conflict structure bis hpb test pt causality

Transcription

1 Causal Testing Ursula Goltz and Heike Wehrheim Institut fur Informatik, University of Hildesheim Postfach , D{31113 Hildesheim, Germany Fax: (+49)(05121) Abstract We suggest an equivalence notion for event structures as a semantic model of concurrent systems. It combines the notion of testing (or failure) equivalence with respect to the timing of choices between dierent executions with a precise account of causalities between action occurrences as in causal semantics. This lls an open gap in the lattice of equivalences considered in comparative concurrency semantics. We show that our notion coincides with a \canonical" equivalence obtained as the usual testing performed on causal trees. Furthermore, we show that it is invariant under action renement, thus fullling a standard criterion for non-interleaving equivalences. 1 Introduction For systematic investigations concerning semantics of concurrent systems, it is useful to investigate all possibilities to consider systems as semantically equivalent. This leads to a better understanding of the crucial features of systems. This line of research is sometimes referred to as comparative concurrency semantics. On the other hand, for practical purposes of specifying and verifying system properties, it is necessary to provide a number of suitable equivalence notions in order to be able to choose always the simplest possible view of the system. The most comprehensive investigation of the possible varieties so far has been undertaken in [18]. Two main lines which have been followed there can be sketched as follows. The rst aspect which is most dominant in the classical concurrency approaches (interleaving semantics) is the so-called linear time - branching time spectrum [17]. Here dierent possibilities are discussed to what extent the points of choice between dierent executions of systems are taken into account. In the linear time approach, a system is equated with its set of The research reported in this paper was partially supported by the Human Capital and Mobility Cooperation Network \EXPRESS" (Expressiveness of Languages for Concurrency).

2 conflict structure bis hpb test? it pt causality possible executions (interleaving trace equivalence, it), that is points of choice are neglected. At the other end of the spectrum, bisimulation equivalence (bis) considers choices very precisely (even the timing of internal choices). Between these two extremes, for example the notion of (interleaving) testing (or failure) equivalence (test) is located. The other aspect to follow is whether causalities between action occurrences are taken into account. In the so-called interleaving approaches these are neglected. Using more expressive system models like Petri nets or event structures, equivalences can be dened which take causality into account. The \linear time" variant, where causalities are taken into account but points of choice are fully neglected is ofter referred to as pomset trace equivalence (pt). For getting a complete picture, at least these two aspects need to be considered also in combined form (there are still other aspects like the eects of internal actions which we do not discuss here). However, it has turned out that this is not trivial, as soon as choices are taken into account. One criterion which has been used to evaluate semantic equivalences is invariance under action re- nement: If two systems are considered equivalent then one expects that after rening actions in both systems in the same way the resulting systems are still equivalent. Using this criterion it has been shown that pomset bisimulation as a simple idea to combine both aspects fails [19]. History preserving bisimulation (hpb) has then been suggested as an equivalence which takes both causalities and points of choice fully into account (and is invariant under action renement). What has not been investigated in detail until now is how to extend other equivalences of the linear time - branching time spectrum to respect causality, i.e. to respect pomset trace equivalence. In particular testing (or failure) equivalence seems, for many applications, to provide exactly the suitable view of a system with respect to the choices. A rst attempt to generalise testing to take care of causality has been undertaken in [2]. However here the same problem occurs as for pomset bisimulation: The subtle interplay between conict and causality is not captured by this notion as we will show here using again the renement criterion.

