Figure 4: Expansion of (S b jt jc 1 jc 2 jr b ) n L. def. def. def. P T ABP as given in section 5, we can conclude

Transcription

1 (S b jt jc 1 jc 2 jr b ) n L A B C T accet:a n L where = (S 0 b jt jc 1jC 2 jr b ) T :(send S;b :start:s 00 b jt jc 1jC 2 jr b ) T ::(start:s 00 b jt jh0; send R;b:C 1 + :C 1 i s jc 2 jr b ) T :::(R 00 b jhsto:t ; timeout:t i tjh0; send R;b :C 1 + :C 1 i s jc 2 jr b ) T ::h0; (S 00 b jhsto:t ; timeout:t i t0sjsend R;b :C 1 + :C 1 jc 2 jr b )i s T h0; :B + :Ci s = (S 00 b jhsto:t ; timeout:t i t0sjc 1 jc 2 jdeliver:ack R;b :Rb ) deliver:d T = (S 00 b jhsto:t ; timeout:t i t0sjc 1 jc 2 jr b ) T h0; (ack S;b :sto:sb + ack S;b :S00 b + timeout:s0 b jtimeout:t jc 1jC 2 jr b )i t0s D E F G T h0; Ai t0s = (S 00 b jhsto:t ; timeout:t i t0sjc 1 jc 2 jack R;b :R b ) T :(S 00 b jhsto:t ; timeout:t i t0sjc 1 jh0; ack S;b :C 2 + :C 2 i a jrb ) T :h0; (S 00 b jhsto:t ; timeout:t i t0(s+a)jc 1 jack S;b :C 2 + :C 2 jrb )i a T h0; :E + :F i a = (S 00 b jhsto:t ; timeout:t i t0(s+a)jc 1 jack R;b :C 2 jrb ) T :(sto:sb jhsto:t ; timeout:t i t0(s+a)jc 1 jc 2 jrb ) T Sb jt jc 1jC 2 jrb = (S 00 b jhsto:t ; timeout:t i t0(s+a)jc 1 jc 2 jrb ) T h0; Gi t0(s+a) = (S 0 b jt jc 1jC 2 jrb ) T h0; :h0; :E + :F i a + :h0; Gi t0s i s Figure 4: Exansion of (S b jt jc 1 jc 2 jr b ) n L where L = fsend S;b ; send R;b ; send ; send ; S;b R;b ack S;b ; ack R;b ; ack ; ack ; start; sto; S;b timeoutg. R;b Using the timed strong equivalence and timed observation equivalence, we derive an exansion of (S b jtjc 1 jc 2 jr b ) n L as shown in Figure 4. Exression A follows directly from Corollary 1, while A T h0; :B + :Ci s is derived from Proosition 5. Derivations of exressions B to G are similar to that of A. From Figure 4, we can transform (S b jtjc 1 jc 2 jr b )nl into a timed observation equivalent exression P as follows: P A G = accet:a = h0; :deliver:h0; :P + :h0; Gi t0(s+a) i a + :h0; Ai t0s i s = h0; :h0; :A + :h0; Gi t0(s+a) i a + :h0; Gi t0s i s Furthermore, since it can be easily shown that P T ABP as given in section 5, we can conclude that ABP is timed observation equivalent to (S b jt jc 1 jc 2 jr b ) n L. (S b jt jc 1 jc 2 jr b ) n L T P where

2 P + Q = Q + P P + (Q + R) = (P + Q) + R P + P = P P + 0 = P (P + Q) n L = P n L + Q n L (:P ) n L = (P + Q)[f] = P [f] + Q[f] (:P )[f] = f():p [f] 8 < : 0 if 2 L [ L :P n L otherwise h:p ; :P i t = :P h:p + Q; Ri t = :P + Q (t > 0) hp; Qi 0 = Q hhp; Qi s ; Ri t = 8 < : hp; Ri t (s t) hp; hq; Ri t0s i s (s < t) hp; Q + Ri t = hp; Qi t + hp; Ri t hp + Q; Ri t = hp; Ri t + hq; Ri t hp; Qi t [f] = hp [f]; Q[f]i t hp; Ri t n L = hp n L; Q n Li t P jq = QjP P j(qjr) = (P jq)jr P j0 = P P jq = P i = j :(P i jq j ) + P i2i i:(p i jq) + P j2j j:(p jq j ) where P P i2i i:p i and Q P j2j j:q j P jq = h P i = j :(P i jq j ) + P i2i i:(p i jq) + P j2j j:(p jq j ) ; P 0 jqi 1 where P h P i2i i:p i ; P 0 i 1 and Q P j2j j:q j P jq = h P i = j :(P i jq j ) + P i2i i:(p i jq) + P j2j j:(p jq j ) ; P 0 jq 0 i 1 where P h P i2i i:p i ; P 0 i 1 and Q h P j2j j:q j ; Q 0 i 1 Figure 3: Equational Proof System based on T Proosition 10 For each P 2 P, there exists a normal form P 0 such P = P 0. Proof. By structural induction on P. Lemma 1 1. If P T Q where P is in NF 6 and Q is in NF, then Q is in NF If P T Q where P is in NF hi and Q is in NF, then Q is in NF hi. Proof. The structure of NF 6 rocesses cannot be transformed by and any NF hi rocess transforms its structure by. Theorem 2 (Comleteness) If P T P; Q 2 P, then P = Q. Q where Proof. Assume that P T Q. By roosition 10, we can nd normal form rocesses P 0 and Q 0 where P = P 0 and Q = Q 0. By lemma 1, both P 0 and Q 0 must be in NF 6 or both P 0 and Q 0 must be in NF hi. Hence we have that P = Q. Aendix B In this aendix we resent a rather detailed descrition of the behavior and timing of the Alternating Bit Protocol as given in section 5 under the assumtion that s + a < t. The whole rotocol is reresented as a arallel comosition of the ve comonent as follows: (S b jt jc 1 jc 2 jr b ) n L

