Process Algebra Having Inherent Choice: Revised Semantics for Concurrent Systems 1

Transcription

1 SOS 2007 Process Algebr Hving Inherent Choice: Revised Semntics for Concurrent Systems 1 Hrld Fecher 2 Deprtment of Computing Imperil College London, UK Heiko Schmidt 3 Institut für Informtik Christin-Albrechts-Universität Kiel, Germny Abstrct Process lgebrs re stndrd formlisms for compositionlly describing systems by the dependencies of their observble synchronous communiction. In concurrent systems, prllel composition introduces resolvble nondeterminism, i.e., nondeterminism tht will be resolved in lter design phses or by the operting system. Sometimes it is lso importnt to express inherent nondeterminism for equl (communiction) lbels. Here, we give opertionl nd xiomtic semntics to process lgebr hving prllel opertor interpreted s concurrent nd hving choice opertor interpreted s inherent, not only w.r.t. different, but lso w.r.t. equl next-step ctions. In order to hndle the different kinds of nondeterminism, the opertionl semntics uses µ-utomt s underlying semnticl model. Soundness nd completeness of our xiom system w.r.t. the opertionl semntics is shown. Keywords: nondeterminism, process lgebr, xiom system, expnsion theorem, µ-utomt 1 Introduction Process lgebrs, see [2] for n overview, re stndrd formlisms for compositionlly describing systems bsed, e.g., on synchronous communiction on n bstrct level by the dependencies of their observble communiction. They serve s domin for semnticl foundtions of progrmming or modeling lnguges nd re lso used s modeling lnguges [6]. Exmple 1.1 Suppose there re two processes running concurrently on single processor computer tht both hve the possibility to send print jobs to printer. 1 This work is in prt finncilly supported by the DFG project Refism (FE 942/1-1) 2 Emil: hfecher@doc.ic.c.uk 3 Emil: hsc@informtik.uni-kiel.de This pper is electroniclly published in Electronic Notes in Theoreticl Computer Science

2 Fecher, Schmidt request request cncel request sendphoto request request request sendphoto senddoc senddoc cncel request cncel senddoc M senddoc sendphoto request cncel request sendphoto senddoc senddoc senddoc cncel request sendphoto request cncel senddoc Mrs ref Fig. 1. The trnsition system c M corresponding to the semntics of (1) nd refinement c M rs ref of c M w.r.t. redy simultion Prior to sending the dt to the printer, ny process must gin exclusive ccess to the printer by synchronizing on n ction request. After tht, the print job cn be sent. In our exmple, the first process sends photo (sendphoto), wheres the second sends document (senddoc). Furthermore, the first process cn be disrupted by user vi ction cncel. This simplified concurrent system (in prllel environment) cn be modeled in process lgebr bsed on synchronous communiction by (1) (request.sendphoto + cncel) (request.senddoc) where the printer nd the user tht cn disrupt belong to the environment. Here, opertor denotes prllel composition,.b denotes ction prefix, nd + denotes the choice opertor. The semntics of (1) in terms of trnsition system is given by M of Figure 1. In the trnsition system of the bove exmple two kinds of choice cn be distinguished: (i) Externl choice represented by outgoing edges with different lbels. This choice occurs in implementtions nd remins undecided until in n execution the environment decides which of the possible ctions is performed. (ii) Internl (nondeterministic) choice represented by outgoing edges with the sme lbels. This nondeterminism is resolved by the scheduler 4 of the operting system, since the two processes run on single processor computer: The scheduler will decide which process my perform its request ction, i.e., synchronize to get exclusive ccess to the printer. This refinement, performed by dding the scheduler, is formlly mde precise by redy simultion [5], which essentilly llows the removl of multiple outgoing edges with the sme lbel, s long s one remins (see Figure 1). Nondeterminism tht will be removed in lter design phses or by the operting system is clled resolvble nondeterminism, wheres nondeterminism tht hs to remin in implementtions nd is decided independently for ech execution (e.g., by rndom), is clled inherent nondeterminism. Consequently, the nondeterminism introduced by bstrcting from schedulers in concurrent setting is resolvble. Note, however, tht in stndrd semntics bsed on bisimultion the bstrction from schedulers cn be regrded s inherent (since trnsition systems with bisimultion cnnot express resolvble nondeterminism). We consider this to be counterintuitive in most cses, becuse schedulers usully do not show rndom behviour tht is determined independently for ech execution. Brnching time logics, like the modl µ-clculus [17], re often used for describing properties of process lgebrs. Unfortuntely, they re not preserved under refinement bsed on redy simultion. Consider, e.g., the sttement tht there is n immedite request ction enbled such tht fterwrds no document cn be sent 4 In genertive rther thn rective setting, different outgoing lbels cn lso express internl choice nd thus be resolved by the scheduler. However, this pper only considers rective systems. 56

