ONE of the key ideas in system engineering

EDIC RESEARCH PROPOSAL 1 Expressiveness and Composability of Glue Operators in BIP Eduard Baranov RISD, I&C, EPFL Abstract We study communication in componentbased design, where basic components are glued together in order to obtain a complex system. Focusing on different aspects of the communication has led to development of different frameworks. Comparison between them became a hard problem. In this paper we present different approaches to modelling communication between components and describe interconnections between them. We discuss, how the expressive power of glue can be measured. Finally, we propose to define a consolidated glue and to research expressive power of different models. Index Terms BIP, component-based design, connectors, expressiveness. I. INTRODUCTION ONE of the key ideas in system engineering is to build complex systems by assembling Proposal submitted to committee: June 14th, 2013; Candidacy exam date: June 21th, 2013; Candidacy exam committee: Prof. Jean-Yves Le Boudec, Prof. Joseph Sifakis, Dr. Simon Bliudze, Prof. Rachid Guerraoui. This research plan has been approved: Date: Doctoral candidate: (E. Baranov) (signature) Thesis director: (J. Sifakis) (signature) Thesis co-director: (S. Bliudze) (signature) Doct. prog. director: (B. Falsafi) (signature) EDIC-ru/05.05.2013 components. Simple components are gluing together in order to obtain larger components, where gluing can be considered as a generalized composition operation on sets of components. Component-based design relies on separation between coordination and computation. Componentbased systems are built from computational entities, called components. Components can communicate through their interfaces, called communication ports. The coordination entities are called connectors. Each connector imposes constraints in order to restrict allowed interactions between components. Component-based design has many advantages, such as reusability, proving properties by construction or by decomposition, etc. The term connector is widely used in the components framework literature with different interpretations. In Reo [1] connectors are complex entities, which regulate the data-flow between components. Some connectors in Reo require simultaneous presence of data on both ends, so they can also impose synchronization constraints. Stateless connectors [5] and Petri Calculus [8] can be considered as circuits connecting a set of inputs to a set of outputs and can model synchronization, mutual exclusion, etc. Our approach considers connectors as relations between ports. Labelled transition systems are used for modelling components in BIP. The coordination layer in BIP consists of two parts: interaction and priority models. The interaction model defines atom collaboration, whereas the priority model defines conflict resolution strategy. Comparison between different approaches is difficult, as there is a lack of adequate notions of expressiveness. Even studying two BIP semantics, the classical one and the variation introduced in [4], leads to problems. By definition of expressiveness from [3] these two semantics are non-comparable, which is not a desirable answer. For a systematic comparison of component frameworks to be possible, one needs sufficient abstract formalisations for glue and expressiveness.

EDIC RESEARCH PROPOSAL 2 This paper is organized as follows. Section II provides a basic presentation of BIP. In Section III the Algebra of Connectors is presented. Section IV describes different approaches to modelling connectors and provides a small comparison. Section V shows the view on BIP connectors expressiveness. In Section VI the variation of BIP semantics and another approach to glue comparison are presented. Finally, in Section VII new directions of research are proposed. II. BIP COMPONENT FRAMEWORK BIP is a component-based framework consisting of three layers: Behaviour, Interaction and Priority. Behaviour consists of a set of atomic components represented as labelled transition systems. The second layer specifies interactions between components, while the last one models control policies, allowing selection between interactions. Definition II.1. A labelled transition system (LTS) is a triple B = (Q, P, ), where Q is a set of states, P is a set of communication ports and Q 2 P Q is a set of labelled transitions. For q, q Q and a 2 P, we write q a q iff (q, a, q ). A label a 2 P is active in a state q Q (denoted q ), a iff there exists q Q such that q