3 In roceedings of the 11th IEEE Real-Time Systems Symosium, [6] Hennessy, M. and Regan, T., A Temoral Process Algebra, Technical Reort 2/90, University of Sussex, 1990 [7] Hoare, C. A. R., Communicating Sequential Processes, Prentice Hall, [8] Honda, K., and Tokoro, M., An Object Calculus for Asynchronous Communication, In roceedings of ECOOP'91, LNCS 512, [9] Ishikawa, Y., Tokuda, H., and Mercer, C. W., Object-Oriented Real-Time Language Design: Construction for Timing Constraints, In roceedings of ECOOP/OOPSLA'90, [10] Milner, R., Calculi for Synchrony and Asynchrony, Theoretical Comuter Science, Vol.25, [11] Milner, R., Communication and Concurrency, Prentice Hall, [12] Milner, R., A Comlete Axiomatization for Observational Congruence of Finite Behavior, Information and Comutation, Vol.81, [13] Milner, R., Parrow, J., and Walker, D., A Calculus of Mobile Processes Part 1 & 2, Technical reort ECS-LFCS & 86, University of Edinburgh, [14] Moller, F., and Tofts, C., A Temoral Calculus of Communicating Systems, In roceedings of CON- CUR'90, LNCS 458, [15] Najm, E., and Stefani, J. B., Object-Based Concurrency: A Process Calculus Analysis, In roceedings of TAPSOFT'91, LNCS 493, [16] Nicollin, X., and Sifakis, J., The Algebra of Timed Process ATP: Theory and Alications, IMAG Technical Reort, RT-C26, [17] Nierstrasz, O. M., and Paathomas, M., Viewing Objects as Patterns of Communicating Agents, In roceedings of ECOOP/OOPSLA'90, [18] Nierstrasz, O. M., Towards an Object Calculus, In roceedings of ECOOP'91 Worksho on Concurrent Object-Based Concurrent Comuting, LNCS 612, [19] Satoh, I., and Tokoro, M., A Formal Descrition and Verication for Parallel Comuting with Timed Constraints, In roceeding of Joint Symosium Parallel Processing'92, June, (in Jaanese) [20] Satoh, I., and Tokoro, M., Timed Process Calculus Semantics for A Real-Timed Concurrent Object- Oriented Language, Technical Reort, Det. Comuter Science, Keio University, February, [21] Takashio, K., and Tokoro, M., DROL: An Object- Orinted Programming Language for Distributed Real-time Systems, In roceedings of ACM OOP- SLA'92, October, [22] Walker, D., -Calculus Semantics of Object- Oriented Programming Languages, In roceedings of Theoretical Asects of Comuter Software, LNCS 526, [23] Yi, W., CCS + Time = an Interleaving Model for Real Time Systems, In roceedings of Automata, Languages and Programming'91, LNCS 510, [24] Yonezawa, A., and Tokoro, M., editors, Object- Oriented Concurrent Programming, MIT Press, Aendix A In this aendix, we develo a sound and comlete equational roof system based on timed strong equivalence. We rst restrict our attention to the non-recursive nite rocess exressions. The equational system for RtCCS is dened in Figure 3. We shall use \=" to denote derivability in our equational system, and \" to denote syntactical identity. It can be easily shown that the equational rocesses in Figure 3 are timed strongly equivalent. Therefore, we get the following result. Theorem 1 (Soundness) If P = Q where P; Q 2 P, then P T Q. Proof. Obvious according to the roositions 1 to 3, and Corollary 1. Next, we want to show that the system is comlete. We can accomlish this by using the following normal forms. Denition 7 A normal form (NF) is dened inductively by: (i) A rocess is in normal form if it is in NF 6 or NF hi. (ii) A rocess is in NF6 if it is of the form P 0in i:p i where each P i is in NF. (iii) A rocess is in NF hi if it is of the form hp; Qi 1 where P is in NF 6 and Q is in NF.

