Designing and Understanding the Behaviour of Systems

Transcription

1 Designing nd Understnding the Behviour of Systems Jn Friso Groote & Michel Reniers Deprtment of Computer Science Eindhoven University of Technology, Eindhoven Emil:

2 2

3 Prefce Robin Milner observed in 1973 tht the primry tsk of computers ppered to be intercting with their environment, yet the theory of progrms nd progrmming t tht time seemed to ignore this fct completely [36, 37]. As consequence, he set out working on his seminl book [38, 40] in which he developed the CCS, the Clculus of Communicting Systems. At the sme time two other min process lgebrs were developed, nmely ACP (Algebr of Communicting Processes, [5]) nd CSP (Communicting Sequentil Processes, [27, 28]). Interesting s they were, these process lgebrs were too bre to be used for the description of ctul systems, minly becuse they lcked proper integrtion of dt. In order to solve this, process lgebric specifiction lnguges hve been designed (most notbly LOTOS [29] nd PSF [35]) which contined both dt nd processes. A problem with these lnguges ws tht they were too complex to ct s bsic crrier for the development of behviourl nlysis techniques. We designed n intermedite lnguge, nmely mcrl2 (nd its direct predecessor µcrl [21, 19]) s stripped down process specifiction lnguge or n extended process lgebr. It contins exctly those ingredients needed for complete behviourl specifiction, nd its (reltive) simplicity llows to concentrte on proof nd nlysis techniques for process behviour. Throughout the yers mny of these techniques hve been developed. To mention few: the Recursive Specifiction Principle, Invrints, Confluence, Cones nd Foci, Abstrct Interprettion nd Coordinte Trnsformtions, Boolen Eqution Systems, Proof by Ptterns, etc. All these results together hve constituted mthemticl frmework suitble to lunch mthemticl ttck on most phenomen tht re not properly understood in process behviour. They lso form very good frmework to formulte nd prove the correctness of complex nd intricte protocols. Up till now, ll these results were lingering round in the literture. We combined them in this book, dded exercises nd exmples to mke the developed mteril suitble for self study nd for teching. Acknowledgements The first version of this book ppered s hndbook chpter [22]. This chpter formed the bsis of reder [14] used for courses t severl universities (mostly written by Wn Fokkink). These erlier publictions were bsed on the modelling lnguge µcrl (micro Common Representtion Lnguge, [21, 19]) essentilly developed in In 2003 we decided tht it ws time for successor, to increse the usbility of the µcrl, nd we decided to bptise its successor mcrl2. The essentil difference is tht mcrl2 hs the bsic dttypes s prt of the lnguge, contrry to µcrl which contined only mechnism to define dttypes. This book is solely bsed on mcrl2. The development of mcrl2 builds upon the development work on process lgebr s between 1970 nd Especilly the work on CCS (Clculus of Communicting Processes) by Robin Milner [38]) nd ACP (Algebr of Communicting Processes) by Jn Bergstr, Jn Willem Klop, Jos Beten, Rob vn Glbbeek nd Frits Vndrger [5, 1] formed n importnt bsis. An essentil step ws the EC SPECS project, where meglomne Common Representtion Lnguge hd to be developed to represent ll behviourl description lnguges tht existed t tht time 3

4 (LOTOS, CHILL, SDL, PSF) nd tht still hd to be developed. As rection micro Common Representtion Lnguge (µcrl) hd been developed in which Albn Ponse ws instrumentl. Bert Lisser ws the min figure behind the mintennce nd development of the tools to support µcrl. The following people hve contributed to the development of mcrl2, its tools nd its theory: Muck vn Weerdenburg, Ad Mthijssen, Bs Ploeger, Tim Willemse, Wieger Wesselink, Jeroen vn der Wulp, Frnk Stppers, Frnk vn Hm, Hnnes Pretorius, Jco vn de Pol, Yroslv Usenko, Jeroen Keiren, Crst Tnkink nd Tom Henen. This book is used s reder for the course Requirements, Anlysis, Design nd Verifiction t Eindhoven University of Technology. Mny thnks go to Jeroen Keiren for his creful proofreding. Vluble feedbck lso cme from Muhmmd Atif, Hrsh Beohr, Debjyon Ber, Anton Bilos, Gert-Jn vn den Brk, Mehmet Çubuk, Hossein Hojjt, Bs Kloet, Geert Kwintenberg, Koen vn Lngen, Mohmmd Mousvi, Mthijs Opdm, Ev Ploum, Mrcel Roeloffzen, Koos Rood, Frnk Stppers, Crst Tnkink, Migiel de Vos nd mny others. Jn Friso Groote nd Michel Reniers September 2007, Eindhoven, The Netherlnds 4

5 Contents I Modeling system behviour 9 1 Introduction 11 2 Actions, behviour, equivlence nd bstrction Actions Lbelled trnsition systems Equivlence of behviours Strong bisimultion equivlence Trce equivlence Lnguge nd filures equivlence The Vn Glbbeek liner time brnching time spectrum Behviourl bstrction The internl ction τ Behviourl equivlence for the internl ction Rooted brnching bisimultion Rooted wek bisimultion Wek trce equivlence Algebric process descriptions Bsic processes Actions Multi-ctions Alterntive nd sequentil composition Dedlock The conditionl nd sum opertor Recursive processes Dt types Bsic dt type definition mechnism Stndrd dt types Boolens Numbers Lists Sets nd bgs Function types Structured types Terms nd where expressions Timed processes Prllel processes The prllel opertor Communiction between prllel processes Blocking nd renming Hiding internl behviour

