Towards Algebraic Semantics of Circus Time

Transcription

1 Towrds Algeric Semntics of Circus Time Kun Wei nd Jim Woodcock Deprtment of Computer Science, University of York, York, YO10 5GH, UK Astrct. Over the yers, the Circus fmily of nottion hs een used for specifiction, progrmming, nd verifiction y refinement in mny pplictions. Circus Time, timed vrint of Circus, plys key role in deling with timed ehviours. While most of the semntic developments of Circus Time hve tended to focus on the denottionl nd opertionl sides, the work on its lgeric semntics is frustrted y the fct tht the prllel opertors re di cult to e reduced to other primitives in oth discrete-time nd continuous-time CSP models. In this pper, we present n lgeric opertionl semntics (AOS) of the discrete-time CSP in Circus Time. The relted AOS form is identified in the timed context, nd complete set of lgeric lws re provided to trnsform ny finite Circus Time progrms into the AOS form. The AOS provides solution to sequentilise the prllel opertors nd is lso the mjor step towrds fully lgeric semntics. Keywords: Algeric Opertionl semntics;circus Time; Timed CSP 1 Introduction Circus [25, 3] is comprehensive comintion of Z [24], CSP [6, 15] nd Morgn s refinement clculus [10], so tht it cn define oth dt nd ehviourl spects of system. Over the yers, Circus hs developed into fmily of lnguges for specifiction, progrmming nd verifiction. For instnce, vrints nd extensions of Circus include Circus Time [17, 21], which provides time fcilities similr to Timed CSP [16], nd OhCircus [5], which is sed on the Jv pproch to oject-orienttion. The semntics of the Circus lnguges is sed on Hore nd He s Unifying Theories of Progrmming (UTP) [7], in which they use the lphetised reltionl clculus to descrie nd reson out wide vriety of progrmming prdigms. Circus hs een used for modelling nd verifiction of control systems specified in Simulink [2, 9]. Recently, Circus nd its extensions hve een dopted to formlise the Timends model [19] for complex rel-time systems, develop high-integrity Jv pplictions [4] with rigorous vlidtion nd verifiction, nd provide semntic support for modelling for dvnced Systems of Systems [23]. To confront the chllenges within these new pplictions, prticulrly for deling with time requirements, Circus Time is enhnced with new denottionl semntics [20] tht provides simpler mthemticl model nd supports contrctsed resoning, with more time opertors [21] in which, for exmple, dedline

2 opertors ply significnt role in imposing requirements on system s environment, nd with n opertionl semntics [22] tht is le to seemly descrie the elorte trnsitions of stte-rich processes y mens of using loose constnts to express the vlues of the progrm vriles. While most of the semntic developments of Circus Time hve tended to focus on the denottionl nd opertionl sides, there is no work on the lgeric semntics of Circus Time yet. Indeed the work on the lgeric semntics of Timed CSP is lso lcking. This my e relted to the fct [13] tht the prllel opertors re di cult to e reduced to other primitives in the stndrd Timed CSP. The lgeric semntics of Circus Time (or Timed CSP) is lso importnt since it cn e used to explin the di erences etween the opertionl nd denottionl semntics, nd give much extr insight into the process equivlence. In ddition, the refinement strtegy for high-integrity Jv pplictions [4] hevily depends on the lgeric semntics of Circus Time to remove the prllelism in the strct model. However, simply quoting set of lws does ring the dngers of not identifying processes tht should e equl, or, more worryingly, identifying equl processes tht should not e. Therefore, ny proposed set of lws must e vlidted to secure the intended im. Although how to crete n lgeric semntics for vrious CSP models hs een thoroughly investigted in [14], pplying the sme pproch to Timed CSP is not n esy tsk. As our est knowledge, some erly work on the lgeric semntics for discrete/continuous Timed CSP models cn e found in [12, 16] y providing some lgeric lws even for sequentilising the prllel opertors. For developing fully lgeric semntics for Circus Time, in this pper we investigte n lgeric strtegy to trnsform n ritrry finite Circus Time progrm with no dt opertion into norml form. This strtegy, which is clled the lgeric opertionl semntics (AOS) in CSP, reduces progrm y lgeric lws to revel its initil ctions nd their sequentil ehviours. The AOS lso provides the underlying foundtion to prove the lgeric lws in terms of the opertionl semntics. Moreover, the AOS form, which reflects the tree structure of how the process s opertionl semntics cretes lelled trnsition, ctully trnsltes Circus Time progrm into n untimed CSP progrm y using visile event (nmed ) to denote the pssge of time. In other words, the AOS form trnslted from Circus Time progrm cn e executed y the CSP model checker FDR [1]. Even if most of the lws introduced in this pper cn e similrly found in CSP [15, 14] nd Timed CSP [16, 12], we, here, provide strtegy to resettle these lws in Circus Time with slight chnges in regrd to the opertionl semntics. In ddition, we explore the fundmentl reson why it is so di cult to sequentilise the prllel opertors in Timed CSP, nd illustrte how we solve this prolem in Circus Time. To understnd this pper, we ssume the sic knowledge of CSP nd Timed CSP. The reminder of this pper hs the following structure. In Section 2, we riefly introduce the Circus Time model nd its properties, which expound the di erence from the Timed CSP models. In Section 3, the AOS form of Circus Time is identified, which discloses the connection etween the lgeric nd opertionl semntics. In Section 4, we develop complete set of lws to reduce n ritrry Circus Time progrm into the AOS form, which is the mjor step

