Causal closure for MSC languages

Transcription

1 FSTTCS 2006, 26th International Conference on Foundations of Software Technology and Theoretical Coputer Science Proceedings: R Raanuja, Sandeep Sen (eds.) Springer Lecture Notes in Coputer Science 3821 (2005), Causal closure for MSC languages Bharat Adsul, Madhavan Mukund, K. Narayan Kuar, and Vasuathi Narayanan Chennai Matheatical Institute, Chennai, India {abharat,adhavan,kuar,vasuathi}@ci.ac.in Abstract. Message sequence charts (MSCs) are coonly used to specify interactions between agents in counicating systes. Their visual nature akes the attractive for describing scenarios, but also leads to abiguities that can result in incoplete or inconsistent descriptions. One such proble is that of iplied scenarios a set of MSCs ay iply new MSCs which are locally consistent with the given set. If local consistency is defined in ters of local projections of actions along each process, it is undecidable whether a set of MSCs is closed with respect to iplied scenarios, even for regular MSC languages [3]. We introduce a new and natural notion of local consistency called causal closure, based on the causal view of a process all the inforation it collects, directly or indirectly, through its actions. Our ain result is that checking whether a set of MSCs is closed with respect to iplied scenarios odulo causal closure is decidable for regular MSC languages. 1 Introduction Message Sequence Charts (MSCs) [10] are an appealing visual foralis that are used in a nuber of software engineering notational fraeworks such as SDL [15] and UML [4, 8]. A collection of MSCs is used to capture the scenarios that a designer ight want the syste to exhibit (or avoid). A standard way to generate a set of MSCs is via Hierarchical (or Highlevel) Message Sequence Charts (HMSCs) [12]. Without losing expressiveness, we consider only a subclass of HMSCs called Message Sequence Graphs (MSGs). An MSG is a finite directed graph in which each node is labeled by an MSC. An MSG defines a collection of MSCs by concatenating the MSCs labeling each path fro an initial vertex to a terinal vertex. Though the visual nature of MSGs akes the attractive for describing scenarios, it also leads to abiguities that can result in incoplete or inconsistent descriptions. An iportant issue is the presence of iplied scenarios [2, 3]. An MSC M is (weakly) iplied by an MSC language L if the local actions of each process p along M agree with its local actions along soe good MSC M p L. Iplied scenarios are naturally tied to the question of realizability when is an MSG specification ipleentable as a set of counicating finite-state achines? In a distributed odel with local acceptance conditions, it is natural

2 336 to expect the specification to be closed with respect to local projections. Thus, a language is said to be weakly realizable if all weakly iplied scenarios are included in the language. Unfortunately, weak realizability is undecidable, even for regular MSC languages [3]. Weak iplication presues that the only inforation a process can aintain locally about an MSC is the sequence of actions that it participates in. However, we can augent the underlying essage alphabet of an MSC by tagging auxiliary inforation to each essage. Using this extra inforation, processes can aintain a bounded aount of inforation about the global state of the syste [13]. With this, we arrive at a stronger notion of iplied scenario that we call causal closure, based on the local view that each process has of an MSC fro the inforation it receives, directly or indirectly, about the syste. Our ain result is that causal closure preserves regularity for MSC languages, in contrast to the situation with weak closure. Fro this it follows that causal realizability is effectively checkable for regular MSC languages, both in the case of ipleentations with deadlocks and for safe, or deadlock-free, ipleentations. Our result also allows us to interpret MSGs as incoplete specifications whose seantics is given in ters of the causal closure. Thus, we can retain relatively siple visual specifications without coproising on the copleteness and consistency of verification. The paper is organized as follows. We begin with soe basic definitions regarding MSCs, essage sequence graphs and essage-passing autoata. In the next section, we recall the results for weakly iplied scenarios. In Section 4, we define the notion of causal closure and establish our ain result, that causal closure preserves regularity for MSC languages. Finally, in Section 5, we exaine the feasibility of using causal closure as a seantics for MSGs. 2 Preliinaries 2.1 Message sequence charts Let P = {p, q, r,...} be a finite set of processes (agents) that counicate with each other through essages via reliable FIFO channels using a finite set of essage types M. For p P, let Σ p = {p!q(), p?q() p q P, M} be the set of counication actions in which p participates. The action p!q() is read as p sends the essage to q and the action p?q() is read as p receives the essage fro q. We set Σ P = p P Σ p. We also denote the set of channels by Ch = {(p, q) p q}. Whenever the set of processes P is clear fro the context, we write Σ instead of Σ P, etc. Labelled posets A Σ-labelled poset is a structure M = (E,, λ) where (E, ) is a poset and λ : E Σ is a labelling function. For e E, let e = {e e e}. For X E, X = e X e. We call X E a prefix of M if X = X. For p P and a Σ, we set E p = {e λ(e) Σ p } and E a = {e λ(e) = a}, respectively. For each (p, q) Ch, we define the relation < pq as follows:

