Z -Toolkit Z specification language is based on formal system: –Propositional and predicate calculus –Set theory –Relations and –Functions Thus Z offers a set of facilities to include (or express) these concepts ---- we call the set of facilities the Z toolkit.

Numbers and Operations in Z Z - language has 3 built-in number types –N : natural numbers (e.g. 0,1,2, , ) –N 1 : positive integers (e.g. 1,2,3, - - -, ) –Int : integers (e.g , -2,-1,0,1,2, - - -, ) Axiomatically expressed : (let IP represent power set) for positive integers for positive integers N 1 : IP N (“type” declaration) N 1 : IP N (“type” declaration) N 1 = N \ {0} (relation definition) N 1 = N \ {0} (relation definition) for natural numbers for natural numbers N : IP Int N : IP Int N = Int \ { - - -, -4, -3, -2, -1} N = Int \ { - - -, -4, -3, -2, -1} Rick ?

Numbers and Operations in Z Numerical operators –Defined as functions may use “lambda” notation –Binary operators defined with underscores on either side e.g. _ op _ e.g. _ op _ –Addition operator, +, (example) _ + _ : N x N N should be included in the signature part of schema _ + _ : N x N N should be included in the signature part of schema _ + _ = ג m,n : N succ n m in the predicate part of the schema Or m + n = succ n m in the predicate part of schema _ + _ : N x N N _ + _ : N x N N m + n = succ n m (where succ is successor ) m + n = succ n m (where succ is successor ) total function

Numbers and Operations in Z Let’s look at the great than or equal, =<, operator over N. _ = N (note : is a relation) _ = N (note : is a relation) _ =< _ = succ* (reflexive transitive closure of succ function) _ =< _ = succ* (reflexive transitive closure of succ function) succ* = succ 0 U succ 1 U succ 2 U succ* = succ 0 U succ 1 U succ 2 U succ 0 = id N = {(0,0), (1,1), } succ 0 = id N = {(0,0), (1,1), } succ 1 = { (0,1), (1,2), (2,3), } succ 1 = { (0,1), (1,2), (2,3), } succ 2 = { (0,2), (1,3), (2,4), } succ 2 = { (0,2), (1,3), (2,4), } succ 3 = { (0,3), (1,4), (2,5), } succ 3 = { (0,3), (1,4), (2,5), } etc. etc. So, succ* contains all the pairs that satisfy the =< relation The operator =< is thus defined in terms of a relation Look at 2 =< 5 as an example; now look at above predicate. should _ =< _ be “equal to” or is an “element of” succ* ? should _ =< _ be “equal to” or is an “element of” succ* ?

Sets and Operators on Sets in Z A Generic Definition is a definition that applies to sets of any type. –In schema representation: use [ ] use [ ] use double line,, on the top use double line,, on the top e.g. (union, difference, intersection ) e.g. (union, difference, intersection ) [ T ] [ T ] _ U _, _ \ _, _ _ : IP T x IP T IP T _ U _, _ \ _, _ _ : IP T x IP T IP T s1, s2 : IP T s1, s2 : IP T s1 U s2 = { x : T I x s1 \/ x s2 } s1 U s2 = { x : T I x s1 \/ x s2 } s1 \ s2 = { x : T I x s1 /\ x s2 } s1 \ s2 = { x : T I x s1 /\ x s2 } s1 s2 = { x : T I x s1 /\ x s2 } s1 s2 = { x : T I x s1 /\ x s2 }

“Inventing” an Operator Modified Example 9.1 in text: S1 and S2 be two sets. –Specify a SCARD operator that returns the cardinality of the set S1\S2. [ T ] [ T ] _ SCARD _ : IP T x IP T N _ SCARD _ : IP T x IP T N \/ S1, S2 : IP T S1 SCARD S2 = # (S1\S2) \/ S1, S2 : IP T S1 SCARD S2 = # (S1\S2)

More Sets and Operators on Sets in Z Subsets and proper subsets may be defined similarly as with unions and intersections, except subsets are defined as a “relation” between power sets, not a function. Generalized union and generalized intersection is defined as follows: [ S] [ S] U _, _ : IP ( IP S) IP S U _, _ : IP ( IP S) IP S \/ A : IP S ( IP S ) \/ A : IP S ( IP S ) U A = { x : S I a A x a } U A = { x : S I a A x a } A = { x : S I a A x a } A = { x : S I a A x a } So, for S = {1,2,3}, IP S = { { }, {1}, {2}, {3}, {1,2}, {1,3}, {2,3}, {1,2,3} }. And { {2,3}, {1,2,3} } = {2,3}