4 the sender, the receiver, the two channels, and the timer, as follows: (S b jt jc 1 jc 2 jr b ) n L where L = fsend S;b ; send ; send S;b R;b; send ; R;b ack S;b ; ack S; b b ; ack R;b ; ack R; b b ; start; sto; timeoutg By using timed bisimilarity, we transform (S b jtjc 1 jc 2 jr b )nl into a timed observation equivalent exression ABP, which is a sequential rocess: ABP ABP 0 (S b jt jc 1 jc 2 jr b ) n L T ABP where = accet:abp 0 = :h0; deliver: X i0 + :h0; ABP 0 i t h0; ABPi i2t+a i s We resent the roof of this transformation in Aendix B. By using the simler exression, we can not only investigate the behavior of the rotocol but also temoral roerties, such as the minimal and maximal delay for delivering a message. With secications based on RtCCS, we can derive the behavior and timing of whole systems from the descrition of its comonents. Timed bisimilarities allows us to analyze systems through timed and behaviorally equivalent rocesses which may have substantially less comlexity in their structure. 6 Conclusion We have dened a formal model called RtCCS for real-time object-oriented comutations. RtCCS is an extension of Milner's CCS by introducing a tick action and a timeout oerator. It can formally describe the asects of time deendence in realtime systems and enjoy many leasant roerties of CCS. We have introduced two timed equivalences based on CCS's bisimulation: timed strong equivalence and timed observation equivalence. The equivalences rovide a formal framework for analyzing the behavior and timing of real-time comutations. We have resented examles that demonstrate the exressiveness and the roof method of RtCCS. Furthermore, we have given a sound and comlete equational roof system based on timed strong equivalence in aendix. As an alication of RtCCS, we are resently develoing on the semantics of real-time objectoriented languages, such as DROL [21]. The semantics is dened by translation rules from the syntactical constructions of the languages into RtCCS rocess exressions, also used as a static verication model for real-time rograms. Details are resented in [19]. We are also interested in investigating whether an axiomatization based on observation congruence [12] can be alied to RtCCS, and whether other rocess equivalences such as distributed bisimulation [3] and testing equivalence [4] can be adoted by RtCCS. Acknowledgements We are grateful to P. Wegner, and K. Takashio for useful discussions. We would like to thank Y. Ishikawa and K. Honda for suggestions at the early stage of this work. We thank V. Vasconcelos, and T. Minohara for comments on an earlier version of this aer. References [1] America, P., de Bakker, J., Kok, J., and Rutten, J., Oerational Semantics of a Parallel Object- Oriented Language, In roceedings of ACM POPL, [2] Beaten, J. C. M, and Bergstra, J. A, Process Algebra, Cambridge University Press [3] Castellani, H., Hennessy, M., Distributed Bisimulation, Journal of ACM, Vol.36, No.4, [4] de Nicola, R. and Hennessy, M., Testing equivalence for rocesses, Theoretical Comuter Science, Vol.34, [5] Hansson, H. and Jonsson, B., A Calculus of Communicating Systems with Time and Probabilities,

5 Remarks It seems that we can always assume that if P Q (or P Q) holds in CCS, then P T Q (or P T Q) holds in RtCCS. There is however a counterexamle: unguarded recursion exressions, e.g., rec X : X exression. This is because in RtCCS such exressions are not allowed. However, we think that such exressions are unrealizable in object-oriented comuting. 5 Examles In this section we resent two examles which illustrate the exressiveness and utility of RtCCS. Examle 2 A Timer Object We describe a timer object T in RtCCS as follows: T = start:hsto:t ; timeout:t i t Uon recetion of a request start to start the timer, it receives the amount t of and then sends timeout. If it accets a request sto, the timer goes back to its initial state T. Examle 3 Verication of Timed Systems In order to illustrate how to describe and verify systems in RtCCS we describe the Alternating Bit Protocol for OSI data link layer. There are ve comonents: the sender, the receiver, the two unreliable channels, and the timer. To nd out dulicate messages or acknowledgments, messages and