3 to the printer. This property is described by the µ-clculus formul (2) request ([senddoc] flse ). Property (2) holds in M of Figure 1, but not in its refinement ref of Figure 1. This illustrtes tht brnching times properties pplied to concurrent setting need to be interpreted w.r.t. sets of schedulers: φ requires the existence of scheduler such tht φ holds fter the execution of, nd [] φ sttes tht, independent of which scheduler is chosen, φ will hold fter the execution of. Consequently, property (2) hs to be understood s follows: There is scheduler for the next step such tht request is enbled nd its execution (which is deterministic if the scheduler is given) leds to stte where senddoc is for ny scheduler disbled. Since the refinement in Figure 1 specilizes schedulers, µ-clculus formul (2) is not preserved. In Exmple 1.1, we illustrted tht resolvble nondeterminism nturlly rises through prllel composition. In the following exmples we rgue tht lso inherent nondeterminism, i.e., internl choice tht remins in running implementtions, occurs in pplictions: Exmple 1.2 In the sitution of Exmple 1.1, ssume fulty chnnel between the first process nd the printer. Then it is possible tht signl request (e.g., encoded s 1) cn be turned into signl cncel (e.g., encoded s 0). This is reflected by the process lgebr term (3) M rs (request.sendphoto + request + cncel) (request.senddoc). We get inherent nondeterminism w.r.t. the sme lbel request, becuse in cse of fulty trnsmission it hs to be hndled s n ction cncel. The nondeterminism is inherent, becuse refinement cnnot decide on the existence of fult, this is decided for every execution. Exmple 1.3 In the sitution of Exmple 1.1, consider request to be n bstrct ction [25] for more refined lbels like requestlowres nd requesthighres, where the first estblishes ccess to the low resolution printing fetures of the printer, nd the second gins ccess to the high resolution fetures. Then, bsed on the printing cpbilities offered by the printer, the usul photo cn be sent (sendphoto) or low resolution lterntive (sendlowresphoto). This is reflected by the following process lgebr term hving inherent nondeterminism w.r.t. the sme lbel request: (4) (request.sendphoto + request.sendlowresphoto + cncel) (request.senddoc). Note tht in these scenrios we hve both inherent nondeterminism, introduced by the choice opertor of the first process, nd resolvble nondeterminism, introduced by the unknown scheduler of the prllel composition. In cse there is no resolvble nondeterminism, i.e., if we consider concrete systems only with inherent nondeterminism, trnsition systems together with bisimultion s underlying equivlence notion is n pproprite semnticl model. Here, bisimultion equivlence is speciliztion of redy simultion for concrete systems, i.e., redy simultion between concrete systems implies bisimilrity. The µ-clculus yields suitble logic, since it chrcterizes trnsition systems up to bisimultion. Nevertheless, trnsition systems re not n pproprite model whenever inherent nd resolvble nondeterminism occur in single setting, like in Exmples

4 nd 1.3. This is becuse choice for n underlying equivlence or preorder hs to be mde: Bisimultion interprets nondeterminism s inherent, redy simultion s resolvble. Furthermore, when using resolvble nondeterminism, we expect three-vlued stisfction interprettion over the µ-clculus, with the possibility tht formul is neither stisfied nor flsified. For exmple, we expect tht request (( senddoc true ) ( sendlowresphoto true )) holds in (4), since ll its implementtions do, but property (2) is unknown for (4), since there re implementtions tht stisfy the property nd there re implementtions tht do not. Contribution. We give n opertionl nd n xiomtic semntics to process lgebr hving prllel opertor interpreted in concurrent (rther thn distributed) setting nd choice opertor interpreted s inherent, not only w.r.t. different, but lso w.r.t. equl next-step ctions. In prticulr, we djust the semntics of [3], which hs n inherent s well s resolvble choice opertor, to our interprettion of prllel composition, since in their interprettion prllel composition yields inherent nondeterminism. In order to hndle the two kinds of nondeterminism dequtely, semnticl model with two kinds of trnsition reltions, s in [3] nd [14], is used, nmely µ-utomt [16] with their stndrd refinement notion nd their three-vlued stisfction reltion over the µ-clculus. The two trnsition reltions re defined using structurl opertionl semntics. One reltion corresponds to the execution of ctions, the other corresponds to the removing of the underspecifiction for the next ction execution, which is clled concretiztion. In order to develop n xiomtic semntics, the process lgebr is extended by further opertors, especilly by choice opertor corresponding to resolvble nondeterminism. From our xiom system, we derive n expnsion theorem, which expresses the prllel composition opertor in terms of choice opertors. Soundness nd completeness of this xiom system w.r.t. the opertionl semntics is shown. 2 Syntx In order not to distrct from the technicl problems nd their solutions, we only present simple process lgebr tht does not hve recursion, sequentil composition, nd prllel composition with synchroniztion mechnism. Our process lgebr consists of ction prefix, inherent nondeterminism, prllel composition, nd ction renming. Note tht (CSP-bsed) hiding opertor is specil cse of renming opertor, where the ction is renmed to the internl ction. Here, we follow the philosophy tht internl ctions re observble. In other words, we do not consider wek equivlence or wek refinement notions. Furthermore, we ssume tht nondeterminism obtined vi mixed choices is resolved inside the environment: For exmple, if the system provides ctions nd b nd the environment their corresponding counterprts, then the environment decides if or b is executed. 5 The renming/hiding opertor is lso of specil interest in our setting, since it introduces nondeterminism, too. For exmple, the process tht provides ction leding to B 1 nd tht provides ction b leding to B 2 does not contin nondeterminism, 5 Otherwise, the system hs to resolve this nondeterminism in which cse two communictions insted of one hve to be modeled: The environment sends its provided ctions nd the system nswers which ction it chooses. 58