3 In this paper, we suggest an equivalence which respects both interleaving testing and pomset trace equivalence, and we show that it is invariant under action renement. In particular, it coincides with interleaving testing for sequential systems. We rst dene this equivalence for prime event structures with binary conict as the most basic model which represents causalities. Since we want to use this simple model, we consider only conict-free renement, however our results could easily be generalised to arbitrary renements using a more expressive version of event structures. In order to verify that our equivalence is indeed the natural one, we show that it coincides with the equivalence obtained as the canonical version of testing on causal trees (Section 3), similarly as history preserving bisimulation is obtained as bisimulation on causal trees [16]. It would be straightforward to dene also a \failure formulation" of our equivalence. We see this piece of work as a contribution to complete the lattice of semantic notions for concurrent systems; we do not want to discuss here whether it is possible to see causalities via some form of test. At least, we would need more than a sequential test. For a discussion of this problem for the case of pomset trace equivalence see [14]. Concerning other related work, there are a number of approaches to dene testing equivalences which are invariant under action renement [21, 11, 12, 3]. However, all these approaches use the idea of split or ST equivalences: It is taken into account that actions have a duration, however they do not take causalities precisely into account (they will in general not respect pomset trace equivalence). Due to lack of space, all proofs have been omitted. They can be found in the full version of this paper [10]. 2 Basic Denitions In this section we will introduce the basic denitions we use throughout the paper. These are mainly event structures and their congurations, causal trees and the transformation of event structures into causal trees. 2.1 Event Structures Our new testing equivalence requires the use of a model of systems which represents causal relationships among its entities. For this purpose we have chosen prime event structures [22] here. Let Act be a set of actions, E a set of events. 2.1 Denition. A (labelled) prime event structure over E is a tuple E = he; ; #; li where E E is a set of events,

4 E E is a partial order (the causality relation) satisfying the principle of nite causes: 8e 2 E : fd 2 E j d eg is nite, # E E is an irreexive, symmetric relation (the conict relation) satisfying the principle of conict heredity: l: E! Act is a labelling function. 8d; e; f 2 E : d e; d # f ) e # f; A prime event structure represents a system in the following way: the action names are activities the system may perform, an event labelled a 2 Act stands for a particular occurrence of an action, d e denotes that e cannot occur before d has and d # e denotes that d and e can never occur together in one run. From the causality relation we can also derive a notion of causal independence: d co e, :(d < e _ e < d _ d # e). The set of all prime event structures is denoted E prim, 0 stands for the empty event structure h?;?;?;?i, the components of an event structure E are denoted E E ; E ; # E and l E. The index will be omitted if clear from the context. E 2 E prim is conict-free i # E =?. For X E E, the restriction of E to X is dened as Ej X := hx; \ (X X); # \ (X X); lj X i: The behaviour of an event structure is described by its congurations which are sets of events with certain properties. 2.2 Denition. A subset X E of events of a prime event structure E is left-closed i, for all d; e 2 E, e 2 X ^ d e ) d 2 X. X is conict-free i Ej X is conict-free. X is called a conguration i it is left-closed and conict-free. C(E) denotes the set of all congurations of E. A conguration X 2 C(E) is called complete i 8d 2 E : d =2 X ) 9e 2 X with e # d. For all X E being congurations, Ej X can also be seen as a poset (partially ordered set) since the conict relation is empty, and therefore we will directly use the symbol X to denote the poset he X ; X ; l X i = hx; E \(X X); l E j X i. Two posets X; X 0 are said to be isomorphic (X ' X 0 ) i there exists a bijective function f: E X! E X 0 such that e X e 0, f(e) X 0 f(e 0 ) and l X (e) = l X 0(f(e)). The isomorphism class of a poset is called a pomset [15], for a

5 poset X this will be denoted by [X] '. We write X 2 p if the poset/conguration X is in the pomset p. For the denition of causal testing we will use posets to represent partial executions and extensions of posets by one event to represent possible continuations. For two posets p; q, p is a direct prex of q (p q) if E p E q ; qj Ep = p, E q r E p = feg; e 2 E, and e is a maximal event of q. A particular property of labelled event structures will play an important role in the denition of causal testing, namely autoconcurrency. E 2 E prim is without autoconcurrency i 8X 2 C(E); 8d; e 2 X : d co e and l(d) = l(e) ) d = e: Event structures are often graphically represented. In the pictures the event names are mostly omitted the event structure is only shown up to isomorphism and the causality relation is depicted by arrows. 2.3 Example. E: a!b # c The gure shows an event structure with three events labelled a; b and c. The action a is causal for b and c is in conict with a and by conict inheritance also with b. The possible congurations of E are?; fag; fa; bg and fcg, fa; bg and fcg are complete. 2.2 Causal Trees The second causality-based model we use for our denition of causal testing are causal trees [6, 7]. Causal trees are essentially synchronisation trees [13] which carry in their labels additional information about the causes of actions. A label in a causal tree consists of an action name and a set of backward pointers being simply numbers which point to the arcs which are causes for the action. The advantage of causal trees especially for our purpose of nding a causal variant of an interleaving equivalence relation is their interleaving representation as a tree, however carrying all information about causality. Thus every equivalence on sychronisation trees can in a natural way be lifted to causal trees by replacing action names by the new labels. 2.4 Denition. A causal tree over Act is a tree hn; A; 'i where N is the set of nodes, A N N is the set of arcs and

