Extending CSP with tests for availability

Transcription

1 Communicting rocess Architectures 2009 eter Welch, Hermn Roebbers nd Tobe Announced (Eds.) IOS ress, c 2009 The uthors nd IOS ress. All rights reserved. 1 Extending CS with tests for vilbility Gvin Lowe Oxford University Computing Lbortory, Wolfson uilding, rks Rod, Oxford, OX1 3QD, UK; e-milgvin.lowe@comlb.ox.c.uk Abstrct. We consider the lnguge of CS extended with construct tht llows processes to test whether prticulr event is vilble (without ctully performing the event). We present n opertionl semntics for this lnguge, together with two congruent denottionl semntic models. We lso show how this extended lnguge cn be simulted using stndrd CS, so s to be ble to nlyse systems using the model checker FDR. Keywords. CS, tests for vilbility, semntic models. 1. Introduction Mny lnguges for messge-pssing concurrency llow progrms to test whether chnnel is redy for communiction, without ctully performing tht communiction. For exmple, in JCS [WM + 07,W09], the input nd output ends of chnnels hve method pending(), to test whether there is dt redy to be red, or whether there is reder redy to receive dt, respectively. JvInputStrems hve methodvilble() tht returns the number of bytes tht re vilble to be red. Andrews [And00] gives number of exmples using such construct. In this pper, we study the effect of dding such tests to the process lgebr CS [Ros97]. In prticulr, we dd single new construct to the lnguge: the process if redy then else Q (1) tests whether the event is redy for communiction, nd then cts like either or Q, ppropritely. More precisely, the process tests whether ll other processes tht hve in their lphbet (nd so who must synchronise on ) re redy to perform. We ssume tht within constructs of the form of (1), the test for the rediness of is crried out only once: if the event becomes vilble or unvilble fter the test is performed, tht does not ffect the brnch tht is selected. We llow processes to test for the rediness of events outside their own lphbet. In this pper we investigte the effect of dding the construct (1) to semntic models for CS. In the next section, we give brief overview of the syntx nd stndrd semntics of CS. In Section 3 we give some exmples using the new construct, both to illustrte its potentil usefulness, nd to highlight some implictions for the semntic models. In Section 4 we give n opertionl semntics to the lnguge; then in Section 5 we give congruent denottionl models, nlogous to the trces nd stble filures models of CS [Ros97]. In Section 6 we show how this extended lnguge cn be simulted using stndrd CS, so s to be ble to nlyse systems using model checker such s FDR [Ros94,For97]. We sum up in Section 7.

2 2 Gvin Lowe / Extending CS with tests for vilbility 2. A brief overview of CS In this section we give brief overview of the syntx of CS; for simplicity nd brevity, we consider frgment of the lnguge in this pper. We lso give brief overview of the trces nd stble filures models of CS. For more detils, see [Ho85,Ros97]. CS is process lgebr for describing progrms or processes tht interct with their environment by communiction. rocesses communicte vi tomic events, from some set Σ. Events re often pssed on chnnels; for exmple, the event c.3 represents the vlue 3 being pssed on chnnel c. The nottion { c } represents the set of events over chnnel c. The simplest process is STO, which represents dedlocked process tht cnnot communicte with its environment. The process div represents divergent process tht cn only perform internl events. The process offers its environment the event ; if the event is performed, it then cts like. The process c?x is initilly willing to input vlue x on chnnel c, i.e. it is willing to perform ny event of the form c.x; it then cts like (which my use x). A stndrd conditionl is written s if b then else Q, where b is boolen condition on vribles within the process (such s vribles tht hold vlues previously input) 1. The process b & is equivlent to if b then else STO: is enbled only if the boolen gurd b is true. For convenience, we extend this nottion to rediness tests nd define: redy & s shorthnd for if redy then else STO, notredy & s shorthnd for if redy then STO else. The tests now ct s gurds upon, so tht cn be performed only if is vilble or not vilble, respectively. The process Q cn ct like either or Q, the choice being mde by the environment: the environment is offered the choice between the initil events of nd Q. y contrst, Q my ct like either or Q, with the choice being mde internlly, nd not under the control of the environment. The process Q represents sliding choice or timeout: the process initilly cts like, but if no event is performed then it cn internlly chnge stte to ct like Q. The process A Q runs nd Q in prllel; is restricted to performing events from A; Q is restricted to performing events from ; the two processes synchronise on events from A. In this pper we will tke the lphbets A nd to comprise just stndrd events, s opposed to ctions corresponding to rediness tests. As noted bove, we llow processes to test for the rediness of events outside their lphbets, e.g. (redy b & STO) {} {b} (b STO STO). In exmples, we will tend to omit the lphbets when they re cler from the context. The process Q runs nd Q in prllel, synchronising on events from A. The process A Q interleves nd Q, i.e. runs them in prllel with no synchronistion. The process \ A cts like, except the events from A re hidden, i.e. turned into internl, invisible events, denoted τ, which do not need to synchronise with the environment. The process [R] represents where events re renmed ccording to the reltion R, i.e., [R] cn perform n event b whenever cn perform n event such tht R b. The reltion R is often presented s substitution; for exmple [b/, c/] represents, with the event renmed to both b nd c, nd ll other events unchnged. 1 We use the sme syntx for both stndrd conditionls nd rediness tests, but they re semnticlly different constructs.