6 4 Describing properties in the modl µ-clculus Hennessy-Milner logic Regulr formuls Fixed point modlities Modl formuls with dt Modl formuls with time Equtions Modelling of system behviour Alternting bit protocol Sliding window protocol A ptient support pltform Semntics Semntics of mcrl2 dt lnguge The opertionl semntics of the mcrl2 process lnguge Vlidity of modl µ-clculus formuls II Model trnsformtions 85 7 Bsic mnipultion of processes Introduction Simply typed λ-clculus Derivtion rules for equtions Derivtion rules for formuls Induction for constructor sorts The sum elimintion lemm Recursive specifiction principle Koomen s fir bstrction rule Prllel expnsion Bsic prllel expnsion Prllel expnsion with dt: two one-bit buffers Prllel expnsion with time Liner Process Equtions nd Lineristion Liner process equtions Generl liner process equtions Clustered liner process equtions Lineristion Lineristion of sequentil processes Prlleliztion of liner processes Lineristion of n prllel processes Proof rules for liner processes τ-convergence Convergent Liner Recursive Specifiction Principle (CL-RSP) CL-RSP with invrints Confluence nd τ-prioristion τ-confluence on lbelled trnsition systems τ-prioritistion lbelled trnsition systems Confluence nd liner processes τ-prioritistion for liner processes Using confluence for stte spce genertion

7 III Checking conformnce between specifiction nd implementtion Cones nd foci Cones nd foci Protocol verifictions using the cones nd foci proof technique Two unbounded queues form queue Milner s scheduler The lternting bit protocol Verifiction of protocols Bounded retrnsmission protocol Tree identify protocol Sliding window protocol Distributed summing protocol IV Checking properties of systems Verifiction of modl formuls Prmeterised boolen eqution systems Trnslting modl formuls to PBESes Solving PBESes V Appendices 149 A Equtionl definition of built in dttypes 151 A.1 Bool A.2 Positive numbers A.3 Nturl numbers A.4 Integers A.5 Rels A.6 Lists A.7 Sets A.8 Bgs A.9 Structured types B Syntx of the formlisms 163 B.1 Lexicl prt B.2 Conventions to denote the context free syntx B.3 Identifiers B.4 Sort expressions nd sort declrtions B.5 Declrtion of constructors nd mppings B.6 Declrtion of equtions B.7 Dt expressions B.8 Communiction nd renming sets B.9 Process expressions B.10 Action declrtion B.11 Process nd initil stte declrtion B.12 Syntx of n mcrl2 specifiction C Axioms for processes 167 D Answers to exercises 171 7

8 References 181 8

9 Prt I Modeling system behviour 9

10

11 Chpter 1 Introduction In tody s world virtully ll designed systems contin computers nd re connected vi dt networks. This mens tht contemporry systems behve in complex wy nd re continuously in contct with their environment. For system rchitects designing nd understnding the behviour of such systems is mjor spect of their tsk. This book dels with the question of how to model system interction in sufficiently bstrct wy, such tht it cn be understood nd nlysed. In prticulr, it provides techniques to prove tht interction schemes fullfill their intended purpose. In order to pprecite this book, it is necessry to understnd the complexity of contemporry system communiction. As n extremely simple exmple, tke the on/off switch of modern computer. We do not hve to go fr bck in history to find tht the power switch hd very simple behviour. After the power switch ws turned off, the computer ws ded, nd it would not ttempt to become involved in ny communiction of whtever kind nymore. In modern computer, the on/off switch is connected to the centrl processor. If the on/off switch is pressed, the processor will be signlled tht it must switch off. The processor will finish current tsks, shut down its hrdwre devices, nd inform (or even sk permission to) others vi its networks tht it intends to go down. So, nowdys, n incresed messge trffic cn be observed fter the shut down button is pressed. Given the complexity of systems, it is not t ll self-evident nymore whether system will respond nd if it does so, wht the correct interprettion of the response is. The number of different messge types generlly is substntil. For lrge systems dozens of different messge types re possible. The possible orderings of these messges in component cn be represented by n utomton. In well designed system the number of sttes in such n utomton is smll, but in prctice the number tends to be huge. Especilly, when the effect of the dt trnsferred in messges is tken into ccount, the size of these utomt quickly becomes drconic. In generl, the stte spce of system is of the sme order of mgnitude s the product of the sizes of the utomt of ech component. The number of different messge sequences (or trces) is in generl exponentil in the number of sttes of the system. The numbers indicting sizes of sttes spces re of the kind of even 10 (1010) nd exceed the well-known stronomicl numbers by fr. It is completely justified to spek bout whole new clss of numbers, i.e. the computer engineering numbers. Of course such numbers would men nothing if the design of communicting systems would not led to problems. But unfortuntely, on virtully ll levels system communiction is cusing problems. Most distributed lgorithms published in the literture turn out to be wrong, or if correct their proofs contin flws. For most of the known stndrd communiction protocols so mny serious flws hve been reveled, tht it is very likely to ssume tht the newest ccepted interntionl stndrds contin literlly hundreds of serious yet to be uncovered bugs. Adding our own experience, we hve fr too often been confronted with subtle bugs in communiction schemes tht we designed. This ll leds to strong belief tht without proper mthemticl theory, pproprite proofnd nlysis methods nd dequte computer tools, it is impossible to design correctly communi- 11