3 towrds true norml form nd furthermore fully lgeric semntics. Finlly, we conclude the pper nd discuss the future work in Section 5. 2 Circus Time nd UTP Circus progrms re formed y sequence of prgrphs: chnnel declrtions, chnnel set definition, Z prgrphs, or process definitions. Processes re the key elements of Circus specifictions. A Circus process exhiits of ehviours, constructed y CSP opertors nd Z dt opertions s ctions, nd locl sttes, defined y Z schems nd ccessile only y its locl ctions, ut hidden to other processes. Processes cn communicte with ech other through chnnels. Actions cn e Z schems, gurded commnds of Dijkstr s lnguge, nd CSP processes. In rief, Circus progrm cn e roughly considered mixture of Z schems, impertive commnds nd CSP processes. The semntics of Circus is sed on UTP, firstly proposed in [26] nd lter completed in [11]. In UTP, designs, specifictions nd progrms re ll interpreted s reltions (or lphetised predictes) with n initil oservtion nd susequent (intermedite or finl) oservtion. Tht is very similr to the decortion style of Z schems. The sic ide to integrte Z nd CSP in Circus progrms is to convert Z expressions into specifiction sttements nd then emed the dt opertion into the theory of rective designs. In other words, we tret Circus progrm s predicte. As timed version of Circus, Circus Time, in fct, only concentrtes on the CSP constructs since the integrtion with Z cn proceed in the sme wy s in Circus. One of the most di erences of the timed model dopted in Circus Time from the stndrd Timed CSP models is tht it is complete lttice, in which the top element, Mircle, is used to define the importnt dedline opertors, nd interpret the ehviour of timestop. The denottionl semntics of Circus Time hs een estlished in [17, 21]. The Circus Time theory is sed on UTP where process is expressed y n lphetised reltion, consisting of set of undshed (for its predecessor) nd dshed vriles (for the current process). There re five oservtionl vriles, ok, wit, tr, ref, stte, nd their counterprts in the Circus Time model. We use ok 0 nd wit 0 to present the process s sttes such s termintion, divergence nd so on. The trces, tr nd tr 0, re defined to e non-empty sequences, nd ech element in the trces represents sequence of events tht hve occurred over one time unit. Also, ref nd ref 0 re non-empty sequences where ech element is refusl t the end of time unit. Thus, time is discrete nd hidden in the length of trces. In ddition, stte nd stte 0 record set of progrmming vriles nd their vlues. The timed model in Circus Time is similr to Lowe nd Ouknine s timed testing trces model [8, 12], which records refusls only efore the specil time event () rther thn simply fter ech stle ction. Towrds trnsforming ny Circus Time progrm into the AOS form, we currently consider the opertors only for the ehviourl description. The interction etween the opertors for dt opertions, such s ssignment, conditionl nd sttement, with the ehviourl opertors will e further explored in the ner future. The simplified syntx for Circus Time is in Figure 1.

4 P ::= Stop Mircle Chos c.e! P P ; Q P 2 Q P u Q P [ X ] Q P \ X Wit d P.{d} Q P I d d J P P 4 Q P 4 d Q Fig. 1. Restricted Circus Time Syntx Most primitive ctions nd opertors re the sme s those in Timed CSP. Note tht Chos in Circus Time is the worst ction nd its ehviour is unpredictle, wheres it is defined in totlly di erent mening in Timed CSP. Mircle, representing n unstrted ction, is usully considered useless ction in engineering prctice ecuse of its infesiility, ut it is useful s mthemticl strction in resoning out progrms. Stop is dedlocked ction nd represents termintion. Note tht, di erent from tht in Time CSP, in Circus Time does not llow ny time to pss. Thus, some lws such s Lw 17 nd Lw 71 nd re vlid in Circus Time only. The prefix c.e!p psses the vlue e through the chnnel c nd then ehves like P. And P ; Q is sequentil composition to perform P nd Q in sequence. The externl choice P 2 Q is resolved y visile events nd the internl choice P u Q ehves like P or Q nondeterministiclly. The opernds in the prllel composition P [ X ] Q must synchronise on the events in the set X. And the hiding ction P \ X mkes the events in X ecome invisile. The dely ction Wit d simply llows d time units to pss. The timeout ction P.{d} Q will pss the progrm control to Q if P does not perform ny visile event within d time units. If d is zero in the timeout opertor.{0}, we express it s P. Q. There re two dedline opertors in Circus Time: one (P I d) requires tht P must terminte within d time units, the other (d J P) requires tht visile event of P must occur within d time units. Also, there re two interrupt opertors: one is event-driven (P 4 Q), nd the other is time-driven (P 4 d Q). 3 AOS Form There is detiled introduction in [15, 14], which studies how to crete n lgeric semntics for certin CSP models. The pproch used in CSP is summrised in three steps. First, finite CSP progrm is trnsformed into n AOS form y lgeric lws. Second, the AOS form is converted into true norml form y stndrdising some prticulr ehviours. Finlly, rules re developed tht llow us to decide the equivlence of ritrry progrms vi their finite pproximtions. Developing the AOS is the most rduous work within this pproch, which is lso the mjor contriution of this pper. As in CSP, finite Circus Time progrm is defined s one with no recursion in its definition. Thus, ll finite progrms only hve finite numer of trces, other thn ones implied y divergence (Chos) nd endlessly intermedite stte (Stop). Also, in order to mke the concept of finite progrm esier to e defined nd mnipulted, we ssume tht the collection of visile events is finite.

5 Chos Stop Wit 1;P ᴨS P S (i) (ii) (iii) (iv) (?x:a P(x)) Mircle (?x:a P(x)) (Wit 1;Q)?x:A P(x) (?x:a P(x)) Q c c c c P() P().. P() P().. (?x:a P(x)) Q P() P().. P() P().. Q (v) (vi) (vii) (viii) Fig. 2. LTSs of AOS nodes other thn nd Mircle The AOS form of CSP is creted from finite process s opertionl semntics, so tht the LTS (Lelled Trnsition System) representtion of every finite CSP progrm cn e mpped into the AOS form in wy tht retins semntics in the denottionl model. Bsed on the initil ctions of ll possile LTS representtions, the AOS form of CSP consists of simple divergence process div ( self loop lelled with ), SKIP, nondeterministic choice u S ( set of ctions from the sme node), prefix choice?x :A! P(x) ( set of visile ctions from stle node) nd sliding choice (?x :A! P(x)). Q (visile nd ctions from n unstle node). In the LTS of Circus Time progrms, prt from visile nd invisile ctions, we define specil event to represent one time unit. The event hs no di erence from other ordinry events, except tht its identity is preserved for time units. Therefore, the trnsformtion of Circus Time progrms into the AOS form cn e considered trnsformtion into -CSP 1. The AOS form of Circus Time is the di erent comintions of the three ctions. In Circus Time, we identify eight forms in its AOS form s represented in Figure 2. Usully, the numer of the forms should e s smll s possile in order to require fewer lgeric lws. However, in this pper dditionl forms, such s the second nd seventh forms, re introduced to conveniently nd concisely construct the synthetic expressions. 1 In the erly of 1990s, discrete-time dilect [15] of Timed CSP ws introduced y Roscoe, sed on using specil event to represent the pssge of time, since the originlly continuous-time model ws considered lot prolemtic for utomtic verifiction in the FDR-using community. In the -CSP style, ordinry events re mesured y n infinite sequence of events. Here, two consecutive events represent one time unit nd ny event is simply n externl visile event. Oviously, one of the most importnt dvntges of this model is -CSP progrm cn e executed in the CSP model checker FDR with ese.