a q a. We abbreviate q def = (q ). a It is assumed that, for all q Q, q q. We write pq for the set of ports {p, q}. Definition II.2. For a set of ports P an interaction a P is a non-empty subset of ports. In BIP systems are obtained by the composition of components, where glue restricts the possible communication between them. Glue is defined through interaction and priority models. Definition II.3. For a set of behaviours {B i = (Q i, P i, ) i [1, n]}, an interaction model is a set of interactions γ 2 P, where P = n P i (all P i are assumed to be disjoint). The component B = γ(b 1,..., B n ) is defined by the behaviour (Q, P, γ ), with Q = n Q i and the transition relation γ inductively defined by the set of rules (1). Definition II.4. Given a system γ(b 1,..., B n ), a priority model π is a strict partial order on γ. For a, a γ, we write a a iff (a, a ) π, meaning that interaction a has less priority than a. For component B = (Q, P, ) and a priority model π, the LTS π(b) = (Q, P, π ) is defined by the rule (2) a q q a : (a a q ) a a (2) q π q The BIP glue is a composition of an interaction model, which compose several behaviours into a single one, and a priority model. Composite component can be used as a behaviour for another glue, i.e. glues can be applied hierarchically. III. ALGEBRA OF CONNECTORS - STRUCTURING INTERACTION IN BIP In this section [2] is discussed, which provides an algebraic formalism of connectors in BIP. Connectors on a set of ports P are modelled in terms of algebra AC(P ), and the semantics of AC(P ) associates connectors with a set of interactions. The following model will be using as an example, which will illustrate connectors in terms of algebra of connectors. Example III.1. Assume we have 4 atomic components, a sender S and three receivers R i. A sender can send a message through port s, and receivers have ports p i for getting messages. The following table specifies 4 different coordination strategies: Name Set of interactions Rendezvous {sr 1 r 2 r 3 } Broadcast {s, sr 1, sr 2, sr 3, sr 1 r 2, sr 1 r 3, sr 2 r 3, sr 1 r 2 r 3 } Atomic Broadcast {s, sr 1 r 2 r 3 } Causality chain {s, sr 1, sr 1 r 2, sr 1 r 2 r 3 } In rendezvous there is a strong synchronization, where all ports are involved. A broadcast is a weak synchronization, involving s and some subset of r i. Atomic broadcast is another synchronization strategy, where either message is received by all receivers or none of them. In causal chain if message is received by r i, then all receivers with smaller number have also received this message. A. Algebra of Interactions The authors define an algebra of interactions, which serves as a basis for algebra of connectors. Syntax. The syntax of the Algebra of Interactions, AI(P ), is defined by the following grammar x ::= 0 1 p P x x x + x (x), (3) where + and are binary operators, respectively called union and synchronisation. Synchronisation binds stronger than union.

EDIC RESEARCH PROPOSAL 3 a γ { } { a P q i i q i a Pi, i [1, n] q i = q i a q 1... q n γ q 1... q n } a P i =, i [1, n]. (1) Semantics. The semantics of AI(P ) is given by the function : AI(P ) 2 2P, defined by 0 =, 1 = { }, p = { {p} }, x 1 + x 2 = x 1 x 2, { } x 1 x 2 = a 1 a 2 a1 x 1, a 2 x 2, (x) = x, (4) for p P, x, x 1, x 2 AI(P ). Terms of AI(P ) represent sets of interactions between the ports P. Axioms. The operations satisfy the following axioms: Union is idempotent, associative, commutative and has an identity element 0. Synchronization is idempotent, associative, commutative, has an identity element 1, and an absorbing element 0. Proposition III.2. The axiomatization is sound and complete, that is for any x, y AI(P ), x = y x = y (5) Example III.3. In terms of the algebra of interactions, coordination schemes from the Example III.1 have the following forms. Name AIP Rendezvous sr 1 r 2 r 3 Broadcast s(1 + r 1 )(1 + r 2 )(1 + r 3 ) Atomic Broadcast s(1 + r 1 r 2 r 3 ) Causality chain s(1 + r 1 (1 + r 2 (1 + r 3 ))) Expression 1+r i suggests that port r i is optional. B. Algebra of Connectors Syntax. The syntax of the Algebra of Connectors, AC(P ), is defined by the following grammar s ::= [0] [1] [p] [x] (synchrons) t ::= [0] [1] [p] [x] (triggers) x ::= s t x x x + x (x), (6) for p P, and where + is binary operator called union, is a binary operator called fusion, and brackets [ ] and [ ] are unary typing operators. Fusion binds stronger than union. Fusion is a generalisation of the synchronisation in AI(P ). Typing is used to form typed connectors: [ ] defines triggers (can initiate an interaction), and [ ] defines synchrons (need synchronisation with other ports in order to interact). Definition III.4. A term x AC(P ) is a monomial, iff it does not involve union operations. Notation III.5. Authors write [x] α, for α {0, 1} to denote typed connector. 