3 Gvin Lowe / Extending CS with tests for vilbility 3 Recursive processes my be defined equtionlly, or using the nottion µ X, which represents process tht cts like, where ech occurrence of X represents recursive instntition of µ X. refixing ( ) nd gurding (&) bind tighter thn ech of the binry choice opertors, which in turn bind tighter thn the prllel opertors. CS cn be given both n opertionl nd denottionl semntics. The denottionl semntics cn either be extrcted from the opertionl semntics, or defined directly over the syntx of the lnguge; see [Ros97]. It is more common to use the denottionl semntics when specifying or describing the behviours of processes, lthough most tools ct on the opertionl semntics. A trce of process is sequence of (visible) events tht process cn perform. We write trces() for the trces of. If tr is trce, then tr ` A represents the restriction of tr to the events in A, wheres tr \ A represents tr with the events from A removed; conctention is written ; A represents the set of trces with events from A. A stble filure of process is pir (tr, X), which represents tht cn perform the trce tr to rech stble stte (i.e. where no internl events re possible) where X cn be refused, i.e., where none of the events of X is vilble. We write filures() for the stble filures of. 3. Exmples In this section we consider few exmples, firstly to illustrte the usefulness of the new construct, nd then to highlight some spects of the semntics. eing ble to detect rediness on chnnels cn be useful in number of circumstnces. For exmple, the construct: notredy & b Q gives priority to over b: the event b cn be performed only if the environment is not willing to perform (t the point t which the test is mde). Note, though, tht if the environment withdrws its willingness to communicte fter the notredy test is performed, then the bove construct will be blocked, even if b is vilble: the construct mkes the ssumption bout the environment tht is not withdrwn in this wy. As slightly lrger exmple, consider the clssic reders nd writers problem [CH71]. Here collections of reders nd writers shre dtbse. In order to mintin consistency, reders my not use the dtbse t the sme time s writers, nd t most one writer my use the dtbse t time. The following gurd process supports this: reders (resp. writers) gin entry to the dtbse by performing the event strtred (resp. strtwrite) nd perform endred (resp. endwrite) when they re finished. The prmeters r nd w record the number of reders nd writers currently using the dtbse, nd stisfy the invrint w 1 (r > 0 w = 0). Gurd(r, w) = w = 0 & strtred Gurd(r + 1, w) endred Gurd(r 1, w) r = 0 w = 0 & strtwrite Gurd(r, w + 1) endwrite Gurd(r, w 1). The problem with the bove design is tht writers my be permnently locked out of the dtbse if there is lwys t lest one reder using the dtbse (even if no individul reder uses the dtbse indefinitely). The following version gives priority to writers, by not llowing new reder to strt using the dtbse if there is writer witing:

4 4 Gvin Lowe / Extending CS with tests for vilbility Gurd(r, w) = w = 0 & notredy strtwrite & strtred Gurd(r + 1, w) endred Gurd(r 1, w) r = 0 w = 0 & strtwrite Gurd(r, w + 1) endwrite Gurd(r, w 1). This ide cn be extended further, to chieve firness to both types of process; the prmeter prired records whether priority should be given to reders. 2 Gurd(r, w, prired) = w = 0 prired & strtred Gurd(r + 1, w, flse) w = 0 & notredy strtwrite & strtred Gurd(r + 1, w, flse) endred Gurd(r 1, w, flse) r = 0 w = 0 prired & strtwrite Gurd(r, w + 1, true) r = 0 w = 0 & notredy strtred & strtwrite Gurd(r, w + 1, true) endwrite Gurd(r, w 1, true). We now consider few exmples in order to better understnd spects of the semntics of processes with rediness tests: it turns out tht some stndrd lgebric lws no longer hold. Throughout these exmples, we omit lphbets from the prllel composition opertor where they re obvious from the context. Exmple 1 Consider Q where = STO nd Q = if redy then b STO else error STO. Clerly, it is possible for Q to detect tht is redy nd so perform b. Could Q detect tht is not redy, nd so perform error? If mkes vilble immeditely then clerly the nswer is no. However, if it tkes some time to mke vilble, then Q could test for the vilbility of before hs mde it vilble. We believe tht ny implementtion of prefixing will tke some time to mke vilble: for exmple, in multi-threded implementtion, scheduling decisions will influence when the becomes vilble; further, the code for mking vilble will itself tke some time to run. This is the intuition we follow in the rest of the pper. This decision hs considerble impct on the semntics: it will men tht ll processes will tke some time to mke events vilble (essentilly since ll the CS opertors mintin this property). Returning to Exmple 1, in the combintion Q, Q cn detect tht is not vilble initilly nd so perform error. Exmple 2 (if redy then else Q) \ {} = \ {}: the hiding of mens tht the redy test succeeds, since there is nothing to prevent from hppening. Exmple 3 Externl choice is not idempotent. Consider = STO b STO nd Q = redy & redy b & error STO. Then Q cnnot perform error, but Q cn, if the two nondeterministic choices re resolved differently. We do not llow externl choices to be resolved by redy or notredy tests: we consider these tests to be nlogous to evlution of stndrd boolen conditions in if sttements, or boolen gurds, which re evluted internlly. Exmple 4 The process R = redy & notredy & Q is not the sme s if redy then else Q, essentilly since the former checks for the rediness of twice, but the ltter checks 2 In principle one could merge the first two brnches, by using gurd w = 0 (prired notredy strtwrite); however, llowing complex gurds tht mix boolens with rediness testing would complicte the semntic definitions.

5 Gvin Lowe / Extending CS with tests for vilbility 5 only once. When in the presence of the process STO, R cn evolve to the stte Q (if the redy test is mde fter the becomes vilble, nd the notredy test is mde before the becomes vilble) or to STO STO = STO (if the redy test is mde before the becomes vilble, nd the notredy test is mde fter the becomes vilble); neither of these is, in generl, stte of if redy then else Q. Exmple 5 redy & redy b & is not the sme s redy b & redy &. Consider = error STO nd Q = STO b STO. Then redy & redy b & Q cn perform error, but redy b & redy & Q cnnot. Similr results hold for notredy, nd for mix of redy nd notredy gurds. The bove exmple shows why we do not llow more complex gurds, such s redy redy b& : ny nturl implementtion of this process would hve to test for the vilbility of nd b in some order, but the order in which those re tested cn mke difference. 4. Opertionl semntics In this section we give opertionl semntics to the lnguge of CS extended with tests for the rediness or non-rediness of events. For simplicity, we omit interleving, the form of prllel composition, nd renming from the lnguge we consider. As norml, we write, for Σ {τ} (where Σ is the set of visible events, nd τ represents n internl event), to indicte tht performs the event to become. In ddition, we include trnsitions to indicte successful rediness or non-rediness tests: We write redy to indicte tht detects tht the event is redy, nd evolves into ; We write notredy to indicte tht detects tht the event is not redy, nd evolves into. Note the different fonts between redy nd notredy, which re prt of the syntx, nd redy nd notredy, which re prt of the semntics. Define, for A Σ: A redy A = {redy A}, A = A redy A notredy A, notredy A = {notredy A}, A τ = A {τ}. Trnsitions, then, will be lbelled by elements of Σ τ. We think of the redy nd notredy trnsitions s being internl in the sense tht they cnnot be directly observed by ny prllel peer. We refer to elements of Σ τ s ctions, nd restrict the word events to elements of Σ τ. elow we use stndrd conventions, writing, e.g., for, nd for ( ). Recll our intuition tht process such s my not mke the vilble immeditely. We model this by τ trnsition to stte where the is indeed vilble. It turns out tht this ltter stte is not expressible within the syntx of the lnguge (this follows from Lemm 11, below). Within the opertionl semntic definitions, we will write this stte s ǎ. We therefore define the semntics of prefixing by the following two rules. τ ǎ, ǎ. We stress, though, tht the ǎ... nottion is only for the purpose of defining the opertionl semntics, nd is not prt of the lnguge.