6 First, we use Chos to denote divergence. The ction Chos in Circus Time ehves like n infinite numer of ritrry ctions. For n esier representtion nd mnipultion of LTSs, we dopt the LTS of div to denote the unpredictle ehviour of Chos, since we re not interested in the ehviour fter divergent stte. To enle Chos with simple LTS to preserve its denottionl semntics, we propose specil rule tht ny divergent stte cn only e represented y self loop of nd ny other ctions strting from node with loop will e eliminted. Second, the dedlocked ction Stop is simply expressed s self loop of. In CSP, Stop is defined s?x :;!P so s not to introduce unnecessry lgeric lws. We retin this definition in Circus Time, ut reconsider it rewriting rule to replce the empty prefix choice with Stop. Note tht Stop is the only one tht cn introduce n infinite numer of events. Certinly, Circus Time cn define finite time units y the dely opertor nd its initil ction is identified s single in Figure 2. The nondeterministic choice (u S) is the sme s tht in CSP, the LTS of which is node with only. The fifth form in Figure 2 is the distinctive property in Circus Time tht forces (visile) events to hppen immeditely with no lterntive. This property cnnot e chieved in Timed CSP where there is lwys nother trnsition to go y performing if n event cnnot occur t once. The corresponding syntx of this form is inry externl choice of the prefix choice nd Mircle, whose ehviour hs een vlidted in [18, 21]. So fr, ll introduced LTSs consist of one kind of ctions only, nd the LTSs contining di erent kind of ctions re defined susequently. We identify three comintions of the prefix choice with single, self loop of nd the invisile ction respectively. The sixth form descries the initil ction of the externl choice etween the prefix choice nd dely. Since the property of constncy of o ers in Timed CSP tht set of visile ctions possile for process remins constnt s time progresses, the prefix choice is still ville fter performing. This corresponds with its denottionl semntics tht the pssge of time cnnot resolve the externl choice. For n ordinry prefix choice?x :A! P(x), we insert self loop of into the initil ctions of its LTS, ecuse it my ehve like Stop if its environment refuses to o er ny event from the set A. Oviously, the seventh form is more nturl nd elegnt thn finitely unfolding the loop of y the sixth form to represent the prefix choice. Under certin circumstnce, the loop of is unfolded to conveniently interct with other LTSs. This unfolding cn e explined y the following lw, which cn e esily proved y its opertionl semntics. Lw 1?x :A! P(x) =(?x :A! P(x) 2 (Wit d ;?x :A! P(x))) The finl form represents the initil ctions tht include oth nd visile ctions. Tht is, the visile ctions occur from unstle sttes. In CSP, the sliding choice opertor (.) is used to express this form, which is interpreted y the timeout opertor with zero time vlue in Circus Time (or Timed CSP). There is no comintion of nd ecuse the property of urgent internl ctions. If process cn perform n internl event then it cn llow no time to pss. In other words, if visile event ecomes invisile, the ction from the

7 Fig. 3. LTSs of CT efore (left) nd fter (right) trnsformtion sme node must e removed. This is implemented y its opertionl semntics. We therefore sy tht process is in the AOS form if it is Mircle, or tkes one of the forms in Figure 2. We cn trnsform ny LTS of finite Circus Time progrms into ones equivlent to the AOS form y the following three rules. First, if node is divergent with further ctions, then only the self loop of is retined with removl of ny other ctions. Second, if node n hs multiple ctions with sme lel x, then ll the x ctions re replced y single x to node tht hs the ctions to ll their susequent nodes. Third, specil rule is to check the well-definition of the sixth form in Figure 2. If node hs ction, nd visile ction tht sequentilly ehves like P(), nd if cn eing fired just fter (or strts from the node tht is ended y ) ut its sequent ehviour is di erent from P(), we then simply insert n invisile ction efore this. Thus, the LTSs of the AOS form constructed y its opertionl semntics hve the following properties. They hve finite numer of nodes. And the cycles re cused only either y the presence of Chos or the dedlocked stte. None of these trnsformtions ever chnges node s vlue in the Circus Time model. The ove third trnsformtion rule is prticulrly discussed in Section 4.7. We conclude tht every finite Circus Time progrm cn e constructed y the AOS form, nd this cn ctully e derived directly from its opertionl semntics. Here, we use n exmple tht is deliertely constructed to contin the first nd second rules of the trnsformtion discussed ove. The illustrtion of the third rule nd its motivtion cn e found in Section 4.7. Consider the finite Circus Time progrm CT, which is ctully the min ction without dt opertion, where CT = P 2 Q 2 R P =!! (Chos 2 ) Q =! Stop R =! (((! ) u (! )) 4 ((! ) 2 Mircle)) The LTS of CT generted y its opertionl semntics is illustrted in Figure 3. The single ction is removed from the node tht hs self loop of. This,