12 cting systems. In this book we provide ll these ingredients. In chpter 2 the bsic notion, nmely n ction is explined. Using trnsition systems, it is explined how ctions cn be combined into behviour. The circumstnces under which behviour cn be considered the sme re lso investigted. In chpter 3 behviour is described in n lgebric wy. This mens tht there re number of behviour combining opertors of which the properties re chrcterized by xioms. In this chpter the stndrd constructs to describe dt re lso introduced. The next chpter, i.e. chpter 4, explins how to describe behviourl properties in the modl mu-clculus. By integrting dt in this clculus, we cnnot only stte simple properties, such s system is dedlock-free, but lso very complex properties tht depend on fir behviour or dt processing. The first prt is concluded with chpter 5 tht contins number of exmple descriptions of the behviour of some simple systems. In chpter 6 the semntics of the process lnguges is described. In essence, this provides mpping between syntcticlly or lgebriclly described processes on the one hnd nd trnsition system on the other hnd. Using this mpping it is possible to estblish the reltion between the process equivlences given in chpter 2 nd the xioms in chpter 3. The second prt of the book dels with process mnipultion. Chpter 7 provides bsic technologies to trnsform one process into nother. Typicl techniques re induction, the recursive specifiction principle nd the expnsion theorem. Chpter 8 describes how to trnsform processes to the so-clled liner form, which will ply n importnt role in ll subsequent mnipultions. Moreover, it will reformulte the principle RSP to the more concise principle CL-RSP (RSP for convergent liner processes). Chpter 9 dels with confluence which is typicl behviourl pttern tht origintes from the prllel composition of two processes. If process is found to be confluent, we cn reduce it using so-clled τ-priority. By giving priority to certin τ-ctions the stte spce cn be reduced considerbly. In chpter 10 the cones nd foci technique is explined, which llows to prove tht specifiction nd n implementtion of certin behviour is equivlent. In the subsequent chpter 11 the ccumulted techniques re used to prove number of typicl protocols nd distributed lgorithms correct. An extensive toolset hs been developed for mcrl2. It cn be downloded from 12

13 Chpter 2 Actions, behviour, equivlence nd bstrction In this chpter the bsic notions of (inter)ction nd behviour re explined in terms of trnsition systems. It is discussed when different trnsition systems cn behve the sme nd it is indicted how complex behviour cn be bstrcted by hiding ctions. 2.1 Actions Interction is everywhere. Computer systems, humns, mchines, nimls, plnts, molecules, plnets nd strs re ll intercting with their environment. Some interctions re continuous such s grvity pulling stellr objects towrds ech other. Other interctions tke plce pointwise in time, such s shking hnds or sending messge. Within engineering continuously intercting systems were prmount. The forces on bridge or building, the burning of fuel in combustion engines or the chrcteristics of n electronic circuit hd to be mstered by mthemticl theory for continuous interction. However, with the dvent of computers, systems tend to communicte in pointwise mnner. Slightly worrying, the complexity of messge exchnges mong computerized systems is currently exceeding the complexity of the more trditionl engineering rtefcts. This complexity needs to be tmed by mking models nd hving the mthemticl mens to understnd these models. The purpose of this book is to provide the modelling mens nd mthemticl nlysis techniques to understnd intercting systems. Interctions re the bsic ingredients of such models. We denote them bstrctly by letters, b, c or more descriptively by red, deliver, timeout, etc. They re generlly referred to s ctions nd they represent some observble tomic event. The ction deliver cn represent the event of letter being dropped in milbox. An ction red cn consist of reding messge on computer screen. The fct tht n ction is tomic mens tht ctions cnnot overlp ech other. For every pir of ctions nd b, the one hppens before the other, or vice vers. Only in rre cses they cn hppen exctly t the sme moment. We write this s b nd cll this multi-ction. It is possible to indicte tht n ction cn tke plce t specific time. E.g., 3 mens tht ction must tke plce t time 3. For the moment multi-ctions nd time re ignored. We come bck to it in the next chpter. Exercise Wht re the interctions of CD-plyer? Wht re the ctions of text-editor? And wht of dt-trnsfer chnnel? 13

14 2.2 Lbelled trnsition systems The order in which ctions cn tke plce is clled behviour. Behviour generlly is depicted s lbelled trnsition system. A lbelled trnsition system consists of set of sttes, nd set of trnsitions lbelled with ctions tht connect the sttes. Lbelled trnsition systems must hve n initil stte, which is depicted by smll incoming rrow. They cn lso hve terminting sttes, generlly indicted with smll tick or squre root symbol ( ). In figure 2.1 the behviours of two simple processes re depicted. Both cn perform the ctions, b, c nd d. At the end, the lower one cn terminte, wheres the upper one cnnot do nything nymore. It is sid to be in dedlock, i.e. in rechble stte tht does not terminte nd hs no outgoing trnsitions. b c d b c d Figure 2.1: Two simple liner behviours of which the lower one cn terminte Such simple digrms re lredy useful to illustrte different behviours. In figure 2.2 the behviours of two lrm clocks re drwn. The behviour on the left llows for repeted lrms, wheres the behviour on the right only signls the lrm once. Note lso tht the behviour t the left only llows strict lterntion between the set nd the reset ctions, wheres this is not the cse in the right digrm. lrm set set reset lrm reset Figure 2.2: Two possible behviours of n lrm clock A stte cn hve more thn one outgoing trnsition with the sme lbel to different sttes. In this cse the stte is clled nondeterministic. A deterministic trnsition system contins no rechble nondeterministic sttes. Nondeterminism is very strong modelling id becuse it mkes it possible to model behviour despite the fct tht the exct behviour is not cler. For instnce if it is uncler how often the lrm cn be repeted, this cn be modelled by the behviour of figure 2.3. If n lrm sounds, you cnnot tell whether it is the lst one, or whether there re more to follow. Even in cse it is cler tht the lrm sounds exctly 714 times before stopping, it lrm set lrm reset Figure 2.3: Nondeterministic behviour of n lrm clock cn be useful to describe it using the model of 2.3. Often the fct tht the lrm sounds exctly 14

