2 J.Burton and M.Koutny we have to exlicitly generate a state sace, namely when testing for trace inclusion, only two rocesses are involved and the te

Transcription

1 Verication of Communicating Processes in the Event of Interface Dierence Jonathan Burton and Maciej Koutny Deartment of Comuting Science, University of Newcastle, Newcastle uon Tyne NE1 7RU, U.K. fj.i.burton, Abstract. We resent a grah-theoretic statement of our imlementation relations which relate the behaviour of imlementation and secication systems built of communicating rocesses in the event that resective imlementation and secication rocesses have diering interfaces. From these grah-theoretic statements we derive algorithms for the automatic verication of the imlementation relations. Keywords: Behaviour abstraction, communicating sequential rocesses, comositionality, verication. 1 Introduction In [1] is resented an imlementation relation scheme aimed at formalising the notion that a system is an accetable imlementation of another base or target system, in the case that the two systems (resective secication and imlementation rocesses) have dierent interfaces. Here we resent the grah-theoretic restatement of those imlementation relations, from which we directly derive algorithms for their automatic verication (adated from [1]). The imlementation relation scheme given in [1] (and reroduced in section 4) satis- es two light but very natural and useful requirements. The rst, accessibility or realisability, ensures that the abstraction built into the imlementation relation may be ut to good use; in ractice, this means that lugging an imlementation into an aroriate environment 1 should yield a conventional imlementation of the target. Distributivity or comositionality, the other constraint on the imlementation relation, requires it to distribute over system comosition; thus, a target comosed of two connected systems may be imlemented by connecting two of their resective imlementations. That the imlementation relations have the roerty of comositionality has an imortant consequence when we aroach automatic verication. It allows us to verify each comonent of the imlementation system exlicitly in terms of its secication comonent and we avoid one of the great sources of the state exlosion roblem in concurrency, namely the generation of a state sace which is a subset (not necessarily roer) of the roduct of all the state saces of a set of comonent rocesses comosed in arallel. As a result, we avoid in most cases the need to exlicitly generate a state sace: the state saces with which we need to deal are mostly imlicit in the structure of the labelled transition systems with which we reresent CSP rocesses. 2 In those cases where 1 In our treatment of NMR [4], this environment is made u of disturbers, feeding faulty but suciently redundant inut, and extractors, which interret the imlementation's outut. 2 Communicating rocesses are reresented formally in the FD model of CSP[5]. Moreover, we assume that the secication rocesses with which we are dealing are IO rocesses as dened in section 2.1.

2 2 J.Burton and M.Koutny we have to exlicitly generate a state sace, namely when testing for trace inclusion, only two rocesses are involved and the testing is done on-the-y anyway. This leads to generally favourable comlexity characteristics. Also of imortance in this resect is the fact that we need only deal with maximal (in a sense to be dened) failures when verifying the imlementation relations. We also use the notion of an extraction attern (see [1] and section 3) to relate behaviour on a channel or channels in the imlementation rocess with that on a channel in the secication rocess. A set of extraction atterns acts as a arameter to our imlementation relation scheme. We resent here algorithms for the urose of verifying that a system is a valid imlementation of a target system, in the event that the two systems have dierent interfaces. It may be the case that the target system must be exressed at too low a level of abstraction to function as a conventional secication. In this event, it may be necessary to verify that the target conforms to another (higher level) secication, also exressed in the FD model of CSP. For this urose, a tool such as FDR [5] may be used, since any interface dierence between the target and the secication may be dealt with using the conventional means of renaming and hiding. Though this (higher level) rocess of verication will not be able to take advantage of the roerty of comositionality as described in our treatment, the (highest level) secication rocess will generally be smaller than the target, and the target rocess will generally be smaller than the imlementation rocess. It is thus clear that our verication methods with their attendant gains in eciency will be used at those oints in the verication rocess where the systems to be dealt with are of the greatest size. The aer is organised as follows. The next section gives reliminary information. Section 3 describes the motivation behind our aroach and denes the notion of extraction attern. Section 4 rsents the imlementation relations themselves. (The denitions in sections 3 and 4 are taken from [1].) Section 5 deals with comuter reresentations of CSP rocesses and extraction atterns, in both cases emloying a variant of a labelled transition system. In section 6 we make the necessary technical stes to relate the labelled transition systems reresenting rocesses and extraction atterns, and in sections 7 and 8 we show how the dening conditions for imlementation relations can be veried algorithmically. All roofs and suorting roositions can be found in[1]. 2 Preliminaries Communicating Sequential Processes (CSP) [2, 5] is a formal model for the descrition of concurrent comuting systems. A CSP rocess can be regarded as a black box which may engage in interaction with its environment. Atomic instances of this interaction are called actions and must be elements of the alhabet of the rocess. A trace of the rocess is a nite sequence of actions that a rocess can be observed to engage in. In this aer, structured actions of the form b!v will be used, where v is a message and b is a communication channel. For every channel b, b is the message set of b - the set of all v such that b!v is a valid action. We dene b = fb!v j v 2 bg to be the alhabet of channel b. S It is assumed that b is always nite and non-emty. For a set of channels B, B = b2b b. a gives the channel on which the event a occurred; for examle, b!1 = b. Moreover, A = fa j a 2 Ag. Throughout the aer we use notations similar to those of [2]. In addition to that, an innite sequence of traces t 1 ; t 2 ; : : : is!-monotonic if t 1 t 2 : : : and lim i!1 jt i j = 1. A trace t[b 0 =b] is obtained from trace t by relacing each action b!v by b 0!v, and tdb is

