Parametric and Quantitative Extensions of Modal Transition Systems

Transcription

1 Prmetric nd Quntittive Extensions of Modl Trnsition Systems Uli Fhrenberg 1, Kim G. Lrsen 2, Axel Legy 1, nd Louis-Mrie Tronouez 1 1 Inri / IRISA, Rennes, Frnce 2 Alborg University, Alborg, Denmrk Abstrct. Modl trnsition systems provide behviorl nd compositionl specifiction formlism for rective systems. We survey two extensions of modl trnsition systems: prmetric modl trnsition systems for specifictions with prmeters, nd weighted modl trnsition systems for quntittive specifictions. 1 Introduction Modl trnsition systems [21, 23] provide behviorl nd compositionl specifiction formlism for rective systems. They grew out of the notion of reltivized bisimultion [20], which llows for simple specifictions of components by llowing the notion of bisimultion to tke into ccount the restricted use tht given component my hve in its context. A modl trnsition system is essentilly (lbeled) trnsition system, but with two types of trnsitions: so-clled my-trnsitions which ny implementtion my (or my not) hve, nd must-trnsitions which ny implementtion is required to hve. In fct, ordinry lbeled trnsition systems (or implementtions) re modl trnsition systems where the set of my- nd must-trnsitions coincide. Modl trnsition systems come equipped with bisimultion-like notion of (modl) refinement, reflecting tht the more must-trnsitions nd the fewer my-trnsitions modl specifiction hs the more refined nd closer to finl implementtion it is. Exmple 1. Consider the modl trnsition system shown in Fig. 1 which models the requirements of simple emil system in which emils re first received nd then delivered; must- nd my-trnsitions re represented by solid nd dshed rrows, respectively. Before delivering the emil, the system my check or process the emil, e.g. for encryption or decryption, filtering of spm emils, or generting utomtic nswers using n uto-reply feture. Any implementtion of this emil system specifiction must be ble to receive nd deliver emil, nd it my lso be ble to check rriving emil before delivering it. No other behvior is llowed. Such vlid implementtion is given in Fig. 2. The theory of modl trnsition systems (MTS), or modl specifictions s they were clled in the pper [21] in the proceedings of the first CAV conference

2 2 Uli Fhrenberg, Kim G. Lrsen, Axel Legy, nd Louis-Mrie Tronouez deliver receive check deliver Fig. 1: Modl trnsition system modeling simple emil system, with n optionl behvior: Once n emil is received, it my be checked, e.g. be scnned for contining viruses, or utomticlly decrypted, before it is delivered to the receiver. receive deliver delivercheck check deliver Fig. 2: An implementtion of the simple emil system in Fig. 1 in which we explicitly model two distinct types of emil pre-processing. orgnized by Joseph Sifkis in Grenoble, 3 ws iming t providing behviorl compositionl specifiction formlism for rective systems. At the time of the introduction of MTS, there were two predominnt pproches to specifictions formlisms nd verifiction methods for rective nd concurrent systems: logicl pproches where specifiction is set of properties of implementtions (lbeled trnsition systems), nd grphicl pproches promoted by the vrious process lgebrs, where implementtions nd specifictions re systems of the sme kind nmely lbeled trnsition systems, nd verifiction mounts to compre such systems with respect to given behviorl preorder, e.g. bisimilrity. In serch for complete specifiction theory, the following properties hve been considered desirble (the first three were listed in the erly pper [6]): expressiveness: the specifiction formlism should be powerful enough to express ll properties of given implementtion. In other words it should be possible to completely specify ny lbeled trnsition system, up to bisimultion. modulrity: implementtions re often mde out of severl components, nd it should be possible to infer stisfction of n overll specifiction solely on the bsis of sub-specifiction of the sub-components. refinement: one should hve the bility to del with prtil specifictions, requiring more nd more properties bout system, up to its complete specifiction. 3 In fct, the first CAV conference ws not clled CAV, but hd the rther lengthy title Automtic Verifiction Methods for Finite Stte Systems.