6 6 Gvin Lowe / Extending CS with tests for vilbility The following rules for norml events re completely stndrd. For brevity, we omit the symmetriclly equivlent rules for externl choice ( ) nd prllel composition ( A ). The identifier rnges over visible events. Q Q τ Q τ Q τ Q τ Q Q τ Q Q τ Q τ Q α A Q α A Q α A {τ} Q Q A Q A Q A α \ A α \ A α Σ A {τ} \ A τ \ A A div τ div µ X τ [µ X /X] The following rules show how the tests for rediness operte. if redy then else Q redy, if redy then else Q notredy Q. The remining rules show how the rediness tests re promoted by vrious opertors. We omit symmetriclly equivlent rules for brevity. The rules for the choice opertors re strightforwrd. redy Q redy Q notredy Q notredy Q redy Q redy Q notredy Q notredy Q The rules for prllel composition re little more involved. A redy ction cn occur only if ll processes with in their lphbet re ble to perform. redy b Q b A Q redy b A Q b redy A Q redy A Q / A notredy ction requires t lest one prllel peer with in its lphbet to be unble to perform. In this cse, the ction is converted into τ. b Q A Q τ A Q notredy b b Q b notredy b A Q notredy b A Q b

7 Gvin Lowe / Extending CS with tests for vilbility 7 notredy A Q notredy A Q / Note tht in the second rule, the notredy b my yet be blocked by some other prllel peer. If redy ction cn be performed in context where is then hidden, then ll relevnt prllel peers re ble to perform ; hence the trnsition cn occur; the ction is converted into τ. redy \ A τ \ A A α α redy(σ A) notredy(σ A) \ A α \ A Note tht there is no corresponding rule for notredy : in the context \ A, if cn perform notredy (with A) then ll prllel peers with in their lphbet re ble to perform, nd so the is vilble; hence the notredy ction is blocked for \ A. The following two lemms cn be proved using strightforwrd structurl inductions. First, redy nd notredy ctions re vilble s lterntives to one nother. Lemm 6 For every process : ( Q redy Q) ( Q notredy Q ). Informlly, the two trnsitions correspond to tking the two brnches of construct of the form if redy then R else R. The if construct my be only prt of the process bove, nd so R nd R my be only prt of Q nd Q bove. Initilly, ech process cn perform no stndrd events. This is consequence of our ssumption tht process of the form cnnot perform the from its initil stte. Lemm 7 For every process expressible using the syntx of the lnguge (so excluding the ǎ... construct), nd for every stndrd event Σ,. Of course, might hve τ trnsition to stte where visible events re vilble. 5. Denottionl semntics We now consider how to build compositionl denottionl semntic model for our lnguge. We wnt the model to record t lest the trces of visible events performed by processes: ny corser model is likely to be trivil. In order to consider wht other informtion is needed in the model, it is useful to consider (informlly) form of testing: we will sy tht test T distinguishes processes nd Q if T nd Q T hve different trces of visible events. In this cse, the denottionl model should lso distinguish nd Q. We wnt to record within trces the redy nd notredy ctions tht re performed. For exmple, the processes b STO nd redy & b STO re distinguished by the test STO (with lphbet {}); we will distinguish them denottionlly by including the redy ction in the ltter s trce. Further, we wnt to record the events tht were vilble s lterntives to those events tht were ctully performed. For exmple, the processes STO b STO nd

8 8 Gvin Lowe / Extending CS with tests for vilbility STO b STO cn be distinguished by the test redy & b STO; we will distinguish them denottionlly by recording tht the former offers s n lterntive to b. We therefore dd ctions offer nd notoffer to represent tht process is offering or not offering, respectively. These ctions will synchronise with redy nd notredy ctions. We write offer A = {offer A}, A = A offer A notoffer A, notoffer A = {notoffer A}, A τ = A {τ}. A trce of process will, then, be sequence of ctions from Σ. We cn clculte the trces of process in two wys: by extrcting then from the opertionl semntics, nd by giving compositionl rules. We begin with the former. We ugment the opertionl semntics with extr trnsitions s follows: We dd offer loops on every stte such tht ; We dd notoffer loops on every stte such tht. Formlly, we define new trnsition reltion by: α Q α Q, for α Σ τ, offer, notoffer. Appendix A gives rules for the tht cn be derived from the rules for the reltion nd the bove definition. We cn then extrct the trces (of Σ ctions) from the opertionl semntics (following [Ros97, Chpter 7]): tr Definition 8 We write Q, for tr = α 1,...,α n (Σ τ ), if there exist 0 =, α i+1 1,..., n = Q such tht i i+1 for i = 0,..., n 1. We write = tr Q, for tr (Σ ), if there is some tr such tht tr Q nd tr = tr \ τ. The trces of process cn then be defined to be the set of ll tr such tht following lemm sttes some helthiness conditions concerning this set. tr =. The Lemm 9 For ll processes expressible using the syntx of the lnguge (so excluding the ǎ... construct), the set T = {tr = } tr stisfies the following conditions: 1. T is non-empty nd prefix-closed. 2. T includes (notoffer Σ), i.e., the process strts in stte where no stndrd events re vilble. 3. offer nd notoffer ctions cn lwys be remove from or duplicted within trce: tr α tr T tr α, α tr T tr tr T, for α offer Σ notoffer Σ. 4. redy nd notredy ctions re vilble s lterntives to one nother: tr redy T tr notredy T. 5. Either n offer or notoffer ction is lwys vilble. tr tr T tr offer tr T tr notoffer tr T.