15 714 times does not outweigh the incresed complexity of the model. Milner ws one of the erly defenders of this use of nondeterminism [36, 38]. He clled it the wether condition. The wether determines the temperture. The temperture influences the speed of processors nd clocks in computer. This my men timeout my come just too lte, or just too erly for some behviour to hppen. It generlly is not effective to include wether model to predict which behviour will hppen. It is much more convenient to describe ll the behviour in nondeterministic wy. The generl definition of lbelled trnsition system is the following. Definition (Lbelled Trnsition System). A lbelled trnsition system (LTS) is five tuple A = (S,Act,, s, T) where S is set of sttes. Act is set of ctions, possibly multi-ctions. S Act S is trnsition reltion. s S is the initil stte. T S is the set of terminting sttes. It is common to write t t for (t,, t ). Often, when not relly relevnt, the set T of terminting sttes is omitted, nd it is lso common tht the initil stte does not pper in the definition of n LTS. Exercise Mke the following extensions to the lrm clock. 1. Drw the behviour of n lrm clock where it is lwys possible to do set or reset ction. 2. Drw the behviour of n lrm clock with unrelible buttons. When pressing the set button the lrm clock cn be set, but this does not need to be the cse. Similrly for the reset button. Pressing it cn reset the lrm clock, but the clock cn lso sty in stte where n lrm is still possible. 3. Drw the behviour of n lrm clock where the lrm sounds t most three times. Exercise Describe the trnsition system in figure 2.3 in the form of lbelled trnsition system conform definition Equivlence of behviours When do two systems hve the sme behviour? Or stted differently, when re two lbelled trnsition systems behviourlly equivlent? The initil nswer to this question is simple. Whenever the difference in behviour cnnot be observed. The obvious next question is how behviour is observed. The nswer to this is tht there re mny wys to observe behviour nd consequently mny different behviourl equivlences. We present here the most importnt ones. For n overview see [17] Strong bisimultion equivlence Bisimultion equivlence (lso referred to s strong bisimultion equivlence) or (strong) bisimilrity is the most importnt process equivlence [2, 39, 42]. The reson is tht if two processes re bisimultion equivlent, they cnnot be distinguished by ny relistic form of behviourl observtion. So, if two processes re bisimilr they cn be considered equl. The ide behind bisimultion is tht two sttes re relted if the ctions tht cn be done in one stte, cn be done in the other, too. And if one ction is simulted by nother in two relted sttes, the resulting sttes must be relted gin. 15

16 Definition (Bisimultion). Let A 1 =(S 1,Act 1, 1, s 1, T 1 ) nd A 2 =(S 2,Act 2, 2, s 2, T 2 ) be lbelled trnsition systems. A binry reltion R S 1 S 2 is clled (strong) bisimultion reltion iff for ll s S 1 nd t S 2 such tht srt holds, it lso holds tht: 1. if s 1 s, then there is t S 2 such tht t 2 t with s Rt, 2. if t 2 t, then there is s S 1 such tht s 1 s with s Rt, nd 3. T 1 (s) if nd only if T 2 (t). Two sttes s nd t re (strongly) bisimilr, denoted by s t, if there is bisimultion reltion R such tht srt. The lbelled trnsition systems A 1 nd A 2 re (strongly) bisimilr iff the initil sttes re bisimilr, i.e. s 1 Rs 2. It is eqully possible to define bisimultion on the sttes of one single trnsition system. In this cse the reltion R is often referred to s n uto-bisimultion reltion. There re severl techniques to show tht one lbelled trnsition system is bisimilr to nother. Computer lgorithms re generlly bsed on the Reltion Corsest Prtitioning Refinement [30, 41]. s 1 s 2 s 3 b b s 4 s 5 t 1 R s 1 R t 2 s 2 s 3 b b b b R t 3 t 4 s 4 s 5 b t 1 t 2 b t 3 t 4 s 1 s 2 s 3 b b R s 4 s 5 R R b t 1 t 2 b t 3 t 4 s 1 s 2 s 3 b b R s 4 s 5 R Figure 2.4: Showing two LTSs bisimilr R R b t 1 t 2 b t 3 t 4 For smll trnsition systems more strightforwrd technique generlly is dequte. Consider the trnsition systems in figure 2.4. In order to show tht the initil sttes s 1 nd t 1 re bisimilr, bisimultion reltion R must be constructed to relte these two sttes. We ssume tht this cn be done. So, we drw n rc between s 1 nd t 1 nd lbel it with R. If R is bisimultion, then every trnsition from s 1 must be mimicked by similrly lbelled trnsition from t 1. More concretely, the -trnsition from s 1 to s 2 cn only be mimicked by n -trnsition from t 1 to t 2. So, s 2 nd t 2 must be relted, too. We lso drw n rc to indicte this (see the second picture in figure 2.4). Now we cn proceed by showing tht the trnsition from s 1 to s 3 must lso be mimicked by the -trnsition from t 1 to t 2. Hence, s 3 is relted to t 2 (see the third picture). Note tht it is wise to choose the trnsitions to be simulted such tht they re simulted by trnsitions in deterministic nodes. Otherwise, there might be choice, nd more thn one possibility needs to be considered. E.g. the -trnsition t 1 to t 2 cn be simulted by either the trnsition from s 1 to s 2, or the one from s 1 to s 3. The reltion R needs to be extended to ll rechble nodes. Therefore, we consider the reltion between s 2 nd t 2. We continue the process sketched bove, but now let the trnsitions from the right trnsition system be simulted by the left one, becuse the sttes s 2 nd s 3 re deterministic. The reltion R is extended s indicted in the fourth picture of figure 2.4. Finlly, it needs to be checked tht ll relted sttes stisfy the requirements in definition R