0 for a synchron, 1 for a trigger. A connector, which type is irrelevant, is denoted by [x]. Axioms. The operations satisfy the following axioms: Union is idempotent, associative, commutative and has an identity element [0]. Fusion is commutative, distributive, has an identity element 1. It is idempotent on the monomial connectors. Typing satisfies the following axioms, for x, y, z AC(P ) and α, β {0, 1} [0] = [0] [[x] α ] β = [x] β [x + y] α = [y] α + [x] α [x] [y] = [x] [y] + [x][y] Semantics. The semantics of AC(P ) is given by the function : AC(P ) AI(P ): [p] = p, (7) x 1 + x 2 = x 1 + x 2, (8) n n [x i ] = x k, (9) n m [x i ] [y j ] = j=1 ( k i n x i (10) ( 1 + x k ) m j=1 ( 1 + y j ) ), for x, x 1,..., x n, y 1,..., y m AC(P ) and p P {0, 1}. Through the semantics of AI(P) connectors represent sets of interactions. Algebra of connectors allows compact representation of interactions. Connectors can be represented as trees with two types of nodes: synchrons and triggers, which are denoted as bullets and triangles respectively.

EDIC RESEARCH PROPOSAL 4 Fig. 2. Graphical representation of basic Reo connectors Fig. 3. Reo exclusive router connector Fig. 1. Graphical representation of BIP connectors Example III.6. In terms of the algebra of connectors, coordination schemes from the Example III.1 have the following forms. Name AC P Rendezvous sr 1 r 2 r 3 Broadcast s r 1 r 2 r 3 Atomic Broadcast s [r 1 r 2 r 3 ] Causality chain s [r 1[r 2r 3 ]] The graphical representation of connectors is presented in Figure 1. Proposition III.7. The axiomatization of AC(P) is sound, i.e. for x, y AC(P ), x = y x = y. Definition III.8. Two connectors x, y AC(P ) are equivalent iff they have the same set of interactions, i.e. x y x = y. C. Conclusion Algebra of connectors provides a mathematical formalisation of the BIP interaction model. It allows to represent interactions in a more compact way. This concept is supported by the BIP language, where connectors describe the set of interactions. IV. BASIC SURVEY ON CONNECTORS In [7] the authors survey several formal approaches to the modelling, composition and analysis of connectors. These approaches are quite different, but the authors argue that they are different views on the same issue. The modelling of a basic operator for Long Running Transactions (LRT) is used as a running example to expose analogies and differences of the approaches. The implementation of LRT does not use locking, but it relies on a weaker notion of atomicity based on compensation. The LRT is represented as a sequence of activities. If some activity is failed, i.e. that transaction is failed, then for each successfully completed activity the compensation activity is executed in order to undo as much as possible of the activity effects. The compensation pair A%B is used as a running example in this paper. The following subsections will briefly describe different approaches and in the end relations between approaches will be shown. A. Reo Connectors in Reo are graphs, where edges are communication channels and nodes implement fixed routing policy. Reo channels have two ends, which can be either source, accepting data into the channel, or sink, which dispenses data out. There are several types of basic channels, some examples can be found in Figure 2. The Sync allows data to flow from source to sink, if both ends are available. LossySync is similar to Sync, except the fact that it can accept data inside even if the sink end is not ready. SyncDrain checks if both ends try to write data simultaneously. FIFO is an asynchronous channel with buffer of capacity 1. Components and primitive connectors can be combined into larger Reo circuits by joining their ends. A node behaves asymmetrically, it takes non-deterministically a message from one of the inputs, and writes the output simultaneously to all outgoing channels. Nodes can be hidden in order to avoid later modifications. Figure 3 (a) illustrates a composite Reo connector, called exclusive router. Any data read on the input port in is written to only one of its output ports out 1 or out 2, depending on which one is ready to consume the data. If both are ready, then the connector chooses nondeterministically. As a shorthand, this connector will be represented later as shown in Figure 3 (b). A stateful selector (Figure 4) is an auxiliary connector, needed to define the compensation pair. In the initial state it can only accept a message