3 Verication of Processes in the Event of Interface Dierence 3 obtained by deleting from t all the actions that do not occur on the channels in B. A maing from a set of traces to a set of traces f : T! T 0 is monotonic if t; u 2 T and t u imlies f(t) f(u); f is strict if h i 2 T and f(h i) = h i; and f is a homomorhism if t; u; t u 2 T imlies f(t u) = f(t) f(u). We use the standard divergence model of CSP [2, 5] in which a rocess P is a trile (P; P; P ) where P alhabet is a non-emty nite set of actions, P failures is a subset of P 2 P, and P divergences is a subset of P. Moreover, P = ft j (t; R) 2 P g denotes the traces of P. We will associate with P a set of channels, P, and stiulate that the alhabet of P is that of P. Thus, we shall be able to identify P with the trile (P; P; P ) in lieu of (P; P; P ). 2.1 Base rocesses A channel c of a rocess P is value indeendent, denoted c 2 vind P, if 8(t; R) 2 P : c 2 R =) (t; R [ c) 2 P. We then dene an inut-outut rocess to be a non-diverging rocess P such that in P vind P, and denote P 2 IO. 3 Extraction atterns In this section, we exlain the basic ideas behind our modelling of behaviour abstraction. c - Snd d (a) - Buf - e c Snd 0 r s Buf 0 (b) e c r Snd 00 s Buf 00 e (c) Fig. 1. Two base IO rocesses and their imlementations Consider a air of IO rocesses, Snd and Buf, shown in gure 1(a). The former generates an innite sequence of 0s or an innite sequence of 1s, deending on the signal (0 or 1) received on its inut channel, c, at the very beginning of its execution. The latter is a buer rocess of caacity one, forwarding signals received on its inut channel, d. In terms of CSP, we have: Snd = i2f0;1g c!i! Snd i and Buf = i2f0;1g d!i! B i where Snd i and B i (i = 0; 1) are auxiliary rocesses dened thus: Snd i = d!i! Snd i and B i = e!i! Buf : Suose that the signal transmission between the two rocesses has been imlemented using two channels, r and s, as shown in gure 1(b). The transmissions on d are now dulicated and the two coies sent along r and s. That is, Snd 0 sends the dulicated

4 4 J.Burton and M.Koutny signal, while Buf 0 accets a single coy and asses it on (ossibly after a delay), ignoring the other one. The scheme clearly works as we have Snd Buf = Snd 0 Buf 0. Suose now that the transmission of signals is imerfect and two tyes of faulty behaviour can occur: g Snd = Snd 0 u sto and d Snd = Snd 0 u Snd, where Snd is Snd 0 with all the communication on channel s being blocked. In other words, g Snd can break down comletely, refusing to outut any signals, while d Snd can fail in such a way that although channel s is blocked r can still transmit the signals. d Snd could be used to model the following situation: in order to imrove erformance, a `slow' channel d is relaced by two channels, a high-seed yet unreliable channel s and a slow but reliable backu channel r. Since Snd Buf = d Snd Buf 0 and Snd Buf 6= g Snd Buf 0 it follows that d Snd is a much `better' imlementation of the Snd rocess than g Snd. We will now analyse the dierences between the two rocesses and at the same time introduce informally some basic concets which are subsequently used. We start by observing that the outut of d Snd can be thought of as adhering to the following two rules: R1 The transmissions over r and s are consistent. R2 Transmission over r is reliable, but there is no such guarantee for s. The outut roduced by g Snd satises R1 but fails to satisfy R2. To exress this formally we need to render the two conditions in some form of recise notation. To cature the behavioural relationshi that exists between Snd and d Snd we will emloy an (extraction) maing extr which for traces over r and s returns corresonding traces over d. For examle, h i 7! h i hr!0i 7! hd!0i hs!0i 7! hd!0i hs!1; r!1i 7! hd!1i hr!1; r!0i 7! hd!1; d!0i Note that the extraction maing need only be dened for traces satisfying R1. Although it will lay a central role, the extraction maing alone is not sucient to identify the `correct' imlementation of Snd in the resence of faults, since Snd = extr( g Snd) = extr( d Snd). What one also needs is an ability to relate the refusals of g Snd and d Snd with the ossible refusals of the base rocess Snd. This, however, is much harder than relating traces. For suose that we attemted to `translate' the refusals of d Snd using the extraction maing. Then, we would have had (h i; fs!0g) 2 d Snd and extr(h i; fs!0g) = (h i; fd!0g) =2 Snd: This indicates that the crude extraction of refusals is not going to work. What we need is a more sohisticated device, which, in our case, comes in the form of another maing, ref, constraining the ossible refusals that a rocess can exhibit after a given trace. This will hel revent, for examle, the sender rocess from blocking if its transmission is yet incomlete. In the examle at hand, this roughly amounts to requiring that the communication on channel r should not be blocked (g Snd fails to satisfy a similar condition). For examle, we will stiulate that ref (hs!0i) must not comrise a refusal containing both r!0 and r!1. We will denote by dom traces conveying information that can be regarded as comlete. According to R2, hs!0i and hs!1i will not belong to dom. The last notion we will need to establish the corresondence between rocesses is a artial inverse of the extraction maing, inv. It will be used to ensure that all the traces of a base rocess (see section 2.1) can be extracted from the traces of its imlementation.