6 ': A! Act 2 INI is the labelling function. The labelling function is extended to paths in a causal tree in the standard way. For the comparison of the two causal testing notions we use the standard construction of Darondeau and Degano [7] to transform event structures into causal trees. First the traces of an event structure are derived. 2.5 Denition. Let E = he; ; #; li be a prime event structure. A trace of E is a word = e 1 : : : e n such that X = fe 1 ; : : : ; e n g is a conguration of E, each event e 2 X occurs exactly once in and e i < X e j implies i < j for all i; j. Hence a trace is just a linearisation of a conguration. The set of traces of E is denoted T r(e). The length of a trace is denoted jj, [i] denotes the i-th component of the trace. Analogously the traces of a conguration X, denoted tr(x), can be dened. In the causal tree of an event structure E, the nodes are now simply the traces of E and an arc exists between two traces if the second one is an extension of the rst one. The causes in the labels of the arc have to be computed from the causality relation of E. 2.6 Denition. The causal tree of an event structure E, CT (E), is the tree ht r(e); A; 'i such that A = f(; e) j ; e 2 T r(e)g and '((; e)) = hl E (e); Ki where K = fj 2 j + 1 j 9e 0 < Xe e and 1 ; 2 such that = 1 e 0 2 g : For an event structure E and a trace = e 1 : : : e n 2 T r(e) we dene ' E () to be ha 1 ; K 1 i : : : ha n ; K n i such that l E (e i ) = a i and K i = fi? j j 9j : e j < E e i g. In the causal tree of E, ' E () is the labelling of the path leading from the root to the node. A similar denition can be made for posets: ' p () stands for the (causal) labelling of a trace 2 tr(p). For an isomorphism f: p! q between posets p and q two traces 2 tr(p); 0 2 tr(q) are called f-isomorphic i f([i]) = 0 [i] holds for all 1 i jj. 3 Testing In this section we will develop a testing equivalence on event structures which takes causality into account. As a crucial property of this equivalence we require

7 that it is invariant under renement of actions. The testing notion on event structures will be compared via the transformation of event structures into causal trees with a testing denition on causal trees. Thus we can ensure that our causal testing relation is the \canonical" one. Furthermore, we classify our equivalence with respect to the related notions. 3.1 Interleaving Testing Testing in general is based on the idea that systems can be distinguished by executing tests on them and comparing their results. For process algebras De Nicola and Hennessy [9] suggested a notion of (interleaving) testing where the system to be tested is set in parallel with a test and the outcome of a test is signalled by a specic success symbol. Two systems are equivalent if they pass exactly the same set of tests. We will use an alternative formulation (also from [9]) of this testing notion here: A test consists of a string of actions s and a set of actions L. A process passes this test if after every execution of s an action from the set L is possible next. We dene this notion for event structures as follows. 3.1 Denition. Let E 2 E prim. For X; X 0 congurations of E, X?! a E X 0 i X X 0, X 0 r X = feg and l E (e) = a. For s = a 1 : : : a n write??! s E X n, X n 2 C(E) i there exist congurations X 1 : : : X n?1 such that?? a1?! E X 1? a2?! E : : :? an?! E X n. 3.2 Denition. Let E; F 2 E prim, s 2 Act and L Act. E after s MUST L i for all X such that?? s! E X there exists an a 2 L, X 0 2 C(E) such that X? a! E X 0. E and F are interleaving testing equivalent (E test F) i for all s 2 Act ; L Act, E after s MUST L i F after s MUST L. This equivalence will now be extended to capture causalities. 3.2 Causal Testing A kind of causal testing on event structures has already been dened by Aceto, De Nicola and Fantechi [2]. Their idea is that the experiments on event structures are pomsets instead of words and the behaviour which is tested for after the experiment consists of a set of actions. More precisely, an event structure E fullls the test E after p MUST L if for every conguration in p there is at least one a 2 L which is possible to execute next. However, this equivalence is not invariant under renement, as can be shown by the following example. Under this denition E and F are equivalent.