9 Gvin Lowe / Extending CS with tests for vilbility 9 roof: (Sketch) 1. This follows directly from the definition of =. 2. The follows from Lemm 7 nd the definition of. 3. This follows directly from the definition of : offer nd notoffer trnsitions lwys form self-loops. 4. This follows directly from Lemm This follows directly from the definition of : ech stte hs either n offer or notoffer loop Compositionl trces semntics We now give compositionl rules for the trces of process. The semntics for ech process will be n element of the following model. Definition 10 The Rediness-Testing Trces Model contins those sets T (Σ ) tht stisfy conditions 2 5 of Lemm 9. We write trces R [[]] for the trces of 3. elow we will show tht these re congruent to the opertionl definition bove. STO nd div re equivlent in this model: they cn perform no stndrd events; they cn only signl tht they re not offering events. trces R [[STO]] = trces R [[div]] = (notoffer Σ). The process cn initilly signl tht it is not offering events; it cn then signl tht it is offering but not offering other events; it cn then perform, nd then continue like. trces R [[ ]] = Init {tr tr tr Init tr trces R [[]]} where Init = {tr tr tr (notoffer Σ) tr ({offer } notoffer(σ {})) }. The process if redy then else Q cn initilly signl tht it is not offering events; it cn then either detect tht is redy nd continue s, or detect tht is not redy nd continue like Q. trces R [[ if redy then else Q]] = (notoffer Σ) {tr redy tr tr (notoffer Σ) tr trces R [[]]} {tr notredy tr tr (notoffer Σ) tr trces R [[Q]]}. The process Q cn either perform trce of, or cn perform trce of with no stndrd events, nd then (fter the timeout) perform trce of Q. The process Q cn perform trces of either of its components. trces R [[ Q]] = trces R [[]] {tr tr Q tr trces R [[]] tr ` Σ = tr Q trces R [[Q]]}, trces R [[ Q]] = trces R [[]] trces R [[Q]]. efore the first visible event, the process Q cn perform n offer ction if either or Q cn do so; it cn perform notoffer ction if both nd Q cn do so. Therefore, 3 We include the subscript R in trces R [[]] to distinguish this semntics from the stndrd trces semntics, trces[[]].

10 10 Gvin Lowe / Extending CS with tests for vilbility nd Q must synchronise on ll notoffer ctions before the first visible event. Let tr notoffer Σ be the set of wys of interleving tr nd tr, synchronising on ll notoffer ctions (this opertor is specilistion of the opertor defined in [Ros97, pge 70]). The three sets in X the definition below correspond to the cses where () neither process performs ny visible events (so the two processes synchronise on notoffer ctions throughout the execution), (b) performs t lest one visible event (fter which, Q is turned off), nd (c) the symmetric cse where Q performs t lest one visible event. trces R [[ Q]] = {tr tr trces R [[]], tr Q trces R [[Q]] tr ` Σ = tr Q ` Σ = tr tr notoffer Σ tr Q } {tr tr tr tr trces R [[]], tr Q trces R [[Q]] tr ` Σ = tr Q ` Σ = Σ tr tr tr Q } notoffer Σ {tr tr Q tr trces R [[]], tr Q tr Q trces R [[Q]] tr ` Σ = tr Q ` Σ = Σ tr tr tr Q }. notoffer Σ In order to give semntic eqution for prllel composition, we define reltion to cpture how trces of prllel components re combined 4. We write (tr, tr Q ) A tr if the trces tr of nd tr Q of Q cn led to the trce tr of A Q. Let privte A = (A ) offer(a ) notoffer A redy(σ ) notredy(σ ); these re the ctions tht the process with lphbet A cn perform without ny coopertion from the other process. Let sync A, = (A ) offer(a ); these re the ctions tht the two processes synchronise upon. The reltion A is defined by: (, ) A, if (tr, tr Q ) A tr nd b, then ( α tr, tr Q ) A α tr, for α privtea, ( α tr, α tr Q ) A α tr, for α synca,, ( redy b tr, offer b tr Q ) A redy b tr, ( notredy b tr, notoffer b tr Q ) A tr, ( notredy b tr, offer b tr Q ) A notredy b tr, The symmetric equivlents of the bove cses. In the second cluse: the first cse corresponds to performing privte ction; the second cse corresponds to nd Q synchronising on shred ction; the third cse corresponds to rediness test of detecting tht Q is offering b; the fourth cse corresponds to nonrediness test of detecting tht Q is not offering b; the fifth cse corresponds to nonrediness test of detecting tht Q is offering b. The reder might like to compre this definition with the corresponding opertionl semntics rules for prllel composition. The semntics of prllel composition is then s follows; note tht ech component is restricted to its own lphbet, nd tht the composition cn perform rbitrry notoffer (Σ A ) ctions: tr 4 One normlly defines set-vlued function to do this, but in our cse it is more convenient to define reltion, since this leds to much shorter definition.

11 Gvin Lowe / Extending CS with tests for vilbility 11 trces R [[ A Q]] = {tr tr trces R [[]], tr Q trces R [[Q]] tr ` (Σ A) offer(σ A) notoffer(σ A) = tr Q ` (Σ ) offer(σ ) notoffer(σ ) = (tr, tr Q ) A tr \ notoffer(σ A )}. The semntic eqution for hiding of A cptures tht notredy A nd offer A ctions re blocked, A nd redy A ctions re internlised, nd rbitrry notoffer A ctions cn occur. trces R [[ \ A]] = {tr tr trces R [[]] tr ` (notredy A offer A) = tr \ (A redy A) = tr \ notoffer A}. We now consider the semntics of recursion. Our pproch follows the stndrd method using complete prtil orders; see, for exmple, [Ros97, Appendix A.1]. Lemm 11 The Rediness-Testing Trces Model forms complete prtil order under the subset ordering, with trces R [[div]] s the bottom element. roof: Tht trces R [[div]] is the bottom element follows from item 2 of Lemm 9. It is strightforwrd to see tht the model is closed under rbitrry unions, nd hence is complete prtil order. The following lemm cn be proved using precisely the sme techniques s for the stndrd trces model; see [Ros97, Section 8.2]. Lemm 12 Ech of the opertors is continuous with respect to the ordering. Hence from Trski s Theorem, ech mpping F definble using the opertors of the lnguge hs lest fixed point given by n 0 F n (div). This justifies the following definition. trces R [[ µ X F(X)]] = the -lest fixed point of the semntic mpping corresponding to F. The following theorem shows tht the two wys of cpturing the trces re congruent. Theorem 13 For ll trces tr (Σ ) : tr trces R [[]] iff tr =. roof: (Sketch.) y structurl induction over the syntx of the lnguge. We give couple of cses in Appendix. Theorem 14 For ll processes, trces R [[]] is member of the Rediness-Testing Trces Model (i.e., it stisfies conditions 2 5 of Lemm 9). roof: This follows directly from Lemm 9 nd Theorem 13. We cn relte the semntics of process in this model to the stndrd trces semntics. Let φ be the function tht replces rediness tests by nondeterministic choices, i.e., φ(if redy then else Q) = φ() φ(q) nd φ distributes over ll other opertors (e.g. φ( A Q) = φ() A φ(q)). The stndrd trces of φ() re just the projection onto stndrd events of the rediness-testing trces of. Theorem 15 trces[[φ()]] = {tr ` Σ tr trces R [[]]}.