5 3.1 Another examle Verication of Processes in the Event of Interface Dierence 5 The revious examle can be thought of as modelling a fail-sto communication between two rocesses. The next examle is dierent in that it emloys a fault tolerant mechanism based on message retransmission (it is used to illustrate the oint that imlementations are not forced to reserve the direction of the transfer of messages). As before, suose that the communication on d has been imlemented using two channels, r and s, but now r is a data channel and s is a feedback channel used to ass acknowledgements. It is, moreover, assumed that a given message is sent at most twice since a re-transmission always succeeds. This leads to a simle rotocol which is incororated into suitably modied original rocesses. The resulting imlementation rocesses shown in gure 1(c), Snd 00 and Buf 00, are given by: where B, Snd 00 i Snd 00 = i2f0;1g c!i! Snd 00 i Buf 00 = i2f0;1g r!i! (s!ack! Bi 0 u s!nak! B) and B 0 i (i = 0; 1) are auxiliary rocesses dened thus: Snd 00 i = r!i! (s!ack! Snd 00 i s!nak! r!i! Snd 00 i ) B = i2f0;1g r!i! B 0 i B 0 i = e!i! Buf 00 : It may be observed that Snd 00 Buf 00 = Snd Buf = Snd[e=d]. One way of showing this would be to comose the two airs of rocesses and rove their equality using, e.g., CSP laws [2]. This would be straightforward for Snd Buf, but less so for Snd 00 Buf 00, at least by hand. Alternatively, the comositional way in which we intend to roceed is to show that Snd 00 and Buf 00 are imlementations of the resective base rocesses according to suitable extraction atterns, and then derive the desired relationshi using general results develoed later in this aer. 3.2 Formal denition The notion of extraction attern relates behaviour on a set of channels in an imlementation rocess to that on a channel or channels in a target rocess. It has two main functions: that of interretation of behaviour necessitated by interface dierence and the encoding of some correctness requirements. An extraction attern 3 is a tule e = (B; b; dom; extr; ref ; inv) satisfying the following conditions: EP0 EP1 EP2 EP3 EP4 B is a non-emty set of channels, called sources, and b is a channel, called target. dom is a non-emty set of traces over the sources; its rex-closure is denoted by Dom. extr is a strict monotonic maing dened for traces in Dom; for every t, extr(t) is a trace over the target. ref is a maing dened for traces in Dom; for every t, ref (t) is a non-emty subset-closed family of subsets of B such that B 62 ref (t). It is assumed that if a 2 B and t hai 62 Dom then R [ fag 2 ref (t), for all R 2 ref (t). inv is a homomorhism from traces over the target to traces in Dom; for every trace w over the target, extr(inv(w)) = w. 3 What we dene here is a basic extraction attern in the terminology of [4]; [3] also allowed sets of target channels.

6 6 J.Burton and M.Koutny The maing extr interrets a trace over the source channels in the imlementation rocess in terms of a trace over a channel of the target and denes functionally correct (i.e., in terms of traces) behaviour over those source channels by way of its domain. The maing ref is used to dene correct behaviour in terms of failures as it gives bounds on refusals after execution of a articular trace sequence over the source channels. The extraction maing is monotonic as receiving more information cannot decrease the current knowledge about the transmission. B 62 ref (t) means that for an unnished communication t we do not allow the sender to refuse all ossible transmission. The second condition in EP3 is a rendering in terms of extraction atterns of a condition imosed on CSP rocesses that imossible events are always refused. Note that since inv is a trace homomorhism, it suces to dene it for single actions over the target only. 4 Imlementation relations Suose that we imlemented the base IO rocess P using another rocess Q (see gure 2). The correctness of the imlementation will be exressed in terms of two sets of extraction atterns, e and e 0. The former (with sources in Q and targets in P ) will be used to relate the communication on the inut channels of P and Q; the latter (with sources out Q and targets out P ) will serve a similar urose for the outut channels. There are several roerties that Q has to satisfy according to the denition given below. Firstly, if a trace t of Q rojected on its inut channels can be interreted by e, then it should be ossible to interret the rojection on the outut channels by e 0 (see IR1(a,c)). Moreover, such a trace should not lead to a divergence, which in CSP signies totally unaccetable behaviour (see IR1(b)). IR2 further ensures that the extracted traces do not lead to divergences in P. IR3 ensures that going outside the bounds of allowed refusals indicates that the communication on a given channel is a comleted one, and, if this is true of all the channels, then the corresonding (sets of) refusals are resent in the base rocess. IR4 simly states that the functionality in terms of traces resent in P can also be found in Q and IR5 extends this to refused sets as well. We are now ready to introduce three imlementation relations which will rovide a means to relate the base and imlementation rocesses. Let P be a base IO rocess as in gure 2 and, for every i m + n, e i = (B i ; b i ; dom i ; extr i ; ref i ; inv i ) be an extraction attern. We assume that the B i 's are mutually disjoint channel sets, and denote e = fe 1 ; : : : ; e m g and e 0 = fe m+1 ; : : : ; e m+n g. We then take a rocess Q such that in Q = B 1 [ : : : [ B m and out Q = B m+1 [ : : : [ B m+n, as shown in gure 2. b 1 b m - - P - b m+1 - bm+n B 1 B m Q B m+1 B m+n Fig. 2. Base IO rocess P and its imlementation Q. The three imlementation relations are dened as follows. For i = 1; 2; 3, we denote Q 2 Iml i (P; e; e 0 ) if resectively IR1{IR3, IR1{IR4 and IR1{IR3&IR5 below hold.

7 Verication of Processes in the Event of Interface Dierence 7 IR1 If t 2 Q and tdin Q 2 Dom e then: (a) t 2 Dom e[e 0. (b) t 62 Q. (c) extr e[e 0(t) 2 P. IR2 If t 1 ; t 2 ; : : : is an!-monotonic sequence of traces in Q \ Dom e[e 0, then the following sequence is also!-monotonic: extr e[e 0(t 1 ); extr e[e 0(t 2 ); : : : IR3 If (t; R) 2 Q and B = fb i1 ; : : : ; b ik g P are such that t 2 Dom e[e 0 and b i 2 in P =) B i? R 2 ref i (tdb i ) b i 2 out P =) B i \ R 62 ref i (tdb i ) IR4 IR5 for every b i 2 B, then the following are satised: (a) td(b i1 [ : : : [ B ik ) 2 dom fei 1 ;:::;e i k g. (b) (extr e[e 0(t); B) 2 P rovided that t 2 dom e[e 0. inv e[e 0(P ) Q. If B P and (t; B) 2 P, then inv e[e 0(t); ( a 2 [ b i2b B i inv e[e 0(t) hai 2 Dom e[e 0 )! 2 Q : The imlementation relations form a hierarchy: Iml 3 (P; e; e 0 ) Iml 2 (P; e; e 0 ) Iml 1 (P; e; e 0 ). Crucially, however, all three imlementation relations are comositional in the sense that they are reserved by the network comosition oeration. 5 Reresenting extraction atterns and CSP rocesses Extraction atterns and CSP rocesses are otentially innite objects. We therefore need a means to reresent them in a nite way in order to allow a comuter imlementation. To deal with CSP rocesses we will use the standard device of a transition system, while extraction atterns will be reresented by the novel notion of an extraction grah. 5.1 Communicating transition systems In order to reresent rocesses in a manner amenable to comuter reresentation, we take advantage of the oerational semantics dened for CSP in [5]. This uses a labelled transition system (LTS) to reresent a CSP rocess. We shall reresent a rocess in terms of a communicating transition system (CTS), which is essentially an LTS incororating additional information about channels. A communicating transition system is a tule CTS = (V; C; D; A; v 0 ) such that: V is a set of states (nodes); v 0 2 V is the initial state; C and D are nite disjoint sets of channels (C will reresent inut and D outut channels); and A V (C [D [fg)v is the set of labelled directed arcs, called transitions, where is a distinguished symbol denoting an internal action. We will use the following notation: { If (v; a; w) 2 A, we denote v { If v 1 a 1???! v 2 a 2???! that hi = hi; moreover, v a???! w. a n ha 1iha ni???! v n+1, we denote v 1 hi =) v, for every v 2 V. =======) v n+1 where it is assumed