8 in fct, corresponds with the fct tht Chos hs the unit lw for every Circus Time opertors. Two nodes hve multiple ctions with the sme lel: the initil node hs two s nd the node in R fter the initil event hs two s. They re trnsformed in terms of the second rule, s shown in in Figure 3. The AOS form derived from the right LTS cn e expressed s CT AOS = S 2 T S =! ((! Chos) u Stop) T =! ((! ). ((! ) u (! ))) where?x : {, }! P(x) hs een unfolded s (! P()) 2 (! P()). Figure 3 demonstrtes n opertionl pproch to trnsform finite Circus Time progrm into the AOS form. The equivlence of CT nd CT AOS is proved y their LTSs in the opertionl semntics ecuse none of these trnsformtions ever chnges node s vlue. In the next section, we develop n lgeric pproch to trnsform CT into CT AOS directly y mens of lgeric lws. 4 Algeric Opertionl Semntics We hve shown the close connection etween the AOS form nd opertionl semntics. In this section, we develop n lgeric opertionl semntics tht is le to reduce n ritrry finite Circus Time progrm into the AOS form using lgeric lws of the vrious Circus Time opertors. To some extent this lgeric reduction strtegy is sed on the opertionl semntics. The complete collection of lws will e introduced in the pper, nd mny of them directly come from CSP nd Timed CSP. The lws we discuss in detil here minly concentrte on the interction etween the timed opertors nd the unstle ctions introduced y.. As the primitive ctions Chos, Mircle, Stop nd re lredy in the AOS form, we first give some lws tht cn simplify these primitives in sequentil composition. Lw 2 ; P = P = P ; Lw 3 Stop ; P = Stop Lw 4 Mircle ; P = Mircle Lw 5 Chos ; P = Chos To reduce progrm of the form Wit 1;P, weneedtoreducep only. We lso need Lw 6 to reduce Wit 0to, nd Lw 7 to unfold n intervl into sequence of single time units. Lw 6 (dely-zero) Wit 0= Lw 7 (dely-sum) Wit m + n = Wit m; Wit n Rther thn in the opertionl semntics, Lw 2 Lw 7 hve een proved in the denottionl semntics [21]. Similrly, for?x : A! P(x) nd ll P 2 S in u S, ll we need to do is to reduce ech P(x) (or P).

9 4.1 Externl Choice There re only two cses of externl choice, (?x : A! P(x)) 2 Mircle nd (?x : A! P(x)) 2 (Wit 1; Q), in the AOS form, nd for other cses we need to trnsform it into the AOS form. The lws of Chos, Stop nd in externl choice re s follows. Lw 8 (2-Stop) P 2 Stop = P Lw 9 (2-Chos) P 2 Chos = Chos Lw 10 (2-) P 2 = P. It is strightforwrd to understnd the ove lws. Lw 8 is the zero lw for Stop, Lw 9 is the unit lw for Chos, nd Lw 10 gives cler view of P 2 tht the ction leding to mkes the occurrence of nondeterministic. Another importnt lw is the ssocitive property of. nd 2. Lw 11 (2-sliding) (P. Q) 2 R = P. (Q 2 R) For the property of Mircle in 2, we only need Lw 12 for dely nd Mircle. Lw 12 (2-Mircle-dely) Mircle 2 (Wit 1;P) =Mircle If oth the opernds hve n initil dely in 2, then this dely cn e lifted forwrd, s descried in Lw 13. Lw 13 (2-dely) (Wit d ; P) 2 (Wit d ; Q) =Wit d ;(P 2 Q) If one of the opernds is internl choice, then it is expressed y the sliding choice. Lw 14 (2-u) (u S) 2 P = P. (u S) In ddition, the externl choice opertor hs the properties of idempotency, symmetry nd ssocitivity tht finish the reduction strtegy for Timeout For the form (?x : A! P(x)). Q, wesimplyneedtoreducep(x) nd Q. In Timed CSP, the sliding choice is the timeout opertor with zero time unit. For every non-zero timeout, we trnsform it into the AOS form. Note tht the time vlue d is non-negtive integer if it is not nnotted. As usul, we strt the lws from the primitives. Lw 15 (.-Stop) Stop.{d} P = Wit d ; P Lw 16 (.--1). P = u P Lw 17 (.--2).{d} P = provided d > 0 Lw 18 (.-Chos) Chos.{d} P = Chos Lw 19 (.-Mircle-left) Mircle.{d} P = Mircle

10 Lw 20 (.-Mircle-right) P. Mircle = P 2 Mircle Usully, we consider the left opernd in timeout ecuse it is AOS from only if the left one is prefix choice. Lw 15 sttes tht Stop cn never resolve the timeout opertor. Lw 16 sttes tht the timeout ecomes n internl choice since here cn resolve. nondeterministiclly. And Lw 17 sys tht decides the timeout immeditely when the time vlue is not due. Note tht Lw 17 is invlid in Timed CSP ecuse of the di erent opertionl semntics. Lw 18 is the unit lw for Chos in.. Mircle lso hs unit lw in. s Lw 19. In ddition, Lw 20 cn further reduce the form of sliding to the form of externl choice. Both internl nd externl choices hve the distriutive lws over.. Lw 21 (.-u-left-dist) (P u Q).{d} R =(P.{d} R) u (Q.{d} R) Lw 22 (.-2-left-dist) (P 2 Q).{d} R =(P.{d} R) 2 (Q.{d} R) Oviously, Lw 22 cn e pplied to reduce timeout in which the form of its left opernd is either (?x :A! P(x)) 2 Mircle or (?x :A! P(x)) 2 (Wit 1;Q). To reduce the ordinry prefix choice, we trnsform it into the sixth form in Figure 2. In Lw 23 the prefix choice is duplicted sequentilly fter the dely to retin the nondeterminism when the timeout is due. Lw 23 (.-choice-dely) (?x :A! P(x)).{d} Q = (?x :A! P(x)) 2 (Wit d ;((?x :A! P(x)). Q)) provided d > 0 Furthermore, there re two simple lws, Lw 24 nd Lw 25, to reduce the timeout with pure dely in its left opernd into the third form in Figure 2. Lw 24 (.-dely-1) (Wit d 1 ; P).{d 1 +d 2 } Q = Wit d 1 ;(P.{d 2 } Q) Lw 25 (.-dely-2) (Wit d 1 +d 2 ; P).{d 1 } Q = Wit d 1 ; Q if d 2 > Hiding Before investigting the reduction strtegy for prllel opertors, we need to reduce ctions contining the hiding opertor into the AOS form. A set of distriutive nd step lws for hiding re discussed s follows. The lws for the primitives re strightforwrd. Lw 26 (\-Stop) Stop \ X = Stop Lw 27 (\-) \ X = Lw 28 (\-Chos) Chos \ X = Chos Lw 29 (\-Mircle) Mircle \ X = Mircle Lw 30 (\-dely) (Wit d ; P) \ X = Wit d ;(P \ X )