3 337 p q r e 1 1 e 2 e 2 2 e 3 e 3 1 e 3 Fig. 1. An MSC over {p, q, r}. e < pq e λ(e) = p!q(), λ(e ) = q?p() and e E p!q() = e E q?p() The relation e < pq e says that channels are FIFO with respect to each essage if e < pq e, the essage read by q at e is the one sent by p at e. Finally, for each p P, we define the relation pp = (E p E p ), with < pp standing for the largest irreflexive subset of pp. Definition 1. An MSC (over P) is a finite Σ-labelled poset M = (E,, λ) that satisfies the following conditions. 1. Each relation pp is a linear order. 2. If p q then for each M, E p!q() = E q?p(). 3. If e < pq e, then e ( M E p!q()) = e ( M E q?p()). 4. The partial order is the reflexive, transitive closure of the relation p,q P < pq. The second condition ensures that every essage sent along a channel is received. The third condition says that every channel is FIFO across all essages. In diagras, the events of an MSC are presented in visual order. The events of each process are arranged in a vertical line and essages are displayed as horizontal or downward-sloping directed edges. Fig. 1 shows an exaple with three processes {p, q, r} and six events {e 1, e 1, e 2, e 2, e 3, e 3 } corresponding to three essages 1 fro p to q, 2 fro q to r and 3 fro p to r. For an MSC M = (E,, λ), we let lin(m) = {λ(π) π is a linearization of (E, )}. For instance, p!q( 1 ) q?p( 1 ) q!r( 2 ) p!r( 3 ) r?q( 2 ) r?p( 3 ) is one linearization of the MSC in Fig. 1. MSC languages An MSC language is a set of MSCs. We can also regard an MSC language L as a word language L over Σ consisting of all linearizations of the MSCs in L. For an MSC language L, we set lin(l) = {lin(m) M L}. Definition 2. An MSC language L is said to be a regular MSC language if the word language lin(l) is a regular language over Σ. 2.2 Message sequence graphs Message sequence graphs (MSGs) are finite directed graphs with designated initial and terinal vertices. Each vertex in an MSG is labelled by an MSC. The edges represent (asynchronous) MSC concatenation, defined as follows.

4 338 p q r s p q r s p r q s M 1 M 2 CG M1 M 2 M 1 M 2 Fig. 2. A essage sequence graph Let M 1 = (E 1, 1, λ 1 ) and M 2 = (E 2, 2, λ 2 ) be a pair of MSCs such that E 1 and E 2 are disjoint. The (asynchronous) concatenation of M 1 and M 2 yields the MSC M 1 M 2 = (E,, λ) where E = E 1 E 2, λ(e) = λ i (e) if e E i, i {1, 2}, and = ( p,q P < pq), where < pp =< 1 pp <2 pp {(e 1, e 2 ) e 1 E 1, e 2 E 2, λ(e 1 ) Σ p, λ(e 2 ) Σ p } and for (p, q) Ch, < pq =< 1 pq <2 pq. A Message Sequence Graph is a structure G = (Q,, Q in, F, Φ), where Q is a finite and nonepty set of states, Q Q, Q in Q is a set of initial states, F Q is a set of final states and Φ labels each state with an MSC. A path π through an MSG G is a sequence q 0 q 1 q n such that (q i 1, q i ) for i {1, 2,..., n}. The MSC generated by π is M(π) = M 0 M 1 M 2 M n, where M i = Φ(q i ). A path π = q 0 q 1 q n is a run if q 0 Q in and q n F. The language of MSCs accepted by G is L(G) = {M(π) π is a run through G}. An exaple of an MSG is depicted in Fig. 2. The initial state is arked and the final state has a double line. The language L defined by this MSG is not regular: L projected to {p!q(), r!s()} consists of σ {p!q(), r!s()} such that σ p!q() = σ r!s() 1, which is not a regular string language. In general, it is undecidable whether an MSG describes a regular MSC language [9]. However, a sufficient condition for the MSC language of an MSG to be regular is that the MSG be locally synchronized. Counication graph For an MSC M = (E,, λ), let CG M, the counication graph of M, be the directed graph (P, ) where: P is the set of processes of the syste. (p, q) iff there exists an e E with λ(e) = p!q(). M is said to be co-connected if CG M consists of one nontrivial strongly connected coponent and isolated vertices. Locally synchronized MSGs The MSG G is locally synchronized [14] (or bounded [1]) if for every loop π = q q 1 q n q, the MSC M(π) is co-connected. In Fig. 2, CG M1 M 2 is not co-connected, so the MSG is not locally synchronized. We have the following result for MSGs [1]. Theore 3. If G is locally synchronized, L(G) is a regular MSC language.