8 8 J.Burton and M.Koutny a { If v???! w, we denote a 2 en(v) and call a enabled at v. { A state v 2 V is stable if 62 en(v); the set of stable states will be denoted by V stb. t t { If v =) w, we denote v =) w or v =). We shall assume that a transition system is nite, i.e., both V and A are nite. Figure 3 shows the grah of a communicating transition system such that C = fdg and D = feg, where d = e = f0; 1g. Note that the initial state is indicated by the node with a white centre. e!0 e!1 z 1 z 0 z 2 CTS buf d!0 d!1 Fig. 3. CTS reresenting a buer of caacity one 5.2 Traces and failures information The imlementation relations which we want to verify algorithmically are all exressed in the denotational semantics of CSP [5], and so we must know how to derive information on divergences, traces and failures from a given CTS. Let CTS = (V; C; D; A; v 0 ) be a communicating transition system. Then P CTS = (C; D; ; ) is a tule such that the following hold (below CTS = C [ D): = ft u 2 CTS j 9k 1 9v 1 ; : : : ; v k 2 V : v 0 = f(t; R) 2 CTS 2 CTS j 9v 2 V stb : v 0 t =) v 1?! v 2?! v k?! v 1 g t =) v ^ R \ en(v) = ;g [ 2 CTS : Note that a divergence is reresented in a CTS by a cycle comosed only of -labelled transitions which is reachable from the initial state. We also have the following: P CTS is a CSP rocess. Moreover, if = ;, then P CTS = ft 2 CTS t j v 0 =)g. Calculating failures On the basis of the revious denition, we roceed to elaborate on how failures information may be exlicitly derived from a CTS. The set of maximal refusals R, for any articular non-diverging t such that (t; R) 2 P CTS may be generated simly by considering the events not on oer at all stable t nodes v reachable from the initial state, v 0 =) v. All other refusals can be derived from the maximal ones. In order that all sets of nodes reresenting the same trace may be groued together, a normalisation rocess is used, as detailed in [5] secically with resect to the oerational semantics of CSP. This roduces a CTS with two fundamental roerties: (i) there are no transitions; and (ii) each node has a unique successor on each visible action it can erform. This normalisation serves two main uroses.

9 Verication of Processes in the Event of Interface Dierence 9 { It creates a deterministic CTS in order that trace inclusion roerties may be easily tested for. t { Every node in the new CTS such that 0 =) is maed to a set of stable nodes in the original CTS. We also denote, for every node of CTS det, CTS () = fen(v) j v 2 ^ 8w 2 : en(w) en(v) =) en(w) = en(v)g : (1) In other words, CTS () is the set of minimal sets of actions enabled at stable nodes corresonding to. Such a set can then be used to calculate maximal failures. We dene maximal failures as max P = f(t; R) 2 P j (t; S) 2 P ^ R S ) R = Sg. 5.3 Extraction grahs We now turn to the reresentation of extraction atterns. An extraction grah is a tule EG = (B; b; V; A; v 0 ; %; ; {) such that: B is a non-emty nite set of channels; b is a channel; V is a set of nodes; A V (B b ) V is a set of labelled arcs; v 0 2 V is the initial node; % is a maing returning for every node in V a non-emty family of roer subsets of B; : V! fd; Dg; and { : b! B. Intuitively, % corresonds to ref, d indicates traces in dom, D indicates traces in Dom? dom, and { corresonds to inv (see section 3.2). We will use the following notation: EN1 If (v; a; t; w) 2 A, we denote v a:t???! w. EN3 EN2 If v 1 a 1:t1???! v 2 a 2:t2???! an:tn???! v n+1, we denote v 1 ha 1;a 2;:::;a ni:t 1t 2t n =============) vn+1 ; moreover, v hi:hi =) v, for every node v. If v =) u:t w, we denote v =) w. We imose the following restrictions on an extraction grah EG, where v 2 V : EG0 If R; R 0 2 %(v) and R R 0, then R = R 0 ; moreover, if a 2 B and there are no w and t such that v???! a:t w, then a 2 R. EG1 v 0 =) v. EG2 If v???! a:t w and v???! a:t0 w 0 then t = t 0 and w = w 0. EG3 If (v) = D, then there is w 2 V such that v =) w and (w) = d. EG4 If t = ha 1 ; : : : ; a k i 2 b {(a 1){(ak ):t, then there is w such that v 0 =======) w. When reresenting an extraction attern e = (B; b; dom; extr; ref ; inv), it is straightforward to deal with its last comonent, inv, which can be reresented by the maing {, giving for every a 2 b the trace inv(a). The reresentation of dom, extr and ref can be rovided by other comonents of an extraction grah. Let EG = (B; b; V; A; v 0 ; %; ; {) be an extraction grah. Then Dom EG is a set of traces, and e EG = (B; b; dom EG ; extr EG ; ref EG ; inv EG ) is a tule, dened in the following way. EG5 Dom EG = fu 2 B j 9v; t : v 0 u:t =) vg.