11 Complex cses reside in the forms of the prefix nd sliding choices. Lw 31 nd Lw 32 re the step lws of hiding for the prefix choice, which re directly clculted from its opertionl semntics. Lw 31 (\-choice-1) (?x :A! P(x)) \ X =?x :A! (P(x) \ X ) provided A \ X = ; Lw 32 (\-choice-2) (?x :A! P(x)) \ X = (?x :A8X! (P(x) \ X )). (u{p(x) \ X x 2 A \ X }) provided A \ X 6= ; Note tht A8B represents the elements from A ut not included in B. For nother forms involving the prefix choice, we hve the following lws. Lw 33 (\-choice-urgency-1) ((?x :A! P(x)) 2 Mircle) \ X =(?x :A! (P(x) \ X )) 2 Mircle provided A \ X = ; Lw 34 (\-choice-urgency-2) ((?x :A! P(x)) 2 Mircle) \ X =(?x :A! P(x)) \ X provided A \ X 6= ; Lw 35 (\-choice-dely-1) ((?x :A! P(x)) 2 (Wit 1; Q)) \ X = (?x :A! (P(x) \ X )) 2 (Wit 1; (Q \ X )) provided A \ X = ; Lw 36 (\-choice-dely-2) ((?x :A! P(x)) 2 (Wit 1; Q)) \ X =(?x :A! P(x)) \ X provided A \ X 6= ; Agin, Lw 34 exhiits the property of Mircle tht it cn force n externl event to hppen immeditely. In other words, Mircle cn eliminte ny originted from the sme node with the externl event, which is lso the exct influence of n invisile ction on visile ctions. Therefore, Mircle in Lw 34 ecomes irrelevnt. Similrly, the delyed prt in Lw 36 is removed since the invisile ctions introduced y hiding enle the dely not to hppen. The sliding choice hs introduced n invisile ction. Hence, if A\X = ;, we simply move the hiding opertor inside on P(x) nd Q in Lw 37. Otherwise, we need to unite the P(x) \ X s, in which x 2 X, nd Q \ X into nondeterministic choice. Finlly, Lw 39 is the distriutive lw for nondeterminism. Lw 37 (\-sliding-1) ((?x :A! P(x)). Q) \ X = (?x :A! (P(x) \ X )). (Q \ X ) provided A \ X = ;

12 Lw 38 (\-sliding-2) ((?x :A! P(x)). Q) \ X = (?x :A8X! (P(x) \ X )). (u({p(x) \ X x 2 A \ X } [ {Q \ X })) provided A \ X 6= ; Lw 39 (\-u-dist) (P u Q) \ X =(P \ X ) u (Q \ X ) 4.4 Prllel composition The prllel opertors lws re more complex ecuse the forms of oth the opernds re considered. Similr to externl choice, prllel composition hs the properties of symmetry, ssocitivity nd distriutivity. Lw 40 (k-sym) P [ X ] Q = Q [ X ] P Lw 41 (k-ssco) P [ X ] (Q [ X ] R) =(P [ X ] Q) [ X ] R Lw 42 (k-dist) (P u Q) [ X ] R =(P [ X ] R) u (Q [ X ] R) In ddition, the primitives, Chos, Mircle, Stop nd, in prllel composition hve the property of idempotency. First of ll, Chos hs the unit lw for the prllel opertor, nd Mircle lso hs the sme one if the other opernd is not Chos. Lw 43 (k-chos) Chos [ X ] P = Chos Lw 44 (k-mircle) Mircle [ X ] P = Mircle provided P 6= Chos We reduce Stop to?x : ;!Chos only if it is in prllel with prefix choice, so tht it is le tke dvntge of the step lw, s elow, for the prlleled prefix choice. Lw 45 (k-choice-step) 8 9 P >< 0 (x) [ X ] Q 0 (x) if x 2 X \ A \ B >= P P [ X ] Q =?x :C! 0 (x) [ X ] Q if x 2 A8(B [ X ) P [ X ] Q >: 0 (x) if x 2 B8(A [ X ) >; (P 0 (x) [ X ] Q) u (P [ X ] Q 0 (x)) if x 2 (A \ B)8X provided P =?x : A! P 0 (x) nd Q =?x : B! Q 0 (x) C =(A \ B \ X ) [ (A8X ) [ (B8X ) This lw is the sme s the step lw in CSP nd Timed CSP. For the urgent nd delyed prefix choice, we distriute Mircle nd the delyed ction over the prllel opertor. Lw 46 (k-choice-urgency-dist) ((?x : A! P(x)) 2 Mircle) [ X ] Q = ((?x : A! P(x)) [ X ] Q) 2 (Mircle [ X ] Q)

13 Lw 47 (k-choice-dely-dist) ((?x : A! P(x)) 2 (Wit 1;Q)) [ X ] R = ((?x : A! P(x)) [ X ] R) 2 ((Wit 1;Q) [ X ] R) As result, we only need to investigte the step lws for the interctions mong, Wit 1;P,?x : A! P(x) nd (?x : A! P(x)). Q. To egin with, we give three step lws for. Lw 48 (k-dely-) (Wit d ; P) [ X ] = Wit d ;(P [ X ] ) Lw 49 (k-choice-) (?x :A! P(x)) [ X ] =?x :(A8X )! (P(x) [ X ] ) Lw 50 (k-sliding-) ((?x :A! P(x)). Q) [ X ] = ((?x :A! P(x)) [ X ] ). (Q [ X ] ) In Circus Time, if one opernd hs terminted, the other cn still evolve s stted in Lw 48. If one opernd is prefix choice, then Lw 49 sttes tht the events excluded in the interct X cn hppen only. Lw 50 descries tht the sliding choice nd in prllel equls to the ction tht intercts with the two opernds of. respectively. Second, we hve nother three lws for the dely opertor. Lw 51 sttes tht if oth opernds cn evolve, then the prllel simply evolves. Lw 51 (k-dely-step) (Wit d;p) [ X ] (Wit d;q) =Wit d;(p [ X ] Q) If n ction, like Q in Lw 52, is deliertely delyed to engge n interction with prefix choice, either the prefix choice including the non-synchronised events only cn hppen immeditely, or the prefix choice cn hppen fter one time unit. Lw 52 is one of the most importnt lws to sequentilise prllel composition, which is proved nd discussed further in Section 4.7. Lw 52 (k-choice-dely) (?x :A! P(x)) [ X ] (Wit 1;Q) = (?x :A8X! (P(x) [ X ] (Wit 1;Q))). (Wit 1;((?x :A! P(x)) [ X ] Q)) The ide of Lw 53 is tht if one of the opernds hs n initilly invisile ction in prllel, then fter the reduction, the whole prllel lso hs the invisile ction from the strt node. Lw 53 (k-sliding-dely) ((?x :A! P(x)). R) [ X ] (Wit 1; Q) = ((?x :A! P(x)) [ X ] (Wit 1; Q)). (R [ X ] (Wit 1; Q))