12 12 Gvin Lowe / Extending CS with tests for vilbility 5.2. Filures We now consider how to refine the semntic model, to mke it nlogous to the stble filures model [Ros97], i.e. to record informtion bout which events cn by stbly refused. The refusl of events seems, t first sight, to be very similr to those events not being offered, s recorded by notoffer ctions. The difference is tht refusls re recorded only in stble sttes, i.e. where no internl events re vilble: this mens tht if n event is stbly refused, it will continue to be refused (until visible event is performed); on the other hnd, notoffer ctions cn occur in ny sttes, nd my subsequently become unvilble. So, for exmple: STO STO is equivlent to STO in the Rediness-Testing Trces model, since the trces of STO re included in the initil trces of STO; but STO STO cn stbly refuse initilly, wheres STO cnnot. STO STO STO hs the trce offer, notoffer, offer (where the notoffer ction is from the intermedite STO stte) wheres STO does not; but neither process cn stbly refuse before is performed. Recll tht in the stndrd model, stble filures re of the form (tr, X), where tr is trce nd X is set of events tht re stbly refused. For the lnguge in this pper, should refusl sets contin ctions other thn stndrd events? Firstly, we should not consider sttes with redy or notredy trnsitions to be stble: recll tht we consider these ctions to be similr to τ events, in tht they re not externlly visible. We define: stble α redy Σ notredyσ {τ} α. Therefore such ctions re necessrily unvilble in stble sttes, so there is no need to record them in refusl sets. There is lso no need to record the refusl of n offer ction, since this will hppen precisely when the event is refused. It turns out tht including notoffer ctions within refusl sets cn dd to the discriminting power of the model. Consider = STO STO, Q = ( STO STO) STO. Then nd Q hve the sme trces, nd hve the sme stble refusls of stndrd events. However, Q cn, fter the empty trce, stbly refuse {b, notoffer } (i.e., stbly offer nd stbly refuse b), wheres cnnot. We therefore hve choice s to whether or not we include notoffer ctions within refusl sets. We choose not to, becuse the distinctions one cn mke by including them do not seem useful, nd excluding them leds to simpler model: in prticulr, the refusl of notoffer ctions do not contribute to the performnce or refusl of ny stndrd events. I suspect tht including notoffer ctions within refusl sets would led to model similr in style to the stble redy sets model [OH86,Ros09]. Hence, we define, for X Σ: ref X stble x X x. We then define the stble filures of process in the norml wy: (tr, X) filures R [[]] Q tr = Q Q ref X. (2) Definition 16 The Rediness-Testing Stble Filures Model contins those pirs (T, F) where T (Σ ), F (Σ ) Σ, T stisfies conditions 2 5 of the Rediness-Testing Trces Model, nd lso

13 Gvin Lowe / Extending CS with tests for vilbility If (tr, X) F then tr T. elow, we give compositionl rules for the stble filures of process. Since the notion of refusl is identicl to s in the stndrd stble filures model, the refusl components re clculted precisely s in tht model, nd so the equtions re stright-forwrd dpttions of the rules for trces. The only point worth noting is tht in the construct if redy then else Q, no filures re recorded before the if is resolved. filures R [[div]] = {}, filures R [[STO]] = {(tr, X) tr (notoffer Σ) X Σ}, filures R [[ ]] = {(tr, X) tr Init / X} {(tr tr, X) tr Init (tr, X) filures R [[]]} where Init = {tr tr tr (notoffer Σ) tr ({offer } notoffer(σ {})) }, filures R [[ if redy then else Q]] = {(tr redy tr, X) tr (notoffer Σ) (tr, X) filures R [[]]} {(tr notredy tr, X) tr (notoffer Σ) (tr, X) filures R [[Q]]}, filures R [[ Q]] = {(tr, X) (tr, X) filures R [[]] tr ` Σ } {(tr tr Q, X) tr trces[[]] tr ` Σ = (tr Q, X) filures R [[Q]]}, filures R [[ Q]] = filures R [[]] filures R [[Q]], filures R [[ Q]] = {(tr, X) (tr, X) filures R [[]], (tr Q, X) filures R [[Q]] tr ` Σ = tr Q ` Σ = tr tr tr Q } notoffer Σ {(tr tr, X) (tr tr, X) filures R[[]], tr Q trces[[q]] tr ` Σ = tr Q ` Σ = Σ tr tr notoffer Σ {(tr tr Q, X) tr trces[[]], (tr Q tr Q, X) filures R[[Q]] tr ` Σ = tr Q ` Σ = Σ tr tr notoffer Σ filures R [[ A Q]] = {(tr, Z) (tr, X) filures R [[]], (tr Q, Y) filures R [[Q]] tr ` (Σ A) offer(σ A) notoffer(σ A) = tr Q ` (Σ ) offer(σ ) notoffer(σ ) = tr Q } tr Q }, (tr, tr Q ) A tr \ notoffer(σ A ) Z A = X A Y }, filures R [[ \ A]] = {(tr, X) (tr, X A) filures R [[]] tr ` (notredy A offer A) = tr \ (A redy A) = tr \ notoffer A}, filures R [[ µ X F(X)]] = the -lest fixed point of the semntic mpping corresponding to F. The fixed-point definition for recursion cn be justified in similr wy to s for trces. The congruence of the bove rules to the opertionl definition of stble filures i.e., eqution (2) cn be proved in similr wy to Theorem 13. Conditions 2 5 of the Rediness- Testing Stble Filures Model re stisfied, becuse of the corresponding result for trces

