tre interrog9e interactivement. Henri Emmanuelli se porte candidat pour les Landes! 8. Pavages et tomographie discr(ete D9echarg9e en 1985 de ses responsabilit9es nationales, Maurice se remet a la recherche. Il garde un int9erˆet pour les langages d’arbres et pour la concurrence. Mais surtout, il d9ecide une nouvelle fois d’inH9echir—plus radicalement sans doute cette fois—son domaine de recherche, et va s’int9eresser aux objets g9eom9etriques discrets, et notamment aux problemes de pavage qui le fascinent [23,22]. Il suit les travaux de plusieurs jeunes chercheurs sur ces sujets: Alain Daurat, Yann G9erard, Laurent Vuillon. Un de ses anciens e9 tudiants, Ahmed Saoudi, malheureusement d9ec9ed9e depuis, l’a beaucoup pouss9e dans cette direction. 8.1. Pavages Avec Daniele Beauquier, Maurice se pose la question suivante: est-il d9ecidable de savoir si un nombre "ni de polyominos forme un code plan? La r9eponse, n9egative, qu’ils obtiennent vers 1993–1994, sera longue a trouver, et doit encore eˆ tre publi9ee. Dans [8], ces deux auteurs s’attaquent au probleme du pavage du plan par translation d’une seule piece. Ils montrent que de tels pavages sont possibles si et seulement si la piece est un pseudo-hexagone, et que tout tel pavage est semi-p9eriodique (c’est-a-dire invariant par certaines translations). Beauquier et Nivat ont ainsi trouv9e une famille int9eressante et d9ecidable de problemes de pavage. Dans [9], Maurice et ses coauteurs montrent la NP-completude des pavages par des dominos horizontaux et des trominos verticaux, et plus generalement pour toute paire de barres dont l’une a une longueur sup9erieure a deux 2. D’autres r9esultats dans la mˆeme veine ont e9 t9e obtenus r9ecemment par Moore et Robson [27]. 8.2. Tomographie discr;ete Maurice est aussi l’un des pionniers de la tomographie discrete, dont l’objet est de reconstruire un objet discret a partir de projections [25]. Il s’est int9eress9e au probleme de la reconstruction de matrices binaires a partir d’un nombre "ni de “radiographies discretes”, c’est-a-dire de projections sur certaines lignes compt9ees avec des
P.-L. Curien / Theoretical Computer Science 281 (2002) 3 – 23
19
multiplicit9es. Le cas de deux projections (horizontale et verticale) a e9 t9e le plus e9 tudi9e. Des r9esultats d’existence et d’unicit9e sont connus [35]. Mais comme le nombre de solutions peut eˆ tre tres e9 lev9e en g9en9eral, les chercheurs du domaine se sont int9eress9es a des cas particuliers. Dans [5,6], Maurice, en collaboration avec Elena Barcucci, Alberto Del Lungo et Renzo Pinzani, donne des algorithmes polynomiaux pour la reconstruction de matrices binaires ayant des propri9et9es de convexit9e et/ou connexit9e. Ces travaux, dont une synthese est pr9esent9ee dans [20], ont e9 t9e prolong9es par plusieurs auteurs [3,15,16]. Le probleme de la reconstruction de matrices binaires a partir de trois projections ou plus est NP-complet [21]. Maurice et ses coauteurs ont trouv9e une classe de polyominos (convexes et connexes, toujours) pour lesquels la reconstruction peut se faire en temps polynomial [4]. Une extension de ces r9esultats aux treillis convexes est donn9ee dans [14]. La tomographie discrete est un sujet relativement r9ecent, riche d’applications et activement e9 tudi9e, que Maurice contribue a promouvoir. Au cours des dernieres ann9ees, il a organis9e deux colloques avec Peter Gritzmann: Workshop on Discrete Tomography: Algorithms and Complexity (Dagstuhl, 1997) et Workshop on Discrete Tomography and Related Problems (Nancy, 1999). 9. Un homme de conviction Ainsi arriv9e au terme de ce bref survol d’une carriere qui n’est pas "nie—car je forme le vZu que Maurice ait une retraite des plus actives—, je voudrais laisser la parole aux collegues et amis—les deux se confondent souvent, tant Maurice a su chaleureusement accueillir et admettre dans sa famille les nombreux collegues avec lesquels il a e9 tabli des relations de con"ance et d’estime—qui m’ont fait parvenir leurs t9emoignages sur leurs rencontres avec Maurice. Ce qui suit est principalement le fruit d’une synthese anonyme de leurs propos, dont j’espere ne pas avoir trahi l’esprit. D9ebarrassons-nous d’abord des ombres au tableau. Les relations de Maurice avec quelques collegues et amis, tout comme sa vie personnelle, ont e9 t9e travers9ees d’9episodes diRciles, ins9eparables d’une personnalit9e complexe et attachante, que rien n’9evoque sans doute mieux que de longs silences de Maurice au milieu d’une conversation t9el9ephonique, nocture de pr9ef9erence! Au total, il faut surtout saluer une activit9e d9ebordante, une vaste imagination, une inlassable curiosit9e, et ... un solide sens de l’humour. Maurice a d9eploy9e des ePorts constants pour diPuser sa vision de l’informatique: discipline scienti"que a part entiere et devant construire ses fondations. Son passage a Grenoble et a Rennes lui a montr9e l’importance de cette “mission”. Il faut se souvenir qu’au d9ebut des ann9ees 70, en France, certains universitaires informaticiens des gros centres de province d9efendaient une informatique “pratique” qui leur servait a justi"er une absence de d9emarche scienti"que. La cr9eation du LITP n’est pas all9ee tout-a-fait de soi au CNRS. En 1983, il arrive encore qu’un th9esard du LITP puisse eˆ tre mal reScu dans un laboratoire d’informatique, sur la seule base de son appartenance au “laboratoire de Nivat”! Le m9erite de Maurice est d’avoir compris qu’il fallait non seulement “produire” des gens qui auraient cette vision de l’informatique et propageraient la “bonne parole”, mais aussi trouver au sein des groupes existants les gens qui comprendraient les enjeux
20
P.-L. Curien / Theoretical Computer Science 281 (2002) 3 – 23
scienti"ques et la n9ecessit9e de sortir de cette d9efense et illustration d’une “informatique pratique a la franScaise” a"n d’ˆetre pr9esent sur la scene scienti"que internationale. Maurice ne s’est pas content9e de d9efendre et diPuser ses convictions aupres des praticiens. Il a aussi constamment plaid9e parmi les th9eoriciens pour l’ouverture vers les applications ou vers de nouveaux champs a explorer. Si le lecteur n’en e9 tait pas encore convaincu, on pourrait encore noter l’int9erˆet de Maurice pour les rapports entre informatique et culture (habilitation de Philippe Aigrain), qui a sans doute pour racine sa passion pour le patrimoine rural ou l’arch9eologie industrielle. Les liens profonds que Maurice a nou9es avec Louis Nolin des le d9ebut de sa carriere ont certainement contribu9e a cr9eer les conditions pour la maturation d’un aussi remarquable spectre scienti"que. Maurice aura ainsi e9 tendu son “9ecole humaine”, pour reprendre le titre d’une section de ce texte (que je dois a Jean Vuillemin), jusqu’a: • Toulouse. Des chercheurs du LITP y ont longtemps donn9e des cours de DEA, qui ont engendr9e des theses (FranScois Rodriguez, Patrick Sall9e, Jean-Louis Durieux,...). Jean Vignolle—qui a travaill9e sur la premiere machine franScaise: le GAP 500—a encourag9e et supervis9e cet apport. • Lille (Dauchet, Arnold, Latteux, Comyn, Jacob). Ici, l’initiative revient a Andr9e Arnold et Max Dauchet, qui forment en 1974 un groupe de travail sur les langages d’arbres, et r9ealisent bientˆot que Maurice travaille d9eja dans ce domaine. Il devient leur directeur de these. Il leur suggere d’organiser un colloque a Lille sur les arbres en algebre et en programmation, qui a ePectivement eu lieu en f9evrier 1976. C’9etait le premier CAAP, qui s’est tenu a Lille pendant une demi-douzaine d’ann9ees, puis dans toute l’Europe. Le CAAP a v9ecu 20 ans, son h9eritier est FOSSACS. • Nancy: ici, il s’agit surtout de nombreux contacts et e9 changes (Jean-Pierre Jouannaud, Claude et H9elene Kirchner, Pierre Lescanne). • Et, via des chercheurs de l’9ecole parisienne nomm9es en province: Amiens (Boasson, aujourd’hui professeur a Paris 7), Bordeaux (Cori, puis Courcelle, puis Arnold), Poitiers (Arnold), Rennes (Kott), Rouen (Perrin, aujourd’hui professeur a Marne-laVall9ee). Notons que le contexte e9 conomique ou reglementaire peut donner un coup de pouce a d’exemplaires mouvements. Ainsi, cet essaimage vers la province doit un peu au premier choc p9etrolier, qui a engendr9e une grande p9enurie de postes, poussant des gens qui ne l’auraient peut-ˆetre pas souhait9e a s’9eloigner de la capitale. Dans un autre ordre d’id9ee, j’ai pu constater le rˆole de l’anti-militarisme dans les vocations vers la "n des ann9ees 60 et le d9ebut des ann9ees 70. Quelques polytechniciens sont arriv9es vers l’informatique en b9en9e"ciant de la “botte recherche”, une disposition qui a l’X permettait entre autres d’“9echapper” au service militaire en allant faire de la recherche! A cette liste, on peut ajouter l’Ecole Normale Sup9erieure de Lyon, ou Maurice fait de multiples s9ejours au d9ebut des ann9ees 90, et noue de nombreux contacts (Mazoyer, Durand, Remila). Maurice a depuis longtemps une vision a long terme de la recherche en informatique, et une compr9ehension remarquable de l’importance relative des r9esultats scienti"ques. Il sait d9etecter les talents et a toujours cherch9e a permettre a de jeunes chercheurs de d9evelopper leurs propres travaux. Il a su faire se rencontrer beaucoup de gens a
P.-L. Curien / Theoretical Computer Science 281 (2002) 3 – 23
21
l’9echelle franScaise et leur faire rencontrer beaucoup d’9etrangers, et construire ainsi un tissu de relations qui a aid9e l’informatique franScaise a rattraper les centres d’excellence comme Edimbourg. Il a constamment cherch9e a e9 largir les domaines de recherche de son entourage, en commenScant par lui-mˆeme. Il n’a eu de cesse de sensibiliser la communaut9e scienti"que autant que les d9ecideurs aux enjeux e9 conomiques ou sociaux de l’informatique. Mais il n’a pas toujours pu assez faire entendre les points de vue dont il e9 tait porteur. Ce n’est pas faute d’y avoir travaill9e, pendant des ann9ees! Appel9e de nouveau par le Ministere charg9e de la Recherche a pr9esider l’Observatoire de la Recherche en Informatique en France, il d9epensera beaucoup d’9energie en 1993 et 1994 a coordonner les travaux d’une vingtaine d’experts chercheurs et industriels, y d9eployant tout le talent de sa belle plume, tout cela pour un rapport si vite enterr9e... Aujourd’hui comme hier, Maurice regrette que les politiques et les grands industriels n’aient pas d9eploy9e les ePorts suRsants pour cr9eer une puissante industrie informatique nationale ou europ9eenne. On se souviendra par exemple de la SM90, dont quelques dizaines d’exemplaires furent produits au d9ebut des ann9ees 80. Une belle architecture, initialement conScue au CNET. La machine aurait pu rivaliser avec le SUN, mais il aurait fallu y mettre dix fois plus de personnes... Notons tout de mˆeme, sur une note plus optimiste, que l’9equipe gouvernementale suivante a reconnu au tournant du mill9enaire l’importance du secteur des STIC (Sciences et Technologies de l’Information), et s’emploie a compenser ce r9eveil tardif par une impulsion forte en termes de programmes et de moyens humains, cr9eant notamment des postes de chercheurs en nombre important dans ce secteur, a l’INRIA et au CNRS, dot9e d’un nouveau d9epartement des Sciences et Technologies de l’Information. Maurice est, en"n, un grand voyageur. Il est impossible de faire la liste de tous les pays qu’il a visit9es. Mentionnons ici seulement ses liens nombreux et "deles avec l’Italie, l’Inde, le Japon, et plus r9ecemment le Chili.. Ainsi s’acheve cette courte et donc bien partielle promenade dans la carriere de Maurice Nivat. Mes remerciements iront d’abord a lui pour ce que je lui dois en g9en9eral, et pour les e9 l9ements de son histoire qu’il a bien voulu me communiquer au cours de deux longues conversations, qui ont fourni la matiere d’une bonne partie de ce texte. Je remercie aussi tous les collegues qui m’ont aid9e dans cette modeste entreprise de m9emoire. Apres une trentaine d’ann9ees d’existence, il reste a souhaiter longue vie a l’informatique fondamentale, science du logiciel, ouverte sur les autres disciplines (biologie, linguistique,...) et les applications, et appuy9ee sur les math9ematiques (algebre, logique, g9eom9etrie), assez inventive cependant pour relever de nouveaux d9e"s comme celui de la programmation distribu9ee et de l’internet, pour lesquels les math9ematiques n’ont pas plus pr9epar9e d’outils tout faits que lorsque les pionniers de la th9eorie des automates, de la s9emantique d9enotationnelle, des calculs de processus ou de l’algorithmique ont commenc9e d’apporter leurs pierres a l’9edi"ce des fondements de l’informatique. References [1] A. Arnold, M. Nivat, Formal computations of non-deterministic recursive program schemes, Math. Systems Theory 13 (1980) 219–236. [2] J. Arsac, A. Lentin, L. Nolin, M. Nivat, Algol, th9eorie et pratique, Gauthier-Villars, 1965.
22
P.-L. Curien / Theoretical Computer Science 281 (2002) 3 – 23
[3] E. Balogh, A. Del Lungo, C. D9ev9enyi, A. Kuba, Comparison of algorithms for reconstructing hv-convex discrete sets, Linear Algebra Appl., to appear. [4] E. Barcucci, S. Brunetti, A. Del Lungo, M. Nivat, Reconstruction of lattice sets from their horizontal, vertical and diagonal X-rays, Disc. Math., to appear. [5] E. Barcucci, A. Del Lungo, M. Nivat, R. Pinzani, Reconstructing convex polyominoes from their vertical and horizontal projections, Theoret. Comput. Sci. 155 (1996) 321–347. [6] E. Barcucci, A. Del Lungo, M. Nivat, R. Pinzani, Medians of polyominoes: a property for the reconstruction, Internat. J. Imaging Systems Technol. 8 (1998) 69–77. [7] J. Beauquier, G9en9erateurs alg9ebriques et paires it9erantes, Theoret. Comput. Sci. 8 (1979). [8] D. Beauquier, M. Nivat, Tiling the plane with one tile, Symp. on Computational Geometry, 1990, pp. 128–138. [9] D. Beauquier, M. Nivat, E. Remila, M. Robson, Tiling "gures of the plane with two bars, Comput. Geometry Theory Appl. 5 (1) (1995) 1–25. [10] G. Berry, J.-J. L9evy, Minimal and optimal computations of recursive programs, JACM 26 (1979) 148–175. [11] J. Berstel, Transductions and context-free languages, Teubner (1979). [12] L. Boasson, B. Courcelle, M. Nivat, A new complexity measure for languages, Conf. on Theoretical Computer Science, 1977. [13] G. Boudol, Computational semantics of term rewriting systems, in: M. Nivat, J. Reynolds (Eds.), Algebraic Methods in Semantics, Cambridge University Press, Cambridge, 1985. [14] S. Brunetti, A. Daurat, Reconstruction of discrete sets from two or more projections in any direction, Proc. of the Seventh International Workshop on Combinatorial Image Analysis (IWCIA 2000), Caen, 2000, pp. 241–258. [15] S. Brunetti, A. Daurat, A. Del Lungo, An algorithm for reconstructing special lattice sets from their approximate X-rays, Lecture Notes in Computer Science 1953, 9th Conf. on Discrete Geometry for Computer Imagery (DGCI00), Uppsala, Sweden, 2000, pp. 113–125. [16] M. Chrobak, C. DBurr, Reconstructing hv-convex polyominoes from orthogonal projections, Inform. Process. Lett. 69 (6) (1999) 283–289. [17] Y. Cochet, M. Nivat, Une g9en9eralisation des ensembles de Dyck, Israel J. Math. 9 (1971). [18] B. Courcelle, M. Nivat, The algebraic semantics of recursive program schemes, Proc. 7th MFCS, Lecture Notes in Computer Science, Vol. 64, Springer, Berlin, 1978, pp. 16 –30. [19] B. Courcelle, Fundamental properties of in"nite trees, Theoret. Comput. Sci. 25 (1963) 95–169. [20] A. Del Lungo, N. Nivat, Reconstruction of connected sets from two projections, Chap. 7 (Foundations), in: G.T. Herman, A. Kuba (Eds.), Discrete Tomography: Foundations, Algorithms and Applications, Birkhauser, Boston, Cambridge, MA, 1999. [21] R.J. Gardner, P. Gritzmann, D. Prangenberg, On the computational complexity of reconstructing lattice sets from their X-rays, Discrete Math. 202 (1999) 45–71. [22] S.W. Golomb, Polyominoes: Puzzles, Patterns, Problems, and Packings, Academic Press, Princeton, 1996. [23] B. Grunbaum, G.C. Shepard, Tilings and patterns, W. H. Freeman and Company, New York, 1986. [24] I. Guessarian, Algebraic Semantics, Lecture Notes in Computer Science, vol. 99, Springer, Berlin, 1981. [25] G.T. Herman, A. Kuba (Eds.), Discrete tomography: Foundations, Algorithms and Applications, Birkhauser, Boston, Cambridge, MA, 1999. [26] S.C. Kleene, Representation of event nets and "nite automata, in: C.E. Shannon, J. MacCarthy (Eds.), Automata Studies, Princeton University Press, Princeton, NJ, 1956, pp. 3–42. [27] C. Moore, M. Robson, Hard tiling problems with simple tiles, Discrete Comput. Geometry, to appear. [28] M. Nivat, Transductions des langages de Chomsky, Ann. Inst. Fourier 18 (1968) 339–455. [29] M. Nivat, These d’Etat mim9eographi9ee, Chap. VI, 1966. [30] M. Nivat, On the interpretation of recursive polyadic program schemes, Symp. Mathematica, vol. XV, Istituto di Alta Mathematica, Bologna, 1975, pp. 255 –281. [31] M. Nivat, Sur les ensembles de mots in"nis engendr9es par une grammaire alg9ebrique, RAIRO Inform. Th9eor. 12 (1979). [32] M. Nivat, Sur la synchronisation des processus, Rev. Tech. Thomson-CSF 11 (1979) 899–919. [33] M. Nivat, In"nite words, in"nite trees, in"nite computations, Math. Cent. Tracts 109 (1979) 1–52.
P.-L. Curien / Theoretical Computer Science 281 (2002) 3 – 23
23
[34] M. Nivat, J. Reynolds (Eds.), Algebraic Methods in Semantics, Cambridge University Press, Cambridge, 1985. [35] H. Ryser, Combinatorial mathematics, The Carus Math. Monographs, Vol. 14, Mathematical Association of America, 1963. [36] C.G. Squier, Word problems and a homological "niteness condition for monoids, J. Pure Appl. Algebra 49 (1987) 201–217.
Theoretical Computer Science 281 (2002) 25 – 30
www.elsevier.com/locate/tcs
ICALP, EATCS and Maurice Nivat Grzegorz Rozenberga; b; ∗ , Arto Salomaac a Leiden
Institute of Advanced Computer Science (LIACS), Leiden University, Niels Bohrweg 1, 2333 CA Leiden, The Netherlands b Department of Computer Science, University of Colorado at Boulder, Boulder, CO 80309, USA c Turku Centre for Computer Science (TUCS), Lemmink* aisenkatu 14A, 20520 Turku, Finland
Abstract The purpose of this writing is to tell something about the quite unique and fundamental role of Maurice Nivat, both in launching ICALP and EATCS, as well as in guiding them through the di/cult early stages. Our account is based on personal recollections, as well as some original documents and letters. To preserve the personal character of our recollections, we have not tried to 2ll the gaps in our information through other channels such as interviewing some of the people involved. In other words, our personal account is not intended to be a comprehensive c 2002 Elsevier Science B.V. All rights reserved. history. It only tells how things seemed to us.
1. ICALP In our days it is hard to visualize any more the scienti2c landscape and academic surroundings in the early 1970s in 2elds now referred to as computer science. Everything was rather unorganized and scattered. Automata theory was already very advanced. On the other hand, what was labeled as theoretical computer science or theoretical informatics varied enormously and could be, for instance, numerical analysis or some parts of theoretical physics. Maurice Nivat apparently wanted to have some order and uniformity, and was also very successful in his e8orts to achieve this goal. The impact of his work was by no means restricted to Europe, since both ICALP and EATCS were quite international from the very beginning. Both writers of this account knew already in summer 1971 that a big International Colloquium on Automata, Languages and Programming was coming up in Paris the following summer 1972. Later on, Maurice Nivat wrote to Arto Salomaa in a letter dated November 7, 1971: ∗
Corresponding author. Tel.: +31-71-277-063; fax: +31-71-276-985. E-mail addresses:
[email protected] (G. Rozenberg),
[email protected] (A. Salomaa).
c 2002 Elsevier Science B.V. All rights reserved. 0304-3975/02/$ - see front matter PII: S 0 3 0 4 - 3 9 7 5 ( 0 2 ) 0 0 0 0 5 - 1
26
G. Rozenberg, A. Salomaa / Theoretical Computer Science 281 (2002) 25 – 30
Dear Arto, At last you will receive very soon a number of call for papers for the colloquium that SchCutzenberger and myself organize in IRIA next July (3–7). Will you be so kind as to spread these call for papers among your students, friends and colleagues whom you think may be interested by this colloquium. The program committee is composed, beside yourself, SchCutzenberger and myself of S. Eilenberg, S. Ginsburg, M. Rabin, A. van Wijngaarden, P. Fischer, D. Park, G. Hotz, C. Boehm and L. Nolin. Our work in choosing the papers to be presented at the conference will take place in April. I con2rm that your travel and stay expenses will get paid by IRIA when, which I hope, you come in July. . . . The letter continues with other matters. Clearly, both the schedule for submitting the papers and the schedule of the Program Committee were very tight. For most of the committee members, the work in April was by mail. Everybody in the committee received all the submitted papers. It is needless to emphasize that mail here refers to ordinary mail! Maurice Nivat apparently did all the heavy work. The scienti2c success of the conference is well known. It was a big success also socially and initiated the friendly and leisurely atmosphere characteristic of so many later ICALP’s. The program of the excursion was printed as follows. Chantilly: The castle and the gardens Senlis: 10th century old little town Royaumont: Vestiges of a beautiful mediaeval abbey Dinner: Refectory of the Abbey There was also a formal reception and dinner for the dignitaries, with the following invitation: A l’occasion du Colloque sur la ThKeorie des Automates, des Langages, et de la Programmation Messieurs M. Nivat, L. Nolin et M.P. Sch*utzenberger recevront Monsieur et Madame . . . le Mardi 4 Juillet. Time and place were indicated separately. Still two important facts should be mentioned. • As far as we know, the Paris ICALP in 1972 was not intended to start a series of conferences. A somewhat similar meeting took place in Haifa in 1971, with no direct continuations. • EATCS did not yet exist. Only later ICALP became the annual conference of EATCS. In the 2rst ICALP’s the procedures (program committee methods, etc.) and time schedules worked on an ad hoc basis. Only gradually things started to become more systematic. As far as we know, Maurice Nivat carried alone the responsibility of keeping ICALP going during the early years. He came to talk to Arto Salomaa during the Oberwolfach meeting in November 1975, asking whether it was possible to organize ICALP in Turku. This was the beginning of ICALP-77. It is well known that ICALP took place only every second year until 1976; after that it has been every year.
G. Rozenberg, A. Salomaa / Theoretical Computer Science 281 (2002) 25 – 30
27
2. EATCS Maurice Nivat was the driving force in creating the European Association for Theoretical Computer Science, as well as getting new members and keeping the association alive in the early days. (Also the French name Association Europ;eenne d’Informatique Th;eorique appeared in the original stationery, and was the main name in the 2rst Bulletin.) Since we have quite much original material, we will rely on many quotations in the sequel. The whole story is actually told in the following letter by Maurice Nivat. It has no date but was obviously written some time in 1972. Dear Colleague, This letter is an invitation to join the young European Association for Theoretical Computer science. Let me begin with some history: in January 1972 a small meeting was held in the building of the European Communities Commission; M. Caracciolo chaired a discussion between a few computer scientists from six countries known for their theoretical work. First, a text written by the members of the University of Paris VII who were present at the meeting was presented and discussed; this text aimed at the de2nition of what can be called Theoretical Computer Science, i.e. the chapter of Computer Sciences which uses mathematical and logical tools to clarify and study the notion of computation. The principal subchapters would be: • Theory of algorithms and complexity • Theory of automata and formal languages • Theory of programming (formal semantics) but this list is certainly not complete. At the time the creation of a European Association was proposed, to promote the development of this 2eld by organizing meetings, exchanges of researchers, professors and students, and by increasing the communication of all sorts of information (it is rather di/cult to know what happens in a 2eld which changes completely in one year if one considers that two years are necessary for the publication of a paper in a journal). An original feature of this association would be to accept both individual members, known scientists working in the 2eld, and institutional members, University departments, research laboratories or any other organization interested in the development of Theoretical Computer Science. It appeared that the Belgian law on scienti2c association allows such a mixture of two kinds of members and more generally o8ers very liberal and Mexible possibilities. This is why, after some months of work, essentially done by our 2rst temporary President M. Sintzo8, statutes were written according to this law and the Belgian authorities were asked to create such an association. It was necessary that some people should act as founding members and share the 2rst responsibilities. These people are: L. Verbeek (President), M. Paterson and M. Paul (Vice-Presidents), M. Sintzo8 (Treasurer), M. Nivat (Secretary), J. de Bakker and G. Ausiello.
28
G. Rozenberg, A. Salomaa / Theoretical Computer Science 281 (2002) 25 – 30
Obviously these people were designated only by chance and each of them represents only himself. And no less obviously, this association will play the role we wish it to play, in the development of the 2eld, only if a large part of the scientists working in this 2eld become members. It is therefore very important that you agree to increase the membership of this association and that, together with the founding members, you not only work to make the association viable but also help in the de2nition of its scope, aims, composition and means of action. The temporary o/cers of the association look forward to your active participation. I cannot indeed tell you much about future activities, which will depend on you and all the people who receive this letter. M. Paterson has generously o8ered the University of Warwick as the location for a necessary General Assembly, and at the same time an informal colloquium which will be the 2rst scienti2c activity of the association. This will take place in March 1973. We have also discussed the idea of a journal or periodic letter to convey information among members (and non-members!). Suggestions concerning this and other actions will be most welcome, in particular an early priority is to assure the 2nancing of our activities. The enclosed copy of the statutes will help you to get a better idea what we are looking for and, I hope, will give you strong reasons to join our common e8ort. Yours sincerely, M. Nivat Together with the letter also a French copy of it was sent, as well as a copy of the Statutes, only in French. The letter tells the early history in quite a detailed manner. Between the lines one can read how Maurice Nivat was involved in everything. The Statutes, very formal law text, do not give much information that would interest us today. The Council was supposed to have between seven and 2fteen members, and the Board (President, two Vice-Presidents, Treasurer, Secretary) was supposed to contain one Belgian member. There were two types of members: personnes morales and personnes physiques. We might easily go wrong if we try to translate these terms! The 2rst General Assembly of EATCS took place at the University of Warwick on March 24–26, 1973. We mention two points from the invitation letter by Mike Paterson to this meeting. • If you would like to talk (in any language you like), please send me a title and a time estimate immediately. I can guarantee you a room and a blackboard but not, of course, an audience. • If you let us know your time of arrival in advance we can meet you either at Birmingham Airport or Coventry Station. Wave a magnetic tape or carry a Turing machine for identi2cation. After Nivat was elected the 2rst (real) President of EATCS in Warwick, he was very active. Some of the matters are described in the following two letters. The 2rst one is written to Arto Salomaa on November 8, 1973.
G. Rozenberg, A. Salomaa / Theoretical Computer Science 281 (2002) 25 – 30
29
Dear Arto, Thank you both for your acceptance to become an editor of the Journal of Theoretical Computer Science and the text you sent me for the Bulletin of the European Association of the same name. You are the 2rst and only one to send some things about TCS to be published! I write you in connection of our Association precisely: in our last meeting in Hamburg we expressed the wish to have you, Z. Manna and E. Engeler 2ll the three empty seats left in the council. I do hope you can accept that too, since it will not be a big burden. We expect to hold the next meeting of the council in SaarbrCucken during the course on theory of programming in late February. . . . Best regards to your wife and you, M. Nivat The EATCS Council consisted by the end of 1973 of the following members: G. Ausiello, C. Boehm, W. Brauer, J. de Bakker, E. Engeler, Z. Manna, B. Mayoh, R. Milner, M. Nivat, M. Paterson, J.F. Perrot, A. Salomaa, D. Scott, M. Sintzo8, L. Verbeek. The second letter we would like to quote is dated December 20, 1973, and was sent to the Council members. Dear Colleague, This is to inform you about our Association EATCS. 1. The 2rst issue of the bulletin is being printed in IRIA and will be distributed in January. It contains about 20 pages mainly informations about Theoretical Computer Science in Holland (furnished by J. de Bakker), in Torino (furnished by C. Boehm) and in the University of Paris VI (furnished by J.F. Perrot). This is completed by various announcements of forthcoming events, an account written by A. Salomaa of the MFCS Conference in the High Tatras, the accounts of the two council meetings held in Warwick and Hamburg written by B. Mayoh and an editorial by me. I believe we should all think about the next issue and also about whom to send this 2rst issue to. People will, I think, be encouraged to become members when they see this bulletin, and for this reason we should spread widely this 2rst issue. 2. The next meeting of the council will be held in the Institut fCur Informatik of SaarbrCucken on Saturday February 23rd at 14.30. The main point on the agenda is the organization of a working conference in 1975: I expect de2nite proposals to be made by C. Boehm. Another point is the cooperation with SIGACT: I started talking about it with Michael Harrison and I hope that I’ll be able to make, on this point too, de2nite proposals. I wish you all a merry christmas and happy new year. Best regards, M. Nivat P.S. Though it no longer interests directly EATCS, I’ll give in SaabrCucken information about the journal Theoretical Computer Science created by North Holland. Let me say now that the negotiations progressed favorably and the creation of
30
G. Rozenberg, A. Salomaa / Theoretical Computer Science 281 (2002) 25 – 30
the journal will be announced very likely in January for a 2rst issue to appear in October. The suggestion about cooperation with SIGACT was responded very positively by Michael Harrison: We look forward to a collaboration with you which should be very bene>cial to both groups. Explicitly, Harrison proposed reduced registration fees and an exchange of Newsletters. It was also clear in early 1974 that EATCS will sponsor the SaarbrCucken ICALP in summer 1974. However, ICALP was not yet speci2ed as the conference of EATCS. Sometimes the going apparently seemed rough to Nivat. The tone of his letter dated January 17, 1974, is quite frustrated. The shipment of the 2rst issue of the Bulletin was delayed very much because of a major postal strike in France. Very few contributions arrived, at a very slow pace, for the second issue, and the printing took long. The whole letter begins with a remark: This is a suggestion to keep our association alive. (The actual suggestion was to combine the membership fee with a subscription of TCS.) But everything worked out 2ne. When we 2nally received the 2rst issue of the EATCS Bulletin, we could read in the editorial: A last word on the scope of Theoretical Computer Science: a general agreement was reached to consider as the major points of Theoretical Computer Science the following 2elds of interest. • Theory of Automata • Formal Languages • Algorithms and their complexity • Theory of programming, if such a thing exists: we may now consider as chapters of this theory formal semantics, proving properties of programs, and all applications of logical concepts and methods to the study and design of programming languages. The list is by no means limitative: de2ning the limits of Theoretical Computer Science is at least as di/cult as de2ning the limits of Computer Science itself. And we strongly believe that a science is what the scientists at work make it: certainly new areas of Computer Science will be open to theory in a very near future. Let us start small and grow: we are sure many of you will help to achieve this necessary growth up to the point where our Association will be a natural link between all European Theoretical Computer Scientists. M. Nivat PrKesident de l’EATCS We started small and grew. Besides ICALP and EATCS, numerous subsequent conferences and associations carry on the work. We are convinced that the entire Theoretical Computer Science community will join our acknowledgement: Thanks, Maurice, for what you gave us!
Theoretical Computer Science 281 (2002) 31 – 36
www.elsevier.com/locate/tcs
Nivat’s processes and their synchronization Andr%e Arnold Universite de Bordeaux I, LABRI, CNRS UMR 5800, 351 cours de la Liberation, F-33405 Talence, France
Abstract This short paper retraces how the notion of synchronization of processes introduced by Maurice c 2002 Elsevier Science B.V. All rights Nivat in 1979 has evolved over more than 20 years. reserved.
At the end of the 1970s, Maurice Nivat took interest in the semantics of parallel and concurrent systems. With G. Ruggiu of the Laboratoire central de recherches of the French company Thomson-CSF, he organized a joint seminar on this topic. That is why his seminal paper on the synchronization of processes [14] appeared in a technical journal of this company and, therefore, was unfortunately not widely known. An extended version of this paper [15] was published in a yet more con;dential place. However, the ideas expressed in these papers have made their way; for instance, they are implemented in the model-checker MEC [4] and are the basis of the AltaRica formalism [6]. In this paper, we wish to explain how these ideas have evolved along time and to compare them with some other similar ideas. In [14], a process is de;ned as a set of in;nite sequences of actions or events. Each action or event is denoted by a letter from an alphabet A, so that a process is de;ned as a set of in;nite words over A. It appeared very soon that this de;nition was not general enough, in particular, because it did not include the notion of a deadlocking process, which was nevertheless considered as a very important notion in the last part of the paper. Therefore, in [15], a process is de;ned as a triple of languages over A: the set of in;nite sequences, the set of ;nite terminated sequences, and the set of all ;nite sequences the process is able to perform. Clearly the latter set contains all the pre'xes (or initial subsequences) of the former two. Such a process is said to be deadlock-free (or nonblocking) if each ;nite sequence which is not terminated can be extended by at least one letter into another ;nite c 2002 Elsevier Science B.V. All rights reserved. 0304-3975/02/$ - see front matter PII: S 0 3 0 4 - 3 9 7 5 ( 0 2 ) 0 0 0 0 6 - 3
32
A. Arnold / Theoretical Computer Science 281 (2002) 31 – 36
sequence. It follows that every ;nite sequence which is not terminated can be extended into a terminated sequence or into an in;nite word over A all of whose pre;xes are in the process. But it is not guaranteed that such an in;nite word belongs to the process. If it is always the case, the process is said to be safe. The above de;nitions are intuitively quite natural and it is not a surprise that they appear elsewhere, for instance, in the fundamental papers by Ramadge and Wonham on the control of discrete event systems [16,17]. They de;ne a discrete event system as a Nivat’s process without in;nite sequences, with the restriction that both languages (of all ;nite sequences and of all terminated ones) are recognizable, and they say that it is nonblocking if every non terminating sequence can be extended into a terminated one, which is exactly the notion of safeness for a process which has no in;nite sequences. The restriction to recognizable processes is quite natural as soon as one is interested in decision problem (whether a process is safe or not) or eDective constructions (e.g., of the greatest safe subprocess of a given process) and was considered in [15]. The paper [8] investigates such problems for some kinds of algebraic (or context-free) processes. The main idea of [14] is to de;ne the interactions between processes (communications, synchronizations) on a very high level of abstraction, so that almost all mechanisms encountered so far in the literature become particular cases of a very general concept: the synchronization vectors. Actually, the eDect of a synchronization mechanism is to force some actions of some processes to be performed simultaneously, or, on the contrary, to forbid their simultaneous occurrences. Therefore, it can be described by giving the list of tuples of action that must or may occur simultaneously (or its complement, the set of tuples that can never occur simultaneously). Formally, for i = 1; : : : ; n, let Li be a process over the alphabet Ai . Let A0i be the set Ai ∪ {}, where is a symbol to be interpreted as “no action”. A synchronization vector is any element of the product A = A10 × · · · × A0n . A synchronization constraint is a set I ⊆ A of synchronization vectors The synchronized product of L1 ; : : : ; Ln with respect to I is the process over I de;ned as follows. Its ;nite (terminated) sequences are those whose projections are ;nite (terminated) sequences of the corresponding component, its in;nite sequences are those whose projections are in;nite or terminated. It is not diIcult to convince oneself that communication mechanisms of CSP [10], CCS [13], COSY [12] can be described in this way. Even Petri nets can be seen as synchronized products where the processes are places and synchronization vectors are transitions. Indeed, the synchronization mechanism proposed in [15] is a little more general: the synchronization constraint is a process over I , acting as a controller or supervisor, and the synchronized product is de;ned by the additional condition that its sequences must also belong to the control process. The former de;nition is a particular case of the latter when the control process consists of all ;nite and in;nite sequences over I . The diDerence between them is quite similar to the diDerence between vector addition systems and vector addition systems with states.
A. Arnold / Theoretical Computer Science 281 (2002) 31 – 36
33
However, in a few lines argument, we explained in [15] that a speci;c control process is not really needed and that the ;rst de;nition is quite suIcient, because one can apply it to a vector of processes containing also this control process as an additional component and then hide the actions of this control process by taking a homomorphic image of the synchronized product. Actually, the notion of a control process no longer appeared in subsequent papers on synchronized products [2,3] and felt into oblivion. This forgetting was an unforgivable blunder, we completely missed the point that a controller for a system of interacting processes is not a process similar to others as it was established by Ramadge and Wonham [16,17] and, however strange it may appear, the notion of a speci;c control process was reintroduced in AltaRica [6] without any conscious reminding of this ;rst attempt. Recognizable processes are those each of the three languages of which is recognizable. Therefore, they can be represented by a ;nite automaton (or labeled transition system), and the synchronized product of recognizable processes is easily represented by the automaton obtained as a kind of product of the automata representing the component processes. We privately used this construction to build up examples, and even to prove some basic results, until it appeared that the synchronized product of labeled transition systems was indeed “the” basic notion. This is why, in [2], the synchronized product is de;ned on transition systems, and no longer on processes, although transition systems are just seen as a way of specifying Nivat’s processes. Actually, it is conceptually easier to work with transition systems than with languages. As an example, Bergeron [7] drastically simpli;ed some proofs of Ramadge and Wonham just by considering that the supervisor of a “plant” is a transition system rather than a language. The next step, that still took some time, was to make explicit the fact that a transition system allows us to de;ne not only a triple but a whole bunch of languages, according to the acceptance condition that is chosen for each of them. Then, the process is indeed the transition system, and the triples that actually started the story de;nitively went out of the picture. It only remained the notion of synchronized products of transition systems [3]. However, the fact that we arrived at this notion as it is explained had an important consequence: the states play no role at all in the synchronization mechanism (in contrast, for instance, with the s=r model of Kurshan [11]) and only the actions or events of each component can be used to synchronize them. Indeed, the states of a transition system are inside a black box, that the designer is allowed to open, but the other components of the system to be synchronized are not. It follows that the synchronization product is congruent with respect to the bisimulation equivalence. The emergence of the synchronized product of transition systems as a basic notion followed many experiments by hand. But it appeared very soon that it was impossible to manage by hand the “combinatorial explosion” and it was obviously necessary to implement this product in a software tool. Under the supervision of Maurice Nivat, Alaiwan realized such a tool, together with some algorithms to analyze the structure of transition systems [1]. It was the preliminary version of the tool christened MEC by Maurice Nivat (it is a shortening of “Meccano”, the french name of the game also known as “Erector set”).
34
A. Arnold / Theoretical Computer Science 281 (2002) 31 – 36
Fig. 1. A synchronized product of transition systems.
Several versions of the tool have been developed, until the last one, which is described in [4] and which diDers from Alaiwan’s one by a much larger set of properties which can be checked on a transition system, so that MEC can be considered as a model-checker for a logic described by Dicky [9]. This tool was used to design and check the embedded software of a household electricity meter, as reported in [5] (Fig. 1 is a picture of this meter). Did Maurice
A. Arnold / Theoretical Computer Science 281 (2002) 31 – 36
35
Nivat imagine, when he published his paper [14], that, some years later, synchronized products of transition systems would be installed in thousands and thousands of homes? More recently, the synchronous product has been introduced as one of the conceptual bases of the AltaRica formalism for describing complex industrial systems [6]. This formalism is intended to serve as an input language for a software workbench devoted to risk analysis. In order to comply with industrial needs, the synchronization product has been extended in several ways. Some of these extensions are just notational short cuts, others consist in minor modi;cations of the basic notion of synchronization product, such as the introduction of priorities on the synchronization vectors. Two of them oDer a special interest in the perspective of this review. First, the complex systems are usually designed in a hierarchical way, and direct interactions between components at a diDerent level of the hierarchy are forbidden for modularity reasons (replacement of a subsystem by another one functionally equivalent). Only indirect interactions are allowed. To implement this constraint, we have reintroduced in the synchronization mechanism, the controller that was so early and unwisely given up, but with an additional role: to provide an interface between the lower and upper levels of the hierarchy. Second, we had to renounce the dogma that states play no role in the synchronization mechanism. In fact, in the systems we are interested in, in contrast with purely software systems, some components can communicate and exchange information on their respective states even in the absence of events or actions ( just think of a turbine and a steam generator connected by a pipe). The solution proposed in AltaRica is to split the state of a transition system into two parts, a control part, which remains hidden, and a visible part whose value depends on the value of the control part. For instance, let us imagine that there is a valve between the generator and the turbine. It can be in one of the two control states open or closed. The visible part of a state is the pair of steam pressures Pg and Pt at the generator and the turbine side of the valve, which can be high or low. If the valve is open then Pg = Pt . If it is closed then Pt = low. (This example explains why the visible parts of a state are named “Pows”.) In the generator–valve–turbine system, the information exchanged between the components are expressed by stating that Pg is equal to the pressure delivered by the generator, and that the pressure on the turbine is Pt . An action can modify only the control part of the state, while the visible part is modi;ed either as a consequence of the modi;cation of the control part of the state, or because of interactions with other components (for instance Pt can go from high to low if the valve is closed or if the generator fails). Although this synchronization mechanism can be expressed by synchronization vectors (but at the cost of dramatically increasing the alphabet of actions of each component), it is more natural and more usable to describe complex computerized systems whose components interact in two very diDerent ways, by physical mechanisms (pressure, voltage, etc.) as well as by electronic control devices (control program of a valve). The base of any concurrency theory is the de;nition of concurrent events. The synchronization product of Maurice Nivat is the way he formalized his view of this central question. Like many other notions introduced by him in computer science, it is both simple and powerful, because it directly addresses the core of the problem.
36
A. Arnold / Theoretical Computer Science 281 (2002) 31 – 36
Since this notion is not “marvellously intricate” it could not be the starting point of a large set of theorems, although it suggested or renewed many problems in language and automata theory. However, along the time, it revealed itself as a very fundamental notion on which many works about concurrent systems and their veri;cation are based. References [1] H. Alaiwan, Algorithmes d’analyse des automates ;nis et applications aux problQemes de synchronisation, Ph.D. Thesis, Universit%e Paris VII, 1983. [2] A. Arnold, Transition systems and concurrent processes, in: G. Mirkowska, H. Rasiowa (Eds.), Mathematical Problems in Computation Theory, Banach Center Publications, Vol. 21, Polish Scienti;c Publishers, 1988, pp. 9–20. [3] A. Arnold, Finite Transition Systems. Semantics of Communicating Sytems, Prentice-Hall, Englewood CliDs, NJ, 1994. [4] A. Arnold, D. B%egay, P. Crubill%e, Construction and Analysis of Transition Systems with MEC, AMAST Ser. Comput., Vol. 3, World Scienti;c, Singapore, 1994. [5] A. Arnold, D. B%egay, J.-P. Radoux, The embedded software of an electricity meter: an experience in using formal methods in an industrial project. Sci. Comput. Programming 28 (1997) 93–110. [6] A. Arnold, G. Point, A. GriDault, A. Rauzy, The AltaRica formalism for describing concurrent systems, Fund. Inform. 40 (2000) 109–124. [7] A. Bergeron, A uni;ed approach to control problems in discrete event processes, RAIRO-Inform. Th%eor. 27 (1993) 555–573. [8] L. Boasson, M. Nivat, Centers of languages, in: Proceedings of the Fifth GI Conference in Computer Science, Lecture Notes on Computer Science, Vol. 104, 1981, pp. 245 –251. [9] A. Dicky, An algebraic and algorithmic method of analyzing transition systems, Theoret. Comput. Sci. 46 (1986) 285–303. [10] C.A.R. Hoare, Communicating sequential processes, Commun. ACM 21 (1978) 666–677. [11] R.P. Kurshan, Modeling concurrent processes, in: Proceedings of Symposia on Applied Mathematics, vol. 31, American Mathematical Society, Providence, RI, 1985, pp. 45 –57. [12] P.E. Lauer, P.R. Torrigiani, M.W. Shields, COSY—a system speci;cation language based on paths and processes, Acta Inform. 12 (1979) 109–158. [13] R. Milner, Processes: a mathematical model of computing agents, in: H.E. Rose, J.C. Shepherdson (Eds.), Proceedings of Logic Collo., 1973, pp. 157–173. [14] M. Nivat, Sur la synchronisation des processus, Rev. Techn. Thomson-CSF 11 (1979) 899–919. [15] M. Nivat, A. Arnold, Comportements de processus, in: Collo. AFCET Les Math%ematiques de l’informatique, 1982, pp. 35 – 68. [16] P.J.G. Ramadge, W.M. Wonham, Supervisory control of a class of discrete events processes, SIAM J. Control Optim. 25 (1987) 206–230. [17] P.J.G. Ramadge, W.M. Wonham, The control of discrete event systems, in: Proceedings of the IEEE, Vol. 77, 1989, pp. 81–98.