14 The finl two lws, Lw 54 nd Lw 55, re tken directly from the lgeric semntics of CSP [14] for descriing the initil ctions of the prllel compositions etween the prefix choice nd the sliding ction, nd etween the two sliding ctions. The two lws re retined in oth untimed nd timed CSP models. Lw 54 (k-choice-sliding) (?x :A! P(x)) [ X ] ((?x :B! Q(x)). R) = ((?x :A! P(x)) [ X ] (?x :B! Q(x))). ((?x :A! P(x)) [ X ] R) Lw 55 (k-sliding-step) ((?x :A! P(x)). R) [ X ] ((?x :B! Q(x)). S) = ((?x :A! P(x)) [ X ] (?x :B! Q(x))). (((?x :A! P(x)). R) [ X ] S) u (((?x :B! Q(x)). S) [ X ] R) 4.5 Interrupt The interrupt opertor cn lso e considered one of the prllel opertors, since oth the two opernds my contriute to the finl visile oservtion. However, ecuse the interrupt opertor is not symmetric, we need to propose the lws with respect to the opernds forms respectively. Therefore, we my see mny lws in this section tht re very similr to those in prllel composition. First, interrupts re still ssocitive, nd distriutive on the nondeterministic choice. Lw 56 (4-ssoc) P 4 (Q 4 R) =(P 4 Q) 4 R Lw 57 (4-u-left-dist) (P u Q) 4 R =(P 4 R) u (Q 4 R) Lw 58 (4-u-right-dist) P 4 (Q u R) =(P 4 Q) u (P 4 R) Similr to the strtegy for prllel composition, we reduce Stop to prefix choice with n empty set. Thus, Lw 59 sttes tht if ny ction interrupts, it ehves like the sliding of them. Lw 60 descries fct tht cn never successfully interrupt ny ction. As usul, Chos hs the unit lw, nd Mircle hs the similr lw if the other opernd is not Chos. Lw 59 (4--left) 4 P = P. Lw 60 (4--right) P 4 = P Lw 61 (4-Chos) Chos 4 P = Chos = P 4 Chos Lw 62 (4-Mircle) Mircle 4P =Mircle =P 4Mircle if P 6=Chos Within the considertion, we hve the distriutive lws of 4 for the forms of (?x :A! P(x)) 2 (Wit 1;Q) nd (?x :A! P(x)) 2 Mircle. Lw 63 (4-2-urgency-dist) ((?x :A! P(x)) 2 Mircle) 4 R =((?x :A! P(x)) 4 R) 2 (Mircle 4 R)

15 Lw 64 (4-2-dely-dist) (?x :A!P(x))2(Wit 1;Q))4R =((?x :A!P(x))4R)2((Wit 1;Q)4R) The following lws cn lso e found in the lgeric semntics of CSP [14]. They reduce the complex forms in the interrupt opertor such s the prefix nd sliding choices. Here, we will not elucidte these lws since they hve een investigted in CSP. We will focus on the lws for the dely ction in interrupts. Lw 65 (4-choice-step) 8 9 < (P 0 (x) 4 Q) u Q(x) if x 2 A \ B = P 4 Q =?x :A [ B! P 0 (x) 4 Q if x 2 A8B : Q 0 ; (x) if x 2 B8A provided P =?x : A! P 0 (x) nd Q =?x : B! Q 0 (x) Lw 66 (4-choice-sliding-right) (?x :A! P(x)) 4 ((?x : B! Q(x)). R) = ((?x :A! P(x)) 4 (?x : B! Q(x))). ((?x :A! P(x)) 4 R) Lw 67 (4-sliding-left) ((?x :A! P(x)). Q) 4 R =((?x :A! P(x)) 4 R). (Q 4 R) If one of the opernds in n interrupt is delyed ction, we reduce the interrupt into the form of externl choice. Lw 68 (4-dely-left) (Wit 1;P) 4 Q =(Wit 1;(P 4 Q)) 2 Q Lw 69 (4-dely-right) P 4 (Wit 1;Q) =P 2 (Wit 1;(P 4 Q)) For exmple, Lw 68 sttes tht if the left opernd is delyed for one time unit sequentilly followed y P, the right opernd Q cn interrupt Wit 1; P either from the strt or fter one time unit. 4.6 Timed interrupts Unlike the event-driven interrupt opertor, the time-driven interrupt opertor P 4 d Q resolves only if the time is due. To some extent, the lgeric lws of 4 d is similr to those of.{d} rther thn 4. Under certin circumstnces, we need to tret the cses tht d = 0 nd d > 0 respectively. For exmple, if the interruptile ction is, we hve two di erent lws in terms of the d s vlue. Lw 70 (Timed-4--1) 4 0 P = u P Lw 71 (Timed-4--2) 4 d P = provided d > 0 Since Stop is not interruptile, the interrupting ction P cn hppen only if the time is due.