8 E : a F : a a # # + # b # b b # b b After rening the action a into a 1! a 2 (for a formal denition of renement see Section 4) the event structures are not equivalent any more since r(e) after a 1 MUST fbg whereas r(f) fails this test (if the action a 1 marked with a star is chosen no action b can be performed next). r(e) : a 1 r(f) : a 1 a 1 # # # a 2 a 2 + a 2 # # # b # b b # b b As soon as actions are assumed to have some duration, E and F should be distinguished. They can be distinguished if the actions which are required to take place after the experiments are being causally related to the experiments themselves and thus to the actions which have happened so far. Instead of sets of actions L we therefore could use sets of direct extensions of the executed pomsets as tests. The rst idea would be to dene E after p MUST Q as: after all congurations in p there must be at least one q 2 Q such that a conguration isomorphic to q is possible next. This equivalence can indeed distinguish E and F since E after a MUST a b but F after a MUST = 3.3 Denition. Let E; F 2 E prim and p a pomset, Q a set of pomsets such that 8q 2 Q : p q. E after p MUST w Q i for all X 2 C(E); X 2 p there exists q 2 Q and X 0 2 C(E) such that X 0 2 q. E and F are weak causal testing equivalent (E wct F) i for all p; Q, E after p MUST w Q, F after p MUST w Q. However this equivalence is still not invariant under renement which can be seen by the following example: a b E : a # a a F : a # a a # # # # # # # b b # b b b b E and F are weak causal testing equivalent. After rening a into a 1! a 2 they are however not equivalent anymore since r(f) after a 1!a 2 a1!a MUST 2!b = w a 1 a 1 (after the conguration containing the actions marked with star no action b is possible) but r(e) fullls the test..

9 r(e) : a 1 # a 1 a 1 r(f) : a 1 # a 1 a 1 # # # # # # a 2 a 2 a 2 a 2 a 2 # a 2 # # # # # # b b # b b b b This phenomenon is due to the fact that the equivalence does not treat autoconcurrency properly: Both E and F fulll the test after a a!b a MUST w. But a whereas in E the action b can be causally related to either of the two concurrent a's, in F there is a conguration where the action b can only causally follow one of the actions a. What we need is a denition of causal testing where F already does not fulll the test and thus E and F are not equivalent. For this we now move from pomsets in the tests to posets. 3.4 Denition. Let E; F be prime event structures, p a poset and Q a set of posets such that 8q 2 Q : p q. E after p MUST Q i forall X 2 C(E) and for all isomorphisms f: X! p there exist q 2 Q; X 0 2 C(E); f 0 such that X X 0, f 0 : X 0! q is an isomorphism and f 0 j X = f. E and F are causal testing equivalent (E ct F) i for all p, Q: E after p MUST Q, F after p MUST Q. Now the above two event structures can be distinguished: For p = 1 a 2a and Q = 1a, where 1 a stands for the event 1 labelled a, we get: E after p MUST Q 2a! 3 b but F after p MUST = Q. For event structures without autoconcurrency the two equivalence notions coincide: 3.5 Theorem. Let E; F be without autoconcurrency. Then E wct F () E ct F. The proof follows immediately from the following lemma. 3.6 Lemma. Let X; Y be two nite posets without autoconcurrency, X ' Y, and let f; g: X! Y be two isomorphisms between X and Y. Then f = g. Next the denition of testing on causal trees is developed. For this we adapt the testing denition of De Nicola and Hennessy [9] to causal trees, that is, the experiments and tests are constructed over the alphabet Act 2 INI instead of over Act. Since causal trees are an augmentation of synchronisation trees