Theoretical Computer Science 281 (2002) 37 – 80
www.elsevier.com/locate/tcs
Basic analytic combinatorics of directed lattice paths Cyril Banderier ∗ , Philippe Flajolet Algorithms Project, INRIA, Rocquencourt, 78150 Le Chesnay, France
Abstract This paper develops a uni(ed enumerative and asymptotic theory of directed two-dimensional lattice paths in half-planes and quarter-planes. The lattice paths are speci(ed by a (nite set of rules that are both time and space homogeneous, and have a privileged direction of increase. (They are then essentially one-dimensional objects.) The theory relies on a speci(c “kernel method” that provides an important decomposition of the algebraic generating functions involved, as well as on a generic study of singularities of an associated algebraic curve. Consequences are precise computable estimates for the number of lattice paths of a given length under various constraints (bridges, excursions, meanders) as well as a characterization of the limit laws associated c 2002 Elsevier Science B.V. All rights reserved. to several basic parameters of paths. Keywords: Lattice path; Analytic combinatorics; Kernel method; Singularity analysis; Generalized ballot problem; Catalan numbers
0. Introduction By a lattice path it is meant in all generality a polygonal line of the discrete Cartesian plane Z×Z. The lattice paths to be considered here are speci(ed by a (nite set of simple rules: typically, from each point, there is a (nite set of allowable moves that are both “time independent” and “space independent”. Throughout this study, we also assume the existence of some privileged direction of increase (the horizontal axis, say), so that paths become essentially similar to one-dimensional objects, namely, walks on the line. Such directed lattice paths intervene in many areas of mathematics and computer science. They play a rˆole, for instance, in probability theory (sums of discrete random ∗
Corresponding author. E-mail addresses:
[email protected] (C. Banderier), philippe.;
[email protected] (P. Flajolet). URLs: http://algo.inria.fr/banderier, http://algo.inria.fr/;ajolet
c 2002 Elsevier Science B.V. All rights reserved. 0304-3975/02/$ - see front matter PII: S 0 3 0 4 - 3 9 7 5 ( 0 2 ) 0 0 0 0 7 - 5
38
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
variables), statistics (non-parametric tests), formal language theory, random generation of planar diagrams (animals and polyominoes), the analysis of dynamic data structures, and queueing theory models. In probability theory, lattice paths describe the evolution of sums of independent discrete random variables, for instance, the succession of your gains if a die is repeatedly cast and your capital is increased by j when face number j shows up. A typical question in this context is the following: Determine the probability of a “lucky game” in the sense that, at any time t, the partial gain is at least as large as the “mean gain”, 72 t. Such questions are indeed addressed by classical probability theory, with Brownian motion entering the game. However, by design, stochastic processes only provide a (rst-order asymptotic theory, while some purely discrete phenomena remain out of reach of this theory. Statistics, though not our primary motivation in this paper, is historically an other important source of problems regarding lattice paths. We may mention the Kolmogorov– Smirnov test in non-parametric statistics that aims at discerning as to whether two random variates have the same distribution (see, e.g., [47]). As a matter of fact, the early books on lattice path combinatorics and lattice path statistics by Mohanty and Narayana [57,59] speci(cally draw some of their motivations from such questions. In discrete mathematics, all sorts of constrained lattice paths serve to describe apparently complex objects. Two-sorted permutations are for instance equivalent to paths made of horizontal and vertical steps that connect the origin to a point lying on the main diagonal—such facts are directly relevant to the analysis of the mergesort and shellsort algorithms [48,69,74]. Dyck paths that are closely related to diagonal paths describe traversal sequences of general and binary trees; they belong to what Riordan has named the “Catalan domain”, that is, the orbit of structures counted by the Catalan numbers, 1=(n + 1)( 2n n ). The wealth of properties surrounding Dyck paths can be perceived when examining either Gould’s monograph [41] that lists 243 references or from Exercise 6.19 in Stanley’s book [72] whose statement alone spans more than 10 full pages. More generally, trees constrained by degrees—e.g., term trees in free magmas, of interest in formal semantics [60]—are known to be bijectively equivalent to Lukasiewicz words, themselves isomorphic to lattice paths of a special form; Lothaire’s book oNers a good description within the framework of combinatorics on words [52, Chapter 11]. Lattice paths also intervene in the analysis of dynamically evolving structures, and, as such, they surface in the continuous as well as discrete parts of the theory. On the discrete side, we have Flajolet’s combinatorial theory of continued fractions [29] motivated by FranPcon’s theory of “histories” of dynamic data structures [32,36] or Knuth’s dynamic storage allocation model (see [46, 2.2.2–13] for the statement of the problem and [30,75] for solutions). As regards continuous aspects, the Karlin–McGregor theory of birth–death processes (of which [33,58] oNer lattice-path perspectives), itself closely related to various queueing theory models, involves lattice paths that describe an interesting collection of events (the embedded Markov chain). The recent book by Fayolle et al. on random walks in the quarter-plane [26] is historically motivated by such queueing theory questions [25].
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
39
Word representations of lattice paths also provide many examples of context-free languages. This side of the coin is closely related to encodings of trees by words, so that Dyck paths (that are associated to general trees and binary trees) and Motzkin paths (that encode unary-binary trees) play an especially important rˆole. The theory of context-free languages and pushdown automata then combines nicely with the Chomsky–SchQutzenberger theorems [10,73], to the eNect that many types of paths can be a priori recognized as admitting generating functions that are algebraic. Examples are provided by Labelle and Yeh [49,50], Merlini et al. [56], and Duchon [22]. (In return, enumerative studies related to context-free languages can sometimes provide structural information on generation mechanisms and formal languages as is evidenced by the analytic theory of inherent ambiguity of [31].) Finally, because of the rich combinatorics surrounding them, lattice paths intervene at many places in the random generation of structured objects. The problem there is to draw a combinatorial object from some class C, and do so uniformly at random amongst all objects of size n in C. Strong decomposability properties of paths usually make random generation possible in low polynomial time (usually with a complexity between O(n) and O(n2 )). Consequently, any easily computable bijection between a class C and a class of simple enough lattice paths induces a random generation algorithm for C. Known examples include the random generation of two-dimensional diagrams like polyominoes and animals. For instance, the Delest–Viennot methodology of [18] allows us to generate parallelogram polyominoes in linear time; the rejection methods of the “Florence School” [8] make it possible to generate various types of directed lattice animals in a surprisingly eScient manner. The design of such algorithms is clearly dependent on the basic combinatorics of lattice paths while the corresponding performance analyses rely on (ne probabilistic estimates of characteristic properties of paths; see Louchard’s contribution [53] for a neat example and the paper [4] for algebraic techniques related to the present paper. In this introduction, we cannot do more than scratch the surface of such rich combinatorial, probabilistic, and algorithmic aspects of lattice paths. Accordingly we cut short our discussion of motivations at this point. Scope of the paper. This paper assembles combinatorics of words and paths, some algebra of formal power series, and complex analysis. Under this angle, we believe the enterprise to be original. Quite a lot is otherwise known regarding probabilistic properties of paths, as these represent sums of random variables. Accordingly, our treatment can be, to some extent, regarded as a parallel of probabilistic–analytic methods in the realm of enumerative combinatorics. In Section 2, we show that the counting generating functions of paths of various sorts are invariably algebraic functions. This algebraic character is predictable since the word encodings of the object considered are clearly recognizable by deterministic pushdown automata, hence are deterministic context-free languages. However, for directed lattice paths, we demonstrate that a strong algebraic decomposability prevails that is obtained by a speci(c technique, the “kernel method ” (historical remarks are given at the end of Section 2.2) and is not clearly visible on combinatorial and grammatical descriptions. Our purpose in this paper is to arrive eventually at a complete characterization of the singular structure of intervening generation functions (Section 3)—by virtue of
40
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
the method of singularity analysis, this leads to very precise asymptotic information on the counting quantities involved. At this level also, the decomposability granted by the kernel method is central as it enables us to determine the location and nature of dominant singularities. Then, once the singular structure of counting generating functions has been extracted, tight estimates on probability distributions of parameters follow easily: see Section 4 for a sample of what can be done. Section 5 sketches extensions to the enumeration of certain types of planar objects provided they satisfy a strong directedness condition.
1. Lattice paths and generating functions This section presents the varieties of lattice paths to be studied as well as their companion generating functions. Denition 1. Fix a (nite set of vectors of Z×Z, S= {(a1 ; b1 ); : : : ; (am ; bm )}. A lattice path or walk relative to S is a sequence v = (v1 ; : : : ; vn ) such that each vj is in S. The geometric realization of a lattice path v = (v1 ; : : : ; vn ) is the sequence of points −→
(P0 ; P1 ; : : : ; Pn ) such that P0 = (0; 0) and Pj−1 Pj = vj . The quantity n is referred to as the size of the path. In the sequel, we shall identify a lattice path with the polygonal line admitting P0 ; : : : ; Pn as vertices. The elements of S are called steps or jumps, and we also refer −→
to the vectors Pj−1 Pj = vj as the steps of a particular path. Various constraints will be imposed on paths. In particular, we restrict attention throughout this paper to directed paths de(ned by the fact that if (a; b) lies in S, then necessarily one should have a¿0. In other words, a step always entails progress along the horizontal axis and the geometric realization of the path naturally lives in the half plane Z¿0 × Z. (This constraint rules out paths like the ones occurring in PWolya’s “drunkard problem” as described in the attractive booklet of Doyle and Snell [19]; it also implies that the paths studied can be treated essentially as one-dimensional objects.) The following conditionings are to be considered (Fig. 1). Denition 2. A bridge is a path whose end-point Pn lies on the x-axis. A meander is a path that lies in the quarter plane Z¿0 × Z¿0 . An excursion is a path that is at the same time a meander and a bridge; it thus connects the origin to a point lying on the x-axis and involves no point with negative y-coordinate. A family of paths is said to be simple if each allowed step in S (De(nition 1) is of the form (1; b) with b ∈ Z. In this case, we also abbreviate S as S= {b1 ; : : : ; bm }. In the simple case the size of a path coincides with its span along the horizontal direction, that is, its length. The terminology of bridges, meanders, and excursions is chosen to be consistent with the standard one adopted in Brownian motion theory; see, e.g. [62].
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
41
Fig. 1. The four types of paths: walks, bridges, meanders, and excursions and the corresponding generating functions.
The main objective of this paper is to enumerate exactly as well as asymptotically paths, bridges, and meanders, this with special attention to simple families. Once the set of steps is (xed, we let W and B denote the set of paths and bridges, respectively (W being reminiscent of “walk”); we denote by M and E the set of meanders and excursions. Given a class C of paths, we let Cn denote the subclass of paths that have size n, and, whenever appropriate, Cn; k ⊂ Cn those that have (nal vertical abscissa (also known as “(nal altitude”) equal to k. With the convention of using standard fonts to denote cardinalities of the corresponding sets (themselves in calligraphic style), Cn = card(Cn ) and Cn = card(Cn; k ), the corresponding (ordinary) generating functions (GFs) are then Cn z n ; C(z; u) = Cn;k uk z n : C(z) := n
n;k
This paper is entirely devoted to characterizing these generating functions: they are either rational functions (W ) or algebraic functions (B; E; M ). As we shall see, a strong algebraic decomposition prevails which, as opposed to other approaches, renders the calculation of the GFs eNective. Even more importantly, the decomposability of GFs makes it possible to extract their singular structure, and in turn solve the corresponding asymptotic enumeration problems in a wholly satisfactory fashion. Weighted paths. For several applications, it is useful to associate weights to single steps. In this case, the set of steps S is coupled with a system of weights = {w1 ; : : : ; wm }, with wj ¿0 the weight associated to (aj ; bj ) ∈ S; the weight of
42
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
a path is then de(ned as the product of the weights of its individual steps. Then the quantity Cn , still referred to as number of paths (of size n), represents the total weight of all paths of size n. Such weighted paths cover several situations of interest: (i) combinatorial paths in the standard sense above when each wj =1; (ii) paths with coloured steps, e.g., wj =2 means that the corresponding step (aj ; bj ) has two possible coloured incarnations (say blue and yellow); (iii) wj = 1 corresponds to a probabilistic model of paths where, at each stage, step (aj ; bj ) is chosen with probability wj . 2. Algebraic structures and the kernel method In this section, we characterize the generating functions of the four types of directed paths (unconstrained, bridges, meanders, and excursions). For ease of exposition, we restrict attention to simple families of paths till Section 5, where we brie;y discuss the more general directed models. It will be seen that a speci(c algebraic curve, the “characteristic curve” plays a central rˆole. In this section, a modicum of analysis is introduced for convenience, but it is limited to the vicinity of z = 0, and consequently, it is largely equivalent to formal series manipulations. 1 Denition 3. Let S= {b1 ; : : : ; bm } be a simple set of jumps, with = {w1 ; : : : ; wj } the corresponding system of weights (wj ≡ 1 in the unweighted case). The characteristic polynomial of S is de(ned as the polynomial in u; u−1 (a Laurent polynomial) P(u) :=
m j=1
wj u b j :
Let c = − minj bj and d= maxj bj be the two extreme vertical amplitudes of any jump, and assume throughout c; d¿0. The characteristic curve of the lattice paths determined by S is the plane algebraic curve de(ned by the equation 1 − zP(u) = 0;
or equivalently
uc − z(uc P(u)) = 0:
(1)
The quantity K(z; u) := u c − zu c P(u) is also referred to as the kernel and Eq. (1) as the kernel equation. As we shall see the characteristic equation plays a central rˆole, the second form being the entire version (that is, a form without negative powers). We also need to introduce technical conditions on periodicities. In a coin-tossing game (S= {−1; +1}) for instance, a bridge or an excursion only exists for even lengths; consequently, what is observed of a random path at time n depends on the residue class of n modulo 2 (Fig. 2). 1 Following a remark by a referee, we note that analyticity considerations in this section could be logically dispensed with; see Gessel’s paper [38] for a proper framework. However, the authors’ feeling is that purely algebraic proofs, though feasible, tend to be less transparent. More importantly, analyticity considerations developed here serve as a useful preparation for our “non-local” treatment of singularities in the next section.
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
43
8 10 6
4 5 2
0
2
4
6
8
10
12
14
16
0
2
4
6
8
10
–2 –5 –4
–6 –10 –8
Fig. 2. Fragments of the sublattices accessible from the origin by the Dyck walk (S= {−1; +1}) and Duchon’s clubs (S= {−2; +3}). The periods are 2 and 5, respectively.
Denition 4. A Laurent series h(z) = n¿−a hn z n is said to admit period p if there exists a Laurent series H and an integer b such that h(z) = z b H (z p );
(2)
the largest p such that a decomposition (2) holds is called the period of h and is denoted by per(h). The series h is called aperiodic if per(h)=1. A simple walk de(ned by the set of jumps S is said have period p if the characteristic polynomial P(u) has period p. A simple walk is said to be reduced if the gcd of the jumps is equal to 1. In what follows, we systematically restrict attention to reduced walks since, up to a linear change of abscissa, any walk can be reduced. For instance, the walks corresponding to U= {−3; +3} are transformed (upon shrinking the vertical axis by a factor of 13 ) into the reduced form S= {−1; +1}. (Aperiodic walks are from their definition automatically reduced.) Periodic walks live on sublattices: the walks associated to S= {−1; +1} (Dyck walks) and T= {−1; 0; +1} (Motzkin walks) are naturally reduced, but Dyck walks are periodic with p = 2 (since uP(u) = 1 + u2 ), while Motzkin walks are aperiodic; “Duchon’s clubs” studied below and de(ned by S= {−2; +3} have period p = 5 (since u2 P(u) = 1 + u5 ), etc. Notice that, if we write P(u) =
m j=1
wj u b j ;
wj = 0;
bj ∈ Z;
the period of P (and of the set of jumps S) is p = per(P) = gcd(b2 − b1 ; : : : ; bm − b1 ):
(3)
44
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
Also, by the strong form of the triangle inequality, for an aperiodic P(u), the strict inequality holds in |P(u)| ¡ P(|u|)
for all u ∈ C\R¿0 :
(4)
It proves convenient to rewrite P(u) =
d k=−c
pk u k :
Examination of the asymptotic regimes consistent with the characteristic equation near z = 0 shows that the equation can only be satis(ed if one of the two relations pd zud ∼ 1 or p−c zu−c ∼ 1
(z → 0)
(5)
is satis(ed. The characteristic equation being of degree c + d in u is known to have generically c+d roots; these constitute the branches of a single algebraic curve de(ned by (1) and called the characteristic curve. Then, as suggested by (5), one expects, in the complex domain (for z near 0), c “small branches” that we write as u1 ; : : : ; uc and d “large branches” v1 ≡ uc+1 ; : : : ; vd ≡ uc+d satisfying (Fig. 3) uj (z) ∼ e2i(j−1) =c (p−c )1=c z 1=c ;
vk (z) ∼ e2i(1−k)
=d
(pd )−1=d z −1=d :
(6)
For determinacy, one restricts attention to the complex plane slit along the negative real axis, which allows us to talk freely of the individual branches in the sequel. The informal discussion summarized by (6) is vindicated by the classical theory of Newton–Puiseux expansions—the fundamental result in the elementary theory of algebraic curves that determines constructively all the possible behaviours of solutions of polynomial equations. For an exposition, we refer to one of the many excellent books on the basic theory of algebraic curves, e.g. [1,45]. Precisely, the general theory teaches us that the small branches are conjugate of each other at 0, and similarly for the large branches at ∞. This means that there exist functions A and B analytic at 0 and non-zero there, such that, in a neighbourhood of 0, one has uj (z) = !j−1 z 1=c A(!j−1 z 1=c ) = u1 (e2i(j−1) z); vk (z) = $1−k z −1=d B($k−1 z 1=d ) = v1 (e2i(k−1) z);
! = e2i
=c
$ = e2i
=d
:
(7)
In summary, the uj and v‘ organize themselves into two “cycles” of c and d elements, respectively; for analytic details, we refer to Hille’s crisp presentation based on monodromy and analytic continuation in [44]. The branch u1 de(ned near 0 by (6) is real positive and is called the principal (small) branch. The graph of branches is obtained by interchanging the axes in the graph of 1=P(u), with u1 appearing as the real positive branch near the origin; see Fig. 3 for an example. We shall prove in Section 3 that in a proper sense u1 “dominates” all the other small branches.
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80 40
1
30
0.8 0.6
20
0.4
10 –4
–3
–2
–1
0
45
0.2 1
–10
2 u
3
–4
4
–3
–2
–1
(τ,ρ)
0 –0.2
1
u
2
3
–0.4
–20
–0.6
–30
–0.8
4
–40
–1
u 2
v1 u1
–0.4
–0.2
u2
0.2 z
0.4
–2
–4
Fig. 3. Graphs associated to the set of jumps S= {−2; −1; 0; 1; 2; 3}, with characteristic polynomial P(u) = u−2 + u−1 + 1 + u + u2 + u3 : Top: the graphs of P(u) and 1=P(u) for real u. Bottom: the three real branches of the characteristic curve, one large of order z −1=3 , and two small of order ±z 1=2 (two complex branches of order e±2i =3 z −1=3 are not shown).
2.1. Walks and bridges We start with the easy case of unconstrained walks and bridges. This already makes use of the characteristic curve and some of its branches. Theorem 1. The bivariate generating function (BGF) of paths (with z marking size and u marking ;nal altitude) relative to a simple set of steps S with characteristic polynomial P(u) is a rational function. It is given by 1 W (z; u) = : (8) 1 − zP(u) The GF of bridges is an algebraic function given by B(z) = z
c u (z) d j =z log(u1 (z) · · · uc (z)); u (z) dz j=1 j
(9)
where the expressions involve all the small branches u1 ; : : : ; uc of the characteristic curve (1). Generally, the GF Wk (z) of paths terminating at altitude k is, for −∞¡k¡c, c c uj (z) z d −k (10) =− uj (z) Wk (z) = z k+1 k dz j=1 j=1 uj (z)
46
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
and for −d¡k¡ +∞, Wk (z) = −z
d j=1
vj (z) z d = k+1 vj (z) k dz
d
j=1
vj (z)
−k
;
(11)
where v1 ; : : : ; vd are the large branches. (For W0 (z), the second form is to be taken in the limit sense k → 0.) Proof. Set wn (u) = [z n ]W (z; u), the Laurent polynomial that describes the possible altitudes and the number of ways to reach them in n steps. We have w0 (u) = 1, w1 (u) = P(u), and wn+1 (u) = P(u)wn (u), so that wn (u) = P(u)n for all n. The determination of W (z; u) in (8) follows from n¿0
P(u)n z n =
1 ; 1 − zP(u)
where the sum converges and represents an analytic function of both arguments for |z|¡1=P(|u|). Observe that the resulting series is entire in z but of the Laurent type in u (it involves arbitrary negative powers of u). For positive u, the radius of convergence of W (z; u) viewed as a function of z is exactly 1=P(u). Also, by dominance of coeScients (one has Bn 6P(1)n ), the radius of convergence of B(z) as a function of z is at least 1=P(1). Consider now |z|¡r, where r := 12 P(1)−1 . Then, since 1=P(u) is continuous and unimodal for u ∈ (0; +∞) (where P (u)¿0, so that P is convex) and 1=P(0) = 1=P(∞) = 0, there exists an interval (&; ') such that for &6u6', one has 1=P(u)¿r. More generally, by positivity of the coeScients, the function W (z; u) is seen to be analytic in the product domain (z; u) ∈ {z | |z|¡r} × {u | &¡|u|¡'}: Thus, by Cauchy’s formula applied to the function W (z; u) (viewed now as a function of u analytic in a crown), one has 2 1 du B(z) = [u0 ]W (z; u) = W (z; u) : 2i u |u|=(&+')=2 Take z small enough, so that all the large branches that escape to in(nity lie outside of |u|6(& + ')=2 and the small branches are all distinct. Then, only the small branches remain inside, and, since there are only simple poles, one has 1 1 =− : (12) Res u=uj u(1 − zP(u)) zuj P (uj ) 2
We make use of the conventional notation for coeScients of entire and Laurent series: [z n ]
n fn z
n
:= fn .
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
47
The integration contour is shrunk to 0, which is legitimate since W (z; u) remains O(1), and residues are taken into account. The residue theorem then gives B(z) as a sum of residues of form (12) over all small branches. The formula simpli(es to (9) since diNerentiation of the characteristic equation shows that P (u)−1 = −z 2 u for any branch u. The same procedure is applicable to 1 du Wk (z) ≡ [uk ]W (z; u) = W (z; u) k+1 : 2i u |u|=(&+')=2 The integration contour can be shrunk to zero provided the integrand (which is of order u c−k−1 ) remains bounded as u → 0, which necessitates k6(c − 1). The result of (10) follows again from a residue calculation involving small branches. (The proof shows the formulX to be valid in a small enough neighbourhood of the origin. The identities are then a posteriori valid as identities between formal (fractional) power series.) When k¿ − d, which covers case (11) of an arbitrary positive k, the residue calculation is completed by extending the contour to a large circle at ∞; in this case, the large branches contribute. The algebraic character of B(z) and the Wk (z) (nally results from the well-known fact that algebraic functions are closed under sums, products, and multiplicative inverses. The quantity B(z) ≡ W0 (z) is equivalently given as the diagonal of a bivariate rational function, 1 zn [z n ucn ] B(z) = 1 − zuc P(u) n and as such it must be algebraic: see PWolya’s paper [63] of 1921 and [37] for developments regarding diagonals of rational functions. Example 1 (Central binomial and trinomial numbers). These are perhaps the most famous examples, associated to the sets S= {−1; +1} and T= {−1; 0; +1}. The corresponding polynomials are P S (u) = u−1 + u and P T (u) = u−1 + 1 + u. In this case, the characteristic curve is of degree 2 and there is only one small branch, namely √ √ 1 − 1 − 4z 2 1 − z − 1 − 2z − 3z 2 u1S (z) = ; u1T (z) = : 2z 2z The algebraic generating functions of bridges are then BS (z) = √
1 = 1 + 2z 2 + 6 z 4 + 20 z 6 + 70 z 8 + 252 z 10 + · · · ; 1 − 4z 2
BT (z) = √
1 = 1 + z + 3z 2 + 7z 3 + 19z 4 + 51z 5 + · · · ; 2 1 − 2z − 3z
48
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
the coeScients being 3 EIS A000984 and EIS A002426 2n n S n 2 n [z ]B (z) = [t ](1 + t ) ≡ ; [z n ]BT (z) = [t n ](1 + t + t 2 )n : n The names of central binomial and trinomial numbers are suggested by the usual expansions of (1 + t 2 )n and (1 + t + t 2 )n : 1 1 1 +1t +t 2 1 + t2 1 +2t +3t2 +2t 3 +t 4 1 + 2t2 + t 4 2 4 6 1 + 3t + 3t + t 1 +3t +6t 2 +7t3 +6t 4 +3t 5 +t 6 4 2 6 8 1 + 4t + 6t + 4t + t 1 +4t +10t 2 +16t 3 +19t4 +16t 5 10t 6 +4t 7 +t 8 It is notable that these cases were already considered by Euler [24], who also gave linear recurrences (with polynomial coeScients) satis(ed by BnT . 2.2. Meanders and excursions In this section, we consider meanders, that is paths that never go below the horizontal axis. The meanders whose (nal altitude is 0 are called excursions, in accordance with De(nition 2, and they turn out to be the objects with the richest combinatorial properties. We continue with a simple system of paths de(ned by the set of jumps S, possibly endowed with weights. The new generating functions will again involve the characteristic curve together with its small and large branches. Let now Fn; k be the number of meanders of size (i.e., length) n that end at altitude k. The corresponding BGF is Fn;k uk z n ; F(z; u) := n;k
which is now an entire series in both z and u. By the combinatorial origin of the problem, F(z; u) is bivariate analytic for |u|61 and |z|¡1=P(1). We also make use of the polynomials fn (u) that describe the possible positions after n steps and write F(z; u) = fn (u)z n = Fk (z)uk : (13) n¿0
k¿0
Combinatorially, the natural decomposition is the one based on the last step added. For the fn (u), “adding a slice” is translated by the recurrence, f0 (u) = 1;
fn+1 (u) = P(u)fn (u) − {u¡0 }P(u)fn (u):
(14)
There, the notation {u¡r }g(u) means the sum of all the monomials with exponent less than r that appear in the Laurent series g(u) as +∞ r−1 {u¡r } gj uj := gj u j : (15) j=−a
j=−a
3 References to EIS point to Sloane’s Encyclopedia of Integer Sequences [70], of which a version also exists in print [71].
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
49
Then, multiplying the terms of the recurrence by z n and summing yields F(z; u) = 1 + zP(u)F(z; u) − z{u¡0 }(P(u)F(z; u));
(16)
where {u¡0 } is to be understood as applied to the u-expansion of F(z; u) in (13). Relation (16) is the fundamental functional equation de(ning meanders. It reads as follows: “A path is either the empty path or it consists of a step (zP(u) describes the possibilities) added to a path except that the steps that would take the walk below level 0 (the operator {u¡0 }) are to be taken out”. Now, P involves only a (nite number of negative powers, so that F(z; u)(1 − zP(u)) = 1 − z
c−1 k=0
rk (u)Fk (z)
(17)
for some Laurent polynomials rk (u) that are immediately computable from P via (16): rk (u) := {u¡0 }(P(u)uk ) ≡
−k−1 j=−c
pj uj+k :
(18)
Theorem 2. For a simple set of steps, the BGF of meanders (with z marking size and u marking ;nal altitude) relative to a simple set of path S is algebraic. It is given in terms of the small and large branches of the characteristic curve of S by c d 1 1 j=1 (u − uj (z)) F(z; u) = c =− : (19) u (1 − zP(u)) pd z ‘=1 (u − v‘ (z)) In particular the GF of excursions, E(z) = F(z; 0); satis;es E(z) =
c d 1 (−1)d−1 (−1)c−1 uj (z) = : p−c z j=1 pd z ‘=1 v‘ (z)
(20)
Proof. The point is that the fundamental equation in its form (17) looks grossly underdetermined as it involves (c + 1) unknown functions; to wit, the bivariate F(z; u) and c−1 the univariate {Fk (z)}k=0 . The main idea of a method known as the “kernel method” (see also historical notes below) consists in binding z and u in such a way that the left-hand side vanishes. Indeed, substitute in (17) any small branch of the characteristic equation. Take |z|¡1=P(1) and restrict z to a small neighbourhood of the origin in such a way that: (i) all the small branches are distinct; (ii) all the small branches satisfy |uj (z)|¡1. Then the substitution is analytically legitimate and, taking all small branches into account, it provides a system of c equations in the unknown functions F0 ; : : : ; Fc−1 : u1c − z
c−1 k=0
u1c rk (u1 )Fk = 0
.. . ucc − z
c−1 k=0
ucc rk (uc )Fk = 0:
(21)
50
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
This system is non-singular for the reason that its determinant is a variant of the Vandermonde determinant and the small branches are clearly all distinct. This observation is enough to justify that each of the Fk is an algebraic function expressible rationally in terms of the algebraic branches uj . Instead of pursuing in the direction of determinantal calculations, here we make use of a cute observation of Bousquet-MWelou (introduced in [13] and employed in the parallel paper [4]). The quantity N (z; u) := uc − z
c−1 k=0
uc rk (u)Fk
(22)
is by (21), a polynomial in u whose roots are precisely all the uj . The leading monomial of this polynomial is u c , so that the polynomial factorizes as N (z; u) =
c
(u − uj (z)):
j=1
(23)
Then, the constant term is at the same time the product (−1)c u1 · · · uc and the quantity −zp−c F0 , as is apparent from de(nition (22) and form (18) of the coeScients. The form of F0 follows. Finally, the result for the BGF F(z; u) derives from (17) made entire, F(z; u) =
N (z; u) uc (1 − zP(u))
and from the factorization (23). An immediate corollary of Theorems 1 and 2 is the generating function of all paths and meanders irrespective of their (nal altitude. Corollary 1. The generating functions of all paths and all meanders are W (z) ≡ W (z; 1) = M (z) ≡ F(z; 1) =
1 ; 1 − zP(1) c d 1 1 1 (1 − uj (z)) = − : 1 − zP(1) j=1 pd z ‘=1 1 − v‘ (z)
A somewhat deeper consequence is a direct relation between the GFs of excursions and bridges that obtains by comparing Eqs. (9) and (20). Corollary 2. The generating functions of bridges (B) and excursions (E) are related by E (z) d (log E(z)) = 1 + z ; E(z) dz z dt : (B(t) − 1) E(z) = exp t 0 B(z) = 1 + z
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
51
In the same vein, consider paths whose intermediate steps may be negative, but with a (nal altitude that is ¿0. Their BGF is W + (z; u) :=
∞ k=0
Wk (z)uk :
Then, comparison of the forms involving large branches for Wk (z) and F(z; u) and a trite calculation shows that W + (z; u) = 1 + z F(z; u) = exp
d (log F(z; u)); dz z
dt (W (t; u) − 1) t 0 +
:
Finally, with Fk (z) being the generating function of meanders that end at altitude k, one has Fk (z) = [uk ]F(z; u). Since F(z; u) is a rational function of u with a simple product expression in terms of the large branches, its expansion with respect to u is easily accessible via a partial fraction decomposition, and one (nds: Corollary 3. The generating function of meanders terminating at altitude k is Fk (z) =
d 1 .‘ v‘−k−1 ; pd z ‘=1
.‘ :=
j=‘
1 : vj − v‘
Some of these relations admit combinatorial interpretations succinctly discussed in Section 4.1. Example 2. Ballot problem, Dyck paths, and Motzkin paths. These are the most famous problems in the area, and they are closely related to Example 1. The ballot problem asks for the probability, in a two candidate election between A and B that eventually results in a tie, of A dominating B throughout the poll. Recording the diNerence between the scores of A and B as time evolves, we model the problem as the counting of excursions associated with S= {−1; +1}. The characteristic curve is the one examined in Example 1 in connection with central binomial coeScients and the GF of excursions is √ 2n 1 1 − 1 − 4z 2 S z 2n ; E (z) = = 2 2z n n¿0 n + 1 where the coeScients 1=(n + 1)( 2n n ) are the Catalan numbers (EIS A000108). For T= {−1; 0; +1}, one (nds similarly √ T n 1 − z − 1 − 2z − 3z 2 T E (z) = = En z ; 2 2z n¿0 where the coeScients are the Motzkin numbers (EIS A001006).
52
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
Example 3. Lukasiewicz paths and tree codes. Consider generally a (nite set / that contains −1 as single negative value. The corresponding paths are known as Lukasiewicz paths. Set 0(u) := uP(u), which is a polynomial. There is only one small branch satisfying u1 (z) = z0(u1 (z))
(24)
and the GF of excursions is (1=zp−1 )u1 (z). vukasiewicz paths of type / encode trees whose node degrees are constrained to lie in 1 + /, this by virtue of a well-known correspondence [52, Chapter 11]. (Traverse the tree in preorder and output a step of d − 1 when a node of outdegree d is encountered.) In this way, it is seen that Eq. (24) gives the GF of trees counted according to the number of their nodes, an otherwise classical result [55]. By Lagrange inversion, the number of trees comprised of n nodes is Tn =
1 n−1 [w ]0(w)n ; n
where 0 can be directly interpreted as the characteristic polynomial of the allowed node (out)degrees. Example 4. Walks with steps in {−2; −1; 0; +1; +2}. This is our (rst example involving inherently more than one branch. The characteristic equation is u2 − z(1 + u + u2 + u3 + u4 ) = 0: The two small branches are conjugate and given by u1 (z) = +z 1=2 + 12 z + 58 z 3=2 + z 2 +
231 5=2 128 z
+ 3z 6 + · · · ;
u2 (z) = −z 1=2 + 12 z − 58 z 3=2 + z 2 −
231 5=2 128 z
+ 3z 6 + · · · :
Then, by (20), the (rst few terms of E(z) are easily determined as E(z) = −
u1 (z)u2 (z) = 1 + z + 3z 2 + 9z 3 + 32z 4 + 120z 5 z
+473z 6 + 1925z 7 + · · · : Similarly, for meanders, one has M (z) =
(1 − u1 (z))(1 − u2 (z)) = 1 + 3z+12z 2 +51z 3 +226z 4 + 1025z 5 + · · · : 1 − 5z
It is then a natural question to ask for an equation satis(ed directly by E(z) or F(z; 1). Regarding excursions, an equation may be obtained by elimination of u1 ; u2 from the system zE + u1 u2 = 0;
u12 − z(1 + u12 + u13 + u14 ) = 0;
u22 − z(1 + u2 u22 + u23 + u24 ) = 0:
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
53
Either resultants or GrQobner bases do the job. For instance, resultants give a polynomial equation of degree 12 satis(ed by E(z). The polynomial factorizes (this is expected as we did not impose conditions like u1 = u2 in the process). Eventually, it is found that E(z) satis(es a polynomial equation of degree 4: z 4 y4 − z 2 (1 + z)y3 + z(2 + z)y2 − (1 + z)y + 1 = 0:
(25)
We shall examine shortly a much better way to perform such computations. Example 5. Duchon’s clubs and underdiagonal paths. The following problem 4 was considered by Duchon [22] (under a diNerent formulation): A club opens in the evening and closes in the morning. People arrive by pairs and leave in threesomes. What is the possible number of scenarios from dusk to dawn as seen from the club’s entry? For instance, an event may be +2 (two enter), +2 (two more enter), −3 (three leave), +2 (two, again arrive), −3 (and the club closes). Naturally, the population inside the club is never negative and a business night starts with the empty club and ends with the empty club. The generalized problem then calls for the number of excursions with step ˆ {−3; +2} or, equivalently by time reversal, set {−c; d} (where Duchon’s case is S= S= {−2; +3}). We assume here without loss of generality that c and d are coprime integers, so that the system of paths is reduced. The characteristic polynomial is P(u) = u−c + ud and the kernel equation is equivalent to uc = z(1 + ue )
with e = c + d:
Thus, the period is e = c + d and the horizontal axis is only touched at places that are a multiple of e. Set z = t c , where t is a local uniformizing parameter at 0. Then, the quantity y(t) := u1 (t c ) satis(es the equation y = t(1 + ye )1=c ; which is Lagrangean. By Lagrange inversion [42], one (nds n=c 1 tn: (26) y(t) = (n − 1)=e n¿1 n (By convention, ( ab ) = 0 if b is non-integral.) Let ! be a primitive cth root of unity; then all the branches admit an expansion similar to y(z). Indeed, by conjugacy, one has yn !nj t n ; uj+1 (t c ) = y(!j t) = n¿1
where yn = [t n ]y(t) is given by (26). Then, the number of excursions is a convolution: yn1 yn2 · · · ync !0n1 +1n2 +···+(c−1)nc : (−1)c−1 En = n1 +···+nc =c(n+1)
4
After this paper had been submitted, Christian Krattenthaler pointed us to Ref. [68] by Sato, dating from 1989. In that paper, Sato derives directly our Eq. (27) by matrix generating function methods and provides valuable additional results regarding underdiagonal paths in a strip.
54
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
It can be checked that En is automatically zero unless n ≡ 0 (mod e) (see also the discussion on periodicities in Section 3.3 below). In summary, taking ! any primitive cth root of unity, and setting nj = 1 + e3j , n = e3, we (nd Ee3 =
1 1 + 31 e
31 +···+3c =c3
1 ··· 1 + 3c e
(1 + 31 e)=c
31
(1 + 3c e)=c
!031 +132 +(c−1)3c :
3c
(27)
In particular, for c = 1, no summation is needed and 1 1 + ne
1 + ne n
gives the number of excursions of length n and type {−1; e − 1}, which is also the number of e-ary trees having n internal nodes (Example 3). If c = 2 formula (27) yields a single convolution. For S= {−2; 3}, the result is E5n
2n (−1)3 = 3=0 1 + 53
(1 + 53)=2 3
1 1 + 5(2n − 3)
(1 + 5(2n − 3))=2 2n − 3
to be compared to E5n =
n i=0
1 5n + i + 1
5n + 1 n−i
5n + 2i i
;
(28)
which Duchon obtained from quite speci(c series manipulations. In general, if the jump in the negative direction is −c, formula (27) is a (c − 1)-fold convolution of binomial coeScients. Duchon’s clubs can also be interpreted as underdiagonal paths. Consider paths in the Z¿0 × Z¿0 lattice whose allowed steps are of type either East (horizontal) or North (vertical), with a straight line barrier 5. It is assumed that 5 passes through the origin and has a rational slope, p=q61. The number of ways Nm; n of reaching point (m; n) by North and East steps then satis(es a recurrence of the same type as Pascal’s triangle but with boundary conditions. For instance, the case of slope 1 gives rise to the original formulation [54] of the ballot problem (Example 2). If one measures at each step of a path the vertical distance to 5, then, this distance can only evolve by +(p=q) for a horizontal step and −1 for a vertical step. Thus, up to rescaling, such an underdiagonal path is equivalent to a Duchon path of type {−q; +p}. The numbers Nm; n are then amenable to the analysis of the paper since their
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
55
determination is equivalent to counting meanders and excursions. For instance, here is a table of values for slope 23 :
1
1
1 1
2 2 1
5 3 1
9 9 4 1
23 23 14 5 1
66 43 20 6 1
136 136 70 27 7 1
377 377 241 105 35 8 1
1144 767 390 149 44 9 1
The sequence of numbers in this array that correspond to the number of ways of touching the boundary line is (EIS A060941) 1; 2; 23; 377; 7229; 151491; 3361598; 77635093; 1846620581; : : : ; which precisely coincides with the sequence of Duchon numbers, {E5n }n¿0 , in (28). Related enumerative results have been obtained by Durand [23] in the context of the “klam” recurrence that arises in complexity theory. Mohanty [57, p. 22] even quotes results of TakWacs relative to underdiagonal paths under a line of arbitrary slope. As the last example shows, the decomposability aNorded by the kernel method provides a grasp on the structural complexity of summatory formulX expressing the number of walks, excursions, etc. Following Comtet [15, p. 216], we observe that the “rank” (de(ned as the minimal number of summations) of the excursion formula in the general case is at most c(q − 1) − 1 if P(u) comprises q terms. For instance, Catalan numbers ((c; q) = (1; 2)) are of rank 0, Motzkin numbers ((c; q) = (1; 3)) and the Duchon numbers En of (28) (having (c; q) = (2; 2)) are of rank 1, etc. Some origins of the kernel method. What we named here the “kernel method” has been part of the folklore of combinatorialists for some time. Earlier references usually deal with the case of a functional equation of the form K(z; u)F(z; u) = A(z; u) + B(z; u)G(z) (with F; G the unknown functions), when there is only one small branch, u1 , such that K(z; u1 (z)) = 0. In that case, a single substitution does the job, and G(z) = −A(z; u1 )= B(z; u1 ). One clear source of this is the exercise section of the (rst edition (in 1968) of Knuth’s book [46]: the detailed solution to Exercise 2.2.1– 4 (see [46, pp. 536–537] and also Example 2.2.1.11) presents a “new method for solving the ballot problem”, for which the characteristic equation is quadratic. See also Odlyzko’s splendid survey [61, Section 15.4] for a discussion of a pebbling game and Prodinger’s recent note [64] for an original application to a quadratic problem arising from queueing theory. The kernel method in its more general version was used recently in a few unpublished works by the authors, including a systematization to directed lattice paths by Banderier in his memoir [2]. Independent combinatorial developments at the end of the last century are due to Bousquet-MWelou and PetkoYsek whose recent paper oNers
56
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
a penetrating perspective on the subject of multidimensional walks, recurrences, and kernels [13]. In fact, as indicated earlier, a remark of Bousquet-MWelou has been used to simplify our proof of Theorem 2 (see also [4] for another application). That probabilists had known a lot since the early 1950s regarding related questions is manifest upon reading Chapter XII of Fellers’ book [28]. It appears that our presentation parallels in some ways what is obtained by the famous Wiener– Hopf approach: refer in particular to the example on bounded arithmetic distributions in [28, pp. 407–408]. Such techniques prove in turn valuable in the theory of queueing systems: see, e.g., Robert’s book [66] for an account. The synthesis by Fayolle et al. [26] exposes the deep rami(cations of the theory in the harder case of walks in a quarter plane not satisfying directedness restrictiction (thus, a “pure” two-dimensional problem), but their methods only apply to nearest-neighbour moves. The book [26] itself draws some of its inspiration from the early paper [25] where a sophisticated use of the kernel method already plays a central rˆole (amongst other techniques like conjugacy and Riemann–Hilbert problems); see also the references to Flatto and Malyshev’s works in [61, p. 1208] and the historical comments in [26, pp. VII–XI]. 2.3. Computational aspects We discuss now a way to determine directly the equations satis(ed by the algebraic functions encountered so far. Because of Corollary 2, we know that bridges and excursions are tightly coupled, and the case of excursions will be detailed here. It is assumed that the characteristic polynomial P(u) is (xed. Then, what is needed in view of Theorem 2 is the equation satis(ed by the product Y = u1 · · · uc of c distinct roots of a polynomial of degree c + d. As roots are in general “indistinguishable”, we expect a polynomial of degree ( c+d c ) to cancel Y . Take a polynomial Q(u) of degree e in C(z)[u] normalized by Q(0) = 1 and assume it has distinct roots u1 ; : : : ; ue . For us, e = c + d, and Q(u) = −
1 (uc − zuc P(u)); zp−c
yet another reformulation of the kernel. We (rst develop the computational process when c = 2, so that the equation for Y = u1 u2 with u1 ; u2 two distinct roots of Q is sought. Write &; & for generic roots of Q. Then, since Q(0) = 1, one has Q(u) =
&
1−
u ; &
while what we need to determine is u R(u) = 1− : && {&;& }
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
57
(A sum or product over {&; & } means a sum or product over all unordered pairs of distinct elements.) Now, take logarithms. One has 1 un 1 = Sn ; log with Sn := n Q(u) n & & n¿1 (2) un 1 1 = Sn : log with Sn(2) := n & n R(u) n & n¿1 {&;& } Then, a simple combinatorial reasoning shows that {&;& }
1
&n & n
=
1 1 1 1 ; n − n 2 (&;& ) & & 2 & &2n
so that Sn(2) = 12 Sn2 − 12 S2n :
(29)
The degree of R is ; := ( 2e ) a priori, and R can be recovered from the formula (“I am always the exponential of my logarithm!”)