acknowledgements are sent tagged with bits 0 and 1 alternately. Uon recetion of a request to send a message (accet), the sender sends it tagged with an aroriate bit b (send S;b ) to the channel. It then waits for an aroriate acknowledgement (ack R;b ). If the acknowledgement cannot be received within a secied eriod of time, the sender retransmits the message. The two channels are unreliable. They may occasionally lose a message or an acknowledgement. The receiver waits for a message (send R;b or send, where b R;b is the comlement of b) and then it sends an acknowledgement to the channel (ack R;b or ack R;b ). If it accets a message tagged with an aroriate bit, it sends the message to the environment (deliver). The sender S has the following denition. S b S 0 b S 00 b S b S 0 b Sb 00 = accet:s 0 b = send S;b :start:s 00 b = ack S;b :sto:sb + ack S;b :S00 b + timeout:s 0 b = accet:s 0 b = send S;b :start:s00 b = ack S;b :sto:s b + ack S;b :S 00 b b + timeout:s 0 b b The timer T has the following denition, where t is the timeout time. T = start:hsto:t ; timeout:t i t The channel C 1 has the following denition, where s is the transmission time for a message. C 1 = send S;b :h0; send R;b :C 1 + :C 1 i s + send S;b :h0; send R;b :C 1 + :C 1 i s The channel C 2 has the following denition, where a is the transmission time for an acknowledgement. C 2 = ack R;b :h0; ack S;b :C 2 + :C 2 i a + ack R;b :h0; ack S;b :C 2 + :C 2 i a The receiver R has the following denition. R b R b = send R;b :deliver:ack R;b :R b + send R;b :ack R;b :R b = send R;b :deliver:ack R;b :R b + send R;b :ack R;b :R b We resent the behavior of the whole rotocol under the assumtion that s + a < t. The rotocol is constructed by the arallel comosition of

6 4.2 Timed Observation Equivalence The timed strong equivalence has several useful algebraic roerties but gives no secial status to the internal action which indeed should not be observed. We resent a weaker equivalence which reects the observation of behaviors and timing in the comutation. Denition 5 A binary relation S P 2 P is a timed weak bisimulation if (P; Q) 2 S imlies, for all 2 Act T, (i) 8P 0 : P =) P 0 9Q 0 : Q =) Q 0 ^ P 0 T Q 0. (ii) 8Q 0 : Q =) Q 0 9P 0 : P =) P 0 ^ P 0 T Q 0. (iii) P " i Q ". We write P = T Q if P and Q are timed observation congruent. Proosition 6 If P T Q and both rocesses are stable 2, then P = T Q. Proof. Direct from Denition 5 and 6. (i) 8P 0 : P (ii) 8Q 0 : Q =) P 0 9Q 0 : Q =) b Q 0 ^ (P 0 ; Q 0 ) 2 S. =) Q 0 9P 0 : P =) b P 0 ^ (P 0 ; Q 0 ) 2 S. Proosition 7 For all P; Q 2 P, if P T P = T Q, and if P = T Q then P T Q. Q then Let \ T " denote the largest timed weak bisimulation, and call P and Q timed observation equivalent if P T Q. Intuitively, if P and Q are timed observation equivalent, each action of P must be matched by a sequence of actions of Q with the same visible contents and timing, and conversely. The equivalence can equate objects that are not distinguishable by the observable behavior and the timing in the comutations. Proosition 5 1. :P T P 2. ::P T :P 3. :P + P T :P 4. :(:P + Q) T :(:P + Q) + :Q 5. h:p ; Qi t T P (t > 0) 6. hp; :Qi t T hp; Qi t 7. h:p ; :h:p ; Qi s i t T h:p ; Qi s+t Proof. Easy alication of Denition 5. Like a weak equivalence in CCS, T is not a congruence relation. However, we can dene a timed observation congruence relation based on the timed observation equivalence. Denition 6 P and Q are timed observation congruent if for all 2 Act T Proof. By Denition 4 to 6, clearly = T lies between T and T. Intuitively, if P T Q and both have no - derivative, then P = T Q. Therefore, we can easily rove the following roerties. Proosition 8 1. ::P = T :P 2. :P + P = T :P 3. :(:P + Q) = T :(:P + Q) + :Q 4. hp; :Qi t = T hp; Qi t (t > 0) 5. h:p ; :h:p ; Qi s i t = T h:p ; Qi s+t Proof. Use Proosition 5 and 6. Proosition 9 (Congruence) Timed observation congruence = T is reserved by all oerators. Proof. Same as Proosition 4. = T is a congruence relation and very close to timed observation equivalence. We grantee that if two objects are timed observation congruent, they are substitutable for each other even though their internal imlementations are dierent. 2 P is stable if P 0! P 0 is imossible for all P 0.

