dierent process-lgebric theories in order to cpture dierent spects of system behvior; however, ech such formlism generlly includes the following chrct

Transcription

1 Process Algebr Rnce Clevelnd Deprtment of Computer Science P.O. Box 7534 North Crolin Stte University Rleigh, NC USA Scott A. Smolk Deprtment of Computer Science Stte University of New York t Stony Brook Stony Brook, NY USA April 7, 1999 Abstrct Process lgebr represents mthemticlly rigorous frmework for modeling concurrent systems of intercting processes. The process-lgebric pproch relies on equtionl nd inequtionl resoning s the bsis for nlyzing the behvior of such systems. This chpter surveys some of the key results obtined in the re within the setting of prticulr process-lgebric nottion, the Clculus of Communicting Systems (CCS) of Milner. In prticulr, the Structurl Opertionl Semntics pproch to dening opertionl behvior of lnguges is illustrted vi CCS, nd severl opertionl equivlences nd renement orderings re discussed. Mechnisms re presented for deducing tht systems re relted by the equivlence reltions nd renement orderings, nd dierent process-lgebric modeling formlisms re briey surveyed. Keywords: process lgebr, equtionl resoning, veriction, veriction tools, bisimultion, filures/testing reltions. 1 Introduction The term process lgebr encompsses collection of theories tht support mthemticlly rigorous (in)equtionl resoning bout systems consisting of concurrent, intercting processes. The eld grew out of seminl book due to Milner [34] in 1980 nd hs been n ctive re of reserch since then. In prticulr, reserchers hve developed number of 1

2 dierent process-lgebric theories in order to cpture dierent spects of system behvior; however, ech such formlism generlly includes the following chrcteristics. 1. A lnguge, or lgebr, is dened for describing systems. 2. A behviorl equivlence is introduced tht is intended to relte systems whose behvior is indistinguishble to n externl observer. 3. Equtionl rules, or xioms, re developed tht permit proofs of equivlences between systems to be conducted in syntx-driven mnner. Some formlisms include renement ordering, in lieu of n equivlence; in this cse, the theories llow one to determine if system is \greter thn or equl to" (i.e. renes) nother. The literture typiclly refers to ech theory s process lgebr; so the eld of process lgebr contins mny process lgebrs. Process lgebrs derive their motivtion from the fct tht system design often consists of severl dierent descriptions of the system involving dierent levels of detil. The behviorl equivlence or renement reltion provided by process lgebr my be used to determine whether these dierent descriptions conform to one nother. More speciclly, higher-level descriptions of system behvior my be relted to lower-level ones using the equivlence or renement ordering supplied by the lgebr. These reltions re typiclly substitutive, mening tht relted systems my be used interchngebly inside lrger system descriptions; this fcilittes compositionl system veriction, since low-level designs of system components my be checked in isoltion ginst their high-level designs. This chpter surveys some of the min fetures of process lgebr, nd it develops long the following lines. The next section introduces CCS, the process lgebr tht we use throughout the chpter to illustrte the principles we cover. Section 3 then introduces behviorl equivlences bsed on the notion of bisimultion, fundmentl concept due to Milner nd Prk. We then show how two of these equivlences my be given equtionl xiomtiztions. The section following then introduces the filures/testing renement reltions nd provides inequtionl xiomtiztions for them for CCS. Section 6 then shows how these reltions my be computed for nite-stte systems. The penultimte section surveys relted work, nd the nl one summrizes the contents of the chpter. 2 A Clculus of Communicting Systems This section introduces the syntx nd semntics of the process lgebr A Clculus of Communicting Systems (CCS). CCS will serve s vehicle for illustrting the dierent ingredients tht mke up process lgebr throughout the reminder of this chpter. Other process lgebrs re briey discussed in Section The Syntctic Form of CCS Processes CCS provides smll set of opertors tht my be used to construct system descriptions from denitions of subsystems. The bsic building blocks of these descriptions, nd indeed of 2

3 system denitions in ll existing process lgebrs, re ctions. Intuitively, ctions represent tomic, uninterruptible execution steps, with some ctions denoting internl execution nd others representing potentil interctions with its environment tht the system my engge in. Actions in CCS. A binry, synchronous model of process communiction underlies CCS, nd the structure of the set of ctions reects this design decision. Actions represent either inputs/outputs on ports or internl computtion steps. The former re sometimes clled externl, s they require interction from the environment in order to tke plce. To formlize these intuitions, let represent countbly innite set of lbels, or ports, not contining the distinguished symbol. Then n ction in CCS hs one of the following three forms., where 2, represents the ct of receiving signl on port., where 2, represents the ct of emitting signl on port. represents n internl computtion step. In wht follows we use A CCS to stnd for the set of ll CCS ctions; tht is, A CCS = [ f j 2 g [ fg: We lso buse nottion by dening = ; note tht is not vlid ction. We refer to the ctions nd, where 2, s complementry, s they represent the input nd output ction on the sme chnnel. The set A CCS? fg then contins the set of externl, or visible, ctions; the only internl ction is. CCS opertors. Hving dened the set A CCS of CCS ctions we now introduce the opertors the process lgebr provides for ssembling ctions into systems. In wht follows, we ssume tht p, p 1 nd p 2 denote CCS system descriptions tht hve previously been constructed, nd we lso ssume countbly innite set C of process vribles. CCS then includes seven dierent mechnisms for building systems. nil represent the terminted process tht hs nished execution. Given 2 A CCS, the prexing opertor : llows n ction to be \prepended" onto n existing system description. Intuitively, :p is cpble rst of n nd then behves like p. + represents choice construct. The system p 1 + p 2 oers the potentil of behving like either p 1 or p 2, depending on the interctions oered by the environment. j denotes prllel composition. The system p 1 jp 2 interleves the execution of p 1 nd p 2 while lso permitting complementry ctions of p 1 nd p 2 to synchronize; in this cse cse, the resulting composite ction is. 3