; 1 2 un R(u) := {u6; } exp − ; (30) (Sn − S2n ) n n=1 2 where {u6; } f means the truncation of the series expansion of f with all terms of degree 6; included (see the analogous notation (15)). The general formulX for c¿2 are easily found from the usual relations between elementary and power sum symmetric functions. Set xj = &j−n . What is sought is plainly a formula expressing the sum
the sum being on all subsets of c elements. Then we have Sn(c) =
1 4 24 Sn
2 − 14 Sn2 S2n + 13 Sn S3n + 18 S2n − 14 S4n :
(32)
58
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
These considerations give rise to a simple algorithm for computing the polynomial cancelled by the product of all small branches. Platypus Algorithm. Computes the polynomial R(u) ∈ C(z)[u] of degree ; = ( ec ) such that R(Y ) = 0, where Y = u1 · · · uc = (−1)c−1 zpc E(z) is the product of all small branches of the characteristic curve. The input is the characteristic polynomial of steps, P(u). 1. Set up the symbolic formulX of type (29) and (32) appropriate for the given value of c. To this eNect, perform the symbolic expansion of (31) with
; un 6; : R(u) := {u } exp −
2(n + 7)(n + 8)(2n + 13)En+6 + · · · + 625(n + 1)(n + 2)(n + 3)En = 0:
(34)
3. Singular structures We now examine paths, bridges, meanders and excursions under the angle of asymptotics. As is well known, the asymptotic behaviour of counts is closely related to the
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
59
2.5
|v2 |, |v3 |
2
v1 u
|u 1 |, |v1 |
1 0.5
u1
0.1
|u 2 | z
0.2
0.3
Fig. 4. A rendering of the modulus of the (ve branches of the characteristic curve in the example of Fig. 3 illustrates the domination properties of the principal small and large branches.
singular structure of the corresponding generating functions [34,61]. Thanks to the factorizations aNorded by the kernel method, the singular forms of intervening generating functions become manageable. This part of the analysis makes use of global properties of branches followed by local analysis in the vicinity of a quantity called the “structural radius” ?. Lemma 1. Let P(u) be the polynomial associated to the steps of a simple walk. Then, there exists a unique number @, called the structural constant, such that P (@) = 0;
@ ¿ 0:
The structural radius is de;ned by the quantity ? :=
1 : P(@)
Proof. DiNerentiating P twice as given in (3), we see that P (x)¿0 for all x¿0. Thus, the real function x → P(x) is strictly convex. Since it satis(es P(0) = P(+∞) = +∞, it must have a unique positive minimum attained at some @, and P (@) = 0. Structural constants a priori live in a (eld of degree e := c + d over the base (eld of weights. However, for symmetric walks (P(u) = P(u−1 )), they automatically reduce to the value @ = 1 and ? becomes automatically a member of the (eld of coeScients of P. In Section 2, we have de(ned the principal branch u1 (z) near the origin by means of its expansion at 0. We show here that this branch satis(es a useful domination property for 06z6?. Cf. Fig. 4 for an illustration. Lemma 2. For an aperiodic walk, the principal small branch u1 (z) is analytic on the open interval z ∈ (0; ?). It dominates strictly in modulus all the other small branches, u2 (z); : : : ; uc (z), throughout the half-closed interval z ∈ (0; ?].
60
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
Proof. By the discussion of Lemma 1, the function 1=P(z) is continuously increasing for z ∈ [0; @]. Hence the equation (in u) z = 1=P(u) admits a unique positive solution, say u+ (z), that is less than @ when z ∈ [0; ?]. This positive solution u+ (z) must coincide with the branch u1 at 0+ (since the expansions at 0+ are the same). Also, the analytic version of the implicit function theorem guarantees that the positive solution u+ (z) remains analytic all along z ∈ (0; ?), so that the principal small branch u1 and the positive solution u+ must coincide throughout this interval. Consequently, u1 (originally only de(ned near 0+ ) increases from 0 to @ as ? increases from 0 to ?. Next, a general fact about polynomials with positive coeScients enters the game: if P(u) is aperiodic, then one has for positive r |P(reiA )| ¡ P(r)
for all A ≡ 0
(mod 2 )
(35)
as seen from the strong form of the triangle inequality. Fix z = x, with x real positive and x¡?, and let w be an arbitrary solution of the kernel equation 1 − xP(w) = 0 that is at most @ in modulus and not equal to u1 (x) (i.e., not real and positive). Then, one has by the strict inequality in (35) that x=
1 1 1 ¿ ; = P(u1 (x)) P(w) P(|w|)
which implies |w|¡u1 (x) since 1=P is increasing in the region considered, [0; @]. Thus, near 0+ and since the non-principal small branches u2 ; : : : ; uc are majorized by @ in modulus (they tend to 0), they must satisfy |uj (x)|¡u1 (x). Additionally, the domination property cannot cease to hold on (0; ?): by continuity of the modulus of any branch, this would imply that u1 (x) itself reaches the value @ for some x¡?, yielding a clear contradiction. Domination must (nally continue to hold at ?, since otherwise, there would be a contradiction with the strong triangle inequality (35). Stronger domination properties are in fact derivable from similar uses of the strong triangle inequality, under the aperiodicity condition (see also [3] for details). For |z|6?, one has: |uj (z)|¡u1 (|z|) for j = 2; : : : ; c; also, |u1 (z)|¡|v1 (z)| safe at z = ?. Simply put, the principal small branch u1 is the “largest” of all the small branches. In Section 4, it will also prove handy to have available the corresponding properties of large branches. For instance, the principal large branch, v1 , is in a similar sense the smallest of all large branches. Generally, the domination properties of large branches are counterparts of those of small branches, as can be seen by mimicking the arguments. Alternatively, one can introduce duality: If P(u) is a Laurent ˜ polynomial, then P(u) = P(u−1 ) is called its dual. It is then easy to see that the small and large branches, u˜j and v˜‘ of the dual are, respectively, the inverses of the large and small branches of the primal: u˜j vj = 1 and v˜‘ u‘ = 1. Duality thus exchanges small and large branches. (Combinatorially, duality may be realized either as a symmetry along the horizontal axis applied to steps, or by the time-reversal transformation that changes a path into another path obtained by reading steps backwards.)
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
61
3.1. Bridges and excursions We (rst address the important problem of estimating the numbers of bridges and excursions. The discussion makes use of the assumption that the walk is reduced and aperiodic. Theorem 3. Consider a simple system of walks that is aperiodic. Let @ be the structural constant determined by P (@) = 0; @¿0. The number of bridges of size n admits a complete asymptotic expansion a2 P(@)n a1 1 P(@) Bn ∼ '0 √ + 2 + · · · ; '0 = 1+ : (36) n n @ P (@) 2 n The number of excursions of size n satis;es b2 b1 P(@)n √ + 2 + ··· ; 1+ En ∼ B0 n n 2 n3 where (the uj are the small branches, with u1 the principal branch) c (−1)c−1 2P(@)3 1 B0 = Y1 (?); Y1 (z) := : uj (z); ? = p−c P (@) P(@) j=2
(37)
(38)
By Lemma 2, the constant Y1 (?) is equivalently characterized as Y1 (?) = C: |C|¡@;P(C)=?−1
Proof. The result for bridges is known as it is equivalent to the local limit theorem for sums of discrete random variables [40, Chapter 9], of which the (rst proof goes back to Laplace 5 in [51]. For completeness, we brie;y sketch the argument here. Start from the fact that the number of bridges of length n is [u0 ]P(u)n . By Cauchy’s coeScient formula, one has du 1 Bn = P(u)n ; 2i u D where the contour D is any positively oriented loop about the origin. The positive real point @ is a simple saddle-point of P(u) (hence of P(u)n ), so that the choice of the circle |u| = @ as integration contour suggests itself by the saddle-point method [16]. By the aperiodicity condition, P(u) is uniquely maximal in modulus along the contour at 5
Quite remarkably, in his ThAeorie analytique des probabilitAes, in 1812 Laplace expresses the problem as a Cauchy coeScient formula presented by its Fourier series counterpart (analytic functions are not yet invented by Cauchy!) and proceeds with a saddle-point argument expressed as an application of the “Laplace method” that was speci(cally developed for that occasion (saddle-point integrals will only emerge half-acentury later!).
62
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
u = @; see (4). Therefore, the following saddle-point approximations are justi(ed: du 1 Bn = P(u)n 2i u |u|=@ 1 ∼ 2i ∼
P(@)n 2 @
1 P (@) du 2 3 exp n log P(@) + (u − @) + O((u − @) ) 2 P(@) u @e−iB @e+iB
+∞ −∞
e−nht
2
=2
P(@)n ; dt = √ @ 2 nh
h=
P (@) : P(@)
By the usual √ process, the contribution is (rst localized near @, taking for instance B = (log n)= n, and local expansions are applied; then the contour is extended back to yield a complete Gaussian integral. This streamlined version of the method is then extended to a full asymptotic expansion in the usual way [43, p. 419], so that (36) results. The saddle-point method thus provides an easy access to the enumeration of bridges. This gives indirectly valuable information on the small branches that can be translated into the singular structure of the GF B(z). First, the relation that determines the branches of the characteristic curve can be put under the form z=
1 : P(u)
(39)
This shows that a branch can become in(nite only at z = 0; in fact, the corresponding solutions give rise precisely to the large branches v1 ; : : : ; vd . By general principles (the inverse of an analytic function at a point where the derivative is non-zero is analytic), relation (39) is invertible analytically in the neighbourhood of any point C such that P (C) = 0. Accordingly, a singularity (in the sense of analytic functions) must occur at any value E such that P (E) = 0. At u = @, with @ the structural constant, one has P (@) = 0 by construction, while P (@)¿0. Then, the local form of (39), reads 1 z = ? − P (@)(u − @)2 + O((u − @)3 ); 2
? :=
1 : P(@)
This is readily inverted, yielding two local solutions P(@) 1 − z=? + · · · (z → ?− ): u(z) = @ ± 2 P (@)
(40)
(41)
In particular, the principal branch u1 (z) has a square root singularity; it takes as value the structural constant @ at the place ?=
1 P(@)
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
63
√ and the − determination must be adopted in (41) since u1 (z) increases as z → ?− : P(@) u1 (z) = @ − 2 1 − z=? + · · · (z → ?− ): (42) P (@) Next, for z = 0, all singularities of the solutions of (39), since they correspond to (nite values of u, can only be (nite branch points E with a local expansion of the form a0 + b0 (z − E)1=r for some rami(cation index r¿1. (This is easily seen directly by a suitable generalization of (40) and (41) upon taking into account the (rst non-zero derivative of 1=P.) We can now confront the result of (42) with the the saddle-point estimation (36), remembering that one has by (9) B(z) = z
d log Y (z); dz
Y (z) := (u1 (z) · · · uc (z)):
First, Y (z) that is analytic near 0 must remain analytic throughout the disk |z|¡?, since otherwise B(z) would be singular for some value inside the disk and this would contradict the asymptotic growth (36) that is of type P(@)n for Bn . Next, Y (z) cannot have any (algebraic) singularity other than z = ? on the circle |z|= ?, since, by singularity analysis, 6 this would entail the presence of oscillating terms in the asymptotic expansion of Bn , again contradicting (36). Also, Y (z) can only have a branch point of rami(cation index r = 2 at z = ?, since otherwise some term of the form n−1+1=r would have been present in the expansion of Bn . Finally, the de;ated product Y1 (z) = u2 (z) · · · uc (z) must be analytic at ? since otherwise, being capable only of having a branch point with rami(cation index 2, one would reach a contradiction regarding the leading coeScient of Bn (as checked from comparing (36) against the consequences of (42) on coeScients). In other words, this sequence of indirect arguments shows the following: 7 The product of all the non-principal small branches Y1 (z) = u2 (z) · · · uc (z)
(43)
is analytic at all points of the closed disk |z|6?. It is now an easy matter to complete the estimate of the number of excursions by singularity analysis applied to (20) in Theorem 2. The unique dominant singularity of E(z) must be at z = ? where the local expansion (42) gives
(−1)c−1 P(@) E(z) ∼ E(?) − B0 1 − z=?; B0 = Y1 (?) 2 p−c ? P (@) 6
Singularity analysis [34,61] allows us to transfer a singular element of the form (1−z=&)F in the expansion of a function f(z) at a singularity & into a corresponding asymptotic element of the form &−n n−F−1 =G(−F) in the expansion of the coeScient [z n ]f(z) at in(nity. It is applicable unconditionally to algebraic functions. 7 An alternative argument based on the re(nement of domination relations evoked after the proof of Lemma 2 is possible; see Banderier’s thesis [3] for details.
64
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
with Y1 given by (43). A full expansion of u1 (z) in powers of (1 − z=?)1=2 being available, and Y1 (z) being analytic on the whole of |z|6?, the proof of (37) is at last completed. Example 6. Asymptotics of tree codes. The case of walks with only one type of descending step equal to −1 corresponds to tree codes, as discussed in Example 3. In this very special case, there is only one small branch, and the GF of excursions is E(z) = u1 (z)=(p1− z). For aperiodic walks, result (37) of Theorem 3, or plainly estimate (41), gives us @:
P (@) = 0;
1 1 √ En ∼ p−1 2 n3
P(@)3 P(@)n : P (@)
(44)
In terms of trees, the principal branch u1 (z) is precisely the GF of trees corresponding to the degree set 1 + S with generating polynomial 0(u) := uP(u) and one has T (z) = p−1 zE(z) = u1 (z). Estimate (44) then coincides with the well-known asymptotic estimate of the number Tn of trees of size n, 0(@) − @0 (@) = 0; n 0(@) 0(@) 1 Tn ∼ √ ; @ 2 n3 0 (@) @:
(45)
which was (rst discovered by Meir and Moon [55]. As soon as c¿1, there are several small branches, and, in this case, the algebraic constant Y1 (?) intervenes. Numerically, this constant can be determined easily as it only involves the product of the small solutions to the kernel equation taken at z = ?. Algebraically, since Y1 (?) is the product of c − 1 solutions to an algebraic equation of c+d degree c+d, it is an algebraic number of degree at most ( c−1 ) over Q(?) ≡ Q(@) that is computable by the techniques of Section 2.3 (upon changing c to c − 1 in the Platypus Algorithm). However, since @ is a double root of the kernel equation instantiated at z = ?, further simpli(cations accrue. This explains that constants involving radicals are often to be observed when analysing problems of relatively low “complexity”. The next example is typical of this state of aNairs. Example 7. Asymptotics of the {−2; −1; 0; 1; 2}-excursions. The walk introduced in Example 4 is symmetric, and like for any symmetric walk system, the structural constant is equal to 1 while the structural radius is the rational number, ? = 1=P(1) = 15 . The product of the non-principal small branches at ? reduces to u2 (?). This quantity is a priori one of the roots of an equation of degree 4 (Eq. (25) instantiated at z = ?), but since this equation has already @ = 1 as a double root, the equation satis(ed by
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
65
u2 (?) is in fact of degree 2 (it is u2 + 3u + 1 = 0) so that 3 1√ u2 (?) = − + 5 2 2 and this quantity is precisely Y1 (?) of (38). Thus, we can conclude and get easily √ 1 5 5n : 1+O En = (3 − 5) √ 4 n n3 The quality of the asymptotic approximation provided by the (rst term is 11% when n = 10 and 1.2% when n = 100, where the En are conveniently determined by (34). The estimate is also consistent with the nature of the singularity at ? = 15 of the diNerential equation (33). 3.2. Paths and meanders Now that the bulk of the work is done, asymptotic estimates of the basic counts of paths and meanders fall as a ripe fruit. The result for unconstrained paths is trivial, since the number of possibilities for size n is P(1)n , a fact consistent with the simple pole of W (z; 1) = (1 − zP(1))−1 . For meanders, three cases are to be distinguished depending upon the value of a quantity called the drift. Denition 5. Given a simple walk with characteristic polynomial P(u), the drift is de(ned by the quantity ; = P (1): In the unweighted case, the drift is thus the sum of all the possible values of the jumps, which constitutes an indicator of the “tendency” for the walk to go up or down. In the probabilistic case (P(1) = 1), the drift represents exactly the expected movement in the y-direction of any single step. For a symmetric walk, the drift is ; = 0, while @ = 1. Theorem 4. Consider a simple aperiodic walk. The number of paths of length n, [z n ]W (z; 1), is P(1)n exactly. Set Y_ 1 (z) :=
c
(1 − uj (z)):
j=2
The asymptotic number of meanders depends on the sign of the drift ; = P (1) as follows: P(1)n c1 c2 1+ ; = 0: Mn ∼ H0 √ + 2 + ··· n n n P(1) H0 := 2 Y_ 1 (?); ? = P(@)−1 = P(1)−1 ; P (1)
66
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
; ¡ 0:
; ¿ 0:
c− c− P(@)n 1 + 1 + 22 + · · · Mn ∼ H0− √ n n 2 n3 Y_ 1 (?) P(@)3 ; ? = P(@)−1 ; H0− := − 2 P (@) P(@) − P(1) P(@)n Mn ∼ H0+ P(1)n + H0− √ 2 n3
1+
c+ c1+ + 22 + · · · n n
H0+ := (1 − u1 (?1 ))Y_ 1 (?1 );
?1 := P(1)−1 :
The formulX have an intuitive meaning. In the case of a positive drift, a fraction close to H0+ of all the (unconstrained) walks is a meander, in accordance with the natural tendency of walks to go up. For negative drift, most paths tend to go down and the proportion of meanders is exponentially √ small, roughly like (P(@)=P(1)) n . For zero drift, the proportion becomes as large as 1= n, while the walks tend to oscillate not too far from the horizontal axis. Proof. The discussion is based on the formula of Corollary 1 rewritten as M (z) = F(z; 1) =
1 − u1 (z) _ Y 1 (z); 1 − zP(1)
Y_ 1 (z) :=
c
(1 − uj (z)):
j=2
It suSces to examine the position of the zeros and the dominant singularity of the numerator in relation to 1=P(1) that is always a zero of the denominator. By proof, arguments similar to Lemma 2, the quantity Y_1 (z) being a symmetric function of small branches each of which is dominated by u1 , must remain analytic throughout |z|6?. In the case ; = 0, one has P (1) = 0, @ = 1, and ? = 1=P(@) = 1=P(1). Thus, (1 − u1 ) contributes a term of the form (1 − z=?)1=2 at z = ? while the denominator (1 − zP(1)) √ has a simple zero there. Globally, the singularity of F(z; 1) is thus of type 1= , and the result follows. For a negative drift, meaning P (1)¡0, one must have @¿1, since P (u) increases from −∞ to +∞ when u ranges from 0+ to +∞. With ? = 1=P(@) (the structural radius) and ?1 := 1=P(1), one then has ?1 ¡?. In this case, the prefactor (1 − zP(1))−1 has a pole at ?1 ; this pole is however cancelled by a zero in the numerator induced by the numerator (1 − u1 (z)) (since u1 (?1 )= 1), so that ?1 is a removable singularity of F(z; 1). Consequently, the dominant singularity of F(z; 1) is at ?, where F(z; 1) is of the square-root type. For a positive drift, one must have @¡1, so that the prefactor induces a pole at ?1 := 1=P(1) before Y_1 or 1 − u1 become singular. The argument concludes by “subtracting singularities”, since the function, F(z; 1) −
Y_ 1 (?1 )(1 − u1 (?1 )) ; 1 − zP(1)
?1 :=
1 P(1)
now has a dominant singularity of the square-root type at ?.
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
67
The earlier discussion about the algebraic character of asymptotic constants applies: quantities like Y_1 (?1 ) and Y_1 (?) can be determined by adapting the Platypus Algorithm of Section 2.3. Should the degrees of the algebraic numbers involved become fairly large, one can always resort to numerical analysis as the next example illustrates. Example 8. Lucky periods in die casting. In [63, p. 45], PWolya introduces the following problem: “En jetant 2n dAes aB la fois, on peut obtenir diCAerentes sommes de points de 2n aB 12n. Le cas le plus probable est celui de 7n points. DAesignons par An le nombre de combinaisons oBu se produit cet eA vAenement.” Imagine that at each of n rounds two dice are cast and the score of the round is the sum of the two dice’s values. PWolya thus considers the number of ways An (and probability An =36n ) of reaching the balanced score 7n at the end of a game of dice consisting of n rounds. PWolya proceeds by an integral representation (precisely of the type used in the proof of Theorem 1) from which he concludes that the GF A(z) has the character of an algebraic function, but does not make the calculation explicit. By centring around the mean score of a round, which equals 7, it is easily realized that the problem is equivalent to a walk whose characteristic polynomial is P(u) = u−5 (1 + u + u2 + u3 + u4 + u5 )2 : Let Bn be the number of bridges. (The quantity Bn is exactly PWolya’s An .) Here, c =−5, d = +5; also @ = 1 as the walk is symmetric, and ? = 1=36. The asymptotic number of bridges is simply Bn ∼ √
6 · 36n 22 · 3 · 5 · 7 n
;
which is nothing but an avatar of the local limit gaussian law. Consider next the modi(cation of PWolya’s problem where we ask for the number of “lucky” games, in the sense that at any time t the score is at least 7t. This is equivalent to (nding the number of meanders. Excursions surface if we further impose the (nal 1 score to be 7n exactly. We have @ = 1 and ? = 36 . One should then examine the kernel equation at z = ?, u5 −
1 5 u P(u) = 0 36
as this gives all the values of the small branches there. We (nd that there are 10 roots, amongst which @ = 1 is a double root. The eight other go by pairs of complex conjugates, with : E = −0:36381 + 0:22924i; : E = −1:96746 + 1:23976i;
: E = 0:06208 + 0:47622i; : E = 0:26919 + 2:06476i:
68
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
Then, the quantity Y1 (?) is determined numerically as the product of the roots of : modulus less than @ = 1, namely, E E_ E E . We (nd Y1 (?) = 0:42648, so that the constant in the asymptotic formula for excursions can be determined to great accuracy: 36n En ∼ C · √ ; n3
: C = 0:35865 42111 34518 86172:
(46)
: _ − E )(1 − E ) to be Y_1 (?) = In the same vein, we determine Y_1 (?) = (1 − E)(1 − E)(1 2:11615, and C 1 n [z ]F(z; 1) ∼ √ ; n 36 n
: C = 0:93071 59694 87799 20216
gives the probability of a lucky game (a meander). PWolya’s example is interesting structurally. For instance, the excursion constant C in (46) involves Y1 (?) that is a root of a self-reciprocal polynomial I(y) of degree 16 (found by Platypus Algorithm and factorization), itself equivalent to a resolvent of degree 8 that turns out to be irreducible, ˆ + y−1 ); I(y) = y8 I(y ˆ I(v) = v8 − 17v7 − 152v6 + 34v5 − 551v4 − 12053v3 + 8038v2 + 38692v + 12664; but algebra stops there. In contrast, analysis based on the decomposability devolving from the kernel method provides fully satisfactory numerical answers. 3.3. Periodicities The discussion above has been conducted under the assumption of aperiodicity. As we explain now, similar results hold for periodic walks provided suitable congruence conditions are imposed on the indices of coeScients of generating function. For reasons explained after De(nition 4, we freely assume the set of jumps to be at least reduced, as this implies no loss in generality. Take a set S corresponding to period p. We sketch the discussion in the case of excursions, with E(z) the corresponding GF. Then, E(z) is periodic with period ˆ p ) for some E(z) ˆ p, meaning that it is of the form E(z) = E(z that is analytic at 0. The foregoing discussion of small branches continues to apply as long as |z| stays inside the disk |z|¡?, and the local analysis (42) of u1 continues to hold as z → ?. However, it appears now that there are p conjugate dominant singularities at the points ?j := ?Jj ;
J = e2i
=p
:
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
69
Indeed, E(z) satis(es E(z) = E(Jz), while Eq. (42) describes the behaviour of u1 (z) at ?j upon changing z into z=J j . Then, each of the p singular elements cumulate and contribute jointly to [z n ]E(z) provided n ≡ 0 mod p. One (nds in this way that P(@)n En ∼ pB0 √ ; 2 n3
n = p3;
3 ∈ Z¿0 ;
where B0 is (still) given by (38). The analysis easily adapts to the other types of paths considered, and is summarized by a simple rule: For a system of jumps of period p, the asymptotic form of the count of index n must be restricted to a suitable congruence class of n mod p in order for objects to exists; then the corresponding asymptotic formula is obtained from the estimate of the aperiodic case through multiplication by a factor of p. Example 9. Asymptotics of generalized Duchon’s clubs. We return to Example 5. The kernel equation is 1 − z(u−c + ud ) = 0, which gives the structural constant @=
c 1=e d
;
e = c + d:
The period is equal to e. The number of excursions of length n is non-zero only if n ≡ 0 (mod e) and it satis(es (with r = ?e ) −3 −3=2 Ee3 ∼ Dc;d rc;d 3 ;
rc;d =
c c dd ee
for some computable constant Dc; d . This generalizes the estimate of Duchon [22] who determined D2; 3 by a particular grammar construction followed by a speci(c algebraic elimination.
4. Basic parameters and limit laws The singular structure of basic generating functions of paths, bridges, meanders, and excursions is well-established by Section 3. On the other hand, many parameters “decompose” combinatorially, so that their GFs are expressible in terms of the basic generating functions, or equivalently, they lie in Q(z; X ; u1 ; : : : ; uc ) for some set X of markers. In this paper, we only exhibit few sample cases of application of this methodology. As pointed by Philippe Robert (private communication), the whole combinatorial-analytic apparatus largely parallels what probabilists do by means of Wiener–Hopf decompositions (this is analogous to the separation between small and large branches) and Tauberian theorems (instead of singularity analysis that aNords greater asymptotic accuracy through complete asymptotic expansions).
70
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
4.1. Arches and contacts De(ne an arch as an excursion of size ¿0 whose only contact with the horizontal axis is at its end points and let A be the set of arches. The set E of excursions satis(es the combinatorial equation E∼ = S{A}; where S denotes the combinatorial construction that freely forms sequences. By wellknown mechanisms this translates directly into the GF equation E(z) =
1 1 − A(z)
or equivalently
A(z) = 1 −
1 : E(z)
(47)
The singular form of A(z) then reads immediately: E(z) ∼ E(?) − B0
1 − z=?;
implying A(z) ∼
1−
1 E(?)
−
B0 1 − z=?: E(?)2
Thus, the number of arches An is asymptotically proportional to ?−n n−3=2 , hence also to the number of excursions En . De(ne a vertex of an excursion not equal to one of the end points to be a contact if its altitude is 0. Then, A(z)k+1 is the GF of excursions having k contacts. For any (xed k, the function Ak+1 has again a singularity of the square root type that is amenable to singularity analysis. An easy calculation then gives: Theorem 5. The probability that a random excursion of size n has k contacts is for any ;xed k of the form k 1 1 1 : (k + 1) 1 − +O E(?)2 E(?) n The number of contacts is thus asymptotically distributed like the sum of two independent geometric random variables with parameter 1 − E(?)−1 . In particular, An ∼
1 En : E(?)2
The constant E(?) is expressible in terms of the quantity Y1 (?) and is thus a close relative of '0 introduced in Theorem 3. On the relation between bridges and excursions. We brie;y discuss here a construction that relates excursions to arches. Consider a bridge and let m (with m60) be the minimal altitude of any vertex. Any non-empty bridge ' decomposes uniquely into a walk ’1 of size ¿1 from 0 to m that only reaches level m at its right end, followed by an excursion ” (this is the part where one wanders around but above level m), followed by a path ’2 of size ¿0 from m to 0 that only touches level m at its beginning. By rearrangement, one can write ' = ” · (’2 |’1 ), where the glueing of ’2 ’1 is an arch and
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
71
the bar keeps track of where the splitting should occur. This construction is illustrated by the following diagram:
In other words, the set of non-empty bridges is combinatorially isomorphic to the product of the set of excursions by the set of arches with a split step that is distinguished. This construction is then nothing but the combinatorial re;ex of the identity excursions
split arches
d B(z) − 1 = E(z) · z A(z) ; dz bridges
(48)
which, in view of (47) is equivalent to 1 E (z) d 1− =z : B(z) − 1 = E(z) · z dz E(z) E(z) (Thus, combinatorics of arches gives back Corollary 2.) Such relations are ubiquitous in the theory of paths, the most famous ones being known by the names of Spitzer and Sparre Andersen: see Kittel’s appendix to [35] and Lothaire’s book [52, Section 5.3] for a summary. Raney’s classic [65] and Gessel’s papers [38,39] make use of similar ideas (inter alia, the “cycle lemma”) in combinatorial proofs of the Lagrange inversion formula. One of the many consequences of this orbit of ideas is for instance the possibility of analysing the number of times a bridge attains its minimum value by adapting the decomposition (48) and closely mimicking the proof of Theorem 5. Louchard’s analyses in [53] provide many striking illustrations of such an interplay between probabilistic and combinatorial properties. 4.2. Final altitude of a meander The ;nal altitude of a path is the abscissa of its end point. For unconstrained paths, the usual local and central limit theorems for discrete random variables apply [40, Chapter 9], so that the limit law, after normalization, is Gaussian, the underlying technology being plainly the saddle-point method. We consider now meanders. The
72
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
random variable associated to (nite altitude when taken over the set of all meanders of length n is denoted by Xn , and it satis(es Pr(Xn = k) =
[z n uk ]F(z; u) : [z n ]F(z; 1)
We state: Theorem 6. The ;nal altitude of a random meander of size n admits a limit distribution, with the limit law being dictated by the value of the drift ;. (i) For a negative drift, ;¡0, the limit distribution is a discrete one characterized in terms of the large branches: lim Pr(Xn = k) = [uk ]$(u);
n→∞
where $(u) =
(1 − @)2 1 − v‘ (?) : (u − @)2 ‘¿2 u − v‘ (?)
(ii) In the case of zero drift, ; = 0, the normalized random variable P (1) Xn √ ; #= P(1) # n 2
converges in law to a Rayleigh distribution de;ned by the density xe−x =2 : 2 Xn √ 6 x = 1 − e−x =2 : lim Pr n→∞ # n (iii) In the case of a positive drift, ;¿0, the standardized version of Xn , 2 P (1) P (1) P (1) Xn − Hn P (1) 2 √ ; H= ; P = + − P(1) P(1) P(1) P(1) P n converges in law to a Gaussian variable N(0; 1): x 2 1 Xn − Hn √ 6x = √ e−y =2 dy: lim Pr n→∞ P n 2 −∞ In the case of a negative drift, the limiting distribution admits an explicit form c‘ v‘ (?)−k [uk ]$(u) = @−k (c0 + c1 k) + ‘¿2
for a set of constants cj that can be made explicit by a partial fraction expansion of $(u). Proof. (i) For a negative drift, one directly shows that the probability generating function of Xn at u converges pointwise to a limit that precisely equals $(u), the convergence holding for u ∈ (0; 1). By the fundamental continuity theorem [27, p. 280]
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
73
for probability generating functions (PGFs), this entails convergence in law of the corresponding discrete distributions. We now (x a value of u taken arbitrarily in (0; 1) and treated as a parameter. The PGF of Xn is [z n ]F(z; u) ; [z n ]F(z; 1) where F(z; u) is given by Theorem 2. In the case of a negative drift we know from the proof of Theorem 4 that @ = v1 (?) satis(es @¿1 while the radius of convergence of F(z; 1) coincides with the structural radius ?. Then, the quantity Y1 (z; u) =
d ‘¿2
1 u − v‘ (z)
is analytic in the closed disk |z|6?: being a symmetric function of the non-principal large branches, it has no algebraic singularity there; given the already known domination relations between the large branches (Lemma 2), the denominators cannot vanish. It then suSces to analyse the factor containing the principal large branch v1 . This factor has a branch point at ?, where 1 P(@) 1 1 2 1 − z=? ∼ + 2 u − v1 (z) u − @ (u − @) P (@) as follows directly from (42) and the fact that v1 is conjugate to u1 at z = ?. Singularity analysis then gives instantly the fact that, for some non-zero constant C, [z n ]F(z; u) ∼ C?−n n−3=2 /(u);
where /(u) =
1 Y1 (?; u) (u − @)2
and the result follows after normalization by [z n ]F(z; 1). For the remaining two cases, it will prove convenient (rst to estimate the mean value (expectation E(·)) of Xn , E(Xn ) =
[z n ]Fu (z; 1) ; [z n ]F(z; 1)
(49)
where Fu indicates diNerentiation with respect to u. Logarithmic diNerentiation gives Fu (z; 1) = F(z; 1)
d ‘=1
1 ; 1 − v‘ (z)
(50)
from which one attains singularities easily. (ii) In the case of a zero drift, the value of the structural constant is @ = 1 and the radius of convergence of F(z;
1) is ? = 1=P(@) = 1=P(1). Then, the singularity at ? of Fu (z; 1) combines a factor 1= 1 − z=? that arises from F(z; 1) and another similar factor that arises from the term (1 − v1 (z))−1 . This singularity is thus, to (rst-order
74
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
asymptotics, similar to a simple pole. A √ computation based again on (42) reveals that the mean value of Xn is of the order of n. Precisely, one (nds n P (1) ; #= : E(Xn ) ∼ # 2 P(1)
(Note that =2 is the mean of the standard Rayleigh distribution.) The formula of Corollary 3 then suggests that Fk (z) should behave very much like v1k , implying that the √ coeScients should resemble, up to scaling, the coeScients in the large power [z n ](1 − 1 − z)k . Such a situation is known to be conducive to Rayleigh laws: it is covered extensively in Drmota and Soria’s study [21] and revisited in the paper [5]; see also [20]. In particular, Theorem 1 of [21] gives us the convergence in distribution to the Rayleigh law, while a simple adaptation of the results of Appendix B in [5] provides corresponding density estimates (a “local” limit law). We omit the tedious but routine details. (iii) For a positive drift, probabilistic intuition indicates that there are relatively few chances for a walk to ever come under the negative axis, and when this happens, it only tends to do so early in the history of the walk. Consequently, the (nal altitude should be only marginally aNected by the meander conditioning. In this case, one has @¡1 and the radius of convergence of F(z; 1) is ?1 = 1=P(1) while the structural radius satis(es ?¿?1 . By de(nition, one has v1 (?1 ) = 1. Consequently, the function Fu (z; 1) in (50) admits a double pole at ?1 , with Fu (z; 1) ∼ F(z; 1)
1 v1 (?1 )(z
− ?1 )
:
so that (one has v1 (?1 ) = −(?21 P (1))−1 ), E(Xn ) =
[z n ]Fu (z; 1) P (1) =n + O(1): n [z ]F(z; 1) P(1)
In the probabilistic case, the coeScient of n in the estimate reduces to the drift, and this estimate does agree with the probabilistic argument sketched above. Similarly, the variance is found to satisfy 2 P (1) P (1) P (1) n + O(1): Var Xn = + − P(1) P(1) P(1) Finally, the Gaussian law is established from the power-sum form of Corollary 3 upon applying Cauchy’s coeScient formula. One has dz 1 [z n ]Fk (z) = .1 (z)v1 (z)−k−1 n+1 + Rn;k : 2i z |z|=?1 The error term Rn; k that arises from all the non-principal branches is exponentially smaller than ?1−n because of the domination properties of 1=v1 (z) (see the proof of Lemma 2, once more). The main integral is then treated by the saddle-point method
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
75
√ in the range considered, k = Hn + O( n) with H := P (1)=P(1). The saddle-point of the integrand is at ?1 , very nearly. The Gaussian density then comes out from a standard saddle-point perturbation analysis. 5. Directed two-dimensional models The kernel method is generally well suited to problems where all the jumps are of the form (aj ; bj ) with aj ¿0. In this case, each choice of a step implies progression along the horizontal axis. One considers the trivariate GF Fn;p;q z n xp yq ; F(z; x; y) := n;p;q
where Fn; p; q is the number of meander paths in Z¿0 × Z¿0 with size (number of steps) equal to n that connect the origin to the point of coordinates (p; q). The walk is thus directed in the sense of Section 1. As we now explain such enumeration problems, though formulated in two-dimensional space, are in fact fake one-dimensional problems amenable to the kernel method. In the directed case, the method of “adding a slice” encountered in Eqs. (14) and (16) gives rise to the fundamental equation F(z; x; y)(1 − zP(x; y)) = 1 − z{y¡0 }(P(x; y)F(z; x; y));
(51)
where the characteristic polynomial is now aj bj x y ; P(x; y) := j
which is entire in x but of Laurent type with respect to y. The parameters of size (marked by z) and horizontal displacement (marked by x) are bound by linear inequalities, and one of them can be treated as the basic variable, the other as an auxiliary parameter or even the constant 1. Then, the adaptation of the kernel method consists in binding the Laurent variable, here y, to the basic variable chosen (x or z) by 1 − zP(x; y) = 0:
(52)
Newton’s polygon then shows that, for the bound equation, the number of “small” roots of the kernel equation coincides with the maximum negative vertical span, namely, c := | minj bj |, and this number is precisely the number of unknown functions on the right-hand side of (51). We let uj represent these small branches. The treatment of walks and bridges adapts easily from what has been done earlier. Regarding excursions and meanders, substitution of the uj then shows the following: The GF of excursions (de;ned by ;nal altitude 0) and the BGF of meanders (de;ned by ;nal altitude ¿0) depend rationally on the variables z; x and the set of small branches {uj } of the associated “kernel equation” (52). Example 10. Chess moves of Labelle and Yeh. In two papers [49,50], Labelle and Yeh develop an interesting set of decompositions for generalized knight moves on a
76
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
chessboard. The standard version of the problem is: Consider the Z¿0 ×Z¿0 chessboard. How many sequences of Eastbound knight moves (S= {(1; 2); (1; −2); (2; 1); (2; −1)}) are there from (0; 0) to (n; 0)? By de(nition, the moves are not allowed to involve points with negative coordinates. As size is not needed, we take x as the independent variable and set z = 1. The kernel equation is then 1 − (xy2 + xy−2 + x2 y + x2 y−1 ) = 0; so that the characteristic curve is a quartic. The vertical symmetry of the moves implies that the kernel equation can be rewritten as a combination of two quadratic equations, 1 − x(W 2 + xW − 2) = 0;
W := y +
1 : y
There results that the four branches of the characteristic equation are given by
1 1 y± (W ) = (W ± W 2 − 4); W± (x) = (−x2 ± x4 + 8x2 + 4x): 2 2x It appears that the two small branches u1 ; u2 correspond to taking opposite signs in the determinations of y(W ) and W (x), and one (nds for the GF of excursions (i.e., paths terminating at altitude 0), in complete analogy to the simple walk, 1 1 E(x) = − (u1 (x)u2 (x)) = − y− (W+ (x)) · y+ (W− (x)) x x = 1 + x2 + 3x4 + 2x5 + 12x6 + 14x7 + 54x8 + 86x9 + · · · : This is the sequence (an ) of [49] and also EIS A005220. Decomposability renders especially easy the asymptotic analysis of the number of excursions and of corresponding parameters. More general knight moves can be treated similarly by the kernel method. In particular, the equation satis(ed by the excursion generating functions tends to be of a degree exponential in c; see [49,50]. Here, the kernel method yields a reduction to an equation of degree 2c, which even reduces to a resolvent of degree c when symmetry is taken into account via the W -parameterization. This illustrates a sharp contrast between the exponential blow-up in combinatorial complexity and the linear character of the analytic complexity. 6. Conclusion In this paper, we have aimed at illustrating the analytic tractability of many onedimensional path problems, a boon of the kernel method. The reduction in the asymptotic–analytic complexity of the problem is often spectacular, as exempli(ed by Duchon’s clubs or the Labelle–Yeh knight moves. Parameters that are easily readable on paths lead to generating functions whose singularities arise simply from the branches of a characteristic curve of low degree. The method applies to all one-dimensional problems as well as to two-dimensional problems provided they remain directed. For
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
77
a thorough discussion of the algebraic power of the kernel method, we refer once more to the study by Bousquet-MWelou and PetkovYsek [13]. (The kernel technique is also reminiscent of Tutte’s quadratic method much of use in the enumerative theory of planar maps [42]; see Bousquet-MWelou’s paper [11] for a perspective.) The case of undirected two-dimensional problems, where one can go back and forth in all four cardinal directions, is appreciably harder. Even in the case of movement of amplitude 61, Fayolle et al. show [26] that stationary solutions involve elliptic functions and integrals. Some directed path problems in dimension higher than 2 can however still be successfully treated by speci(c combinatorial decompositions; see [12] for an example. A tribute to Maurice Nivat. As is apparent from the bibliography of this paper, many papers directly relevant to our study have been published in the journal Theoretical Computer Science along the years. We owe much for this to the Editor-in-Chief, Maurice Nivat. His openness of mind has been a constant help in the emergence and shaping up of sub-communities within theoretical computer science. Examples are the GASCOM (Generation of Random Combinatorial Objects) and AofA (Analysis of Algorithms) communities which have greatly bene(tted from special issues of TCS, this at the invariably encouraging initiative of Maurice. In view of this and of Maurice’s long-standing interest in similar discrete geometrical objects (see, e.g., [6,7,9,17]), we kindly dedicate this study to him. Acknowledgements This work was supported in part by the IST Programme of the EU under contract number IST-1999-14186 (ALCOM-FT). The authors are grateful to Philippe Robert for many insightful discussions on probabilistic aspects of random walks as well as to Mireille Bousquet-MWelou and an anonymous referee for a careful scrutiny of the paper that greatly helped us improve our presentation. Thanks (nally to Christian Krattenthaler for valuable bibliographical remarks. References [1] S.-S. Abhyankar, Algebraic Geometry for Scientists and Engineers, American Mathematical Society, 1990. [2] C. Banderier, Combinatoire analytique: application aux marches alWeatoires, D.E.A. memoir, UniversitWe Paris VII, July 1998. [3] C. Banderier, Combinatoire analytique des chemins et des cartes, Ph.D. thesis, UniversitWe Paris VI, June 2001. [4] C. Banderier, M. Bousquet-MWelou, A. Denise, P. Flajolet, D. Gardy, D. Gouyou-Beauchamps, Generating functions of generating trees, Tech. Report ALCOM FT-TR-01-17, Alcom-FT Project, February 2001, 26 pages, Accepted for publication in Discrete Mathematics. [5] C. Banderier, P. Flajolet, G. SchaeNer, M. Soria, Random maps, coalescing saddles, singularity analysis, and Airy phenomena, Random Structures & Algorithms. 19 (2001) 194–246. [6] E. Barcucci, S. Brunetti, A. Del Lungo, M. Nivat, Reconstruction of discrete sets from three or more X-rays, Discrete Math. 241 (2001) 65–78.
78
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
[7] E. Barcucci, A. Del Lungo, M. Nivat, R. Pinzani, Reconstructing convex polyominoes from horizontal and vertical projections, Theoret. Comput. Sci. 155 (2) (1996) 321–347. [8] E. Barcucci, R. Pinzani, R. Sprugnoli, The random generation of directed animals, Theoret. Comput. Sci. 127 (2) (1994) 333–350. W RWemila, M. Robson, Tiling (gures of the plane with two bars, Comput. [9] D. Beauquier, M. Nivat, E. Geom. Theory Appl. 5 (1) (1995) 1–25. [10] J. Berstel (Ed.), SWeries formelles, LITP, University of Paris, 1978. (Proceedings of a School, Vieux– Boucau, France, 1977.) [11] M. Bousquet-MWelou, On (some) functional equations arising in enumerative combinatorics, Preprint, 2001. [12] M. Bousquet-MWelou, A.J. Guttmann, Three-dimensional self-avoiding convex polygons, Physical Review E. Statistical Physics, Plasmas, Fluids, and Related Interdisciplinary Topics. Third Series 55(6) part A (1997), R6323–R6326. [13] M. Bousquet-MWelou, M. PetkovYsek, Linear recurrences with constant coeScients: the multivariate case. Discrete Math. 225 (1–3) (2000) 51–75. [14] L. Comtet, Calcul pratique des coeScients de Taylor d’une fonction algWebrique, Enseign. Math. 10 (1964) 267–270. [15] L. Comtet, Advanced Combinatorics, Reidel, Dordrecht, 1974. [16] N.G. de Bruijn, Asymptotic methods in analysis, Dover, 1981, A reprint of the third North Holland edition, 1970 (1st Edition, 1958). [17] A. Del Lungo, M. Nivat, R. Pinzani, The number of convex polyominoes reconstructible from their orthogonal projections, Proceedings of the 6th Conference on Formal Power Series and Algebraic Combinatorics, New Brunswick, NJ, 1994, Vol. 157, 1996, pp. 65 –78. [18] M. Delest, G. Viennot, Algebraic languages and polyominoes enumeration, Theoret. Comput. Sci. 34 (1984) 169–206. [19] Peter G. Doyle, J. Laurie Snell, Random Walks and Electric Networks, Mathematical Association of America, Washington, DC, 1984. [20] M. Drmota, Asymptotic distributions and a multivariate Darboux method in enumeration problems, J. Combin. Theory Ser. A 67 (1994) 169–184. [21] M. Drmota, M. Soria, Images and preimages in random mappings, SIAM J. Discrete Math. 10 (2) (1997) 246–269. [22] P. Duchon, On the enumeration and generation of generalized Dyck words, Discrete Math. 225 (1–3) (2000) 121–135. (Formal power series and algebraic combinatorics, Toronto, Ont., 1998.) [23] M. Durand, Asymptotics of the “klam” recurrence, Preprint, 2001. [24] L. Euler, Observationes analyticae, Novi Commentarii Acad. Sci. Imper. Petropolitanae 11 (1765) 124– 143. [25] G. Fayolle, R. Iasnogorodski, Two coupled processors: the reduction to a Riemann–Hilbert problem. Z. Warsch. Verw. Gebiete 47 (3) (1979) 325–351. [26] G. Fayolle, R. Iasnogorodski, V. Malyshev, Random Walks in the Quarter-plane, Springer, Berlin, 1999. [27] W. Feller, An Introduction to Probability Theory and its Applications, Vol. 1, 3rd Edition, Wiley, New York, 1968. [28] W. Feller, An Introduction to Probability Theory and its Applications, Vol. 2, Wiley, New York, 1971. [29] P. Flajolet, Combinatorial aspects of continued fractions, Discrete Math. 32 (1980) 125–161. [30] P. Flajolet, The evolution of two stacks in bounded space and random walks in a triangle, in: J. Gruska, B. Rovan, J. Wiedermann (Eds.), Mathematical Foundations of Computer Science, Lecture Notes in Computer Science, Vol. 233, Springer, 1986, Proceedings of the 12th MFCS Symposium, Bratislava, August 1986, pp. 325 –340. [31] P. Flajolet, Analytic models and ambiguity of context-free languages, Theoret. Comput. Sci. 49 (1987) 283–309. [32] P. Flajolet, J. FranPcon, J. Vuillemin, Sequence of operations analysis for dynamic data structures, J. Algorithms 1 (1980) 111–141. [33] P. Flajolet, F. Guillemin, The formal theory of birth-and-death processes, lattice path combinatorics, and continued fractions, Adv. Appl. Probab. 32 (2000) 750–778.