17 s 1 R t 1 s 1 R t 1 s 2 s 3 b c b t 2 c s 2 s 3 b c b t 2 c s 4 s 5 t 3 t 4 s 4 s 5 t 3 t 4 Figure 2.5: Two non bisimilr lbelled trnsition systems Now consider the trnsition systems in figure 2.5. There re three ctions, b nd c. These two trnsition systems re not bisimilr. Before showing this formlly, we first give n intuitive rgument why these two processes re different. Let ctions, b nd c stnd for pressing button. If trnsition is possible, the button cn be pressed. If trnsition is not possible, the button is blocked. Now suppose customer ordered the trnsition system to the right (with initil stte t 1 ) nd mlicious supplier delivered box with the behviour of the trnsition system to the left. If the customer could not experience the difference, the supplier did do n dequte job. But the customer cn first press n button such tht the box ends up being in stte s 3. Now the customer, thinking tht he is in stte t 2 expects tht both b nd c cn be pressed. He, however, finds out tht b is blocked, from which he cn conclude tht he is deceived nd hs n rgument to sue the supplier. Now note tht in both behviours in figure 2.5 the sme sequence of ctions cn be performed, nmely b nd c. Yet, the behviour of both systems cn be experienced to be different! If one tries to show both trnsition systems bisimilr using the method outlined bove, then in the sme wy s bove, stte s 2 must be relted to stte t 2. However, c trnsition is possible from stte t 2 tht cnnot be mimicked by stte s 2 which hs no outgoing c trnsition. So, s 2 cnnot be relted to t 2 nd consequently, s 1 cnnot be bisimilr to t 1. A plesnt property of bisimultion is tht for ny lbelled trnsition system, there is unique miniml trnsition system which is bisimilr to it. Strictly spoken, it is unique except for the nmes of the sttes. But the nmes of the sttes re not relly relevnt for behviourl nlysis. Exercise Sy for ech of the following trnsition systems whether they re pirwise bisimilr: b b c b c b c c b c c Exercise Show tht the following trnsition systems re not bisimilr, where the trnsition system to the left consists of sequences of -trnsitions with length n for ech n N. The trnsition system to the right is the sme except tht it cn dditionlly do n infinite sequence of -trnsitions. 17

18 Exercise Give the unique miniml lbelled trnsition system tht is bisimilr to the following one: b b b b Trce equivlence b b A quite different behviourl equivlence is trce equivlence. The essentil ide is tht two trnsition systems re equivlent if the sme sequences of ctions cn be performed from the respective initil sttes. Definition (Trce equivlence). Let A = (S,Act,, s, T) be lbelled trnsition system. The set of trces (runs, sequences) Trces(t) for stte t S is the miniml set stisfying: 1. ǫ Trces(t), i.e. the empty trce is member of Trces(t). 2. Trces(t) iff T(t), nd 3. if there is stte t S such tht t t nd σ Trces(t ) then σ Trces(t). Two sttes t, u S re clled trce equivlent iff Trces(t) = Trces(u). Two trnsition systems re trce equivlent if their initil sttes re trce equivlent. Note tht the two trnsition systems in figure 2.5 both hve sets of trces {ǫ,, c, b} nd hence they re trce equivlent. Yet, s rgued there, in n ordinry behviourl sense we cnnot consider them equl. This is the reson why trce equivlence generlly is not used. The two b b Figure 2.6: Trce equivlence does not preserve dedlocks trnsition systems in figure 2.6 re lso trce equivlent. Both hve trce sets {ǫ,, b, b }. However, the trnsition system t the left cn dedlock fter doing single. This is not possible in the trnsition system t the right. As dedlock freedom, i.e., the bsence of dedlock, is n importnt notion in processes, behviourl equivlences should preserve dedlocks. This is lso n rgument ginst the use of trce equivlence. 18

19 However, there re cses where trce equivlence is useful. If the only observtions re tht one cn see wht is hppening without being ble to influence this behviour, trce equivlence is exctly the right notion. Also, mny properties only regrd the trces of processes. A property cn for instnce be tht before every b n ction must be done. This property is preserved by trce equivlence. So, in order to determine this for the trnsition system on the left in figure 2.6, it is perfectly vlid to first trnsform it into the trnsition system on the right of this figure, nd then determine the property for this lst trnsition system. Exercise Which of the lbelled trnsition systems of exercise re trce equivlent Lnguge nd filures equivlence In lnguge theory lbelled trnsition systems re in common use to help in prsing of lnguges. Generlly, the word utomton is used for lbelled trnsition systems in tht context. Process theory, s described here, nd lnguge theory hve lot in common. For instnce grmmrs to describe lnguges re essentilly the sme s process expressions s described in the next chpter. There is however one difference. In the process world there re mny different behviourl equivlences, wheres in the lnguge world lnguge equivlence is essentilly the only one. In the process world one lso refers to this equivlence s completed trce equivlence. Every trce tht cnnot be extended is clled completed trce or sentence. Two processes re lnguge equivlent if their sets of sentences re the sme. More formlly: Definition (Lnguge equivlence). Let A = (S, Act,, s, T) be lbelled trnsition system. We define the lnguge Lng(t) of stte t S s the miniml set stisfying: ǫ Lng(t) if not T(t) nd there re no t S nd Act such tht t t ; Lng(t) if T(t) nd there re no t S nd Act such tht t t ; nd if t t nd σ Lng(t ) then σ Lng(t). Two sttes t, u S re lnguge equivlent iff Lng(t) = Lng(u). Two lbelled trnsition systems re lnguge equivlent if their initil sttes re lnguge equivlent. Note tht the trnsition systems in figure 2.6 re not lnguge equivlent. The lnguge of the one t the left is {b, } wheres the lnguge of the one t the right is {b }. The trnsition systems in figure 2.5 re lnguge equivlent, both hving the lnguge {b, c}. However, suppose one would decide to block the ction c in both digrms, which is norml opertion on behviour. Then the two trnsition digrms of figure 2.6 re obtined, which re not lnguge equivlent nymore. This is n nnoying property tht mkes lnguge equivlence quite unusble in the context of interction. The equivlence tht is closest to lnguge equivlence, but tht cn stnd interction is filures equivlence. It preserves dedlocks, but reltes fr more processes thn bisimultion equivlence. Therefore, some people prefer filures equivlence bove bisimultion. The definition of filures equivlence hs two steps. First refusl set of stte t is defined to contin those ctions tht cnnot be performed in t. Then filure pir is defined to be trce ending in some refusl set. Definition (Filures equivlence). Let A = (S,Act,, s, T) be lbelled trnsition system. A set F Act { } is clled refusl set of stte t S, if for ll F there is no t S such tht t t. The termintion symbol cn be n element of F if not T(t), i.e. if t cnnot terminte. The set of filure pirs, FilurePirs(t) of stte t S is inductively defined s follows (ǫ, F) FilurePirs(t) if F is refusl set of t. (, F) FilurePirs(t) if T(t) holds, nd 19