5 but fter hiding nd b, i.e., renming nd b to the internl ction, nondeterminism occurs, since now n internl step either leds to B 1 or to B 2. Agin, the two interprettions of inherent or resolvble nondeterminism re possible for the renming opertor. But in our setting the nondeterminism obtined through hiding (nd therefore implicitly for renming) should be resolvble nondeterminism, which is rgued s follows: The system hs stimulus for ny hidden ction. These cn be considered to be provided by n dditionl component continuously providing hidden ctions. Then the scheduler of the prllel composition decides, which prllel component executes next. Consequently, hiding (nd therefore renming) yields resolvble nondeterminism with our interprettion of schedulers of prllel components, which ssumes tht schedulers do not behve rndomly. Before we formlly present our process lgebr, we introduce some nottions. Let Act denote the set of ll ctions, let S denote the crdinlity of set S, nd let P(S) denote its power set. Furthermore, denotes reltionl composition. For binry reltion ρ S I with subsets X S nd Y I we write X ρ for {i I x X : (x,i) ρ} nd ρ Y for {s S y Y : (s,y) ρ}. For ternry reltion S Act I we write s i for (s,,i), nd we write for the binry reltion {(s,i) s i}, thus {s} = {i I s i}. Furthermore, we write s, iff {s} =. PA, the set of ll bsis process lgebr terms, is generted by B ::= 0.B B + B B B B /b, where,b Act. Process 0 describes dedlocked process, i.e., no further ctions cn be executed. We sometimes omit symbol 0 by writing insted of.0. Process.B llows the execution of ction resulting in the process B. Inherent choice is described by B 1 +B 2, nd B 1 B 2 describes prllel composition. The prllel composition hs implicit resolvble nondeterminism, introduced by bstrction from scheduler fvoring one of the two sides. B /b describes the process where the execution of in B becomes the execution of b. All other ction execution, including ction b, remins unffected. Note tht this renming process lso introduces resolvble nondeterminism s described in the beginning of this section. 3 Opertionl Semntics 3.1 µ-utomt As underlying semnticl model we use µ-utomt [16] in the nottion of [9], except tht we omit firness constrints nd tht we do not consider propositions. Definition 3.1 [µ-utomt] A µ-utomton M w.r.t. Act is tuple (S, S,s i,, ) such tht (s )S is the set of OR-sttes, ( s ) S the set of BRANCH-sttes (disjoint from S), s i S its initil element, S S the OR-trnsition reltion, nd S Act S the BRANCH-trnsition reltion. The BRANCH-sttes do not contin underspecifiction for the next ction execution, wheres OR-sttes cn be underspecified in tht sense. This underspecifiction is resolved vi the OR-trnsition reltion (for this reson lso clled concretiztion reltion), which is mde precise by the stndrd refinement notion of 59

6 µ-utomt: Definition 3.2 [µ-refinement] A reltion R (S 1 S 2 ) ( S 1 S 2 ) is µ-refinement between two µ-utomt M 1 nd M 2 if (s i 1,si 2 ) R nd (s 1,s 2 ) R, s 1 ({s 1 } ) : s 2 ({s 2 } ) : ( s 1, s 2 ) R, ( s 1, s 2 ) R, Act,s 1 ({ s 1 } ) : s 2 ({ s 2 } ) : (s 1,s 2 ) R, nd ( s 1, s 2 ) R, Act,s 2 ({ s 2 } ) : s 1 ({ s 1 } ) : (s 1,s 2 ) R. M 1 µ-refines M 2 if there exists µ-refinement R between M 1 nd M 2. Lbeled trnsition systems re strightforwrdly embedded into µ-utomt by using OR-sttes hving exctly one outgoing trnsition. The restriction of µ- refinement onto these systems coincides with bisimultion. As commonly known, µ-refinement yields prtil order. Furthermore, µ-utomt come with threevlued stisfction reltion over the µ-clculus, which is preserved under refinement. 3.2 Opertionl semntics rules In order to define the opertionl semntics we use two different kinds of expressions: one where underspecifiction for the next step is llowed (PA, corresponding to the OR-sttes) nd one where it is not (PA con, corresponding to the BRANCHsttes), i.e., where the resolvble nondeterminism for the next execution is resolved. Then dditionlly to the step trnsition reltion (, corresponding to BRANCHtrnsition reltion) from PA con to PA, concretiztion reltion (, corresponding to the OR-trnsition reltion) from PA to PA con, which resolves the resolvble nondeterminism for the next execution, is used. Formlly, PA con denotes the set of ll process lgebr terms generted by P ::= [0] [. B] P + P P bb,a, e B P P /b,v, where,b Act, A Act, B, B PA, nd v {d,s}. The intuition of the opertors is similr to the one of the opertors given in Section 2, except tht here the scheduler of the prllel composition nd of the renming opertor is determined for the next step. First, we explin the intuition of prllel composition P 1 B1,A,B 2 P 2, t first neglecting B 1 nd B 2, which will be explined lter, nd using the nottion P 1 A P 2 insted. Here, A specifies scheduler, which is not necessry in stndrd semntics bsed on redy simultion, since there schedulers re dequtely hndled vi the redy simultion. However, the scheduler needs to be modeled if both resolvble nondeterminism nd inherent choice should pper in one setting. The scheduler informtion is interpreted s follows: The right side is fvored in P 1 A P 2 for ctions from A, wheres the left side is fvored for ctions from Act\A. This fvoring concerns only the next step, i.e., fter the execution of n ction, ny scheduling is llowed gin. This is even the cse if n ction in prllel to P 1 A P 2 is executed, e.g., if P 3 executes ction leding to B 3 in (P 1 A P 2 ) A P 3 the resulting process is, roughly speking, (P 1 P 2 ) B 3, where ll next step scheduling is removed. Note tht this pproch is more pproprite thn the pproch where the prtil scheduler is kept (in which cse (P 1 A P 2 ) B 3 would be the result), 60