10 10 J.Burton and M.Koutny EG6 dom EG = fu 2 B u:t j 9v; t : v 0 =) v ^ (v) = dg. EG7 For every t = ha 1 ; : : : ; a k i 2 b, inv EG (t) = {(a 1 ) {(a k ). EG8 u:t By EG2, for every u 2 Dom EG, there are unique t and v such that v 0 =) v. We then dene extr EG (u) = t and ref EG (u) = fr j 9R 0 2 %(v) : R R 0 g : We have that e EG is an extraction attern. Conversely, one can easily see that for every extraction attern e there is an extraction grah EG such that e = e EG. From the oint of view of ractical imlementation, however, we will be interested only in those extraction grahs which are nite, i.e., have a nite number of nodes V. 6 Unambiguous CTS Extraction atterns and so extraction grahs are dened for a channel in a base rocess P and a channel or channels in an imlementation rocess Q. As a result, more than one EG will usually be required to interret the behaviour of the imlementation rocess Q as a whole. Moreover, it is ossible that the CTS reresenting Q will be ambiguous (in the sense exlained below) with resect to interretation in terms of the EGs. We now discuss how to verify trace-based imlementation conditions, such as IR1. Let us consider a base rocess Buf modelling a buer of caacity one, with inut channel d and outut channel e, dened in section 3. Recall that it can be modelled by the communicating transition system CTS buf shown in gure 3. We also consider two extraction atterns, e 1 and e 2, given by the extraction grahs EG 1 and EG 2, i.e., e i = e EGi (for i = 1; 2). The rst extraction grah, EG 1, over source c and target c, is given in gure 4. The second one, over the sources fr; sg and target e, is given in gure 5. % v 0 d fc!0g; fc!1g c!0 : hc!0i c!1 : hc!1i v 0 { c!0 hc!0i c!1 hc!1i Fig. 4. Extraction grah EG 1 We would like to verify the imlementation conditions, with resect to e 1 and e 2, for a rocess Q 0 such that in Q 0 = fdg and out Q 0 = fr; sg, and whose behaviour is described by the communicating transition system CTS Q shown in gure 6, i.e., Q 0 = P CTS Q. Although it is not dicult to see that Q 0 2 Iml 3 (Buf ; e 1 ; e 2 ), it may not be clear what needs to be done to verify this using only the reresentations of Q 0, Buf, e 1 and e 2, given in the form of the aroriate communicating transition systems and extraction grahs. In articular, suose that we want to verify that IR1(c) holds, i.e., extr fe1 ;e 2 g(q 0 ) Buf : (2) A ossible attemt would be to relace each of the arc annotations in CTS Q by the `extracted' string given by the corresonding extraction attern. This could be done for all the actions excet s!ack from which we can extract either he!0i or he!1i, deending on the revious actions executed by the rocess. Thus CTS Q is an ambiguous reresentation

11 Verication of Processes in the Event of Interface Dierence 11 s!ack : he!0i s!ack : he!1i w 1 w 0 w 2 r!0 : hi r!1 : hi w 0 w 1 D w 2 D % d fs!ack ; r!0g; fs!ack ; r!1g fr!0; r!1g fr!0; r!1g e!0 hr!0; s!acki e!1 hr!1; s!acki { Fig. 5. Extraction grah EG 2 x 3 r!0 s!ack r!1 CTS Q x 1 x 0 x 2 d!0 d!1 Fig. 6. An imlementation of a buer of caacity one of Q 0 given the extraction atterns e 1 and e 2. A solution we roose is to remove this ambiguity, by suitably modifying CTS Q. We slit the node x 3 of CTS Q and searate the two arcs incoming to it, obtaining CTS 0 Q shown in gure 7(a). We can now unambiguously interret each of the arc annotations, which leads to the grah G shown in gure 7(b). To verify that IR1(c) holds, it now suces to check that the traces generated by G are also generated by CTS buf. x 0 3 x 00 3 x 0 3 x 00 3 r!0 s!ack s!ack r!1 hi he!0i he!1i hi x 1 x 0 x 2 x 1 x 0 x 2 d!0 d!1 (a) hd!0i (b) hd!1i Fig. 7. Disambiguating CTS Q The following algorithm generates an equivalent unambiguous CTS, from a given CTS and a set of extraction grahs.

12 12 J.Burton and M.Koutny Algorithm 1. For i = 1; : : : ; m + n, let EG i = (B i ; b i ; V i ; A i ; v 0i ; % i ; i ; { i ) be extraction grahs such that the B i 's are mutually disjoint and the b i 's distinct. Moreover, let CTS = (V; C; D; A; v 0 ) be a communicating transition system such that C = B 1 [ : : : [ B m and D = B m+1 [ : : : [ B m+n : The algorithm generates a communicating transition system CTS u, in two stes. Ste 1: We generate a labelled directed grah G, with the nodes V V 1 V n, as follows. Let q = (v; v 1 ; : : : ; v n ) be a node in G. The arcs outgoing from q are derived a from those outgoing from v; for each arc v???! w in CTS we roceed according to exactly one of the following four cases. 1. a =. Then we add a transition q???! (w; v 1 ; : : : ; v n ). a:t 2. a 6= and there is an arc v i???! w i in EG i, for some i 1. 4 a???! (w; w 1 ; : : : ; w n ) where w j = v i, for all j 6= i. Then we add a transition q Moreover, we denote extr(q; a) = if t = hi, and extr(q; a) = b if t = hbi. Note that extr(q; a) is well dened by EG2. a:t 3. a 2 C and there is no arc v i???! w i, for any i 1. Then we do nothing. 4. a 2 D and there is no arc v i a:t???! w i, for any i 1. Then we mark ermanently q as an unnished node (all the nodes are assumed to be nished at the beginning). Ste 2: From the grah G we obtain a communicating transition system CTS u with the same channels as CTS, by taking q 0 = (v 0 ; v 01 ; : : : ; v 0n ) as the initial node, and then adding all the nodes reachable from q 0, together with all the interconnecting arcs. If any of the reachable nodes is marked as unnished, we reject CTS u (since this means that the traces generated by Q = P CTS u do not satisfy the condition IR1(a), where each e i is generated by EG i, see the roof of roosition 1). ut The above algorithm will be executed on the CTS reresentation of the imlementation rocess Q. The result is denoted CTS u Q; its main characteristic is that the denition of the nodes allows the unambiguous interretation of the arc labels through the extraction maings. In addition, P CTS u Q = Q \ Dom e[e 0 (see roosition 2). The grah G for the examle in gure 5 is shown in gure 8(a), where the indicates an unnished node. After restricting ourselves only to the relevant subgrah (comrising nodes reachable from the initial one), we obtain the grah, shown in gure 8(b), which is isomorhic to CTS 0 Q obtained informally before. Note that extr((x 3 ; v 0 ; w 1 ); s!ack) = e!0 and extr((x 1 ; v 0 ; w 0 ); r!0) = hi. Later, for a node q = (w 0 ; w 1 ; : : : ; w n ) of CTS u and 0 i m + n, we will denote q (i) = w i. 7 Grah reresentation of imlementation relations In this section, we will transfer the imlementation conditions IR1{IR5 formulated in terms of the denotational semantics of CSP, into equivalent conditions exressed in terms of communicating transition systems and extraction grahs. The latter will rovide, in section 8, a suitable basis for verication algorithms. Below we list some general assumtions which will be used throughout this and the next section. 4 There can only be one such EG i since the B i's are mutually disjoint.