7 2. h:p ; h:p ; Qi t i s T h:p ; Qi s+t 3. h:p + Q; Ri t T :P + Q (t > 0) 4. hp; Qi t n L T hp n L; Q n Li t 5. hp; Qi t [f] T hp [f]; Q[f]i t 6. hp; Q + Ri t T hp; Qi t + hp; Ri t 7. hp + Q; Ri t T hp; Ri t + hq; Ri t 8. hhp; Qi s ; Ri t T hp; Rit (s t) hp; hq; Ri t0s i s (s < t) Proof. All the laws may be roved by exhibiting aroriate timed strong bisimulations. The hardest is (8) of Proosition 3 in the case of (s < t) which we rove as follows: We need to show that S is a timed strong bisimulation, where f ( hhp 1 ; P 2 i s ; P 3 i t ; hp 1 ; hp 2 ; P 3 i t0s i s ) j 0 s < t; P 1 ; P 2 ; P 3 2 Pg. So let hhp 1 ; P 2 i s ; P 3 i t 0! Q 1 ; it is enough to nd Q 2 such that hp 1 ; hp 2 ; P 3 i t0s i s 0! Q 2 and (Q 1 ; Q 2 ) 2 S. There are two cases: Case 1 2 Act and P 1 0! P 0. By TIME 1 0, Q 1 P 0, and 1 Q 2 P 0, and we know 1 Q 1 Q 2. Case 2 =. Case 2.1 s = 0. We assume that P 2 0! P 0 2. By TIME 2, Q 1 hp 0 2 ; P 3i t01 and Q 2 hp 0 2 ; P 3i t01, hence Q 1 Q 2. Case 2.2 s > 0. We assume that P 10!P 0. 1 By TIME 1, Q 1 hhp 0 1 ; P 2i s01 ; P 3 i t01, and Q 2 hp 0 1 ; hp 2; P 3 i t0s i s01, and clearly (Q 1 ; Q 2 ) 2 S. By a symmetric argument, we comlete the roof. RtCCS, like CCS, is based on the concet of interleaving and can reduce concurrent rocesses to sequential rocesses in terms of nondeterminism, for examle, :0j:0 T ::0 + ::0. Corollary 1 The Exansion Laws 1. Let P P i2i i:p i and Q P j2j j:q j ; PjQ T Pi2I i:(p i jq) + P j2j j:(p jq j ) + P i = j :(P i jq j ) 2. Let P h P i2i i:p i ; P 0 i 1 and Q P j2j j:q j ; P jq T h P i2i i:(p i jq) + P j2j j:(p jq j ) + P i = j :(P i jq j ) ; P 0 jqi 1 3. Let P h P i2i i:p i ; P 0 i 1 and Q h P j2j j:q j ; Q 0 i 1 ; P jq T h P i2i i:(p i jq) + P j2j j:(p jq j ) + P i = j :(P i jq j ) ; P 0 jq 0 i 1 From the laws in Proosition 1, 2, 3, and Corollary 1, we can develo an equational roof system based on timed strong equivalence. The system is given in aendix A. Proosition 4 (Congruence) Timed strong equivalence T is reserved by all oerators. Proof. We show a roof only for the timeout oerator; the roofs for the other oerations are similar to the roofs of [11]. We will rove that hp 1 ; Qi t T hp 2 ; Qi t where P 1 ; P 2 ; Q 2 P and P 1 T P 2. It is enough to show that S = f(hp 1 ; Qi t ; hp 2 ; Qi t ) : P 1 T P 2 ; t 0g is a timed strong bisimulation. We assume hp 1 ; Qi t 0! R. There are two cases: Case 1 2 Act and P 1 0! P 0 1. Then because P 1 T P 2, we have 9P 0 : 2 P 2 0! P 0 2 with P 0 1 T P 0. Hence 2 hp 1; Qi t 0! P 0, 1 hp 2 ; Qi t 0! P 0, and clearly 2 P 0 1 T P 0. 2 Case 2 =. Case 2.1 t = 0. Obvious. Case 2.2 t > 0, P 1 0! P 0, and 1 hp 1; Qi t 0! hp 0 1 ; Qi t01. Then because P 1 T P 2, we have 9P 0 : 2 P 2 0! P 0 with 2 P 0 1 T P 0. Hence 2 hp 2; Qi t 0! hp 0 2 ; Qi t01 and (hp 0 1 ; Qi t01; hp 0 2 ; Qi t01) 2 S. By a symmetric argument, we comlete the roof. The roof for the other case of the timeout oerator, i.e. hq; P 1 i t T hq; P 2 i t where P 1 T P 2, is similar. By this roosition we guarantee that if two objects are timed strongly equivalent, the objects are substitutable for each other.