7 0 [0].B [.B] B 1 P 1 B 2 P 2 B 1 + B 2 P 1 + P 2 B 1 P 1 B 2 P 2 A Act B P v {d,s} B 1 B 2 P 1 B1,A,B 2 P 2 B /b P /b,v P 1 B 1 [.B] B A P 2 P 1 B3,A,B 4 P 2 B 1 B 4 P 2 B4,Act\A,B 3 P 1 B 4 B 1 i {1,2} P i B P 1 + P 2 B c P B c / {,b} c P /b,v B /b P b B v = s P b P /b,v B /b P b B v = d P b P /b,v B /b Tble 1 Upper section: Resolving of the next-step-underspecifiction vi reltion PA PA con. Lower section: Action executions vi PA con Act PA. since the scheduler is globl nd therefore cn depend on ny pst execution. 6 Furthermore, ssocitivity of would be lost in the lterntive pproch, which is illustrted lter in Exmple 3.5. In order to model the undoing of the scheduler informtion efficiently, the prllel composition stores the originl processes of its components (here B 1 nd B 2 ) nd replces the non-executing component by its stored originl one, where no scheduler informtion is present. This will be clrified by the trnsition rules. The scheduler informtion of the next execution v is dded to the renming opertor: The execution of the ction corresponding to the source lbel of the renming, which becomes b, is fvored in B /b,s, wheres the execution of the ction corresponding to the destintion lbel b is fvored in B /b, d. Here, fvoring mens tht for B /b,d, process B my only execute (which will be renmed to b) if B cnnot execute b nd nlogously for B /b,s, where is fvored. Agin, this scheduling of the renming opertor only pplies for the next ction execution, i.e., fter the execution of ny ction, possibly different from b, the current fvoring is removed. The concretiztion reltion is given in the upper section of Tble 1, where the underspecifiction of the next step is resolved, nd the step trnsition reltion is presented in the lower section of Tble 1, where ctions re executed resulting in processes hving underspecifiction for the next step executions. We give some comments on : The resolution of next-step-underspecifiction hs to tke plce in every subprt tht cn potentilly mke the next execution, consequently resolution does not tke plce for B in.b. In the prllel composition, however, the nextstep-underspecifiction is resolved by choosing n rbitrry scheduler. The prllel composition opertor stores the originl processes such tht it cn efficiently undo 6 The pproch where the prtil scheduler is kept mkes only sense if ech prllel component hs its own scheduler nd there is n dditionl globl scheduler which decides which of the prllel components is fvored. 61

8 Fecher, Schmidt {[]+[.b] +.b,act, [], {[]+[.b] (+.b) +.b,{b}, [], []+[.b] +.b,{}, []} []+[.b] +.b,, []} (+.b) 0 b {([]+[.b]) +.b,a,0 [0] {[b] b,a, [] A P(Act)} b 0 A P(Act)} b 0 {[b] b,a,0 [0] A P(Act)} {[0] 0,A, [] A P(Act)} b 0 0 {[0] 0,A,0 [0] A P(Act)} Fig. 2. The opertionl semntics for ( +.b), where Act = {, b}. OR-sttes of the µ-utomton hve double-lined frmes, wheres BRANCH-sttes hve single-lined frmes. OR-trnsitions re drwn s double-line rrows, wheres BRANCH-trnsitions re drwn s lbeled single-line rrows. A stte described by set stnds for set of sttes, described by the elements of the set nd hving the sme incoming nd outgoing trnsitions s the stte lbeled with the set. the concretiztion. In the renming opertor, the next-step-underspecifiction is resolved by either fvoring the ction corresponding to the source lbel (s) or fvoring the ction corresponding to the destintion lbel (d) of the renming. We proceed with some comments on : The rules for [.B] nd P 1 +P 2 re stndrd. The left side of the prllel composition P 1 B3,A,B 4 P 2 cn execute if (i) the left side is fvored for by the scheduler ( / A) or (ii) the right side does not provide (P 2 ). Symmetric constrints hold for the execution of on the right side of P 1 B3,A,B 4 P 2. As lredy mentioned before, the next-step-underspecifiction resolution hs to be undone for the prllel component tht did not mke the execution. Therefore, process B 3, resp. B 4 replces the non-executed side. In P /b,v n ction c different from nd b cn be executed leding to B /b, whenever P cn execute c leding to B. This is stted in the first rule. Furthermore, P /b,v cn execute b, leding to process B /b, where B cn be obtined fter executing b in P, whenever v fvors the destintion lbel (v = d) or no ction is provided by P. Similrly, P /b,v cn execute b, leding to process B /b, where B cn be obtined fter executing in P, whenever v fvors the source lbel (v = s) or no ction b is provided by P. In ll these three cses, the scheduler is removed fter the execution. Note tht by definition, the trget processes of do not contin ny scheduling informtion. Definition 3.3 [Opertionl semntics] The opertionl semntics of process lgebr term B PA is the µ-utomton (PA,PA con,b,, ), where nd re given in Tble 1. We sy tht process lgebr term B from PA refines nother one B, written B B, if the opertionl semntics of B µ-refines the opertionl semntics of B. Furthermore, B is refinement equivlent to B, written B B, if B refines B nd B refines B. Exmple 3.4 The opertionl semntics for ( +.b) is illustrted in Figure 2. Exmple 3.5 We illustrte tht ssocitivity of the prllel composition does not hold, if the resolution of underspecifiction in the prllel composition rule of Tble 1 62