3 Prmetric nd Quntittive Extensions of Modl Trnsition Systems 3 logicl composition: specifiction should be composble with respect to usul logicl opertors such s conjunction nd (possibly) disjunction. quotienting: given n overll specifiction S of composite systems s well s sub-specifiction T of sub-component, the existence of quotient specifiction S\T will describe the sufficient nd necessry condition of the remining components in order tht S is stisfied by the totl systems. Applying these criteri to the logicl nd grphicl (i.e. bisimultion) frmework, s ws done in [6], we see tht the logicl nd grphicl frmeworks offer complementry dvntges: on the grphicl side, expressiveness is trivil since process i specifiction of itself. Modulrity is usully gurnteed by the fct tht bisimultions re comptible with (most) process constructors. On the logicl side, expressiveness is chieved if we llow possibly infinite sets of formule s logicl specifictions, or dmit recursively specified properties. The point of modulrity hs proved more difficult with erly ttempts of Sifkis nd Grf [15] nd Holmstrøm [17] providing sound nd highly usble proof systems for specifictions mixing logicl nd behviorl constructs (s well s fix-point constructs) but lcking ccompnying completeness results. Much lter the work of Mrdre nd Policriti [25] provided first mtching completeness result. In the rest of this pper, we survey two extensions of modl trnsition systems. The first extension, prmetric modl trnsition systems, is concerned with systems whose behviors depend on prmeters [4]. The second extension, weighted modl trnsition systems [1, 2] permits to reson on systems whose behviors depend on quntities. Another pper in this volume [11] will be concerned with other extensions of modl trnsition systems which re more closely relted to pplictions. Acknowledgment. This survey pper presents reserch which we hve conducted with number of couthors; in lphbeticl order, these re Sebstin S. Buer, Nikol Beneš, Line Juhl, Jn Křetínský, Mikel H. Møller, Jiří Srb, nd Clus Thrne. We cknowledge their coopertion in this work; ny errors in this presenttion re, however, our own. 2 Prmetric Modl Trnsition Systems It is well dmitted (see e.g. [27]) tht MTS nd their extensions like disjunctive MTS (DMTS) [24], 1-selecting MTS (1MTS) [13] nd trnsition systems with obligtions (OTS) [5] provide strong support for specifiction formlism llowing for step-wise refinement process. Moreover, the MTS formlisms hve pplictions in other contexts, which include verifiction of product lines [16, 22], interfce theories [27, 28] nd modl bstrctions in progrm nlysis [14, 18, 26]. Unfortuntely, ll of these formlisms lck the cpbility to express some intuitive specifiction requirements like exclusive, conditionl nd persistent choices. In [4] the expressive power of MTS nd its vrints hs been extended considerbly so it cn model model rbitrry Boolen conditions on trnsitions

4 4 Uli Fhrenberg, Kim G. Lrsen, Axel Legy, nd Louis-Mrie Tronouez nd lso llows to instntite persistent trnsitions. The model, clled prmetric modl trnsition systems (PMTS), is equipped with finite set of prmeters tht re fixed prior to the instntition of the trnsitions in the specifiction. The generlized notion of modl refinement is designed to hndle the prmetric extension nd it specilizes to the well-studied modl refinements on ll the subclsses of our model like MTS, disjunctive MTS nd MTS with obligtions. 2.1 Motivtion We shll now discuss these limittions on n exmple s motivtion for the introduction of prmetric MTS formlism with generl Boolen conditions in specifiction requirements. Consider simple specifiction of trffic light controller tht cn be t ny moment in one of the four predefined sttes: red, green, yellow or yellowred. The requirements of the specifiction re: when green is on the trffic light my either chnge to red or yellow nd if it turned yellow it must to red fterwrd; when red is on it my either turn to green or yellowred, nd if it turns yellowred (s it is the cse in some countries) it must to green fterwords. Fig. 3 shows n obvious MTS specifiction of the proposed specifiction. The trnsitions in the stndrd MTS formlism re either of type my (optionl trnsitions depicted s dshed lines) or must (required trnsitions depicted s solid lines). In Fig. 3c, Fig. 3d nd Fig. 3e we present three different implementtions of the MTS specifiction where there re no more optionl trnsitions. The implementtion I 1 does not implement ny my trnsition s it is vlid possibility to stisfy the specifiction S 1. Of course, in our concrete exmple, this mens tht the light is constntly green nd it is clerly n undesirble behvior tht cnnot be, however, esily voided. The second implementtion I 2 on the other hnd implements ll my trnsitions, gin legl implementtion in the MTS methodology but not desirble implementtion of trffic light s the next ction is not lwys deterministiclly given. Finlly, the implementtion I 3 of S 1 illustrtes the third problem with the MTS specifictions, nmely tht the choices mde in ech turn re not persistent nd the implementtion lterntes between entering yellow or not. None of these problems cn be voided when using the MTS formlism. A more expressive formlism of disjunctive modl trnsition systems (DMTS) cn overcome some of the bove mentioned problems. A possible DMTS specifiction S 2 is depicted in Fig. 3b. Here the nd trnsitions, s well s nd ones, re disjunctive, mening tht it is still optionl which one is implemented but t lest one of them must be present. Now the system I 1 in Fig. 3c is not vlid implementtion of S 2 ny more. Nevertheless, the undesirble implementtions I 2 nd I 3 re still possible nd the modeling power of DMTS is insufficient to eliminte them. Inspired by the recent notion of trnsition systems with obligtions [5], we cn model the trffic light using specifiction s trnsition system with