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
79
[34] P. Flajolet, Andrew M. Odlyzko, Singularity analysis of generating functions, SIAM J. Algeb. Discrete Meth. 3 (2) (1990) 216–240. [35] D. Foata, La sWerie gWenWeratrice exponentielle dans les problcemes d’WenumWeration, S.M.S, Montreal University Press, 1974. [36] J. FranPcon, Histoires de (chiers, RAIRO Informat. ThWeor. 12 (1) (1978) 49–62. [37] H. Furstenberg, Algebraic functions over (nite (elds, J. Algebra 7 (1967) 271–277. [38] Ira M. Gessel, A factorization for formal Laurent series and lattice path enumeration, J. Combin. Theory Ser. A 28 (3) (1980) 321–337. [39] Ira M. Gessel, A noncommutative generalization and q-analog of the Lagrange inversion formula, Trans. Amer. Math. Soc. 257 (2) (1980) 455–482. [40] B.V. Gnedenko, A.N. Kolmogorov, Limit Distributions for Sums of Independent Random Variables, Addison-Wesley, Reading, MA, 1968. [41] H.W. Gould, Research bibliography on two number sequences, in: Mathematica Monongaliae, 1971. (A comprehensive bibliography on Bell and Catalan numbers.) [42] Ian P. Goulden, David M. Jackson, Combinatorial Enumeration, Wiley, New York, 1983. [43] P. Henrici, Applied and Computational Complex Analysis, Vol. 2, Wiley, New York, 1974. [44] E. Hille, Analytic Function Theory, Blaisdell Publishing Company, Waltham, 1962, 2 Volumes. [45] F. Kirwan, Complex Algebraic Curves, London Mathematical Society Student Texts, no. 23, Cambridge University Press, Cambridge, 1992. [46] Donald E. Knuth, The Art of Computer Programming, Vol. 1, 3rd Edition, Fundamental Algorithms, Addison-Wesley, Reading, MA, 1997. [47] Donald E. Knuth, The Art of Computer Programming, Vol. 2, 3rd Edition, Seminumerical Algorithms, Addison-Wesley, Reading, MA, 1998. [48] Donald E. Knuth, The Art of Computer Programming, Vol. 3, 2nd Edition, Sorting and Searching, Addison-Wesley, Reading, MA, 1998. [49] J. Labelle, Y. Nan Yeh, Dyck paths of knight moves, Discrete Appl. Math. 24(1–3) (1989) 213–221. (First Montreal Conference on Combinatorics and Computer Science, 1987.) [50] J. Labelle, Y. Nan Yeh, Generalized Dyck paths, Discrete Math. 82 (1990) 1–6. W [51] P.-S. Laplace, ThWeorie analytique des probabilitWes, Vol. I, II, Editions Jacques Gabay, Paris, 1995, Reprint of the 1819 and 1820 editions. [52] M. Lothaire, Combinatorics on Words, Encyclopedia of Mathematics and its Applications, Vol. 17, Addison-Wesley, Reading, MA, 1983. [53] G. Louchard, Asymptotic properties of some underdiagonal walks generation algorithms, Theoret. Comput. Sci. 218 (2) (1999) 249–262. [54] E. Lucas, ThWeorie des Nombres, Gauthier-Villard, Paris, 1891, Reprinted by A. Blanchard, Paris, 1961. [55] A. Meir, J.W. Moon, On the altitude of nodes in random trees, Canad. J. Math. 30 (1978) 997–1015. [56] D. Merlini, D.G. Rogers, R. Sprugnoli, M. Cecilia Verri, Underdiagonal lattice paths with unrestricted steps, Discrete Appl. Math. Combin. Algorithms, Optimization and Computer Science 91 (1–3) (1999) 197–213. [57] Sri G. Mohanty, Lattice Path Counting and Applications, Academic Press [Harcourt Brace Jovanovich Publishers], New York, 1979, Probability and Mathematical Statistics. [58] Sri G. Mohanty, Combinatorial aspects of some random walks, Random walks (Budapest, 1998), JWanos Bolyai Math. Soc., Budapest, 1999, pp. 259 –273. [59] T.V. Narayana, Lattice Path Combinatorics with Statistical Applications, University of Toronto Press, Toronto, Ont., 1979. [60] Maurice Nivat, Langages algWebriques sur le magma libre et sWemantique des schWemas de programme, Automata, languages and programming (Proc. Symp., Rocquencourt, 1972), North-Holland, Amsterdam, 1973, pp. 293–308. [61] A.M. Odlyzko, Asymptotic enumeration methods, in: R. Graham, M. GrQotschel, L. LovWasz (Eds.), Handbook of Combinatorics, Vol. II, Elsevier, Amsterdam, 1995, pp. 1063–1229. [62] J. Pitman, Brownian motion, bridge, excursion, and meander characterized by sampling at independent uniform times, Electron. J. Probab. 4(11) (1999) 33 (electronic). [63] G. PWolya, Sur les sWeries enticeres dont la somme est une fonction algWebrique, Enseig. Math. 1–2 (1921– 1922) 38–47.
80
C. Banderier, P. Flajolet / Theoretical Computer Science 281 (2002) 37 – 80
[64] H. Prodinger, On a functional-diNerence equation of Runyon, Morrison, Carlitz, and Riordan, Sem. Lothar. Combin. 46 (2001), paper B46a, 4 pp. (electronic). [65] G.N. Raney, Functional composition patterns and power series reversion, Trans. Amer. Math. Soc. 94 (1960) 441–451. [66] P. Robert, RWeseaux et (les d’attente: mWethodes probabilistes, Math. Appl., Vol. 35, sPRINGER, pARIS, 2000. [67] B. Salvy, P. Zimmermann, GFUN: a Maple package for the manipulation of generating and holonomic functions in one variable, ACM Trans. Math. Software 20 (2) (1994) 163–167. [68] M. Sato, Generating funtions for the number of lattice paths between two parallel lines with a rational incline, Math. Japonica 34 (1) (1989) 123–137. [69] R. Sedgewick, P. Flajolet, An Introduction to the Analysis of Algorithms, Addison-Wesley Publishing Company, Reading, MA, 1996. [70] N.J.A. Sloane, The on-line encyclopedia of integer sequences, 2000, Published electronically at http://www.research.att.com/njas/sequences/. [71] N.J.A. Sloane, S. PlouNe, The Encyclopedia of Integer Sequences, Academic Press, New York, 1995. [72] R.P. Stanley, Enumerative Combinatorics, Vol. II, Cambridge University Press, Cambridge, 1998. [73] J. van Leeuwen (Ed.), Handbook of Theoretical Computer Science, vol. B: Formal Models and Semantics, North-Holland, Amsterdam, 1990. [74] A. Chi Chih Yao, An analysis of (h; k; 1)-Shellsort, J. Algorithms 1 (1) (1980) 14–50. [75] A. Chi Chih Yao, An analysis of a memory allocation scheme for implementing stacks, SIAM J. Comput. 10 (2) (1981) 398–403.
Theoretical Computer Science 281 (2002) 81 – 97
www.elsevier.com/locate/tcs
Groups and tilings Dani#ele Beauquiera; ∗ , Jean-Claude Fournierb a Laboratory
of Algorithmics, Complexity and Logic, Department of Informatics, University Paris-12, 61 Av. du G$en. de Gaulle, 94010 Creteil, France b Equipe Combinatoire, CNRS Paris-6, Department of Informatics, University Paris-12, 61 Av. du G$en. de Gaulle, 94010 Cr$eteil, France
Abstract We prove that the word problem for the group of dominoes is equivalent to the existence of a directed tiling for the corresponding closed curve in the plane, which, in turn is equivalent to the fact that the curve is “balanced”. This last property beeing decidable, the word problem is also decidable. Moreover we prove that this result is transposable in any other regular grid c 2002 Elsevier Science (hexagonal or triangular) and we partially extend it to “exact” tiles. B.V. All rights reserved.
1. Introduction Conway [2] introduced a technique using in7nite 7nitely presented groups which permits to answer the question whether a region of the plane is tilable by translation of given tiles. This idea was developed later in numerous papers [7,5,3]. Consider a group Gs (s for square) de7ned by two generators a; b and relations abba−1 b−1 b−1 = 1 and baab−1 a−1 a−1 = 1 which represent the contour words of vertical and horizontal dominoes, respectively. It is easy to prove that if a region R of the Z2 -grid is tilable by dominoes then the contour word of R belongs to the group Gs . In [2], it is proved that the converse is not necessarily true and the authors introduce the notion of signed tiling which turns out to be the appropriate geometrical interpretation of the fact that a region has a contour word equal to 1 in the group Gs . Actually, [2] proves that a region R of the plane has a contour word equal to 1 in the group Gs i= it admits a signed tiling.
∗ Corresponding author. E-mail addresses:
[email protected] (D. Beauquier),
[email protected] (J.-C. Fournier).
c 2002 Elsevier Science B.V. All rights reserved. 0304-3975/02/$ - see front matter PII: S 0 3 0 4 - 3 9 7 5 ( 0 2 ) 0 0 0 0 8 - 7
82
D. Beauquier, J.-C. Fournier / Theoretical Computer Science 281 (2002) 81 – 97
O
Fig. 1. The chessboard like plane.
In this paper, we extend this result in several directions. Firstly we prove that this result holds also for general closed curves. The case of general closed curves was never considered before. Secondly, we extend the result to the di=erent regular lattices of the plane, triangular and hexagonal ones. More precisely we prove that for the three regular lattices, the three following properties are equivalent: (1) w = 1 in the considered associated group, (2) there exists a signed tiling with boundary w, (3) w de7nes a balanced closed curve. As a consequence of the last property we get that the word problem is decidable for each of the three considered groups. As far as we know, it is a new result for the hexagonal case. Thirdly we propose a generalization of the set of possible used tiles and get partial results in this case. Section 2 is devoted to the square lattice and Section 3 to the hexagonal one. Section 4 proposes a generalization and states a conjecture which provides an in7nite class of groups for which the word problem should be decidable.
2. The 2-squares group G s 2.1. Preliminaries Let a Z2 -grid which de7nes a tiling of the euclidian plane with unit squares called cells. The plane is colored like a chessboard (see Fig. 1). Consider the four letters alphabet A = {a; a ; b; b } encoding, respectively, a unit move on the right, on the left, upwards and downwards on the Z2 -grid. A vertex A ∈ Z2 and a word w on the alphabet A de7nes a curve on the Z2 -grid starting in A and following the moves given by the sequence of letters of w. The end of this curve is denoted by A + w. If O is the origin of the grid, the curve is denoted by Cw . If w is a word on this alphabet, and x is a letter, we denote by |w| the length of w and by |w|x the number of occurrences of x in w. The empty word is denoted 1. If w is a word, w˜ is de7ned inductively as follows: 1˜ = 1;
a˜ = a ;
b˜ = b ;
x = x˜w: if x is letter; w ˜
a˜ = a; b˜ = b;
D. Beauquier, J.-C. Fournier / Theoretical Computer Science 281 (2002) 81 – 97
83
b
a -1
a b
-1
An horizontal domino with (direct) contour word aaba-1a -1b -1
A vertical domino with (direct) contour word abba -1b -1b -1
Fig. 2. The two dominoes.
Two words w1 and w2 ar called conjugate if there exist words u and v such that w1 = uv and w2 = vu. The conjugation is an equivalence relation and the equivalence class of w will be denoted by [w]. A word w de7nes a closed curve i= |w|a = |w|a and |w|b = |w|b . A vertical domino has a direct contour word which is a conjugate of abba b b depending on the starting vertex and an horizontal domino has a direct contour word which is a conjugate of aaba a b . A directed domino is a domino with a 7xed choice of orientation of the contour (Fig. 2). Let us consider the 2-squares group Gs de7ned by two generators a and b and the two relations abba−1 b−1 b−1 = 1;
aaba−1 a−1 b−1 = 1
which correspond, respectively, to direct contour words of vertical and horizontal dominoes. There is a morphism from A∗ onto Gs which maps letters a; b, respectively, onto generators a; b, and a ; b respectively, onto the inverse of generators a; b. From now on, we identify a ; b , respectively, to their image in Gs , namely a−1 ; b−1 . For two words w1 and w2 we write w1 ≡ w2 i= 1 and w2 have the same image in Gs by this morphism. Let =df aba−1 b−1 . This word is a direct contour word of a cell. In a standard way, one associates to Gs a rewriting system, whose rules are the following ones: Rules of type (I) aa−1 → 1;
a−1 a → 1;
bb−1 → 1;
b−1 b → 1
and the reverse ones. Rules of type (II) w → w ∗
˜ if ww˜ ∈ [ ] ∪ [ ]:
We write w → w i= w is obtained from w using the rewriting rules of Gs , and by ∗ w i= w ≡ w . We are interested in the word problem for de7nition of Gs we have w →
84
D. Beauquier, J.-C. Fournier / Theoretical Computer Science 281 (2002) 81 – 97
the group Gs , namely is the property w ≡ 1 decidable? In order to solve this problem we introduce some notions. 2.2. Balanced closed curves First of all, let us de7ne the index of a cell and the index of a color according to a closed curve C. Afterwards, “closed curve” means “bounded closed curve”. The index of a cell c according to a bounded closed curve C, denoted by IC (c), is the number of turns of C around cell c, taking into account the direct or undirect sense of the turns. This index can be computed as follows: consider a vertical line going up from in7nity to the center of the cell and add the weights of all the directed unit segments of C crossed by , a segment directed to the right or upwards has weight 1, a segment directed to the left or downwards has weight −1. We can generalize this notion to a 7nite set of directed unit segments of the Z2 -grid instead of a closed curve. Let S be a set of directed unit segments of the Z2 -grid. The index of a cell c according to S, denoted by IS (c), is the number of segments of S crossed by a vertical line going up from in7nity to the center of the cell, each segment being counted with its weight. For simplicity we will denote by Iw (c) the index ICw (c). The index of a color i ∈ {black; white} according to a closed curve C, denoted by IC (i) is the sum of the indices of the cells colored by i: IC (i) =
color(c)=i
IC (c):
Notice that since the curve is bounded only a 7nite set of cells have a nonnull index, so the above sum is 7nite. A bounded closed curve C is balanced if IC (black) = IC (white): The notion of balanced closed curve is introduced in [2] in a slightly di=erent but equivalent way. 2.3. Directed tiling with boundary a closed curve C Let C be a closed curve. A directed tiling with boundary C is a set D of directed dominoes such that for every unit segment s of the Z2 -grid, the sum of weights of the directed segments of C with support s (with their multiplicity), denoted by WC (s), is equal to the sum of weights of the directed segments of D with support s, denoted by WD (s). An example is shown in Fig. 3. If w is a word, for simplicity we will write Ww (s) instead of WCw (s).
D. Beauquier, J.-C. Fournier / Theoretical Computer Science 281 (2002) 81 – 97
3
85
4
2
5
1 Fig. 3. A closed curve C and a directed tiling with boundary C.
2.4. Relations between tilings, balance, and the word problem Theorem 1. Let w be a
A (i)u ≡ u A+u (i);
−1
A−1 (i)u ≡ u A+u (i):
(ii) If Cu is a closed curve,
A (i)u ≡ u A (i);
A−1 (i)u ≡ u A−1 (i):
(iii)
A (black) A (white) ≡ A (white) A (black) ≡ 1: Proof. (i) For symmetry reasons we have only to consider A = O and i = black. Thus A (i) = aba−1 b−1 . The proof is by induction on the length of u. For |u| = 0, the property holds. For |u| = 1, there are four cases to consider. • u=a We have to prove (aba−1 b−1 )a ≡ a(ba−1 b−1 a). Obvious. • u = a−1 We have to prove (aba−1 b−1 )a−1 ≡ a−1 (ba−1 b−1 a). Notice that for any letters x; y we have xyx−1 ≡ x−1 yx. Thus (aba−1 b−1 )a−1 = (aba−1 )b−1 a−1 ≡ (a−1 ba)b−1 a−1 = a−1 b(ab−1 a−1 ) ≡ a−1 b −1 −1 (a b a). QED
86
D. Beauquier, J.-C. Fournier / Theoretical Computer Science 281 (2002) 81 – 97
• u=b We have to prove (aba−1 b−1 )b ≡ b(ba−1 b−1 a). (aba−1 b−1 )b ≡ aba−1 ≡ bb−1 aba−1 ≡ b(b−1 ab)a−1 ≡ b(bab−1 )a−1 . QED • u = b−1 We have to prove (aba−1 b−1 )b−1 ≡ b−1 (ba−1 b−1 a). (aba−1 b−1 )b−1 ≡ a(ba−1 b−1 )b−1 ≡ a(b−1 a−1 b)b−1 ≡ ab−1 a−1 ≡ b−1 b(a−1 b−1 a). QED For |u|¿1, let u = xv with x ∈ A. By induction hypothesis: u A (i) = xv A (i) ≡ x A+v (i) ≡ (A+v)+x (i)x = A+xv (i)x = A+u (i)x. QED The second equivalence of (i) is obtained straightforwardly from the 7rst one, computing inverses of each member. (ii) Clear from (i) since in the case when Cu is a closed curve, A (i) = A+u (i). (iii) C A (i) is a closed curve, so from (ii) we get:
A (black) A (white) ≡ A (white) A (black): Then A (black) A (white) has two possible values depending on the position of point A with respect to black cells. First case:
A (black) A (white) = (aba−1 b−1 )(ba−1 b−1 a) ≡ aba−1 a−1 b−1 a ≡ 1. Second case:
A (black) A (white) = (ba−1 b−1 a)(aba−1 b−1 ) = ba−1 b−1 a(aba−1 )b−1 ≡ ba−1 b−1 a(a−1 ba)b−1 ≡ 1. The second lemma expresses an invariant property of the rewriting operation Lemma 2. For every word w such that Cw is a closed curve, every rewriting w → w satis<es: (i) Cw is a closed curve (ii) Cw is balanced i= Cw is balanced. Proof. (i) is clear, since every rewriting rule keeps invariant the di=erences between the number of occurrences of a letter x and its inverse x. ˜ (ii) One has to consider every rule. We just give the proof for one of them, the other cases are similar. Consider the rule a → b−1 b−1 abb. Let w = w1 aw2 and w = w1 b−1 b−1 abbw2 . As shown in Fig. 4, only two cells have their index modi7ed in this transformation, namely the cells c1 and c2 . We have Iw (c1 ) = Iw (c1 ) + 1 and
Iw (c2 ) = Iw (c2 ) + 1:
But one of the cells is black and the other one is white, so Cw is balanced i= Cw is balanced. The following lemma expresses the link between the number of white and black cells in a region and the possible reduction of its contour word.
D. Beauquier, J.-C. Fournier / Theoretical Computer Science 281 (2002) 81 – 97
87
a c1
b
-1
c1
b
c2
b -1
c2
b
a Fig. 4. Modi7cation of indices.
T
O
Fig. 5. A spanning tree.
Lemma 3. If Cw is a direct (resp. undirect) simple closed curve whose interior contains p black cells more than white ones, then w ≡ p (resp. w ≡ −p ). In other words, if Cw is a simple closed curve, then w ≡ Iw (black)−Iw (white) . Proof. Recall that = aba−1 b−1 . Suppose 7rstly that Cw is direct and let R be the region inside Cw . Let D be a maximal set of disjoint dominoes inside Cw and let T be the domain covered by dominoes of D. If R = T , it means that there is an exact tiling of R, and it is well known [2,7] that in that case, w ≡ 1. Actually, in that case, Cw is balanced and p = 0. If T ⊂ R, using only the edges of dominoes of D one can draw a tree which joins the origin O and the noncovered cells of R (Fig. 5). If we “cut” the domain T along the edges of the tree we get a word w such that ww is a direct contour word of T starting in O (Fig. 6). Since T is tiled by dominoes, one has ww ≡ 1. Thus w ≡ w−1 : We are to prove w−1 ≡ p . In order to make the reduction easier, we replace w by w such that w ≡ w and w contains the undirect contour of each cell of R not covered by D as it is shown in Fig. 7. Now we use Lemma 1 to shift all the cells of R not covered by D at the origin O, following the path drawn by w . If there are n + p black cells of R not covered by
88
D. Beauquier, J.-C. Fournier / Theoretical Computer Science 281 (2002) 81 – 97
Fig. 6. A direct contour word of T .
Fig. 7. Modi7cation of w .
D and n white cells of R not covered by D, we get: w ≡ 0−(n+p) (black) 0−n (white)w where w is reducible to 1 using relations xx−1 ≡ 1 for x ∈ A. We obtain 7nally: w ≡ w−1 ≡ w−1 ≡ 0n+p (black) 0n (white) ≡ 0p (black) = p : Suppose now that Cw is an undirect simple closed curve. Then Cw˜ is a direct simple closed curve and thus: w˜ ≡ p ; So w ≡ −p . ∗
Proof of Theorem 1. (i) ⇒ (ii). Suppose w → 1. Each rewriting rule u → u of type (I) de7nes a directed domino whose directed contour word is uu−1 . Thus the reduction ∗ w → 1 de7nes a set of directed dominoes S corresponding to rules of type (I) used in this derivation. We claim that S is a directed tiling with boundary Cw . Let wn be the word obtained after using n rules, and Sn be the corresponding set of n directed dominoes obtained after n rules. Thus w0 = w and S0 = ∅. As a matter of fact, for each segment s the value of Wwn (s)+WSn (s) is independent of n. Clearly a rule of type (I) keeps Wwn (s) and WSn (s) unchanged. Concerning rules of type (II), take for example the rule bab−1 → b−1 ab (other cases are similar). There are six segments for which Wwn (s) and WSn (s) may change, namely the boundary segments of the domino de7ned by the rule. It is clear from Fig. 8 that for each of these six segments, the value of Wwn (s) + WSn (s) is unchanged.
D. Beauquier, J.-C. Fournier / Theoretical Computer Science 281 (2002) 81 – 97
89
a b -1
b
-1 b
b a
Fig. 8. Modi7cation of segment weights. ∗
Let N be the length of the derivation w → 1. The sum Ww0 (s) + WS0 (s) is thus equal to WwN (s) + WSN (s). But wN = 1, so WwN (s) = 0. Moreover SN = S. Therefore, Ww (s) = WS (s) for every s and the claim is proved. (ii) ⇒ (iii). Let D be a directed tiling with boundary Cw . We will prove that the closed curve Cw is balanced, i.e. Iw (black) = Iw (white). Since for every segment s we have WD (s) = Ww (s), we can write: Iw (c) − Iw (c) color(c)=black
=
d∈D
color(c)=white
Id (cd ) − Id (cd ) +
c=cd ∧c=cd
Id (c) ;
(1)
where d represents a domino of D; cd ; cd , respectively, its black and white cell, and Id (x) represents the index of cell x according to the set of directed segments of domino d. For each domino d we have Id (c) = 0 for c = cd ∧ c = cd . On the other hand, for each domino d; Id (cd ) = Id (cd ). Thus from (1) we get the result. (iii) ⇒ (iv). Firstly a notation: for a non empty word u, we denote by
q , and w ≡ u. Thus using Lemma 2, Iu (black) − Iu (white) = Iv (black) − Iv (white) = 0. On the other hand, Iu (black) − Iu (white) = q. So q = 0 and then w ≡ 1.
90
D. Beauquier, J.-C. Fournier / Theoretical Computer Science 281 (2002) 81 – 97
a b c
O
c a b
Fig. 9. The hexagonal grid.
T1
T2
B1
B2
B3
Fig. 10. Five tiles.
3. The 3-hexes group G h In this section, we are interested in tilings of the hexagonal grid in the plane. We prove that the results obtained for the square grid hold also for the hexagonal one. The plane is here colored with three colors black; white; gray (Fig. 9) and the used tiles are all the balanced 3-hexes [4]: 2 “triangles” and 3 “bars” (see Fig. 10). The corresponding group Gh is de7ned by three generators a; b; c and the following relations: a2 = b2 = c2 = 1; (ca)2 (bc)2 (ab)2 = 1 (T1 ); (ab)2 (ca)2 (bc)2 = 1 (T2 ); (ca)3 b(ca)3 b = 1 (B1 ); (ab)3 c(ab)3 c = 1 (B2 ); (bc)3 a(bc)3 a = 1 (B3 ): Actually this set of relations is not minimal, relations T2 ; B2 and B3 for example can be deduced from the other ones. Fig. 11 gives a geometric view of these dependencies (hexagons are represented as black points). The notions de7ned in Section 2 can be easily transposed. Since there are three colors, there are three indices of a closed curve, one for each color.
D. Beauquier, J.-C. Fournier / Theoretical Computer Science 281 (2002) 81 – 97
91
B2
B2 B2 T1
B3
T1 T2
T1
B1 B1 from B 2 and T 1
T 2 from B 2 and T 1
B3 from B 2 and T 1
Fig. 11. Dependencies between tiles.
A closed curve is balanced if IC (black) = IC (white) = IC (gray). Here is the hexagonal version of Theorem 1: Theorem 2. Let w be a
92
D. Beauquier, J.-C. Fournier / Theoretical Computer Science 281 (2002) 81 – 97
bac c b a b b ac b c b a
B2
T1 Fig. 12. Shift of a cell.
Proof of Lemma 3 in the hexagonal case. The hexagonal version of the Lemma is as follows: If Cw is a direct (resp. undirect) simple closed curve whose interior contains p black cells more than white ones, and q white cells more than gray ones then w ≡ $0p+q (black)$0q (white) (resp: w ≡ $0−q (white)$0−p−q (black)): The idea of the proof is the same: every cell is “shifted” to the origin and Lemma 1 is used. As a corollary of Theorem 2, we get: Proposition 1. One can decide whether a given word w is equal to 1 in the group G h . 4. Generalization: the group Gp There exist three regular polygons which tile the plane by translation: triangles, squares and hexagons. If we consider a triangular tiling as in Fig. 13 and the associated group Gt with generators a; b; c and relations ab = ba; bc = cb; ca = ac, the results of Theorems 1 holds too, and are easy to prove since Gt is an abelian group. At this point, one can conjecture that these three results for Gs ; G h ; Gt are particular cases of a more general one. Consider a regular tiling of the plane, for example the square one. A polyomino is a simply connected set of unit squares (two squares are connected if they share at least one vertex). Choose a polyomino tile p which tiles the plane by translation. Such a tile is called an exact tile. In [1], it is proved that the exact tile p admits a contour word of the form uvwu˜v˜w˜ (see Fig. 14). Consider a periodic tiling T of the plane with translated copies of p such that p is adjacent to 6 copies of itself (the adjacency may be reduced to a vertex). Such a tiling is called a 6-periodic p-tiling. Provide colors 1; 2; : : : ; n to the n squares of p and extend this coloration to the tiling T (Fig. 15). We have the following property:
D. Beauquier, J.-C. Fournier / Theoretical Computer Science 281 (2002) 81 – 97
93
Fig. 13. A triangular grid.
u ~ w
v
~ v w
~ u Fig. 14. An exact tile.
Lemma 4. Let p be an exact tile. Consider a plane colored by a 6-periodic p-tiling. Every polyomino q of the colored plane which contains exactly one square of each color is also an exact tile. Proof. Let W be a translation vector of T. Denote by qW the translated image of q in translation W . Then q and qW have no common unit square. Actually, suppose a square c belongs to q and qW . Then squares c and cW belong to qW , but these squares have the same color, impossible. Let q be a translated copy of q which intersects p. Consider the sets A = p ∩ q ; B = p\q and C = q \p. Thus p = A ∪ B and q = A ∪ C. By [1], we know that there exist two independent vectors U and V such that the plane is the disjoint union of the copies pkU +k V = (A ∪ B)kU +k V for k; k ∈ Z. It is easy to prove that the plane is also the disjoint union of the copies qkU +k V = (A ∪ C)kU +k V for k; k ∈ Z. Thus q is also an exact tile. Let p be an exact tile with direct contour word uvwu˜v˜w; ˜ T be a 6-periodic p-tiling of the plane and let ( be the starting point of u on the boundary of p. Let c be a
94
D. Beauquier, J.-C. Fournier / Theoretical Computer Science 281 (2002) 81 – 97 1 2
1
3
4
6
7
8
(a)
5
1 1 2
2
3
4
5
6
7
1
8
2
3
4
1
2
3
4
5
6
7
1
2
3
5
3
4
6
7
1
8
4
5
6
7
8
2
3
4
5
6
7
1
8
2
3
4
6
7
1
8
2
3
4
5
6
7
8
2
3
4
5
6
7
6
7
5 5
8
8
8
(b)
Fig. 15. (a) An exact tile p; (b) a 6-periodic p-tiling.
cv
Ω c
V
U
cu
Fig. 16. c; cU and cV .
square of p which contains the vertex (. There are two vectors U and V such that translated copies of c, respectively, cU and cV , are adjacent to p (see Fig. 16). Thus using Lemma 4, pU = p\{c} ∪ {cU } and pV = p\{c} ∪ {cV } are exact tiles. Denote by p the set of three tiles {p; pU ; pV } (Fig. 17). Consider the group Gp with generators a; b and relations q = 1 for the contour words q of the three tiles in p. The notions of directed tiling by p with boundary Cw , closed balanced curve Cw , are de7ned as before. It is easy to prove using the same technics as in theorem 1 that: Lemma 5. Let C be a closed curve with contour word w. (1) w = 1 in the group Gp implies there exists a directed tiling with boundary Cw ,
D. Beauquier, J.-C. Fournier / Theoretical Computer Science 281 (2002) 81 – 97
u
p:
v
~ w
95
w u~
~ v
pV :
pU :
Fig. 17. {p; pU ; pV }.
c+
+ cU Fig. 18. A one step move of a colored cell.
(2) if there exists a directed tiling with boundary Cw then Cw is a closed balanced curve. Finally we prove the following statement: Lemma 6. Consider a plane colored by a 6-periodic p-tiling. If a closed curve C is balanced, there exists a directed tiling by p with boundary C. Proof. Consider the square c used to de7ne p. Denote by c+ (resp. c− ) the square c oriented in a positive (resp. negative) way, and use the same notation for general tiles. + Starting with c+ , if we cover it with the oriented tile p− and cover p− with pU + as shown in Fig. 18 we get cU , in the sense that for each segment s in the plane: Wc+ ∪p− ∪pU+ (s) = WcU+ (s). The same holds for vector V . It means that iterating the process, one can “move” an oriented square from one place into any other place with the same color in the plane (with the same orientation). Now, consider the simpler case when C is a simply closed balanced curve with positive orientation. Let r be the number of squares with a given color inside C.
96
D. Beauquier, J.-C. Fournier / Theoretical Computer Science 281 (2002) 81 – 97
With respect to the weight of segments, C can be looked as the union of its squares oriented positively. Thus each square inside C is “moved”, using tiles of p to the unique cell of the same color in p. Let P be the directed tiling composed with the directed tiles of p used for these moves. We complete P by adding r copies of p− over p. We have W (C ∪ P)(s) = 0 for every segment s. Thus C is the boundary of the directed tiling P− obtained from P by changing the orientation of tiles in P. If we consider now the general case for C, we decompose C into a union of loops by the following “loop algorithm” similar to the one used in Section 2, where u is a contour word of C: Begin ) := 1; * := u; D := ∅ While * = 1 Do ) := )
D. Beauquier, J.-C. Fournier / Theoretical Computer Science 281 (2002) 81 – 97
97
References [1] D. Beauquier, M. Nivat, Tiling the plane with one tile, in: Proc. 6th Annu. Symp. on Computational Geometry, ACM Press, New York, 1990, pp. 128–138. [2] J.H. Conway, J.C. Lagarias, Tiling with polyominoes and combinatorial group theory, J. Combin. Theory 53 (1990) 183–208. [3] J.C. Fournier, Pavage des 7gures sans trous par des dominos: fondement graphique de l’algorithme de Thurston, parallSelisation, unicitSe, dSecomposition, Theoret. Comput. Sci. 159 (1–2) (1997) 105–128. [4] B. GrTunbaum, G.C. Shepard (Eds.), Tilings and Patterns, W.H. Freeman and Company, New York, 1987 [5] C. Kenyon, R Kenyon, Tiling a polygon with rectangles, in: 33rd Symp. on Foundations of Computer Science, IEEE Computer Society, Silver Spring, MD, 1992, pp. 610 – 619. [6] R.C. Lyndon, P.E. Schupp (Eds.), Combinatorial Group Theory, Inst. fTur Technische Informatik und Kommunikationsnetze, ETH ZTurich, 1977. [7] W.P. Thurston, Conway’s tiling group, Amer. Math. Monthly (1990) 757–773.
Theoretical Computer Science 281 (2002) 99 – 107
www.elsevier.com/locate/tcs
Coding rotations on intervals Jean Berstela , Laurent Vuillonb; ∗ a Institut
Gaspard Monge (IGM), Universite de Marne-la-Vallee, 5, boulevard Descartes, 77454 Marne-la-Vallee Cedex 2, France b Laboratoire d’informatique algorithmique: fondements et applications (LIAFA) and CNRS, Universite Denis-Diderot (Paris VII), 2, place Jussieu, 75251 Paris Cedex 05, France
Abstract We show that the coding of a rotation by on m intervals can be recoded over m Sturmian c 2002 Elsevier Science B.V. All rights reserved. words of angle .
1. Introduction The coding of rotations is a tool for the construction of in,nite words over a ,nite alphabet. Consider a rotation R , given by an angle , and de,ned for a point x by R (x) = {x + }, where {y} denotes the fractional part of y. Consider next a partition of the unit circle in m + 1 half open intervals {B0 ; B1 ; : : : ; Bm }. For any starting point x with 06x¡1, one gets an in,nite word u by I (x)I (R (x))I (R2 (x)) · · · I (Rn (x)) : : : ; where I (y)= i if y ∈Bi . In the special case where is irrational and the partition is B0 = [0; [ and B1 = [; 1[, this construction produces exactly the well-known Sturmian words. These words appear in various domains as computer sciences [2], Physics, Mathematical optimization and play a crucial role in this article. It is remarkable that Sturmian words have a combinatorial characterization. Thus, they are exactly aperiodic words with (subword) complexity p(n)= n + 1 where the complexity function p : N → N counts the number of distinct factors of length n in the in,nite word u [2]. The same general construction allows also to compute Rote words with complexity p(n) = 2n by using an irrational rotation and the partition B0 =[0; 12 [ and B1 = [ 12 ; 1[ (see [7]). More generally, one can ∗
Corresponding author. E-mail address:
[email protected] (L. Vuillon).
c 2002 Elsevier Science B.V. All rights reserved. 0304-3975/02/$ - see front matter PII: S 0 3 0 4 - 3 9 7 5 ( 0 2 ) 0 0 0 0 9 - 9
100
J. Berstel, L. Vuillon / Theoretical Computer Science 281 (2002) 99 – 107
0 0 0
0 0
1 1
0 0
1 1 1
0 0 0
0 0 1 0 1 0
1 1 1 1
0 0 0 0
1
0
1 1 0
1 0 0
0 0 1
0 1 1 1
1 0 0 0
2 3
0 0 0
1 1 1 1
1
1 0 1
0 1 1
1
0 0 0 0
0 1 0 0
0 1 0
1 1
1 1 1
1 1 0 0
1 1 1
1 0 0 1
0 1 1 0 1 1 1 0
1 0 1 1
1 1 0 1
0 0 1 0
0 0 1 1
2
0 0 0 1 0 0 0 0
1 1 1 1
0 0 0 0
1 1 1 1
Fig. 1. Automata for m = 1; 2; 3.
obtain in,nite words with complexity p(n) = an + b; where a and b are real, by coding of rotation [1,3]. In addition, codings of rotation with an irrational value of and the partition B0 = [0; [ and B1 =[; 1[ are intimately related to Sturmian words. Indeed, the ,rst sequence is the diBerence term by term of two Sturmian words [6]. Didier gives a characterization of the coding of rotation with a partition of m intervals of length greater than by using Sturmian words and cellular automata [5]. Finally, Blanchard and Kurka study the complexity of formal languages that are generated by coding of rotation [4]. The goal of this article is to show that the coding of a rotation by on m + 1 intervals can be recoded over m + 1 Sturmian words of angle by the use of an automaton. Let the partition of [0; 1[ be given for j = 0; : : : ; m, by [j ; j+1 [, where 0 = 0¡1 ¡2 ¡ · · · ¡j ¡ · · · ¡m+1 = 1, then the kth Sturmian word is given by Jk (x)Jk (R (x))Jk (R2 (x)) · · · Jk (Rn (x)) · · · ; where Jk (y)=1 if y ∈Ik =[k ; k + [ and 0 otherwise (thus the m + 1 Sturmian words have the same language). The automaton for the recoding is a universal automaton (i.e. it is the same for all (m + 1) tuples of Sturmian words). It has m + 1 states. Its edges are (m + 1) tuples of 0 and 1. The edge labeled by the vector composed of the ith letters of each Sturmian word gives the ith letter of the coding of rotation (see Fig. 1).
J. Berstel, L. Vuillon / Theoretical Computer Science 281 (2002) 99 – 107
101
Fig. 2. Partition of the unit circle.
2. Examples Fig. 2 shows a partition of the unit circle into 4 intervals of the form [j ; j+1 [. It shows also the positions of i + and the coding by 8 intervals associated with binary vectors called XK in Section 3. We can ,nd the coding of the interval [j ; j+1 [ by the automaton for m = 3 applied to the binary vector values. As an example, using the universal automaton for m = 3, the four following Sturmian words can be recoded on a word on a four letter alphabet: 10001001000100010 · · · 01000100100010001 · · · 00100100010001001 · · · 00010001001000100 · · · is recoded on the following word: 01230220123012302 · · · : 3. Notation We will consider subsets of [0; 1[ that we call intervals. Let x; y be in [0; 1[. Then we set if x¡y; {z | x 6 z ¡ y} if x = y; [x; y[= ∅ {z | x 6 z ¡ 1} ∪ {z | 0 6 z ¡ y} if x¿y: In particular, [x; y[ =[0; y[ ∪ [x; 1[ if x¿y. This is precisely the notion of an interval on the torus T =R=Z. Let ; 1 ; : : : ; m be numbers in the interval ]0; 1[, with 1 ¡ · · · ¡m . It will be convenient to set 0 = 0 and m+1 = 1. The m + 1 intervals Bk = [k ; k+1 [;
k = 0; : : : ; m
102
J. Berstel, L. Vuillon / Theoretical Computer Science 281 (2002) 99 – 107
are a partition of [0; 1[. We consider the rotation of angle de,ned by R (x) = x + mod 1. De,ne intervals Ik by (all values are computed modulo 1) Ik = [k ; k + [;
k = 0; : : : ; m:
We will be specially interested in the nonempty intervals XK = Ik ∩ Ik : k∈K
k ∈K =
Here, K is a subset of M = {0; : : : ; m}, and Ik = [0; 1[\Ik is the complement of Ik . Observe that, for any nonempty interval I = [x; y[, one gets IH = [y; x[. 4. Circular order We want to compute intersections of intervals. Although the geometric approach is easy to understand, it is error prone because points are usually not in general position. Therefore, we consider a more combinatoric approach. Given numbers x1 ; : : : ; xn ∈[0; 1[, the sequence (x1 ; : : : ; xn ) is circularly ordered, or c-ordered for short, if there exists an integer h with 16h6n such that 0 6 xh 6 xh+1 6 · · · 6 xn 6 x1 6 · · · 6 xh−1 ¡ 1:
(1)
If (1) holds, then either x1 = · · · =xn , or the integer h is unique. Also, if (x1 ; : : : ; xn ) is c-ordered, then clearly (x2 ; : : : ; xn ; x1 ) is c-ordered. Any subsequence of a c-ordered sequence is c-ordered. Observe also that if (x1 ; : : : ; xn ) is c-ordered and x1 ¡xn then x1 6 · · · 6xn . Indeed, if (1) holds for h = 1, then xn 6x1 . Two rules are useful. Lemma 4.1. (i) Translation Rule If (x1 ; : : : ; xn ) is c-ordered and yi ≡ xi + mod 1, then (y1 ; : : : ; yn ) is c-ordered. (ii) Insertion Rule If (x1 ; : : : ; xn ) and (y1 ; : : : ; ym ) are c-ordered, if furthermore y1 = ym and xi =y1 ; xi+1 =ym , then (x1 ; : : : ; xi ; y2 ; : : : ; ym−1 ; xi+1 ; : : : ; xn ) is c-ordered. Proof. (i) We may assume 06x1 6 · · · 6xn ¡1. The real numbers xi + satisfy x1 + 6 · · · 6xn + ¡1 + x1 + . If xn + ¡1, then yi = xi + and (y1 ; : : : ; yn ) is c-ordered. Otherwise, let h be the smallest integer such that xh + ¿1. Then x1 + 6 · · · 6 xh−1 + ¡ 1 6 xh + 6 · · · 6 xn + : If h = 1, one gets 1¡x1 + 6 · · · 6xn + ¡2 and clearly (y1 ; : : : ; yn ) is c-ordered. If h¿1, then xn + − 1¡x1 + implies yh 6 · · · 6 yn ¡y1 6 · · · 6 yh−1 : (ii) There are two cases. If xi = max{x1 ; : : : ; xn }, then xi+1 6 · · · 6xn 6x1 6 · · · 6xi . From xi =y1 ; xi+1 =ym , it follows that ym ¡y1 . Let h = 1 be the integer such that 06yh 6 · · · 6ym ¡y1 6 · · · 6yh−1 . Then 0 6 yh 6 · · · 6 ym = xi+1 6 · · · 6 xn 6 x1 6 · · · 6 xi = y1 6 · · · 6 yh−1 :
J. Berstel, L. Vuillon / Theoretical Computer Science 281 (2002) 99 – 107
103
If xi ¡ max{x1 ; : : : ; xn }, then xi =y1 ¡ym = xi+1 and consequently xi = y1 6y2 6 · · · 6ym = xi+1 . We observe that the insertion rule does not hold if y1 = ym . Consider the two c-ordered sequences (x; x; y) and (x; y; x), where 0¡x¡y¡1. Inserting the second into the ,rst give the sequence (x; y; x; y) which is not c-ordered. We prove another useful formula. Lemma 4.2. Let ¡ 12 . If (x; y; x + ) is c-ordered, then (x; y; x + ; y + ) is c-ordered. Proof. The condition ¡ 12 implies that (x; x +; x +2) is c-ordered. By the translation rule, we get that (x + ; y + ; x + 2) is c-ordered. The insertion rule shows that (x; x + ; y + ; x + 2) is c-ordered and, again by the insertion rule, one gets that (x; y; x + ; y + ) is c-ordered. 5. Intersection Circular order is useful in considering intersections of intervals. Let I = [x; y[ be a nonempty interval. Then x ∈[x; y[ iB (x; x ; y) is ordered. Let I = [x; y[ and I = [x ; y [ be nonempty intervals. Then x ∈I iB (x; x ; y) is c-ordered. Since I ∩ I = ∅ iB x ∈I or x ∈I , the intervals I and I are disjoint iB (x; y; x ) and (x ; y ; x) are c-ordered. Consequently, we have shown Lemma 5.1. Let I =[x; y[ and I =[x ; y [ be nonempty intervals. Then I ∩ I = ∅ if and only if (x; y; x ; y ) is c-ordered. The length s of an interval I =[x; y[ is the number s = y − x if x6y, and is s = 1 − (x − y) if y¡x. In both cases, y ≡ x + s mod 1 so that, knowing the length, we may write I = [x; x + s[. Lemma 5.2. Let I =[x; y[ and I =[x ; y [ be intervals of the same length 0¡¡ 12 . If I and I intersect, then (x; x ; y; y ) or (x ; x; y ; y) is c-ordered. In the ;rst case, I ∩ I = [x ; y[, in the second case, I ∩ I = [x; y [. Observe that if the length of I and I is greater than 1=2, then the intersection needs not to be an interval. Proof. The discussion before Lemma 5.1 shows that I and I intersect if and only if (x; x ; y) or (x ; x; y ) are c-ordered. From Lemma 4.2, it follows that (x; x ; y; y ) or (x ; x; y ; y) is c-ordered. Moreover, y = x and x = y since otherwise (x; y; x ; y ) is c-ordered and the intervals are disjoint by Lemma 4.2. If x =x (or equivalently if y =y ), then I = I . Thus, we may assume that the numbers x; y; x ; y are distinct. Assume the ,rst ordering holds. The formula for the intersection is straightforward if 06x¡x ¡y¡y ¡1. If 06x ¡y¡y ¡x¡1, then I = [0; y[ ∪ [x; 1[ and I ∩ I = [x ; y[. The two other cases are proved in the same way.
104
J. Berstel, L. Vuillon / Theoretical Computer Science 281 (2002) 99 – 107
The previous lemma will be applied to the intervals Ik = [k ; k + [. They all have same length . We write the conclusion for further reference. Lemma 5.3. Let ¡ 12 . Let Ik =[k ; k + [ and I‘ = [‘ ; ‘ + [ be two intervals. If Ik and I‘ intersect then (k ; ‘ ; k + ; ‘ + ) or (‘ ; k ; ‘ + ; k + ) is c-ordered. Moreover, Ik ∩ I‘ =[‘ ; k + [ in the ;rst case, and Ik ∩ I‘ = [k ; ‘ + [ in the second case. The following observation is the basic step for analyzing the coding induced by a rotation. Recall that for K ⊂{0; : : : ; m}, Ik ∩ Ik : XK = k∈K
k ∈K =
We assume from now on that ¡ 12 . Proposition 5.4. Assume XK = ∅ for some K ⊂ {0; : : : ; m} and assume (i1 ; i2 ; i3 ; i4 ) is a c-ordered sequence. If i1 ; i3 ∈K, then i2 ∈K or i4 ∈K. = Since XK = ∅, the interval Proof. Arguing by contradiction, suppose that i2 ; i4 ∈K. Ii1 ∩ Ii3 is not empty, therefore by Lemma 5.3 (i1 ; i3 ; i1 + ; i3 + ) or (i3 ; i1 ; i3 + ; i1 + ) is c-ordered (or the sequence obtained by exchanging i1 and i3 ). Consider the ,rst case, the second is the same by exchanging i2 and i4 . Since (i1 ; i2 ; i3 ) is c-ordered, the translation rule shows that (i1 + ; i2 + ; i3 + ) is c-ordered which gives, applying twice the insertion rule, that (i1 ; i2 ; i3 ; i1 + ; i2 + ; i3 + ) is c-ordered. From this, we get that (i1 ; i2 ; i1 +; i2 +) is c-ordered. From Lemma 5.1, we know that Ii1 ∩ Ii3 =[i3 ; i1 + [, and this is then disjoint from Ii2 = [i2 + ; i2 [. Proposition 5.5. If XK is not empty, then there exist integers k; ‘ with 06k¡‘6m such that {K; M \K} ={{k; : : : ; ‘ − 1}; {‘; : : : ; m; 0; : : : ; k − 1}}. Proof. This is a direct consequence of the preceding discussion. It follows that there are only (m + 1)(m + 2) intervals XK to be considered. In fact, consider the numbers 0; 1 ; : : : ; m ; 1 and ; 1 + ; : : : ; m + . They partition [0; 1[ into exactly 2m + 2 intervals. Each of these intervals is contained in one and only one of the XK (but X∅ may be scattered over several of the small intervals). This means that, among the (m + 1)(m + 2) possible intervals XK , there are only 2m + 2 that are used in a particular setting of the values of ; 1 ; : : : ; m . Theorem 5.6. Assume K = ∅; M , and XK = ∅. Then XK = [‘−1 ; k + [ ∩ [k−1 + ; ‘ [ where k and ‘ are de;ned in Proposition 5:5. If K = {k} is a singleton, then the formula still holds with ‘ − 1 = k. Proof. Supposethat K ={k; : : : ; ‘ − 1} with k¡‘. The other case is symmetric. We ,rst prove that n∈K In =[‘−1 ; k + [: Set YK = n∈K In .