4 If L A CCS? fg then the restriction opertor nl permits ctions to be loclized within system. Intuitively, pnl behves like p except tht it is disllowed from intercting with its environment using ctions mentioned in L. Note tht cn never be restricted. The opertor [f] llows ctions in process to be renmed. Here f is function from A CCS to A CCS tht is required to stisfy the following two restrictions. { f() = { f() = f(). When this is the cse, f is clled renming. The system p[f] behves exctly like p except tht f is pplied to ech ction tht p wishes to engge in. If C 2 C then C represents vlid system provided tht dening eqution of the form C = p hs been given. Intuitively, C represents n \invoction" tht behves like p. This construct llows systems to be dened recursively. In process-lgebric prlnce, system descriptions built using the bove opertors re often referred to s terms or processes. We use P CCS to represent the set of ll CCS processes. As exmples, consider the following, where we ssume tht contins send, recv, msg, ck, get, put, get ck nd put ck. The term send:recv:nil represents system tht engges in sequence of two ctions: n \input" on the send chnnel, followed by n \output" on the recv chnnel. Consider the denition M = put:get:m + put ck:get ck:m This denes system M tht my be thought of s one-plce communiction buer: given \messge" on its put chnnel it delivers it on its get chnnel, nd similrly for cknowledgments. This exmple illustrtes how, lthough the version of CCS considered here does not explicitly support vlue-pssing, limited form of dt exchnge cn be implemented by encoding vlues in port nmes. Here M cn hndle two kinds of \dt": messges nd cknowledgments. Now consider the following denitions, where M is s dened previously. S = send:msg:ck:s R = msg:recv:ck:r P = (S[put=msg; get ck=ck] j M j R[get=msg; put ck=ck])nfget; put; get ck; put ckg P represents the CCS term for simple communictions protocol consisting of sender S, receiver R, nd medium M, grphicl depiction of which my be found in Figure 1. The sender repetedly ccepts \messges" on its send chnnel, outputs them 4

5 send recv S R msg ck msg ck put get_ck get put_ck M Figure 1: The rchitecture of smple communictions protocol. on its msg chnnel, nd then wits n cknowledgment on its ck chnnel. The receiver behves similrly: it wits messge on its msg chnnel, delivers it on its recv chnnel, nd then sends n cknowledgment vi its ck chnnel. The relbeling opertors re given in the form =b; c=d; : : :; intuitively, such relbeling chnges b (nd its inverse) to, d to c, etc. Actions not mentioned re unected. In this exmple the relbelings eect the \wiring" given in the gure. The restriction opertor ensures tht only the sender nd receive my interct directly with the medium. 2.2 The Opertionl Semntics of CCS Terms In the ccount so fr we hve relied on the reder's intuition to understnd the mening of the CCS opertors. To mke these menings precise, CCS nd other process lgebrs usully include n opertionl semntics tht is intended precisely to dene the \execution steps" tht processes my engge in. This semntics is usully specied in the form of ternry reltion,?!; intuitively, p?! p 0 holds if system p is cpble of engging in ction nd then behving like p 0. Process lgebrs such s CCS typiclly dene?! inductively using collection of inference rules for ech opertor. These rules hve the following form. premises conclusion (side condition) A rule sttes tht, if one hs estblished the premises, nd the side condition holds, then one my infer the conclusion. This presenttion style for opertionl semntics is often clled 5

6 SOS, for Structurl Opertionl Semntics, nd ws devised by Plotkin [39]. The reminder of this section covers the SOS rules for CCS nd shows how they my be used rigorously to chrcterize the behvior of CCS system descriptions. We group the rules on the bsis of the CCS opertors to which they pply. nil. The CCS process nil hs no rules; consequently, it is incpble of ny trnsitions. Prexing. The prexing opertor contins one rule. :p?! p This rule hs no premises, nd the conclusion sttes tht processes of the form :p my engge in nd therefter behve like p. Note tht the side condition is omitted; in such cses it is ssumed to be \true". Choice. The choice opertor hs two symmetric rules. p?! p 0 q?! q 0 p + q?! p 0 p + q?! q 0 These rules in essence stte tht system of the form p + q \inherits" the trnsitions of its subsystems p nd q. Prllel Composition. The prllel composition opertor hs three rules, the rst two of which re symmetric. p?! p 0 q?! q 0 pjq?! p 0 jq pjq?! pjq 0 These rules indicte tht j interleves the trnsitions of its subsystems. The next rule llows processes connected by j to interct. p?! p 0 ; q?! q 0 pjq?! p 0 jq 0 According to this rule, subsystems my synchronize on complementry ctions (i.e. inputs nd outputs on the sme port). Note tht the ction produced s the result of the synchroniztion is ; since is undened, this ensures tht synchroniztions involve only two prtners. Restriction. The restriction opertor hs one rule. p?! p 0 pnl?! p 0 nl (; 62 L) This rule, which includes side condition, only llows ctions not mentioned in L (or whose complements re not in L) to be performed by pnl. Restriction in eect \loclizes" ctions in L, since the opertor forbids the system's environment from intercting with the system using them. 6

7 Relbeling. The relbeling opertion hs one rule. p?! p 0 p[f] f()?! p 0 [f] As the intuitive ccount bove suggests, p[f] engges in the sme trnsitions s p, the dierence being tht the ctions re relbeled vi f. Process Vribles. The behvior of process vribles is given by one rule. p?! p 0 C?! (C = p) p 0 This rule sttes tht system C behves like its \body", p, provided tht C hs been provided with denition of the form C = p. Exmples. As stted bove, the SOS rules for CCS dene the single-step trnsitions tht CCS processes my engge in. As one exmple, consider the medium process M dened bove. Using the prexing rule, one my infer the trnsition put:get:m?! put get:m Using this fct nd one of the rules for +, one my therefore infer tht put:get:m + put ck:get ck:m?! put get:m This observtion nd the rule for constnts then permit the following trnsition to be inferred. M?! put get:m Using similr lines of resoning, one my lso deduce tht P?! send ((msg:ck:s)[put=msg; get ck=ck] j M j R[get=msg; put ck=ck])nfget; get ck; put; put ckg Note tht this is the only trnsition vilble to P, since the trnsitions of M nd R ll involve ctions in the restriction set. 2.3 CCS, Processes nd Lbeled Trnsition Systems The denition of?! just given llows CCS processes to be viewed s stte mchines of certin type. To begin with, we show how CCS my be viewed s structure clled lbeled trnsition system consisting of collection of possible system sttes nd trnsitions. Denition 2.1 A lbeled trnsition system (LTS) is triple hq; A;?!i, where Q is set of sttes, A is set of ctions, nd?! Q A Q is trnsition reltion. 7