16 Lw 72 (Timed-4-Stop) Stop 4 d P = Wit d ; P As usul, Chos hs the unit lw for. d. And Mircle cn retin the unit lw in the light of some conditions. Lw 73 (Timed-4-Chos) Chos 4 d P = Chos Lw 74 (Timed-4-Mircle) Mircle 4 d P = Mircle provided d > 0 Lw 75 (Timed-4-Mircle) Mircle 4 0 P = Mircle provided P 6= Chos The timed interrupt opertor remrkly hs the distriutive lws for oth internl nd externl choices. Lw 76 (Timed-4-2-dist) (P 2 Q) 4 d R =(P 4 d R) 2 (Q 4 d R) Lw 77 (Timed-4-u-dist) (P u Q) 4 d R =(P 4 d R) u (Q 4 d R) Thus, we still need to reduce the forms of prefix choice, dely nd sliding choice. Firstly, Lw 78 descries the reduction for n interruptile prefix choice when d = 0. The events chosen from the set A in the prefix choice ecome urgent only, which is expressed y the form of the sliding choice. However, the timed interrupt opertor will not e resolved in cse more urgent ctions from P(x) my occur. Similr to Lw 52, the vlue of d in Lw 79 is frgmented if the prefix events cnnot e performed immeditely. Lw 78 (Timed-4-choice-1) (?x :A! P(x)) 4 0 Q =(?x :A! (P(x) 4 0 Q)). Q Lw 79 (Timed-4-choice-2) (?x :A! P(x)) 4 d Q = (?x :A!(P(x) 4 d Q)). (Wit 1;((?x :A! P(x)) 4 d provided d > 0 1 Q)) In ddition, we hve two ovious lws for delyed ctions in timed interrupts to tke the delys forwrd. Lw 80 (Timed-4-dely-1) (Wit d 1 ; P) 4 d1+d 2 Q = Wit d 1 ;(P 4 d2 Q) Lw 81 (Timed-4-dely-2) ((Wit d 1 + d 2 );P) 4 d1 Q = Wit d 1 ; Q Finlly, we simply use distriutive lw to reduce n interruptile sliding choice into n AOS form. Lw 82 (Timed-4-sliding) ((?x :A! P(x)). Q) 4 d R =((?x :A! P(x)) 4 d R). (Q 4 d R)

17 (i) (ii) (iii) Fig. 4. LTSs clculted from OS nd reduction lws of Timed CSP nd Circus Time Note tht most of the lws introduced for. d impose no requirement on the form of the interrupting ctions. Tht is, the reduction strtegy for. d fully depends on the form of the interruptile ctions. As mtter of fct, the dedline opertors cn e defined y other Circus Time opertors nd therefore re le to use the existing lws. For exmple, the dedline opertor d J P, which requires tht visile events must e oserved within d, cn e defined y comining it with Mircle s P 2 (Wit d ; Mircle). And the dedline opertor P I d, which forces P to terminte y d, cn e defined y dopting Mircle to interrupt P fter d s P 4 d Mircle. All in ll, y mens of the lgeric lws introduced in this section, we conclude tht every Circus Time ction, which is constructed y the primitives nd opertors presented in Figure 1, cn e trnsformed into the ction consisting of the AOS form (in Figure 2) only. 4.7 Vlidtion Most of the lgeric lws introduced in the ove section come from the lgeric semntics of CSP [15, 14], nd some of the lws involving explicit delys hve een investigted in Timed CSP [16]. Even though Circus Time hs different CSP model from the stndrd models in CSP nd Timed CSP, those lws tht hve een proved in vrious CSP models cn e proved in Circus Time with little e ort. The proof simply depends on the opertionl semntics to clculte the initil ctions nd their following ehviours of lw s left-hnd side in the form of LTSs, trnsform the LTSs into the AOS form nd reverse it into the right-hnd side of the lw. The little work on the lgeric semntics of Timed CSP minly results from the di culty of reducing the prllel opertors to other sequentil opertors. An interesting exmple tken from [12] is the following process (! ) (Wit 1;! ) (1) constructed y two interleved components, the left one of which o ers immeditely since the strt, nd the right one of which wits one time unit nd then

18 o ers. The LTS clculted from the opertionl semntics of Circus Time [22] is illustrted y the left digrm in Figure 4. We interpret the left nd right rnches of this digrm divided y mens of the root node respectively s! ( (Wit 1;! )) (2) Wit 1;(!! ) (3) Unfortuntely, this LTS is not of the form?x :A! P(x) 2 Wit 1;Q, sincethe well-defined LTS of this form is tht the LTS of (2) should pper sequentilly fter the top right. Tht is, (! ) (Wit 1;! ) 6= (! ( (Wit 1;! ))) 2 (Wit 1;(!! )) The right-hnd side of the ove ineqution, fter one time unit, hs nondeterminism to perform, which, oviously, genertes two di erent ehviours. In other words, the first LTS in Figure 4 cnnot e clculted from ny nonprlleled opertors in Timed CSP. There re some pproches proposed to reduce the prllel opertors. For exmple, Lowe nd Ouknine in [8] introduce nonstndrd timeout opertor to eliminte prllel opertors in discrete-time context, ut t the cost of scrificing of some stndrd Timed CSP xioms nd lws. This specil timeout P. s {d}q is strict, in the sense tht events from P cnnot hppen when d = 0; y contrst, the stndrd timeout llows the events from oth P nd Q to occur nondeterministiclly when the timeout is due. On ccount of this specil timeout opertor, we cn reduce the process in (1) s (! ) (Wit 1;! ) = (! ( (Wit 1;! ))). s {1}(!! ) The dvntge of introducing the strict timeout is tht we cn generte sme LTS s the first digrm in Figure 4 for the reduction of the process in (1). However, it is di cult to identify form to express. s, which in turn cuses nother hssle into the proof of the relted lws sed on the opertionl semntics. Schneider in his CSP ook [16] uses timed event prefix, which records the time point of the occurrence of the event in time vrile, to del with the concurrent pssge of time in the prllel opertors, nd stndrd timeout opertor to cpture the ehviour when the first visile event hppens. For exmple, the process in (1) cn e reduced s (! ) (Wit 1;! ) = (@t! ( (Wit (1 t);! ))). {1}(!! ) The second LTS in Figure 4 is clculted from the right-hnd process of the ove eqution without considertion of the time vrile. We elieve tht the first nd second LTSs in Figure 4 re equl. However, the representtion of the timed event prefix in LTS is nother chllenge.