20 If t t nd (σ, F) FilurePirs(t ) then (σ, F) FilurePirs(t). Two sttes t, u S re filures equivlent if FilurePirs(t) = FilurePirs(u). Two trnsition systems re filures equivlent if their initil sttes re filures equivlent. Exercise Stte whether the following pirs of trnsition systems re lnguge nd/or filures equivlent. b c c f b c c f b b b b c b c d e e d The Vn Glbbeek liner time brnching time spectrum As stted before, there re very mny process equivlences. A nice clssifiction of some of these hs been mde by Vn Glbbeek [17]. He produced the so-clled liner time - brnching time spectrum which is depicted in figure 2.7. At the top the finest the less relting equivlence is depicted nd towrds the bottom the corser the more relting equivlences re found. The rrows indicte tht n equivlence is strictly corser. So, if processes re bisimultion equivlent, then they re lso 2-nested simultion equivlent. Clerly, bisimultion equivlence is the finest equivlence nd trce equivlence the corsest. So, if two processes re bisimilr then they re equivlent in ny sense. If processes re not bisimilr, but still pper to be behviourlly equl, then it mkes sense to investigte whether they re equl with respect to ny other equivlence. Ech equivlence hs its own properties, nd it goes too fr to tret them ll. Some interesting properties cn still be mentioned. Suppose tht we cn interct with mchine tht is equipped with n undo button. So, fter doing some ctions, we cn go bck to where we cme from. Then one cn devise tests to distinguish between processes tht re not redy simultion equivlent. So, redy simultion is tightly connected to the cpbility of undoing ctions. In similr wy, possible future equivlence is strongly connected to the cpbility of predicting which ctions re possible in the future nd 2-nested simultion equivlence combines them both. The Vn Glbbeek spectrum is strongly connected to non determinism. If the trnsition systems re deterministic then the whole spectrum collpses. In tht cse two sttes re bisimultion equivlent if nd only if they re trce equivlent. We stte this theorem precisely here nd provide the full proof s n exmple of how properties of bisimultion re proven. Definition We cll lbelled trnsition system A = (S,Act,, s, T) deterministic iff for ll sttes t, t, t S nd ction Act it holds tht if t t nd t t then t = t. Theorem Let A = (S, Act,, s, T) be deterministic trnsition system. For ll sttes t, t S it holds tht Trces(t) = Trces(t ) iff t t. Proof. We only prove the cse from left to right, leving the cse from right to left s n exercise. In order to show tht t t, we need to show the existence of bisimultion reltion R such tht trt. We coin the following reltion for ny sttes u nd u : R(u, u ) iff Trces(u) = Trces(u ). Finding the right reltion R is generlly the crux in such proofs. Note tht R is indeed suitble, s R reltes t nd t. So, we re only left with showing tht R is indeed bisimultion reltion. This boils down to checking the properties in definition So, ssume tht for sttes u nd v we hve tht urv. Then 20

21 bisimultion 2-nested simultion redy simultion possible worlds possible futures redy trce filure trce rediness simultion filures lnguge trce Figure 2.7: The Vn Glbbeek liner brnching time spectrum 21

22 1. Suppose v v. So, ccording to definition σ Trces(s) for ll trces σ Trces(v ). Furthermore, s Trces(u) = Trces(v), it holds tht σ Trces(v) or in other words, v v for some stte v S. So, we re left to show tht u Rv, or in other words: Trces(u ) = Trces(v ). We prove this by mutul set inclusion, restricting to only one cse, s both re lmost identicl. So, we prove Trces(u ) Trces(v ). So, ssume some trce σ Trces(u ). So, σ Trces(u), nd consequently σ Trces(v). So, there is v such tht v v nd σ Trces(v ). Now, s the trnsition system A is deterministic, v v nd v v, we cn conclude v = v. Ergo, σ Trces(v ). 2. This second cse is symmetric to the first cse nd goes ccording to exctly the sme lines. 3. If T(u), then Trces(u). As u nd v re relted, it follows by definition of R tht Trces(v). So, T(v). Similrly, it cn be shown tht if T(v) then T(u) must hold. The definitions of bisimultion re much more complex thn those for lnguge or trce equivlence. This might led to the wrong ssumption tht determining whether two trnsition systems re bisimilr is much hrder thn determining their trce or lnguge equivlency. The contrry is true. Virtully ll forms of bisimultion cn be determined in polynomil time on finite stte trnsition systems, wheres trce, filure nd lnguge equivlence re in generl difficult (P-spce hrd). Exercise Prove tht n uto-bisimultion is n equivlence reltion, i.e., bisimultion must be reflexive (s s for ny s S), symmetric (if s t then t s for ll sttes s nd t) nd trnsitive (if s t nd t u, then s u for ll sttes s, t, u). 2.4 Behviourl bstrction Although the exmples given up till now my give different impression, the behviour of systems cn be utterly complex. The only wy to obtin insight in such behviour is to use bstrction. The most common nd extremely powerful bstrction mechnism is to declre n ction to be non observble or internl. Milner introduced this notion [38] together with n ssocited process equivlence, clled wek bisimultion. We re minly using brnching bisimultion which ws defined by Vn Glbbeek nd Weijlnd [18]. Brnching bisimultion nd wek bisimultion serve the sme purpose, nmely relting processes with internl ctions, nd re exchngeble for prcticl purposes The internl ction τ An ction is internl, if we hve no wy of observing it directly. We use the specil symbol τ to denote ny internl ction. We generlly ssume tht it is vilble in lbelled trnsition system, i.e., τ Act. Typicl for n internl ction is tht if it follows nother ction, it is impossible to sy whether it is there. So, the trnsition systems in figure 2.8 cnnot be distinguished, becuse the τ fter the cnnot be observed. Such internl ctions re clled inert. However, in certin cses the presence of n internl ction cn be observed, lthough the ction by itself cnnot be seen. See figure 2.9. Suppose one expects the behviour of the figure t the right. Then it is lwys possible to do n -ction, s long s neither n or b hve been done. Now suppose the ctul behviour is tht of the figure t the left. After while, if the internl ction hs silently hppened, it is impossible to do the nymore. Hence, it is observed tht the behviour cnnot be the sme s tht of the trnsition system t the right. In this cse the τ is not inert, nd it cnnot be removed without chnging the behviour. 22