9 is not undone, i.e., if the originl process does not replce the current process in cse of non-execution. Under this ssumption, B1 =.b (.c) does not refine B 2 = (.b ).c: By definition B 1 [.b] Act ([] Act [.c]). Since ction c hs to be possible fterwrds, this process cn only be dequtely mtched by B 2 vi process tht is refinement equivlent to ([.b] {} []) {} [.c] or to ([.b] []) {} [.c]. Thus fter the execution of we would need tht.b ( c) refines ([.b] {} []) [c] or refines ([.b] []) [c]. Furthermore,.b ( c) cn be concretized such tht either b is possible fter the execution of or no b is possible fter the execution of. But only one of these concretiztions is possible in ([.b] {} []) [c] nd in ([.b] []) [c]. Hence, B1 does not refine B 2. Exmple 3.6 Process.(B 1 (.B 2 )) refines (.B 1 ) (.B 2 ), but not vice vers. This illustrtes tht refinement over PA does not yield n equivlence reltion. Theorem 3.7 Refinement is preserved under ll process lgebr opertors, i.e., if B 1 B 1 B 2 B 2 then.b 1.B 1 B 1 + B 2 B 1 + B 2 B 1 B 2 B 1 B 2 B 1 /b B 1 /b. Note tht the strightforwrd extension of to PA con is lso preserved under ll process lgebr opertors for PA con. 4 Axiomtic Semntics In this section, we present sound nd complete xiom system for the refinement over PA. 4.1 Process lgebr extension In order to define the xioms, further terms re introduced: The most interesting one is the resolvble nondeterminism opertor, which is lso of interest for modeling by itself. The intuition of resolvble nondeterminism B 1 B 2 is tht either B 1 or B 2 is implemented, but not both. Thus, B 1 + B 2 is in generl not n llowed implementtion. Further dded terms re: (i) A next step restriction process B \, where B my not execute ction s its next step. Note tht ction my be executed if n ction different from is executed before. (ii) A conditionl prefix term c.b 1 > B 2, which is equivlent to c.b 1 whenever B 2 cnnot execute ction in its next step nd it is equivlent to 0 if B 2 cn execute ction in its next step. (iii) A prllel composition B 1 B3,A,B 4 B 2 where the scheduler informtion for the next execution nd the replcing processes for non-execution re lredy given. (iv) A renming opertor B /b, v, where the scheduler informtion for the next execution is lredy present. Also some counterprts of these new expressions re dded to the process lgebr terms where the next-step-underspecifiction is resolved. Formlly, we define PA to be the set of ll process lgebr terms generted by B ::= 0.B B + B B B B /b B B B \ c.b > B B B,A,B B B /b, v nd we define PA con to be the set of ll process lgebr terms generted by 63

10 B P B \ P \ i {1,2} B i P B 1 B 2 P Fecher, Schmidt B 1 P 1 B 2 P 2 B 1 B3,A,B 4 B 2 P 1 B3,A,B 4 P 2 B 2 P 2 c.b 1 > B 2 c.b 1 > P 2 P 2 P B b c c.b 1 > P 2 B 1 P \ b B Tble 2 Additionl trnsition rules for the extended process lgebr. B P B /b,v P /b,v P ::= [0] [. B] P + P P bb,a, e B P P /b,v P \ c. B > P where,b,c Act, A Act, B, B PA nd v {d,s}. The previous trnsition rules (Tble 1) re extended by those from Tble 2. We give some comments on : the resolvble nondeterminism is resolved by choosing either the right or the left side nd resolving this term. In B 1 B3,A,B 4 B 2 only B 1 nd B 2 hve to be resolved, since no next step nlysis tkes plce in term B 3 nd B 4. By the sme rgument, only B 2 hs to be resolved in c.b 1 > B 2. Now some comments on : In c.b 1 > P 2 c-step to B 1 is possible iff the right hnd side cnnot execute. In P \ b ll executions of P tht differ from b cn tke plce s next step, in which cse \b is removed, since this restriction only holds for the next step execution. Remrk 4.1 For terms of PA, fter every -step the sme set of provided ctions is obtined. This does not hold for terms of PA, s, e.g., illustrted by 0. The opertionl semntics of terms in PA nd refinement (equivlence) over PA re defined s in Definition 3.3 except tht the extended concretiztion nd step trnsition reltions re used. 4.2 Equtions Before we present the xiom system, we discuss some of the (stndrd) xioms tht do not hold in generl, i.e., where refinement equivlence cnnot be gurnteed, which is denoted by : B+B B, since the left hnd side llows more kinds of resolution of underspecifiction. For exmple, ( b) + ( b) cn be resolved to [] + [b], which provides s well s b. On the other hnd, b cnnot be resolved such tht both ctions re provided. By similr rguments, (5) (B 1 B 2 ) + (B 1 B 3 ) B 1 (B 2 + B 3 ), since the underspecifiction in B 1 cn possibly be resolved in two different wys such tht it cnnot be mtched by single resolution of B 1. More precisely, fter, it is possible tht the left hnd side of (5) cn provide more ctions thn the right hnd side. In cse B 1 is next-step-underspecifiction-free, e.g., if B 1 is of form i I i.b i for some I, i, nd B i, we do not hve this problem. Predicte nuf on PA, which is formlly defined in Tble 3, collects those next step underspecifiction free processes. Resolution of next-step-underspecifiction yields unique term if nuf holds: 64

