Conjunction on processes: Full abstraction via ready-tree semantics

Transcription

1 Theoreticl Computer Science 373 (2007) Conjunction on processes: Full bstrction vi redy-tree semntics Gerld Lüttgen, Wlter Vogler b, Deprtment of Computer Science, University of York, York YO10 5DD, UK b Institut für Informtik, Universität Augsburg, D Augsburg, Germny Received 18 My 2006; received in revised form 25 October 2006; ccepted 26 October 2006 Communicted by R. Gorrieri Abstrct A key problem in mixing opertionl (e.g. process-lgebric) nd declrtive (e.g. logicl) styles of specifiction is how to del with inconsistencies rising when composing processes under conjunction. This rticle introduces conjunction opertor on lbelled trnsition systems cpturing the bsic intuition of nd b = flse, nd considers nive preorder tht demnds tht n inconsistent specifiction cn only be refined by n inconsistent implementtion. The min body of the rticle is concerned with chrcterizing the lrgest precongruence contined in the nive preorder. This chrcteriztion will be bsed on wht we cll redy-tree semntics, which is vrint of pth-bsed possible-worlds semntics. We prove tht the induced redy-tree preorder is compositionl nd fully bstrct, nd tht the conjunction opertor indeed reflects conjunction. The rticle s results provide foundtion for, nd n importnt step towrds unified frmework tht llows one to freely mix opertors from process lgebrs nd liner-time temporl logics. c 2007 Published by Elsevier B.V. Keywords: Lbelled trnsition system; Conjunction; Consistency preorder; Redy-tree semntics; Redy-tree preorder; Full bstrction 1. Introduction Process lgebr [1] nd temporl logic [2] re two populr pproches to formlly specifying nd resoning bout rective systems. The process-lgebric prdigm is founded on notions of refinement, where one typiclly formultes system specifiction nd its implementtion in the sme nottion nd then proves using compositionl resoning tht the ltter refines the former. The underlying semntics is often given opertionlly, nd refinement reltions re formlized s precongruences. In contrst, the temporl-logic prdigm is bsed on the use of temporl logics to formulte specifictions bstrctly, with implementtions being denoted in n opertionl nottion. One then verifies system by estblishing tht it is model of its specifiction. An extended bstrct ppered in L. Aceto, A. Ingólfsdóttir (Eds.), Intl. Conf. on Foundtions of Softwre Science nd Computtion Structures, FOSSACS 2006, Vienn, Austri, in: Lecture Notes in Computer Science, vol. 3921, Springer-Verlg, 2006, pp Corresponding uthor. Tel.: ; fx: E-mil ddress: wlter.vogler@informtik.uni-ugsburg.de (W. Vogler) /$ - see front mtter c 2007 Published by Elsevier B.V. doi: /j.tcs

2 20 G. Lüttgen, W. Vogler / Theoreticl Computer Science 373 (2007) Recently, two ppers hve been published imed t mrrying process lgebrs nd temporl logics [3,4]. While the first pper introduces semntic frmework bsed on Büchi utomt, the second pper considers lbelled trnsition systems ugmented with n unimplementbility predicte. This predicte cptures inconsistencies rising when composing processes conjunctively; e.g. the composition b is contrdictory since run of process cnnot begin with both ctions nd b. Note tht one cnnot simply interpret conjunction s synchronous composition nd ignore inconsistencies. Otherwise, b would be deemed equivlent to the dedlock process 0. Hence, 0 would implement b, lthough it neither implements or b in ny dedlock-sensitive implementtion reltion. The frmeworks in [3,4] re equipped with refinement preorder bsed on De Nicol nd Hennessy s must-testing preorder [5]. However, the results obtined in [3,4] re unstisfctory: the refinement preorder in [3] is not precongruence, while the -opertor in [4] is not conjunction with respect to the studied precongruence, i.e. it does not stisfy the lw p q r if nd only if p r nd q r. This rticle solves the deficiencies of [3,4] within simple setting of lbelled trnsition systems in which stte represents either n externl (non-deterministic) or internl (disjunctive) choice. Moreover, sttes tht re vcuously true or flse re tgged ccordingly. The tgging of flse sttes, or inconsistent sttes, is given by n inductive inconsistency predicte tht is defined very similr but subtly different to the unimplementbility predicte of [4]. We then equip our setting with two opertors: the conjunction opertor is in essence synchronous composition on observble ctions nd n interleving product on the unobservble ction τ, but dditionlly cptures inconsistencies; the disjunction opertor simply resembles the process-lgebric opertor of internl choice. Our vrint of lbelled trnsition systems gives rise to nive refinement preorder F requiring tht n inconsistent specifiction cnnot be refined except by n inconsistent implementtion. We chrcterize the consistency preorder, i.e. the lrgest precongruence contined in F when conjunctively closing under ll contexts. To do so, we dpt vn Glbbeek s pth-bsed possible-worlds semntics [6] which in turn is motivted by the possible-worlds semntics of Veglioni nd De Nicol [7]. We cll the dpted semntics redy-tree semntics which is t lest when disllowing divergent behviour finer thn both must-testing semntics [5] nd redy-trce semntics [8], but corser thn redy simultion [9]. The resulting redy-tree preorder is not only compositionl for nd nd fully bstrct with respect to F, but lso possesses severl other desired properties. In prticulr, we prove tht ( ) is indeed conjunction (disjunction) reltive to, nd tht nd stisfy the expected boolen lws, such s the distributivity lws. Our results re significnt first step towrds the gol of developing uniform clculus in which one cn freely mix process-lgebric nd temporl-logic opertors. This will give engineers powerful tools to model system components t different levels of bstrction nd to impose logicl constrints on the execution behviour of components. The proposed redy-tree preorder will llow engineers to step-wise nd component-wise refine systems by trding off logicl content for opertionl content Orgnistion The next section presents our setting of lbelled trnsition systems ugmented with true nd flse predictes, together with conjunction nd disjunction opertor. Section 3 defines redy-tree semntics, ddresses expressiveness issues of severl redy-tree vrints nd introduces the redy-tree preorder. Our compositionlity nd full-bstrction results re proved in Section 4. The reltion of our redy-tree preorder to estblished preorders is mde precise in Section 5. Our frmework is then extended by prllel composition opertor in Section 6, in which it is lso pplied to the structured specifiction nd refinement-bsed design of mode logics of flight guidnce systems. Finlly, Section 7 discusses our results in light of relted work, while Section 8 presents our conclusions nd suggests directions for future reserch. 2. Lbelled trnsition systems nd conjunction This section first introduces our process-lgebric setting nd prticulrly conjunctive composition informlly, discusses semntic choices nd their implictions, nd finlly gives forml ccount of our frmework Motivtion Our setting models processes s lbelled trnsition systems, which my be composed conjunctively nd disjunctively. As usul in process lgebr, trnsition lbels re ctions tken from some lphbet A = {, b,...}.