8 Some denitions of LTS lso designte strt stte. We refer to lbeled trnsitions of this form (i.e. qudruples of the form hq; A;?!; q S i where q S 2 Q is the strt stte) s rooted lbeled trnsition systems. Perhps surprisingly, the denitions of this chpter show tht CCS my be viewed s single LTS. Recll tht P CCS represents the (innite) set of syntcticlly vlid CCS system denitions, nd let?! CCS be the trnsition reltion dened in the previous subsection. Then hp CCS ; A CCS ;?! CCS i stises the denition of LTS. This observtion lso holds for other process lgebrs nd hs two consequences. The rst is tht certin denitions, such s those for behviorl equivlences nd renement orderings, my be given in lngugeindependent mnner by dening them with respect to LTS's. The second consequence is tht tht individul system descriptions my be \converted" into rooted LTS's. Mthemticlly, for ny CCS system p the qudruple hp CCS ; A CCS ;?! CCS ; pi constitutes rooted LTS. As P CCS is innite this observtion is only of theoreticl interest until one observes tht not every stte in P CCS is \rechble" from p vi?! CCS. Consequently, we my insted dene nother LTS, M p, consisting only of CCS terms rechble from p vi sequences of trnsitions. If M p contins only nitely mny sttes, then it my be nlyzed using lgorithms for mnipulting nite-stte mchines. As n exmple, Figure 2 contins the nite-stte rooted LTS corresponding to the communiction protocol P described bove. 3 Behviorl Congruences for CCS Process lgebrs usully use notion of behviorl congruence s bsis for system nlysis. A congruence for n lgebr is n equivlence reltion (i.e. reltion tht is reexive, symmetric nd trnsitive) tht lso hs the substitution property: equivlent systems my be used interchngebly inside ny lrger system. Formlly, dene context C[ ] to be system description with \hole", [ ]; given system description p, then, C[p] represents the system obtined by \lling" the hole with p. Then n equivlence is congruence for lnguge if, whenever p q, then C[p] C[q] for ny context C[ ] built using opertors in the lnguge. It should be noted tht reltions tht re congruences for some lnguges re not congruences for others. In this section we study congruences for CCS with view towrd dening reltion tht reltes systems with respect to their \observble" behvior. In ech cse we rst dene n equivlence reltion on sttes in n rbitrry LTS; since CCS my be viewed s n LTS, these reltions my then be used to relte CCS system descriptions. We then consider the suitbility of the equivlence from the stndpoint of the observble behvior to which it is sensitive nd study whether or not the reltion is congruence for CCS. In the rst prt of the section we mke no specil llownce for the \unobservbility" of the ction, deferring its tretment to lter. 3.1 The Indequcy of Trce Equivlence Stte mchines hve well-studied equivlence, lnguge equivlence, tht stipultes tht two mchines re equivlent if they ccept the sme sequences of symbols. Rooted lbeled trnsition systems do not contin \ccepting sttes" per se, nd consequently the notion 8

9 (S[...] M R[...})\{...} send ((msg.ck.s)[...] M R[...])\{...} τ ((ck.s)[...] get.m R[...])\{...} τ τ ((ck.s)[...] M ( recv.ck.r)[...])\{...} recv ((ck.s)[...] M ( ck.r)[...])\{...} τ ((ck.s)[...] get_ck.m R[...])\{...} Figure 2: The stte mchine for P. 9

10 of lnguge equivlence from nite-stte mchine theory cnnot be directly pplied. However, if we identify every stte in rooted LTS s being ccepting, then the \lnguge" of the mchine contins the execution sequences, or \trces", tht mchine my engge in. Consequently, resonble rst ttempt t dening behviorl equivlence for CCS nd other process lgebrs might be to relte two system descriptions (i.e. sttes in the LTS hq; A;?!i exctly when the mchines for them hve exctly the sme trces. Before formlizing these notions we rst review some concepts from the theory of nite sequences. If A is set, then A consists of the set of (possibly empty) nite sequences of elements of A. We use to represent the empty sequence. One my now dene trces, nd trce equivlence, s follows. Denition 3.1 Let hq; A;?!i be lbeled trnsition system. 1. Let s = 1 : : : n 2 A be sequence of ctions. Then q q 0 ; : : : ; q n such tht q = q 0, q i i?! q i+1, nd q 0 = q n. s?! q 0 if there re sttes 2. s is strong trce of q if there exists q 0 such tht q the set of ll strong trces of q. 3. p S q exctly when S(p) = S(q). s?! q 0. We use S(q) to represent We use the term strong trces becuse the denition given bove does not distinguish between internl nd externl ctions; ll my pper in strong trce. In contrst, the trditionl denition of trces trets ctions in specil mnner. Since CCS is lbeled trnsition system whose sttes re system descriptions we my pply the denition of S to CCS systems. Unfortuntely, S suers from severe deciencies for CCS nd other lnguges tht permit the denition of nondeterministic systems, s the following exmples illustrte. 1. Let p be :b:nil + :c:nil nd q be :(b:nil + c:nil ). Then p S q, s S(p) = S(q) = f; ; b; cg. However, fter n -trnsition q cn perform both b nd c, wheres p must reject one or the other of these possibilities fter ech of its (two) -trnsitions. 2. Let C 1 = :C 1 nd C 2 = :C 2 + :nil. Then C 1 S C 2, nd yet C 2 cn rech \dedlocked" stte fter n -trnsition (i.e. stte tht is incpble of ny trnsitions) while C 1 cnnot. The trouble with trce equivlence nd nondeterministic systems is tht even though two systems hve the sme trces, they my go through inequivlent sttes in performing them. (This sitution cnnot occur in deterministic systems.) In prticulr, trce equivlent systems cn hve dierent dedlocking behvior. 10