13 Verication of Processes in the Event of Interface Dierence 13 (x 3; v 0; w 1) (x 3; v 0; w 2) r!0 s!ack s!ack r!1 (x 1; v 0; w 0) (x 0; v 0; w 0) (x 2; v 0; w 0) (x 0; v 0; w 1) d!0 d!1 (x 3; v 0; w 0) (x 0; v 0; w 2) d!1 d!0 d!0 d!1 (x 2; v 0; w 1) (x 1; v 0; w 1) (a) (x 2; v 0; w 2) (x 1; v 0; w 2) (x 3; v 0; w 1) (x 3; v 0; w 2) r!0 s!ack s!ack r!1 (x 1; v 0; w 0) (x 0; v 0; w 0) (x 2; v 0; w 0) d!0 d!1 (b) Fig. 8. Alying disambiguating algorithm { P, Q, e i (for i = 1; : : : ; m+n), e and e 0 are as in section 4 on the imlementation relations. { CTS P and CTS Q are communicating transition systems reresenting P and Q resectively; i.e., P = P CTS P and Q = P CTS Q. { For i = 1; : : : ; m+n, EG i is an extraction grah with initial node v 0i and reresenting e i ; i.e., e EGi = e i. { P det is the normalised version of CTS P. We will use P to denote the maing dened as in (1) for the nodes of P det, and denote the initial state of P det by 0. { CTS u Q is a disambiguated version of CTS Q w.r.t. extraction grahs EG i (see algorithm 1). We will denote the initial state of CTS u Q by q u 0. The rocess generated by CTS u Q will be denoted by b Q; i.e., b Q = PCTS u Q. { Q det is the normalised version of CTS u Q. We will use Q to denote the maing dened as in (1) for the nodes of Q det, and denote the initial state of Q det by q 0. It may be observed that if v is a node of Q det and q; r 2 v then, for all 1 i m+n, q (i) = r (i). We can therefore use v (i) to denote q (i), and extr(v; a) = extr(q; a) whenever the latter is dened. We now roceed with a systematic re-evaluation of the imlementation conditions IR1{IR5. We rst obtain the result that testing for IR1(b) amounts to checking for the resence of -loos in the grah of CTS u Q, and, if there is no such loo, then testing for IR1(a) is done while generating CTS u Q.

14 14 J.Burton and M.Koutny Proosition 1 Q satises IR1(a,b) if and only if CTS u Q has been successfully generated and there are no nodes v 1 ; : : : ; v k (k 2) in CTS u Q such that v 1?! v 2?!?! v k = v 1. From now on, we will assume that CTS u Q has been successfully generated and does not contain any -loos, and so IR1(a,b) hold. In such a case, as the next result shows, CTS u Q generates a rocess which can be used to test for all imlementation relations in lace of Q. Proosition 2 For each verication condition IR1{IR5 (other than IR1(a,b)), it is the case that Q satises the condition if and only if the same is true of b Q. Moreover, b Q = Q \ Dom e[e 0. Note: Thus, for i = 1; 2; 3, Q 2 Iml i (P; e; e 0 ) if and only if b Q 2 Iml i (P; e; e 0 ). As we have already seen, IR1(a,b) can be checked directly using CTS u Q. In dealing with the remaining imlementation conditions, we assume that IR1(a,b) hold, and use Q det, which is the normalised CTS derived from CTS u Q. Note that, by roositions 1 and 2, we may assume that Q b is an imlementation rocess such that Q b = ; and Q b Dom e[e 0 : A relation sim extr V Qdet V Pdet is an extr-simulation for Q det and P det if (q 0 ; 0 ) 2 sim extr and, for every (q; ) 2 sim extr, q a?! q 0 =) 9(q 0 ; 0 ) 2 sim extr : =======) hextr(q;a)i 0 : (3) Proosition 3 b Q (and so Q) satises IR1(c) if and only if there exists an extr-simulation for Q det and P det. Note that, since P det is deterministic and contains no -transitions, if there is at least one extr-simulation, then there exists the smallest one, sim min extr. From now on, we will additionally assume that Q b (and so Q) satises IR1(c). Then, testing for the next imlementation condition, IR2, amounts to checking for extracted -loos in the grah of Q det. Proosition 4 Q b (and so Q) satises IR2 if and only if there are no nodes v1 ; : : : ; v k (k 2) in Q det such that v 1 a?! 1 v2 a?! 2 a k?1?! v k = v 1 and extr(v i ; a i ) =, for all i k. To reare the ground for testing of IR3, we re-hrase it in terms of maximal failures of b Q. For every (t; R) 2 b Q, we denote Ct;R = fb i 2 in P j B i?r 2 ref i (tdb i )g [ fb i 2 out P j B i \ R 62 ref i (tdb i )g : We also denote C t = fc t;r j (t; R) 2 max b Qg and C t = S fb j B 2 C t g. We have that b Q (and so Q) satises IR3 if and only if, for every t 2 b Q, the following hold. If b i 2 C t then tdb i 2 dom i and if t 2 dom e[e 0 then for every B 2 C t there exists R such that (extr e[e 0(t); R) 2 max P and B R. We now introduce notions corresonding to C t;r, C t and C t in the domain of communicating transition systems and extraction grahs. For all q 2 V Qdet and A 2 Q (q), we denote C q;a = fb i 2 in P j 9R 0 2 % i (q (i) ) : B i \A R 0 g [ fb i 2 out S P j6 9R 0 2 % i (q (i) ) : B i? A R 0 g : We also denote C q = fc q;a j A 2 Q (q)g and C q = fb j B 2 C q g. t If q 0 =) q then C q = C t. Moreover, C q;a = C t;q?a for every A 2 Q (q) and C t;r = C q;q?r for every (t; R) 2 max Q. b