3 G. Lüttgen, W. Vogler / Theoreticl Computer Science 373 (2007) Fig. 1. Bsic intuition behind conjunctive composition. Fig. 2. Bckwrd propgtion of inconsistencies. When n ction is offered by the environment nd the process under considertion is in stte hving one or more outgoing -trnsitions, the process must choose nd perform one of them. If there is no outgoing -trnsition, then the process stys in its stte, t lest in clssicl process-lgebric frmeworks where the composition between process nd its environment is modelled using some prllel opertor. However, in conjunctive setting we wish to mrk the composed stte between process nd environment s inconsistent, if the environment offers n ction tht the process cnnot perform, or vice vers. Hence, tking ordinry synchronous composition s opertor for conjunction is insufficient. We illustrte this intuition behind our conjunction opertor nd its implictions by the exmple lbelled trnsition systems of Fig. 1. First, consider the processes p, q nd r. Process p nd q specify tht exctly ction nd respectively ction b is offered initilly. Similrly, process r specifies tht nd b re offered initilly. From this perspective, p q s well s p r re inconsistent nd should be tgged s such. Formlly, our lbelled trnsition systems will be ugmented by n inconsistency predicte F, so tht p q, p r F in our exmple. We lso refer to inconsistent sttes s flse-sttes. Now consider the conjunction p q shown on the right in Fig. 1. Since both conjuncts require ction to be performed, p q should hve n -trnsition. From the preceding discussion, this trnsition should led to flse-stte. No implementble process cn meet these requirements of being ble to perform nd being inconsistent fterwrds. Thus, our inconsistency predicte will propgte bckwrds to the conjunction itself, s indicted in Fig. 1. Fig. 2 shows more intricte exmples of bckwrd propgtion. The inconsistency of the trget stte of the - trnsition of the process on the left propgtes bckwrds to its source stte. This is the cse lthough the source stte is ble to offer trnsition leding to consistent stte. However, tht trnsition cn only be tken if the environment offers ction b. The process is forced into the inconsistency when the environment offers ction. The sitution is different for the process in the middle, which hs n dditionl -trnsition leding to consistent stte. Here, the process is consistent, s it cn choose to execute this new -trnsition nd thus void to enter flsestte. In fct, this choice cn be viewed s disjunction between the two -brnches. As n side, note tht in [4] the design decision ws to consider process lredy s inconsistent if some -derivtive is. While there might be n intuitive justifiction for tht, it led to setting where the implied conjunction opertor did not reflect conjunction for the studied refinement preorder, i.e. where Theorem 21(1) did not hold. Disjunction cn be mde explicit by using the clssicl internl-choice opertor. This opertor my s usul be expressed by employing the specil, unobservble ction τ / A s shown on the right in Fig. 2. Hence, we my identify the internl-choice opertor with the disjunction opertor desired in our setting. Moreover, disjunction p q is inconsistent if both p nd q re flse-sttes. In prticulr, the process on the right in Fig. 2 will represent flse q in our pproch, with q from Fig. 1, which clerly should be consistent Formliztion For nottionl convenience we denote A {τ} by A τ nd use α, β,... s representtives of A τ. We strt off by defining our notion of lbelled trnsition system (LTS). The LTSs considered here re ugmented with

4 22 G. Lüttgen, W. Vogler / Theoreticl Computer Science 373 (2007) flse-predicte F on sttes, s discussed bove, nd dully with true-predicte T. A stte in F represents inconsistent, empty behviour, while stte in T represents completely underspecified, rbitrry behviour. Formlly, n LTS is qudruple P,, T, F, where P is the set of processes (sttes), P A τ P is the trnsition reltion, nd T P nd F P re the true-predicte nd flse-predicte, respectively. We write p α p insted of p, α, p, p α insted of p P. p α p, nd p insted of p P, α A τ. p α p. α When p p, we sy tht process p cn perform n α-step to p, nd we cll p n α-derivtive of p. We lso require n LTS to stisfy the following τ-purity condition: p τ implies A. p, for ll p P. Hence, ech process represents either n externl or internl (disjunctive) choice between its outgoing trnsitions. This restriction turns out to be techniclly convenient, nd we leve exploring the consequences of lifting it for future work. The LTSs of interest to us need to stisfy four further properties, s stted in the following forml definition, where I(p) stnds for the set {α A τ p } α of initil ctions of process p, to which we lso refer s redy set. Definition 1 (Logic LTS). An LTS P,, T, F is logic LTS if it stisfies the following conditions: (1) T F = (2) T {p p } (3) F P such tht p F if α I(p) p P. p α p = p F (4) p cnnot stbilize (see below) = p F. Nturlly, we require tht process cnnot be tgged true nd flse t the sme time. As true-process specifies rbitrry, full behviour, ny behviour mde explicit by outgoing trnsitions is lredy included implicitly; hence, ny outgoing trnsitions my simply be cut off. The third condition formlizes the bckwrds propgtion of inconsistencies s discussed in the motivtion section bove. The fourth condition reltes to divergence, i.e. infinite sequences of τ-trnsitions. In mny semntic frmeworks, e.g. [10], divergence is considered ctstrophic, while in our setting ctstrophic behviour is inconsistent behviour. We view divergence only s ctstrophic if process cnnot stbilize, i.e. if it cnnot get out of n infinite, internl computtion. While this is intuitive, there is lso technicl reson to which we will come bck shortly. To formlize our notion of stbiliztion, we first introduce wek trnsition reltion = F P (A τ {ε}) P (ε denoting the empty sequence), which is defined by: (1) p = ε F p if p p / F, where denotes syntctic equlity; (2) p = ε F p if p / F nd p τ p ε = F p for some p ; (3) p = F p if p / F nd p p ε = F p for some p. Our definition of wek trnsition is slightly unusul: wek trnsition cnnot pss through flse-sttes since these cnnot occur in computtions, nd it does not bstrct from τ-trnsitions preceding visible trnsition. However, we only will use wek visible trnsitions from stble sttes, i.e. sttes with no outgoing τ-trnsition. Finlly, we cn now formlize stbiliztion: process p cn stbilize if p = ε F p for some stble p. Note tht both Conds. (3) nd (4) re inductively defined conditions. We refer to them s fixed point conditions of F for LTS. For convenience, we will often write LTS insted of Logic LTS in the sequel. Moreover, whenever we mention process p without stting respective LTS explicitly, we ssume implicitly tht such n LTS P,, T, F is given. We let tt (ff) stnd for the true (flse) process, which is the only process of n LTS with tt T (ff F) Opertors Our conjunction opertor is essentilly synchronous composition for visible trnsitions nd n synchronous composition for τ-trnsitions. However, we need to tke cre of the T - nd F-predictes. Definition 2 (Conjunction Opertor). The conjunction of two Logic LTSs P, P, T P, F P, Q, Q, T Q, F Q is the LTS P Q, P Q, T P Q, F P Q defined by: P Q = df {p q p P, q Q} P Q is determined by the following opertionl rules:

5 G. Lüttgen, W. Vogler / Theoreticl Computer Science 373 (2007) p Fig. 3. Counter-exmple demonstrting non-ssocitivity. p τ P p = p q τ P Q p q q τ Q q = p q τ P Q p q P p, q Q q = p q P Q p q q T Q, p α P p = p q α P Q p q p T P, q α Q q = p q α P Q p q p q T P Q if nd only if p T P nd q T Q F P Q is the lest subset of P Q such tht p q F P Q if t lest one of the following conditions holds: (1) p F P or q F Q τ (2) p / T P nd q / T Q nd p q P Q nd I(p) I(q) (3) α I(p q) p q. p q α P Q p q = p q F P Q (4) p q cnnot stbilize. Note tht the tretment of true-processes when defining P Q nd T P Q reflects our intuition tht these processes llow rbitrry behviour. We re left with explining Conds. (1) (4). Firstly, conjunction is inconsistent if ny conjunct is. Conds. (2) nd (3) reflect our intuition of inconsistency nd, respectively, bckwrd propgtion stted in the motivtion section bove. Cond. (4) is dded to enforce Definition 1(4). We refer to Conds. (3) nd (4) s fixed point conditions of F for. It is esy to check tht conjunction is well-defined, i.e. tht the conjunctive composition of two Logic LTSs stisfies the four conditions of Definition 1. For Definition 1(1) in prticulr, note tht p q T P Q does not stisfy ny of the four conditions for F P Q. We my now demonstrte why we hve treted non-escpble divergence s ctstrophic in our setting. This is becuse, otherwise, our conjunction opertor would not be ssocitive s demonstrted by the exmple depicted in Fig. 3. If the conjunction is computed from the left, the result is the first conjunct. Computed from the right, the result is the sme but with both processes being in F. Hence, in the first cse, the divergence hides the inconsistency. Since this is not relly plusible nd ssocitivity of conjunction is clerly desirble, we need some restriction for divergence; it turns out tht restricting divergence to escpble divergence, i.e. potentil stbiliztion, is sufficient for our purposes. Definition 3 (Disjunction Opertor). The disjunction of Logic LTSs P, P, T P, F P nd Q, Q, T Q, F Q stisfying (w.l.o.g.) P Q =, is the Logic LTS P Q, P Q, T P Q, F P Q defined by: P Q = df {p q p P, q Q} P Q P Q is determined by the following opertionl rules: lwys = p q τ P Q p lwys = p q τ P Q q p α P p = p α P Q p q α Q q = q α P Q q T P Q = T P T Q ; in prticulr, p q / T P Q lwys F P Q = F P F Q {p q p F P, q F Q }.

6 24 G. Lüttgen, W. Vogler / Theoreticl Computer Science 373 (2007) Fig. 4. Exmple processes. The definition of disjunction, which reflects internl choice, is quite strightforwrd nd well-defined. Only the definition of T P Q for p q is unusul, s one would expect to simply hve p q T whenever p or q is in T. However, then Cond. (2) of Definition 1 would be violted. Our lterntive definition respects this condition nd is semnticlly equivlent. In the sequel we leve out indices of reltions nd predictes whenever the context is cler Refinement preorder As the bsis for our semntic considertions we now define nive refinement preorder stting tht n inconsistent specifiction cnnot be implemented except by n inconsistent implementtion. Definition 4 (Nive Consistency Preorder). The nive consistency preorder F on processes is defined by p F q if p F = q F. One of the min objectives of this rticle is to identify the corresponding fully-bstrct preorder with respect to conjunction nd disjunction, which is contined in F. Our pproch follows the testing ide of De Nicol nd Hennessy [5], for which we define testing reltion s usul. Note tht process nd n observer need to be composed not simply synchronously but conjunctively. This is becuse we wnt the observer to be sensitive to inconsistencies, so tht p q if ech conjunctive observer tht sees n inconsistency in p lso sees one in q. Definition 5 (Consistency Testing Preorder). The consistency testing preorder on processes is defined s the conjunctive closure of the nive consistency preorder under ll processes (observers), i.e. p q if o. p o F q o. To chrcterize the fully-bstrct precongruence contined in F we will introduce redy-tree semntics which is vrint of vn Glbbeek s pth-bsed possible-worlds semntics [6], nd n ssocited preorder, the redy-tree preorder. This preorder is compositionl for conjunction nd disjunction nd chrcterizes Exmple As n illustrtion of our pproch, consider process spec in Fig. 4. For A = {, b, c}, spec specifies tht ction c cn only occur fter ction. In the light of the bove discussions, n implementtion of this intuition should offer initilly either just, or nd b, or just b, so tht spec is n internl choice between three sttes. Moreover, fter n ction, nothing more is specified; fter n ction b, the sme is required s initilly. While our specifiction of this simple behviour my look quite complex, we my imgine tht process spec is generted utomticlly from temporl-logic formul. Fig. 4 lso shows process impl which repets sequence bc, nd spec impl. It will turn out tht spec impl, s we will show in Section Redy-tree semntics A first guess for chieving compositionl semntics reflecting consistency testing is to use kind of redy-trce semntics [8]. Such semntics would refine trce semntics by checking the initil ction set of every stble stte long ech trce. However, this is not sufficient when deling with inconsistencies, since inconsistencies propgte bckwrds long trces s explined in Section 2. It turns out tht set of tree-like observtions is needed, which leds to denottionl-style semntics which we cll redy-tree semntics Observtion trees nd redy trees A tree-like observtion cn itself be seen s deterministic LTS with empty F-predicte, reflecting tht observers re internlly consistent.