11 3.2 Bisimultion Equivlence The lst observtion in the previous section suggests tht n pproprite equivlence for CCS, nd indeed for ny lnguge permitting the denition of nondeterministic systems, ought to hve recursive vor: execution sequences for equivlent systems ought to \pss through" equivlent sttes. This intuition underlies the denition of bisimultion, or strong equivlence. The nme of the equivlence stems from the fct tht it is dened in terms of specil reltions clled bisimultions. Denition 3.2 Let hq; A;?!i be n LTS. A reltion R Q Q is bisimultion if, whenever hp; qi 2 R, then the following conditions hold for ny, p 0 nd q if p?! p 0 then q?! q 0 for some q 0 such tht hp 0 ; q 0 i 2 R. 2. if q?! q 0 then p?! p 0 for some p 0 such tht hp 0 ; q 0 i 2 R. Intuitively, if two systems re relted by bisimultion, then it is possible for ech to simulte, or \trck", the other's behvior: hence the term bisimultion. More speciclly, for reltion to be bisimultion, relted sttes must be ble to \mtch" trnsitions of ech other by moving to relted sttes. Two sttes re then bisimultion equivlent exctly when bisimultion my be found relting them. Denition 3.3 Systems p nd q re bisimultion equivlent, or bisimilr, if there exists bisimultion R contining hp; qi. We write p q whenever p nd q re bisimilr. Since CCS my be viewed s n LTS, one my use to relte CCS processes. As exmples, we hve the following. 1. :b:nil + :b:nil :b:nil 2. :b:nil + :c:nil 6 :(b:nil + c:nil) 3. C 1 6 C 2. Bisimultion equivlence hs number of plesing properties. Firstly, for ny lbeled trnsition system it is indeed n equivlence; tht is, the reltion is reexive, symmetric nd trnsitive. Secondly it cn be shown in precise sense tht two equivlent systems must hve the sme \dedlock potentil"; this point is ddressed in more detil below. Thirdly, implies S nd coincides with it if the LTS is deterministic in the sense tht every stte hs t most one outgoing trnsition per ction. Finlly, is congruence for CCS; if p q then p nd q my be used interchngebly inside ny lrger system. However, does suer from mjor w from the perspective of CCS nd other process lgebrs llowing synchronous execution: it is too sensitive to internl computtion. In prticulr, the denition does not tke ccount of the specil sttus tht hs vis vis other ctions. For exmple, the systems ::b:nil nd :b:nil re not bisimultion equivlent, even though n externl observble cnnot detect the dierence between them. Nevertheless, hs been studied extensively in the literture, nd for process lgebrs in which internl computtion in one component cn indeed ect the behvior of other components, it is resonble bsis for veriction. 11

12 Dedlock, Logicl Chrcteriztions nd The preceding discussion sttes tht reltes systems on the bsis of their reltive \dedlock potentils". The reminder of this subsection mkes this sttement precise by dening logic, clled the Hennessy-Milner Logic (HML) [26], tht permits the formultion of simple system properties, including potentils for dedlock. The logic lso chrcterizes in the following sense: two systems re bisimilr if nd only if they stisfy exctly the sme formuls in the logic. Syntx of HML. The denition of HML is prmeterized with respect to set A of ctions. Given such set, the syntx of HML formuls cn be given vi the following grmmr. ::= tt j j j j j ^ _ We use for the set of ll well-formed HML formuls. The constructs in the logic my be understood s follows. First, it should be noted tht formuls re intended to be interpreted with respect sttes in lbeled trnsition system. Then tt nd represent the constnts \true" nd \flse" tht hold of ny stte nd no stte, respectively, while ^ nd _ denote conjunction (\nd") nd disjunction (\or"), respectively. The nl two opertors re referred to s modlities, s they permit sttements to be mde bout the trnsitions emnting from stte; thus HML is modl logic. A stte stises hi if trget stte of one of its -trnsitions stises, while [] holds of stte if the trget sttes of ll of its -trnsitions stisfy. Semntics of HML. In order to formlize the previous informl discussion, we rst x lbeled trnsition system L = hq; A;?!i hving the sme ction set s HML. We then dene reltion j= L Q ; intuitively, q j= L should hold if stte q \stises". The forml denition is given inductively s follows. q j= L tt for ny q 2 Q. q j= L for no q 2 Q. hi [] q j= L 1 ^ 2 if nd only if q j= L 1 nd q j= L 2. q j= L 1 _ 2 if nd only if q j= L 1 or q j= L 2. q j= L hi if nd only if q?! q 0 nd q 0 j= L for some q 0 2 Q. q j= L [] if nd only if for every q 0 such tht q?! q 0, q 0 j= L. 12

13 This denition includes some subtleties tht deserve comment. To begin with, formul [] is stised by ny stte not hving n -trnsition; such sttes vcuously fulll the requirement imposed by []. Indeed, stte with no -trnsitions stises [] for ny. These fcts lso imply tht stte incpble of ny ction in the set f 1 ; : : : ; n g will stisfy the formul [ 1 ] ^ ^ [ n ]. If such stte occurs in n environment tht requires one of these ctions, then dedlock results. In relted vein, stte stises hbitt if nd only if it hs n b-trnsition; more generlly, given (nonempty) sequence of ctions b 1 : : : b m, stte includes b 1 : : : b m s one of its strong trces if nd only if the stte stises the formul hb 1 i hb m itt. Finlly, consider stte stisfying formul of the form hb 1 i hb m i([ 1 ] ^ ^ [ n ]): Such stte stises this formul if it cn engge in the sequence b 1 : : : b m nd rrive t stte tht rejects oers for interction involving ny of 1 ; : : : ; n. In n environment cpble of exercising the sequence b 1 : : : b m nd then requiring n interction involving one of 1 ; : : : ; n, the given stte could dedlock. It is in this sense tht HML permits the formultion of properties expressing potentils for dedlock. HML nd. The reltionship between HML nd is cptured by the following theorem tht sttes tht HML chrcterizes for lbeled trnsition systems tht re imge-nite. An LTS is imge-nite if every stte in the LTS hs t most nitely mny trnsitions shring the sme ction lbel. In prctice lmost ll lbeled trnsition systems stisfy this requirement; in prticulr, CCS does provided the denitions of process vribles obey smll restriction. Theorem 3.4 Let L = hq; A;?!i be n imge-nite LTS, nd let p; q 2 Q. Then p q if nd only if for ll HML formuls, either p j= L nd q j= L or p 6j= L nd q 6j= L. On the one hnd, this result nd the previous discussion substntites the clim tht bisimultion equivlence requires equivlent systems to hve the sme \dedlock potentils". On the other hnd, the theorem provides useful mechnism for explining why two systems fil to be equivlent; one need only present formul stised by one system nd not the other. The following provides exmples illustrting this ltter point in the context of CCS. Consider the system p given by :b:nil+:c:nil nd the system q given by :(b:nil+c:nil). Since p 6 q there must be formul stised by one nd not the other. One such formul is hi[b], which is stised by p but not by q. Consider C 1 nd C 2 given bove. The formul hi[] distinguishes them, s C 2 stises it nd C 1 does not. 3.3 Observtionl Equivlence nd Congruence for CCS This subsection presents corsening of bisimultion equivlence tht is intended to relx the sensitivity of the former to internl computtion. The denition of this reltion relies on the introduction of so-clled \wek" trnsitions. 13