15 Verication of Processes in the Event of Interface Dierence 15 Proosition 5 b Q (and so Q) satises IR3 if and only if, for every q 2 VQdet, the following hold. 1. If b i 2 C q then i (q (i) ) = d. 2. If i (q (1) ) = = i (q (m+n) ) = d then, for every B 2 C q, and for every such that (q; ) 2 sim min extr, there is A 2 P () satisfying B \ A = ;. We now turn to the two remaining imlementation conditions. Since the inv i 's are homomorhisms, they can interret the arc labels directly, without taking into account how a articular node has been reached. However, the situation is comlicated by the fact that inv i (a) will usually be a non-singleton trace. A relation sim inv V Pdet V Qdet is an inv-simulation for P det and Q det if ( 0 ; q 0 ) 2 sim inv and, for every air (; q) 2 sim inv,?! a 0 =) 9( 0 ; q 0 ) 2 sim inv : q inv 0 (a) e[e =======) q 0 : (4) Proosition 6 b Q (and so Q) satises IR4 if and only if there exists an inv-simulation. In the last art of this section dealing with IR5, we will assume that Q b (and so Q) satises IR4. This does not result in a loss of generality as IR4 is imlied by IR5. Note that, since Q det is deterministic and contains no -transitions, if there is at least one inv-simulation, then there exists the smallest one, sim min To test for IR5, we rst observe that it can be equivalently exressed in terms of maximal failures. For every (t; R) 2 P, we denote D t;r = fb i 2 P j b i Rg; moreover, D t = fd t;r j (t; R) 2 max P g. We have that b Q (and so Q) satises IR5 if and only if, for every t 2 P and B 2 D t, there is (inv e[e 0(t); R) 2 max b Q such that S b i2b B i R. We now introduce notions corresonding to D t;r and D t in the domain of communicating transition systems. For every 2 V Pdet and A 2 P (), we denote D ;A = fb i 2 P j b i \ A = ;g; moreover D = fd ;A j A 2 P ()g. If 0 t =) then D = D t. Moreover, D ;A = D t;q?a for every A 2 P () and D t;r = D ;Q?R for every (t; R) 2 max P. Proosition 7 b Q (and so Q) satises IR5 if and only if for every (; q) 2 sim min inv, if B 2 D then there is A 0 2 Q (q) such that S b i2b B i \ A 0 = ;. inv. 8 Algorithms In this section, we outline algorithms for checking the imlementation relations IR1{IR5 excet for IR1(a) which is imlicitly tested during the generation of CTS u Q rovided that CTS u Q does not contain any -loo which is checked in order to establish that IR1(b) holds (see roosition 1). To test for IR1(b), we use a modied version of the deth-rst search algorithm given in [6] to test for strong connectivity in directed grahs. The (original) algorithm returns the nodes in each strongly connected comonent of the grah, thus indicating all those nodes on cycles. We make two modications to the original algorithm. Firstly, we exlore only -transitions and so return only those strongly connected comonents in which all nodes are mutually accessible by such transitions. Secondly, we ignore comonents consisting of only one node, unless they admit a self--loo. Thus, due to roosition 1, IR1(b) is met if and only if the modied algorithm nds no -traversable strongly connected comonents.

16 16 J.Burton and M.Koutny Algorithm 2. The outline for the algorithm is shown in gure 9. The visit function executes the recursive deth-rst search which searches for (-traversable) strongly connected comonents reachable (by -only transitions) from the node v for which it is originally called. If and when such a comonent is encountered, the nodes within it are recorded in the global variable cyclicnodes. The function IR1b() calls visit only for those nodes which have not already been considered and which have at least one -transition leaving them. ut function IR1b() for every v 2 V CTS u such that Q 2 en(v) if v has not already been seen then visit(v) if cyclicnodes 6= ; then return failure else return success function IR2 () for every q 2 V Qdet if q has not already been seen then visit(q) if cyclicnodes 6= ; then return failure else return success Fig. 9. Testing for IR1(b) and IR2 The algorithm to test for IR1(c) is based on roosition 3. We aim to construct the minimal extr-simulation sim min extr, by traversing the roduct V Qdet V Pdet. We rst ma the initial nodes to each other, (q 0 ; 0 ) 2 sim extr. We then erform a deth-rst search, beginning at (q 0 ; 0 ). If the construction is successful, the set of all airs of nodes reachable from (q 0 ; 0 ) gives the minimal extr-simulation. Algorithm 3. The seudo-code of the algorithm is shown in gure 10. In the function IR1c() itself, the initial nodes in Q det and P det are aired. The visit function is then called for this initial air of nodes. The data structure used to indicate if the aired nodes have been seen is the hashtable jointnodes. If a comosite node is in jointnodes, then it constitutes a air in sim min extr (this relation is then used in testing for IR3). ut The algorithm to test for IR2 is based on roosition 4. We again use a modied version of the algorithm testing for strong connectivity. This time, however, we wish only to nd those strongly connected comonents where all nodes are mutually accessible by -transitions after extraction. In addition, we wish to ignore comonents consisting of a only one node q, unless q?! q and extr(q; a) =, as this does not constitute a cycle for our uroses. Algorithm 4. The seudo-code for the algorithm is shown in gure 9. The visit function executes the recursive deth-rst search which searches for (-traversable, after extraction given by extr(q; a)) strongly connected comonents reachable (by emty traces, after alying extraction given by extr(q; a)) from the node q for which it is originally called. If and when such a comonent is encountered, the nodes within it are recorded in cyclicnodes. The function IR2 () calls visit for every node q 2 V Qdet. ut