Relations in Z A Relation in Z between two sets, S1 and S2, may be expressed as S1 S2 in the signature part of the schema. So, a relation would be R1 : S1 S2 Consider the composition operator, ;, defined generically [ T1, T2, T3 ] [ T1, T2, T3 ] _ ; _ : [(T1 T2) x (T2 T3)] (T1 T3) _ ; _ : [(T1 T2) x (T2 T3)] (T1 T3) R1 ; R2 = { t1: T1, t3 : T3 I t2: T2 R1 ; R2 = { t1: T1, t3 : T3 I t2: T2 (t1, t2) R1 /\ (t2, t3) R2 } (t1, t2) R1 /\ (t2, t3) R2 } R1 and R1 needs to be defined in Signature part?

Relations in Z Restrictions on domain and range of relations in Z [ T!, T2 ] [ T!, T2 ] _ _ : [ IP T1 x (T1 T2)] (T1 T2) _ _ : [ IP T1 x (T1 T2)] (T1 T2) _ _ : [(T1 T2 ) x IP T2] (T1 T2) _ _ : [(T1 T2 ) x IP T2] (T1 T2) \/ S : IP T1, R : T1 T2 \/ S : IP T1, R : T1 T2 S R = { t1 : T1, t2 :T2 I t1 S /\ (t1,t2) R (t1,t2) } S R = { t1 : T1, t2 :T2 I t1 S /\ (t1,t2) R (t1,t2) } \/ R : T1 T2, S : IP T2 \/ R : T1 T2, S : IP T2 R S = { t1: T1, t2 : T2 I (t1,t2) R /\ t2 S (t1,t2) } R S = { t1: T1, t2 : T2 I (t1,t2) R /\ t2 S (t1,t2) }

Relations in Z The “image” operator, where the image of a Relation restricted to the set S as the domain. [ T1, T2 ] [ T1, T2 ] _ ( _ ) : ( T1 T2) x IP T1 IP T2 _ ( _ ) : ( T1 T2) x IP T1 IP T2 \/ R : T1 T2, S : IP T1 \/ R : T1 T2, S : IP T1 R ( S ) = { t1: T1, t2 : T2 I t1 S /\ (t1,t2) R t2} R ( S ) = { t1: T1, t2 : T2 I t1 S /\ (t1,t2) R t2}

Functions in Z Since functions are just special relations, all the previous operators for sets and relations can be used Example with the “override” operator, – Recall that given two relations R and S each, over T1 x T2, R S = (dom S R) U S = [ (T1 \ dom S) R] U S R S = (dom S R) U S = [ (T1 \ dom S) R] U S [ T1, T2 ] [ T1, T2 ] _ _ : (T1 T2) x ( T1 T2) (T1 T2) _ _ : (T1 T2) x ( T1 T2) (T1 T2) \/ f, g : (T1 T2) \/ f, g : (T1 T2) f g = { {dom g} f } U g } f g = { {dom g} f } U g }

Sequences in Z There are 3 types of sequences in Z – a) a finite sequence ( note: most practical systems are finite) seq T = { f : N 1 T I dom f = 1, , #f }, where #f is the cardinality of sequence f. seq T = { f : N 1 T I dom f = 1, , #f }, where #f is the cardinality of sequence f. – b) non-empty finite sequence non-e-seq T = { f : seq T I #f >0 } non-e-seq T = { f : seq T I #f >0 } – c) injective sequence (sequence with no repetition) inj_seq T = { f: N 1 T I dom f = 1, - - -, #f } inj_seq T = { f: N 1 T I dom f = 1, - - -, #f } = seq T (N 1 T) = seq T (N 1 T) –Example : file_Q file_Q inQ, OutQ : seq Files inQ, OutQ : seq Files # inQ = #OutQ # inQ = #OutQ

Concatenaton of sequences in Z Two sequences may be concatenatec or a sequence and a single element may be concatenated. example”: [ T ] [ T ] _ Con _ : seq T x seq T seq T _ Con _ : seq T x seq T seq T \/ s1, s2 : seq T \/ s1, s2 : seq T s1 Con s2 = s1 U { i : dom s2 ( i + #s1, s2 i ) } s1 Con s2 = s1 U { i : dom s2 ( i + #s1, s2 i ) } S2 i represents the ith elements of seq, s2.