23 τ b b Figure 2.8: The internl ction τ is not visible τ b b Figure 2.9: The internl ction τ is indirectly visible 2.5 Behviourl equivlence for the internl ction With the internl ction present, equivlences for processes chnge slightly, to tke into ccount tht we cnnot observe the internl ction directly. Here the most importnt of such equivlences re given Rooted brnching bisimultion In [16] it is shown tht the observble equlity of the two behviours in figure 2.8 leds to rooted brnching bisimultion s the finest equivlence incorporting internl ctions [18]. The rgument uses the presence of prllelism. The ide is very similr to tht of strong bisimultion. But now, insted of letting single ction be simulted by single ction, n ction cn be simulted by sequence of internl trnsitions, followed by tht single ction. See the digrm t the left of figure Note tht ll sttes tht re visited vi τ ctions re relted. If the ction to be simulted is τ it cn be simulted by ny number of internl trnsitions. Even by none, s the digrm in the middle of figure 2.10 shows. If stte cn terminte, it does not need to be relted to terminting stte. It suffices if terminting stte cn be reched fter number of internl trnsitions, s shown t the right of figure Definition (Brnching bisimultion). Consider the two lbelled trnsition systems R R R τ τ τ R R R R τ τ Figure 2.10: Brnching bisimultion 23

24 s 1 τ s 2 s 3 b s 4 s 5 R t 1 s 1 b τ τ t 2 t 3 s 2 s 3 b b t 4 t 5 s 4 s 5 R R R b t 1 τ t 2 t 3 b t 4 t 5 s 1 τ R t 1 s 1 b τ τ R b t 1 τ s 2 s 3 b t 2 t 3 b s 2 s 3 b t 2 t 3 b s 4 s 5 t 4 t 5 s 4 s 5 t 4 t 5 Figure 2.11: Two brnching bisimilr trnsition systems A 1 = (S 1,Act, 1, s 1, T 1 ) nd A 2 = (S 2,Act, 2, s 2, T 2 ). We cll reltion R S 1 S 2 brnching bisimultion reltion if for ll s S 1 nd t S 2 such tht srt, the following conditions hold: 1. If s 1 s, then - either = τ nd s Rt, or - there is sequence t τ τ 2 2 t of (zero or more) τ-trnsitions such tht srt nd t 2 t with s Rt. 2. Symmetriclly, if t 2 t, then - either = τ nd srt, or - there is sequence s τ τ 1 1 s of (zero or more) τ-trnsitions such tht s Rt nd s 1 s with s Rt. 3. If T(s), then there is sequence of (zero or more) τ-trnsitions t τ τ 2 2 t such tht srt nd T(t ). 4. Agin, symmetriclly, if T(t), then there is sequence of (zero or more) τ-trnsitions s τ 1 τ 1 s such tht srt nd T(s ). Two sttes s nd t re brnching bisimilr, denoted by s b t, if there is brnching bisimultion reltion R such tht srt. Two lbelled trnsition systems re brnching bisimilr if their initil sttes re brnching bisimilr. Exmple In figure 2.11 two trnsition systems re depicted. We cn determine tht they re brnching bisimilr in the sme wy s for strong bisimultion. So, first ssume tht the initil sttes must be relted, vi some reltion R. For R to be brnching bisimultion, the trnsition s 1 s3 must be mimicked. This cn only be done by two trnsitions t 1 τ t3 t4. So, s depicted in the second digrm, s 1 must be relted to the intermedite stte t 3 nd s 3 must be relted to t 4. Now, by letting the trnsition t 1 b t2 be simulted by s 1 τ s2 b s5 the reltion is extended s indicted in the third digrm. Ultimtely, the reltion R must be extended s indicted in the fourth digrm. It requires creful check tht this reltion is indeed brnching bisimultion reltion. 24

25 τ Figure 2.12: Brnching bisimultion does not preserve firness Brnching bisimultion equivlence stisfies notion of firness. Tht is, if τ-loop exists, then no infinite execution sequence will remin in this τ-loop forever if there is possibility to leve it. The intuition is tht there is zero chnce tht no exit from the τ-loop will ever be chosen. It is strightforwrd to show tht the initil sttes in the two lbelled trnsition systems in figure 2.12 re brnching bisimilr. Brnching bisimultion hs n unplesnt property. If n lterntive is dded to the initil stte then processes tht were brnching bisimilr re not brnching bisimilr nymore. In the next chpter, we will see tht dding n lterntive to the initil stte is common opertion. The following figure illustrtes the problem: τ τ b b The two trnsition systems t the left re brnching bisimilr, but the digrms t the right reflect the trnsition systems of figure 2.5. They re not brnching bisimilr, becuse doing the τ in the third trnsition system mens tht the option to do b disppers, nd this is not possible in the fourth grph. Milner [40] showed tht this problem cn be overcome by dding rootedness condition: initil τ-trnsitions re never inert. In other words, two processes re considered equivlent if they cn simulte ech other s initil trnsitions, such tht the resulting processes re brnching bisimilr. This leds to the notion of rooted brnching bisimultion, which is presented below. Definition (Rooted brnching bisimultion). Let A 1 = (S 1,Act, 1, s 1, T 1 ) nd A 2 = (S 2,Act, 2, s 2, T 2 ) be two lbelled trnsition systems. A reltion R S 1 S 2 is clled rooted brnching bisimultion reltion if it stisfies for ll s S 1 nd t S 2 such tht srt: 1. if s 1 s, then there is t S 2 such tht t 2 t nd s b t, 2. symmetriclly, if t 2 t, then there is n s S 1 such tht s 1 s nd s b t, nd 3. T 1 (s) if nd only if T 2 (t). Two sttes s S 1 nd t S 2 re rooted brnching bisimilr, denoted by p rb q, if there is rooted brnching bisimultion reltion R such tht srt. Two trnsition systems re rooted brnching bisimilr iff their initil sttes re rooted brnching bisimilr. Brnching bisimultion equivlence strictly includes rooted brnching bisimultion equivlence, which in turn strictly includes bisimultion equivlence: rb b. In the bsence of τ, bisimultion nd brnching bisimultion coincide. 25