J. Berstel, L. Vuillon / Theoretical Computer Science 281 (2002) 99 – 107
105
Since XK = ∅, the interval Ik ∩ I‘−1 is not empty. By Lemma 4.3 there are two cases: either (k ; ‘−1 ; k +; ‘−1 +) is c-ordered, or (‘−1 ; k ; ‘−1 +; k +) is c-ordered. We show that this second case cannot happen. Indeed in this case, YK ⊂ Ik ∩ I‘−1 = [k ; ‘−1 + [: Moreover for each n ∈M \K, the sequence (‘−1 ; n ; k ) is c-ordered. By translation and insertion, the sequence (‘−1 ; n ; k ; ‘−1 +; n +; k +) is c-ordered. This shows that In ⊃ Ik ∩ I‘−1 , and consequently Ik ∩ I‘−1 ∩ In = ∅ for each n in M \K, contradicting the assumption that XK = ∅: Thus, (k ; ‘−1 ; k + ; ‘−1 + ) is c-ordered. This implies that Ik ∩ I‘−1 = [‘−1 ; k +[: If i ∈K then (k ; i ; ‘−1 ) is c-ordered. By translation, (k +; i +; ‘−1 +) is c-ordered. By insertion of (k ; i ; ‘−1 ) into (k ; ‘−1 ; k + ; ‘−1 + ) one gets (k ; i ; ‘−1 ; k + ; ‘−1 + ) is c-ordered. Again by insertion of (k + ; i + ; ‘−1 + ), the sequence (k ; i ; ‘−1 ; k + ; i + ; ‘−1 +) is c-ordered. Thus YK = [‘−1 ; k + [: The second part of the proof deals with n∈M \K In : In this intersection the index n runs through the set {0; : : : ; k − 1; ‘; : : : ; m}. The set M \K is partitioned into three possibly empty subsets as follows: n∈N iB In ⊃ YK ; n ∈P iB In ∩ YK = [‘−1 ; n [ and ,nally n ∈Q iB In ∩ YK =[n + ; k + [: Of course, (In ∩ YK ) ∩ (In ∩ YK ) ∩ (In ∩ YK ): XK = n∈N
n∈P
n∈Q
If one of the sets N; P; Q is empty it does not contributeto the intersection. Clearly, (I ∩Y )= Y . Next ; [. If P is not K n∈N n n∈P (In ∩YK ) = n∈P [ ‘−1 n K empty then ‘ is in P and n∈P (In ∩ YK ) = [‘−1 ; ‘ [. Finally, n∈Q (In ∩ YK ) = n∈Q [n +; k +[. If Q is not empty then k−1 is in Q and n∈Q (In ∩ YK ) = [k−1 +; k +[. To ,nish the proof, we just have to verify that in each case, XK = n∈N (In ∩ YK ) ∩ (In ∩ YK ) is equal to [‘−1 ; k + [ ∩ [k−1 + ; ‘ [. n∈P (In ∩ YK ) ∩ n∈Q If P = ∅ then n∈P (In ∩ YK )=[‘−1 ; ‘ [ and the sequence (‘−1 ; ‘ ; k + ) is c-ordered (case P1 ). If P =∅ then the sequence (‘−1 ; k + ; ‘ ) is c-ordered (case P0 ). If Q = ∅ then n∈Q (In ∩ YK )=[k−1 +; k +[ and the sequence (‘−1 ; k−1 +; k +) is c-ordered (case Q1 ). If Q =∅ then the sequence (‘−1 ; k + ; k−1 + ) is c-ordered (case Q0 ). Case (P1 Q1 ): If P and Q are nonempty then XK = [‘−1 ; k +[ ∩ [‘−1 ; ‘ [ ∩ [k−1 + ; k + [. As the sequences (‘−1 ; ‘ ; k + ) and (‘−1 ; k−1 + ; k + ) are c-ordered, by the insertion rule either the sequence (‘−1 ; ‘ ; k−1 + ; k + ) or (‘−1 ; k−1 + ; ‘ ; k + ) is c-ordered. The ,rst case is impossible because XK is not empty. The second case implies that XK =[‘−1 ; k + [ ∩ [k−1 + ; ‘ [. Case (P0 Q1 ): If P = ∅ and Q = ∅, then XK = [‘−1 ; k + [ ∩ [k−1 + ; k + [ and the sequences (‘−1 ; k + ; ‘ ), (‘−1 ; k−1 + ; k + ) are c-ordered. By insertion the sequence (‘−1 ; k−1 +; k +; ‘ ) is c-ordered. Thus, XK = [‘−1 ; k +[ ∩ [k−1 +; ‘ [. Case (P1 Q0 ): is symmetric to case (P0 Q1 ). Case (P0 Q0 ): If P = ∅ and Q = ∅, then XK = [‘−1 ; k + [ ∩ [k−1 + ; ‘ [ and the sequences (k + ; k−1 + ; ‘−1 ), (k−1 + ; ‘ ; ‘−1 ) are c-ordered. By insertion rule either the sequence (k +; k−1 +; ‘ ; ‘−1 ), or (k +; k−1 +; ‘ ; ‘−1 ) is c-ordered. The ,rst case is impossible because XK is non empty. The second case implies that XK = [‘−1 ; k + [ ∩ [k−1 + ; ‘ [.
106
J. Berstel, L. Vuillon / Theoretical Computer Science 281 (2002) 99 – 107
Remark. As an additional property, the preceding proof shows that XK is an interval and the interior of XK does not contain any i or {i + }:
6. Main result Proposition 6.1. If x ∈Bi and x + ∈Bj ∩ XK , then j ≡ i + |K| mod m + 1. Proof. If K = ∅ or K = M then XK =[‘−1 ; k + [ ∩ [k−1 + ; ‘ [: As x ∈[i ; i+1 [; by translation rule we have y =x + ∈[i + ; i+1 + [. Furthermore, y ∈[j ; j+1 [: By the preceding remark and by identi,cation, the only possibility is j = ‘ − 1 and i = k − 1: It follows that j =i + |K| mod m + 1: If K =∅ then XK = n∈M In : By hypothesis we have y =x+ ∈Bj : But y ∈XK implies that y ∈[ = j ; j + [= Ij . If |Ij |¿|Bj | then Bj ∩ XK should be empty in contradiction with the hypothesis. Thus |Ij |¡|Bj |. The interval Bj is equal to Ij ∪ [j + ; j+1 [: That is x + ∈[j + ; j+1 [ and x + ∈[i + ; i+1+ [: By identi,cation, we have i =j: If K = M then XK = n∈M In : As x ∈In implies x + ∈I = n , by contraposition x + ∈XK implies x ∈I = n for all n. Thus (x; n ; x+) is c-ordered for all n ∈M . As x ∈Bi and x is not in Ii the sequence (i ; i + ; x; i+1 ) is c-ordered. Thus (x; i+1 ; : : : ; i+m−1 ; i ; x + ) is c-ordered. Consequently, XK is equal to [i ; i+1 + [: As x + ∈[j ; j+1 [ by identi,cation we ,nd j =i. From this proposition, we get the following automaton A (Fig. 1 gives the automata for m= 1; 2; 3). Its set of states is the set M in bijection with the intervals Bk . The alphabet is the set of subsets of M corresponding to the nonempty intervals XK . As already mentioned, there are (m+1)(m+2) of them. The transitions or edges are given by the proposition: (i; K; j) is a transition if j ≡ i + |K| mod m + 1. Observe that the automaton is deterministic. Also, it is universal in the following sense: for a particular setting of ; 1 ; : : : ; m , if the i and the j + are two by two distinct, there are only 2m+2 of the edges that are used. Indeed they are exactly 2m+2 intervals in the partition and between i and i+1 the coding is uniquely determined for all i. Moreover, the automaton has the noteworthy property that each label provided it is neither (0; : : : ; 0) nor (1; : : : ; 1) appears at only one edge. Consequently, both the starting state and the arrival state of such an edge is determined by is label. We denote by A(v0 ; : : : ; vm ) the arrival state of the edge with label (v0 ; : : : ; vm ). We now explain the result in terms of in,nite words. Recall that Bi = [i ; i+1 [ and Ii = [i ; i + [. Let u be the in,nite word de,ned by I (x)I (R (x))I (R2 (x)) · · · I (Rn (x)) · · · ;
J. Berstel, L. Vuillon / Theoretical Computer Science 281 (2002) 99 – 107
107
where I (y)= i if y ∈Bi . Let sk be the kth Sturmian word de,ned by Jk (x)Jk (R (x))Jk (R2 (x)) · · · Jk (Rn (x)) · · · ; where Jk (y)=1 if y ∈Ik =[k ; k + [ and 0 otherwise. Theorem 6.2. The in;nite word u and the m + 1 Sturmian words si are related by A(s0 (n); : : : ; sm (n)) = u(n) for all n¿n0 , where n0 is the smallest integer such that {s0 (n0 ); : : : ; sm (n0 )} contains both 0 and 1. For n¡n0 the value u(n) is the starting state of the edge labeled {s0 (n0 ); : : : ; sm (n0 )}. Remark that the result is written for irrational in order to manipulate Sturmian words. The construction of the automaton is independent of the rationality of (this case leads to in,nite periodic words). References [1] P. Alessandri, V. BerthKe, Three distance theorems and combinatorics on words, Enseig. Math. 44 (1998) 103–132. [2] J. Berstel, P. SKeeK bold, Sturmian words, in: M. Lothaire (Ed.), Algebraic Combinatorics on Words, Chap. 2, Cambridge University Press, Cambridge, to appear. [3] V. BerthKe, Etude arithmKetique et dynamique de suites algorithmiques, Habilitation aM diriger des reserches, UniversitKe d’Aix-Marseille II, 1999. [4] F. Blanchard, P. Kurka, Language complexity of rotations and Sturmian sequences, Theoret. Comput. Sci. 209 (1998) 179–193. [5] G. Didier, Combinatoire des codages de rotations, Acta Arith. 85 (1998) 157–177. [6] P. Hubert, PropriKetKes combinatoires des suites dKe,nes par billard dans les triangles pavants, Theoret. Comput. Sci. 164 (1996) 165–183. [7] G. Rote, Sequences with subword complexity 2n, J. Number Theory 46 (1994) 196–213.
Theoretical Computer Science 281 (2002) 109 – 130
www.elsevier.com/locate/tcs
Noninterference for concurrent programs and thread systems G%erard Boudol ∗ , Ilaria Castellani INRIA, Sophia-Antipolis, 2004 Route des Lucioles, BP 93, 06902 Sophia-Antipolis, Cedex, France
Abstract We propose a type system to ensure the property of noninterference in a system of concurrent programs, described in a standard imperative language enriched with parallelism. Our proposal is in the line of some recent work by Irvine, Volpano and Smith. Our type system seems more natural and less restrictive than that originally presented by these authors for the concurrent case. Moreover, we show how to extend the language in order to formalise scheduling policies for systems of sequential threads. The type system is extended to the new constructs, and we show c 2002 Elsevier that noninterference still holds, while remaining in a nonprobabilistic setting. Science B.V. All rights reserved.
1. Introduction The aim of this paper is to study the property of secure information 3ow, and more speci4cally of noninterference (a notion 4rst introduced by Goguen and Meseguer in [6]) in the setting of concurrency. Here noninterference means that variables of a given security level do not interfere with those of lower or incomparable levels. More precisely, the values of variables at some level are not dependent on the values of variables of higher or incomparable level. Noninterference is meant to model the absence of information 3ow from any security level 0 to another one 1 , except when this is explicitly allowed, that is 0 61 . Such information 3ow is considered insecure, as it amounts to the disclosure of secret information into the public domain. In this introduction, and in the examples given in the paper, the security levels will simply be high (H ), or secret, and low (L), or public. However, all results will be given Research partially funded by the EU Working Group CONFER II and by the french RNRT Project MARVEL. ∗ Corresponding author. E-mail address:
[email protected] (G. Boudol).
c 2002 Elsevier Science B.V. All rights reserved. 0304-3975/02/$ - see front matter PII: S 0 3 0 4 - 3 9 7 5 ( 0 2 ) 0 0 0 1 0 - 5
110
G. Boudol, I. Castellani / Theoretical Computer Science 281 (2002) 109 – 130
: if PIN = 0 then t := tt else t := tt : while t = tt do nil ; r := 0 ; t := tt : while t = tt do nil ; r := 1 ; t := tt PIN; t ; t : boolean variables of type H r : boolean variable of type L Fig. 1. Information 3ow through control 3ow.
for an arbitrary lattice of security levels. For some concrete examples using a more sophisticated lattice of security levels, see for instance [3]. Our starting point is the paper [21] by Volpano et al. and the subsequent paper [18] by Smith and Volpano, where noninterference is enforced by means of a simple type system in an imperative language with security levels. The language considered in [21] is purely sequential, and is extended in [18] with asynchronous parallelism (interleaving). In such a language, insecure 3ow can be explicit, when assigning the value of a high variable to a low variable, or implicit, when testing the value of a high variable and then assigning to a low variable a value depending on the result of the test, for instance. In the approach of [21,18], explicit 3ow is prevented by requiring that the level of the assigned variable be at least as high as that of the source variable, while implicit 3ow is prevented by asking that the level of the commands in the branches of a conditional (the level of a command being that of its lowest assigned variables) be at least as high as that of the tested variable. Implicit 3ow can also arise in while-loops, and is prevented by a similar condition on the type of the body of the loop. In fact, because of while-loops, the de4nition of noninterference is more precise than what is stated above: it says that no change in the values of low-level variables should be observed as a consequence of a change in high-level variables, provided that the program terminates successfully. Using subscripts to explicitly indicate the security level of a variable, let us consider the following program, that terminates if x H = 0 and loops forever (doing nothing) otherwise: while xH = 0 do nil; yL := 1
(1)
Should this program be accepted, that is, should it be typable? According to the above de4nition of noninterference the answer is “yes”, since whenever the program terminates it produces the same value yL = 1 for its low-level variable. Indeed, this program is typable in the original system of Volpano et al. [21], since the loop is typable and the sequential composition of typable programs is always typable. However, accepting such a program leads to problems when parallelism is introduced in the language. These problems can be concisely described as “disguising information 3ow as control 3ow”. Let us illustrate the problem by means of an example, which is a simpli4ed version of the PIN example given by Smith and Volpano in [18]. In this example, given in Fig. 1, three threads , and are run (asynchronously) in parallel. There are four variables, a high-level variable PIN tested by thread , two high-level
G. Boudol, I. Castellani / Theoretical Computer Science 281 (2002) 109 – 130
111
variables t and t serving as “triggers” for threads and , and a low-level variable r written by and . As can be easily seen, with initial values t = t = 3 the eKect of this program is to copy the value of the secret variable PIN into the public variable r. The illicit information 3ow from PIN to r is implemented through the control 4ow from to or . However, if we assume that a system of concurrent threads is typable provided each component is typable, as would be natural, this particular system is to be accepted. To circumvent this problem, Smith and Volpano propose in [18] to forbid the use of high-level variables in guards of while-loops, and more speci4cally 1 to accept only while-loops of low level. While ruling out the program in (1), and also the threads and of the PIN example, this solution seems a bit drastic. It excludes inoKensive programs such as while x H = 0 do nil. We shall propose here a diKerent solution to the problem raised by while-loops in the presence of parallelism, which allows this program to be typed, while ruling out the programs of example (1) and Fig. 1. Our solution is based on the observation that a program such as while xH = 0 do nil should indeed be considered with some care in a concurrent setting, but only as a “guard”, that is, as regards what may follow it. In the context of concurrent threads, if the control comes back to this while loop, this may be with a value for x H diKerent from 0, contrarily to what happens in a sequential setting. In other words, this program may observe the behaviour of other, concurrent components, in the course of their execution, and in3uence accordingly the behaviour of the thread in which it participates. Our aim is then to ensure a stronger form of noninterference, where the course of values —not just the 4nal value—of a low-level variable does not depend upon the value of high variables. Typically, program (1) is no longer interference-free in this stronger sense. In order to reject it, we introduce a re4nement of the notion of type, and a new type system, where the level of loop guards—the expressions tested by while loops— is taken into account in sequential composition. The basic idea is that assigning to a low variable must not depend upon consulting the value of a high variable. Then also conditional guards—the expressions tested by conditional statements—will be taken into account (we will see an example in the next section). We will also examine the situation where a scheduling policy is in force in a thread system of sequential programs: we will introduce a couple of new programming primitives to describe formally such a situation, and show how to extend the type system to this new setting, where new interference phenomena arise. We show that our type system still ensures the noninterference property in this case, while imposing a less severe restriction than that pre4gured in [18]. The rest of the paper is organised as follows. In Section 2 we introduce the language, its operational semantics and its type system. Section 3 presents the properties of typed programs, including subject reduction and noninterference. Finally, in Section 4 we consider the extended language with scheduling policies for sequential threads. 1
Assuming, in the case of an arbitrary lattice of security levels, that there is a lowest level ⊥.
112
G. Boudol, I. Castellani / Theoretical Computer Science 281 (2002) 109 – 130
2. The language and type system The language we consider is essentially that of [18] (where e stands for a boolean or arithmetic expression, whose syntax we do not detail here). We use the following two-level syntax, where U; V denote sequential programs, while P; Q denote general (concurrent) programs: U; V : : : ::= nil | x := e | U ; V | if e then U else V | while e do U P; Q : : : ::= U | U ; P | if e then P else Q | (P Q) Note that on the left of a sequential composition, we must have a sequential program. Thus programs of the form (P Q); R are not allowed. With this restriction, our language is still more general than that of [18], which describes concurrent systems as collections of threads, thus allowing only top-level parallelism, while we allow the dynamic spawning of new threads (although in a limited way). The operational semantics of the language is given in terms of transitions between con4gurations (P; ) → (P ; ) where P; P are programs and ; stand for memories, that is mappings from variables to values. These mappings are extended in the obvious way to expressions, whose evaluation is assumed to be atomic as in [18]. We use the notation [v=x] for memory update. The rules specifying the operational semantics of programs are presented in Fig. 2. The semantics used here is a small step semantics, as opposed to the big step semantics of [21]. 2 The rules are fairly standard, and we shall not comment on them. In the introduction we argued that, in a concurrent setting, program (1) should be treated as another case of implicit information 3ow. Intuitively, when exiting a loop one gets some information about its guard; it seems then appropriate to require that what follows the loop–its “continuation”–have level at least as high as that of the loop guard. This will be the basic idea of our new type system, which is closely inspired by that given by Volpano et al. [21]–however as suggested by the above Example (1) it will be more restrictive than that of [21] on the sequential sublanguage, because of our more detailed observation of programs, where an attacker is allowed to read the low part of the memory at any time. The types of data and expressions are security levels, that is elements of a lattice (T;6). We denote the operations of meet and join, respectively, by and . These types are ranged over by ; : : : : In the examples, the lattice of security levels will simply be {L; H }, with L¡H . The types of variables (when used in the left-hand side of an assignment) are of the form var. Our 4rst point of departure from [21] concerns the types for programs. Type judgements in [21] are of the form P : cmd, where is a mapping from variables to types of variables, i.e. elements of { var | ∈ T}. The meaning of P : cmd is that in the type environment , the type is a lower 2
In [18], the semantics is a mixture of small and big step semantics: transitions are given between con4gurations but there are two kinds of con4gurations, intermediate and 4nal ones, suggesting that termination should be observed.
G. Boudol, I. Castellani / Theoretical Computer Science 281 (2002) 109 – 130
(ASSIGN-OP) (SEQ-OP1) (SEQ-OP2) (COND-OP1) (COND-OP2) (WHILE-OP1) (WHILE-OP2) (PAR-OP1) (PAR-OP2)
113
(x := e; ) → (nil; [(e)=x]) (U; ) → (U ; ) (U ; P; ) → (U ; P; ) (P; ) → (P ; ) (nil; P; ) → (P ; ) (e) = tt (if e then P else Q; ) → (P; ) (e) = tt (if e then P else Q; ) → (Q; ) (e) = tt (while e do U; ) → (U ; while e do U; ) (e) = tt (while e do U; ) → (nil; ) (P; ) → (P ; ) (P Q; ) → (P Q; ) (Q; ) → (Q ; ) (P Q; ) → (P Q ; )
Fig. 2. Operational semantics for parallel programs.
bound for the level of the assigned variables of P. In line with this intuition, subtyping for programs is contravariant, that is cmd6 cmd if 6. Thus for instance any program of type H cmd can be downgraded to type L cmd. A program of type H cmd is guaranteed not to contain any assignment to a low variable. As we said previously, we have to take into account the level of loop guards in typing. To deal with possible divergence (and, as we shall see, with the scheduling of threads) we also have to record the level of the tested expression in conditional branching, which we regard as a guard as well. Thus we shall use here more re4ned types (; ) cmd, where the 4rst component plays the same role as in the type cmd, while the second component is the guard type, an upper bound on the level of the loop and conditional guards occurring in a program. Accordingly, the subtyping for programs is contravariant in its 4rst component and covariant in the second: (; )cmd 6 ( ; ) cmd if 6 and 6 : The guard type will be set up by while-loops and conditional branchings, and looked up by sequential composition. The complete type system for programs is shown in
114
G. Boudol, I. Castellani / Theoretical Computer Science 281 (2002) 109 – 130
(NIL) (ASSIGN) (SEQ) (COND) (WHILE) (PAR) (SUBTYPING)
nil : (; ) cmd e : ;
(x) = var
x := e : (; ) cmd U : (; ) cmd;
P : ( ; ) cmd;
6
U ; P : ( ; ) cmd e : ;
Pi : (; ) cmd;
6
if e then P0 else P1 : (; ) cmd e : ;
U : (; ) cmd;
6
while e do U : (; ) cmd Pi : (; ) cmd P0 P1 : (; ) cmd P : (; ) cmd;
6;
6
P : ( ; ) cmd Fig. 3. Typing rules for concurrent programs.
Fig. 3, where we assume given a system allowing us to infer judgements e : about the security level of an expression. These are used in the (ASSIGN), (COND) and (WHILE) rules. Notice that the guard type plays no particular rˆole in rules (NIL) and (ASSIGN), which are plain adaptations of the ones in [21]. As in that paper, the side condition 6 in the rules (COND) and (WHILE) is meant to avoid implicit insecure 3ow. Let us comment a little on the rules for conditional branching, while-loops and sequential composition, which are the main novelty w.r.t. [21,18]. As explained, the guard type is at least for a conditional branching or a while-loop testing an expression of level , and from then onwards it should remain at least to prevent concatenation with programs of a lower or incomparable level. Rule (SEQ) is precisely designed to avoid sequencing “low” assignments after a program with “high” guards. This rules out the kind of implicit 3ow exhibited by program (1). It also rules out the (semantically equivalent, in a sequential setting) program if xH = 0 then while tt do nil else nil ; yL := 1
(2)
which is not interference-free in our sense. Indeed, this example shows why the level of conditional guards should be recorded as a guard type. The side condition 6 in the rule (WHILE) is needed for the preservation of types during execution, as one can
G. Boudol, I. Castellani / Theoretical Computer Science 281 (2002) 109 – 130
115
see from the unfolding of while e do P into if e then P; while e do P else nil. Notice that if P0 and P1 are both typable in the typing context , say with respective types (0 ; 0 ) cmd and (1 ; 1 ) cmd, then their parallel composition (P0 P1 ) is typable, since both P0 and P1 have type (0 1 ; 0 1 ) cmd, thanks to the (SUBTYPING) rule. 3. Properties of typed programs In this section we prove some desired properties of our type system. The 4rst property, subject reduction, states that types are preserved along execution. Theorem 3.1 (Subject reduction). If P : (; ) cmd and (P; ) → (P ; ), then P : (; ) cmd. Proof. By induction on the inference of P : (; ) cmd, and then case analysis on the last rule used in this inference. If this rule is the subtyping rule, we simply use the induction hypothesis. We examine the main cases: (ASSIGN). Here we have P = x := e with e : and (x) = var. Moreover, it must be that P = nil and = [(e)=x]. The theorem is trivial in this case, since nil : (; ) cmd. (SEQ). Here P = U ; Q with U : (1 ; 1 ) cmd, Q : (2 ; 2 ) cmd, = 1 2 and = 1 2 with 1 62 . There are two possibilities for a transition (P; ) → (P ; ). If this results from (U; ) → (U ; ), by means of (SEQ-OP1), we have P = U ; Q, where U : (1 ; 1 ) cmd by induction, and we conclude using the rule (SEQ). If (SEQOP2) is used, we have U = nil with (Q; ) → (P ; ). By induction P : (2 ; 2 )cmd, and we use the subtyping rule to conclude. (WHILE). Here P = while e do U and U : (; ) cmd, with = and 6. If (e) = tt we have P = U ; P, and since 6 we may use the rule (SEQ) to conclude P : (; ) cmd. Otherwise P = nil, and this case is trivial. All the other cases are similar (in the case of (COND) we use subtyping). We shall use the following assumptions about expressions: Assumption 3.2 (Termination of expression evaluation). For any memory and expression e, the value (e) is de7ned. Notice that this implies for instance that for any sequential program U = nil ; · · · ; nil and for any there exist U and such that (U; ) → (U ; ). Assumption 3.3 (Simple security). If e : , then every variable occurring in e has type var in , with 6. We introduce now a notion of equality on memories, depending on a given type environment and a given set L ⊆T of security levels, which are to be understood as “low” security levels. In the following, L will always denote a downward-closed
116
G. Boudol, I. Castellani / Theoretical Computer Science 281 (2002) 109 – 130
set of security levels, that is a set satisfying ∈ L & 6 ⇒ ∈ L: Two memories are (; L)-equal if they coincide on variables to which assigns a level in L. Intuitively, such memories are indistinguishable for an observer which has access only to information of level in L. De nition 3.4 ((; L)-Equality of memories). =L ⇔def ∀x: (x) = var & ∈L ⇒ (x) = (x). {L}
In the examples we implicitly used the particular case = , which is denoted ∼ in [18]. As it has become standard, we use the notion of bisimulation [11,13] to (state and) establish the security properties of concurrent programs. We shall actually use several kinds of bisimulations. To de4ne these notions, it is convenient to introduce some notations. First, we denote by the re3exive closure of → , that is, (P; ) (P ; ) ⇔def P = P & =
or
(P; ) → (P ; ):
∗
As usual, → is the re3exive and transitive closure of → . We say that P is a derivative ∗ of P, denoted P P , if for some and we have (P; ) → (P ; ). Then, given a typing context and a set L of (low) security levels, we denote by P ; L the set of “(semantically) high” programs, that is programs that never modify the low part of the memory: P ∈ P;L ⇔def ∀P ; ; P ; : P
∗
P & (P ; ) →(P ; ) ⇒ =L :
Clearly, if P ∈ P ; L and P is a derivative of P then P ∈ P ; L . De nition 3.5 ((; L)-Bisimulation). A relation R on con4gurations is a (; L)bisimulation if R is symmetric and (P; ) R (Q; ) implies (i) =L (ii) (P; ) → (P ; ) ⇒ ∃Q ; : (Q; ) (Q ; ) & (P ; ) R (Q ; ). The relation R is a strong (; L)-bisimulation if it satis4es the conditions above, where is replaced by → . The (; L)-bisimulation equivalence on con4gurations, L noted ≈L (resp. the strong (; L)-bisimulation equivalence, noted ∼ ) is the largest (; L)-bisimulation (resp. the largest strong (; L)-bisimulation). L Clearly, we have ∼L ⊆ ≈ , and the inclusion is strict, since for instance, for any memories and such that =L , we have
(nil; ) ≈L (while tt do nil; ): This is a consequence of the following: Lemma 3.6 (Bisimilarity of high programs). The relation R0;L = {((P; ); (Q; )) | P ∈ P ; L ; Q ∈ P ; L & =L } is a (; L)-bisimulation.
G. Boudol, I. Castellani / Theoretical Computer Science 281 (2002) 109 – 130
117
Proof. This is immediate, because if (P; ) → (P ; ) then P ∈ P ; L and =L =L . For technical reasons we introduce one last notion of bisimulation: De nition 3.7 (Quasi-strong (; L)-bisimulation). A relation R on con4gurations is a quasi-strong (; L)-bisimulation if R is symmetric and (P; ) R (Q; ) implies (i) =L : (ii) P ∈ P ; L and Q ∈ P ; L , or (P; ) → (P ; ) ⇒ ∃Q ; : (Q; ) → (Q ; ) & (P ; ) R (Q ; ): The quasi-strong (; L)-bisimulation equivalence on con4gurations, noted L , is the largest quasi-strong (; L)-bisimulation. It should be clear that a quasi-strong (; L)-bisimulation is also a bisimulation, and that a strong (; L)-bisimulation is also a quasi-strong L L bisimulation, and therefore we have ∼L ⊆ ⊆ ≈ . As in [16], we shall abuse of language, that a relation S on programs is a (strong, quasi-strong) bisimulation if the relation
(; L)(; L)say, by (; L)-
{((P; ); (Q; )) | PSQ & =L } is a (strong, quasi-strong) (; L)-bisimulation. For instance, Lemma 3.6 shows that the relation S0; L given by P S0;L Q ⇔def P ∈ P;L & Q ∈ P;L is a (; L)-bisimulation. Observe also that quasi-strong bisimulation is not preserved by parallel composition, as shown by (nil yL := 0) L (while tt do nil yL := 0): One should note that although there exists a largest (; L)-bisimulation on programs (since the union of a family of such relations is a (; L)-bisimulation), that we still denote ≈L , this is not a re3exive relation, since for instance the program yL := x H is not bisimilar to itself. However, the relation ≈L on programs is a nonempty (as shown by Lemma 3.6) partial equivalence relation. The domain of ≈L characterizes the secure programs: De nition 3.8 (Secure programs). A program P is secure in the typing context if and only if P ≈L P for any downward-closed set L of security levels. We let the reader check that, for instance, the program of Example (1) is not secure in this sense. To establish the noninterference result, stating that a typable program is secure, we need some preliminary lemmas. The following two lemmas con4rm the intuition,
118
G. Boudol, I. Castellani / Theoretical Computer Science 281 (2002) 109 – 130
discussed earlier, behind the type judgements P : (; ) cmd. Both results are easily proved by induction on the inference of type judgements. Lemma 3.9 (Con4nement). If P : (; ) cmd then every variable assigned to in P has type var in , with 6. Lemma 3.10 (Guard safety). If P : (; ) cmd then every loop or conditional guard in P has type in , with 6. De nition 3.11 (L-Boundedness). A program P is L-bounded in if P : (; ) cmd implies ∈ L. We shall often use the complementary notion of non L-boundedness: P is not Lbounded in if there exist ; , with ∈= L, such that P : (; ) cmd. De nition 3.12 (L-Guardedness). A program P is L-guarded in if there exist ∈ L and such that P : (; ) cmd. In the following, we shall most often use the terminology “(non)L-bounded” and “L-guarded” without any explicit reference to the current typing context . As a consequence of subject reduction, both non L-boundedness and L-guardedness are preserved by execution. Note that for any downward-closed L, by the Con4nement Lemma a program which is not L-bounded cannot write on variables of low level, that is in L, and therefore such a program is “high”, that is in P ; L . Note however that, in general, a high program is not necessarily non L-bounded. For instance, assume that the lattice of security levels is {L; A; B; H } with L = A B and H = A B. Then if L = {L}, the program xA := 0; yB := 0 is high and L-bounded in this case. Similarly, by the Guard Safety Lemma, a program which is L-guarded does not contain loop guards of high level, that is not in L. Lemma 3.13 (Behaviour of L-guarded programs). If P is L-guarded in and L =L , then (P; ) → (P ; ) implies (P; ) → (P ; ), with = . Proof. By induction on the inference of P : (; ) cmd, where ∈ L, and by case analysis on the last rule used in this inference. We examine the main cases. (ASSIGN). Here P = x := e with e : , (x) = var, P = nil and = [(e)=x]. By Assumption 3.2, (e) is de4ned. Let = [ (e)=x]. It is easy to see that =L , L since if ∈= L then = by the De4nition 3.4, while if ∈ L then (e) = (e) by Assumption 3.3. (SEQ). Here P = U ; Q, U : (1 ; 1 ) cmd and Q : (2 ; 2 ) cmd with = 1 2 and 1 62 . If the transition (P; ) → (P ; ) is proved by means of (SEQ-OP1), that is P = U ; Q with (U; ) → (U ; ), then we use the induction hypothesis, since 1 2 ∈ L ⇒ 1 ∈ L. This will give us (U; ) → (U ; ), with =L , and by (SEQ-OP1) we conclude that (P; ) → (U ; Q; ), as required. In the case where (SEQ-OP2) is used, with U = nil and (Q; ) → (P ; ), we simply use the induction hypothesis.
G. Boudol, I. Castellani / Theoretical Computer Science 281 (2002) 109 – 130
119
(COND). Here P = if e then P1 else P2 with e : , Pi : (; ) cmd, with 6 and = . Since ∈ L, also ∈ L, and thus (e) = (e) by Assumption 3.3. Hence a transition (P; ) → (Pi ; ) is matched by (P; ) → (Pi ; ). (WHILE). Here P = while e do U and e : , U : (; ) cmd, with 6 and = . Clearly ∈ L implies ∈ L, therefore (e) = (e) by Assumption 3.3, and thus a transition of the loop, which is necessarily of the form (P; ) → (P ; ), will be matched by (P; ) → (P ; ). The case of (PAR) is easy, since the components have the same type as the whole program, and the case of (SUBTYPING) is immediate by induction. This lemma is crucial for the proof of our main results, namely that typable programs (and, in the next section, scheduled thread systems) are secure. Obviously, it could not be stated in the original system of Volpano et al. [21], where the level of guards is not recorded in the type. Now, given and L, let us de4ne inductively the relation S1; L on sequential programs as follows: U S1; L V if and only if U and V are typable in , and one of the following holds: 1. U S0; L V , that is U ∈ P ; L and V ∈ P ; L , or 2. V = U and U is L-bounded in , or 3. U = U0 ; W and V = V0 ; W , where U0 S1; L V0 and W is not L-bounded in . Lemma 3.14. (i) The relation S1; L is symmetric. (ii) If U is typable in then U S1; L U . (iii) If nil S1; L V then V ∈ P ; L . Proof. The 4rst point is easy to check, by induction on the de4nition of S1; L . For the second point, if U is typable in then either U is L-bounded in , in which case U S1; L U by clause 2, or not, in which case U ∈ P ; L , as we have seen, hence U S1; L U by clause 1. Finally, observe that if nil S1; L V , this must be by clause 1 or 2, and in both cases this implies V ∈ P ; L . Theorem 3.15 (Sequential noninterference). The relation S1; L is a quasi-strong (; L)-bisimulation, and therefore if U is typable in then U is secure in . Proof. Let R1;L = {((U; ); (V; )) | U S1;L V & =L }: By construction, (U; ) R1; L (V; ) implies =L . We show, by induction on the de4nition of S1; L , that either U and V are both in P ; L , or if (U; ) → (U ; ) and (U; ) R1; L (V; ) then there exist V and such that (V; ) → (V ; ), with (U ; ) R1; L ; (V ; ). The case where U and V are both in P ; L , that is the case of clause 1 is trivial, and therefore for the rest of the proof we assume that U and V are not both in P ; L . In this proof we implicitly use the Subject Reduction Theorem, which is needed to check that we are dealing with typable terms.
120
G. Boudol, I. Castellani / Theoretical Computer Science 281 (2002) 109 – 130
Clause 2. We proceed by induction on the structure of U . Assignment: Here U = x := e, U = nil and = [(e)=x]. Then the matching move is L (U; ) → (nil; ), where = [ (e)=x]. Indeed from =L we deduce = since U is L-bounded, and thus by Assumption 3.3 (e) = (e). Sequence: Here U = U0 ; W . We distinguish two cases, according to which of the rule (SEQ-OP1) or (SEQ-OP2) is used to deduce the transition (U; ) → (U ; ). 1. If (U; ) → (U ; ) is proved by means of (SEQ-OP1), that is U = U0 ; W with (U0 ; ) → (U0 ; ), then there are two possibilities: 1.1. W is L-bounded in : then W : (2 ; 2 ) cmd implies 2 ∈ L, therefore since U is typable there exist 1 ; 1 such that U0 : (1 ; 1 ) cmd, with 1 ∈ L (this is where we use the side condition of the rule (SEQ)). Thus U0 is L-guarded. Then by Lemma 3.13 we have (U0 ; ) → (U0 ; ), with =L . Therefore (U; ) → (U0 ; W; ) by (SEQ-OP1), which is the required matching move by clause 2 again since U0 ; W is L-bounded (because 2 ∈ L implies 1 2 ∈ L). 1.2. If W is not L-bounded, then W ∈ P ; L . Since we assumed U ∈= P ; L , U0 must be L-bounded, and by induction on the structure of the programs, there exist U0 and such that (U0 ; ) → (U0 ; ) with U0 S1; L U0 and =L . Then (U; ) → (U0 ; W; ) by (SEQ-OP1), which is the required matching move by clause 3. 2. Let (U; ) →(U ; ) be proved by means of (SEQ-OP2), with U0 = nil and (W; ) → (U ; ). Since we assumed U ∈= P ; L , W must be L-bounded, and by induction on the structure of the programs, there exist U and such that (W; ) → (U ; ) with U S1; L U and =L . Then (U; ) → (U ; ) by (SEQ-OP2), which is the required matching move. Conditional: Here U = if e then U1 else U2 with e : , Ui : (; ) cmd, with 6 and = . Then ∈ L implies ∈ L, and by Assumption 3.3 we have (e) = (e). Thus the move (U; ) → (Ui ; ) is matched by (U; ) → (Ui ; ), since S1; L is re3exive. The case of a while-loop U = while e do W is similar. Clause 3. Here U =U0 ; W and V =V0 ; W , where U0 S1; L V0 and W is not L-bounded in . We assumed that U and V are not both in P ; L . Then U0 = nil, since otherwise we would have V0 ∈ P ; L by Lemma 3.14(iii), hence U ∈ P ; L , and V ∈ P ; L , for W ∈ P ; L . Therefore the transition (U; ) → (U ; ) must be proved by means of (SEQOP1), that is U = U0 ; W with (U0 ; ) → (U0 ; ), and we use the induction hypothesis related to U0 S1; L V0 (notice that, due to our assumption about U and V , U0 and V0 cannot be both in P ; L ). To extend this result to concurrent programs, we de4ne inductively the relation S2; L as follows: P S2; L Q if and only if P and Q are typable in , and one of the following holds: 1. P S0; L Q, that is P ∈ P ; L and Q ∈ P ; L , or 2. Q = P and P is L-bounded in , or
G. Boudol, I. Castellani / Theoretical Computer Science 281 (2002) 109 – 130
121
3. P = U ; R and Q = V ; R, where U S2; L V and R is not L-bounded in , or 4. P = P1 P2 and Q = Q1 Q2 with Pi S2; L Qi . It is easy to see that Lemma 3.14 holds, replacing sequential programs by concurrent ones, for this relation too. Theorem 3.16 (Concurrent noninterference). The relation S2; L is bisimulation, and therefore if P is typable in then P is secure in .
a
(; L)-
Proof. For the clauses 1, 2 and 3, the proof is mostly the same as in the previous theorem (using the proof of Lemma 3.6). The remaining cases only concern parallel composition (in clauses 2 and 4), and are trivial, using the induction hypothesis. Observe that if 1 and 2 are incomparable levels in (T;6), they may be separated by a downward-closed set L, namely L = { | 61 }, and therefore a typable program cannot yield any 3ow from level 2 to 1 (and conversely). In other words, information 3ow arising from typable programs is indeed of the kind allowed by the security lattice, that is from to where 6. As we have seen, (P Q) is typable as soon as both P and Q are. Therefore, the previous result means that there can be no information leakage from one secure program to another, concurrent one. Then one may say that our result shows that typed programs are “internally secure”, that is they are guaranteed against attacks coming from other, concurrent programs. Notice that, assuming that there is a lowest security level ⊥, a program that has direct access only to the lowest information is always typable, with type (⊥; ⊥) cmd. Such a program may be regarded as a potential attacker. As is well-known, bisimulation equivalence is a strong relation, and therefore our noninterference result is quite sharp. In particular, bisimulation equivalence is usually stronger than trace semantics, and therefore we can draw some consequences of our result regarding the trace behaviour of programs. To this end, let us introduce a nota L tion: we write (P; ) L (P ; ) if and only if = and there exist P0 ; 0 ; : : : ; Pn ; n L (possibly with n = 0) such that i = for all i and (P; ) = (P0 ; 0 ) → (P1 ; 1 ) → · · · (Pn ; n ) → (P ; ): Given an initial memory 0 , let us de4ne the set, denoted TraceL (P; 0 ), of (L; )traces of the program P as the set of 4nite or in4nite sequences 0 ; 1 ; : : : ; n : : : such that there exist P1 ; : : : ; Pn : : : with L L (P; 0 ) L (P1 ; 1 ) · · · (Pn ; n ) · · ·
Note that, by de4nition, i+1 =L i for all i. The (; L)-equality of memories is easily extended into a (; L)-equality of traces of the same length, as follows: L 0 ; 1 ; : : : ; n : : : =L 0 ; 1 ; : : : ; n : : : ⇔def ∀i: i = i :
Then we can show that a typable program has the same traces (up to =L ) when execution starts from (; L)-equal memories:
122
G. Boudol, I. Castellani / Theoretical Computer Science 281 (2002) 109 – 130
Corollary 3.17 (Trace equivalence). Let L be a downward-closed set of security levL els. If P is typable in and =L then for any trace t ∈ Trace (P; ) there exists L L t ∈ Trace (P; ) such that t = t. Proof. By the Theorem 3.16, we have (P; ) ≈L (P; ), and it is easy to see that L (P ; ) and (P; ) ≈ (Q; ) implies that there exist Q and such that (P; ) L L (Q; ) (Q ; ). 4. Scheduling sequential programs As pointed out by Smith and Volpano in [18], their noninterference result for concurrent threads relies on the hypothesis of a purely nondeterministic execution. This result breaks down if particular scheduling policies are enforced. We recall the example given in [18]. Assume a round robin time slicing scheduler, with a time slice of t steps, t¿2, and consider the composition P = U1 U2 of the following two threads: U1 = if xH = 0 then V else nil ; yL := 0 U2 = yL := 1
(3)
Then, supposing that V is a convergent program that takes at least t − 1 steps to execute, and that the scheduler gives precedence to U1 , the value of yL will depend on that of x H . The solution proposed in [18] to preserve noninterference in the presence of an arbitrary scheduler consists in forbidding conditionals with high guards, 3 that is, again assuming that there is a lowest security level, to accept only conditional branching on low-level expressions. This condition, combined with the exclusion of loops with high guards, required for multi-threading, resulted in [18] in a very severe limitation: the impossibility for any program to test a variable, except at the lowest level. Let us immediately point out that, with the typing we propose in this paper, we cannot accept any scheduling policy. For instance, if the scheduling of two concurrent threads consists in performing the 4rst, up to completion, and then the second, we may reproduce the insecure 3ow exhibited by program (1), simply by executing (while x H = 0 do nil yL := 1) under this scheduling. Therefore, we have to reject some scheduling policies, and the way we do that is by encoding these policies into programs, and reject the non typables ones. One may observe that the program U1 of Example (3) is actually ruled out by our typing rule for conditional branching, which ensures that low assignments cannot be performed after a high test (cf. Example 2). To show that our typing is indeed adequate for dealing with scheduling, we 4rst formalise what it means for a system of concurrent programs to be controlled by a scheduler. Essentially, this means running the system 3
It is also suggested there that a better approach to scheduling would be probabilistic. Indeed, a whole line of research on probabilistic noninterference has been developed, but this will not be our concern here, where we stick to a possibilistic setting.