14 14 Gvin Lowe / Extending CS with tests for vilbility (Theorem 14). Condition 6 follows directly from the definition of stble filure, nd the congruence of the opertionl nd denottionl semntics. The following theorem reltes the semntics of process in this model to the stndrd stble filures semntics. Theorem 17 filures[[φ()]] = {(tr ` Σ, X) (tr, X) filures R [[]]}. 6. Model checking In this section we illustrte how one cn use stndrd CS model checker, such s FDR [Ros94,For97], to nlyse processes in the extended lnguge of this pper. We just give n exmple here, in order to give the flvour of the trnsltion; we discuss prospects for generlising the pproch in the concluding section of the pper. We consider the following solution to the reders nd writers problem. Gurd(r, w) = w = 0 r < N & notredy strtwrite & strtred Gurd(r + 1, w) r > 0 & endred Gurd(r 1, w) r = 0 w = 0 & strtwrite Gurd(r, w + 1) w > 0 & endwrite Gurd(r, w 1). This is the solution from Section 3 tht gives priority to writers, except we impose bound of N upon the number of reders, nd dd gurds to the second nd fourth brnches, in order to keep the stte spce finite. We will show tht this solution is strvtion free s fr s the writers is concerned: i.e. if writer is trying to gin ccess then one such writer eventully succeeds. We will simulte the bove gurd process using stndrd CS, in prticulr simulting the redy, notredy, offer nd notoffer ctions by fresh CS events on chnnels redy, notredy, offer nd notoffer. Ech process is trnslted into form tht uses these chnnels, following the semntics presented erlier; the simultion will hve trnsitions tht correspond to the trnsitions of the originl, except it will hve few dditionl τ trnsitions tht do not ffect the filures-divergences semntics. More precisely, let ˆα be the event used to simulte the ction α; for exmple, if α = redy e then ˆα = redy.e. Then ech process is simulted by trnsltion trns(), where if α ˆα Q then trns() ( ) τ trns(q), nd vice vers. In prticulr, for ech stndrd event e, we must dd n offer.e or notoffer.e loop to ech stte. For convenience, nd to distinguish between the source nd trget lnguges, we present the simultion using prettified mchine-redble CS. 5 The stndrd events nd the chnnels to simulte the non-stndrd ctions re declred s follows: chnnel s t r t W r i t e, endwrite, strtred, endred E = { s t r t W r i t e, endwrite, strtred, endred} chnnel redy, notredy, o f f e r, n o t O f f e r : E We strt by defining some helper processes. The following process is the trnsltion of STO: it cn only signl tht it is not offering stndrd events. STOT = n o t O f f e r?e STOT 5 The CS text below is produced (lmost) directly from the mchine-redble CS using L A TEX mcros.

15 Gvin Lowe / Extending CS with tests for vilbility 15 The following process is the trnsltion of e : initilly it cn signl tht it is not offering stndrd events; it cn then timeout into stte where e is vilble, fter which it cts like ; in this ltter stte it cn lso signl tht it is offering e but no other stndrd events. 6 r e f i x ( e, ) = n o t O f f e r?e1 r e f i x ( e, ) r e f i x 1 ( e, ) r e f i x 1 ( e, ) = e o f f e r. e r e f i x 1 ( e,) n o t O f f e r?e1 : d i f f (E, { e } ) r e f i x 1 ( e,) The reder might like to compre these with the semntics in Appendix A. In order to simulte the Gurd process, we simulte ech brnch s seprte prllel process: the brnches of Gurd synchronise on notoffer ctions before the choice is resolved, so the processes simulting these brnches will synchronise on pproprite notoffer events. The first brnch is simulted s below: rnch ( 1, r,w) = i f w==0 nd r<n then notredy. s t r t W r i t e r e f i x ( strtred, Restrt ( 1, r +1,w) ) redy. s t r t W r i t e STOT n o t O f f e r?e rnch ( 1, r,w) else STOT We explin the Restrt process below. Note how the notredy strtwrite test is simulted by the notredy.strtwrite nd redy.strtwrite events. Note lso how the process signls which stndrd events re nd re not vilble in the different sttes. The other brnches re slightly simpler, s they do not include rediness tests. rnch ( 2, r,w) = i f r>0 then r e f i x ( endred, Restrt ( 2, r 1,w) ) else STOT rnch ( 3, r,w) = i f r ==0 nd w==0 then r e f i x ( s t r t W r i t e, Restrt ( 3, r,w+1)) else STOT rnch ( 4, r,w) = i f w>0 then r e f i x ( endwrite, Restrt ( 4, r,w 1)) else STOT When one brnch executes nd reches point corresponding to recursion within the Gurd process, ll the other brnch processes need to be restrted, with new vlues for r or w. We implement this by the executing brnch signlling on the chnnel restrt. R = { 0..N} possible vlues of r W = { } possible vlues of w RANCH = { } brnch i d e n t i f i e r s chnnel r e s t r t : RANCH.R.W Restrt ( i, r,w) = r e s t r t! i. r.w rnch ( i, r,w) Ech brnch cn receive such signl from nother brnch, s n interrupt, nd restrt with the new vlues for r nd w. 7 rnch ( i, r,w) = rnch ( i, r,w) r e s t r t? j : d i f f (RANCH, { i })? r. w rnch ( i, r, w ) 6 The opertor diff represents set difference. 7 The is n interrupt opertor; the left hnd side is interrupted when the right hnd side performs n event.