5 Prmetric nd Quntittive Extensions of Modl Trnsition Systems 5 yellowred green red yellow () MTS specifiction S 1 (b) DMTS specifiction S 2 (c) Implementtion I 1 (d) Implementtion I 2 (e) Implementtion I 3 Obligtion function: Φ(green) = (, red) (, yellow) Φ(red) = (, green) (, yellowred) (f) Specifiction S 3 Prmeters: {reqyfromr, reqyfromg} Obligtion function: Φ(green) = ((, red) (, yellow)) (reqyfromg (, yellow)) Φ(red) = ((, green) (, yellowred)) (reqyfromr (, yellowred)) (g) PMTS specifiction S 4 Fig. 3: Specifictions nd implementtions of trffic light controller rbitrry 4 obligtion formule. These formule re Boolen propositions over the outing trnsitions from ech stte, whose stisfying ssignments yield the llowed combintions of outing trnsitions. A possible specifiction clled S 3 is given in Fig. 3f nd it uses the opertion of exclusive-or. We will follow n greement tht whenever the obligtion function for some node is not listed in the system description then it is implicitly understood s requiring ll the vilble outing trnsitions to be present. Due to the use of exclusive-or in the obligtion function, the trnsition systems I 1 nd I 2 re not vlid implementtion 4 In the trnsition systems with obligtions only positive Boolen formule re llowed.

6 6 Uli Fhrenberg, Kim G. Lrsen, Axel Legy, nd Louis-Mrie Tronouez ny more. Nevertheless, the implementtion I 3 in Fig. 3e cnnot be voided in this formlism either. Finlly, the problem with the lternting implementtion I 3 is tht we cnnot enforce in ny of the bove mentioned formlisms uniform (persistent) implementtion of the sme trnsitions in ll its sttes. In order to overcome this problem, we propose the so-clled prmetric MTS where we cn, moreover, choose persistently whether the trnsition to yellow is present or not vi the use of prmeters. The PMTS specifiction with two prmeters reqyfromr nd reqyfromg is shown in Fig. 3g. Fixing priori the (Boolen) vlues of the prmeters mkes the choices permnent in the whole implementtion, hence we eliminte lso the lst problemtic implementtion I Definition We shll now formlly cpture the intuition behind prmetric MTS introduced bove. First, we recll the stndrd propositionl logic. A Boolen formul over set X of tomic propositions is given by the following bstrct syntx ϕ ::= tt x ϕ ϕ ψ ϕ ψ where x rnges over X. The set of ll Boolen formule over the set X is denoted by B(X). Let ν X be truth ssignment, i.e. set of vribles with vlue true, then the stisfction reltion ν = ϕ is given by ν = tt, ν = x iff x ν, nd the stisfction of the remining Boolen connectives is defined in the stndrd wy. We lso use the stndrd derived opertors like exclusive-or ϕ ψ = (ϕ ψ) ( ϕ ψ), impliction ϕ ψ = ϕ ψ nd equivlence ϕ ψ = ( ϕ ψ) (ϕ ψ). We cn now proceed with the definition of prmetric MTS. Definition 1. A prmetric MTS (PMTS) over n ction lphbet Σ is tuple (S, T, P, Φ) where S is set of sttes, T S Σ S is trnsition reltion, P is finite set of prmeters, nd Φ : S B((Σ S) P ) is n obligtion function over the tomic propositions contining outing trnsitions nd prmeters. We implicitly ssume tht whenever (, t) Φ(s) then (s,, t) T. By T (s) = {(, t) (s,, t) T } we denote the set of ll outing trnsitions of s. PMTS hs been provided refinement notion tht generlizes the well-studied refinement notions on its subclsses including tht of MTS. In the definition, the prmeters re fixed first (persistence) followed by ll vlid choices modulo the fixed prmeters tht now behve s constnts. First we set the following nottion. Let (S, T, P, Φ) be PMTS nd ν P be truth ssignment. For s S, we denote by Trn ν (s) = {E T (s) E ν = Φ(s)} the set of ll dmissible sets of trnsitions from s under the fixed truth vlues of the prmeters. We cn now define the notion of modl refinement between PMTS.