14 Denition 3.5 Let hq; A;?!i be n LTS with 2 A, nd let q 2 Q. 1. If s 2 A then ^s 2 (A?fg) is the ction sequence obtined by deleting ll occurrences of from s. 2. Let s 2 (A? fg). Then q s =) q 0 if there exists s 0 such tht q s0?! q 0 nd s = ^s 0. Intuitively, ^s returns the \visible content" (i.e. non- elements) of sequence s; in prticulr, s if 2 A then ^ = if =, while ^ = if 6=. In ddition, q =) q 0 if q cn perform sequence of trnsitions with the sme visible content s s nd evolve to q 0. In this cse note tht the sequence of trnsitions tht is performed is the sme s s except tht it potentilly includes n rbitrry number of trnsitions in between the visible ctions of s. In prticulr, q =) q 0 if sequence of -trnsitions leds from q to q 0, while for single visible ction, q =) q 0 if q cn perform n, possibly \surrounded" by some internl computtion, in order to rrive t q 0. We my now dene wek bisimultions s follows. Denition 3.6 Let hq; A;?!i be n LTS, with 2 A. Then reltion R Q Q is wek bisimultion if, whenever hp; qi 2 R, then the following hold for ll 2 A nd p 0 ; q 0 2 Q. 1. If p?! p 0 ^ then q =) q 0 for some q 0 such tht hp 0 ; q 0 i 2 R. 2. If q?! q 0 then p =) ^ p 0 for some p 0 such tht hp 0 ; q 0 i 2 R. Sttes p nd q re observtionlly equivlent, or wekly equivlent, or wekly bisimilr, if there exists wek bisimultion R contining hp; qi. When this is the cse we write p q. A wek bisimultion closely resembles regulr bisimultion; the only dierence lies in the fct tht systems my use wek trnsitions to simulte norml trnsitions in the other system. As CCS is lbeled trnsition system whose ction set contins, the denition of my be used to relte CCS system descriptions. Doing so leds to the following observtions. ::b:nil :b:nil. For ny p, :p p. Let Svc = send:recv:svc. Then P Svc, where P is the simple communictions protocol described in the previous section. The lst exmple illustrtes the power of equivlences in relting system designs t dierent levels of bstrction, since Svc could be thought of s \high-level" design tht P is intended to conform to. Even though it ignores internl computtion observtionl equivlence still enjoys similr degree of dedlock-sensitivity to bisimultion equivlence: vrint of HML cn be dened tht chrcterizes in the sme wy tht HML chrcterizes. (This logic replces the hi nd [] modlities of HML by two new opertors, hhii nd [[]]; stte 14

15 q j= L hhii if there exists q 0 such tht q =) q 0 nd q 0 j= L, nd similrly for [[]].) Consequently it would pper to be vible cndidte for relting CCS system descriptions. Unfortuntely, however, it is not congruence for CCS. To see why, consider the context C[ ] given by [ ] + b:nil. It is esy to estblish tht p q, where p is given by ::nil nd q by :nil. However, C[p] 6 C[q]. To see this, note tht C[p]?! :nil. This trnsition must be mtched by wek -lbeled trnsition from C[q]. The only such trnsition C[q] hs is C[q] =) C[q]. However, :nil 6 C[q], since the ltter cn engge in b-lbeled trnsition tht cnnot be mtched by the former. This defect of rises from the interply between + nd the initil internl computtion tht system might engge in; in prticulr, the only CCS opertor tht \breks" the congruence-hood of is +. Some reserchers resonbly suggest tht this is n rgument ginst including + in the lnguge. Milner [34, 36] dopts nother point of view tht we pursue in the reminder of this section, nd tht is to focus on nding the lrgest CCS congruence C tht implies. Such lrgest congruence is gurnteed to exist [26]. Denition 3.7 Let hq; A;?!i be n LTS with 2 A, nd let p; q 2 Q. Then p C q if the following hold for ll 2 A nd p 0 ; q 0 2 Q. 1. If p?! p 0 then q =) q 0 for some q 0 such tht p 0 q If q?! q 0 then p =) p 0 for some p 0 such tht p 0 q 0. Some remrks bout this reltion re in order. Firstly, it should be noted tht for p C q to hold, ny -trnsition of p must be mtched by =)-trnsition of q; in prticulr, this wek trnsition must consist of non-empty sequence of -trnsitions. Secondly, the denition is not recursive: the trgets of initil mtching trnsitions need only be relted by. Finlly, it indeed turns out tht C is congruence for CCS nd tht it is the lrgest CCS congruence entiling. Tht is, p C q implies p q, nd for ny other congruence R such tht p R q implies p q, p R q lso implies p C q. As exmples, we hve the following. 1. ::b:nil C :b:nil 2. ::nil 6 C :nil, since the trnsition of the ltter. 3. For ny p; q, if p q then :p C :q. 4. Svc C P, where Svc nd P re s dened bove.?! trnsition of the former cnnot be mtched by =) 4 Equtionl Resoning in CCS In ddition to denitions of behviorl congruences, process lgebrs trditionlly provide equtionl xiomtiztions tht permit equivlences to be estblished by mens of simple syntctic mnipultions. This section presents such xiomtiztions for CCS for both nd C. 15

16 Tble 1: Axiomtizing for Bsic CCS: Rule Set E 1. (A1) x + y = y + x (A2) x + (y + z) = (x + y) + z (A3) x + nil = x (A4) x + x = x 4.1 Axiomtizing We present the xiomtiztion of for CCS in stges by considering successively lrger frgments of CCS. The rst, nd most bsic, subset of CCS we investigte we term \Bsic CCS" Axiomtizing Bsic CCS Bsic CCS contins only the nil, prexing nd + opertors of CCS, nd hence it only llows the denition of \sequentil" (i.e. no prllelism) terminting systems. The xiomtiztion of for Bsic CCS consists of the four rules given in Tble 1. Some words of explntion bout these xioms re in order. Firstly, nd for convenience, ech rule we present hs nme; in this cse, the rules re nmed (A1){(A4). Secondly, ech rule contins vribles tht re intended to be rbitrry terms in the lnguge under considertion. In (A2), for exmple, x; y nd z re vribles, nd the rule should be red s sserting tht regrdless of the Bsic CCS terms substituted for these vribles, the indicted equivlence holds. Finlly, xioms re used to construct equtionl proofs s illustrted by the following exmple. :(b:nil + nil) + (:nil + :b:nil) = :b:nil + (:nil + :b:nil) by (A3) = :b:nil + (:b:nil + :nil) by (A1) = (:b:nil + :b:nil) + :nil by (A2) = :b:nil + :nil by (A4) This proof estblishes tht :(b:nil + nil) + (:nil + :b:nil) = :b:nil + :nil in four steps, where ech step represents the \ppliction" of rule to subterm, yielding new term. The development of such equtionl proofs typiclly relies on four rules of inference reecting the fct tht = is reexive, symmetric, nd trnsitive nd tht equl terms my be used interchngebly; these rules implicitly support the construction of proofs such s the one bove. We will not sy more bout this mtter. When proof tht terms t 1 nd t 2 exists using xioms in set E, we write E ` t 1 = t 2. Thus, E 1 ` :(b:nil + nil) + (:nil + :b:nil) = :b:nil + :nil; where E 1 contins the four rules in Tble 1. Returning to the rules in Tble 1, Rules (A1) nd (A2) ssert tht + is commuttive nd ssocitive, respectively. Rule (A3) indictes tht nil is n identity element for +; these rst three rules re sometimes referred to s the monoid lws, monoid being ny mthemticl 16