19 In this pper, we simply insert n invisile ction in front of the top-right, s the third LTS in Figure 4, to rek the comintion of nd, so s to dischrge the ssumption of the constncy of o ers. As result, we conclude (! ) (Wit 1;! ) = (! ( (Wit 1;! ))). (Wit 1;(!! )) which sttes tht the event in the left-hnd side of. hs to hppen immeditely, or my occur fter one time unit. This ide is in terms of the interprettion of. in timed context tht visile ctions, when competing with invisile ctions, cn hppen only if they re urgent s well. We elieve tht it is highly likely tht the first nd third LTSs in Figure 4 re equl in Circus Time. This is our shortterm gol for trnsforming ny progrm in the AOS form into true norml form. Intuitively,. seems to hve close reltion with the ehviour of simple prefix! P, which sys tht either occurs immeditely or dely is oserved efore. A rdicl strtegy is to reduce the simple prefix into., which cn reduce the numer of the AOS from. 5 Conclusion In this pper, we develop n AOS semntics for Circus Time, which is crucil towrds the lgeric semntics of Circus Time. Aprt from identifying the AOS form nd giving complete set of lws for trnsforming ny finite Circus Time progrms into the AOS form, we propose di erent pproch from existing work [12, 16] to sequentilise prllel opertors. This pproch retins the lgeric strtegy of the stndrd CSP with the slightest chnge to generte the lgeric semntics of Circus Time from its opertionl semntics. Towrds fully lgeric semntics of Circus Time, we need to further investigte the strtegy of converting progrms in the AOS form into true norml form, which cn decide tht ny pir of syntcticlly di erent progrms re semnticlly di erent y virtue of their LTSs. In ddition, the lgeric lws with dt opertions will e considered in the ner future, since the true power of Circus Time is the cpility to del with oth dt nd ehviour. Acknowledgements. This work ws fully supported y EPSRC (EP/H017461/1). References 1. A. W. Roscoe. Model-checking CSP. In A Clssicl Mind: essys in Honour of C.A.R. Hore, chpter 21. Prentice-Hll, A. Cvlcnti, P. Clyton, nd C. O Hllorn. From control lw digrms to d vi circus. Forml Asp. Comput., 23(4): , A. Cvlcnti, A. Smpio, nd J. Woodcock. A Refinement Strtegy for Circus. Forml Aspects of Computing,15(2-3): , A. Cvlcnti, F. Zeyd, A. J. Wellings, J. Woodcock, nd K. Wei. Sfety-criticl jv progrms from circus models. Rel-Time Systems, 49(5): , 2013.

20 5. A. L. C. Cvlcnti, A. C. A. Smpio, nd J. C. P. Woodcock. Unifying Clsses nd Processes. Softwre nd System Modelling, 4(3): , C. A. R. Hore. Communicting Sequentil Processes. Prentice-Hll Interntionl, C. A. R. Hore nd H. Jifeng. Unifying Theories of Progrmming. Prentice-Hll Interntionl, G. Lowe nd J. Ouknine. On timed models nd full strction. Electron. Notes Theor. Comput. Sci., 155: ,My A. Miyzw nd A. Cvlcnti. Refinement-sed verifiction of sequentil implementtions of stteflow chrts. In Refine, pges 65 83, C. Morgn. Progrmming from specifictions. Prentice-Hll, Inc., Upper Sddle River, NJ, USA, M. Oliveir, A. Cvlcnti, nd J. Woodcock. A UTP Semntics for Circus. Forml Aspects of Computing, 21(1):3 32, J. Ouknine. Discrete nlysis of continuous ehviour in rel-time concurrent systems. PhD thesis, Oxford University, UK, J. Ouknine nd S. Schneider. Timed csp: A retrospective. Electr. Notes Theor. Comput. Sci., 162: , A. Roscoe. Understnding Concurrent Systems. Springer-Verlg New York, Inc., New York, NY, USA, 1st edition, A. W. Roscoe. The Theory nd Prctice of Concurrency. Prentice-Hll Interntionl, S. A. Schneider. Concurrent nd rel-time systems: the CSP pproch. JohnWiley &Sons, A. Sherif, A. L. C. Cvlcnti, H. Jifeng, nd A. C. A. Smpio. A process lgeric frmework for specifiction nd vlidtion of rel-time systems. Forml Aspects of Computing, 22(2): , K. Wei, J. Woodcock, nd A. Burns. A timed model of Circus with the rective design mircle. In 8th Interntionl Conference on Softwre Engineering nd Forml Methods (SEFM), pges ,Pis,Itly,Septemer2010.IEEEComputer Society. 19. K. Wei, J. Woodcock, nd A. Burns. Modelling temporl ehviour in complex systems with timends. Forml Methods in System Design, 43(3): , K. Wei, J. Woodcock, nd A. Cvlcnti. Circus Time with rective designs. In UTP, pges68 87, K. Wei, J. Woodcock, nd A. Cvlcnti. New Circus Time. Technicl report, Computer Science, University of York, UK, Avlile t K. Wei, J. Woodcock, nd A. Cvlcnti. Opertionl Semntics for Circus Time. Technicl report, Computer Science, University of York, UK, Avlile t J. Woodcock, A. Cvlcnti, J. S. Fitzgerld, P. G. Lrsen, A. Miyzw, nd S. Perry. Fetures of cml: A forml modelling lnguge for systems of systems. In SoSE, pges IEEE, J. Woodcock nd J. Dvies. Using Z: Specifiction, Refinement nd Proof. Prentice- Hll, Inc., Upper Sddle River, NJ, USA, J. C. P. Woodcock nd A. L. C. Cvlcnti. A concurrent lnguge for refinement. In A. Butterfield nd C. Phl, editors, IWFM 01: 5th Irish Workshop in Forml Methods, BCS Electronic Workshops in Computing, Dulin, Irelnd, July J. C. P. Woodcock nd A. L. C. Cvlcnti. The semntics of circus. In D. Bert, J. P. Bowen, M. C. Henson, nd K. Roinson, editors, ZB 2002: Forml Specifiction nd Development in Z nd B, volume2272oflecture Notes in Computer Science, pges Springer-Verlg, 2002.