7 Prmetric nd Quntittive Extensions of Modl Trnsition Systems 7 Prmeters: {reqy } Prmeters: {reqyfromr, reqyfromg} m m m Obligtion function: Φ(green) = ((, red) (, yellow)) (reqy (, yellow)) Φ(red) = ((, green) (, yellowred)) (reqy (, yellowred)) Obligtion function: Φ(green) = ((, red) (, yellow)) (reqyfromg (, yellow)) Φ(red) = ((, green) (, yellowred)) (reqyfromr (, yellowred)) Fig. 4: Exmple of modl refinement Definition 2. Let (S 1, T 1, P 1, Φ 1 ) nd (S 2, T 2, P 2, Φ 2 ) be two PMTS. A binry reltion R S 1 S 2 is modl refinement if for ech µ P 1 there exists ν P 2 such tht for every (s, t) R holds M Trn µ (s) : N Trn ν (t) : (, s ) M : (, t ) N : (s, t ) R (, t ) N : (, s ) M : (s, t ) R. We sy tht s modlly refines t, denoted by s m refinement R such tht (s, t) R. t, if there exists modl Exmple 2. Consider the rightmost PMTS in Fig. 4. It hs two prmeters reqyfromg nd reqyfromr whose vlues cn be set independently nd it cn be refined by the system in the middle of the figure hving only one prmeter reqy. This single prmeter simply binds the two originl prmeters to the sme vlue. The PMTS in the middle cn be further refined into the implementtions where either yellow is lwys used in both cses, or never t ll. Notice tht there re in principle infinitely mny implementtions of the system in the middle, however, they re ll bisimilr to either of the two implementtions depicted in the left of Fig. 4. [4] provides n extensive study of the complexity of refinement checking between prmetric modl trnsitions with clssifiction depending on the complexity of obligtions s well s the presence or bsence of prmeters. For ech combintion the complexity clss of the polynomil hierrchy for which modl refinement is complete is provided. In short, the complexities rnges from P-complete to Π p 4 -complete (thus in PSPACE). 3 Quntittive Modl Trnsition Systems Motivted by pplictions to embedded, rel-time nd hybrid systems, the modl trnsition system frmework hs been extended in order to reson bout

8 8 Uli Fhrenberg, Kim G. Lrsen, Axel Legy, nd Louis-Mrie Tronouez deliver, [1, 4] receive, [1, 3] check, [0, 5] deliver, [1, 2] Fig. 5: Specifiction of simple emil system, similr to Fig. 1, but extended by integer intervls modeling time units for performing the corresponding ctions. quntittive spects [3, 19]. With these pplictions in mind, it is necessry not only to be ble to specify quntittive spects of systems, but lso to formlize successive refinement of quntities. To illustrte this extension, consider gin the modl trnsition system of Fig. 1, but this time with quntities, see Fig. 5: Every trnsition lbel is extended by integer intervls modeling upper nd lower bounds on time required for performing the corresponding ctions. For instnce, the reception of new emil (ction receive) must tke between one nd three time units, the checking of the emil (ction check) is llowed to tke up to five time units. In this quntittive setting, there is problem with using Boolen notion of refinement s is done in the preceding section: If one only cn decide whether or not n implementtion refines specifiction, then the quntittive spects get lost in the refinement process. As n exmple, consider the emil system implementtions in Fig. 6. Implementtion () does not refine the specifiction, s there is n error in the discrete structure of ctions: fter receiving n emil, the system cn check it indefinitely without ever delivering it. Also implementtions (b) nd (c) do not refine the specifiction: (b) tkes too long to receive emil, (c) does not deliver emil fst enough fter checking it. Implementtion (d) on the other hnd is perfect refinement of the specifiction. Intuitively however, implementtions (b) nd (c) conform much better to the specifiction thn implementtion () in Fig. 6: there re no discrepncies in the discrete structure, only the weights re off by 1. Additionlly, the quntittive error in implementtion (c) occurs lter thn the one in (b). Hence one my wnt to sy tht implementtion (d) is in perfect refinement of the specifiction, (c) is slightly off, (b) is bit more problemtic, wheres implementtion () is completely uncceptble. A Boolen notion of refinement does not llow to mke such distinctions between different negtive nswers. To sum up, Boolen notion of refinement is too frgile for quntittive formlisms. Minor nd mjor modifictions in the implementtion cnnot be distinguished, s both of them my reverse the Boolen nswer. As observed e.g. in [9], this view is obsolete; engineers need quntittive notions on how modified implementtions differ. The introduction of such quntittive notion of refinement, nd its consequences for the specifiction theory, re the subject of this section, which is bsed on the ppers [1, 2].