17 Tble 2: Axiomtizing for Bsic Prllel CCS: Rule Set E 2. (A1){(A4) from Tble 1 P P (Exp) ( i2i i :x i ) j ( j2j b j :y j ) = P P P P P i2i i :(x i j j2j b j :y j ) + j2j b j :(( i2i i :x i ) j y j ) + :(x f (i;j)j i =b j g i j y j ) structure obeying these xioms. The nl rule is often clled the bsorption lw, s it llows multiple copies of the sme summnd to be \bsorbed" into one. Mettheory. two questions. Given proposed xiomtiztion for n equivlence reltion, one my sk 1. Is the xiomtiztion sound? Tht is, re ll proved equlities true? 2. Is the xiomtiztion complete? Tht is, re ll true equlities provble? Soundness is n bsolute necessity; n unsound proof system is worse thn useless, since it llows the derivtion of untrue informtion. Completeness is highly desirble, since once proof system is shown complete, one knows tht there cn be no \missing" xioms. The following results estblish the soundness nd completeness of the xioms in Tble 1 for over Bsic CCS. Theorem 4.1 (Soundness) Let t 1 nd t 2 be terms in Bsic CCS, nd suppose tht E 1 ` t 1 = t 2. Then t 1 t 2. Theorem 4.2 (Completeness) Let t 1 nd t 2 be terms in Bsic CCS such tht t 1 t 2. Then E 1 ` t 1 = t Axiomtizing Bsic Prllel CCS The next frgment of CCS we present n xiomtiztion for extends Bsic CCS with the inclusion of the prllel composition opertor, j. We cll this frgment Bsic Prllel CCS. As it turns out Rules (A1){(A4) remin sound for Bsic Prllel CCS, but they re obviously not complete, since none of the rules mentions j. In order to devise complete xiomtiztion for this subset of CCS we therefore must dd xioms for j. The new xiomtiztion is presented in Tble 2. The single new xiom, (Exp), is often referred to s the expnsion lw, s it shows how terms involving j t the top level my be \expnded" into ones involving prexing nd summtion. This xiom is the most complicted rule for CCS, nd it deserves further commentry. Firstly, the P nottion needs explntion. Rules (A1) nd (A2) indicte tht + is commuttive nd ssocitive. This mens tht expressions of the form t t n, while not strictly speking expressions since they re not fully prenthesized, nevertheless 17

18 hve precise mening, since ll prenthesiztions of such expressions re equivlent. More generlly, given nite index set I nd n I-indexed set of terms of the form t i, we my dene P i2i t i s nil if I is empty nd s the summtion of ll the t i 's otherwise. The second feture of (Exp) is tht it my only be pplied to term t 1 jt 2 if both t 1 nd t 2 hve specil form: nmely, ech must be summtion of terms whose outermost opertor involves prexing. Techniclly speking, (Exp) is not single xiom but n xiom schem, with ech dierent vlue of I nd J yielding dierent xiom. Finlly, the right-hnd side of (Exp) consists of three summnds, ech corresponding to dierent SOS rule for j. The rst summnd llows the left subterm to \move" utonomously, nd the second permits the sme behvior from the right subterm. The third summnd hndles possible synchroniztions. To see how (Exp) is used in eqution proofs, consider the following exmple showing tht E 2 ` nil j b:nil = b:nil; recll tht nil is the sme s P i2; t i. nil j b:nil = nil + b:(nil j nil) + nil by (Exp) = b:(nil j nil) by (A3) twice = b:(nil + nil + nil) by (Exp) = b:nil by (A3) twice Indeed, for ny term t in Bsic Prllel CCS it follows tht E 2 ` nil j t = t. It my lso be shown tht for ny terms t 1 ; t 2 nd t 3 E 2 ` t 1 jt 2 = t 2 jt 1 nd E 2 ` t 1 j(t 2 jt 3 ) = (t 1 jt 2 )jt 3 ; consequently, j is commuttive nd ssocitive. Finlly, s the strict ppliction of (Exp) results in mny occurrences of nil s summnd, these nil's re suppressed in prctice, since they my be removed by pplying (A3) ppropritely. It my be shown tht E 2 is sound nd complete xiomtiztion of for Bsic Prllel CCS Axiomtizing for Finite CCS The next frgment of CCS we xiomtize includes ll opertors except for process vribles; the literture refers to this frgment s Finite CCS. Finite CCS extends Bsic Prllel CCS with the restriction nd relbeling opertors; the xioms for this subset of CCS pper in Tble 3. The xioms for nl nd [f] only explin how these opertors interct with nil, prexing nd +. Tht no rules re needed dening the interction between j nd nl, or nl nd [f], is consequence of the fct tht the innermost occurrences of these so-clled sttic opertors (with nil, prexing nd + being the dynmic ones) cn be eliminted by repeted use of the lws for the opertor in conjunction with (A1){(A4). This rgument my be formlized nd used to show tht rule set E 3 constitutes sound nd complete xiomtiztion of for Finite CCS Rules for Recursive Processes In order to xiomtize full CCS, we need rules for resoning bout terms tht include process vribles. Unfortuntely, results from computbility theory imply tht no complete xiom- 18