8 Examle 1 Here we give some simle examles of RtCCS exressions. (1) a:h b:p ; 0i t After erforming an inut action a, it behaves as P if an outut action b is executed within t units of time, otherwise terminates. (2) a:h0; b:p i t After erforming a, it is idle for t time units and then behaves as b:p. (3) a:(h0; b:0i d jp ) After erforming a, it behaves as P but b becomes available after d time units. Note that h0; b:0i d jp reresents a rocess which behaves as P and sends b as an asynchronous outut communication with transmission delay d time units. Remarks 1. The fundamental asects of concurrent objectoriented comuting are modeled as the rimitive constructions of RtCCS as follows: Objects as rocesses. Concurrency among objects as arallel comosition. Message assing as communication between rocesses. Encasulation in objects as restriction and relabeling. Also, we cature the fundamental asects of real-time comuting delayed rocessing and timeout handling, through the timeout oerator of RtCCS. 2. An external action cannot be erformed before its artner action in another rocess is ready to communicate. While a rocess having an external action is waiting for its artner action, it must erform actions. If a rocess has an executable communication (including ), it must erform the communication immediately, instead of idling. 4 Timed Bisimilarity In this section we resent two equivalences over rocesses, which are extensions of CCS's bisimulation with the notion of time. The equivalences rovide a formal framework for analyzing the behavior and timing of real-time object-oriented comutations. 4.1 Timed Strong Equivalence Denition 4 A binary relation S P 2 P is a timed strong bisimulation if (P; Q) 2 S imlies, for all 2 Act T, (i) 8P 0 : P 0! P 0 9Q 0 : Q 0! Q 0 ^ (P 0 ; Q 0 ) 2 S. (ii) 8Q 0 : Q 0! Q 0 9P 0 : P 0! P 0 ^ (P 0 ; Q 0 ) 2 S. We let \ T " denote the largest timed strong bisimulation, and call P and Q timed strongly equivalent if P T Q. Intuitively, if P and Q are timed strongly equivalent, they seem indistinguishable from one another in behavior and timing. We show some algebraic roerties of the equivalence: Proosition 1 1. P + Q T Q + P 2. P + (Q + R) T (P + Q) + R 3. P + P T P 4. P + 0 T P Proosition 2 1. P jq T QjP 2. P j(qjr) T (P jq)jr 3. P j0 T P 4. (P + Q) n L T P n L + Q n L 5. (:P ) n L T 0 if 2 L [ L :P n L otherwise 6. (P + Q)[f] T P [f] + Q[f] 7. (:P )[f] T f():p [f] Proosition 3 1. h:p ; :P i t T :P

9 where t is a natural number, f 2 Act! Act and L Act. We assume that f() =, f( ) =, and that X is always guarded 1 [11]. We denote the set of closed exressions by P( E), ranged over P; Q;.... The syntax of RtCCS is essentially the same as that of CCS, excet for the newly introduced tick action and timeout oerator. Intuitively, the meaning of rocess constructions are as follows: 0 reresents a deadlocked or terminated rocess; :E erforms an action and then behaves like E; E 1 + E 2 is the rocess which may behave as E 1 or E 2 ; E 1 je 2 reresents rocesses E 1 and E 2 executing concurrently; E[f] behaves like E but with the actions relabeled by function f; E n L behaves like E but with actions in L [ L rohibited; rec X : E binds the free occurrences of X in E but we shall often use the more readable notation X = E instead Oerational Semantics of RtCCS RtCCS is a labeled transition system h E; Act T ; f 0! j 2 Act T g i where 0! is a transition relation ( 0! E 2 E). The transition relation 0! is dened by structural induction and is the smallest relation given by the rules in Figure 2. The 0! relation does not distinguish between observable and unobservable actions. In order to reect that is not visible, we dene two transition relations due to the unobservability of. Denition 2 (i) P =) Q = P ( 0!) 3 0! ( 0!) 3 Q (ii) P =) b Q = P ( 0!) 3 0! ( 0!) 3 Q if 6= and otherwise P ( 0!) 3 Q. Also, we dene an oeration to denote a rocess caable of innite internal comutation. Denition 3 E " if 9E 0 : E( 0!)! E 0 1 X is guarded in E if each occurrence of X is only within some subexressions :E 0 in E; c.f. unguarded exressions, e.g. rec X : X or rec X : X + E. ACT 0 : 0 :E 0! E ACT 1 : 0 a:e 0! a:e ACT 2 : 0 0 0! 0 SUM 0 : E 0! E 0 E + F 0! E 0 SUM 1 : F 0! F 0 E + F 0! F 0 E SUM 2 : 0! E 0 ; F 0! F 0 E + F 0! E 0 + F 0 COM 0 : E 0! E 0 EjF 0! E 0 jf COM 1 : F 0! F 0 COM 2 : COM 3 : RES 0 : RES 1 : E EjF 0! EjF 0 E 0! a E 0 ; F 0! a F 0 EjF 0! E 0 jf 0 0! E 0 ; F 0! F 0 ; EjF 0! 6 EjF 0! E 0 jf 0 E 0! E 0 ; ; =2 L E n L 0! E 0 n L E 0! E 0 E n L 0! E 0 n L REL : E 0! E 0 REC : TIME 0 : TIME 1 : E[f] f () 0! E 0 [f] Efrec X : E=Xg 0! E 0 rec X : E=X 0! E 0 E 0! E 0 ; t > 0 he; F i t 0! E 0 E 0! E 0 ; t > 0 he; F i t 0! he 0 ; F i t01 TIME 2 : F 0! F 0 he; F i 0 0! F 0 Figure 2: Inference Rules of RtCCS