9 Prmetric nd Quntittive Extensions of Modl Trnsition Systems 9 deliver, 3 receive, 2 () check, 1 deliver, 3 receive, 4 (b) deliver, 3 receive, 3 check, 1 deliver, 3 receive, 2 deliver, 3 (c) (d) Fig. 6: Four implementtions of the simple emil system in Fig. 5. Depending on the precise ppliction of our quntittive formlism, there re few choices which one hs to mke. One such choice is the precise definition of quntittive refinement, s the wy quntittive discrepncies between specifictions is mesured e.g. depends on whether differences ccumulte over time or the interest more lies in the mximl individul differences. Another choice is how to combine quntities during structurl composition: when modeling e.g. energy consumption, they should be dded; when modeling timing constrints, some form of conjunction should be used. To fcilitte quntittive resoning on specifictions nd implementtions, we introduce rel-vlued distnce between specifictions such tht perfect refinement corresponds to distnce 0, smll quntittive discrepncies give rise to smll distnces, nd differences in the discrete control structure correspond to distnce. For the exmples in Figs. 5 nd 6, we will deduce the following chin of decresing distnces: = d(i 1, S) > d(i 2, S) > d(i 3, S) > d(i 4, S) = Weighted modl trnsition systems Let Σ be set of lbels with preorder Σ Σ, nd denote by Σ = Σ Σ ω the set of finite nd infinite trces over Σ. len(σ), for σ Σ, denotes the length (finite or infinite) of trce σ. Let ε Σ denote the empty trce, nd for Σ, σ Σ, denote by.σ their conctention. A weighted modl trnsition system (WMTS) is tuple S = (S, s 0,, ) consisting of set S of sttes, n initil stte s 0 S, nd must- nd mytrnsitions, S Σ S for which it holds tht for ll s s there is s b s with b.

10 10 Uli Fhrenberg, Kim G. Lrsen, Axel Legy, nd Louis-Mrie Tronouez b Intuitively, my-trnsition s t specifies tht n implementtion I of S is permitted to hve corresponding trnsition i j, for ny b, wheres must-trnsition s b t postultes tht I is required to implement t lest one corresponding trnsition i j for some b. We will mke this precise below. An WMTS S = (S, s 0,, ) is n implementtion if =. Hence in n implementtion, ll optionl behvior hs been resolved. Definition 3. A modl refinement of WMTS S 1 = (S 1, s 0 1, 1, 1 ), S 2 = (S 2, s 0 2, 2, 2 ) is reltion R S 1 S 2 such tht for ny (s 1, s 2 ) R, 1 2 whenever s 1 1 t 1, then lso s 2 2 t 2 for some 1 2 nd (t 1, t 2 ) R, whenever s t 2, then lso s t 1 for some 1 2 nd (t 1, t 2 ) R. Thus ny behvior which is permitted in S 1 is lso permitted in S 2, nd ny behvior required in S 2 is lso required in S 1. We write S 1 m S 2 if there is modl refinement R S 1 S 2 with (s 0 1, s 0 2) R. The implementtion semntics of WMTS S is the set S = {I m S I implementtion}, nd we write S 1 t S 1 if S 1 S 2, sying tht S 1 thoroughly refines S 2. It follows by trnsitivity of m tht S 1 m S 2 implies S 1 t S 2, hence modl refinement is syntctic over-pproximtion of thorough refinement. 3.2 Distnces Recll tht hemimetric on set X is function d : X X R 0 { } which stisfies d(x, x) = 0 nd d(x, y) + d(y, z) d(x, z) (the tringle inequlity) for ll x, y, z X. Note tht our hemimetrics re extended in tht they cn tke the vlue. We will need to generlize hemimetrics to codomins other thn R 0 { }. For prtilly ordered monoid (L,,, 0), n L-hemimetric on X is function d : X X L which stisfies d(x, x) = 0 nd d(x, y) d(y, z) d(x, z) for ll x, y, z X. Definition 4. A trce distnce is hemimetric td : Σ Σ R 0 { } for which td(, b) = 0 for ll, b Σ with b nd td(σ, τ) = whenever len(σ) len(τ). For ny set M, let LM = (R 0 { }) M the set of functions from M to the extended non-negtive rel line. Then LM is complete lttice with prtil order LM LM given by α β if nd only if α(x) β(x) for ll x M, nd with n ddition given by (α β)(x) = α(x) + β(x). The bottom element of LM is lso the zero of nd given by (x) = 0, nd the top element is (x) =. Definition 5. A recursive specifiction of trce distnce td consists of set M with lttice homomorphism evl : LM R 0 { },