5 Message-passing autoata Message-passing autoata are natural recognizers for MSC languages. Definition 4. A essage-passing autoaton (MPA) over Σ is a structure A = ({A p } p P,, s in, F) where: is a finite alphabet of auxiliary essages. Each coponent A p is of the for (S p, p ) where S p is a finite set of p-local states and p S p Σ p S p is the p-local transition relation. s in p P S p is the global initial state. F p P S p is the set of global final states. The local transition relation p specifies how the process p sends and receives essages. The transition (s, p!q(), x, s ) says that in state s, p can send the essage to q tagged with auxiliary inforation x and ove to state s. Siilarly, the transition (s, p?q(), x, s ) signifies that at state s, p can receive the essage fro q tagged with inforation x and ove to state s. A global state of A is an eleent of p P S p. For a global state s, s p denotes the pth coponent of s. A configuration is a pair (s, χ) where s is a global state and χ : Ch (M ) is the channel state describing the essage queue in each channel c. The initial configuration of A is (s in, χ ε ) where χ ε (c) is the epty string ε for every channel c. The set of final configurations of A is F {χ ε }. The set of reachable configurations of A, Conf A, is defined in the obvious way. The initial configuration (s in, χ ε ) is in Conf A. If (s, χ) Conf A and (s p, p!q(), x, s p) p, then there is a global ove (s, χ) p!q() = (s, χ ) where for r p, s r = s r, for each r P, χ ((p, q)) = χ((p, q)) (, x), and for c (p, q), χ (c) = χ(c). Siilarly, if (s, χ) Conf A and (s p, p?q(), x, s p) p, then there is a global ove (s, χ) p?q() = (s, χ ) where for r p, s r = s r, for each r P, χ((q, p)) = (, x) χ ((q, p)), and for c (q, p), χ (c) = χ(c). Let prf(σ) denote the set of prefixes of a word σ Σ. A run of A over σ is a ap ρ : prf(σ) Conf A such that ρ(ε) = (s in, χ ε ) and for each τa prf(σ), a ρ(τ) = ρ(τa). The run ρ is accepting if ρ(σ) is a final configuration. We define L(A) = {σ A has an accepting run over σ}. L(A) corresponds to the set of linearizations of an MSC language. To siplify notation, we write L(A) = L, where L is an MSC language, rather than L(A) = lin(l). For B N, we say that a configuration (s, χ) of A is B-bounded if χ(c) B for every channel c Ch. We say that A is a B-bounded autoaton if every reachable configuration (s, χ) Conf A is B-bounded. The MPA A in Fig. 3 has two coponents, p and q, with initial state (s 1, t 1 ) and only one final state, (s 2, t 3 ). A typical MSC in L(A) is displayed at the right. Deterinistic essage-passing autoata We say that A is deterinistic if the transition relation p for each coponent satisfies the following conditions: (s, p!q(), x, s ) p and (s, p!q(), x, s ) p iply x = x, s = s.