7 G. Lüttgen, W. Vogler / Theoreticl Computer Science 373 (2007) Fig. 5. Some redy trees of spec. Definition 6 (Observtion Tree). An observtion tree is LTS V,, T, stisfying the following properties: (1) V, is non-empty tree whose root is referred to s v 0 (2) v V. v stble (3) v V, I(v) 1 v V. v v. We often denote such n observtion tree by its root v 0. Next we define the observtions of process p, clled redy trees. Note tht p cn only be observed t its stble sttes. Definition 7 (Redy Tree). An observtion tree v 0 is redy tree of p if there is lbelling h : V P stisfying the following conditions: (1) v V. h(v) stble nd h(v) / F (2) p = ε F h(v 0 ) (3) v V, A. v v implies () h(v ) = h(v) T or (b) h(v) = F h(v ) (4) v V. (v / T nd h(v) / T ) implies I(v) = I(h(v)). Intuitively, nodes v in redy tree represent stble sttes h(v) of p (cf. Cond. (1), first prt) nd trnsitions represent computtions contining exctly one observble ction (cf. Cond. (3)(b)). Since computtions do not contin flsesttes, no represented stte is in F (cf. Cond. (1), second prt). Since p might not be stble, the root v 0 of redy tree represents stble stte rechble from p by some internl computtion (cf. Cond. (2)). If the stte h(v) represented by node v is in T, the subtree of v is rbitrry since h(v) is considered to be completely underspecified (cf. Conds. (3)() nd (4)). In cse h(v) / T, one distinguishes two cses: (i) if v / T, then v nd h(v) must hve the sme initil ctions, i.e. the sme redy set; (ii) if v T, the observtion stops t this node nd nothing is required in Conds. (3) nd (4). In the following, we write RT(p) for the set of ll redy trees of p, frt(p) for the set of ll redy trees of p tht hve finite depth (finite-depth redy trees), nd crt(p) for the set of redy trees V,, T, where T = (complete redy trees). Note tht complete redy tree is clled complete s it never stops its tsk of observing; hence, complete redy trees re often infinite in prctise. Moreover, flse-sttes my be chrcterized s follows: Lemm 8. RT(p) = if nd only if p F. Proof. Direction = follows immeditely from Definition 7(2) nd the definition of = F. For Direction = we know by p / F nd Definition 1(4) of the existence of some p ε such tht p = F p τ. Hence, tt RT(p) by h(tt) = df p. We illustrte our concept of redy trees by returning to our exmple of Fig. 4. Some of the redy trees of process spec re shown in Fig. 5. In the first redy tree, the observtion stops fter the third b. In the second tree, we see tht we cn observe n rbitrry tree fter, since the respective stte of spec is in T. An rbitrry tree cn lso consist of just the root, s shown for the right-most in the third tree; this tree is lso complete. Process impl in Fig. 4 hs only one complete redy tree which is n infinite pth repeting sequence bc; this is lso redy tree of spec Redy-tree preorder nd expressiveness Our redy-tree semntics suggests the following refinement preorder: ε Definition 9 (Redy-Tree Preorder). The redy-tree preorder inclusion, i.e. p q if RT(q) RT(p). on processes is defined s reverse redy-tree

8 26 G. Lüttgen, W. Vogler / Theoreticl Computer Science 373 (2007) This preorder will turn out to be the desired fully-bstrct preorder contined in the nive consistency preorder. We first show tht could just s well be formulted on the bsis of complete redy trees nd, for finitely brnching LTS, of finite-depth redy trees. A crucil notion for our results is the following: Definition 10 (Redy-Tree Prefix). Redy tree v 0 is prefix of redy tree w 0, written v 0 w 0, if there exists n injective mpping ρ : V W such tht: (1) ρ(v 0 ) = w 0 (2) v v = ρ(v) ρ(v ) (3) ρ(v) w = v T or ( v. v v nd ρ(v ) = w ) (4) ρ(v) T = v T. Intuitively, one observtion is prefix of nother if it stops observing erlier. Recll tht true-node indictes tht observtion stops (cf. Cond. (3)). Intuitively, we obtin prefix of w 0 by cutting ll trnsitions from some nodes (nd dding the ltter to T ), while cutting just some trnsitions of node is not llowed. It is esy to see tht our definition of RT(p) is closed under prefix: Lemm 11. (v 0 w 0 nd w 0 RT(p)) implies v 0 RT(p). Proof. Let w 0 RT(p) due to h nd v 0 w 0 with injection ρ. We define h : V P such tht v h(ρ(v)) nd check tht v 0 is redy tree of p: (1) h (v) = h(ρ(v)) is stble nd not in F by Definition 7(1) for w 0. (2) p = ε F h(w 0 ) = h(ρ(v 0 )) = h (v 0 ) by Definition 7(2) for w 0. (3) v v = ρ(v) ρ(v ) = h(ρ(v )) = h(ρ(v)) T or h(ρ(v)) = F h(ρ(v )) = h (v ) = h (v) T or h (v) = F h (v ). (4) Assume v / T nd h (v) / T. Then, ρ(v) / T by Definition 10(4) s well s h(ρ(v)) / T by the definition of h. This implies I(ρ(v)) = I(h(ρ(v))) = I(h (v)). Furthermore, I(v) = I(ρ(v)) by Definitions 10(2) nd (3) nd since v / T. Hence, I(v) = I(h (v)). Note tht, since we do not wnt to distinguish isomorphic observtion trees, we my lwys ssume, without loss of generlity, tht the embedding ρ in Definition 10 is the identity, i.e. tht the node set V of the prefix is subset of W. Lemm 12. {v 0 w 0 crt(p). v 0 w 0 } = RT(p). Proof. Inclusion is n ppliction of Lemm 11; note tht crt(p) RT(p) by definition. For proving the reverse inclusion, let v 0 RT(p) due to h. We construct suitble w 0 such tht the respective injection is the identity, by successively extending the T -nodes of v 0. Let v 0 be the 0-extension of v 0. Given the k-extension of v 0 we construct the (k+1)-extension s follows: For ech v T with h(v) T, remove v from T. For ech v T with h(v) / T, nd every I(h(v)), choose some p with h(v) = F p / F nd p stble. Such p exists since h(v) / F (due to Definition 7(1)) implies, by the first fixed point condition of F for LTS (Definition 1(3)), the existence of p / F with h(v) p. Moreover, by the second fixed point condition of F for LTS (Definition 1(4)), p cn stbilise, i.e. there is stble p / F such tht p ε = F p. Now, choose fresh node v nd dd v v into the tree, with h(v ) = p nd v T. Remove v from T. Note tht the (k+1)-extension is indeed redy tree for p by construction. Finlly, let w 0 be the component-wise union of ll k-extensions with T set to the empty set. This yields complete redy tree, i.e. w 0 crt(p); note in prticulr tht our construction ensures tht h(v) / T = I(v) = I(h(v)). As consequence of Lemm 12 we obtin the following corollry: Corollry 13. (1) RT(p) is uniquely determined by crt(p), nd vice vers. (2) RT(p) RT(q) crt(p) crt(q) (3) frt(p) = {v 0 of finite depth w 0 crt(p). v 0 w 0 }. Before stting the next lemm we introduce the following definitions tht llow us to pproximte redy trees:

9 G. Lüttgen, W. Vogler / Theoreticl Computer Science 373 (2007) Definition 14 (k-redy Tree). A k-tree V,, T,, where k N 0, is n observtion tree where ll nodes hve depth t most k, nd T is the set of ll nodes of depth k. A k-redy tree of p is redy tree of p tht is lso k-tree. Moreover, k-rt(p) = df {v 0 RT(p) v 0 is k-tree }. Intuitively, k-trees represent observtions of k steps. Definition 15 (Limit). Let v be n infinite sequence (v k ) k N where v k k-rt(p) nd v k v k+1, with the identity s injection, for ll k N. Then, lim v is the component-wise union of ll v k with T set to empty; lim v is clled limit of p. Observe tht node of some v k in such sequence is not in the true-predicte of v k+1, whence nodes in T re successively pushed out. In the limit, we my thus set T to empty. Moreover, if v k = v k+1 = v k+2 = for some k, then the limit is v k ; this hppens exctly when v k is complete. We bse the notion of finite brnching on the wek trnsition reltion = α F. Definition 16 (Finite Brnching). Process p is finite brnching if, for ll p rechble from p, there re only finitely mny α, p with p ε α = F = F p. For finite-brnching processes p, crt(p) is chrcterized by the limits of p. Lemm 17. If p is finite brnching, crt(p) equls the set of ll limits of p. Proof. For proving inclusion, let w 0 crt(p); gin we refer to the tree s root s w 0, too, nd denote the tree s node set by W. We define sequence v = (v k ) k N s follows: v k consists of ll nodes of w 0 of depth t most k, nd the rcs between them. Moreover, T is the set of ll nodes t depth k. Hence, v k is k-tree, nd v k w 0 with the identity s injection. By Lemm 11, ech v k is in RT(p). Obviously, v k v k+1 for ll k N nd w 0 = lim( v). For proving inclusion, let v = (v k ) k N with w 0 lim( v). Hence, for ech v k we hve t lest one h k such tht v k RT(p) due to h k. To show w 0 crt(p) we hve to find lbelling g : W P so tht the definition of crt is stisfied. This h will be ssembled from the h k s by n ppliction of König s lemm. We construct grph with vertices v k, h such tht v k k-rt(p) due to h. Note gin tht there my be severl such h. The edges of our grph re given by v k, h v k+1, h if h = h V k. Since p is finite brnching we hve only finitely mny v k, h for ech k. Adding root vertex r tht is connected to ll v 0, h, we therefore obtin n infinite, finitely brnching tree. According to König s lemm, there exists n infinite pth v 0, h 0 v 1, h 1. We now set g = df k N h k. Tht g stisfies the conditions of the definition of crt(p) is obvious for Conds. (1) (3); for Cond. (4), observe tht ech node w of w 0 hs some depth k, hence it is in v k+1 nd not in T k+1, nd we cn use tht v k+1 stisfies Cond. (4). Note tht the premise p is finite brnching is only needed for direction in the bove lemm. We my now obtin the following corollry of Corollry 13(3) nd of Lemm 17, which is the key to proving compositionlity nd full bstrction of our redy-tree preorder in the next section. Corollry 18. (1) crt( p) crt(q) = frt( p) frt(q), lwys. (2) crt( p) crt(q) = frt( p) frt(q), if p is finite brnching. We conclude this section by pointing out tht ny process is redy-tree-equivlent to process tht is either inconsistent itself, or does not hve ny inconsistent stte. If one normlizes two processes by omitting inconsistent sttes nd then clcultes their conjunction, one obtins n equivlent process s first clculting the conjunction nd subsequently normlizing the result. This gives us first indiction tht the bove definition of conjunction is dequte. 4. Compositionlity nd full bstrction This section presents our full-bstrction result of the redy-tree preorder with respect to the consistency testing preorder, nd proves tht nd re indeed conjunction nd, respectively, disjunction for. We first show tht nd correspond to intersection nd union on the semntic level, respectively. While the correspondence for holds for redy trees in generl, the correspondence for only holds for complete redy trees.

10 28 G. Lüttgen, W. Vogler / Theoreticl Computer Science 373 (2007) Theorem 19 (Set-Theoretic Interprettion of nd ). (1) crt(p q) = crt(p) crt(q) (2) RT(p q) = RT(p) RT(q). Proof. We first estblish sttement (1) of Theorem 19. For proving direction, tke v 0 crt(p q) due to h. We define h (v) = df p if h(v) = p q for some q, for ll v V, nd check the conditions of the definition of crt: (1) Since p q is stble (not in F, resp.), lso p is stble (not in F, resp.) by our definition of (Definition 2). (2) p q = ε F p q implies p = ε F p. (3) Let v v. If h(v ) = h(v) = p q T, then h (v) = h (v ) = p T, by (Definition 2). If h(v) = p q = F p q = h(v ), then either h (v) = p = p = h (v ) T, or h (v) = p = F p = h (v ); note tht we cn void F-processes long p = F p since we cn do so long p q = F p q, nd tht h (v) = p is stble s noted in (1). (4) Let h (v) = p / T nd v / T (which is in fct lwys the cse in complete redy trees). Then, h(v) = p q / T by Definition 2. Hence, I(v) = I(h(v)) = I(p q ) by Definition 7(4). Reclling tht p nd q re stble nd tht p / T, the opertionl rules of Definition 2 show tht either q T nd I(p q ) = I(p ) = I(h (v)), or q / T nd I(p ) = I(q ) by Definition 2(2). Observe p q / F by Definition 7(1). Thus, gin, I(p q ) = I(p ) = I(h (v)). Note tht this direction of the theorem is lso vlid for RT in plce of crt. For proving direction, tke v 0 crt(p) crt(q) due to h 1 nd h 2, respectively. Define h(v) = df h 1 (v) h 2 (v). We check the four conditions of the definition of crt, strting with Cond. (4): Let v / T nd h(v) / T. Without loss of generlity, h 1 (v) / T ccording to our definition of (Definition 2). If h 2 (v) T, we hve I(h(v)) = I(h 1 (v)) = I(v) by Cond. (4) for h 1. If h 2 (v) / T, then I(v) = I(h 1 (v)) = I(h 2 (v)) by Cond. (4) for h 1 nd h 2 ; hence, I(v) = I(h(v)) ccording to the definition of p q. Conds. (1) (3), re proved together. Note tht, since h 1 (v) nd h 2 (v) re stble, we hve tht h(v) is stble, too. We will prove simultneously tht number of processes re not in F. To do so, we will collect number of processes in list F nd rgue tht the complement F meets the conditions for F in (Definition 2). Then we know tht the lest set F p q stisfying these conditions is contined in F, whence no process on our list is in F. We now simply show tht the processes on the list do not stisfy ny of the four conditions, using for the fixed point conditions (Definition 2(3) nd (4)) tht no process in F is in F. Our list F firstly contins ll processes p q, so tht p (q ε ) is process long the derivtion p = F h 1 (v 0 ) ε (q = F h 2 (v 0 )) ccording to Definition 7(2). Anlogously, we tret p on the subderivtion p ε = F h 1 (v ) contined in h 1 (v) = F h 1 (v ) nd q on the subderivtion q ε = F h 2 (v ) contined in h 2 (v) = F h 2 (v ) ccording to Definition 7(3), if both derivtions exist. Finlly, if h 1 (v) = F h 1 (v ) (h 2 (v) = F h 2 (v )) exists nd h 2 (v ) = h 2 (v) T (h 1 (v ) = h 1 (v) T ), we combine ech such p (q ) with h 2 (v) (h 1 (v)). We next show tht F is consistent with our constrints on F (Definition 2(1) (4)): (1) If p F or q F, then p q is not on the list, i.e. p q is in F. In other words, if p q is on the list, then p / F nd q / F such tht the first constrint on F is stisfied. (2) Assume p q is on the list, nd p / T nd q / T nd p q stble. The lst condition implies p h 1 (v) nd q h 2 (v) for some v. Since v / T by completeness of v 0, we get I(h 1 (v)) = I(v) = I(h 2 (v)) by Definition 7(4). (3) Assume p q is on the list F. If p q τ, then (without loss of generlity) p τ p for some p on the sme derivtion s p. Hence, p q τ p q which is lso on our list F. If p q τ, then p h 1 (v) nd q h 2 (v) for some v. Let I(h 1 (v) h 2 (v)) nd distinguish the following cses: h 1 (v) T, i.e., h 1 (v) tt : By Lemm 23, h 1 (v) h 2 (v) = h 2 (v). We must hve I(h 2 (v)), whence h 2 (v) / T. Since v / T by completeness of v 0, we hve I(v) = I(h 2 (v)) by Definition 7(4). Thus, v v for some v, nd h 2 (v) q ε = F h 2 (v ) by Definition 7(3). This implies h 1 (v) h 2 (v) h 1 (v) q which is on our list F.