11 Prmetric nd Quntittive Extensions of Modl Trnsition Systems 11 n LM-hemimetric td LM : Σ Σ LM which stisfies td = evl td LM nd td LM (, b) = for ll, b Σ with b, nd function F : Σ Σ LM LM. F must be monotone in the third coordinte nd stisfy, for ll, b Σ nd σ, τ Σ, tht td LM (.σ, b.τ) = F (, b, td LM (σ, τ)). Note tht the definition implies tht for ll, b Σ, td LM (, b) = td LM (.ε, b.ε) = F (, b, td LM (ε, ε)) = F (, b, ). Hence lso F (,, ) = td LM (, ) = for ll Σ. We hve shown in [2, 10, 12] tht ll commonly used trce distnces obey recursive chrcteriztion s bove. The point-wise distnce from [8], for exmple, hs L = R 0 { }, evl = id nd d LM m (.σ, b.τ) = mx(d(, b), d LM m (σ, τ)), where d : Σ Σ R 0 { } is hemimetric on lbels. The limit-verge distnce used in e.g. [7] hs L = (R 0 { }) N, the complete lttice of functions N R 0 { }, evl(α) = lim inf j N α(j) nd d LM m (.σ, b.τ)(j) = 1 j+1d(, b) + j j+1 dlm m (σ, τ). For the rest of this section, we fix recursively specified trce distnce. A WMTS (S, s 0,, ) is deterministic if it holds for ll s S, s 1 s 1, s 2 s 2 for which there is Σ with td LM (, 1 ) nd td LM (, 2 ) tht 1 = 2 nd s 1 = s 2. Definition 6. The lifted modl refinement distnce d LM m : S 1 S 2 L between the sttes of WMTS S 1 = (S 1, s 0 1, 1, 1 ), S 2 = (S 2, s 0 2, 2, 2 ) is defined to be the lest fixed point to the equtions d LM m (s 1, s 2 ) = mx sup 1 s 1 1t 1 sup s 2 2 2t 2 inf F ( 1, 2, d LM m (t 1, t 2 )), 2 s 2 2t 2 inf F ( 1, 2, d LM m (t 1, t 2 )). s 1 1 1t 1 We let d LM m (S 1, S 2 ) = d LM m (s 0 1, s 0 2). The modl refinement distnce is d m = evl d LM m, nd we write S 1 ε m S 2, for ε R 0 { }, if d LM m (S 1, S 2 ) ε. Proposition 1. The modl refinement distnce is well-defined hemimetric, nd S 1 m S 2 implies S 1 0 m S 2. The thorough refinement distnce between WMTS S 1, S 2 is d t (S 1, S 2 ) = sup inf I 1 S 1 I 2 S 2 d m (I 1, I 2 ), nd we write S 1 ε t S 2, for ε R 0 { }, if d t (S 1, S 2 ) ε. As for the modl distnce, d t is hemimetric, nd S 1 t S 2 implies S 1 0 t S 2. Theorem 1. For ll WMTS S 1, S 2, d t (S 1, S 2 ) d m (S 1, S 2 ). If S 2 is deterministic, then d t (S 1, S 2 ) = d m (S 1, S 2 ).

12 12 Uli Fhrenberg, Kim G. Lrsen, Axel Legy, nd Louis-Mrie Tronouez 3.3 Conjunction Let : Σ Σ Σ be commuttive prtil lbel conjunction opertor for which it holds, for ll b 1, b 2 Σ, tht there is Σ for which both td LM (, b 1 ) nd td LM (, b 2 ) iff there exists c Σ for which both b 1 c nd b 2 c re defined. This is to relte determinism (left-hnd side of the bove) to similr property for lbel conjunction which is needed in the proof of Theorem 2. Additionlly, we ssume tht is gretest lower bound on lbels, i.e. for ll, b Σ with b defined, b nd b b; for ll, b, c Σ with b nd c, b c is defined nd b c. In the definition below, we denote by ρ B (S) the pruning of WMTS S = (S, s 0,, ) with respect to the sttes in ( bd ) subset B S, which is obtined s follows: Define must-predecessor opertor pre : 2 S 2 S by pre(s ) = {s S Σ, s S : s s } nd let pre be the reflexive, trnsitive closure of pre. Then ρ B (S) is defined if s 0 / pre (B), nd in tht cse, ρ B (S) = (S ρ, s 0, ρ, ρ ) with S ρ = S \ pre (B), ρ = (S ρ Σ S ρ ), nd ρ = (S ρ Σ S ρ ). Definition 7. The conjunction of two WMTS S 1 = (S 1, s 0 1, 1, 1 ), S 2 = (S 2, s 0 2, 2, 2 ) is the WMTS S 1 S 2 = ρ B (S 1 S 2, (s 0 1, s 0 2),, ) given s follows (if it exists): s t 1 s 2 2 t 2 (s 1, s 2) 1 2 (t1, t 2) 1 2 defined 1 2 s 1 1 t 1 s 2 2 t 2 s t 1 s 2 2 t 2 : 1 2 undef. (s 1, s 2) B (s 1, s 2) 1 2 (t 1, t 2) 1 s 1 1 t 1 s t defined (s 1, s 2) 1 2 (t1, t 2) 1 2 defined s t 2 s 1 1 t 1 : 1 2 undef. (s 1, s 2) B Note tht conjunction of WMTS my give inconsistent sttes which need to be pruned wy fter. As seen in the lst two SOS rules bove, this is the cse when one WMTS specifies must-trnsition which the other WMTS cnnot synchronize with. Here, the demnd on implementtions of the conjunction would be tht they simultneously must nd cnnot hve trnsition, which of course is unstisfible. Theorem 2. Let S 1, S 2, S 3 be WMTS. If S 1 S 2 is defined, then S 1 S 2 m S 1 nd S 1 S 2 m S 2. If S 1 m S 2, S 1 m S 3, nd S 2 or S 3 is deterministic, then S 2 S 3 is defined nd S 1 m S 2 S 2.