26 Exercise Show using the definition of rooted brnching bisimultion tht the two lbelled trnsition systems in figure 2.8 re rooted brnching bisimilr. Show lso tht the two trnsition systems in figure 2.9 re neither rooted brnching bisimilr nor brnching bisimilr. Exercise Which of the following pirs of trnsition systems re brnching nd/or rooted brnching bisimilr. τ b τ τ b τ c b τ c b c b c b c b c b b Exercise With regrd to the exmples in the previous exercise which τ-trnsitions re inert with respect to brnching bisimultion, i.e., for which τ-trnsitions s τ s re the sttes s nd s brnching bisimilr Rooted wek bisimultion A slight vrition of brnching bisimultion is wek bisimultion. We give its definition here, becuse wek bisimultion ws defined well before brnching bisimultion ws invented nd therefore wek bisimultion is much more commonly used in the literture. The primry difference between brnching nd wek bisimultion is tht brnching bisimultion preserves the brnching structure of processes. For instnce the lst pir of trnsition systems in exercise re wekly bisimilr, lthough the initil in the trnsition system t the left cn mke choice tht cnnot be mimicked in the trnsition system t the right. The brnching structure is not respected. It is useful to know tht (rooted) brnching bisimilr processes re lso (rooted) wekly bisimilr. Furthermore, from prcticl perspective, it hrdly ever mtters whether brnching or wek bisimultion is used, except tht the lgorithms to clculte brnching bisimultion on lrge grphs re more efficient thn those for wek bisimultion. Definition (Wek bisimultion). Consider the two lbelled trnsition systems A 1 = (S 1,Act, 1, s 1, T 1 ) nd A 2 = (S 2,Act, 2, s 2, T 2 ). We cll reltion R S 1 S 2 wek bisimultion reltion if for ll s S 1 nd t S 2 such tht srt, the following conditions hold: 1. If s 1 s, then - either = τ nd s Rt, or - there is sequence t τ 2 τ 2 2 τ 2 τ 2 t such tht s Rt. 2. Symmetriclly, if t 2 t, then - either = τ nd srt, or - there is sequence s τ 1 τ 1 1 τ 1 τ 1 s such tht s Rt. 3. If T(s), then there is sequence t τ 2 τ 2 t such tht T(t ). 4. Agin, symmetriclly, if T(t), then there is sequence s τ 1 τ 1 s such tht T(s ). Two sttes s nd t re wekly bisimilr, denoted by s w t, iff there is wek bisimultion reltion R such tht srt. Two lbelled trnsition systems re wekly bisimilr iff their initil sttes re wekly bisimilr. 26

27 R τ τ τ R R R τ τ R τ τ Figure 2.13: Wek bisimultion In figure 2.13 wek bisimultion hs been depicted. Compre this figure with figure 2.10 for brnching bisimultion. Note tht wek bisimultion is more relxed in the sense tht R does not hve to relte tht mny sttes. The notion of rooted wek bisimultion is defined long exctly the sme lines s rooted brnching bisimultion. The underlying motivtion is exctly the sme. Definition (Rooted wek bisimultion). Let A 1 = (S 1,Act, 1, s 1, T 1 ) nd A 2 = (S 2,Act, 2, s 2, T 2 ) be two lbelled trnsition systems. A reltion R S 1 S 2 is clled rooted wek bisimultion reltion if R is wek bisimultion reltion nd it stisfies for ll s S 1 nd t S 2 such tht srt: 1. if s τ 1 s, then there is sequence t τ 2 τ 2 τ 2 t of t lest length 1 nd s w t, nd τ 2. symmetriclly, if t 2 t, then there is sequence of t lest length 1 of τ-steps s τ τ 1 1 τ 1 s nd s w t. Two sttes s S 1 nd t S 2 re rooted wek bisimilr, denoted by p rw q, if there is rooted wek bisimultion reltion R such tht srt. Two trnsition systems re rooted wek bisimilr iff their initil sttes re rooted wek bisimilr. We finish this section by showing the reltionships between the vrious bisimultion reltions defined hitherto. rb b w, rb rw w. Note tht rooted wek bisimultion nd brnching bisimultion re incomprble. Exercise Which of the pirs of trnsition systems of exercise re (rooted) wekly bisimilr. Which τ-trnsitions re inert with respect to wek bisimultion. Exercise Prove tht ny brnching bisimultion is wek bisimultion reltion Wek trce equivlence Two processes re wekly trce equivlent, if their sets of trces in which τ-trnsitions re mde invisible re the sme. Definition (Wek trce equivlence). Let A = (S,Act,, s, T) be lbelled trnsition system. The set of wek trces WTrces(t) for stte t S is the miniml set stisfying: 1. ǫ WTrces(t). 2. WTrces(t) iff T(s), nd 27