19 Tble 3: Axiomtizing for Finite CCS: Rule Set E 3. (A1){(A4) from Tble 1; (Exp) from Tble 2 (Res1) nilnl = nil ( nil if ; 2 L (Res2) (:x)nl = :(xnl) otherwise (Res3) (x + y)nl = xnl + ynl (Rel1) nil[f] = nil (Rel2) (:x)[f] = f():(x[f]) (Rel3) (x + y)[f] = x[f] + y[f] tiztion cn exist for for full CCS. 1 However, two useful heuristics hve been developed for hndling process vribles, nd we review these here. Both techniques tke the form of inference rules nd re therefore similr in form to the SOS rules used to dene the opertionl semntics of CCS. The rst rule, clled the unrolling rule, sttes tht process invoction is equivlent to the body of the invoction. (Unr) C = p C = p The second inference rule is often clled the unique xpoint induction principle, nd stting it relies on introducing the notion of eqution nd solution. Given vrible X nd CCS term t potentilly contining X, such tht t most X ppers \free" in t, 2 we cll the expression X = t n eqution. A CCS process p is solution to X = t if nd only if p t[p=x], where t[p=x] is the CCS term obtined by replcing ll occurrences of vrible X by p. An eqution hs unique solution up to if for ny two solutions p nd q to the eqution, p q. We my now formulte the unique xpoint induction rule s follows. (UFI) p = t[p=x] q = t[q=x] p = q (X = t hs unique solution) This rule llows one to conclude tht two terms re equl, provided one cn prove tht they re both solutions to the sme eqution nd the eqution hs unique solution. A couple of comments bout (UFI) re in order. Firstly, every eqution X = t hs solution: given denition X = t, it is esy to see tht process X is solution of X = t. Secondly, (UFI) is only useful insofr s one my redily identify when equtions hve unique solution. One such clss of equtions, nd lrge one t tht, cn be dened s follows. 1 The set of equlities one cn prove using ny xiomtiztion cn only be recursively enumerble; however, for full CCS is known not to be recursively enumerble. 2 For the present discussion, vribles only occur free; i.e. they re not bounded by xed-point opertor. See [36] for further detils. 19

20 Tble 4: Axiomtizing C for Finite CCS: Rule Set E 4. (A1){(A4) from Tble 1; (Exp) from Tble 2; (Res1){(Res3), (Rel1){(Rel3) from Tble 3 ( 1) ::x = :x (2) x + :x = :x (3) :(x + :y) = :(x + :y) + :y Denition 4.3 Let X be vrible, nd t be CCS term involving X. Then X is gurded in t if every occurrence of X in t flls within the scope of prex opertor. For exmple, X is gurded in :X nd :Xj(b:(X + c:nil)), but it is not gurded in X + b:x. We now hve the following result. Theorem 4.4 Let X be gurded in t. Then eqution X = t hs unique solution up to. As n ppliction of (Unr) nd (UFI), suppose we wish to prove tht A nd B re bisimilr, where A = :A nd B = ::B. Consider the eqution X = ::X. We cn show tht both A nd B re solutions to this eqution: A = :A by (Unr) = ::A by (Unr) B = :B by (Unr) Since X is gurded in ::X, X = ::X hs unique solution, nd consequently using (UFI) one my conclude tht A = B. 4.2 Axiomtizing C This section presents n xiomtiztion for C nd CCS. Following the development in the previous subsection, we rst consider the Finite CCS frgment nd then full CCS Axiomtizing Finite CCS To begin with, it should be noted tht the xioms in rule set E 3 of Tble 3 re lso sound for C, since whenever p q it immeditely follows tht p C q. In order to obtin full xiomtiztion for C, then, we need only dd xioms reecting the specil sttus of the ction in this congruence. One tempting xiom to dd would be x = :x; however, this is not sound for C, since it would llow one to prove tht ::nil = :nil, which is not vlid. The correct rules re listed in Tble 4 nd re often clled the lws. Rule ( 1) llows for the \bsorption" of ctions tht immeditely follows prexing opertions. Rule ( 2) is more subtle, nd my be understood s follows. First, note tht 20

21 ny strong trnsition of :x is lso strong trnsition of x + :x. Secondly, ny strong trnsition of x + :x, including ny -trnsition, my be mtched by n pproprite wek trnsition in :x. The nl rule, (3) is perhps the most dicult to interpret; note tht the strong trnsition :(x + :y) + :y?! y of the right-hnd side my however be mtched by the wek trnsition :(x + :y) =) y of the left-hnd side. Somewht surprisingly, these rules suce; the xiomtiztion E 4 is sound nd complete for C nd Finite CCS Axiomtizing Full CCS The sme observtions for lso hold for C vis vis sound nd complete xiomtiztions: none cn exist. The (Unr) nd (UFI) rules nevertheless still hold, lthough the chrcteriztion of which equtions hve unique xpoints becomes somewht more complex; gurdedness no longer suces. To see this, consider the eqution X = :X. X is gurded in :X, nd yet ny process cpble of n initil ction is solution to this eqution up to C. In prticulr, ::nil C :::nil nd :b:nil C ::b:nil, nd yet ::nil 6 C :b:nil. One potentil solution to this problem is to require stronger condition thn gurdedness in equtions. Denition 4.5 Let X be vrible nd t CCS term involving X. Then X is strongly gurded in t if every occurrence of X flls within the scope of prexing opertor where 6=. Tht is, X is strongly gurded in t if prex opertor involving visible ction \gurds" ech occurrence of X in t. Note tht X is not strongly gurded in :X. However, even if X is strongly gurded in t it does not follow tht X = t hs unique solution up to C. To see this, consider the eqution X = (:X j :nil)nfg: X is strongly gurded in the right-hnd side of the eqution, nd yet it cn be shown tht e.g. :b:nil nd :c:nil re both solutions. We my nevertheless x this problem by requiring the following. Denition 4.6 Let X be vrible nd t CCS term involving X. Then X is sequentil in t if no occurrence of X in t flls within the scope of prllel composition opertor. As exmples, X is sequentil in :X nd :X + (b:nil j c:nil) but not sequentil in :X j b:nil. The following cn now be proved. Theorem 4.7 Let X = t be n eqution with X strongly gurded nd sequentil in t. Then X = t hs unique solution up to C. 21