16 16 Gvin Lowe / Extending CS with tests for vilbility elow we will combine these rnch processes in prllel so s to simulte Gurd. We will need to be ble to identify which brnch performs certin events. For events e other thn notoffer events, we renme e performed by brnch i to c.i.e. We renme ech notoffer.e event performed by brnch i to both itself nd notoffer1.i.e: the former will be used before the choice is resolved (synchronised between ll brnch processes), nd the ltter will be used fter the choice is resolved (privtely to brnch i): 8 EE = union (E, { redy, notredy, o f f e r } ) events other thn n o t O f f e r chnnel c : RANCH.EE c. i. e represents event e done by rnch ( i,, ) chnnel notoffer1 : RANCH. E rnch ( i, r,w) = rnch ( i, r,w) [e \ c. i. e e EE ] [ n o t O f f e r. e \ n o t O f f e r. e, n o t O f f e r. e \ notoffer1. i. e e E ] lph ( i ) = { c. i, r e s t r t, notoffer, notoffer1. i } lphbet of brnch i elow we will combine the brnch processes in prllel, together with regultor process Reg tht, once brnch hs done stndrd event to resolve the choice, blocks ll events of the other brnches until restrt occurs; further, it forces processes to synchronise on notoffer events before the choice is resolved, nd subsequently llows the unsynchronised notoffer1 events. 9 Reg = c? i?e ( i f member ( e, E) then Reg ( i ) else Reg ) n o t O f f e r? Reg Reg ( i ) = c. i? Reg ( i ) r e s t r t. i?? Reg notoffer1. i? Reg ( i ) We build the gurd process by combining the brnches nd regultor in prllel, hiding the restrt events, nd reversing the bove renming. 10 Gurd0 ( r,w) = ( i : RANCH [ lph ( i ) ] rnch ( i, r,w) ) [ { c, r e s t r t, notoffer, notoffer1 } ] Reg Gurd ( r,w) = ( Gurd0 ( r,w) \ { r e s t r t } ) [ c. i. e \ e e EE, i RANCH] [ notoffer1. i. e \ n o t O f f e r. e e E, i RANCH] We now model the reders nd writers themselves. Ech reder lterntes between performing strtred nd endred. Ech writer is similr, but, for lter convenience, we dd n event writertrying to indicte tht it is trying to perform write. chnnel w r i t e r T r y i n g Reder = r e f i x ( strtred, r e f i x ( endred, Reder ) ) W r i t e r = w r i t e r T r y i n g r e f i x ( s t r t W r i t e, r e f i x ( endwrite, W r i t e r ) ) RedersWriters = ( r : { 1..N} Reder ) ( w: { 1.. N} W r i t e r ) 8 union represents the union opertion. 9 member tests for membership of set. 10 The is n indexed prllel composition, indexed by i; here the ith component hs lphbet lph(i). The nottion [ A ] is the mchine-redble CS version of. A

17 Gvin Lowe / Extending CS with tests for vilbility 17 We need to synchronise the offer.strtwrite nd notoffer.strtwrite events of the writers with the redy.strtwrite nd notredy.strtwrite events of the gurd, respectively. For convenience, we block the remining offer nd notoffer events, since we mke no use of them, nd processes do not chnge stte when they perform such n event. RedersWriters = RedersWriters [ o f f e r. s t r t W r i t e \ redy. s t r t W r i t e, n o t O f f e r. s t r t W r i t e \ notredy. s t r t W r i t e ] System = l e t SyncSet = union (E, { redy. s t r t W r i t e, notredy. s t r t W r i t e } ) within ( Gurd ( 0, 0 ) [ SyncSet ] RedersWriters ) [ { o f f e r, n o t O f f e r } ] STO We cn check the simple sfety property tht the gurd llows t most one ctive writer t time, nd never llows both reders nd writers to be ctive. Spec ( r,w) = w==0 nd r<n & strtred Spec ( r +1,w) r>0 & endred Spec ( r 1,w) r ==0 nd w==0 & s t r t W r i t e Spec ( r,w+1) w>0 & endwrite Spec ( r,w 1) i n t e r n l s = { redy, notredy, o f f e r, n o t O f f e r } ssert Spec ( 0, 0 ) T System \ { redy, notredy, w r i t e r T r y i n g } This test succeeds, t lest for smll vlues of N. More interestingly, we cn lso verify tht the gurd is fir to the writers, in the sense tht if t lest one writer is trying to gin ccess, then one of them eventully succeeds. The prmeter n of WLSpec0, below, records how mny writers re currently trying; when n>0 (i.e. t lest one writer is trying), this process insists tht writer cn strt. WLSpec( n ) = n<n & w r i t e r T r y i n g WLSpec( n+1) n>0 & s t r t W r i t e WLSpec( n 1) ( notredy. s t r t W r i t e WLSpec( n ) STO) System = l e t hiddens = d i f f ({ strtred, endred, endwrite, redy, notredy }, {notredy. s t r t W r i t e } ) w it hin System \ hiddens ssert WLSpec ( 0 ) FD System The bove refinement test succeeds. In prticulr, this mens tht the right hnd side is divergence-free, so tht the strtwrite events will become vilble fter finite number of the hidden events. (Note though tht we keep the notredy.strtwrite visible, to void divergence tht would be cused by n infinite repetition of notredy.strtwrite, strtred, endred events, when no writer ws trying.) 7. Discussion In this pper we hve considered n extension of CS tht llows processes to test whether n event is vilble. We hve formlised this construct by giving n opertionl semntics nd congruent denottionl semntic models. We hve illustrted how we cn use stndrd model checker to nlyse systems in this extended lnguge.

18 18 Gvin Lowe / Extending CS with tests for vilbility In this finl section we discuss some relted work nd possible extensions to this work Comprison with stndrd models There hve been severl different denottionl semntic models for CS. Most of these re bsed on the stndrd syntx of CS, with the stndrd opertionl semntics. It is not possible to compre these models directly with the models in this pper, since we hve used more expressive lnguge, with the ddition of rediness tests; however, we cn compre them with the sub-lnguge excluding this construct. For processes tht do not use rediness tests, the two models of this pper re more distinguishing thn the stndrd trces nd stble filures models, respectively. Theorems 15 nd 17 show tht our models mke t lest s mny distinctions s the stndrd models. They distinguish processes tht the stndrd models identify, such s STO ( STO b STO) nd STO b STO : the former, but not the ltter, hs the trce offer, b. In [Ros09], Roscoe gives survey of the denottionl models bsed on the stndrd syntx. The most distinguishing of those models bsed on finite observtions (nd so not modelling divergences) is the finite liner model, F L. This model uses observtions of the form A 0, 0, A 1, 1,..., n 1, A n, where ech i is n event tht is performed, nd ech A i is either () set of events, representing tht those events re offered in stble stte (nd so i A i ), or (b) the specil vlue representing no informtion bout wht events re stbly offered (perhps becuse the process did not stbilise). For processes with no rediness tests, FL is incomprble with the models in this pper. Our models distinguish processes tht F L identifies, essentilly becuse the ltter records the vilbility of events only in stble sttes, wheres our models record this informtion lso in unstble sttes. For exmple, the processes (b STO STO) b STO nd STO b STO re distinguished in our models since just the former hs the trce offer b, ; however they re identified in FL (nd hence ll the other finite observtion models from [Ros09]) becuse this b is not stbly vilble. Conversely, FL distinguishes processes tht our models identify, such s b STO ( STO STO) nd (b STO STO) STO, since the former hs the observtion {},,, b,, but the ltter does not since its is performed from n unstble stte; however, they re identified by our filures model (nd hence our trces model) since this records stbility informtion only t the end of trce. I believe it would be strightforwrd to extend our models to record stbility informtion throughout the trce in the wy FL does. Roscoe lso shows tht ech of the stndrd finite observtion models cn be extended to model divergences in three essentilly different wys. I believe tht it would be strightforwrd to extend the model in this pper to include divergences following ny of these techniques Comprison with other prioritised models As we described in the introduction, the rediness tests cn be used to implement form of priority. There hve been number of previous ttempts to dd priority to CS. Lwrence [Lw04] models priorities by representing process s set of triples of the form (tr, X, Y), mening tht fter performing trce tr, if process is offered the set of