6 340 s 1 p!q() q?p() s 2 p!q() p?q( ) t 1 q!p( ) t 2 q?p() t 3 p q s 3 Fig. 3. A essage-passing autoaton. (s, p?q(), x, s ) p and (s, p?q(), x, s ) p iply s = s. For deterinistic MPAs, the global state at the end of an MSC is independent of the choice of linearization. Proposition 5. Let A be a deterinistic MPA, M = (E,, λ) an MSC and E E a prefix of M. Let w and w be linearizations of E and let ρ and ρ be the runs of A on w and w, respectively. Then, ρ(w) = ρ(w ). If A is deterinistic, for any prefix E of an MSC M, we can unabiguously write ρ(e ) to denote the unique run of A on E. In particular, the unique run of A on M can be written as ρ(m). The following theore characterizes regular MSC languages in ters of essage-passing autoata [9]. Theore 6. An MSC language L is regular iff there is a deterinistic B- bounded MPA A such that L(A) = L. 3 Iplied scenarios: the weak case When we use MSC languages to specify sets of scenarios, it is iportant to identify whether the specification is coplete. A natural requireent is that the language be closed with respect to local views for an MSC M, if every process locally believes that M belongs to the language L, M should in fact be in L. One way to foralize closure with respect to local views is in ters of local projections [2, 3]. Definition 7. Let M = (E,, λ) be an MSC and p P a process. The projection of M onto p, M p, is the Σ-labelled partial order (E p, p, λ p ), where p = (E p E p ) is a total order and λ p = λ Ep. An MSC M is said to be weakly iplied by L if for every process p P there is an MSC M p L such that M p p = M p. The weak closure of L is the collection of MSCs WeakCl(L) = {M M is weakly iplied by L}.

7 341 p q r s p q r s p q r s M M Fig.4. A regular MSC language whose weak closure has unbounded buffers Unfortunately, the weak closure of a language can adit unbounded channels even when every channel in the original language is uniforly bounded. An exaple is shown in Fig. 4 all essages are labelled and labels are oitted. Both M and M are co-connected, so the MSC language consisting of arbitrary concatenations of M and M is regular. However, for every natural nuber k, the weak closure of this language contains the MSC M k in which the actions of p and q correspond to the sequence M 2k M k while the actions of r and s atch the sequence M k M 2k. In M k, the buffer fro p to s contains k essages at the global state where p and q ake the transition fro M to M and r and s ake the transition fro M to M. The figure shows the case k = 2. The dotted line arks the global cut where the channel fro p to s has axiu capacity. Iplied scenarios have a close link to ipleentability, or realizability. An MSC language recognized by a counicating finite-state achine with a local acceptance condition ust be closed with respect to local views. We say that an MSC language L is weakly realizable if L = WeakCl(L). We have the following negative result [3], which arises fro the fact that the weak closure of a regular MSC language ay have unbounded buffers. Theore 8. Let G be a locally synchronized MSG. It is undecidable if L(G) is weakly realizable. To overcoe this negative result, a ore restrictive notion of realizability is proposed in [2, 11]. An MSC language is said to be safely realizable if it adits a deadlock-free ipleentation a deadlock is a global state fro which no accepting state is reachable. In a safe ipleentation, it turns out that all iplied scenarios ust have bounded buffers, yielding the following result [3]. Theore 9. Let G be a locally synchronized MSG. It is decidable if L(G) is safely realizable. 4 Causal closure for regular MSC languages Weak closure assues that the only inforation that a process can aintain locally about the current MSC is the sequence of actions that it participates