G. Boudol, I. Castellani / Theoretical Computer Science 281 (2002) 109 – 130
(WHEN-OP1) (WHEN-OP2) (CONTROL-OP1) (CONTROL-OP2)
123
(e) = tt; (U; ) → (U ; ) (when e do U; ) → (when e do U ; ) (e) = tt; (U; ) 9 (when e do U; ) → (when e do U; ) (P; ) → (P ; ); (T; ) → (T ; ) (P[T ]; ) → (P [T ]; ) (P; ) → (P ; ); (T; ) 9 (P[T ]; ) → (P [T ]; )
Fig. 4. Additional operational rules for systems.
in lockstep with a program that implements the scheduling policy. To describe controlled execution, we use a construction P[Q], which makes P and Q move hand in hand, but allows the controller, P, to proceed by itself whenever Q is unable to move. Then a system consisting of n sequential programs Ui controlled by a scheduler Sched will be described as Sched[T1 · · · Tn ]; where the Ti are adaptations of the Ui , so that the threads can be triggered and suspended by the scheduler. To this end we introduce a new construct when e do U , whose semantics is that U is allowed to proceed, for one step, when the condition e holds. It is technically convenient to introduce two more levels in the syntax: besides the sequential and concurrent programs U and P, written according to the grammar given in Section 2, there is a set of “thread systems” T , and a set of “controlled thread systems” S built as follows: T ::= when e do U | (T T ); S ::= P[T ]: Letting w(P) denote the set of variables written (assigned to) by P, and similarly for w(T ), the construct P[T ] is only legal under the condition w(P) ∩ w(T ) = ∅. Notation 4.1. We use (T; ) → to mean ∃T ; such that (T; ) → (T ; ), and (T; ) 9 for the negation of (T; ) → (and similarly for the other syntactic categories). The semantics of the new constructs is given in Fig. 4, where represents the memory with the conjunction of the updates operated by P and by T , that is \ ∪ \ ∪ ( ∩ ). As we said, the scheduled sequential programs are written Ti = when ei do Ui where the expression ei is the “proceed” signal for program Ui ,
124
G. Boudol, I. Castellani / Theoretical Computer Science 281 (2002) 109 – 130
(WHEN) (CONTROL)
e : ;
U : (; ) cmd;
6
when e do U : (; ) cmd P : (; ) cmd;
T : (; ) cmd;
¿
P[T ] : (; ) cmd Fig. 5. Additional typing rules for systems.
set up by the scheduler. For instance, assuming that each ei is a variable si , initially false, the following program Rtn = i := 0 ; while tt do k := 0; (while k ¡ t do si+1 := tt; si+1 := 3 ; k := k + 1); i := [i + 1]mod n describes a scheduler for a system of n threads, implementing round robin with time slice t. It is easy to imagine how to program other scheduling policies in a similar style. For instance, assuming that there is a random function in the language, such that the evaluation of random(n) consists in randomly choosing an integer i such that 16i6n, then while tt do (i := random(n); si := tt; si := 3 ) describes a uniform probabilistic scheduler. Notice also that, if the controlled threads have the form when s ∧ si do Ui , the scheduling enforced by s1 := tt; · · · ; sn := tt; s := tt; while tt do nil is—assuming that s is initially false—simply the nondeterministic interleaving of the Ui ’s. We see from these examples that the scheduler usually needs some time to determine the index of the next thread to execute, and this is why we need the rule (CONTROL-OP2). This rule also allows one to ignore a terminated thread, and therefore the rule (WHEN-OP2), which is technically convenient, is harmless. The typing rules for the new operators are given in Fig. 5. The side-conditions in rules (WHEN) and (CONTROL) need some comments. First, note that a when statement can induce an implicit 3ow, just like the conditional and while statements, as for instance in the system: when xH = 0 do yL := yL + 1: This explains the requirement 6 in rule (WHEN). Now let us discuss the side condition in the rule (CONTROL). In a controlled thread system P[T ] where T = (when e1 do U1 · · · when en do Un );
G. Boudol, I. Castellani / Theoretical Computer Science 281 (2002) 109 – 130
125
the conditions ei are normally managed by the controller process P. Then if the Ui ’s have types (i ; i ) cmd, to type P[T ] the conditions ei must be chosen so that they have types i satisfying = 1 · · · n 61 · · · n = : If that is the case, P[T ] may be typed with (; ) cmd, regardless of the i ’s, thanks to the side condition in rule (WHEN), and to the fact that we only record the level of the condition as a guard in this rule. Therefore, the side condition ¿ in the rule (CONTROL) is more a constraint for the scheduler P than for the thread system T . Typically, programs of (L; ) cmd type can only be controlled by schedulers of type (L; L) cmd. One can see for instance that the round robin scheduler Rnt has type (L; L) cmd in a context where the variables i, k and si have type L var. Therefore, for any typable Ui ’s (in this context 4), the system Rtn [when s1 do U1 · · · when sn do Un ] is typable. The side condition ¿ in the rule (CONTROL) precludes, for instance, schedulers whose unique type is (L; H ) cmd. Indeed, it would be unsafe to accept programs of this kind as schedulers. For instance, if P = s := tt ; while xH = 0 do nil; U = yL := 0 ; yL := yL + 1; then the system P[when s do U ] is not interference-free, and would be typable without the side condition in the rule (CONTROL), with (s) = L var. Let us see another, similar example. Suppose for instance that we wish to design a scheduler which is able to detect the termination of a thread Ui , and then to skip it from execution. Then we may transform Ui into when ei do (Ui ; ti := tt) where the variable ti is a termination signal, initially false. Now if Ui has type ( ; H ) cmd, then ti must be high. Certainly, the scheduler will have to test the value of this variable, and therefore it must have type ( ; H ) cmd, but then, due to the condition ¿ in the (CONTROL) rule, it must have type (H; H ) cmd, and it can only control programs of type (H; ) cmd. Indeed, checking the termination of a program with high guards may be dangerous, as shown by the system—with a mistaken, still typable scheduler: P[when s1 do (U ; t1 := tt) when s2 do (yL := 0 ; yL := yL + 1)]; where P = s1 := tt ; s2 := tt ; while not t1 do nil: It is easy to check that the Subject Reduction Theorem and the Con4nement Lemma, and therefore also Lemma 3.6, extend to the new language. Similarly, the de4nitions of (strong, quasi-strong) (; L)-bisimulation and L-boundedness remain formally the 4 Note that the controlled programs U usually do not contain the control variables manipulated by the i scheduler. Indeed, i and k should be local to Rnt —for a treatment of local variables, see [21].
126
G. Boudol, I. Castellani / Theoretical Computer Science 281 (2002) 109 – 130
same as those for the base language (modulo the replacement of programs by systems), as well as the de4nition of secure systems. Given a typing context and a downwardclosed set L of security levels, let us de4ne the relation S3; L on controlled thread systems as follows: S 0 S3; L S1 if and only if S 0 and S1 are both typable in , and S0 = P[when e1 do U1 · · · when en do Un ]; S1 = P[when e1 do V1 · · · when en do Vn ] with 1. P is L-guarded in , and 2. for all i there exists i ∈ L such that ei : i , and 3. Ui L Vi for all i. Lemma 4.2. The relation S3; L is a strong (; L)-bisimulation. Proof. Let =L and (S 0 ; ) → (S 0 ; ). There are two cases: 1. If this transition is proved by means of (CONTROL-OP1) then
S0 = P [· · · when ei do Ui · · ·]; where (P; ) → (P ; 0 ), (when ei do Ui ; ) → (when ei do Ui ; 1 ) and = 0 1 . Since P is L-guarded in , by Lemma 3.13, there exists 0 such that (P; ) → (P ; 0 ) with 0 =L 0 . Regarding the transition of the thread system, there are again two cases: 1.1. The transition is proved by means of (WHEN-OP1), that is (e) = tt and (Ui ; ) → (Ui ; 1 ). Since Vi L Ui , either there is a transition (Vi ; ) → (Vi ; 1 ) such that L L ; L Vi Ui and 1 = 1 , or both Ui and Vi are in P . By the Assumption 3.3 we have (ei ) = (ei ) = tt (since ei is low in ), and therefore in the 4rst case (when ei do Vi ; ) → (when ei do Vi ; 1 ) by (WHEN-OP1), hence (S1 ; ) → (P [· · · when ei do Vi · · ·]; ); where = 0 1 =L , and this is the required matching move. Otherwise, ; L ; L Ui ∈ P and Vi ∈ P , and we distinguish again two cases: either there exist Vi L L and 1 such that (Vi ; ) → (Vi ; 1 ), and then 1 =L = = 1 , and we conclude as in the previous case, or (Vi ; ) 9 . Then (when ei do Vi ; ) → (when ei do Vi ; ) L by (WHEN-OP2), with =L = 1 , and
(S1 ; ) → (P [· · · when ei do Vi · · ·]; 0 ) is the required matching move in this case. 1.2. The transition is proved by means of (WHEN-OP2), that is (e) = tt, (Ui ; ) 9 and ; L , and we distinguish two Ui = Ui and 1 = . Since Vi L Ui , we have Vi ∈ P cases, depending on whether (Vi ; ) may perform a transition or not. We conclude as in the previous case. 2. If this transition is proved by means of (CONTROL-OP2) then S 0 = P [T0 ] with (P; ) → (P ; ) and (T0 ; ) 9 , where T0 = (when e1 do U1 · · · when en do Un ):
G. Boudol, I. Castellani / Theoretical Computer Science 281 (2002) 109 – 130
127
It is easy to see that (T0 ; ) 9 implies (ei ) = 3 for all i, and therefore also (ei ) = 3 by Assumption 3.3 since the ei ’s are low in . Then (T1 ; ) 9 where T1 = (when e1 do V1 · · · when en do Vn ): Since P is L-guarded in , by Lemma 3.13, there exists such that (P; ) → (P ; ) with =L , and therefore (S1 ; ) → (P [T1 ]; ), and this is the required matching move. We are now ready to prove our main result: Theorem 4.3 (Noninterference for controlled thread systems). If S is a controlled thread system typable in then S is secure in . Proof. Given a downward-closed set L of security levels, let us still denote by P ; L the set of high programs and systems (of any kind), and by S0; L the cartesian product P ; L × P ; L . It is easy to see (as in Lemma 3.6) that this is a (; L)-bisimulation, and therefore the relation S4;L = S0;L ∪ S3;L is a (quasi-strong) (; L)-bisimulation, by the previous lemma. We show that if S is typed in then S S4; L S. This is obvious if S is not L-bounded in , by the (extended) Con4nement Lemma, since S is in P ; L in this case. If S is L-bounded in , and S = P[T ] where T = (when e1 do U1 · · · when en do Un ); then a typing S : (; ) cmd may be inferred either using the (SUBTYPING) or the (CONTROL) rule. More precisely, there exist and such that S : ( ; ) cmd by the (CONTROL) rule, that is P : ( ; ) cmd and T : ( ; ) cmd with 6 ¿ and 6. Since S is L-bounded in , we have ∈ L, and therefore P is L-guarded in . Now T : ( ; ) cmd may be proved either using the (SUBTYPING) or the (PAR) rule—or the (WHEN) rule if n = 1. Then it is not diUcult to see that there exist i , i and i for each i such that ei : i and Ui : (i ; i ) cmd with 61 · · · n and 1 · · · n 6 and therefore i ∈ L for all i. Finally, we have Ui L Ui for all i by Theorem 3.15, and this concludes the proof. 5. Conclusion and related work We have addressed the question of secure information 3ow in systems of concurrent programs. This covers one of the security problems that can arise, for instance, when a mobile program visits diKerent sites, namely that of preserving the con7dentiality of the visited sites’ private data. In fact, in [5], it is shown how a form of noninterference called nondeducibility on composition may be used to model also other security properties like authenticity, nonrepudiation and fairness. Noninterference thus appears as a
128
G. Boudol, I. Castellani / Theoretical Computer Science 281 (2002) 109 – 130
rather interesting notion to study when security is concerned. On the other hand, it may be argued [10] that covert channels, that is implicit information 3ows, are unavoidable in practice, as they can arise also at the hardware level. Thus the aim of statically ensuring the absence of covert channels might be a hard one to realise. We certainly do not claim here to cover the whole range of possible attacks from a hostile party. The issue of noninterference has been largely studied in the literature, using diKerent models, and it is not our intention to review the various approaches. We focused on the approach of Volpano et al., as it gives an elegant treatment for a fairly standard language, which can be assumed to be the kernel of more sophisticated practical languages. The question of secure information 3ow and noninterference has also been investigated in the setting of process calculi [5,15]. More recently, there have been studies on noninterference for functional languages [14] and mobile process calculi [9,8,7]. The latter papers are closer to our work, as they use a type system to enforce noninterference. The treatment in [9,8], however, seems overly restrictive: it amounts (at least in the core calculus) to forbid all control 3ow from actions on high channels to actions on low channels. In [9], the core calculus is extended with more sophisticated constructs; in the extended calculus some actions may be classi4ed as “innocuous”, and the restriction on control 3ow may be relaxed when these actions are involved. The papers [14,7] are less restrictive and closer in spirit to our approach, as they try to distinguish the dangerous control 3ow (implementing information 3ow) from the harmless control 3ow which should not be restricted. Another related paper is [1], which studies secrecy properties in security protocols expressed in the spi-calculus. There again, a type system is used to ensure the security properties. As concerns noninterference in the presence of scheduling policies, the most popular approach has been so far the probabilistic one, taken for instance in [20,16]. Our intention here was to handle scheduling entirely within a possibilistic setting. It should be noted, also, that in [20,16] scheduling is introduced at the semantic level (adding probabilities to the transitions), while we express scheduling policies—which, after all, are programs—at the syntactic level. This has the advantage of allowing us to type the schedulers themselves, and express through typing conditions the restrictions one needs to impose on any reasonable scheduling policy for multilevel systems. This is in line with the view expressed by Sabelfeld and Sands [16], where a scheduler is described as a “mechanism for selecting threads which itself satis4es some noninterference property”. Moreover, [16] also identi4es a few characteristics which are deemed necessary for schedulers to be well-behaved in a multilevel security setting. Essentially, schedulers should be allowed to have access to the low part of the memory (to allow some interaction with the controlled threads), and be able to use the history of thread creation=generation along the computation, which may be of high level. In our setting we are able to express more precise conditions, for instance that schedulers allowed to test the termination of high threads should themselves be high-level programs. However, it would be interesting to compare more precisely our syntactic approach with the probabilistic approach of [20,16]. As we have seen, conditional branchings combined with scheduling can introduce new interferences due to the unbalanced duration of the branches. Some proposed
G. Boudol, I. Castellani / Theoretical Computer Science 281 (2002) 109 – 130
129
solutions to this problem rely on a controlled execution time for conditional branchings with high guards. For instance, in [20], a “protect” construct is used to encapsulate these conditional branchings as atomic operations. Another solution was presented by Agat [2], and proved correct in [16], where the branches of high-guarded conditionals are padded so that they always have the same duration. It should be noted that both these approaches allow loops of low-level only. Here we have adopted a diKerent solution to this speci4c problem, which allows us to deal uniformly with various notions of guards. For instance, with our notion of type it is very easy to deal with the standard wait=signal primitives used for synchronisation and cooperative scheduling. By the time we started revising this paper, and thanks also to one of the anonymous referees, we became aware of an independent paper by Smith [17] which was about to appear (indeed, within a similar time frame as our extended abstract [4]). As it turns out, Smith’s paper proposes a type system which is identical to ours, with the additional possibility of recording the running time of programs when this is known statically, thus incorporating the above-mentioned timing techniques for conditional branchings in the type system. Indeed, Smith’s concern is in controlling time leaks, of which scheduling leaks are a particular case. The absence of time leaks is formalised as a property of probabilistic noninterference. Since our type system is slightly more restrictive than Smith’s one (in the sense that the class of typable programs is smaller), it also implies a form of probabilistic noninterference. Finally, let us mention that the type system presented here is diKerent from the one of [4], where the level of conditional guards does not need to be taken into account as long as scheduling is not considered. Instead, the typing rule for loops is more restricted: loops are only allowed to have uniform types of the form (; ) cmd. This alternative type system also guarantees noninterference for concurrent programs (without scheduling), and we conjecture that it allows a larger class of programs to be typed. On the other hand, the solution for scheduling we propose here is more generous than that of [4], as long as we are only interested in scheduling sequential threads. An issue which has not been addressed here, but is planned for future work, is the feasibility of checking noninterference using a type inference algorithm, in the line of [19]. Current work is also oriented towards the treatment of more realistic languages, as advocated for instance in [12], including exceptions and higher-order constructs. Acknowledgements We would like to thank GeoKrey Smith for his interest in, and comments on the submitted version of this paper, and the anonymous referees, whose questions and suggestions led us to largely revise and improve the last section of the paper. References [1] M. Abadi, Secrecy by typing in security protocols, Journal of the ACM 46 (5) (1999) 749–786. [2] J. Agat, Transforming out timing leaks, in: 27th ACM Symposium on Principles of Programming Languages (POPL), 2000, pp. 40 –53.
130
G. Boudol, I. Castellani / Theoretical Computer Science 281 (2002) 109 – 130
[3] P. Bieber, J. Cazin, V. Wiels, G. Zanon, P. Girard, J.-L. Lanet, Electronic purse applet certi4cation (extended abstract), in: Workshop on Secure Architectures and Information Flow, ENTCS, Vol. 32, 2000. [4] G. Boudol, I. Castellani, Noninterference for concurrent programs, in: ICALP’01, Lecture Notes in Computer Science, Vol. 2076, 2001, pp. 382–395. [5] R. Focardi, R. Gorrieri, F. Martinelli, Non interference for the analysis of cryptographic protocols, in: Proceedings ICALP’00, Lecture Notes in Computer Science, Vol. 1853, 2000. [6] J.A. Goguen, J. Meseguer, Security policies and security models, in: Proceedings 1982 IEEE Symposium on Security and Privacy, 1982, pp. 11–20. [7] M. Hennessy, The security )-calculus and noninterference, Computer Science Technical Report 2000:05, University of Sussex, 2000. [8] M. Hennessy, J. Riely, Information 3ow vs. resource access in the asynchronous pi-calculus (extended abstract), in: Proceedings ICALP’00, Lecture Notes in Computer Science, Vol. 1853, 2000. [9] K. Honda, V. Vasconcelos, N. Yoshida, Secure information 3ow as typed process behaviour, in: Proceedings ESOP’00, Lecture Notes in Computer Science, Vol. 1782, 2000, pp. 180 –199. [10] J. Millen, 20 years of covert channel modeling and analysis, in: IEEE Symposium on Security and Privacy, 1999. [11] R. Milner, A Calculus of Communicating Systems, Lecture Notes in Computer Science, Vol. 92, Springer, Berlin, 1980. [12] A. Myers, J3ow: practical mostly-static information 3ow control, in: 26th ACM Symposium on Principles of Programming Languages (POPL), 1999. [13] D. Park, Concurrency and automata on in4nite sequences, in: Proceedings 5th GI-Conf. on Theoretical Computer Science, Lecture Notes in Computer Science, Vol. 104, 1981. [14] F. Pottier, S. Conchon, Information 3ow inference for free, in: Proceedings ICFP’00, 2000. [15] P.Y.A. Ryan, S.A. Schneider, Process algebra and non-interference, Journal of Computer Security 9 (1=2) (2001). [16] A. Sabelfeld, D. Sands, Probabilistic noninterference for multi-threaded programs, in: IEEE, 13th Computer Security Foundations Workshop, 2000. [17] G. Smith, A new type system for secure information 3ow, in: 14th IEEE Computer Security Foundations Workshop, 2001. [18] G. Smith, D. Volpano, Secure information 3ow in a multi-threaded imperative language, in: ACM, Proceedings POPL ’98, ACM Press, 1998, pp. 355 –364. [19] D. Volpano, G. Smith, A type-based approach to program security, in: TAPSOFT’97, Lecture Notes in Computer Science, Vol. 1214, 1997, pp. 607– 621. [20] D. Volpano, G. Smith, Probabilistic noninterference in a concurrent language, Journal of Computer Security 7 (2–3) (1999). [21] D. Volpano, G. Smith, C. Irvine, A sound type system for secure 3ow analysis, Journal of Computer Security 4 (3) (1996) 167–187.
Theoretical Computer Science 281 (2002) 131 – 176
www.elsevier.com/locate/tcs
Dynamic connectors for concurrency Roberto Bruni ∗ , Ugo Montanari Dipartimento di Informatica, Universita di Pisa, Corso Italia 40, I-56125 Pisa, Italy
Abstract We propose a metatheoretic approach to the de,nition of operational and abstract concurrent semantics for systems where name handling is a key issue. The main ingredients of our framework are connectors and tile logic. The former allow for the modeling of various kinds of graph-like and term-like structures, which can be useful in representing system distribution and causal histories. The latter is used to combine the use of connectors in space and in time (i.e., according to con,gurations and computations). As a detailed case study, we show how to de,ne a concurrent operational semantics and causal weak bisimilarity for a 0avor of basic parallel c 2002 Elsevier Science B.V. All rights reserved. processes. Keywords: Distributed systems; Concurrent and causal semantics; Tile logic; Algebras of connectors; Wirings; Process rewrite systems; Basic parallel processes
0. Introduction New technologies and the di6usion of wide area networks have had a great impact on the role of nowadays concept of computation, where issues like distribution, interaction, reactivity and coordination have become central and call for adequate formal models. The growth of many successful proposals for new calculi, each with its own distinguishing features, is a faithful witness of this situation: -calculus [69] for name mobility, HO [77] for process mobility, spi-calculus [1] with encryption primitives for the analysis of secure protocols, join calculus [42] for guaranteeing the locality principle in distributed implementations, action calculi [68] for separating name handling from controls and handling encapsulation of agents, ambients [25] for studying the distribution of processes, mobile and dynamic nets [3,22] for network recon,gurability, just to
Research supported by the EC TMR Network GETGRATS and by the Italian MURST Project TOSCA. Corresponding author. Tel.: +39-050-2212-768; fax: +39-050-2212-726. E-mail addresses:
[email protected] (R. Bruni),
[email protected] (U. Montanari). URLs: http://www.di.unipi.it/∼bruni, http://www.di.unipi.it/∼ugo
∗
c 2002 Elsevier Science B.V. All rights reserved. 0304-3975/02/$ - see front matter PII: S 0 3 0 4 - 3 9 7 5 ( 0 2 ) 0 0 0 1 1 - 7
132
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
cite a few well-known examples. However, the operational semantics of many of the aforementioned calculi require ad hoc techniques for dealing with interesting issues like, distribution, name handling, causal histories, which can hardly be automatically handled via standard speci,cation formats. This is also the case of located CCS [9], whose abstract semantics requires a specialized bisimulation, and of calculi equipped with history preserving bisimilarities. In this paper, we focus on a mathematical setting that exploits analogies in the representation of names, locations and causal links and that thus can serve as a general purpose metamodel to be instantiated to several cases of interest. We then show in detail an application to the simple case study of basic parallel processes with weak synchronization, de,ning a concurrent operational semantics and a causal abstract semantics, which is shown to coincide with bisimilarity via causal trees [33]. Finally, we informally discuss the treatment of other features like mobility and restriction on the basis of [40,70]. To characterize the kernel of properties, which are common to the features we want to model, and for which a uniform mathematical treatment is feasible, we rely on our joint work with Gadducci [14,15], where a small set of connectors is proposed, which can be used for modeling, e.g., communication infrastructures, spatial distribution of system components, partial orders of actions. In particular, these connectors can interact according to a small number of algebraic laws, which precisely characterize di6erent kinds of mathematical entities (all closed under sequential composition), like relations, partial orders, and partitions. Given this correspondence, when modeling a system, we can choose which subset of connectors to employ and ,x a few axioms for ,nitely generating the mathematical setting of connections we are interested in. It is worth remarking that all the structures considered in [15] admit normal form representations. Moreover, the various classes for connectors can be easily represented and manipulated in logical languages like Maude [28] (of the OBJ family [49]). In fact, Maude (as well as other languages supporting algebraic speci,cations and rewriting mechanisms) allows for eJcient rewriting over a mixing of associativity, commutativity, identity, idempotency and -conversion, which are the common axioms involved in the algebras of connectors. The process of speci,cation and prototyping can then be accelerated and conveniently tested. As semantic framework, we ,nd it convenient to take tile logic (TL) [45]. In fact, TL is to some extent parametric with respect to the algebras of states and observable actions, and it is adequate for expressing (and exploiting) the analogies between these two algebras. Like process calculi (PC), which usually consist of a term algebra for processes (possibly up to some axiomatic structural congruence), together with a labeled transition system (LTS) or a reduction system (in the style of Berry and Boudol’s chemical abstract machine [6]) inductively de,ned on the state structure, TL reconciles the algebraic structure of states with the coalgebraic view of computations. Moreover, analogously to the theory of SOS speci,cation formats [35,7,50], several tile speci6cation formats [45,12] have been developed for de,ning compositional abstract semantics. As argued in [12], TL is reminiscent of context systems [6] and hence designed to handle both closed terms and open terms in a uniform way (also analogously to Rensink’s conditional transition systems [75]).
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
133
Our aim is to combine connectors and TL to de,ne a general speci,cation paradigm based on algebraic representations of term-like and graph-like structures, which can o6er a valid semantic framework for concurrency in distributed, reactive and open systems. We end up with a taxonomy of categories of connectors, which can be extended to the two-dimensional tile paradigm in a standard way, allowing us to model di6erent features of distributed settings in a uniform way. Moreover, we can apply known results and proof mechanisms from tile theory for studying abstract properties such as observational congruences and adequacy of the concurrent semantics with respect to interleaving. 0.1. An algebra of connectors The key notion we need is that of link to names. In fact, names are to some extent multi-purpose tags that can be attached to e.g. resources, locations, objects, functions, channels, messages, memory cells and even to relevant events in the past history of the computation. The information about sharing is often more important than names themselves (think e.g. of bound names that can be freely -converted, and of canonical naming as in the De Brujin notation). Having multiple links to the same name means that the name is shared, while having at disposal no link to a name means that the name is private and cannot be accessed from the outside. Many mathematical structures have been recently proposed for expressing graphlike representations of name-based systems. They range from the :ownomial calculus of SMtefNanescu [26,78], to the bicategories of processes of Walters [56,57], to the interaction combinators of Lafont [60], to the pre-monoidal categories of Power and Robinson [73,55], to the action structures of Milner [68], to the interaction categories of Abramsky [2], to the sharing graphs of Hasegawa [51] and to the gs-monoidal categories of Corradini and Gadducci [29,30], just to mention a few (other references are [31,44,47,53,76]). Similarly to [29,30], we ,x a ,rst-order term-like notation which is reminiscent of Lawvere’s theories [62], but requires a di6erent axiomatization of the auxiliary operators involved in the construction. It is noteworthy that most of the above structures can be seen as enrichments over symmetric monoidal categories, which form the basis for the description of distributed environments in terms of the so-called “wire and box” diagrams. The informal wire and box notation gives an intuitive, visual understanding of the name sharing mechanism: Wires represent links from and to names, while boxes, labeled with operators in a signature , represent the modules interconnected in the system. Connection points between wires and boxes are marked by the sort of the corresponding name (i.e., the type of the wire). When composing systems, it is essential to know which names are private and which ones are public, therefore public names form an input and an output interface, represented by untied left-end or right-end of wires. Moreover, the basic operations of sequential and (disjoint) parallel composition for building larger diagrams arise naturally (see Fig. 1). Fig. 2 shows three examples of wire and box diagrams: on the left, a component C has two identical subcomponents p; in the center, D has two connections to the same subcomponent q. Both systems have empty input interfaces and unary output interfaces.
134
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
input
.. .
.. .
output
.. .
. ..
.. .
. ..
.. .
. ..
. ..
Fig. 1. A generic wire and box diagram and two ways of composing diagrams.
p
.
.
. C
p
.
.
.
q
x
D
.
.
.
p
.
q
.
.
y
r
.
.
z
x
Fig. 2. Examples: three wire and box diagrams.
For denoting these situations as terms, we can write C(p; p) in the ,rst case, but we must write e.g. let x = q in D(x; x), instead of D(q; q), to faithfully describe the sharing of q (the same resource q, denoted by a local name x, is referenced twice in the context D). This distinction plays a signi,cant role when dealing with distributed systems, as distinct instances of the same resource can evolve independently (possibly nondeterministically), while the evolution of a shared component must be coordinated with all the contexts it is linked to. The rightmost diagram in Fig. 2 represents a situation which we shall exploit further in our case study: a system is composed by three components (i.e., p, q and r) that are attached via several connectors to the output interface. We can think of the interface x; y; z as a list of places, encoding some information about the past history of the system (e.g., which process spawned the components). It is evident that p is linked to x and y, while q is connected to x, y and z, and r is linked to z. But what about p and z? If links were undirected, then there is a path connecting p to z, but if instead links were directed (e.g., from left to right), then p cannot see z. The answer lies in the algebraic laws of connectors: we shall see that both situations are possible and that the di6erence is given by just one axiom. A unambiguous notation for denoting the third diagram can be p[x; y] | q[x; y; z] | r[z] (for directed links), which is di6erent from p[x; y; z] | q[x; y; z] | r[x; y; z] (associated with undirected links). The wire and box notation clearly separates the signature (i.e., the basic modules) from the auxiliary structure which can be used for coordination (i.e., wires or connectors). In particular, in [15] it is shown that by imposing suitable wiring formats (e.g., that at most one wire can exit from a name) it is possible to characterize very di6erent frameworks which can encode, e.g., Petri net processes, contextual net processes, relations, partitions, partial orders, and multi-sets of traces. At the algebraic level, they correspond to di6erent ways of combining four auxiliary operators: duplicator ∇ (for
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
135
initial configuration initial input interface trigger final input interface
initial output interface
s a
α
b
t
effect final output interface
final configuration Fig. 3. A generic tile.
sharing names), discharger ! (for hiding names), co-duplicator T (for matching names), and co-discharger ¡ (for creating names). 0.2. A two-dimensional logic Connectors can be employed both in “space” (to describe the topology of the system, i.e., its structure or syntax) and in “time” (to express behavioral observation, i.e., for abstract semantics). Nevertheless, the common underlying algebraic representation of connectors suggests that some interplay might naturally occur between their structural and semantic usages, which is one of the main issues in moving from rewriting logic to tile logic. Rewriting logic (RL) [65] gives the basis for reduction semantics, lifting the structure of states to the level of (concurrent) computations. It o6ers both a semantic and logical framework, where many di6erent languages and systems can be straightforwardly encoded and many other logics can be naturally represented. Notably, several programming languages based on rewriting logic have been developed (e.g., Maude [28], ELAN [74] and CafeObj [37]). However, as noticed in [46], RL is not designed around interaction and coordination issues, which must be recovered via suitable encodings. Tile logic extends rewriting logic (in the unconditional case) by taking into account state changes with side e6ects and rewriting synchronization. Basically, a set of rules describes the behavior of open con6gurations, which may interact through their interfaces. The name “tile” is due to the graphical representation of such rules, which have a the form shown in Fig. 3, also written as : s → t, stating that the initial con6guration b
s of the system evolves to the 6nal con6guration t via the tile , producing the e;ect b. However, such a step is allowed only if the subcomponents of s (i.e., the arguments of the context s) evolve to the subcomponents of t, producing the e6ect a, which acts as the trigger for the execution of . Triggers and e6ects are called observations and tile vertices are called interfaces. The arrows s, a, b and t give the border of . The interfaces shared between con,gurations and observations represent the way in which the two dimensions are connected. In fact, con,gurations and observations are just arrows in two distinct monoidal categories having the same set of objects. In particular, the categories we consider are those freely generated starting from suitable signatures and enriched with the auxiliary connectors of interest. Tiles can be composed horizontally, in parallel, and vertically to generate larger steps. Horizontal composition yields rewriting synchronization: the e6ect of the ,rst tile acts
136
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
β α
α
β α
β
Fig. 4. Horizontal, parallel and vertical tile compositions.
as trigger for the second tile, and the resulting tile expresses the synchronized behavior of both. The operation of parallel composition corresponds to building concurrent steps, where two (or more) disjoint con,gurations can concurrently evolve. Of course, the border of a concurrent step is the parallel composition of the borders of each component of the step. Vertical composition models the execution of a sequence of steps starting from an initial con,guration. It corresponds to sequential composition of computations. The three compositions are illustrated in Fig. 4. Given a set of basic tiles, the associated tile logic is obtained by adding some canonical “auxiliary” tiles and then closing by (the three kinds of) composition both auxiliary and basic tiles. Analogously to rewrite rules in rewriting logic, tiles can be seen as sequents in tile logic, with tile compositions yielding the inference mechanism for deriving new sequents. Thus, tile logic o6ers a two-dimensional Curry–Howard analogy, where borders are types, i.e. formulas, and tiles are terms, i.e. proofs: Type inhabitance means ,nding a tile with a certain border (and of course, it may happen that di6erent tiles have the same border). Auxiliary tiles are the two-dimensional counterparts of (one-dimensional) connectors. Therefore, when the same connectors are used on the horizontal and vertical dimensions, auxiliary tiles model the “sliding” of connections from one dimension to the other through tile vertices. As an example, auxiliary tiles may be introduced that accommodate consistent sharing of names in the two dimensions. In this paper, we shall give just an informal view of the categorical models of tile logic (expressed by suitable monoidal double categories [45,18,19]), and of the equational algebra of proof terms decorating tile sequents. We shall instead pursue the view of tile logic as a concurrent operational machinery, where trigger=e6ect pairs are labels that provide a natural way of expressing abstract semantics of open systems (e.g., via traces, tile bisimulation and coalgebraic techniques [32]). By analogy with the theory of SOS formats, several speci,cation formats have been de,ned for tiles, e.g.: (a) the monoidal tile format [67] and the process tile format [16], which have monoidal structures of both con,gurations and observations (i.e., linear terms); (b) the algebraic tile format [45], which has cartesian con,gurations and monoidal observations; and (c) the term tile format [16], which has cartesian con,gurations and observations. Moreover, the so-called basic source syntactic constraint guarantees that tile bisimilarity is a congruence for (a) and (c), while for the algebraic format the congruence is guaranteed for closed terms only [12]. Intuitively, the fact that the basic source works ,ne for the monoidal and the cartesian tile format but not for the algebraic tile format suggests that having analogous horizontal and vertical structures allows for proving stronger results. Therefore, the
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
137
idea is to encourage the use of the same algebra of horizontal and vertical connectors, so that a two-dimensional connector (also dynamic connector) is just any tile that expresses the consistency between its corresponding horizontal and vertical connections. In other words, the categorical perspective and the graphical representation of tiles both suggest that two-dimensional connectors must be commuting squares in the category of connectors. Informally, two-dimensional connectors have the main task of propagating e6ects through horizontal connectors, preserving the correct correspondences. Driven a by the results in [16,18,19], we take as connectors all tiles : s → t, where all s, a, b b
and t are obtained as compositions of one-dimensional basic connectors and such that s; b = a ; t, for a and b the horizontal counterparts of the vertical connectors a and b (uniquely determined by the analogy between horizontal and vertical connectors). As a ,rst result, we show that two-dimensional connectors can be ,nitely generated and axiomatized according to a very simple scheme whenever one-dimensional connectors can. Since this is the case of all the structures considered in [15], then we are con,dent that the resulting metamodel (which is parametric with respect to horizontal and vertical signatures, the algebra of connectors, and the operational moves de,ned by basic tiles) is general enough to cover several cases of interest. 0.3. An example from basic process algebras In the literature, tiles have been already applied to many formalisms, e.g., CCSlike calculi, located CCS, -calculus and actors. Nevertheless, no uniform approach to provide such calculi with a causal and concurrent operational semantics has been de,ned. In this paper, we focus on such an approach for systems whose abstract view of states is similar to the one illustrated in the rightmost diagram of Fig. 2: There are several components (which are to some extent similar to the tokens of a Petri net) and an output interface of the system (essentially a list of names). Between them, suitable connectors establish the internal interaction between components and the external interaction between components and any environment attached to the interface. An input interface can also be present, whose names can be of course connected with components and names in the output interface. Operationally, each component must be able to express all of its possible behaviors, also those that require some coordination with other components. In doing this, suitable e6ects can be produced that must be propagated through horizontal connectors and eventually coordinated; a task which is assigned to two-dimensional connectors, as we already noticed. The simplest example that ,ts our aim is based on a description of in,nite state concurrent systems in the style of PA-processes [5,63] and process rewrite systems [64], where a smaller set of basic operators (namely parallel and sequential composition) is considered with respect to CCS-like calculi, while action pre,x, (guarded) choice and recursion are directly encoded in the operational semantics, in the form of basic labeled rewrite rules. In particular, we rely on the subclass of basic parallel processes (BPP), whose processes t are just the empty process , constants in a countably in,nite set Const = {X; Y; : : :}, or the (associative, commutative and with unit ) parallel composition t1 t2 of two other processes t1 and t2 . The operational semantics
138
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176 a
is obtained by closing a set of basic rules (each having the form X → t for a an action taken in a countably in,nite set Act = {a; b; : : :}) with respect to free concurrent application in any parallel composition, i.e., according to the classi,cation of [64], we rely on BPP(1,P) processes (the symbols in parentheses denote the forms of sources and targets of basic transitions, hence 1 means that the sources of basic transitions are single constants, while P means that any ,nite parallel composition of constants can be taken as target). Note that since is ,nite, only a ,nite number of actions and constants must be considered, although Act and Const can be countably in,nite. Pre,xes are encoded in transition labels, guarded choice is given by inserting multiple a b basic transitions having the same constant as source (e.g. X → Z W and X → Y Y ), and (guarded) recursion is obtained by allowing the re-use in the transition target of a the same symbol in the source, as in X → Y X Y . The idea is to combine the use of connectors and tiles to equip BPP(1,P) with: (1) synchronization between otherwise communication-free processes; (2) causality information based on abstract locations; (3) weak observational semantics, giving a satisfactory account of causality, in the style of Darondeau and Degano’s causal trees [33,34]; and (4) a concurrent operational semantics, i.e., a concurrent implementation (as opposed to concurrent abstract semantics). We call WS-BPP(1,P) the resulting process paradigm (the pre,x “ws” stands for weakly synchronized). We shall state a formal correspondence between ordinary labeled transitions of WS-BPP(1,P) processes and tiles and prove that tile bisimilarity coincide with the causal weak bisimilarity of Darondeau and Degano [33]. 0.4. Structure of the paper Section 1 introduces the basic notation and concepts about our algebraic view of connectors (Section 1.1) and tile logic (Section 1.2). Section 2 presents the original results about the characterization of dynamic connectors which will constitute the basis of our metamodel. Section 3 focuses on the application of our paradigm to the study of causal and concurrent semantics for WS-BPP(1,P) processes. Section 4 discusses further applications of our metamodel, sketching a comparison with related work in the literature.
1. Background 1.1. Normal forms for algebras of connectors We recall here a categorical view of connectors, along the lines traced in [15]. Essentially, connectors represent suitable enrichments of monoidal categories and, as it is argued by various authors (cf. surveys in [15,30]), these structures allow to recast the usual notion of term over a signature in a more general setting. Moreover, the progressive enrichment of a basic theory with additional connectors generates several di6erent models, where the notions of relation, partial order, partition, and many others
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
139
can be represented and compared. In particular, a key role is played by the way in which the various connectors can interact. A category C can be seen as a graph with nodes in O and arrows in A, together with a total map id : O → A that associates an arrow id x : x → x with each object x ∈ O, and a partial, associative operation for sequential composition of arrows ; : A × A → A that is de,ned if and only if the target of its ,rst argument matches the source of its second argument: whenever f : x → y and g : y → z are arrows of C then f; g : x → z is an arrow, and for all f : x → y we have id x ; f = f = f; idy . As usual, we will often denote the arrow id x by the object name x itself. The obvious notion of morphism between categories (mapping arrows into arrows and objects into objects) must preserve the categorical structure (source, target, identities and sequential composition) and is called functor. In what follows, we will sometimes refer to the opposite category C op of a category C as the category having the same objects as C, but where the direction of the arrows is reversed (e.g., if f : x → y and g : y → z are arrows of C, then f op : y → x, g op : z → y and g op ; f op = (f; g)op ). When no confusion can arise, we shall omit the superscript (·)op from arrow symbols. For simplicity, we restrict to categories strictly preserving the additional structure; and, in particular, to monoidal structures where the tensor product is strictly associative and with unit, instead of being so only up to a canonical isomorphism. This allows us to focus on the overall presentation of the monoidal structure itself as a suitable data type, at the same time easing the notation. Denition 1. A (strict) monoidal category (MC) is a triple C; ⊗; e, where C is the underlying category, the tensor product ⊗ : C × C → C is a functor satisfying the associative law (t1 ⊗ t2 ) ⊗ t3 = t1 ⊗ (t2 ⊗ t3 ), and the unit e is an object of C satisfying the identity law t1 ⊗ e = t1 = e ⊗ t1 , for all arrows t1 , t2 and t3 . As a matter of terminology, given two functors F; G : C → D, we use the term transformation (from F to G) to denote a family $ of arrows in D indexed by the objects of C, such that $x : F(x) → G(x) for all objects x in C. It is a natural transformation if F(f); $y = $x ; G(f) for any arrow f : x → y in C. Denition 2. A symmetric monoidal category (SMC) is a 4-tuple C; ⊗; e; %, where C; ⊗; e is a MC, and % :−1 ⊗−2 ⇒−2 ⊗−1 is a natural transformation satisfying the coherence axioms %x⊗y; z = (x ⊗ %y; z ); (%x; z ⊗ y) and %x; y ; %y; x = x ⊗ y, for all x; y; z. Note that, the naturality of symmetries in a SMC C; ⊗; e; % amounts to say that for all arrows f : x → y and g : z → w we have (f ⊗ g); %y;w = %x; z ; (g ⊗ f). We shall consider connectors which can all be expressed as suitable categorical transformations. Symmetries and connectors can also be nicely illustrated via the wire and box notation. For example, the symmetry %x; y can be seen as the crossing of wires in Fig. 5 (left), and consequently the coherence axioms can be drawn as in Fig. 5 (center and right), while the naturality of % is represented in Fig. 6. (The labels x, y and z denote typing information associated with wires.)
140
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
x y
x
x
z
x
z
y
z
x = y
x
z
y
y
y
y
y
x y
x
z
x y
x
=
x
x
y
y
Fig. 5. Symmetries: the wire and box notation.
x
f
y
w
x
z
g
w
z
x
f
y
= z
g
w
y
Fig. 6. Wire and box representation of the naturality axiom for symmetries.
The constructive de,nition of algebraic theories [62] as symmetric monoidal categories, enriched with two natural transformations (duplicator and discharger), dates back to the mid-seventies [52,72], even if it has received a new stream of attention in these days. With respect to the usual presentation via universal properties (or equivalently, the ordinary description of terms by means of the metaoperation of substitution), it emphasizes and separates very nicely the “link structure” from the term signature . The naturality axioms for these transformations express a controlled form of data sharing and garbaging. This intuition is further con,rmed by the results in [30], where it is shown that, if these axioms are missing (i.e., if duplicators and dischargers are just transformations), then the corresponding gs-monoidal theory is the natural framework for the representation of term graphs [4] (the pre,x “gs” comes indeed from graph substitution). In this section we propose a taxonomy for these enriched structures, which are essentially built on duplicators, dischargers, and their “opposite” versions. A duplicator ∇ is a transformation from the identity functor on C to the functor D; ⊗ =−1 ⊗−1 obtained by pre-composing the monoidal tensor product by the diagonal functor D : C → C × C (with D(f) = (f; f) for all f ∈ C). A discharger ! is a transformation between the identity on C and the constant functor that sends everything into the unit e. Moreover, the following coherence axioms must be satis,ed: ∇x⊗y = (∇x ⊗ ∇y ); (x ⊗ %x;y ⊗ y) !x⊗y =!x ⊗!y ∇x ; (∇x ⊗ x) = ∇x ; (x ⊗ ∇x )
∇e =!e = id e
∇x ; %x;x = ∇x ∇x ; (!x ⊗ x) = x
This situation is sometimes referred to in the literature by saying that each object is equipped with a co-monoid structure [43], while, after [30], we denote such a structured category as gs-monoidal. If ∇ and ! are natural (i.e., if they satisfy f; ∇y = ∇x ; (f ⊗ f) and f; !y = !x for all f : x → y), then the category is cartesian. We shall omit the subscripts from connector components (e.g., by writing ∇ instead of ∇x ) when the object name is obvious from the context. Similarly, co-duplicators Tx : x ⊗ x → x and co-dischargers ¡x : e → x must satisfy dual coherence axioms, and we denote the resulting category as cogs-monoidal; when nat-
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
x x
∆
x
!
∆x =
x
!
!x =
x = x
x =
!
x
141
x
x
Fig. 7. Four connectors in the wire and box notation: ∇x , !x , Tx and ¡x .
urality is also satis,ed, it yields co-cartesianity. The four connectors are illustrated in Fig. 7. Wire and box representations for their coherence axioms can be found in [15]. There are various ways for the gs-monoidal and the cogs-monoidal structures to interact. In particular, the following laws have been pointed out in the literature (see, e.g., [24,27,15]): ∇x ; Tx = x;
(1)
Tx ; ∇x = (∇x ⊗ ∇x ); (x ⊗ %x;x ⊗ x); (Tx ⊗ Tx );
(2)
Tx ; ∇x = (x ⊗ ∇x ); (Tx ⊗ x);
(3)
Tx ; ∇x = (∇x ⊗ x); (x ⊗ Tx );
(4)
¡x ; !x = e;
(5)
¡x ; ∇x = ¡x ⊗ ¡x ;
(6)
Tx ; !x =!x ⊗!x :
(7)
As a set, these laws are of course redundant. For example, laws (3) and (4) are equivalent, and they subsume law (2). At the same time, they are linked with naturality: law (2) is e.g. satis,ed when the monoidal product is both cartesian and co-cartesian, i.e., if the underlying category has biproducts. Several subsets of the eight laws listed above have been studied in the literature, usually as a model for various algebras of systems. Case studies range from the causal streams of Ferrari and Mowbray (in joint work with the second author) [41] and the :ownomials calculus proposed by CNazNanescu and SMtefNanescu [27,78], to the bicategories of relations introduced by Carboni and Walters [23,24], and to the (co)span categories considered in [13] by Gadducci (in joint work with the ,rst author). The relevant axioms are graphically illustrated in Fig. 8, where axiom (4) is omitted because equivalent to law (3). Table 1 summarizes the taxonomy of categories obtained via several mixing of constructors. In particular, the ,rst four rows show whether (co)duplicators and (co)dischargers are required, while the remaining six rows illustrate the laws that regulate the interplay between duplicators, dischargers and their opposites. The columns are devoted to each one of the categories presented. Entries are marked with the symbol + if the objects of the category in the corresponding columns (which are categories themselves) must satisfy the structural requirement associated with that row. The symbol - is used otherwise. Note that, for the sake of readability, we presented a graphical view of axioms (1) – (3) and (5) – (7) in the ,rst column, which is reminiscent of the corresponding
142
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
x (1) x = x
x
x
x
x
x
x
!
x
x
!