19 Gvin Lowe / Extending CS with tests for vilbility 19 events X, then it will be willing to perform ny of the events from Y. For exmple, process tht initilly gives priority to over b would include the triple, {, b}, {}). Fidge [Fid93] models priorities using set of preferences reltions over events. For exmple, process tht gives priority to over b would hve the preferences reltion {, b b, b}. In [Low93,Low95], I modelled priorities within timed CS using n order over the sets (ctully, multi-sets) of events tht the process could do t the sme time. For exmple, process tht gives priority to over b (nd would rther do either thn nothing) t time 0 would hve the ordering (0, {}) (0, {b}) (0, {}). All the bove models re rther complex: I would clim tht the model in this pper is somewht simpler, nd hs the dvntge of llowing trnsltion into stndrd CS, in order to use the FDR model checker. One issue tht sometimes rises when considering priority is wht hppens when two processes with opposing priorities re composed in prllel. For exmple, consider Q where nd Q give priority to nd b respectively: = 1 notredy & b 2, Q = b Q 1 notredy b & Q 2. There re essentilly three wys in which this prllel composition cn behve (in context tht doesn t block or b): If performs its notredy test before Q, the test succeeds; if, further, mkes the b vilble before Q performs its notredy test, then Q s notredy test will fil, nd so the prllel composition will perform b; The symmetric opposite of the previous cse, where Q performs its notredy test nd mkes vilble before performs its notredy test, nd so the prllel composition performs ; If both processes perform their notredy tests before the other process mkes the corresponding event vilble, then both tests will succeed, nd so both events will be possible. I consider this to be n pproprite solution. y contrst, the model in [Lw04] leds to this system dedlocking; in [Low93,Low95] I used prioritised prllel composition opertor to give priority to the preferences of one components, thereby voiding this problem, but t the cost of considerble complexity Rediness testing for chnnels Most CS-like progrmming lnguges mke use of chnnels tht pss dt. In such lnguges, one cn often test for the vilbility of chnnels, rther thn of individul events. Note, though, tht there is n symmetry between the reder nd writer of the chnnel: the reder will normlly wnt to test whether there is ny event on the chnnel tht is redy for communiction (i.e. the writer is redy to communicte), wheres the writer will normlly wnt to test whether ll the events on the chnnel re redy for communiction (i.e. the reder is redy to communicte). It would be interesting to extend the lnguge of this pper with constructs if redy ll A then else Q nd if redy ny A then else Q, where A is set of events (e.g. ll events on chnnel), to cpture this ide.

20 20 Gvin Lowe / Extending CS with tests for vilbility 7.4. Model checking In Section 6, we gve n indiction s to how to simulte the lnguge of this pper using stndrd CS, so s to use model checker such s FDR. This technique works in generl. This cn be shown directly, by exhibiting the trnsltion. Alterntively, we cn mke use of generl result from [Ros09b], where Roscoe shows tht ny opertor with n opertionl semntics tht is CS-like essentilly tht the opertor cn turn rguments on, interct with rguments vi visible events, promote τ events of rguments, nd mybe turn rguments off cn be simulted using stndrd CS opertors. The semntics of this pper is CS-like in this sense, so we cn use those techniques to simulte this semntics. We intend to utomte the trnsltion. One difficulty is tht the trnsltion from [Ros09b] cn produce processes tht re infinite stte becuse they brnch off extr prllel processes t ech recursion of the simulted process. In Section 6 we voided this problem by restrting the rnch processes tht constituted the gurd t ech recursion (this uses n ide lso due to Roscoe), wheres Roscoe s pproch would brnch off new processes t ech recursion. I believe the technique in Section 6 cn be generlised nd probbly utomted Full bstrction The denottionl semntic models we hve presented turn out not to be fully bstrct with respect to my-testing [dnh84]. Consider the process if redy then else. This is denottionlly distinct from, since its trces hve redy or notredy events dded to the trces of. Yet there seems no wy to distinguish the two processes by testing: i.e., there is no good reson to consider those processes s distinct. We believe tht one could form fully bstrct semntics s follows. Consider the reltion over sets of trces defined by (S {tr tr }) (S {tr redy tr, tr notredy tr }) for ll S (Σ ), tr, tr Σ, Σ. In other words, two sets re relted if one is formed from the other by dding redy nd notredy ctions in the sme plce. Let be the trnsitive reflexive closure of. This reltion essentilly bstrcts wy irrelevnt rediness tests. We conjecture tht nd Q re testing equivlent iff trces[[]] trces[[q]], nd tht it might be possible to produce compositionl semntics corresponding to this equivlence. It is not cler tht the benefits of full bstrction re worth this extr complexity, though. Acknowledgements I would like to think ill Roscoe nd ernrd Sufrin for interesting discussions on this work. I would like to thnk the nonymous referees for number of very useful suggestions. References [And00] Gregory R. Andrews. Foundtions of Multithreded, rllel, nd Distributed rogrmming. Addison-Wesley, [CH71]. J. Courtois, F. Heymns, nd D. L. rns. Concurrent control with reders nd writers. Communictions of the ACM, 14(10): , [dnh84] R. de Nicol nd M. C.. Hennessy. Testing equivlences for processes. Theoreticl Computer Science, 34:83 133, [Fid93] C. J. Fidge. A forml definition of priority in CS. ACM Trnsctions on rogrmming Lnguges nd Systems, 15(4): , 1993.