13 Prmetric nd Quntittive Extensions of Modl Trnsition Systems Structurl composition Let ɵ : Σ Σ Σ be commuttive prtil lbel composition opertor which specifies which lbels cn synchronize. Agin we need to relte determinism to n nlous property for lbel composition, hence we require tht it holds, for ll b 1, b 2 Σ, tht there is Σ for which both d(, b 1 ) L nd d(, b 2 ) L iff there exists c Σ for which both b 1 ɵ c nd b 2 ɵ c re defined. Additionlly, we ssume tht there exists function P : L L L which llows us to infer bounds on distnces on synchronized lbels. We ssume tht P is monotone in both coordintes, hs P ( L, L) = L, P (α, L) = P ( L, α) = L for ll α L, nd tht F ( 1 ɵ 2, b 1 ɵ b 2, P (α 1, α 2 )) L P (F ( 1, b 1, α 1 ), F ( 2, b 2, α 2 )) (1) for ll 1, b 1, 2, b 2 Σ nd α 1, α 2 L for which 1 ɵ 2 nd b 1 ɵ b 2 re defined. Hence d( 1 ɵ 2, b 1 ɵ b 2 ) P (d( 1, b 1 ), d( 2, b 2 )) for ll such 1, b 1, 2, b 2 Σ. Intuitively, P gives uniform bound on lbel composition: distnces between composed lbels cn be bounded bove using P nd the individul lbels distnces, nd (1) ensures tht this bound holds recursively. Definition 8. The structurl composition of two WMTS S 1 = (S 1,s 0 1, 1, 1 ), S 2 = (S 2, s 0 2, 2, 2 ) is the WMTS S 1 S 2 = (S 1 S 2, (s 1 0, s 2 0),, ) with trnsitions defined s follows: s t 1 s t 2 (s 1, s 2 ) 1ɵ2 (t 1, t 2 ) 1 ɵ 2 def. s t 1 s t 2 (s 1, s 2 ) 1ɵ2 (t 1, t 2 ) 1 ɵ 2 def. The next theorem shows tht structurl composition supports quntittive independent implementbility: the distnce between structurl compositions cn bounded bove using P nd the distnces between the individul components. Theorem 3. For ll WMTS S 1, T 1, S 2, T 2 with d m (S 1 S 2, T 1 T 2 ) L, we hve d m (S 1 S 2, T 1 T 2 ) L P (d m (S 1, T 1 ), d m (S 2, T 2 )). References 1. Sebstin S. Buer, Uli Fhrenberg, Line Juhl, Kim G. Lrsen, Axel Legy, nd Clus Thrne. Quntittive refinement for weighted modl trnsition systems. In MFCS, volume 6907 of LNCS, pges Springer, Sebstin S. Buer, Uli Fhrenberg, Axel Legy, nd Clus Thrne. Generl quntittive specifiction theories with modlities. In CSR, volume 7353 of LNCS, pges Springer, Sebstin S. Buer, Line Juhl, Kim G. Lrsen, Axel Legy, nd Jiří Srb. Extending modl trnsition systems with structured lbels. Mthemticl Structures in Computer Science, 22(4): , Nikol Beneš, Jn Křetínský, Kim G. Lrsen, Mikel H. Møller, nd Jiří Srb. Prmetric modl trnsition systems. In ATVA, volume 6996 of LNCS, pges Springer, 2011.