(5) =e
x x
x
x
x x
!
(2) =
x x
x
x
x
x
x
x
x
!
x
x x
x x
(7) x = x
x
x
(3) =
x
(6) =
x
x
x
x
!
x
!
x
x
x
x
!
!
x
Fig. 8. Axioms (1) – (3) and (5) – (7) as wires and boxes.
Table 1 A taxonomy of connectors
ShCat GSCat coGSCat RMCat MShCat NBCat PMCat DGSCat TRMCat ∇
T ! ¡
+
+
−
+
−
− − −
−
− − X=Z − − |−| = e |−≺ = |= − −| = =| −
− − − − − −
=− X=,
−
+ + − − − − − −
+ + + + + +
−
+ + +
+ +
− −
+ + +
− − −
− −
+ +
− − −
+
− −
+ + + +
+ + + +
+ + + +
+ + +
− −
− − −
+ +
−
+
+ +
− −
+
−
wire and box diagrams in Fig. 8. For example, the category ShCat has share categories as objects and share functors between them as arrows. The corresponding column tells us that a share category is a SMC with duplicators. Share functors are just SMC functors strictly preserving duplicators. A more interesting example is given by RMCat, whose objects are r-monoidal categories and whose arrows are R-monoidal functors. r-Monoidal categories have a very rich structure, which includes all connectors, satisfying laws (1) – (2) and (5) – (7). The name r-monoidal comes from the word relation, because Rel the category of sets (as objects) and relations (as arrows) has that structure.
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
143
Leaving aside gs-monoidal categories (i.e., the objects of GSCat), cogs-monoidal categories (in coGSCat = GSCatop ), match-share categories (in MShCat) and the new-bang categories (in NBCat), let us mention also the p-monoidal categories of PMCat, which are very similar to r-monoidal categories, except for the fact that the stronger axiom (3) holds rather than just law (2), but that cannot be compared with r-monoidal categories because laws (6) –(7) are not required. The name p-monoidal comes from the word partition: in fact, the valid laws state that it is not important the way in which two names are connected, but just the fact that they are connected, i.e., the paths formed by connectors de,ne a partitioning of input and output names. To some extent, axiom (3) imposes a sort of transitive (and re0exive) closure on paths, which corresponds to the di6erence between a relation and the partition it generates. Finally, p-monoidal categories are a particular instance of dgs-monoidal categories (see row DGSCat). Though any of the above structures has its own merit and can be exploited in the two-dimensional tile setting, we shall focus on TRMCat which suits the case study presented in the Introduction. The category TRMCat di6ers from RMCat in that dischargers are not required, hence the name TRMCat, which stands for total relation. Moreover, since ! is not considered, then axioms (5) and (7) must be relaxed. We conclude this overview with an example, taken from [15], which illustrates how to model (,nite) labeled partial orders by means of connectors. This representation is in fact used for the observations of tiles in Section 3. Example 3. Let L be a set of labels and L = {l : 1 → 1 | l ∈ L} be a special signature of unary operators associated with L. For any l ∈ L, let us denote by el the arrow ∇1 ; (id1 ⊗ l); T1 taken in the free r-monoidal category RM(L ) generated by L . Given the symmetric monoidal functor F : RM(L ) → RM(L ) de,ned by F(l) = el and behaving as the identity on objects and connectors ∇, T, ! and ¡, we have that the set F(RM(L )) [ 0; 0] = F(RM(L ) [ 0; 0]) (i.e., the set of arrows from 0 to 0 in the subcategory F(RM(L )) is isomorphic to the set of ,nite partial orders (E; ) labeled over L. The functor F has the task of selecting only arrows built using el as generators, instead of l. In fact, by joining the source and target of l with those of an identity in parallel with l via ∇1 and T1 , the arrow el provides a direct connection from the source of l to its target, and this short-circuit is transitively closed through sequential composition thanks to axiom (2) of r-monoidal connectors. Thus, given a generic arrow f ∈ F(RM(L )) [ 0; 0], the generators l appearing in f become the events of the partial order (labeled by l), and two di6erent events e1 , e2 are ordered as e1 e2 if there is a direct connection between the target of e1 and the source of e2 . We just take arrows from 0 to 0, because otherwise source and target ranks should also be taken into account. 1.2. Tile logic The tile model has been introduced in [45] as an extension of rewriting logic along the intuition of context systems. While ordinary (unconditional) rewrite rules do not rely on the interaction with the environment (they can be freely instantiated with any
144
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
term and also contextualized inside any context), the goal of tiles is a reactive view of the system, so that components can be designed in isolation and then composed via their behavior. In fact, triggers and e6ects allow for modeling interaction where also the interface of the component can be modi,ed, and this is possible only if also the environment can accomplish this change, or vice versa, the component might be required to o6er di6erent services on demand, which may involve some rearrangement of its local network topology. It is straightforward that rewrite rules are just a special case of tiles, whose triggers and e6ects are identities. Moreover, being designed for application to concurrency, tiles require a monoidal operation on states and observations, for parallel composition of components. Varying the algebraic structure of con,gurations and observations, tiles have been used to model many di6erent aspects of dynamic and reactive systems, ranging from synchronization of net transitions [20], to causal dependencies for located calculi and ,nitely branching approaches for asynchronous -calculus [40], to name handling in synchronous -calculus [19] (where a higher-order version of tiles is used), to actor systems [70]. Though at present no automated veri,cation tool is available which is based directly on TL, some prototyping has been made possible for suitable TL speci,cation classes, via a conservative encoding in RL [16,17]. Denition 4. A tile system is a tuple R = (H; V; N; R) where H, V are monoidal categories with the same set of objects OH = OV , N is the set of rule names and R : N → H × V × V × H is a function such that for all ∈ N , if R() = s; a; b; t, then s : x → y, a : x → z, b : y → w, and t : z → w for suitable objects x, y, z and w. We a shall write such rule either as : s → t, or as the tile b
The category H is called horizontal and its arrows con6gurations. The category V is called vertical and its arrows observations. The objects of H and V are called interfaces. Starting from the basic tiles R() of the system, more complex tiles can be constructed via horizontal, vertical and parallel compositions. Moreover, the horizontal and vertical identities are always added to the system and composed with the basic tiles. All this is illustrated in Fig. 9. Depending on the chosen tile format, H and V must satisfy certain constraints and suitable auxiliary tiles are added and composed with basic tiles and identities in all the possible ways. The set of resulting tiles (called :at a sequents) de,ne the :at tile logic associated with R. We say that s → t is entailed by a
a
b
b
b
the logic, written R f s → t, if the sequent s → t can be expressed as the composition of basic and auxiliary tiles.
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
145
R() = s; a; b; t
t:x→y∈H
a:x→z∈V
a
x
x −→ z
s −→ t a
y
b
s −→ t b
a
s −→ t
h −→ f a
a
t −→ t
b
c
b
s; h −→ t; f
a
c
a
s −→ t
t : −→ h a;c
d
b
s −→ h
c
c
h −→ f a⊗c
d
s ⊗ h −→ t ⊗ f
b;d
b⊗d
Fig. 9. Inference rules for 0at tile logic: (from left to right, top to down) basic sequents; vertical and horizontal identities; horizontal, vertical and parallel compositions.
The usual abstract equivalences of LTS can then be straightforwardly rede,ned by considering the pairs (trigger, e6ect) as the labels of the transition system. Denition 5. Let R = (H; V; N; R) be a tile system. A symmetric relation ∼t on a con,gurations is called tile bisimulation if whenever s ∼t t and R f s → s , then t b a exists such that R f t → t , and s ∼t t . b
The maximal tile bisimulation is denoted by t , and two con,gurations s and t are tile bisimilar if s t t. Tile bisimilarity is a congruence if whenever s t t and s t t , then s ⊗ s t t ⊗ t and s; s t t; t (if composable). A semantics being a congruence is of course fundamental for having a compositional framework, since it guarantees that any component of the system can be safely replaced by any semantically equivalent component. Note that the congruence property must be veri,ed against the two basic operations of tile con,gurations: sequential and parallel compositions (ordinary congruence with respect to operators in the con,guration signature follows as an easy implication). The monoidal structure of V makes tile bisimilarity suitable for expressing true-concurrent semantics in the style, e.g., of [48]. We are particularly interested in considering tile systems where the monoidal categories of con,gurations and observations are freely generated from suitable horizontal and vertical signatures, respectively, e.g., they are initial models in the categories discussed in the previous section. The tile format originally proposed in [45] is the so-called algebraic tile format that recollected the perspective of ordinary transition system speci,cations: con,gurations are terms over a certain signature, and observations are the arrows of the monoidal category freely generated by certain labels (regarded as unary operators). Auxiliary tiles lift the horizontal cartesian structure to the horizontal composition of tiles. In the a ⊗···⊗a algebraic tile format, basic tiles have the form s −1−−−−→n t, where ai ’s and a can be a
either labels or identities and s; t ∈ T (X ). A typical auxiliary tile for the algebraic a format is ∇ −→ ∇, which duplicates the observation a (trigger of the tile). We refer a⊗a
to [45] for more details. The algebraic tile format is not uniform in the two dimensions, since H is cartesian, whereas V is only monoidal (nonsymmetric). The results in [12] suggest that a more
146
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
Basic proof sequents: Generators and Identities: a : s −→ t ∈ R(N ) a : x −→ z ∈ S(V ) b
s : x −→ y ∈ S(H )
: s −→ t ∈ Pp (R)
1s : s −→ s ∈ Pp (R)
a
a
idy
1a : id x −→ id z ∈ Pp (R) a
b
idx
x; y ∈ S ∗
Auxiliary proof sequents: Symmetries:
%x; y
2x; y : %x; y −→ idy⊗x ∈ Pp (R) idy ⊗ x
Composition rules: Parallel and Sequential compositions: a
: s −→ t; b
⊗ : a
: s −→ t; b
b
a⊗a s ⊗ s −→ t b⊗b
3 : s −→ t ∈ Pp (R) a
b
∗ 3 : s; s −→ t; t ∈ Pp (R) b
a
: s −→ t ∈ Pp (R) b
⊗ t ∈ Pp (R) a
: s −→ t; b
a
3 : t −→ t ∈ Pp (R) a;a
b
· 3 : s −→ t ∈ Pp (R) b;b
Fig. 10. Inference rules for process tile logic.
convenient framework can be obtained if we renounce to the cartesian structure altogether, resorting to the simpler monoidal tile format [67] where only linear contexts are allowed (and observed), or if we consider the more general term tile format [16], where also V is cartesian. Since here we are not interested in naturality axioms for ∇ and !, the term tile format is not adequate; on the other hand, the monoidal tile format is not suJcient for our purposes (all categories of connectors have at least the symmetries). We thus consider process tile logic [11,16]. Denition 6. A process tile system (PTS) R is a tile system, whose categories of con,gurations and observations are the free SMC’s S(H ) and S(V ) generated by two signatures H and V (over the same set of sorts S). Without loss of generality, we represent the objects of S(H ) and S(V ) as ,nite strings of sorts, i.e. as elements of S ∗ , which is indeed the free monoid on S. In process tile logic, the consistent permutation of wires is introduced for free. Starting from a PTS, we derive all the tiles obtained by applications of some deduction rules, de,ning the free compositions of the basic and auxiliary tiles in R according to parallel, horizontal, and vertical compositions. We decorate the sequents with proof terms, that can be axiomatized in order to capture equivalent proofs. The resulting equivalence classes make fewer identi,cations than those induced by the undecorated 0at version. Denition 7. Let R be a PTS. We say that R entails the class Pp (R) of process sequents, obtained by a ,nite number of applications of the inference rules in Fig. 10. For any ∈ Pp (R) we write R p (while f is used for 0at sequents).
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
147
Fig. 11. A composition of two-dimensional symmetries.
Entailment in the logic can be expressed using the algebraic structure on proof sequents. Due to space limitations, we refer the interested reader to [11] for the detailed description of the axiomatization of proof sequents. We say that R entails the class Ap (R) of abstract process sequents, whose elements are equivalence classes of Pp (R) modulo such axiomatization. This makes Ap (R) a symmetric monoidal double category [18], de,ning the initial model of PTL. 1.2.1. A digression on symmetric monoidal double categories and PMEqtl This informal digression introduces concepts to be used in conjunction with Propositions 16 and 17. If skipped, this material does not otherwise compromise the readability of the rest of the paper. Monoidal double categories come equipped with the operations of sequential, vertical and parallel compositions, thus providing a convenient class of models for tile logic. Essentially, the axioms de,ne the associativity (and the obvious unit elements) for all compositions, plus the functoriality of each composition with respect to the other two. The axiomatization of two-dimensional symmetries is more complex and not discussed here. However, the idea is that any two tiles with the same border that are obtained by the composition of auxiliary tiles and horizontal and vertical identities are equated. Thus we have e.g., (see Fig. 11): (2x;y ∗ 1%y;x ) · (1%y;x ∗ 2y;x ) = 1id x ⊗id y = 1id x ⊗id y : Formally, a double category is an internal category (i.e., a cat-object) in Cat, the category of small categories (as objects) and functors (as arrows). Given two double categories D and E, a double functor F : D → E is a 4-tuple of functions mapping objects to objects, horizontal and vertical arrows to horizontal and vertical arrows, and cells to cells, preserving identities and compositions of all kinds. Thus, monoidal double categories are double categories together with a double functorial tensor product ⊗ and a unit object e. An alternative characterization of monoidal double categories can be given in terms of product theories in partial membership equational logic (PMEqtl) [66], as proposed in [67]. The features of PMEqtl (partiality, poset of sorts, membership assertions) offer a natural framework for the speci,cation of categorical structures, ,rstly because arrow composition is a partial operation, and secondly because membership predicates over a poset of sorts allow, e.g., the objects to be modeled as a subset of the arrows,
148
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
and the arrows as a subset of the cells. Moreover, the tensor product construction of theories can be conveniently formulated in PMEqtl, and yields a concise de,nition of monoidal double categories. In fact, the tensor product construction works at the syntax level of the theories, combining the conditional sentences (equations and membership assertions) according to a simple scheme. Essentially, if we let CAT and MON be, respectively, the theories of categories and of monoids, then the theory MONCAT of monoidal categories is just the tensor product CAT ⊗ MON MON ⊗ CAT, the theory DCAT of double categories is the tensor product CAT ⊗ CAT and the theory of monoidal double categories is given by any of the tensor products MONCAT ⊗ CAT MON ⊗ DCAT MON ⊗ CAT ⊗ CAT. We refer to [67,16] for more information on the tensor product construction. For dealing with both horizontal and vertical symmetries and their consistent interaction on the two dimensions, the two-dimensional analogous of natural transformations has been presented in [16,18], by introducing the notion of generalized natural transformations between four double functors, in the style of Ehresmann work on hypertransformations [38,39].
2. Auxiliary connectors as tiles From the mathematical viewpoint, the two-dimensional extension of symmetries is completely satisfactory. Similarly, the extension of one-dimensional cartesianity has been discussed extensively in [16,18,11]. But for the connectors we are interested in, the naturality axioms are not required. Therefore, we must exploit some other interpretation of two-dimensional connectors. Informally, we would like: • to ,x suitable categories of observations and con,gurations having not only the same objects, but also the same auxiliary structure, i.e., the same connectors according to the taxonomy in Section 1.1; • to have at disposal all the tiles whose border contains only connectors and no primitive module and that would commute if horizontal and vertical connectors were arrows in the same category; such tiles are called auxiliary tile connectors, dynamic connectors or also two-dimensional connectors; • from the point of view of sequent decorations, we also would like to identify all the auxiliary tile connectors having the same border. Denition 8. A theory of connectors is a pair T = (C; L), where C ⊆ {∇; T; !; ¡} and L ⊆ {1; 2; 3; 5; 6; 7} (any connector used in the laws of L must be present in C). Denition 9. Given a theory of connectors T = (C; L), a T-category of connectors is a symmetric monoidal category with all transformations in C which must respect the coherence axioms plus the axioms in L. We call T-Cat the category whose objects are T-categories and whose arrows are symmetric functors that strictly preserves the additional T-structure. For example, GSCat is ({∇; !}; ∅)-Cat and RMCat can be equivalently de,ned as ({∇; !; T; ¡}; {1; 2; 5; 6; 7})-Cat.
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
x
s
y
t
idy
1t
idy
y
t
1b
b
β
α
a y b z
idz
z
idz
149
z idz z idz z
Fig. 12. The diagonal composition / 3.
Denition 10. Let T = (C; L) be a theory of connectors. A T-tile system is a tile system R whose categories of con,gurations and observations are the free T-categories generated by two signatures H and V (over the same set of sorts S). According to the above de,nition, a process tile system is a (∅; ∅)-tile system. Denition 11. Let T = (C; L) be a theory of connectors and R be a T-tile system. We say that R entails the class PT (R) of T-tile sequents, obtained by a ,nite number of applications of the inference rules for process tile logic, plus any of the following two rules for any connector 5 ∈ C: -auxiliary proof sequents:
x ∈ S∗
x ∈ S∗
5x : 5x → id ∈ PT (R)
5x⊥ : id → 5x ∈ PT (R)
5x id
id
5x
a
For any sequent ∈ PT (R) we write R T . We also write R f s → t to say that the b
a
0at sequent s → t is entailed by R. b
From the “0at” viewpoint, the 5-auxiliary proof sequents are enough for generating all the tiles we are interested in. In fact we have the following lemmata: Lemma 12. Let T = (C; L) be a theory of connectors and let s : x → y be any parallel and sequential compositions of identities, symmetries and connectors in C. Then, s R f s −→ idy for any T-tile system R. idy
Proof. The proof is analogous to the one used in [21] for dynamic closure of arbitrary contexts. The idea is to exploit the diagonal composition / which is de,ned for any tiles and 3 such that (1) their horizontal and vertical targets are identities, and (2) the ,nal output interface of is the initial input interface of 3. The composition / 3 is obtained by completing the tiling with two identities, as illustrated in Fig. 12. In fact, we can proceed inductively on the structure of the arrow s. The base cases are identities, symmetries and constructors, for which the corresponding tiles trivially s1 ⊗s2 exist. If s = s1 ⊗ s2 , then the tile s1 ⊗ s2 −→ id is the parallel composition of the tiles id
150
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
x idx x
idy
s
y
1s
idy
α
s
y
b
1s;b
idx x a z
b w idw
a
z
t
β
idz
1t
z
idz
y
w idw w
t
Fig. 13. Graphical proof of Lemma 14. s ;s
1 2 inductively associated with s1 and s2 . Finally, if s = s1 ; s2 then the tile s1 ; s2 −→ id is
the diagonal composition of the tiles inductively associated with s1 and s2 .
id
Lemma 13. Let T = (C; L) be a theory of connectors and let s : x → y be any parallel and sequential compositions of identities, symmetries and connectors in C. Then, idx s for any T-tile system R. R f id x −→ s
Proof. The proof exploits a second diagonal composition ., which is de,ned between any two tiles and 3 such that (1) their horizontal and vertical sources are identities, and (2) the ,nal output interface of is the initial input interface of 3. For the rest, the proof is analogous to that of Lemma 12 and thus omitted. a
Lemma 14. Let T = (C; L) be a theory of connectors and let s → t be any sequent, b
where s, t, a, and b can be expressed as the parallel and sequential compositions of identities, symmetries and connectors in C, such that s; b = a; t holds in the free a T-category over the empty signature. Then, R f s → t for any T-tile system R. b
Proof. By construction s; b can be seen as a horizontal arrow, and as such, it generates id
x s; b. Since s; b = a; t in the initial algebra, it follows that the an identity tile s; b −→
idw
id
x a; t. Then we can exploit Lemmata 12 and above tile can also be written as s; b −→
idw
idy
a
b
id z
13 to prove the existence of two tiles : idy −→ b and 3 : a −→ id z , which can be composed as in Fig. 13, proving the thesis.
For example, if we select the theory of connectors ({∇; T}; {1; 2; 3}), i.e., the theory id ⊗∇
x of match-share categories, then R f Tx −− −→x Tx ⊗ id x , because Tx ; ∇x = (id x ⊗ ∇x );
∇x
∇
x (Tx ⊗ id x ) by axiom (3). Likewise, R f id x −→ ∇x , because ∇x ; Tx = id x ; id x = id x by
idx
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
151
axiom (1). Note that the e6ect of the ,rst tile is equal to the trigger of the second tile. id ⊗∇
x −→x (Tx ⊗ id x ); Tx , for which it is in fact By horizontal composition, we get R f Tx −−
idx
easy to verify that Tx = (id x ⊗ ∇x ); (Tx ⊗ id x ); Tx (by coherence of T, we know that (Tx ⊗ id x ); Tx = (id x ⊗ Tx ); Tx , but then (id x ⊗ ∇x ); (id x ⊗ Tx ) = id x ⊗ (∇x ; Tx ) = id x ⊗ id x ). Regarding the decorated sequents, we should ,nd an axiomatization of the basic auxiliary sequents which is able to identify exactly all dynamic connectors with identical border. We call this property “coherence of dynamic connectors”. Denition 15. Let T = (C; L) be a theory of connectors and R be a T-tile system. Given an equational theory E on the class PT (R) of T-tile sequents entailed by R, we say that the dynamic connectors of R are coherent under E if E = 3 for any two tiles ; 3 ∈ PT (R) with the same border and built without using the basic tiles of R. Thanks to the diagonal compositions illustrated in the proofs of Lemmata 12 and 13, and to the results in [16,18,11], such an axiomatization can be de,ned by stating: • the axioms of process tile logic (including the axiomatization of horizontal, vertical and parallel compositions and the laws for coherence of symmetries); • the coherence axioms with respect to the two diagonal compositions (stating the coherence of auxiliary transformations); • the axioms in L with respect to the two diagonal compositions (which, together with coherence axioms, state the uniqueness and appropriateness of all combinations of dynamic connectors); • the following two-dimensional coherence axioms for any connector 5 ∈ C: 5x⊥ · 5x = 15x ;
(8)
5x⊥ ∗ 5x = 15x :
(9)
For example, suppose the match-share theory ({∇; T}; {1; 2; 3}) is selected. Then, the coherence axiom ∇x ; %x; x = ∇x generates the axioms: ∇ x / %x;x = ∇x ; ⊥ ⊥ ∇⊥ x . %x;x = ∇x ; id
⊥ %x; y where % ∗ (2y; x · 1%y; x ) : id −→ %x; y . Note that the laws x; y = 2x; y and %x; y = 1 %x; y
1∇x ; 1%x;x = 1∇x ; 1∇x ; 1%x;x = 1∇x hold because of the functoriality of horizontal and vertical identities.
152
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
Similarly, axiom (1) for connectors yields the axioms id x = 1id x ; ∇ x / Tx = 1 ⊥ id x ∇⊥ = 1id x : x . Tx = 1
Finally, the two-dimensional coherence laws for the selected connectors are: ∇⊥ x · ∇x = 1∇x ; ∇x ∇⊥ x ∗ ∇x = 1 ; T⊥ x · Tx = 1Tx ; Tx T⊥ x ∗ Tx = 1 :
Any T-tile logic extends process tile logic with additional connectors (and their coherence axioms). However, any such extension is conservative, in the sense that: (1) any valid theorem of process tile logic is provable in (any) T-tile logic without using additional axioms; and (2) the additional axioms of (any) T-tile logic cannot prove more theorems than process tile logic with respect to the formulas of process tile logic (i.e., two tiles carrying di6erent proofs in process tile logic cannot be identi,ed by T-tile logic). Proposition 16. T-tile logic is a conservative extension of process tile logic for any theory of connectors T. The proof requires the application of simple PMEqtl techniques for specifying the theories of T-tiles and process tiles, then showing that there is an obvious signature morphism from process tiles to T-tiles which induces a forgetful functor U from the category of T-tile models to the category of process tile models. The functor U has a left adjoint, and the unit of the adjunction is conservative, i.e., injective. Proposition 17. Let T be a theory of connectors. With the axiomatization sketched above, dynamic connectors are coherent for any T-tile system R. These results allow us to lift the taxonomy of connectors in Table 1 to the level of dynamic connectors, i.e., to the two-dimensional case. 3. Connectors for concurrency It is nowadays commonly accepted that concurrent processes should be distinguished from nondeterministic sequential processes, especially when dealing with distributed implementations. The most common example is given by the CCS processes P = a:nil | b:nil and Q = a:b:nil + b:a:nil: process P models a concurrent system with two independent sequential components, while Q is a sequential system with a centralized choice point.
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176 a
t1 −→ t1 ∈ T
a
t1 t2 −→ t1 t2 ∈ T
153
a
X −→ t ∈
a
X −→ t ∈ T Fig. 14. Inference rules for T .
Of course, P and Q are bisimilar, and therefore equivalent for what concerns ordinary observations, but they are di6erent when viewed as concurrent systems. Thus, a more precise description of their behaviors should state this di6erence in a formal way. Moreover, according to [58,71], we can distinguish between causality-based (see e.g. [8,33]) and locality-based approaches [9,10,36]: In a causality-based semantics, taking inspiration from Petri nets, the interest concerns the gradual development of each concurrent subcomputation (e.g., which events cause certain events), which is relevant in 0ow analysis; in a locality based approach, the 0avor is more on the (logic) spatial distribution of the system, which is a relevant issue in the implementation. In our metamodel, like in [58], causal and spatial information are dealt with uniformly. Thus, rather than saying either that “two actions happen at the same location” or that “the action a is caused by action b”. We can express that “actions a and c happen at the location l, which has been spawned by the execution of b”. Moreover, we take into account the fact that synchronized communication is represented as an internal action, not observable from the outside environment, and therefore that spawned events or locations must refer to their closer observable antecedents. As announced in the Introduction, we put our metamodel to the test on a simple extension of BPP(1,P) processes, which equips them with (weakly observational) synchronization, and focuses on causality and locality aspects. Denition 18. Let Act = {a; b; : : :} and Const = {X; Y; : : :} be countably in,nite sets of actions and process constants, respectively, where Act is structured with CCS-like V with (V·) an injective function s.t. AV = co-actions, i.e., Act can be partitioned as A ∪ A, V {aV | a ∈ A} and aV = a. Then BPP(1,P) processes are generated by the grammar: t::= |X | t t where is a distinguished (inactive) constant, X ∈ Const, and the operator is the associative and commutative parallel compositions of processes, with unit . Note that associativity, commutativity and unit axioms of parallel composition introduce a structural equivalence on processes. Denition 19. The dynamics of BPP(1,P) systems consists of a ,nite set of rules a in the form X → t for X ∈ Const, a ∈ Act and t any process. All process constants for which no operational rule can be found in are considered equal to the empty process . The set induces an LTS T , which is the least one generated by the inference rules in Fig. 14.
154
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176 a
X −→ t ∈ a
X −→ t ∈ Tws
a
aV
t1 −→ t1 ∈ Tws ; t2 −→ t2 ∈ Tws 9
t1 t2 −→ t1 t2 ∈ Tws
:
t1 −→ t1 ∈ Tws :
t1 t2 −→ t1 t2 ∈ Tws
Fig. 15. Inference rules for Tws .
Note that parallel composition is commutative and thus the symmetric inference rule for parallel composition can be safely omitted. Denition 20. The language WS-BPP(1,P) consists of BPP(1,P) processes with a dynamics , but whose LTS Tws is generated by the rules in Fig. 15, with 9 a distinguished silent action and : ranging over Act ∪ {9}. a
9
a
9
9
Denition 21. We write t ⇒ t if t →∗ t1 → t1 →∗ t for some t1 and t1 , where →∗ denotes any (possibly empty) sequence of 9 moves. Given w = a1 a2 : : : an ∈ Act ∗ we an a2 a1 w t1 ⇒ t2 · · · tn−1 ⇒ t for suitable t1 ; t2 ; : : : ; tn−1 . write t ⇒ t if t ⇒ Then, ordinary observational equivalences can be straightforwardly de,ned for WSprocesses (e.g., trace equivalence or strong and weak bisimilarities). To handle causal and spatial information, we follow a tile-based approach, which gives emphasis to the analogy between the underlying algebraic usage of event names and locations. The building blocks of our approach are the following: (i) Each constant corresponds to a distinct basic con,guration <X = with empty input interface and unary output interface (when no confusion can arise, we shall use the symbol X to denote the con,guration <X =). (ii) Parallel composition is modeled via connectors that go from the involved constants into the same abstract location (viewed as a name). (iii) Each action a corresponds to a distinct basic observation
BPP(1,P)
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
155
. .
. X
. a Syncha
a
[[X → t ]]
a
]]
t ]]
.
]]
ε]]
a-
. .
.
.
. .
. .
Fig. 16. Wire and box tiles for BPP.
place-holder for the otherwise pending reference to the location where X lived. For example, after the application of the rule to <X Y =, the component Y will be attached to the location associated with <=, which is logically di6erent from that of
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
.
Y
.
.
.
.
.
.
.
Y
.
. . .
[[
Y
.
[[ε
Z
.
Z
a
.
.
a
.
.
.
Y
X
.
X
.
156
b
.
.
[[ε
.
.
[[
a
a
.
.
.
W
.
Z
.
b
Fig. 17. <X Y −→ Z Y = on the left and <X Y −→ Z Y −→ Z W = on the right. a
b
with rules X → Z and Y → W . Then, X Y is represented by
If X moves, then the e6ect a can be propagated via the connector exiting from X (which is matched with Y ), while Y stays idle. The step is shown in Fig. 17 (left), a where the place-holder <= produced by <X → Z = can be safely omitted because Y is attached to the same location. Then, if Y moves, the action b happens at a di6erent location than that of Z, see Fig. 17 (right). The e6ect of the two consecutive moves, after some graphical rearrangement of connectors, is in Fig. 18 (left), which is clearly di6erent from the situation where the action b is causally dependent on a (Fig. 18, right). The latter causal dependency can arise e.g. in the system with basic steps a b b a X → Z , Z → , X → Y , and Y → , starting from the con,guration X . (Note that, under the rules above, X is to some extent the BPP representation of a:b:nil + b:a:nil). Hence, <X Y = cannot be bisimilar to <X =. Moreover, in <X Y = the order in which the two moves are performed is not important, thus a commuting diamond is obtained (e.g., X Y and X are not even trace equivalent in our setting). It is worth noting that, by the axioms of total relations, a further dependency arise in the sequential execution of a and b, which is drawn as a dotted line in Fig. 18 (it is implicit, in the sense that
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
.
.
.
.
.
a
b
a
.
.
.
.
157
.
b
.
.
.
.
Fig. 18. Parallel and sequential execution of actions a and b. s
n −→ m a↑ ↑b k −→ m t
Fig. 19. A tile with “reversed” observations.
the two observations, with and without the additional wire, are identi,ed by the laws of connectors). Formally, the ,rst step in our approach consists of ,xing the categories of con,gurations and observations. This amounts to de,ning: (1) the set of sorts; (2) the horizontal signature; (3) the vertical signature; (4) the horizontal and vertical theories of connectors. Denition 22. There is only one sort (for processes). Therefore, operator arities are just natural numbers, and the objects of the categories of con,gurations and observations will be denoted by underlined natural numbers (with n ⊗ m = n + m). The signature for WS-BPP(1,P) con,gurations contains a constant <X = : 0 → 1 for each X ∈ Const with X = . The signature for WS-BPP(1,P) observations contains a unary operator
of s; b = a; t (see Fig. 19). This is necessary for maintaining the correct interpretation of dynamic connectors. At the semantic level, this corresponds to state that con,guration connectors can be observed but not arbitrarily added. We hope the reader will not be confused by this assumption, which does not create any particular problem, and in fact, categorically, it just corresponds to standard duality consideration, taking the opposite
158
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
vertical category. (A less intuitive view is to consider the category of observations as horizontal and the category of con,gurations as the vertical one, e.g., we should rotate clockwise by 90◦ the tile in Fig. 19.) Denition 23 (From processes to con6gurations). The mapping of constants to con,gurations can be extended to processes as below: • <= = ¡1 •
(by de,nition)
= (
(by coherence of T)
= %0;0 ; (
(by naturality of %)
= (
(by coherence of %)
=
(by de,nition):
The proofs for associativity and unit are analogous. Note that any t is mapped to an arrow from 0 to 1. The converse also holds. Proposition 25. Given a con6guration f : 0 → 1, a unique such that
WS-BPP(1,P)
process t exists
Proof. Thanks to the results in [15], it is easy to see that a generic con,guration has the form (id n ⊗ M ); r, where M is the monoidal composition X1 ⊗ · · · ⊗ Xm for suitable not necessarily distinct constants (assuming an arbitrary total order on Const such that Xi 6Xi+1 for i ∈ [1; n−1]), and r : n + m → k is a total relation r ⊆ [1; n+m] × [1; k] such that if Xi = Xj then r(i) 4 r( j), where r(x) = {y | (x; y) ∈ r} and 4 is an arbitrary total order on 2[1; k] . Thus, when n = 0 and k = 1, then r = T1m , where, as a matter of notation, we let Txi+1 = (Tix ⊗ id x ); Tx for i¿0, with T1x = id x and ∇xi+1 = ∇x ; (∇xi ⊗ id x ) for i¿0, with ∇x1 = id x be convenient abbreviations for expressing consecutive matchings and duplications of the object x. By taking t = X1 · · · Xm the hypothesis trivially follows. Uniqueness follows by the fact that each process t is uniquely determined by the multi-set of constants it contains. To ,nd a term-like notation for con,gurations which is closer to processes, we can exploit the above-mentioned normal form representation.
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
Denition 26. Let N be a countably in,nite set of location names. A located state is a term generated by the grammar
159
WS-BPP(1,P)
t::= | X [@] | t t where @ ⊆ N is a nonempty, ,nite set of names and the parallel composition operator is AC1. We denote by n(t) the set of names used in t. Given a ,nite list A of distinct names, a located state t is acceptable in A, written A t, if n(t) ⊆ |A|, where |A| is the set of names in A. If t is acceptable in A and the cardinality of |A| is n, we say that t is n-acceptable. Acceptable located states are taken up to renaming of names in the environment A, letting B(A) B(t) = A t for any injective name substitution B : |A| → N. We shall abbreviate the notation X [{x1 ; : : : ; xn }] by writing X [x1 ; : : : ; xn ]. Proposition 27. The set of n-acceptable the con6gurations from 0 to n.
WS-BPP(1,P)
located states is isomorphic to
Proof. Informally, the environment A of an acceptable located state A t represents the interface of the con,guration (remind that names are not important). Then, the name set @ associated with each constant X expresses the wiring between the location of <X = and the names in the interface. The precise correspondence can be formally stated as mfollows. Given an arbitrary con,guration from 0 to n, we consider its normal form i=1 Xi ; r, with r : m → n representing a total relation r ⊆ [1; m] × [1; n]. We ,x the environment A = [x1 ; : : : ; xn ] and m let the located state associated with i=1 Xi ; r be the acceptable term A X1 [@1 ] · · · Xm [@m ], where @i = {j | (i; j) ∈ r} for any i ∈ [1; m]. For the converse correspondence, given a generic acceptable located state A X1 [@1 ] · · · Xm [@m ], let n be the cardinality of |A|, and let ki ¿0 be the cardinality of @i for i ∈ [1; m]. We denote by Aj the name in the jth position of A. As a matter of notation, let i; j be equal to id1 when Aj ∈ @i , and equal to ¡1 otherwise. Then the conm ,guration with A X1 [@1 ] · · · Xm [@m ] is f = i=1 (Xi ; ∇1ki ); C; Tm n , where m associated n m C = i=1 j=1 i; j . In fact, f can be written as i=1 Xi ; r, where r ⊆ [1; m] × [1; n] is the total relation r = {(i; j) | Aj ∈ @i }. It is easy to verify that the two mappings de,ne a bijective correspondence. We let < = denote the component of the above bijection that maps acceptable located states to con,gurations, and let < =−1 denote its inverse. Denition 28. The underlying process of a located state X1 [@1 ] · · · Xm [@m ] is X1 · · · Xm . For an acceptable located state A t, we denote its underlying process by u(t). Proposition 29. Let A t be an acceptable located state; then
160
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
Proof. The proof is a straightforward application of the axioms in the theory of connectors under consideration. As a matter of notation, for A t acceptable and @ ⊆ A, we de,ne A t[@] by def
def
[@] =
(t[@1 ])[@] = t[@1 ∪ @]
def
(t1 t2 )[@] = t1 [@] t2 [@]:
By choosing the theory Tws we also ,xed one of the parameters of the metamodel proposed in Section 2. The ,nal step of the speci,cation is de,ning the basic tiles of the Tws -tile system for WS-BPP(1,P) processes. To shorten the notation, we let Ea denote the observation ∇1 ; (
a
<X → t= : X
→0
(Ea ⊗id 1 );T1
WS-BPP(1,P)
is denoted by R ws and contains
is considered (remind that (Ea ⊗ id1 ); T1 goes from the ,nal output interface to the initial output interface, because we are considering an opposite vertical category); • for any a ∈ Const, the below synchronization tile Syncha is introduced: (id 1 ⊗Ea ⊗EaV⊗id 1 );(T1 ⊗T1 )
Syncha : id 1 ⊗ id 1 −−−−−−−−−−−−−−→(id 1 ⊗ (T1 ; ∇1 ) ⊗ id 1 ); (T1 ⊗ T1 ) id 1 ⊗id 1
We let {[a]} denote the observation (Ea ⊗ id1 ); T1 associated with a. We have already shown some examples of tile computations. Here we illustrate how the mechanism for e6ect propagation works. In the following examples, we shall a aV b consider the process X Y , with rules X → Z, Y → Z, and Z → X Y . a
Example 31. Suppose we want to apply the tile <X → Z = to the X component in the initial con,guration (X ⊗ Y ); T1 = X ; (id1 ⊗ Y ); T1 . Thus, we must synchronize the a e6ect {[a]} of <X → Z = with the con,guration (id1 ⊗ Y ); T1 . This can be done by exploiting the dynamic connector T ⊗id
1 Prop : T1 −−1−−→ id 1 ⊗ T1
T1
in Fig. 20 (left). This connector exists by Lemma 14, because (T1 ⊗ id1 ); T1 = (id1 ⊗ T1 ); T1 is a (one-dimensional) coherence axiom for matching (we remind that since vertical arrows are directed from bottom to top, the two-dimensional coherence for dynamic connectors requires that the trigger composed with the initial con,guration be equal to the ,nal con,guration followed by the e6ect). Tile Prop can be sequentially pre-composed with 1T1 ⊗ 1Y , and the result can be vertically composed with 1Ea ⊗ 1(id 1 ⊗Y );T1 . The ,nal result = ((1T1 ⊗ 1Y ) ∗ Prop)·
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
.
.
1
Prop .
2
. .
2 .
id1⊗ id1 ⊗Y
3
∆1 Prop id1⊗ ∆1
1λa ⊗1(id1 ⊗Y); λ1
λa ⊗ id1 .
2
1∆1 ⊗1Y ∆1 ⊗id1
∆1
.
id1 ⊗ Y
(id1⊗id1 ⊗Y); ∆1
161
1 ∆1 2 λa⊗ id1 2
Fig. 20. Dynamic connectors for e6ect propagation.
(1Ea ⊗ 1(id 1 ⊗Y );T1 ) is illustrated in Fig. 20 (right). Then, the cell can be used to a coordinate the activity of X , because the e6ect of <X → Z = matches the trigger of , and we have a
<X → Z= ∗ : (X ⊗ Y ); T1
id
→0
(Ea ⊗id 1 );T1
Z ⊗ Y;
because we have (Z ⊗ <= ⊗ Y ); (id1 ⊗ T1 ) = Z ⊗ Y by !1 = <= and coherence of T. Thus, in the ,nal con,guration Z and Y are associated with two distinct locations: the one of Z has been spawned by the action a, while the one of Y is the original one, where also X was allocated. It follows that any subsequent action performed by Z will be causally dependent on action a, because it will be performed in the location spawned by a. The acceptable located state representing Z ⊗ Y is [z; y] Z[z] Y [y]. Example 32. More interestingly, in the con,guration <X Y =, the two subprocesses a aV can concurrently evolve. In fact, the tile <X → Z = ⊗
1 id 1 ⊗ T1 ⊗ id 1 ; Comb: T1 −−1−−→
T31
which is illustrated in Fig. 21 (left). In fact, Comb can be vertically composed with 1Ea ⊗ 1T1 ⊗ 1EaV , yielding the coordinator we were looking for, which is illustrated in Fig. 21 (right). Note that a two-dimensional symmetry %1;1
Sym : id 2 −→%1;1 id 2
is needed for matching the observation {[a]} ⊗ {[a]}, V (because {[a]} V = (EaV ⊗ id1 ); T1 = (EaV ⊗ id1 ); %1;1 ; T1 = %1;1 ; (id1 ⊗ EaV ); T1 by coherence of T and % and by naturality of %). As a ,nal result, we get a tile 3 with e6ect (Ea ⊗ id1 ⊗ EaV ); T13 and ,nal con,guration (Z ⊗ ¡1 ⊗ Z ⊗ ¡1 ); (id1 ⊗ %1;1 ⊗ id1 ); (id1 ⊗ T1 ⊗ id1 ) = (Z ⊗ ¡1 ⊗ ¡1 ⊗ Z); (id1 ⊗ T1 ⊗ id1 ) = Z ⊗ ¡1 ⊗ Z, where the two components Z are attached to the locations spawned by a
162
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
Fig. 21. Dynamic connectors for concurrent propagation of e6ects.
and a, V while ¡1 is a place-holder for the original location, where X and Y were allocated (which is now empty). The located state associated with the ,nal con,guration is [z1 ; x; z2 ] Z[z1 ] Z[z2 ]. It is worth remarking that the useless location x can be cut from the prosecution of the computation via the dynamic connector id
1 id ; Collect : ¡1 −→ ¡1 1 vertically composing 3 with the tile 1Z ⊗ Collect ⊗ 1Z . From the viewpoint of located states, this corresponds to move from [z1 ; x; z2 ] Z[z1 ] Z[z2 ] to [z1 ; z2 ] Z[z1 ] Z[z2 ] (with e6ect id1 ⊗ ¡1 ⊗ id1 ).
As a ,nal example, we show how weak causality is handled by the rule for synchronization. The idea is that 9 actions should not be observed, but that, when synchronizing two actions which happens at two locations ‘1 and ‘2 spawning fresh locations ‘1 and ‘2 , then each process attached to ‘1 or ‘2 should also keep causal links to both ‘1 and ‘2 . This mechanism extends the spatial information from a single location to a set of locations, which are inherited from the (unobservable) synchronized actions. Example 33. The concurrent actions a and a, V executed, respectively, by X and Y , can synchronize via the tile Syncha . To see this, we can vertically compose Syncha with (Sym ⊗ 1id 2 ) ∗ 1r , where r = (id1 ⊗ (T1 ; ∇1 ) ⊗ id1 ); (T1 ⊗ T1 ) is the ,nal con,guration of Syncha , and then pre-compose the resulting tile with the concurrent step a
aV
id
<X → Z = ⊗
con,guration has been simpli,ed by applying twice the coherence axiom (id1 ⊗ ¡1 ); T1 = id1 for eliminating the two place-holders produced by the basic rules. Note that the relation T1 ; ∇1 in the ,nal con,guration expresses the fact that each component Z is attached to both locations in the ,nal output interface, i.e., the ,nal con,guration is the located state [z1 ; z2 ] Z[z1 ; z2 ] Z[z1 ; z2 ].
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
163
Since the global e6ect is id 2 , then no observation must be propagated through the T1 of the initial state, i.e., we can just horizontally compose G with 1T1 , obtaining id
0 (Z ⊗ Z); T1 ; ∇1 ; T1 . But ∇1 ; T1 = id1 by axiom (1) in the the tile H : (X ⊗ Y ); T1 −→
id1
theory of connectors; hence the ,nal con,guration is (Z ⊗ Z); T1 =
Theorem 34. If t ⇒ t , then a con6guration f : 0 → 2 exists such that
0 f. R ws f
{[a]}
The proof easily follows from the following lemmata: a
Lemma 35. If t → t , then a con6guration f : 0 → 2 exists, such that
0 f. R ws f
{[a]} a
Proof. If t → t , then, by a simple inspection of the inference rules for T ws , it must a be the case that t = X s for some constant X and process s such that X → s ∈ and t = s s (let s = if t = X ). Then, by a construction analogous to that employed in Example 31, where this time s plays the role of Y , we can prove that id
0 <s = ⊗ <s= and conclude by taking f = <s = ⊗ <s=, as
{[a]}
esis, and <s s= = (<s = ⊗ <s=); T1 by de,nition. a
Lemma 36. If u(A t) → t , then two natural numbers m and n, two total relations id
0 −−−− −−→ f and r and r and a con6guration f : 0 → m exist, with R ws f
r ;(idn ⊗{[a]});r
The proof is analogous to that of Lemma 35, except that we must ,rst exploit the normal form representation of
id
0 Lemma 37. If t → t , then R ws f
id1
9
Proof. If t → t , then, by a simple inspection of the inference rules for T ws , it must be the case that t = X Y s for suitable constants X; Y and process s such that a aV X → s1 ∈ , Y → s2 ∈ and t = s1 s2 s (let s = if t = X Y ). Then, by a construction analogous to that employed in Example 33, where this time there is an adid
0 <s1 = ⊗ <s2 = ditional s in parallel with X Y , we can ,rst prove that R ws f X ⊗ Y −→
id 2
164
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
and then conclude by composing with the vertical identity of (T1 ⊗ <s=); T1 , since
Lemma 38. If u(A t) → t , then a con6guration f : 0 → m exists, with m the cardiid
0 f and
id m
The proof is analogous to that of Lemma 37, except that we must propagate the e6ect id 2 of the synchronization through a generic relation, but this can be done exploiting dynamic connectors. The result then follows by Proposition 29. Proof of Theorem 34 (sketched). By straightforward induction on n, we prove that Lemmata 37 and 38 can be extended to any ,nite sequence of 9 moves. We arbitrarily a ,x a ,nite sequence of transitions which corresponds to t ⇒ t (there can be more than one), and then we apply: (1) the above result on simulating any sequence of 9 moves (on the 9 transitions pre,xing the execution of a); (2) Lemma 35 to the transition with label a; and (3) again the above result on simulating any sequences of 9 moves (on the 9 transitions post,xing the execution of a). Similarly, we can prove the following result: a
Theorem 39. If u(A t) ⇒ t , then two relations r and r , two natural numbers n id
0 −−−− −−→ f and
r ;(idn ⊗{[a]});r
f; T1m .