11 nuf(0) nuf(.b 1 ) nuf(b 2 ) nuf(c.b 1 > B 2 ) nuf(b 1 ) nuf(b 2 ) nuf(b 1 + B 2 ) nuf(b 1 ) nuf(b 2 ) nuf(b 1 B3,A,B 4 B 2 ) nuf(b) nuf(b \ ) nuf(b) nuf(b /b, v ) Tble 3 Definition of predicte nuf. Lemm 4.2 Suppose B PA nd Act. If nuf(b), then B hs unique trget w.r.t., i.e., nuf(b) {B} = 1. Nevertheless, the processes of (5) re not equivlent even if nuf(b 1 ) holds, since the resolvble nondeterminism of the prllel composition cn be resolved in different wys. For exmple, fter pplying on (.b) (.c + 0) there is exctly one trnsition t lbeled with nd either b or c is possible fterwrds. On the other hnd step from ((.b) (.c)) + ((.b) 0) exists where two trnsitions t 1, t 2 lbeled with re possible such tht b is possible fter t 1 nd c is possible fter t 2. We remedy this problem by resolving the resolvble nondeterminism of the prllel opertor before the prllel composition is expnded. This motivtes why we introduced the term B 1 B3,A,B 4 B 2 lredy in PA. In Tble 4 xioms for the refinement reltion over PA re presented, where we ssume for simplicity tht Act is finite. Theorem 4.3 The xioms from Tble 4 re sound nd complete, i.e., B 1,B 2 PA : B 1 B 2 B 1 B 2. Exmple 4.4 By using Axiom A32, we get.(b c) (.(b c)) (.b). Furthermore, by using Axiom A32 nd then Axiom A3 we get (.(b c)) (.b) (.(b c)) (.(b c)).(b c). Thus we hve shown tht.(b c) (.(b c)) (.b). Note tht this cnnot be shown by using only Axioms A1 A31, since the necessry removl of becomes impossible. This illustrtes tht Axiom A32 is lso essentil for the completeness of our Axiom system w.r.t.. How the prllel composition cn be expressed in terms of nondeterminism, known s the expnsion theorem [23,4], is one of the most importnt rules. In our setting the expnsion theorem is more complicted thn usully, since resolvble s well s inherent nondeterminism hs to be hndled. It is directly derived from our xiom system nd illustrted in the following, where 1 j=0 B j yields 0: Theorem 4.5 (Expnsion theorem) B B n n ( where A Act i=0 i =0 B = n i=0 ) i,j.(b i,j B ) + i,j.(b B i,j ) j J (A,i,i ) j J (A,i,i ) m(i) 1 j=0 i,j.b i,j, B = n m (i) 1 i=0 j=0 i,j.b i,j, J (A,i,i ) = {j < m (i) i,j A j < m (i ) : i,j i,j }, J (A,i,i ) = {j < m (i ) i,j / A j < m (i) : i,j i,j }. Here, (i) the scheduler (A Act) is determined by resolution of resolvble nondeterminism, (ii) ny combintion of resolutions of both sides is considered, 65

12 (A1) B 1 B 2 B 2 B 1 (A2) B 1 (B 2 B 3 ) (B 1 B 2 ) B 3 (A3) B B B (A4) B 1 + B 2 B 2 + B 1 (A5) B 1 + (B 2 + B 3 ) (B 1 + B 2 ) + B 3 (A6).B +.B.B (A7) B + 0 B (A8) B 1 + (B 2 B 3 ) (B 1 + B 2 ) (B 1 + B 3 ) (A9) B 1 B 2 A Act (B 1 B1,A,B 2 B 2 ) (A10) B 1 B4,A,B 5 B 2 B 2 B5,Act\A,B 4 B 1 (A11) B 1 B4,A,B 5 (B 2 B 3 ) (B 1 B4,A,B 5 B 2 ) (B 1 B4,A,B 5 B 3 ) (A12) B 1 B4,A,B 5 (B 2 +.B 3 ) ((B 1 \ ) B4,A,B 5 B 2 ) +.(B 4 B 3 ) if A (A13) B 1 B4,A,B 5 (B 2 +.B 3 ) (B 1 B4,A,B 5 B 2 ) + (.(B 4 B 3 ) > B 1 ) if / A nuf(b 1 ) (A14) 0 B4,A,B (A15) B /b B /b, d B /b, s (A16) (B 1 B 2 ) /b,v B 1 /b,v B 2 /b,v (A17) (B 1 + c.b 2 ) /b,v B 1 /b,v + c.(b 2 /b ) if c / {,b} (A18) (B 1 +.B 2 ) /b,d B 1 /b,d + (b.(b 2 /b ) > b B 1 ) if nuf(b 1 ) (A19) (B 1 + b.b 2 ) /b,d (B 1 \ ) /b,d + b.(b 2 /b ) (A20) (B 1 +.B 2 ) /b,s (B 1 \ b) /b,s + b.(b 2 /b ) (A21) (B 1 + b.b 2 ) /b,s B 1 /b,s + (b.(b 2 /b ) > B 1 ) if nuf(b 1 ) (A22) 0 /b,v 0 (A23) (B 1 B 2 ) \ (B 1 \ ) (B 2 \ ) (A24) (B 1 + B 2 ) \ (B 1 \ ) + (B 2 \ ) (A25) 0 \ 0 (A26) (.B) \ 0 (A27) (b.b) \ b.b if b (A28) c.b 1 > (B 2 B 3 ) (c.b 1 > B 2 ) (c.b 1 > B 3 ) (A29) c.b 1 > (B 2 +.B 3 ) 0 (A30) c.b 1 > (B 2 + b.b 3 ) c.b 1 > B 2 if b (A31) c.b > 0 c.b (A32) B 1 B 1 B 2 Tble 4 Axioms for, where =. Here, L i {j} B i is defined to be B j nd for I finite, L i I B i is defined to be B i ( L i I\{i } B i) where i I (by the ssocitivity nd commuttivity of the definition is independent of the chosen i ). Note tht we ssume tht Act is finite. Otherwise, more complex formuls hve to be used in order to remin in f PA. 66