14 14 Uli Fhrenberg, Kim G. Lrsen, Axel Legy, nd Louis-Mrie Tronouez 5. Nikol Beneš nd Jn Křetínský. Process lgebr for modl trnsition systemses. In MEMICS, volume 16 of OASICS, pges Schloss Dgstuhl - Leibniz-Zentrum fuer Informtik, Germny, Gérrd Boudol nd Kim G. Lrsen. Grphicl versus logicl specifictions. In CAAP, volume 431 of LNCS, pges Springer, Pvol Černý, Thoms A. Henzinger, nd Arjun Rdhkrishn. Simultion distnces. Theor. Comput. Sci., 413(1):21 35, Luc de Alfro, Mrco Fell, Thoms A. Henzinger, Rupk Mjumdr, nd Mriëlle Stoeling. Model checking discounted temporl properties. Theor. Comput. Sci., 345(1): , Luc de Alfro, Mrco Fell, nd Mriëlle Stoeling. Liner nd brnching system metrics. IEEE Trns. Softwre Eng., 35(2): , Uli Fhrenberg, Axel Legy, nd Clus Thrne. The quntittive liner-time brnching-time spectrum. In FSTTCS, volume 13 of LIPIcs, pges Schloss Dgstuhl - Leibniz-Zentrum fuer Informtik, Uli Fhrenberg, Axel Legy, nd Louis-Mrie Tronouez. Specifiction theories for probbilistic nd rel-time systems. In From Progrms to Systems The Systems Perspective in Computing, volume 8415 of LNCS. Springer, In this volume. 12. Uli Fhrenberg, Clus R. Thrne, nd Kim G. Lrsen. Distnces for weighted trnsition systems: Gmes nd properties. In QAPL, volume 57 of Electr. Proc. Theor. Comput. Sci., pges , Hrld Fecher nd Heiko Schmidt. Compring disjunctive modl trnsition systems with n one-selecting vrint. J. Logic Alg. Progrm., 77(1-2):20 39, Ptrice Godefroid, Michel Huth, nd Rdh Jgdeesn. Abstrction-bsed model checking using modl trnsition systems. In CONCUR, volume 2154 of LNCS, pges Springer, Susnne Grf nd Joseph Sifkis. A logic for the description of non-deterministic progrms nd their properties. Inf. Control, 68(1-3): , Alexnder Gruler, Mrtin Leucker, nd Kthrin D. Scheidemnn. Modeling nd model checking softwre product lines. In FMOODS, volume 5051 of LNCS, pges Springer, Sören Holmström. A refinement clculus for specifictions in Hennessy-Milner logic with recursion. Forml Asp. Comput., 1(3): , Michel Huth, Rdh Jgdeesn, nd Dvid A. Schmidt. Modl trnsition systems: A foundtion for three-vlued progrm nlysis. In ESOP, volume 2028 of LNCS, pges Springer, Line Juhl, Kim G. Lrsen, nd Jiří Srb. Modl trnsition systems with weight intervls. J. Log. Algebr. Progrm., 81(4): , Kim G. Lrsen. A context dependent equivlence between processes. Theor. Comput. Sci., 49: , Kim G. Lrsen. Modl specifictions. In Automtic Verifiction Methods for Finite Stte Systems, volume 407 of LNCS, pges Springer, Kim G. Lrsen, Ulrik Nymn, nd Andrzej Wąsowski. On modl refinement nd consistency. In CONCUR, volume 4703 of LNCS, pges Springer, Kim G. Lrsen nd Bent Thomsen. A modl process logic. In LICS, pges IEEE Computer Society, Kim G. Lrsen nd Liu Xinxin. Eqution solving using modl trnsition systems. In LICS, pges IEEE Computer Society, Rdu Mrdre nd Alberto Policriti. A complete xiomtic system for processbsed sptil logic. In MFCS, volume 5162 of LNCS, pges Springer, 2008.

15 Prmetric nd Quntittive Extensions of Modl Trnsition Systems Sebstin Nnz, Flemming Nielson, nd Hnne Riis Nielson. Modl bstrctions of concurrent behviour. In SAS, volume 5079 of LNCS, pges Springer, Jen-Bptiste Rclet, Eric Bdouel, Albert Benveniste, Benoît Cillud, nd Roberto Psserone. Why re modlities od for interfce theories? In ACSD, pges IEEE, Sebstián Uchitel nd Mrsh Chechik. Merging prtil behviourl models. In FSE, pges ACM, 2004.