For the converse correspondence, note that the concurrent moves of tiles cannot be simulated in one step by the interleaving transition system Tws . Therefore, tile bisimilarity on R ws is ,ner than ordinary (interleaving) bisimilarity on Tws . We ,rst state the complete concurrency of our tile system, and then show that any linearization of a concurrent tile-computation can be simulated by Tws . id
0 Proposition 40 (Complete concurrency). Let R ws f f −→ g with : = : ; (id n ⊗ {[a]});
:
r for some relation r, natural number n and generic observation : . Then, a con6gid
id
(idn ⊗{[a]});r
:
0 0 −→ g and R ws f g −→ g. uration g exists such that R ws f f −−−−−
The functoriality of tensor product allows for selecting any (top-level) action {[a]} out of a generic concurrent execution : (concurrent actions are pushed in : ). The id
0 g, allowing to cut the partial process can then be iterated to the tile R ws f g −→
:
order of observations in the e6ect at any consistent point, hence the name complete concurrency for the above proposition. id
Theorem 41. If R ws f
and con6guration g : 0 → m, then u(t) ⇒ t with
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
.
(β ,{1})
. .
(β,∅) (α,{1})
. .
(α ,∅) (β,∅)
.
. .
(α, ∅)
. .
165
(β,∅) (α,∅)
Fig. 22. Causal trees for :3:nil + 3::nil (left) and :nil | 3:nil (right).
3.1. Tile bisimilarity and causal weak bisimilarity Next we want to prove an interesting correspondence result with (the analogous for processes of) the causal weak bisimilarity of [33], which can be summarized by saying that:
WS-BPP(1,P)
The tile bisimilarity on R ws coincide with the causal weak bisimilarity of Darondeau and Degano de,ned via causal trees [33]. We remind that causal trees are a special kind of synchronization trees, whose labels are pairs action, set of positive numbers such that the second element is a set of relative backward pointers to past events (each positive number in the set counts the number of arcs that separate the ancestor event from the one under consideration). Thus the CCS terms :3:nil + 3::nil and :nil | 3:nil yield the trees in Fig. 22. To de,ne the causal tree semantics of WS-BPP(1,P), we ,rst need to extend the syntax of the calculus for pre,xing processes by the sets of their causes, obtaining the socalled causal processes. Beside parallel composition and inactive process (on which this time we relax AC1 axioms), we introduce a new operator ⇒ to this aim. Hence, a causal process of the form K ⇒ X tells that the actions of X have the set of activating causes K. We let ⇒ distribute over all the operators, and let K1 ⇒ K2 ⇒ t = K1 ∪ K2 ⇒ t. This way, causal processes can always be represented in a form where only constants are pre,xed by causes. As a special case an ordinary process t can be viewed as the causal process ∅ ⇒ t. We denote by K(t) the set of all causes appearing in t. The transition rules for the upgraded calculus must also dynamically update the causal information contained in the states, and it is convenient to introduce two special operations for this task: G(K) increases by one every element of a nonempty set K; while $(H; K) joins the sets H and K only if 1 ∈ K and otherwise returns K. These def operations are trivially extended to causal processes by letting G(K ⇒ X ) = G(K) ⇒ X def and $(H; K ⇒ X ) = $(H; K) ⇒ X and assuming distributivity over parallel composition. The strong causal operational semantics Tsc can then be de,ned as in Fig. 23, by adapting the rules for CCS. We recall that is the set of basic moves for constants. When a generic constant X with activating causes K makes a move a, then the set of causes is observed in the transition label and the causes of the spawned process t are given by {1} (because it depends on the last action executed, i.e., a) and G(K) (because the old relative pointers must now be increased by one to skip the last executed action). When a process t1 performs an asynchronous move, then the causes of any idle process
166
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176 :; K
a
t1 −→ t1 ∈ Tsc
X −→ t ∈ a; K
:; K
K ⇒ X −→ {1} ∪ G(K) ⇒ t ∈ Tsc a; K
t1 t2 −→ t1 G(t2 ) ∈ Tsc :; K
a; VK
t1 −→1 t1 ∈ Tsc ; t2 −→2 t2 ∈ Tsc
t2 −→ t2 ∈ Tsc
9; K ∪K
:; K
1 2 t1 t2 −→ $(G(K2 ); t1 ) $(G(K1 ); t2 ) ∈ Tsc
t1 t2 −→ G(t1 ) t2 ∈ Tsc
Fig. 23. Inference rules for Tsc .
a; K
t −→ t ∈ Tsc
9; K
a; K
t −→ † (t ) ∈ Twc
t −→ t ∈ Tsc
9
t −→ t ∈ Twc Fig. 24. Inference rules for Twc .
t2 in parallel with t1 must be increased by one to skip the action executed by t1 . In the case of synchronization, the causes observed with the invisible action are the union of the causes of the two actions involved in the communication. Moreover, we must add the causes G(K2 ) to the constants in t1 spawned by the move a; K1 , which are precisely characterized by having 1 as cause. Similarly, G(K1 ) must be added to the processes spawned by a; V K2 . The two updates are delegated to the operation $. Note that no inference rule is necessary for generic K ⇒ t with t not a constant, because causes can always be distributed to constants. The weak causal operational semantics Twc is de,ned on the basis of Tsc by the obvious rules in Fig. 24, where † (read :exa) is a special operator distributing over pardef allel composition, such that †(K ⇒ X ) = †(K) ⇒ X , with †(K) returning ∅ if K ⊆ {1}, and {k − 1 | k ∈ K; k¿1} otherwise. Flexa essentially removes references to 9 events from all sets of activating causes. Note that the operational semantics de,ned via causal trees is interleaving: we cannot change the order in which two transitions are executed without changing the set of activating causes in the reached states. 9 We write t ⇒ t if there exists a sequence of n¿0 9-transitions in Twc , leading from a; K
9
a; K
9
t to t . We write t =⇒ t if t1 and t2 exist with t ⇒ t1 −→ t2 ⇒ t .
Denition 42. A symmetric relation ∼w on causal processes is a causal weak bisimulation if for all t1 ; t2 such that t1 ∼w t2 , then whenever & ∈ {9} ∪ {a; K | a ∈ Act; K ⊆ N} & & and t1 exists with t1 → t1 then t2 exists such that t2 ⇒ t2 and t1 ∼w t2 . We denote by w the maximal causal weak bisimulation and call it causal weak bisimilarity. We show that tile bisimilarity and causal weak bisimilarity coincide on WS-BPP(1,P) processes.
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
167
To this aim we ,rst consider a correspondence between con,gurations and causal processes and then extend the correspondence to operational steps of the two approaches. Proposition 43. The structural congruence on causal processes given by associativity, commutativity and unit of parallel composition is a causal weak bisimulation. Proof. It is immediate to show that the AC1 axioms de,ne a strong bisimulation with respect to Tsc and therefore, also a causal weak bisimulation (because Twc is de,ned on top of Tsc ). We show the proof for the commutativity axioms, the other proofs :; K
:; K
are analogous. We need to prove that if t1 t2 −→ t1 t2 , then t2 t1 −→ t2 t1 . If the :; K
transition t1 t2 −→ t1 t2 has been obtained by a left-asynchronous move of t1 , then :; K
t1 −→ t1 and t2 = G(t2 ), but then we can apply the rule for right-asynchronous moves :; K
to t2 t1 to obtain t2 t1 −→ G(t2 ) t1 . Likewise, if the transition has been obtained by a right-asynchronous move of t2 . Instead, if the transition is the result of a synchroa; K a; VK nization between t1 −→1 t1 and t2 −→2 t2 , then : = 9, K = K1 ∪ K2 , t1 = $(G(K2 ); t1 ) and a; VK
t2 = $(G(K1 ); t2 ), thus we can apply the synchronization rule to the premises t2 −→2 t2 VV K a;
9; K
and t1 −→1 t1 to conclude that t2 t1 −→ t2 t1 . We say that a causal process t is closed if K(t) is a possibly empty interval of natural numbers [1; n] for some n¿0. Proposition 43 guarantees that we can take causal processes up to AC1 axioms without colliding against causal weak bisimilarity. This allows us to fully exploit the evident syntactic analogy between located states and closed causal processes (taken up to AC1 axioms) de,ned via the bijection: def
(K1 ⇒ X1 · · · Kn ⇒ Xn ) = A X1 [@1 ] · · · Xn [@n ]; where |A| = {xj | j ∈ K} for K = {1} ∪ G(K1 ∪ · · · ∪ Kn ) and xi precedes xj in the list A whenever i¡j, @i = {xmax(A) } ∪ {xj | j ∈ Ki ). Since the Ki in Ki ⇒ Xi can also be empty, while @i in Xi [@i ] must be nonempty, we are forced to create a ,ctitious initial event xmax(A) , which acts e.g. as the location of all constants with empty set of activating causes. The closure property of the causal process serves for uniquely determining the environment, i.e., to give a bound to the number of names. We are only interested in closed causal process because these are the only one reachable from ordinary processes, as the following results demonstrate: a; K
Lemma 44. If t −→ t ∈ Twc , then K(t ) = {1} ∪ G(K(t)). Proof. Obvious rule induction on the inference rules for Twc . 9
Lemma 45. If t → t ∈ Twc , then K(t ) = K(t). Proof. Obvious rule induction on the inference rules for Twc .
168
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176 &
Proposition 46. If t → t ∈ Twc and t is closed, then also t is closed. Proof. Easy consequence of Lemmata 44 and 45. Lemmata 44 and 45 are also useful in understanding the way in which events correspond to names. In fact, if we regard a cause i as a location xi , then when a new event a is performed, all the existing locations are renamed (i.e. their references are increased by one) and a fresh location is generated which becomes x1 . On the other hand, if a 9 event occurs, then locations are left unchanged, but the constants spawned by the synchronization have now the same set of causes, which is given by the union of the causes of the synchronized processes. Another consequence is that for reasoning on ordinary processes (i.e., causal processes t with K(t) = ∅) it makes no sense to discuss the equivalence between causal processes with di6erent sets of activating causes, as they will never be compared in the bisimulation game, i.e., we can consider a version of causal weak bisimilarity ranked by the set of activating causes: We write t ≈w t for t w t and K(t) = K(t ). Denition 47. For t a closed causal process, we let
id
Proposition 48. If t −→ t ∈ Twc , then R ws f
r : n + 1 → n is the (total) relation {(1; k) | k ∈ K ∪ {n}} ∪ {(i + 1; i) | 16i6n}. Proof. Without loss of generality, we can assume that (1) t = K ⇒ X t1 ; a (2) X → t2 ∈ ; (3) t = {1} ∪ G(K) ⇒ t2 G(t1 ). By (1) we have
id
0 X ⊗ g. r −→ id n+1 , i.e., r can be observed. Thus R ws f 1X ⊗g ∗ r ⊥ :
a
id
0 <X −→ t2 = : X −−−−−−−− −−−−→
(Ea ⊗id 1 );T1
exists, which can be vertically composed with the tile 1
id
1 where ¡⊥ −−− →id 1 1 : ¡1 − ¡1
id
0 is the basic dynamic connector 1 associated with ¡1 . Thus, R ws f 3 = X −→
Ea
1 We recall that we are using a dual version of tiles, where the direction of vertical arrows is reversed, hence the rotation of the border with respect to the notation in De,nition 11.
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
169
The tile 1X ⊗g ∗ r ⊥ can then be vertically composed with 3 ⊗ 1g , yielding id
0 −−−−→
(Ea ⊗id n );r
By (3) it is easy to check that
9
0
idn
By repeated application of Proposition 49 and by the properties of identities, we trivially obtain the following corollary. id
9
0
idn
By Proposition 48 and Corollary 50, we also get Corollary 51. a; K
id
Corollary 51. If t =⇒ t ∈ Twc , then R ws f
r = {(1; k) | k ∈ K ∪ {n}} ∪ {(i + 1; i) | 16i6n}.
Note that the tile observation associated with the move is determined by the rank K(t), by the executed action a and by the set of causes K, which are the criteria on which ≈w is based. We are now ready to prove the correspondence theorem. Theorem 52. Given two ordinary only if t ≈w t .
WS-BPP(1,P)
processes t and t , then
Proof (sketched). Thanks to Propositions 48 and 49, together with Theorem 41, we know that t distinguishes as much as ≈w . It remains to prove that dynamic connectors do not introduce any step that allows one to distinguish otherwise equivalent processes. In fact, dynamic connectors allow to observing part of the state, an operation that cannot be directly performed in Twc . We have three cases to analyze: • The ,rst case concerns the co-discharger id
0 ¡⊥ 1 : ¡1 → id 1 : ¡1
It allows for observing inactive processes, but we have the main assumption that all constants have at least an admissible move, i.e., that is the only inactive processes and cannot be equivalent to any other process unless they are structurally equivalent. Since <= = ¡1 , the tile ¡⊥ 1 creates no problem. id
2 id 2 . It allows for observing that two processes • The second case concerns T1⊥ : T1 −→
T1
have a common cause, but since inactive processes can always be spawned by
170
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
structural equivalence, the information is not important until some action is executed by the two processes. But when an action is executed we are indeed interested in observing the causes. Hence, also T1⊥ creates no problem. id
1 id1 . It allows for observing that a certain process • The third case concerns ∇1⊥ : ∇1 −→
∇1
has two causes, but since new causes are introduced only by the execution of certain events, this information could have been as well retrieved when observing the last action which spawned the process. The tiles ¡ 1 , T1 and ∇1 allow only for moving to con,gurations some information which has already been observed, and therefore cannot a6ect tile bisimilarity.
We emphasize that one of the advantages with respect to [33] is that our approach for weak bisimilarity not only de,nes a concurrent (and causal) abstract semantics, but, thanks to Proposition 40, it also yields a truly concurrent operational machinery, which is analogous to that of Petri nets.
4. Related work Summarizing the results, the combined use of connectors and tile logic allows us: (1) to de,ne a causal and concurrent semantics for WS-BPP(1,P) processes; (2) to express the semantics via two straightforward operational rules, with causal dependencies automatically handled by the theory of (dynamic) connectors; (3) to have at disposal a concurrent operational machine instead of just a denotational model; (4) to recast our case study inside a more general concurrent framework, which is parametric with respect to the theory of connectors, and thus suitable for embedding and comparing di6erent systems, models and logics. Our metamodel, and its instantiation to the case study of WS-BPP(1,P) processes, gives evidence of the analogy between names and events, and provides a uniform framework for both. Moreover, di6erent kind of names can be distinguished, if necessary: it suJces to have many di6erent sorts, one for each name kind. We think that the case study in Section 3 further motivates our approach, illustrating the novelties with respect to other previous results in the literature. In fact, it allows for having, for the ,rst time to our knowledge, at the same time: (a) states with structural axioms aW la CHAM for parallel composition; (b) a concurrent operational semantics. (c) partial orders of observed events (in the style of causal trees); (d) a weak abstract semantics with automatic propagation of causal dependencies due to invisible internal actions; It is also worth noting that these features arise naturally from the choice of dynamic connectors. A comparison with other well-known LTS-based and reduction-based approaches can be sketched as follows: (i) CHAM is apt for structural axioms like associativity, commutativity and identity of parallel composition, but it is less suited for abstract observational semantics;
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
171
(ii) Causal trees and located calculi [33,9] o6er a truly concurrent denotational semantics, but not a concurrent machine (the underlying LTS relies on actions interleaving); (iii) In comparison with other approaches focusing on time–space issues of concurrency in process algebras (e.g., [8] that reconciles three noninterleaving semantics for CCS, respectively, based on permutation equivalence, 0ow event structures and a special kind of Petri nets called 0ow nets), here we de,ne a concurrent operational model, where guarded recursion is dealt with a compact state representation and where 9 actions are invisible; (iv) the extended labels of the LTS for taking care of locations and events are automatically generated by the tile framework, in a systematic way, which is especially convenient for de,ning the weak semantics (where 9 actions disappears, but not their in0uence on the history and distribution of the system). The last point is particularly relevant, because location names are not important (only the links to them matter) and fresh locations can be generated concurrently. As a consequence, we neither need to consider side-conditions and renaming of idle components in the inference rules of the LTS (e.g., for avoiding name clashes), nor to de,ne specialized notions of bisimulation (e.g., where certain moves are not to be simulated because fresh location names are generated that already appear in the other process). Let us now discuss analogies and di6erences with other applications of tiles in the literature. In [40], ad hoc tile systems have been de,ned for located CCS [71] and asynchronous -calculus [54], whose con,gurations and observations are based on gs-monoidal structures. According to the de,nitions given in this paper (cf. Section 2), the tile systems in [40] are just T-tile system, for T the theory of (co)gs-monoidal connectors (i.e., T and ¡), and they can be straightforwardly recast in our metamodel. The application to calculus shows the use of two di6erent kinds of names, one for channel names, and one for the events (analogous to the one used in our case study). Sharing and name passing are then handled by many coordination rules (e.g., twelve ad hoc rules are needed for action propagation), which extensively use connectors for modeling such features. Dynamic connectors allow for a simpler and systematic de,nition of coordination rules. Moreover, the gs-monoidal structure is not suJcient to give a satisfactory account of weak causal semantics, because many-to-many dependencies cannot be expressed (∇ is missing). Our case study encompasses the above limitation by introducing a richer relationallike structure (and a standardization of coordination rules). We emphasize that the tile system in [40] is an instance of our framework, and thus the techniques for name mobility presented there can be easily transferred to and re-used in other models. For example, though we cannot illustrate the issue here in full detail for space limitations, name restriction can be modeled by introducing a suitable constructor M in the signature together with operational rules analogous to those in [40]. Finally, let us mention the work in [19], where a higher-order 0avor of tiles (whose models are cartesian closed double categories) is used to model the synchronous calculus. In that case, name creation and name passing are conveniently handled by the
172
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
higher-order features of tiles, but the cartesian structure imposes naturality axioms on connectors. An interesting issue would be to reconcile the theory of dynamic connectors presented here with monoidal-closedness. 5. Conclusion We have proposed a metamodel for concurrent semantics, where causal and spatial aspects can be suitably analyzed. Our approach can be summarized by the formula connectors + tiles = concurrent causal semantics: The theory of connectors makes the framework parametric with respect to the way in which the components of a distributed system can interact and communicate, i.e., with respect to the network realization. The use of tile logic allows us to extend structural connectors to the semantics in a uniform way. From this originates the terminology dynamic connectors. Connectors and tiles together, allow for “,ne tuning” our metamodel around di6erent issues of interest. The case study of weakly synchronized and distributed BPP(1,P) processes illustrates the main steps of the methodology we are proposing: (1) Fix the signature of con,gurations and the connectors needed for the particular framework we model; (2) Fix the signature of observation, but re-use the same connectors introduced for con,gurations, or at most a closed subset of them; (steps (1) and (2) can be iterated possibly many times for ,nding a common structure of connectors); (3) De,ne the basic tiles of the system but, if necessary, go back to step (1) to change the horizontal and vertical structures to suit the operational rules; (4) Dynamic (two-dimensional) connectors are automatically added depending on the choices at steps (1) and (2). As a result, the system comes automatically equipped with a concurrent abstract semantics, namely tile bisimilarity. Congruence proofs for such equivalence can be either guaranteed by suitable formats for basic tiles, or obtained by slightly re,ning the proof schemes in [45,12,59] (if necessary, we can always resort to the dynamic tile bisimilarity of [21], characterizing the coarsest congruence which is also a tile bisimulation). In particular, the tile decomposition property of [45] implies that tile bisimilarity is a congruence but is often easier to prove, it is format-independent and has been used with success in many cases. Analogous to the auxiliary tiles of [21], dynamic connectors can be conveniently used in graphical proofs (tile pastings) of tile decomposition. Acknowledgements We thank the anonymous referees for the very detailed comments and suggestions, which have helped us in preparing the ,nal version.
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
173
References [1] M. Abadi, A.D. Gordon, A calculus for cryptographic protocols: the spi calculus, Inform. and Comput. 148 (1) (1999) 1–70. [2] S. Abramsky, S. Gay, R. Nagarajan, Interaction categories and the foundations of typed concurrent programming, in: M. Broy (Ed.), Proc. 1994 Marktoberdorf Summer School on Deductive Program Design, Nato ASI Series F, Vol. 152, Springer, Berlin, 1996, pp. 403–442. [3] A. Asperti, N. Busi, Mobile Petri nets, Technical Report UBLCS 96-10, Computer Science Department, University of Bologna, 1996. [4] H.P. Barendregt, M.C.J.D. van Eekelen, J.R.W. Glauert, J.R. Kennaway, M.J. Plasmeijer, M.R. Sleep, Term graph rewriting, in: J.W. de Bakker, A.J. Nijman, P.C. Treleaven (Eds.), Proc. PARLE’87, Parallel Architectures and Languages Europe, Lecture Notes in Computer Science, Vol. 259, Springer, Berlin, 1987, pp. 141–158. [5] J.A. Bergstra, J.W. Klop, Algebra of communicating processes with abstraction, Theoret. Comput. Sci. 37 (1985) 77–121. [6] G. Berry, G. Boudol, The chemical abstract machine, Theoret. Comput. Sci. 96 (1) (1992) 217–248. [7] B. Bloom, S. Istrail, A.R. Meyer, Bisimulation can’t be traced, J. Assoc. Comput. Mach. 42 (1) (1995) 232–268. [8] G. Boudol, I. Castellani, Flow models of distributed computations: three equivalent semantics for CCS Inform. and Comput. 114 (2) (1994) 247–314. [9] G. Boudol, I. Castellani, I. Hennessy, A. Kiehn, Observing localities, Theoret. Comput. Sci. 114 (1993) 31–61. [10] G. Boudol, I. Castellani, I. Hennessy, A. Kiehn, A theory of processes with localities, Formal Aspects Comput. 6 (1994) 165–200. [11] R. Bruni, Tile logic for synchronized rewriting of concurrent systems, Ph.D. Thesis, Computer Science Department, University of Pisa, 1999. [12] R. Bruni, D. de Frutos-Escrig, N. MartYZ-Oliet, U. Montanari, Bisimilarity congruences for open terms and term graphs via tile logic, in: C. Palamidessi (Ed.), Proc. CONCUR 2000, 11th Internat. Conf. on Concurrency Theory, Lecture Notes in Computer Science, Vol. 1877, Springer, Berlin, 2000, pp. 259–274. [13] R. Bruni, F. Gadducci, Some algebraic laws for spans (and their connections with multirelations), in: W. Kahl, D.L. Parnas, G. Schmidt (Eds.), Proc. RelMiS 2001, Relational Methods in Software, Electronic Notes in Theoretical Computer Science, Vol. 44.3, Elsevier Science, Amsterdam, 2001. Also published as Technical Report, Bericht Nr. 2001-02, Fakultat fur Informatik, Universitat der Bundeswehr Munchen. [14] R. Bruni, F. Gadducci, U. Montanari, Normal forms for partitions and relations, in: J.L. Fiadeiro (Ed.), Proc. WADT’98, 13th Workshop on Recent Trends in Algebraic Development Techniques, Lecture Notes in Computer Science, vol. 1589, Springer, Berlin, 1999, pp. 31–47. [15] R. Bruni, F. Gadducci, U. Montanari, Normal forms for algebras of connections, Theoret. Comput. Sci., 2002, to appear. [16] R. Bruni, J. Meseguer, U. Montanari, Process and term tile logic, Technical Report SRI-CSL-98-06, SRI International, 1998. Also Technical Report TR-98-09, Computer Science Department, University of Pisa. [17] R. Bruni, J. Meseguer, U. Montanari, Executable tile speci,cations for process calculi, in: J.-P. Finance (Ed.), Proc. FASE’99, Fundamental Approaches to Software Engineering, Lecture Notes in Computer Science, vol. 1577, Springer, Berlin, 1999, pp. 60–76. [18] R. Bruni, J. Meseguer, U. Montanari, Symmetric monoidal and cartesian double categories as a semantic framework for tile logic, Math. Struct. Comput. Sci. 12 (2002) 53–90. [19] R. Bruni, U. Montanari, Cartesian closed double categories, their lambda-notation, and the pi-calculus, in: Proc. LICS’99, 14th Annu. IEEE Symp. on Logic in Computer Science, IEEE Computer Society Press, Silver Spring, MD, 1999, pp. 246 –265. [20] R. Bruni, U. Montanari, Zero-safe nets: Comparing the collective and individual token approaches, Inform. and Comput. 156 (1–2) (2000) 46–89. [21] R. Bruni, U. Montanari, V. Sassone, Open ended systems, dynamic bisimulation and tile logic, in: J. van Leeuwen, O. Watanabe, M. Hagiya, P.D. Mosses, T. Ito (Eds.), Proc. IFIP TCS 2000, IFIP
174
[22]
[23] [24] [25]
[26] [27] [28] [29]
[30] [31]
[32]
[33]
[34] [35] [36]
[37]
[38] [39] [40] [41]
[42]
[43]
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176 Internat. Conf. on Theoretical Computer Science, Lecture Notes in Computer Science, vol. 1872, Springer, Berlin, 2000, pp. 440–456. M. Buscemi, V. Sassone, High-level Petri nets as type theories in the Join calculus, in: F. Honsell, M. Miculan (Eds.), Proc. FoSSaCS 2001, Foundations of Software Science and Computation Structures, Lecture Notes in Computer Science, Vol. 2030, Springer, Berlin, 2001, pp. 104–120. A. Carboni, S. Kasangian, R.H. Street, Bicategories of spans and relations, J. Pure Appl. Algebra 33 (1984) 259–267. A. Carboni, R.F.C. Walters, Cartesian bicategories I, J. Pure Appl. Algebra 49 (1987) 11–32. L. Cardelli, A.D. Gordon, Mobile ambients, in: M. Nivat (Ed.), Proc. FoSSaCS’98, Foundations of Software Science and Computational Structures, Lecture Notes in Computer Science, Vol. 1378, Springer, Berlin, 1998, pp. 140–155. V.E. Cazanescu, G. Stefanescu, Towards a new algebraic foundation of 0owchart scheme theory, Fund. Inform. 13 (1990) 171–210. V.E. Cazanescu, G. Stefanescu, Classes of ,nite relations as initial abstract data types I, Discrete Math. 90 (1991) 233–265. M. Clavel, F. DurYan, S. Eker, N. MartYZ-Oliet, J. Meseguer, J. Quesada, Maude: Speci,cation and programming in rewriting logic. SRI International, 1999. Available at http://maude.csl.sri.com/manual. A. Corradini, F. Gadducci, A 2-categorical presentation of term graph rewriting, in: E. Moggi, G. Rosolini (Eds.), Proc. CTCS’97, Category Theory and Computer Science, Lecture Notes in Computer Science, Vol. 1290, Springer, Berlin, 1997, pp. 87–105. A. Corradini, F. Gadducci, An algebraic presentation of term graphs, via gs-monoidal categories, Appl. Categorical Struct. 7 (1999) 299–331. A. Corradini, F. Gadducci, Functorial semantics for multi-algebras, in: J.L. Fiadeiro (Ed.), Proc. WADT’98, Recent Trends in Algebraic Development Techniques, Lecture Notes in Computer Science, Vol. 1589, Springer, Berlin, 1999, pp. 78–90. A. Corradini, R. Heckel, U. Montanari, Compositional SOS and beyond: a coalgebraic view of open systems, Technical Report TR-01-01, Computer Science Department, University of Pisa, 2001. Theoret. Comput. Sci., to appear. P. Darondeau, P. Degano, Causal trees, in: G. Ausiello, M. Dezani-Ciancaglini, S. Ronchi Della Rocca (Eds.), Proceedings of ICALP’89, 16th International Colloquium on Automata, Languages and Programming, Lecture Notes in Computer Science, Vol. 372, Springer, Berlin, 1989, pp. 234 –248. P. Darondeau, P. Degano, Re,nement of actions in event structures and causal trees, Theoret. Comput. Sci. 118 (1993) 21–48. R. De Simone, Higher level synchronizing devices in MEIJE-SCCS, Theoret. Comput. Sci. 37 (1985) 245–267. P. Degano, C. Priami, Proved trees, in: W. Kuich (Ed.), Proceedings of ICALP’92, 19th International Colloquium on Automata, Languages and Programming, Lecture Notes in Computer Science, Vol. 623, Springer, Berlin, 1992, pp. 629 – 640. R. Diaconescu, K. Futatsugi, CafeOBJ Report: The language, proof techniques, and methodologies for object-oriented algebraic speci,cation, AMAST Series in Computing, Vol. 6, World Scienti,c, Singapore, 1998. Y E. Ehresmann, CatYegories structurWees: I–II, Ann. Ecol. Norm. Sup. 80 (1963) 349–426. E. Ehresmann, CatYegories structurWees: III, Cahiers Topologie GYeom. Di6Yerentielle 5 (1963). G.L. Ferrari, U. Montanari, Tile formats for located and mobile systems, Inform. and Comput. 156 (1–2) (2000) 173–235. G.L. Ferrari, U. Montanari, M. Mowbray, Causal streams: Tracing causality in distributed systems (extended abstract), in: E. Best, G. Rozenberg (Eds.), Proc. 3rd Workshop on Concurrency and Compositionality, 1991, pp. 99 –108. Hildesheimer Informatik-Bericht 6=91. C. Fournet, G. Gonthier, J.-J. LYevy, L. Maranget, D. RYemy, A calculus of mobile agents, in: U. Montanari, V. Sassone (Ed.), Proc. CONCUR’96, 7th Internat. Conf. on Concurrency Theory, Lecture Notes in Computer Science, Vol. 1119, Springer, Berlin, 1996, pp. 406–421. T. Fox, Coalgebras and cartesian categories, Comm. Algebra 4 (1976) 665–667.
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
175
[44] F. Gadducci, R. Heckel, M. LlabrYes, A bi-categorical axiomatisation of concurrent graph rewriting, in: M. Hofmann, G. Rosolini, D. Pavlovic (Eds.), Proc. CTCS’99, 8th Category Theory and Computer Science, Electronic Notes in Theoretical Computer Science, Vol. 29, Elsevier Science, Amsterdam, 1999. [45] F. Gadducci, U. Montanari, The tile model, in: G. Plotkin, C. Stirling, M. Tofte (Eds.), Proof, Language and Interaction: Essays in Honour of Robin Milner, MIT Press, Cambridge, MA, 2000. Also Technical Report TR-27=96, Dipartimento di Informatica, UniversitWa di Pisa, 1996. [46] F. Gadducci, U. Montanari, Comparing logics for rewriting: Rewriting logic, action calculi and tile logic, Theoret. Comput. Sci., 2002, to appear. [47] P. Gardner, Closed action calculi, Theoret. Comput. Sci. 228 (1–2) (1999) 77–103. [48] R.J. van Glabbeek, G.D. Plotkin, Con,guration structures, in: D. Kozen (Ed.), Proc. LICS’95, 10th Annu. IEEE Symp. on Logics in Computer Science, IEEE Computer Society Press, Silver Spring, MD, 1995, pp. 199–209. [49] J. Goguen, G. Malcolm, Algebraic Semantics of Imperative Programs, MIT Press, Cambridge, MA, 1997. [50] J.F. Groote, F. Vaandrager, Structured operational semantics and bisimulation as a congruence, Inform. and Comput. 100 (1992) 202–260. [51] M. Hasegawa, Recursion from cyclic sharing: traced monoidal categories and models of cyclic lambda-calculus, in: Ph. de Groote, R. Hindly (Eds.), Proc. TLCA’97, Typed Lambda Calculi and Applications, Lecture Notes in Computer Science, Vol. 1210, Springer, Berlin, 1997, pp. 196–213. [52] H.-J. Hoenke, On partial algebras, in: B. CsYakYany, E. Fried, E.T. Schmidt (Eds.), Universal Algebra, Colloquia Mathematica Societatis JYanos Bolyai, Vol. 29, North-Holland, Amsterdam, 1977, pp. 373–412. [53] K. Honda, Elementary structures in process theory (1): sets with renaming, Math. Struct. Comput. Sci. 10 (5) (2000) 617–663. [54] K. Honda, M. Tokoro, An object calculus for asynchronous communication, in: P. America (Ed.), Proc. ECOOP’91, 6th European Conf. on Object-Oriented Programming, Lecture Notes in Computer Science, Vol. 512, Springer, Berlin, 1991, pp. 1–20. [55] A.S.A. Je6rey, Premonoidal categories and a graphical view of programs, 1998, On-line material available from http://klee.cs.depaul.edu/premon/. [56] P. Katis, N. Sabadini, R.F.C. Walters, Bicategories of processes, J. Pure Appl. Algebra 115 (1997) 141–178. [57] P. Katis, N. Sabadini, R.F.C. Walters, SPAN(Graph): a categorical algebra of transition systems, in: M. Johnson (Ed.), Proc. AMAST’97, 5th Internat. Conf. on Algebraic Methodology and Software Technology, Lecture Notes in Computer Science, Vol. 1349, Springer, Berlin, 1997, pp. 307–321. [58] A. Kiehn, Comparing locality and causality based equivalences, Acta Inform. 31 (1994) 697–718. [59] B. K]onig, U. Montanari, Observational equivalence for synchronized graph rewriting with mobility, in: Proc. TACS’01, 4th Internat. Symp. on Theoretical Aspects of Computer Software, Lecture Notes in Computer Science, Vol. 2215, Springer, Berlin, 2001, pp. 145–164. [60] Y. Lafont, Interaction combinators, Inform. and Comput. 137 (1) (1997) 69–101. [61] K.G. Larsen, L. Xinxin, Compositionality through an operational semantics of contexts, in: M.S. Paterson (Ed.), Proc. ICALP’90, 17th Internat. Colloq. on Automata, Languages and Programming, Lecture Notes in Computer Science, Vol. 443, Springer, Berlin, 1990, pp. 526–539. [62] F.W. Lawvere, Functorial semantics of algebraic theories, Proc. Nat. Acad. Sci. 50 (1963) 869–872. [63] D. Lugiez, Ph. Schnoebelen, The regular viewpoint on PA-processes, in: Proc. INFINITY’98, 3rd Internat. Workshop on Veri,cation of In,nite State Systems, 1998, pp. 27– 43. [64] R. Mayr, Process rewrite systems, Inform. and Comput. 156 (1–2) (2000) 264–286. [65] J. Meseguer, Conditional rewriting logic as a uni,ed model of concurrency, Theoret. Comput. Sci. 96 (1992) 73–155. [66] J. Meseguer, Membership algebra as a logical framework for equational speci,cation, in: F. Parisi-Presicce (Ed.), Proc. WADT’97, 12th Workshop on Recent Trends in Algebraic Development Techniques, Lecture Notes in Computer Science, Vol. 1376, Springer, Berlin, 1998, pp. 18–61. [67] J. Meseguer, U. Montanari, Mapping tile logic into rewriting logic, in: F. Parisi-Presicce (Ed.), Proc. WADT’97, 12th Workshop on Recent Trends in Algebraic Development Techniques, Lecture Notes in Computer Science, vol. 1376, Springer, Berlin, 1998, pp. 62–91.
176
R. Bruni, U. Montanari / Theoretical Computer Science 281 (2002) 131 – 176
[68] R. Milner, Calculi for interaction, Acta Inform. 33 (8) (1996) 707–737. [69] R. Milner, J. Parrow, J. Walker, A calculus of mobile processes, I and II, Inform. and Comput. 100 (1) (1992) 1– 40,41–77 [70] U. Montanari, C. Talcott, Can actors and -agents live together? in: Proc. HOOTS’98, 2nd Workshop on Higher Order Operational Techniques in Semantics, Electronic Notes in Theoretical Comput. Sci., vol. 10. Elsevier Science, Amsterdam, 1998. [71] U. Montanari, D. Yankelevich, Location equivalence in a parametric setting, Theoret. Comput. Sci. 149 (1995) 299–332. [72] M. Pfender, Universal algebra in s-monoidal categories, Algebra Berichte 20, Department of Mathematics, University of Munich, 1974. [73] J. Power, E. Robinson, Premonoidal categories and notions of computation, Math. Struct. Comput. Sci. 7 (1998) 453–468. [74] Protheo Team, The ELAN home page, 2001, www page http://elan.loria.fr. [75] A. Rensink, Bisimilarity of open terms, Inform. and Comput. 156 (1–2) (2000) 345–385. [76] E. Robinson, G. Rosolini, Categories of partial maps, Inform. and Comput. 79 (1988) 95–130. [77] D. Sangiorgi, Expressing mobility in process algebras: ,rst-order and higher-order paradigms, Ph.D. Thesis, LFCS, University of Edinburgh, 1993. CST-99-93 (also published as ECS-LFCS-93-266). [78] G. Stefanescu, Network Algebra, Discrete Mathematics and Theoretical Computer Science, Springer, Berlin, 2000.
Theoretical Computer Science 281 (2002) 177 – 206
www.elsevier.com/locate/tcs
The evaluation of rst-order substitution is monadic second-order compatible Bruno Courcellea; ∗ , Teodor Knapikb a LaBRI
(CNRS laboratory 5800), Universite Bordeaux 1, 351 Cours de la Liberation, 33405 Talence Cedex, France b ERMIT, Universit e de la Reunion, BP 7151, 97715 Saint Denis Messageries, Cedex 9, La Reunion, France
Abstract We denote rst-order substitutions of nite and in nite terms by function symbols indexed by the sequences of rst-order variables to which substitutions are made. We consider the evaluation mapping from in nite terms to in nite terms that evaluates these substitution operations. This mapping may perform in nitely many nested substitutions, so that a term which has the structure of an in nite string can be transformed into one isomorphic to an in nite binary tree. We prove that this mapping is monadic second-order compatible which means that a monadic second-order formula expressing a property of the output term produced by the evaluation mapping can be translated into a monadic second-order formula expressing this property over the input term. This implies that, deciding the monadic second-order theory of the output term reduces to deciding that of the input term. As an application, we obtain another proof that the monadic second-order properties of the algebraic trees, which represent the behaviours of recursive applicative program schemes, are decidable. This proof extends to hyperalgebraic trees. These in nite trees correspond to certain recursive program schemes with functional parameters of arbitrary high c 2002 Elsevier Science B.V. All rights reserved. type. Keywords: Monadic second-order logic; First-order substitution; Algebraic tree; Hyperalgebraic tree; Decidability of logical theories
∗
Corresponding author. E-mail addresses: [email protected] (B. Courcelle), [email protected] (T. Knapik). URLs: http://www.labri.fr/∼courcell, http://www.univ-reunion.fr/∼knapik
c 2002 Elsevier Science B.V. All rights reserved. 0304-3975/02/$ - see front matter PII: S 0 3 0 4 - 3 9 7 5 ( 0 2 ) 0 0 0 1 2 - 9
178
B. Courcelle, T. Knapik / Theoretical Computer Science 281 (2002) 177 – 206
1. Introduction For investigating the recursive applicative program schemes considered in the 1970s by Nivat and others [11,12,17,18] (see [5] for a survey), it is useful to associate with every such a scheme an in nite term that represents its computations in all semantical domains. Useful informations about a scheme can be obtained from the corresponding tree and used, for instance, for rewriting the scheme in a simpler or in a standard way [17]. It is thus useful to know which properties of these terms (called algebraic trees in the above quoted works) are decidable. A fundamental theorem by Rabin [20] (see [21]) states that the properties expressible in monadic second-order logic (MS logic in short) are decidable over regular trees, a proper subclass of that of algebraic trees. Monadic second-order logic is quite powerful (it subsumes temporal logics) but regular trees are insuCcient to represent computations of recursive applicative program schemes. However, the monadic second-order properties of algebraic trees are decidable [8]. We give a new proof of this result which, furthermore, extends to the hyperalgebraic trees that correspond to certain higher-level program schemes, with parameters of function and functional types, already considered by Damm [15]. A rst result about the decidability of the MS theory of hyperalgebraic trees is given in [19] where, so called safe applicative schemes of level 2 are considered. In these schemes procedure names carry functional parameters in addition to individual ones but, according to the safety restriction, a parameter of the basic type should not occur within a functional argument of a procedure call. In an essential way, the proof of [19] uses paths in -graphs. The latter are borrowed form the geometry of interactions [1] and the theory of optimal reductions [2]. The present paper is independent of these -calculus related theories. We develop several tools for the MS logic of higher-level trees. Our rst tool is a signature of graph operations studied by Courcelle, Olariu, Engelfriet and others [10,16,6,9,13]. We use operations which allow to add edges to a vertex labelled graph, from every vertex labelled by, say, a to every vertex labelled by, say, b. Other operations rename labels and a binary operation builds the disjoint union of two labelled graphs. Using these operations, graphs are generated from constants, each of which represents a single labelled vertex. In such a way, a graph may be represented by a nite or in nite term over the corresponding signature of graph operations. The set of such terms is organized into a continuous algebra and the unique continuous morphism from this algebra into the algebra of graphs is called the value morphism. The graph represented by the term is the image of the term under the value morphism. Our rst result shows that this value morphism is a monadic second-order transduction (an MS transduction in short). MS transductions are transformations of logical structures speci ed in MS logic; see [7,9]. This implies that the value morphism preserves the decidability of the MS theory of the structures to which it is applied. Hence the MS theory of a graph de ned by an in nite regular term is decidable. Our second main tool is an explicit operation of rst-order substitution of terms. This operation speci es the variables to which substitutions are made. The arguments are thus: the term on which the substitution acts and the terms which are substituted. We show that the evaluation of substitutions is an MS-compatible operation.
B. Courcelle, T. Knapik / Theoretical Computer Science 281 (2002) 177 – 206
179
A transformation of structures f is MS-compatible if for every MS formula ’, one can eGectively construct an MS formula such that for every structure S; S satises iG f(S) satis es ’. Every MS-transduction is MS compatible, but some MScompatible mappings, like the unfolding of a graph into a tree (by a result of [14], see Theorem 2.11), are not MS transductions. Our proof uses in a crucial way the MS-compatibility of unfolding. We also consider second-order substitutions in the context of recursive applicative program schemes. By reducing second-order substitutions to rst-order ones, we reduce the functionality of the types of the variables in recursive de nitions. In such a way, we establish that every algebraic tree may be obtained from a regular tree with rst-order substitution operators by evaluating these substitution operators (a result known from [15]). This gives another proof of the decidability of the MS theory of every algebraic tree. Since the evaluation of rst-order substitutions is MS-compatible, by evaluating them on algebraic trees, we get more complex trees with decidable MS theories. This process may be iterated. We obtain that each tree in the strict hierarchy de ned by Damm in [15] has a decidable MS theory. It is not clear yet whether these trees represent all lambda-schemes, i.e., all systems of typed mutually recursive de nitions using lambdaabstraction in the right-hand sides of equations.
2. Graphs, terms, monadic second-order logic: basic denitions In Sections 2.1–2.5, we review from previous articles de nitions and notation concerning relational structures and MS logic, nite and in nite terms, graphs and graph operations. In Section 2.5 we prove that the value mapping associating a graph to an innite term is an MS-transduction, hence is MS-compatible. In Section 2.6 we introduce notation for new graph operations derived from those of Section 2.5. In Section 2.7 we review graph unfolding. 2.1. Structures and monadic second-order logic We let R be a nite set of relation symbols, each of them, say r, being given with an arity (r) in N+ . We denote by S(R) the set of nite or countable R-structures, i.e., of tuples of the form S = DS ; (rS )r∈R where rS ⊆DS (r) for r ∈R. For two structures S and S in S(R), we write S ⊆S (read S is included in S ) if DS ⊆DS , and rS ⊆rS for each r in R. We recall that monadic second-order logic (MS logic for short) is rst-order logic augmented with (uppercase) variables denoting subsets of the domain of the considered structure, and new atomic formulas of the form x ∈X expressing the membership of x in a set X . We denote by MS(R; X) the set of MS formulas over R with free variables in X (the set of all individual and set variables.) A property of structures (or of elements and=or of sets of elements of a structure) is MS-de:nable if it can be expressed by an MS formula.
180
B. Courcelle, T. Knapik / Theoretical Computer Science 281 (2002) 177 – 206
We denote by S ≡S the existence of an isomorphism between two structures S and S . If L; L ⊆S(R), we write L≡L if every structure of L is isomorphic to a structure in L and vice-versa.
2.1.1. MS-transductions A transduction of structures is a multivalued mapping: S(R) → S(R ), formally handled as a mapping f : S(R) → ˝(S(R )) such that S ≡S implies f(S) ≡f(S ), where ˝(−) denotes a powerset operation. We say that f as above is MS-compatible [14] if there exists a total recursive mapping f # : MS(R ; ∅) → MS(R; ∅) such that S |= f # (’) iG S |= ’ for some S ∈f(S). We call f # (’) the backwards translation of ’ relative to f. Let L ⊆S(R). We say that a transduction f : S(R) →S(R ) is deterministic on L if for every S ∈L; f(S) is not empty and its elements are pairwise isomorphic. We now consider t