11 G. Lüttgen, W. Vogler / Theoreticl Computer Science 373 (2007) Fig. 6. Necessity of considering complete redy trees for conjunction. h 2 (v) T, i.e., h 2 (v) tt : This cse is nlogous to the first one. h 1 (v) / T nd h 2 / T : We must hve I(h 1 (v)) nd I(h 2 (v)). As bove, v v for some v ; we conclude h 1 (v) h 2 (v) p q which is on our list F. (4) Suppose p q is on our list F. Then, either p q τ, or p q lies long the wy to h 1 (v ) h 2 (v τ ), using only processes on list F. This concludes the proof of Cond. (1). The vlidity of Cond. (2) is now immedite: by the bove, p q = F h 1 (v 0 ) h 2 (v 0 ) since p = ε F h 1 (v 0 ) nd q = ε F h 2 (v 0 ). To show the vlidity of Cond. (3), we consider v v nd distinguish four cses, s suggested by Definition 7(3). We only show one cse here s the others re eqully esy: if h 1 (v) p ε = F h 1 (v ) nd h 2 (v) q ε = F h 2 (v ), then h 1 (v) h 2 (v) p q ε = F h 1 (v ) h 2 (v ) using only processes not in F. This finishes the proof of sttement (1) of Theorem 19. The proof of sttement (2) of Theorem 19 is much esier. For inclusion, let v 0 RT(p) RT(q), whence (without loss of generlity) v 0 RT(p) due to h. Now, it is strightforwrd to check tht v 0 RT(p q) due to h. We only τ note tht Cond (2) of Definition 7 follows from p q p = ε F h(v 0 ), due to p / F by Lemm 8. For the reverse ε inclusion, let v 0 RT(p q) due to h. By Definition 7(2), p q = F h(v 0 ) nd (without loss of generlity) p q τ p = ε F h(v 0 ). Obviously, v 0 RT(p) by h. Note tht, by Definition 7(2), ll h(v) re rechble from h(v 0 ), whence h mps into P. Fig. 6 illustrtes tht Theorem 19(1) is invlid when considering ll redy trees insted of complete red trees. The two processes displyed on the left nd in the middle hve the redy tree displyed on the right in common. However, the conjunction of the two processes is flse nd hs no redy trees. Intuitively, the shown common redy tree formlizes n observtion tht finished too erly to encounter the inconsistency. Given Theorem 19, compositionlity of our conjunction nd disjunction opertors for is now n immedite consequence. Theorem 20 (Compositionlity). (1) p q = p r q r (2) p q = p r q r. Proof. The compositionlity of follows from the following impliction chin: RT( p) RT(q) = (by Corollry 13(2)) crt( p) crt(q) = crt( p) crt(r) crt(q) crt(r) = (by Theorem 19(1)) crt( p r) crt(q r) = (by Corollry 13(2)) RT( p r) RT(q r). The compositionlity of cn be proved nlogously by referring to Theorem 19(2) insted of Theorem 19(1). Theorem 19 lso llows us to prove tht nd relly behve s conjunction nd disjunction with respect to our refinement reltion. Theorem 21 ( is And & is Or). (1) p q r p r nd q r (2) r p q r p nd r q. Proof. Prt (1) follows from the following equivlences: RT( p q) RT(r) (by Corollry 13(2)) crt( p q) crt(r) (by Theorem 19(1)) crt( p) crt(q) crt(r) crt( p) crt(r) nd crt(q) crt(r) (by Corollry 13(2)) RT( p) RT(r) nd RT(q) RT(r). Agin, for Prt (2) we get similr but simpler proof by referring to Theorem 19(2) insted of Theorem 19(1). Prt (2) of the bove theorem lso implies property demnded by system designers [11]: if q 1 is n implementtion of p 1 nd q 2 is n implementtion of p 2, then the specifiction p 1 p 2 cn be implemented by either q 1 or q 2. To justify this within our frmework, we first formlize the premise s p 1 q 1 nd p 2 q 2. By compositionlity, ε