13 nd (iii) the complete inherent nondeterminism of component for is tken if this component is fvored by the scheduler or if the current resolution of the other component cnnot provide. 5 Relted Work An overview on lgebric pproches to nondeterminism is given in [27]. Nondeterminism is often interpreted s ngelic (chosen positively w.r.t. to desired property) or demonic (chosen by n dversry). In [22], both nondeterminism interprettions re modeled in single setting. The ngelic/demonic view is orthogonl to our view, leding to the following four interprettions: (i) The tsk of resolving resolvble, ngelic nondeterminism is stisfibility check, i.e., n bstrction hs n implementtion stisfying the desired property if there is n ngelic resolution. (ii) On the other hnd, the tsk of resolving resolvble, demonic nondeterminism is stisfction check on the bstrct level: the property holds if demonic resolution stisfies it. (iii) Inherent, ngelic nondeterminism ensures the existence of step such tht the desired property holds, wheres (iv) inherent, demonic nondeterminism ensures tht ll possible next steps stisfy the property. In lternting-time temporl logic [1], interprettions (iii) nd (iv) re generlized to multiple ctors. In [3], both our choice opertors (inherent nd resolvble) re used in process lgebr nd n opertionl semntics in terms of µ-utomt s well s n xiomtic semntics is given. The difference to our work consists in the semntics of the prllel opertor, since the semntics of the prllel opertor in [3] is bsed on inherent insted of resolvble scheduling choice, i.e., schedulers behve rndomly lso t the concrete level, which is in most pplictions, like schedulers in operting systems, not the cse. If the scheduler cn prefer different prllel components per ction, we cnnot pply the usul pproch to split the prllel composition by using the left merge opertor, s it is lso mde in [3]. Therefore our xiom system becomes more complicted by using dditionl opertors nd by using predicte nuf. A further choice opertor is presented in [3]. The interprettion of this choice opertor is similr to our resolvble choice opertor, except tht the resolving cn be moved outwrds, e.g.,.(b c) is equivlent to.b.c, which is not the cse for. The choice opertor hs the sme expressiveness s w.r.t. the describble sets of concrete systems, i.e., replcing by, or vice vers, does not chnge the set of concrete systems tht refine the corresponding expressions. A difference rises in the refinement reltion between different bstrct levels, i.e., the refinement reltion between non-concrete systems is different. In [26] process lgebr hving our resolvble choice opertor together with choice opertor tht is only resolvble w.r.t. the sme ction, which hrmonizes with redy simultion, is presented. Thus full inherent nondeterminism is not hndled there. The semntics is given s possible worlds, i.e., sets of concrete systems. No prllel opertor is considered t ll. This process lgebr is extended by recursion in [21], but still no prllel composition is considered. Different kinds of choice opertors re considered in hybrid systems, see, e.g., [7], but those choice opertors concentrte on underspecifiction (i.e., resolvble nondeterminism) resulting from time spects. 67

14 Other bstrct models tht cn express inherent s well s resolvble nondeterminism re, e.g., (disjunctive) modl trnsition systems [18,19], hypermixed Kripke structures [11], generlized Kripke modl trnsition systems [24], modl utomt [9] nd ν-utomt [12]. These models re often used s bstrct models for trnsition systems in order to improve verifiction of full brnching time properties, s in [13,10]. In some settings the scheduler cn be restricted by further constrints, like priority or firness ssumptions. They cn be interpreted s refinement of n bstrct level where no constrint on the scheduler is enforced. This llownce to describe more detiled scheduler is orthogonl to the problem of hndling the interction of inherent nondeterminism with the resolvble nondeterminism of n underspecified scheduler. In probbilistic process lgebrs, see [20] for n overview, choice opertors re extended with distribution determining the wy the different sides re fvored. Rndomized choice opertors re specil kinds of inherent nondeterminism. Nevertheless, it is importnt to exmine inherent choice opertors, which do not contin distribution, for their own, since sometimes the distribution is not known nd sometimes it does not exist t ll (cf. Exmples 1.2 nd 1.3). Note tht pproches trying to embed pure inherent nondeterminism into probbilistic settings led to unnecessrily complex models nd thus unnecessrily increse the cost of verifiction. 6 Conclusion We hve presented the structurl opertionl semntics of process lgebr tht hndles choice opertors corresponding to inherent nondeterminism s well s resolvble nondeterminism obtined by bstrction from the scheduling of the prllel composition or the renming/hiding opertor. In prticulr, µ-utomt, which hve two kinds of trnsition reltions (one for ction execution nd one for resolution of resolvble nondeterminism), re used s underlying model for the structurl opertionl semntics. In order to void ny restriction on schedulers, the resolution of the resolvble nondeterminism hs to be mde undone if it ws not ffected by the previous execution step. A sound nd complete xiom system hs been presented, where in prticulr choice opertor representing resolvble nondeterminism is used. Note tht the incresed complexity of our semntics, compred to the stndrd semntics, is unvoidble if µ-clculus formuls should be preserved under refinement. Our opertionl semntics cn be strightforwrdly dpted to process lgebr hving prllel composition with CSP-bsed synchroniztion [15], sequentil composition, or recursion. The only problem rises for ungurded recursion, i.e., if there exists vrible tht is bound without being behind n ction prefix: There the definition of the concretiztion reltion yields problems, since infinite derivtion trees cn be generted. This is not very criticl, becuse usully process lgebrs without ungurded recursion re sufficient for pplictions. 68