8 342 p q r s p q r s p q r s M 1 M 2 M Fig.5. Illustrating the difference between weak and causal closure in. However, as we have observed when characterizing regular MSC languages in ters of MPAs, we can tag each underlying essage with extra data using which processes can aintain a bounded aount of inforation about the global state of the syste. This leads us to a stronger notion of local view called causal view. We begin by defining p-views. For an MSC M = (E,, λ) and p P, let ax p (M) denote the axiu event fro E p in M since all p events in M are linearly ordered by pp, ax p (M) is well-defined whenever E p. Definition 10. Let M = (E,, λ) be an MSC and p P a process. The p-view of M, p (M), is the Σ-labelled partial order (E,, λ ) where E = {e e ax p (M)}, = (E E ) and λ = λ E. If E p =, p (M) = (,, ). It is easy to observe that p (M) is always a prefix of M. Causal realizability captures the intuition that each process p can keep track of the events in p (M). Definition 11. Let L be an MSC language. An MSC M is said to be causally iplied by L if for every process p P there is an MSC M p L such that p (M) = p (M p ). The causal closure of L is the collection of MSCs CausalCl(L) = {M M is causally iplied by L}. The language L is said to be causally realizable if L = CausalCl(L). An MSC language is causally realizable if each local process can recognize whether an MSC belongs to the language based purely on its causal view of the MSC. Observe that we always have L CausalCl(L). Thus, L is not causally realizable iff there is an MSC M CausalCl(L) such that M / L. We also have the inclusion CausalCl(L) WeakCl(L). In general, CausalCl(L) WeakCl(L) for instance, the iplied MSCs in Fig. 4 are not in the causal closure of the language. Fig. 5 illustrates the difference between weak and causal closure. Here M is in the weak closure of {M 1, M 2 } but not in the causal closure, because the causal view of process s includes inforation about whether or not p has sent a essage to q. Every regular MSC language L is recognized by a deterinistic B-bounded MPA A L. To construct an MPA for CausalCl(L), we siulate A L and ake each process go into a local accepting state if its current history is consistent with soe accepting run of A L. To achieve this, we ake use of a bounded tie-staping protocol for B-bounded MPA, described in [13], by which each process can aintain the latest known state of every other process and channel. Using this protocol, we can derive the following result.

9 343 Theore 12. Let A = ({A p } p P,, s in, F) be a deterinistic B-bounded MPA. We can augent A with tie-staping inforation to get a deterinistic B- bounded MPA A τ = ({A τ p} p P, τ, s τ in, F τ ) such that: For each process p, let A p = (S p, p ) and A τ p = (S τ p, τ p) be the p coponents of A and A τ, respectively. Then: Sp τ is of the for S p Γ, where Γ contains a bounded aount of tiestaped data about all the processes and channels in the syste. τ p is such that for every MSC M = (E,, λ) and for every prefix E of M, the unique run ρ τ (E ) of A τ on E corresponds to the unique run ρ(e ) of A on E in the sense that ρ(e ) atches the first coponent of ρ τ (E ). s τ in = p P (s p, γp) 0 where s in = p P s p and p P γ0 p is a fixed set of initial tie-staps. { F τ = p P (s p, γ p ) } p P s p F. Let M = (E,, λ) be an MSC. For each p P, fro the p-state (s p, γ p ) assigned by ρ τ ( p (M)) we can recover the configuration (s, χ) reached by A at the end of p (M). When we augent a deterinistic MPA A with tie-staping data to obtain A τ, after any sequence of actions w, the local state of p in A τ allows us to recover the global configuration reached by A after processing all actions in the p-view of w. Thus, increentally each process can keep track of the global configuration of the autoaton A for the portion of the MSC that it has seen so far. Theore 13. Let L be a regular MSC language. Then, its causal closure CausalCl(L) is also a regular MSC language. Proof. Since L is a regular MSC language, by Theore 6 there is a deterinistic B-bounded MPA A such that L(A) = L. We apply Theore 12, to obtain a new autoaton A τ that augents A with tie-staped inforation. For each process p, we define a subset of local final states Fp τ Sτ p as follows. A state (s p, γ p ) belongs to Fp τ iff, starting fro the configuration (s, χ) of A that we recover fro (s p, γ p ), A can reach a configuration (f, χ ε ), where f F, without perforing any actions involving process p. Notice that the sets Fp τ are effectively coputable. In A τ, we replace the set of global final states F τ by the product of local final states p P F p τ and call this odified MPA ACl τ. Clai L(A Cl τ ) = CausalCl(L). Proof of clai ( ) Suppose that M CausalCl(L). Then, for every process p, there is an MSC M p L such that p (M) = p (M p ). Fix p P and let (s p, γ p ) be the state of p in the run ρ τ of A τ on p (M). The configuration (s, χ) recorded in (s p, γ p ) is the configuration reached by A at the end of p (M) = p (M p ). Since M p L, A can reach a configuration (f, χ ε ), f F, starting fro (s, χ), without perforing any actions involving p. Thus, (s p, γ p ) Fp τ. Since p does not ake