10 an extension of CCS with discrete time and robability. PTCCS is similar to our RtCCS. However, unlike ours, time stos inside the timeout oerator of PTCCS. Therefore, the timeout oerator of PTCCS cannot aly to a rocess with timed roerties, and PTCCS cannot describe a timeout excetion for such a rocess. The timeout oerator of ATP is similar to ours. However, ATP has no notion of observation equivalence because ATP has no action, since it is not based on CCS. 3 RtCCS In this section, we resent the basic idea of RtCCS and rovide its formal denition. 3.1 Time Extensions We assume a concetual global clock: time asses as the global clock erforms tick actions. The tick action is a synchronous broadcast message over all rocesses. It is described as. The advance of time can be reresented as a sequence of tick actions and is viewed as discrete time. Also, we assume that all communications and internal actions take no time, and that comlementary actions and internal actions are erformed as soon as they become ossible. Therefore, a rocess having a communication action ready must wait until other rocess becomes ready to communicate with it. Once both the artners of a communication are ready, they must erform the communication actions immediately, before the next tick. As mentioned reviously, many real-time rogramming languages have timed oerations such as delay and timeout. In order to be used as a framework for formal semantics of languages, RtCCS needs to reresent behaviors deendent on the advancing of time. We introduce a secial binary oerator: h ; i t, called a timeout oerator. As shown in Figure 1, hp; Qi t denotes a rocess that after t time units becomes Q, unless P erforms any actions rior to that. Intuitively hp; Qi t behaves as rocess P if P can execute an initial transition within t units of time, whereas hp; Qi t behaves as rocess Q if P does not erform any action within t units of time. That is to say, P and Q corresond to ordinary and timeout rocesses resectively, in ractical rogramming. if t > 1 if t = 1 P 0 P 0 a 0 09 a 0 09 hp; hp 00 ; a P 0! P 0 P 0! P 00 hp; Qi 1 P 0! a P 0 Figure 1: The behavior of the timeout oerator Q 3.2 The RtCCS Language In this subsection, we resent the syntax and the oerational semantics of RtCCS Notation and Syntax of RtCCS We resuose that A is a set of communication action names and A the set of co-names. Let a,b,... range over A and a,b,... over A. An action a is the comlementary action of a, and a a. Let denote an internal action, and a tick action. Finally let Act A[A[fg ranged over by,,..., and Act T Act [ f g ranged over by,,.... Denition 1 The set E of RtCCS exressions ranged over by E; E 1 ; E 2 ; F;... is dened recursively by the following abstract syntax. E ::= 0 (Deadlock Process) j X (Process Variable) j :E (Action Prex) j E 1 + E 2 (Summation) j E 1 je 2 (Comosition) j E[f] (Relabeling) j E n L (Restriction) j rec X : E (Recursion) j he 1 ; E 2 i t (Timeout)

11 cesses which may change their states when communicating with another agent. Also, rocess calculi have equivalence relations over rocesses which rovide theoretical frameworks for analyzing the behavior of objects and for substituting objects. In this aer we develo a rocess calculus which ermits exressing and analyzing time constraints in real-time object-oriented comutations. To do this, we extend an existing rocess calculus with the notion of time and introduce a timed rocess calculus called RtCCS (Real-time Calculus of Communication Systems). It is an extension of Milner's CCS [11] with a minimal set of notions for time: a tick action and a timeout oerator. The execution of tick actions corresonds to the assage of time; the timeout oerator reresents a behavior deendent on the assage of time. Furthermore, we develo theoretical equivalences over rocesses with time roerties. In RtCCS, time indeendent roerties of rocesses can be treated as usual CCS while the time deendent roerties can be treated with the timed extensions. In order to demonstrate its eectiveness in a simler form, our timed extension is develoed for CCS. However, the same extension can be naturally adoted into -calculus [13] which has more owerful mechanisms for modeling object-oriented comuting. In the next section, we discuss some of the related works. In Section 3, we dene the syntax and the oerational semantics of RtCCS. Section 4 de- nes two equivalence relations called timed strong equivalence and timed observation equivalence resectively, and studies their basic roerties. In Section 5, we resent some examles that demonstrate the usefulness of RtCCS. The nal section contains some concluding remarks. In Aendix A, we dene an equational roof system based on timed strong equivalence. 