22 We conclude this section with n extended exmple illustrting the use of the xioms. Recll the simple communictions protocol P given in Section 2.1 nd the speciction Svc in Section 3.3. We my estblish tht E 4 [ f(unr); (UFI)g ` P = Svc s follows. First note tht X is strongly gurded nd sequentil in send:recv:x nd consequently hs unique solution up to C. Therefore, we need only show tht both P nd Svc re solutions to this eqution; then, by (UFI), P = Svc. Now, Svc = send:recv:svc by (Unr) so Svc is solution. As for P, we cn prove tht P = (S[put=msg; get ck=ck] j M j R[get=msg; put ck=ck])nfget; put; get ck; put ckg using (Unr), so it suces to prove tht the right-hnd side is solution to the given eqution. The proof of this my be found in Figure 3. 5 Renement Orderings for CCS This chpter hs so fr concentrted on the role of behviorl equivlences in process lgebr in generl, nd CCS in prticulr. We now shift our ttention to renement orderings, nd to prticulr clss of renement orderings tht re often referred to s the filures/testing orderings. This section presents denition of these orderings nd gives xiomtiztions for them for CCS. 5.1 The Filures/Testing Orderings The motivtion for the filures/testing orderings rises from two sources. On the one hnd, equivlences sometimes impose overly severe restrictions on designer dening lowerlevel design tht is intended to implement higher-level one. In prticulr, equivlences require tht the behviors of the designs be identicl; this precludes higher-level design oering severl possibilities for behvior or including \don't-cre points". This suggests tht n ordering in which \more deterministic" system is lrger, or \better", thn less deterministic one would be desirble. On the other hnd, while nd C bstrct from internl computtion nd re sensitive to dedlock, it cn be rgued tht they re overly sensitive to unobservble dierences in the brnching structure of systems. As n exmple, consider the two CCS denitions P = :b:c:nil + :b:d:nil nd Q = :(b:c:nil + b:d:nil). These two systems re not relted by ; the formul [[]]hhbiihhciitt is stised by the ltter nd not the former. However, user ought not to be ble to distinguish them, since to user it does not mtter when the nondeterministic choice tht ultimtely elimintes the possibility of c or d is mde. The filures [12, 27] nd testing [19, 25] orderings dier substntilly in their pproches to ddressing these issues, nd yet the resulting orderings turn out to coincide. In this section we follow the filures presenttion given in [32] becuse it requires the introduction of less nottion given the mchinery we hve lredy developed. We need the following denitions. 22

23 (S[put=ck; get ck=ck] j M j R[get=msg; put ck=ck])nfget; put; get ck; put ckg = send: ((msg:ck:s)[put=ck; get ck=ck] j M j R[get=msg; put ck=ck])nfget; put; get ck; put ckg) by (Exp), (Rel1){(Rel3), (Res1){(Res3) = send:: ((ck:s)[put=ck; get ck=ck] j (get:m) j R[get=msg; put ck=ck])nfget; put; get ck; put ckg) by (Exp), (Rel1){(Rel3), (Res1){(Res3) = send: ((ck:s)[put=ck; get ck=ck] j (get:m) j R[get=msg; put ck=ck])nfget; put; get ck; put ckg) by (1) = send:: ((ck:s)[put=ck; get ck=ck] j M j (recv:ck:r)[get=msg; put ck=ck])nfget; put; get ck; put ckg) by (Exp), (Rel1){(Rel3), (Res1){(Res3) = send: ((ck:s)[put=ck; get ck=ck] j M j (recv:ck:r)[get=msg; put ck=ck])nfget; put; get ck; put ckg) by (1) = send:recv: ((ck:s)[put=ck; get ck=ck] j M j (ck:r)[get=msg; put ck=ck])nfget; put; get ck; put ckg) by (Exp), (Rel1){(Rel3), (Res1){(Res3) = send:recv:: ((ck:s)[put=ck; get ck=ck] j get ck:m j R[get=msg; put ck=ck])nfget; put; get ck; put ckg) by (Exp), (Rel1){(Rel3), (Res1){(Res3) = send:recv: ((ck:s)[put=ck; get ck=ck] j get ck:m j R[get=msg; put ck=ck])nfget; put; get ck; put ckg) by (1) = send:recv: (S[put=ck; get ck=ck] j M j R[get=msg; put ck=ck])nfget; put; get ck; put ckg) by (Exp), (Rel1){(Rel3), (Res1){(Res3) = send:recv: (S[put=ck; get ck=ck] j M j R[get=msg; put ck=ck])nfget; put; get ck; put ckg) by (1) Figure 3: Proving tht P = Svc. 23

24 Denition 5.1 Let hq; A;?!i be n LTS with 2 A, let q 2 Q, nd let s 2 (A? fg) be sequence of visible ctions. s 1. q =) holds if there exists q 0 such tht q L(q) denotes the set of ll trces of q. s =) q 0. In this cse we sy s is trce of q. 2. q refuses B A? fg if jbj < 1 nd for ll b 2 B; there exists no q 0 such tht b q =) q q is divergent, written q *, if nd only if there exists n innite sequence q 0 ; q 1 ; : : : such tht q = q 0 nd q i?! q i+1 for ll i 0. q * s if nd only if there exists (possibly empty) prex s 0 of s nd stte q 0 such tht q =) s0 q 0 nd q 0 *. When this is the cse we sy q diverges on s. We write q + s if q * s is not true nd sy tht q converges on s in this cse. 4. A stte q is totlly convergent if q + s holds for ll sequences s. 5. Let s be sequence of visible ctions nd B A be nite. Then hs; Bi is filure for q if either q * s or there is q 0 s such tht q =) q 0 nd q 0 refuses B. We use F (q) to represent the set of ll filures of q. The filures/testing ordering rely on the notions of trce, refusl, divergence nd filure. Intuitively, trce of stte consists of sequence of visible ctions the stte cn perform, with rbitrry mounts of internl computtion llowed in between. A refusl consists of nite set of visible ctions tht stte is incpble of engging in, no mtter how much internl computtion is performed. A stte is divergent if it cn engge in n innite sequence of internl trnsitions, thereby ignoring its environment; q * s holds if, in the course of \executing" s, q could enter divergent stte. Finlly, filure consists of sequence of ctions nd set of \oered ctions" tht stte cn fil to complete, either by diverging in the course of performing the sequence or completing the sequence nd rriving t stte tht is incpble of responding to the oered ctions. As exmples, consider the following. The pir h; fbgi is filure of :b:nil + :c:nil nd of :(:b:nil + :c:nil) but not of :(b:nil+c:nil). Both of the former processes hve =) trnsitions to c:nil, which refuses fbg; the lst process hs no such trnsition. Consider D = :D; D * s for ny sequence s of visible ctions, nd consequently hs; Bi is filure for ny D for ny sequence s nd nite set of ctions B. The sets L(q) nd F (q) stisfy number of properties. For exmple, the empty sequence is in L(q) for ny q. In ddition, if q + s then s 2 L(q) if nd only if there is B such tht hs; Bi 2 F (q). It should lso be noted tht if hs; Bi 2 F (q) nd B 0 B then hs; B 0 i 2 F (q). Reders re referred to [32] for other such properties. We now introduce the following orderings nd equivlences. Denition 5.2 Let hq; A;?!i be n LTS, with p; q 2 Q. 24