10 344 any oves outside p (M), the state of p in ρ τ (M) also belongs to Fp τ. Since every process p reaches a state in Fp τ at the end of M, M L(A Cl τ ). ( ) Suppose that M L(A Cl τ ). Fix a process p, and let (s p, γ p ) Fp τ be the state of p in the accepting run ρ τ (M) of A Cl τ on M. Since p does not participate in any action outside p (M), the state of p in ρ τ ( p (M)) ust also be (s p, γ p ). Let (s, χ) be the configuration of A that we recover fro (s p, γ p ) by Theore 12, (s, χ) is the configuration reached by A at the end of p (M). Fro the definition of Fp τ, we know that A can reach a configuration (f, χ ε ) fro (s, χ), where f F, without perfoing any actions involving p. Let w p be linearization of p (M) and let w be the sequence of actions processed by A when going fro the configuration (s, χ) to the configuration (f, χ ε ). All essages sent during w p but not received in w p ust be received in w since all channels are epty in the final configuration. It is not difficult to see that w p w corresponds to the linearization of an MSC M p. By construction, A has an accepting run on M p, so M p L, with p (M) = p (M p ). Thus, whenever p reaches a state in Fp τ after M, there is an MSC M p L such that p (M) = p (M p ). If M is in L(A τ ), then we find such a witness M p for every p P, so M CausalCl(L). Since we can construct a B-bounded MPA recognizing CausalCl(L) for any regular MSC language L, we can effectively check whether L = CausalCl(L). Thus, we have the following. Corollary 14. For any regular MSC language L (respectively, locally synchronized MSG G), it is decidable if L (respectively, L(G)) is causally realizable. Every regular MSC language is recognized by a deterinistic MPA. Our construction for the causal closure preserves deterinacy. We can check this deterinistic MPA for deadlocked states, which iediately yields the following. Corollary 15. Let L be a regular MSC language. It is decidable if L is causally realizable and adits a deadlock-free ipleentation. Not all regular MSC languages are MSG-definable. A regular MSC language is MSG-definable precisely when it is finitely generated that is, there is a finite set of MSCs Atos = {M 1, M 2,...,M k } such that every MSC in the language can be written out as a sequence M i1 M i2 M il where each M ij Atos [9]. Proposition 16. There exist regular MSC languages L such that L is MSGdefinable but CausalCl(L) is not. Proof. The MSG in Fig. 6 is locally synchronized and hence defines a regular MSC language. In the sae figure is shown a faily of MSCs {M n } n N, each of which is causally iplied by the language of this MSG. However, observe that each M n is an atoic MSC that cannot be written as the asynchronous concatenation M 1 M 2 of two nontrivial MSCs. Thus, the causal closure of this MSG language is regular but not MSG-definable.

11 345 p q r s p q r s p q r s p q r s. n copies p q r s Fig.6. MSG definability and causal closure Moving to arbitrary MSGs takes us into the real of undecidability. We have the following results, whose proofs are oitted. Theore 17. For an arbitrary MSG G, it is undecidable whether L(G) is causally realizable. It is also undecidable whether the causal closure of L(G) is a regular MSC language. 5 MSGs as partial specifications The realizability question for MSGs asks whether the set of scenarios represented by an MSG corresponds exactly to the language of a suitably defined MPA. To ensure that a specification is realizable, we need to ipose severe restrictions on the structure of the MSG. This leads to an explosion in the coplexity of the MSG and detracts significantly fro the ain otivation for using this notation, which is to have a transparent and visually appealing foralis to describe the behaviour of counicating systes. An alternative is to view MSGs as partial specifications and interpret the odulo the closure conditions required by distributed ipleentations. This approach was studied in the context of Petri nets in [5]. For MPAs, we cannot use weak closure as the seantics of MSGs because weak closure does not preserve regularity. However, since the causal closure does preserve regularity, it is feasible to use this as a seantics for MSGs. Under the exact interpretation, locally synchronized MSGs correspond to the class of finitely-generated regular MSC languages [9]. If we interpret MSGs odulo causal closure, an MSG can represent languages that are not finitely generated (like the exaple in Fig. 6). This increases the expressive power of the MSG notation. Another advantage is that we can sensibly analyze less coplicated MSG specifications, aking the notation ore usable. MSC languages can also be used to specify desirable properties of counicating systes. Two interpretations are possible: positive scenarios are those that the syste ust be able to exhibit, while negative scenarios should be avoided.