10 with causality information this directly gives us a canonical notion of causal testing, following the idea from Vaandrager [16] and Aceto [1] where it is shown that causal bisimulation (bisimulation on causal trees) equals history preserving bisimulation. 3.7 Denition. Let T 1 ; T 2 be causal trees, w a word over Act 2 INI and L Act 2 INI a set of labels. T 1 after w MUST L i for all paths u in T 1 from the root of T 1 to a node n such that ' 1 (u) = w there exists a label ha; Ki 2 L and an arc r starting from n such that ' 1 (r) = ha; Ki. T 1 and T 2 are causal tree testing equivalent, T 1 ctt T 2, i for all words w and sets of labels L, T 1 after w MUST L, T 2 after w MUST L. The following theorem shows that the two test notions coincide. This suggests that our notion of causal testing is indeed the natural extension of interleaving testing for causality. 3.8 Theorem. Let E; F be prime event structures. E ct F () CT (E) ctt CT (F) : 3.3 Classication We now classify the new equivalence according to the scheme sketched in Section 1. In particular we will compare causal testing with three equivalences: with pomset trace equivalence which does not take the branching structure but the causality between action occurrences into account, with history preserving bisimulation which completely takes both branching structure and causality into account and with interleaving testing which takes branching to the same degree into account as causal testing but does not treat causality. It turns out that causal testing lies strictly between pomset trace equivalence and history preserving bisimulation and that it implies interleaving testing, hence lls exactly the gap indicated in Section 1. We start by dening pomset trace equivalence and history preserving bisimulation. 3.9 Denition. Let E; F 2 E prim. Let P omsets(e) := f[x] ' j X 2 C(E)g. E and F are pomset trace equivalent (E pt F) i P omsets(e) = P omsets(f) Denition. Let E; F 2 E prim. A relation R C(E) C(F) 2 EE EF is called a history preserving bisimulation between E and F if (?;?;?) 2 R and whenever (X; Y; f) 2 R then f is an isomorphism between X and Y,

11 X? a! E X 0 ) 9Y 0 ; f 0 with Y? a! F Y 0 ; (X 0 ; Y 0 ; f 0 ) 2 R and f 0 j X = f, Y? a! F Y 0 ) 9X 0 ; f 0 with X? a! E X 0 ; (X 0 ; Y 0 ; f 0 ) 2 R and f 0 j X = f. E and F are history preserving bisimilar (E hpb F) i there exists a history preserving bisimulation between E and F. The following theorem gives the envisaged classication. For completeness, we include also some other known inclusions Theorem. bis hpb \ \ test ct \ \ it pt (all inclusions being strict.) In particular, ct coincides with test for sequential systems (co =?). 4 Renement Next we will dene the operation of action renement and show that our notion of causal testing is invariant under renement. In event structures, action renement means substituting single events by complex event structures. A re- nement function describes this substitution: it maps actions (and thereby all events labelled with this action) to nite non-empty conict-free event structures. The restriction to conict-free renements is due to the chosen model of prime event structures, if one moves to for instance ow event structures [4] it can be dropped. The operation itself is dened as follows (see [20]): in the renement of an event structure E by a renement function r every event e labelled a is replaced by a disjoint copy of r(a), the causality and the conict relation are inherited from E. 4.1 Denition. A function r: Act! E prim? f0g is called a renement function for prime event structures if 8a 2 Act : r(a) is nite and conict-free. Let E 2 E prim and r a renement function. Then r(e) is dened as { E r(e) = f(e; e 0 ) j e 2 E E ; e 0 2 E r(le (e)) g,