12 30 G. Lüttgen, W. Vogler / Theoreticl Computer Science 373 (2007) Theorem 20(2), we obtin p 1 p 2 q 1 q 2. But this implies the desired sttement p 1 p 2 q 1 nd p 1 p 2 q 2, by Theorem 21(2). In order to see tht redy trees re indeed fully-bstrct with respect to our nive consistency preorder, it now suffices to prove tht coincides with our consistency testing preorder. This mens tht is the dequte preorder in our setting of Logic LTSs with conjunction nd disjunction. Theorem 22 (Full Abstrction). =. For the proof of this theorem, the following technicl lemm will be convenient. Lemm 23. The LTSs of tt p nd p re isomorphic, written tt p = p. Proof. It is esy to check tht tt p p is n isomorphism. Note tht with tt p F iff p F, the fixed point conditions of F re stisfied. We my now prove Theorem 22. Proof. We first prove the esier direction. If p q then, for ll o, we hve p o q o by Theorem 20. If p o F, then RT(p o) = by Lemm 8. Hence, RT(q o) =, i.e., q o F by Lemm 8 gin. Thus, p q. For proving the reverse inclusion, let p q nd v 0 RT(q) due to h. Note tht v 0 is process itself. We show tht q v 0 / F. To do so, we use fixed point rgument similr to the one in the proof of Theorem 19. Here, our list firstly includes processes q v 0, with q ε on the derivtion q = F h(v 0 ) (cf. Definition 7(3)), s well s processes q v, with q long the derivtions q ε = F h(v ) tht emerge due to h(v) q ε = F h(v ) in Definition 7(3). Furthermore, we include ll processes h(v ) v on our list, whenever h(v ) = h(v) T in Definition 7(3). Finlly, we include ll q v such tht q / F, v T nd q is process in the sme LTS s q. We now check tht the complement of this list is fixed point, i.e. stisfies Conds. (1) (4) of Definition 2. Let q v be on our list: (1) According to the definition of observtion trees (Definition 6), v / F. Moreover, q / F by the definition of = F, or q T or immedite, depending on why q v hs been included in the list. (2) If q / T nd v / T nd q v τ, then q h(v ), s these re the only stble processes on our list. Hence, we my pply Definition 7(4) for v to obtin I(q ) = I(v ). (3) Let α I(q v ). If α = τ, then q τ q on the respective derivtion ccording to the definition of our list. Then, q v τ q v which is on our list s well. If α τ, then q is stble, whence q h(v ) gin or v T. We proceed by cse distinction: q T : Hence, v α v for some v nd v / T. Since q α = F, we re in the cse of Definition 7(3)(), i.e. h(v ) = h(v ) = q. Moreover, q v α q v which is on our list. v T : Hence, q α q for some q / F. Then, q v α q v which is on our list. q / T nd v / T : Hence, v α v for some v. Since h(v ) = q / T we know, by Definition 7(3), tht q α q ε = F h(v ). Thus, q v α q v which is on our list. (4) If q v is on the list due to q ε = F h(v ), then q v ε = F h(v ) v long processes tht re on our list, nd h(v ) v is stble since h(v ) is stble nd v is trivilly stble. If q v is on the list due to v T, then q cn stbilize. Thus, q v cn stbilize in n isomorphic wy using only processes on the list. Thus, we hve estblished q v 0 / F. This implies by p q tht p v 0 / F. To show v 0 RT(p), we will construct respective lbelling g ccording to depth. Since p v 0 / F, process p v 0 cn stbilize by Definition 1(4) with ε p v 0 = F p v 0 for some stble p with p = ε F p. We define g(v 0 ) = df p, so tht Cond. (2) of Definition 7 is stisfied, nd Cond. (1) of Definition 7 holds for v 0. Note tht g(v 0 ) v 0 p ε v 0 / F by the definition of = F. Assume tht g is defined up to depth k such tht Conds. (1), (3) nd (4) of Definition 7 hold for ll v with depth less thn k, nd tht Cond. (1) is stisfied for depth k s well. Moreover, ssume tht g(v) v / F whenever g(v) is defined. These ssumptions re our induction hypothesis, which we hve just checked for k = 0. For ech v t depth k we proceed s follows. If v T, then Conds. (3) nd (4) re vcuously true; since v hs no children t depth k + 1, we re done. Thus, let v / T nd distinguish the following cses: ε

13 G. Lüttgen, W. Vogler / Theoreticl Computer Science 373 (2007) g(v) T : For ll v with v v, define g(v ) = df g(v). Thus, Conds. (3) nd (4) re stisfied for v, nd g(v ) is stble nd not in F. Since g(v) T we hve, by consequence of Lemm 23, tht g(v) v nd v re isomorphic. As v v / F, this implies g(v ) v g(v) v / F. g(v) / T : We first show Cond. (4) whose premise is now true. As g(v) v / F, the fcts v / T, g(v) / T nd g(v) v stble imply I(v) = I(g(v)). Next, we show Cond. (3), i.e. how to extend g to ll v with v v such tht g(v) = F g(v ). Consider some v v. Since I(v) = I(g(v)) we know I(g(v) v) nd, since g(v) v / F, there is some p such tht g(v) v p v / F. But p v / F implies tht p v cn stbilize ccording to Definition 1(4), with some derivtion p v ε = F p v τ. In prticulr, p is stble nd not in F. In ddition, g(v) p ε = F p. Note tht ll processes long the derivtion p ε = F p re not in F since, otherwise, some process long p v ε = F p v would be in F. Finlly, we now define g(v ) = df p. When pplying this construction to ll v with v v, Cond. (3) is stisfied for v. Furthermore, Cond. (1) is stisfied for ll v, nd g(v ) v / F. Treting ll v t level k s bove, we extend g to depth k + 1 such tht the induction hypothesis now lso holds for k + 1. With this induction, we cn thus define g for ech v in the observtion tree. Hence, v 0 RT(p) due to g. The following proposition sttes the vlidity of severl boolen properties desired of conjunction nd disjunction opertors. Here, = denotes the kernel of our consistency testing preorder (redy-tree preorder). Proposition 24 (Properties of nd ). Commuttivity: p q = q p p q = q p Associtivity: (p q) r = p (q r) (p q) r = p (q r) Idempotence: p p = p p p = p Flse: p ff = ff p ff = p True: p tt = p p tt = tt Distributivity: p (q r) = (p q) (p r) p (q r) = (p q) (p r). Proof. All the bove properties re strightforwrd since ( ) on processes corresponds to ( ) on complete redy trees by Theorem 19, nd since complete redy trees nd redy trees induce the sme preorder by Corollry 13(2). Moreover, crt(ff) is the empty set of complete observtion trees, while crt(tt) is the set of ll complete observtion trees. We my lso obtin the expected results for relting nd to. Proposition 25 (Relting, to ). (1) p q = q p q (2) p q = p p q. Proof. Both of these sttements follow from Theorem 19 nd Corollry 13(2). We conclude this section by briefly returning to the illustrtive processes spec nd impl of Fig. 4. We hve lredy remrked tht the only complete redy tree of the ltter is lso one of the former. Hence, by Theorem 22, impl is indeed refinement of spec ccording to our redy-tree preorder. Considering the conjunction of these processes, lso shown in Fig. 4, it might be esier to see this using Proposition 25(1). 5. Compring redy-tree semntics to other semntics In the following, we compre redy-tree semntics to four other semntics, nmely possible-worlds semntics, redy-trce semntics, filures semntics nd redy simultion [6,8]. Since our tretment of divergence is different from the one of filures semntics, we restrict our discussion to τ-free processes in Sections 5.2 nd 5.3.