12 346 Suppose we use MSC languages both to specify the counicating syste as well as to describe the scenarios that the syste should exhibit. To verify that a set of positive scenarios P is included in the set of syste behaviours S, it is iportant that both P and S are causally closed to avoid issing out soe scenarios when checking this inclusion. When odel checking a negative property, it is again iportant to use the causal closure of the property. We have argued that reasonable ipleentations are causally closed. If the property is not causally closed, the ipleentation ay exhibit an iplied scenario that is forbidden, but this fact could go undetected. In [7], it is shown that odel checking of positive and negative scenarios under the exact interpretation can be perfored for MSC languages where channels are existentially bounded there is at least one linearization for each MSC in the language for which all channels are uniforly bounded. This is contrast to regular MSC languages, where channels are universally bounded across all linearizations. The properties of existentially bounded MSC languages are further elaborated in [6]. Unfortunately, the causal closure of an existentially bounded MSC language need not be existentially bounded. It would be interesting to identify when the causal closure of an existentially bounded MSC languages reains existentially bounded so that the results of [7] can be applied odulo causal closure. References [1] Alur, R., Yannakakis, M.: Model checking of essage sequence charts. Proc. CON- CUR 1999), Springer Lecture Notes in Coputer Science 1664 (1999) [2] Alur, R., Etessai, K., Yannakakis, M.: Inference of essage sequence graphs. IEEE Trans. Software Engg 29(7) (2003) [3] Alur, R., Etessai, K., Yannakakis, M.: Realizability and Verification of MSC Graphs. Theor. Coput. Sci. 331(1) (2005) [4] Booch, G., Jacobson, I., Rubaugh, J.: Unified Modeling Language User Guide. Addison-Wesley (1997) [5] Caillaud, B., Darondeau, P., Hélouët, L. and Lesventes, G.: HMSCS as partial specifications... with PNs as copletions. In Modeling and Verification of Parallel Processes, 4th Suer School, MOVEP 2000, Nantes, France (2000). [6] Genest, B., Muscholl, A., and Kuske, D.: A Kleene Theore for a Class of Counicating Autoata with Effective Algoriths. Proc DLT 2004, Springer Lecture Notes in Coputer Science 3340 (2004) [7] Genest, B., Muscholl, A., Seidl, H. and Zeitoun, M.: Infinite-State High-Level MSCs: Model-Checking and Realizability. Proc ICALP 2002, Springer Lecture Notes in Coputer Science 2380 (2002) [8] Harel, D., Gery, E.: Executable object odeling with statecharts. IEEE Coputer, July 1997 (1997) [9] Henriksen, J.G., Mukund, M., Narayan Kuar, K., Sohoni, M., and Thiagarajan, P.S.: A Theory of Regular MSC Languages. Inf. Cop., 202(1) (2005) [10] ITU-TS Recoendation Z.120: Message Sequence Chart (MSC). ITU-TS, Geneva (1997). [11] Lohrey, M.: Safe Realizability of High-Level Message Sequence Charts. Proc CON- CUR 2002, Springer Lecture Notes in Coputer Science 2421 (2002)

13 347 [12] Mauw, S., Reniers, M. A.: High-level essage sequence charts, Proc SDL 97, Elsevier (1997) [13] Mukund, M., Narayan Kuar, K., Sohoni, M.: Bounded tie-staping in essage-passing systes. Theoretical Coputer Science, 290(1) (2003) [14] Muscholl, A., Peled, D.: Message sequence graphs and decision probles on Mazurkiewicz traces. Proc. MFCS 1999), Springer Lecture Notes in Coputer Science 1672 (1999) [15] Rudolph, E., Graubann, P., Grabowski, J.: Tutorial on essage sequence charts. In Coputer Networks and ISDN Systes SDL and MSC 28 (1996)