17 Verication of Processes in the Event of Interface Dierence 17 function IR1c() outcome success visit(q 0; 0) return outcome void visit(q; ) enter (q,) in jointnodes a for every q???! q 0 if extr(q; a) = then if (q',) not in jointnodes then visit(q 0 ; ) else if extr(q; a) 62 en() then outcome failure return else if (q',') not in jointnodes where extr (q;a)???! 0 then visit(q 0 ; 0 ) Fig. 10. Testing for IR1(c) The algorithm to test for IR3 is based on roosition 5 and uses the relation sim min extr calculated during the execution of algorithm 3. Algorithm 5. The seudo-code for the algorithm to test for IR3 is shown in gure 11. It uses three auxiliary functions: { IR3a() to test for roosition 5(1) (which catures IR3(a)) for q and C q. { IR3b() to test for roosition 5(2) (which catures IR3(b)) for q and C q. { getc() to calculate the set C q for a given q. ut To test for IR4 we use roosition 6, aiming to construct the minimal inv-simulation sim min inv by traversing the roduct V Pdet V Qdet. We rst ma the initial nodes to each other, ( 0 ; q 0 ) 2 sim inv. We then erform a deth-rst search, beginning at ( 0 ; q 0 ). If the construction is successful, the set of all airs of nodes reachable from ( 0 ; q 0 ) gives the minimal inv-simulation. If the deth-rst search function has been called for (; q) 2 sim min inv, then we need to consider every transition a out of, and generate inv(a) before considering if the rst event in inv(a) is oered as a transition out of q. Algorithm 6. The seudo-code is shown in gure 12. The function IR4 () calls visit for ( 0 ; q 0 ), as a result of which all airs in sim min inv are reached. The algorithm uses the hashtable jointnodes. If a comosite node is in jointnodes, then it constitutes a air in sim min inv (this relation is then used in testing for IR5). ut The algorithm to test for IR5 is based on roosition 7, and uses the relation sim min inv calculated during the execution of algorithm 6. Algorithm 7. The seudo-code for the algorithm to test for IR5 is shown in gure 12. ut

18 18 J.Burton and M.Koutny function IR3 () for every q 2 V Qdet C q getc(q) if IR3a(q; C q) = failure or IR3b(q; C q) = failure then return failure return success S function IR3a(q; C q) B B2Cq B for every b i 2 B if i(q (i) ) = D then return failure return success function IR3b(q; C q) if 1(q (1) ) = = m+n(q (m+n) ) = d then for every B 2 C q for every such that (q; ) 2 sim min extr successful false for every A 2 P () if B \ A = ; then successful true ; break if successful = false then return failure return success function getc(q) C q ; for every A 2 Q(q) B ; for every b i 2 in P if 9R 2 % i(q (i) ) : B i \ A R then B for every b i 2 out P C q return C q if 6 9R 2 % i(q (i) ) : B i? A R then B C q [ fbg B [ fb ig B [ fb ig Fig. 11. Testing for IR3 9 Concluding remarks The algorithms resented here have been derived almost directly from the imlementation relations themselves and little eort has yet been ut into otimisation. Future work will exlore ossibilities for otimisation, as well as including a case study to evaluate the erformance of the algorithms in ractice and to establish in which context the imlementation relations may rove to be most alicable. References 1. J. Burton, M. Koutny and G. Paalardo: Modelling and Verication of Communicating Processes in the Event of Interface Dierence. Technical Reort CS-TR-696, Deartment of Comuting Science, University of Newcastle uon Tyne (2000). 2. C. A. R. Hoare: Communicating Sequential Processes. Prentice Hall (1985).

19 Verication of Processes in the Event of Interface Dierence 19 function IR4 () outcome success visit( 0; q 0; hi) return outcome void visit(; q; invevents) if hi 6= invevents = hai invevents 0 then if a 62 en(q) then outcome = failure else visit(; q 0 ; invevents 0 ) where q else if (,q) not in jointnodes then enter (,q) in jointnodes return for every???! a0 0 visit( 0 ; q; inv e[e 0(a 0 )) a???! q 0 function IR5 () for every 2 V Pdet for every A 2 P () B P? A for every q such that (; q) 2 sim min inv matchfound false for every S A 0 2 Q(q) if b i 2B Bi Q? A0 then matchfound = true ; break if matchfound = false then return failure return success Fig. 12. Testing for IR4 and IR5

20 20 J.Burton and M.Koutny 3. M. Koutny and G. Paalardo: A Model of Behaviour Abstraction for Communicating Processes. Proc. of 16th Symosium on Theoretical Asects of Comuter Science, STACS'99, C. Meinel and S. Tison (Eds.). Sringer-Verlag, Lecture Notes in Comuter Science 1563 (1999) M. Koutny, L. Mancini and G. Paalardo: Two Imlementation Relations and the Correctness of Communicated Relicated Processing. Formal Asects of Comuting 9 (1997) A. W. Roscoe: The Theory and ractice of Concurrency. Prentice-Hall (1998). 6. R. Sedgewick: Algorithms in C++. Addison-Wesley (1992).