2 Related Research Recently, many theoretical models for concurrent object-oriented comutations have been exlored in rocess calculi, such as CCS [11], -calculus [13], and ACP [2]. In the rocess calculus aradigm, objects can be viewed as rocesses, interactions among objects can be seen as communications, and encasulation can be modeled by the restriction of visible communications. In [8] a formal system based on the notion of actor-like object with asynchronous communication was investigated, and in [17] an executable notation for secifying concurrent object-oriented languages in a rocess calculus was exlored. In [18] some requirements for a calculus suitable for concurrent objects is resented. In [15] the author resents a language based on a rocess calculus and analyzes the essential features of object-based concurrency. In [22] a semantics for POOL [1] is dened by the translation of the language constructs into -calculus [13]. Many theoretical models for real-time comutations have been exlored in temoral logic, timed Petri nets, and denotational semantics frameworks based on linear history semantics. More recently, several studies develoed temoral models based on rocess calculi such as CCS, ACP, and CSP [6, 5, 10, 16, 14, 23]. Milner's SCCS [10] is a calculus for synchronous rocesses based on the idea that each atomic action takes one unit of time. The concurrent agents of SCCS essentially roceed in lockste and at every instant erform a single action; there is also an asynchronous oerator. Since each object in an object-oriented comutation roceeds at indeterminate relative seeds, SCCS does not t our uroses. TPA [6], timed CCS [23], and Temoral CCS [14] introduce delay oerators into CCS. The delay oerators reresent the susension of execution for a secied time, similarly to the delay command in Ada. In TPA and timed CCS, like in RtCCS, there are two assumtions: time advances only when communications are not ossible and that actions are instantaneous. Once an action is enabled, it cannot be disabled. Therefore, they cannot exress timeout behavior. On the other hand, Temoral CCS can reresent timeout behavior but has no equivalent relation over rocesses based on observation of their behaviors. PTCCS [5] and ATP [16], like ours, have a timeout oerator. PTCCS is

12 To aear in Proceedings of ACM OOPSLA'92 A Formalism for Real-Time Concurrent Object-Oriented Comuting Ichiro Satoh satoh@mt.cs.keio.ac.j Mario Tokoro 3 mario@mt.cs.keio.ac.j Deartment of Comuter Science, Keio University , Hiyoshi, Kohoku-ku, Yokohama, 223, Jaan Tel: Fax: Abstract We investigate a formal model for reasoning about real-time object-oriented comutations. The model is an extension of CCS with the notion of time, called RtCCS (Real-time Calculus of Communication Systems). It can naturally model real-time concurrent objects as communicating rocesses and reresent the timed roerties of objects. We de- ne two timed equivalences based on CCS's bisimulation and derive algebraic laws for reasoning about real-time rocesses. The equivalences rovide a formal framework for analyzing the behavior and timing of real-time comutations. Also, we dene a sound and comlete equational roof system for - nite rocesses. Some examles in RtCCS are shown in order to demonstrate its usefulness. 1 Introduction Real-time systems are increasingly being used in various areas such as factory automation, robotics, and multi-media systems. These systems have to interact and cooerate with many external ele- 3 Also with Sony Comuter Science Laboratory Inc Higashi-Gotanda, Shinagawa-ku, Tokyo, 141, Jaan. ments which run in arallel, such as other comuters, sensors, and actuators. The notion of concurrent object-oriented comuting [24] is considered as a owerful method to design and to develo such real-time systems. This is because concurrent object-oriented systems consist of objects which are logically self-contained active entities that cooerate with each other. Concurrent objects can naturally model such active elements directly. Recently, some real-time systems and languages use this concet as their basis [9, 21]. Real-time systems have certain time constraints which must be satised. The correctness of a realtime system deends not only on the logical results of comutation, but also on the time at which the results are roduced. Therefore, the construction and debugging of real-time rograms is far more comlex and dicult than those of ordinary concurrent rograms. We need the suort of formal verication methods for reasoning about real-time rograms. In the ast few years several researchers have roosed such methods based on timed Petri nets, rst order logics, and temoral logics. However, these frameworks are not always t for concurrent object-oriented comuting. The goal of this aer is to investigate a formal model to reason about real-time object-oriented comutations. Various formal models for concurrent objectoriented comutation have reviously been devised. Among these, rocess calculus [2, 11, 13] is a well-dened theory that can model naturally and easily concurrent objects as communicating ro-