15 References [1] R. Alur, T. A. Henzinger, nd O. Kupfermn. Alternting-time temporl logic. J. ACM, 49(5): , [2] J. C. M. Beten. A brief history of process lgebr. Theor. Comput. Sci., 335(2-3): , [3] J. C. M. Beten nd J. A. Bergstr. Process lgebr with prtil choice. In B. Jonsson nd J. Prrow, editors, CONCUR, volume 836 of LNCS, pges Springer, [4] J. A. Bergstr nd J. W. Klop. Algebr of communicting processes with bstrction. Theor. Comput. Sci., 37:77 121, [5] B. Bloom, S. Istril, nd A. Meyer. Bisimultion cn t be trced. J. ACM, 42(1): , [6] T. Bolognesi nd E. Brinksm. Introduction to the ISO specifiction lnguge LOTOS. Computer Networks nd ISDN Systems, 14:25 59, [7] S. Bornot nd J. Sifkis. On the composition of hybrid systems. In T. A. Henzinger nd S. Sstry, editors, HSCC, volume 1386 of LNCS, pges Springer, [8] R. Cousot, editor. Verifiction, Model Checking, nd Abstrct Interprettion, 6th Interntionl Conference, VMCAI 2005, Pris, Frnce, Jnury 17-19, 2005, Proceedings, volume 3385 of LNCS. Springer, [9] D. Dms nd K. S. Nmjoshi. Automt s bstrctions. In Cousot [8], pges [10] L. de Alfro, P. Godefroid, nd R. Jgdeesn. Three-vlued bstrctions of gmes: Uncertinty, but with precision. In LICS, pges IEEE Computer Society Press, [11] H. Fecher nd M. Huth. Rnked predicte bstrction for brnching time: Complete, incrementl, nd precise. In S. Grf nd W. Zhng, editors, ATVA, volume 4218 of LNCS, pges Springer, [12] H. Fecher, H. Schmidt, nd J. Schönborn. Refinement sensitive forml semntics of stte mchines hving inherent nondeterminism. In MODELS, Avilble t submitted for publiction. [13] O. Grumberg, M. Lnge, M. Leucker, nd S. Shohm. Don t know in the µ-clculus. In Cousot [8], pges [14] H. Hnsson nd B. Jonsson. A clculus for communicting systems with time nd probbilities. In Proc. 11th IEEE Rel-Time Systems Symposium (RTSS), Orlndo, Fl., Jnury [15] C. A. R. Hore. Communicting Sequentil Processes. Prentice Hll, [16] D. Jnin nd I. Wlukiewicz. Automt for the modl mu-clculus nd relted results. In J. Wiedermnn nd P. Hájek, editors, Mthemticl Foundtions of Computer Science, volume 969 of LNCS, pges Springer, [17] D. Kozen. Results on the propositionl µ-clculus. Theor. Comput. Sci., 27: , [18] K. G. Lrsen nd B. Thomsen. A modl process logic. In LICS, pges IEEE Computer Society Press, [19] K. G. Lrsen nd L. Xinxin. Eqution solving using modl trnsition systems. In LICS, pges IEEE Computer Society Press, [20] N. López nd M. Núñez. An overview of probbilistic process lgebrs nd their equivlences. In C. Bier, B. R. Hverkort, H. Hermnns, J.-P. Ktoen, nd M. Siegle, editors, Vlidtion of Stochstic Systems, volume 2925 of LNCS, pges Springer, [21] M. E. Mjster-Cederbum. Underspecifiction for simple process lgebr of recursive processes. Theor. Comput. Sci., 266: , [22] C. E. Mrtin, S. A. Curtis, nd I. Rewitzky. Modelling nondeterminism. In D. Kozen nd C. Shnklnd, editors, MPC, volume 3125 of LNCS, pges Springer, [23] R. Milner. A Clculus for Communicting Systems, volume 92 of LNCS. Springer-Verlg, [24] S. Shohm nd O. Grumberg. 3-vlued bstrction: More precision t less cost. In LICS, pges IEEE Computer Society Press, [25] B. Thomsen. An extended bisimultion induced by preorder on ctions. Mster s thesis, Alborg University Centre, [26] S. Veglioni nd R. De Nicol. Possible worlds for process lgebrs. In D. Sngiorgi nd R. de Simone, editors, CONCUR, volume 1466 of LNCS, pges Springer, [27] M. Wlicki nd S. Meldl. Algebric pproches to nondeterminism: An overview. ACM Comput. Surv., 29(1):30 81,