14 32 G. Lüttgen, W. Vogler / Theoreticl Computer Science 373 (2007) Possible-worlds semntics Fig. 7. Redy-tree semntics is strictly finer thn redy-trce semntics. Our redy-tree semntics is in essence the pth-bsed possible-worlds semntics of vn Glbbeek [6]. This semntics is inspired by the possible-worlds semntics tht ws introduced by Veglioni nd De Nicol in [7]. Their ide ws to consider specifiction tht offers choice between different behviours s stnding for set of models, where ech model represents one of the possible behviours specified [7]. However, their semntics hd severl technicl shortcomings which were pointed out nd ddressed by vn Glbbeek in his hndbook rticle [6]. Vn Glbbeek refers to Veglioni nd De Nicol s originl semntics s stte-bsed possible-worlds semntics nd hs coined the corrected version pth-bsed possible-worlds semntics. Despite the strong similrities, there re differences between vn Glbbeek s pth-bsed possible-worlds semntics nd our redy-tree semntics. First, vn Glbbeek s frmework does not consider τ-trnsitions nd thus does not ddress divergence. Second, our frmework of Logic LTS does not only include τ-trnsitions but lso true- nd flse-predicte. In redy trees, the true-predicte hs the effect of terminting observtion; this concept does not exist in possible-worlds semntics. Third, vn Glbbeek s semntics uses deterministic cyclic lbelled trnsition systems, in ddition to wht we cll redy trees. However, doing so hs no effect on the semntics expressive power. Note tht within our setting of τ-pure LTSs, the theory of redy-tree semntics is when putting the issue of divergence side lmost fully determined by the sub-theory of τ-free LTSs. The reson cn be expressed in process lgebr by sying tht the kernel of, which we cll redy-tree equivlence, stisfies the lw. τ.b i.p i =.b i.p i. i I i I This lw llows ny τ-pure process to be rewritten s redy-tree-equivlent process tht fetures no τ-moves t ll, except for the cse tht the process llows n initil τ-move. Even in tht cse one could get rid of τ-moves, lbeit t the price of hving multiple initil sttes for modelling initil non-determinism Redy-trce semntics A redy trce [12] of process is sequence of ctions tht it cn perform nd where, t the beginning of the trce, between ny two ctions nd t the end, the redy set of the process reched t the respective stge is inserted. Such redy trce cn be understood s prticulr type of redy tree tht consists only of single pth nd includes dditionl trnsitions representing the redy sets. These dditionl trnsitions ensure tht ech stte on the pth hs, for ech ction in its redy set, exctly one trnsition tht either belongs to the pth or ends in true-stte. For exmple, the first redy tree in Fig. 5 in Section 3 represents the redy trce {, b}b{b}b{, b}. Consequently, the redy trces of process cn be red off from its redy trees, nd redy-tree inclusion implies redy-trce inclusion. The reverse impliction does not hold s demonstrted by the two leftmost processes in Fig. 7. These possess the sme redy trces; however, the observtion tree on the right-hnd side is redy tree of the first, but not of the second process Filures semntics The filures semntics of process is the set of its refusl pirs. Such pir consists of trce followed by refusl set, i.e. set of ctions tht the process reched by the trce cnnot perform. Such refusl pir cn be red off from the respective redy trce by deleting ll its redy sets nd dding set of ctions hving n empty intersection with the lst redy set on the trce. Thus, redy-tree semntics is finer thn filures semntics.

15 G. Lüttgen, W. Vogler / Theoreticl Computer Science 373 (2007) Fig. 8. The redy-tree preorder is strictly corser thn redy simultion Redy simultion Intuitively, process q redy-simultes some process p if there exists simultion reltion from p to q such tht relted sttes hve identicl redy sets [9,13]. Definition 26 (Redy Simultion on Logic LTS). Let P, P, T P, F P nd Q, Q, T Q, F Q be two Logic LTS. A reltion R P Q is redy simultion reltion, if the following conditions hold, for ny p, q R nd A: (1) q T Q implies p T P ; (2) q τ q nd p / T implies p. p = ε F p nd p, q R; (3) q q nd p / T implies p. p = F p nd p, q R; (4) q stble nd p / T implies p stble nd I(p) = I(q). We sy tht p redy simultes q, in symbols p r q, if there exists redy simultion reltion R nd some p with p = ε F p such tht p, q R. Item (4) lso ensures tht p in Item (3) is stble, nd tht hence its wek trnsition is of the specil form we require in this pper. In the definition of p r q, p my perform wek trnsition first; this llows n unstble p to redy simulte stble q, nd it corresponds to the specil root-condition in Definition 7(2). It turns out tht redy simultion includes the redy-tree preorder. This is vluble result for pplictions of our refinement theory, s will become evident in Section 6.2. Theorem 27. r. This result hs been shown in [6] for τ-free lbelled trnsition systems nd cn be dpted to our frmework of Logic LTS. The key observtion is tht, when p r q nd trcing redy tree of p, redy simultion trnsltes this redy tree to the sme redy tree for q. Fig. 8 shows tht the redy-tree preorder is indeed strictly corser thn redy simultion. Both processes displyed hve the sme redy trees, ll of which re pths. However, the second process cnnot even simulte the first one. 6. Specifiction, design nd refinement n exmple As explined erlier, our motivtion for studying conjunction on processes is to provide bsis for combining opertionl nd logicl styles of specifiction. Moreover, ny such heterogeneous specifiction lnguge should be equipped with compositionl refinement preorder tht llows one to trde off opertionl contents for logicl contents. This section demonstrtes tht Logic LTS, together with the redy-tree preorder, provides the foundtion for relizing our vision. We first show how our setting, which so fr only incorportes logicl opertors, nmely conjunction nd disjunction, my be ugmented with prllel composition opertor. We then pply this extended frmework to non-trivil exmple which is concerned with the specifiction nd design of simple mode logic [14]. Mode logics re key components of modern digitl control systems, such s flight guidnce systems instlled in ircrft. We detil how our heterogeneous specifiction cn be refined step-by-step, first to n bstrct design nd then to detiled, fully opertionl design.