12 { (d; d 0 ) r(e) (e; e 0 ) i d < E e or (d = e ^ d 0 r(le(d)) e 0 ), { (d; d 0 ) # r(e) (e; e 0 ) i d # E e and { l r(e) (e; e 0 ) = l r(le (e)) (e 0 ). The behaviour of an event structure is described by the set of its congurations. The behaviour of the rened event structure r(e) can immediately be derived from the behaviour of E and the behaviour of the substituted event structures [19]. We can now prove that causal testing indeed possesses the property which we required to hold: Causal testing equivalence is invariant under renement. If two systems are causal testing equivalent then after rening actions in both systems in the same way the resulting systems are still causal testing equivalent. 4.2 Theorem. Let E; F 2 E prim and r a renement function for prime event structures. E ct F ) r(e) ct r(f). As a corolloray we get that for event structures without autoconcurrency weak causal testing is also invariant under renement. Acknowledgements. Thanks to Rob van Glabbeek, Arend Rensink and Walter Vogler for inspiring discussions and in particular to Rob van Glabbeek for suggesting to compare any kind of causal variant of interleaving equivalences with the corresponding causal tree version. Many thanks to Thomas Gehrke for his help in preparing the nal version of this paper. References [1] Luca Aceto. History preserving, causal and mixed-ordering equivalences over stable event structures. Fundamenta Informaticae, 17, [2] Luca Aceto, Rocco De Nicola, and A. Fantechi. Testing equivalences for event structures. In M. Venturini Zilli, editor, Mathematical Models for the Semantics of Parallelism, volume 280 of Lecture Notes in Computer Science, pages 1{20. Springer-Verlag, [3] Luca Aceto and Ue Engberg. Failures semantics for a simple process language with renement. In S. Biswas and K. V. Nori, editors, Foundations of Software Technology and Theoretical Computer Science, volume 590 of Lecture Notes in Computer Science, pages 89{108. Springer-Verlag, [4] Gerard Boudol and Ilaria Castellani. Permutations of transitions: An event structure semantics for CCS and SCCS. In de Bakker et al. [8], pages 411{427. [5] W. R. Cleaveland, editor. Concur '92, volume 630 of Lecture Notes in Computer Science. Springer-Verlag, 1992.

13 [6] Philippe Darondeau and Pierpaolo Degano. Causal trees. In G. Ausiello, M. Dezani-Ciancaglini, and S. Ronchi Della Rocca, editors, Automata, Languages and Programming, volume 372 of Lecture Notes in Computer Science, pages 234{ 248. Springer-Verlag, [7] Philippe Darondeau and Pierpaolo Degano. Causal trees = interleaving + causality. In I. Guessarian, editor, Semantics of Systems of Concurrent Processes, volume 469 of Lecture Notes in Computer Science, pages 239{255. Springer- Verlag, [8] J. W. de Bakker, W.-P. de Roever, and Grzegorz Rozenberg, editors. Linear Time, Branching Time and Partial Order in Logics and Models for Concurrency, volume 354 of Lecture Notes in Computer Science. Springer-Verlag, [9] Rocco De Nicola and Matthew Hennessy. Testing equivalences for processes. Theoretical Computer Science, 34:83{133, [10] Ursula Goltz and Heike Wehrheim. Causal Testing. Technical Report 5/96, Institut fur Informatik, Universitat Hildesheim, [11] M. Hennessy. Concurrent testing of processes. In Cleaveland [5], pages 94{107. [12] Lalita Jategaonkar and Albert Meyer. Testing equivalences for Petri nets with action renement. In Cleaveland [5], pages 17{31. [13] Robin Milner. Communication and Concurrency. Prentice-Hall, [14] Gordon Plotkin and Vaughan Pratt. Teams can see pomsets. extended abstract; available by ftp, August [15] Vaughan R. Pratt. Modeling concurrency with partial orders. International Journal of Parallel Programming, 15(1):33{71, [16] Frits Vaandrager. An explicit representation of equivalence classes of history preserving bisimulation. Unpublished manuscript, [17] R. J. van Glabbeek. The linear time { branching time spectrum. In J. C. M. Baeten and J. W. Klop, editors, Concur '90, volume 458 of Lecture Notes in Computer Science, pages 278{297. Springer-Verlag, [18] Rob van Glabbeek. Comparative Concurrency Semantics and Renement of Actions. PhD thesis, Free University of Amsterdam, [19] Rob van Glabbeek and Ursula Goltz. Equivalences and renement. In I. Guessarian, editor, 18eme Ecole de Printemps d'informatique Theorique Semantique du Parallelisme, volume 469 of Lecture Notes in Computer Science, [20] Rob van Glabbeek and Ursula Goltz. Renement of actions in causality based models. In J. W. de Bakker, W.-P. de Roever, and Grzegorz Rozenberg, editors, Stepwise Renement of Distributed Systems Models, Formalisms, Correctness, volume 430 of Lecture Notes in Computer Science, pages 267{300. Springer- Verlag, Report version: Arbeitspapiere der GMD 428, Gesellschaft fur Mathematik und Datenverarbeitung. [21] Walter Vogler. Failure semantics based on interval semiwords is a congruence for renement. Distributed Computing, (4):139{162, [22] Glynn Winskel. An introduction to event structures. In de Bakker et al. [8], pages 364{397.