EDIC RESEARCH PROPOSAL 5 Fig. 7. Nets with boundaries Fig. 4. Reo stateful selector Fig. 8. Nets with boundaries: stateful selector Fig. 5. Reo compensation pair from port on and put it into FIFO. After that it can synchronize with one of ports in 1 or in 2, which are mutually exclusive due to exclusive router. The compensation pair is presented in Figure 5. After execution of A the connector waits for one of two signals cancel or commit. B. BIP The BIP model is described in Section II. The compensation pair can be modelled in BIP by using components, illustrated in Figure 6, with empty priority layer and the following set of interactions: γ = {{start, starta}, {perf ormed, enda, on}, {cancel, in 1, startb}, {endb, cancelled}, {commit, in 2, commited}} Env represents the environment in which the compensation pair will execute, and Selector has a role of stateful selector similar to one in Reo. C. Nets with Boundaries Definition IV.1. Let m, n N. A net with boundaries N : m n is a tuple N = (S, T,,,, ), where S is a set of places, T is a set of transitions, and : T 2 N assign places to each transition, respectively source and targets, and : T 2 m and : T 2 n assign transitions to the left and right boundaries. Graphically, places are circles, transitions are rectangles, boundaries are bullets and arcs stands for pre and post set relations. Figure 7 shows three examples of nets with boundaries. Nets with boundaries can be composed in parallel and in series. Intuitively, the parallel composition corresponds to drawing two nets one above other, and the sequential composition corresponds to connection of the right boundary of the first net connects with the left boundary of the second net (boundaries should coincide). For modelling the compensation pair authors again introduce the stateful selector (Figure 8). Assuming that A and B tasks can be modelled as nets [A] : 1 1 and [B] : 1 1, the corresponding net with boundaries for the compensation pair is defined as follows: [A%B] : 3 3 (Figure 9). [A%B] = ([A] I I); o ff; (I [B] I) D. Petri Calculus Petri Calculus consists of the following constants plus parallel and sequential composition: empty and full place, identity, swap, duplicator and its dual, mutex and dual, hiding and dual, inaction and dual. The graphic representation is presented in Figure 10. Intuitively, the parallel and sequential compositions are similar to the ones in nets with boundaries: put one connector under the other one or connect the right boundary with the left boundary of the second connector. To define the compensation pair the authors introduce an auxiliary stateful selector (Figure 11): Fig. 6. BIP behaviours for compensation pair Fig. 9. Nets with boundaries: compensation pair

EDIC RESEARCH PROPOSAL 6 A. CAB Calculus Fig. 10. Fig. 11. Petri calculus constants Petri calculus stateful selector o ff = ( I I); (I I I); (I I I); (I I I); (I ) And the compensation pair has the form [A%B] = ([A] I I); o ff; (I [B] I) E. Conclusion There are others approaches, which were mentioned in the paper: the tile model, the algebra of stateless connectors, which can be regarded as a special kind of tile model, and the wire calculus. Approaches described in this paper are quite different, but there are several results, appeared in the literature, which relate these models. Any BIP system without priorities can be mapped into the net with boundaries, and any net with boundaries without left interface can be encoded as a BIP system [6]. There is a tight correspondence between nets with boundaries and Petri Calculus [8]. Petri calculus is an algebra of stateful connectors, which basically extends the algebra of stateless connectors, and can be characterized as Tiles. It has been shown that two-colour semantics in Reo can be recovered into the tile approach by adding a tile for one-state buffer. V. REVISITING GLUE EXPRESSIVENESS The authors of this paper were interested in research of some open questions concerning glue expressive power, especially in intrinsic expressiveness of BIP glue. Turing-completeness is used as a benchmark for expressiveness. In the paper the authors introduced a CAB (Connectors and Behaviours) Calculus. A component in CAB takes the form of l[c 1 ;... ; C n B], where l is the name of the component, C 1,..., C n are its subcomponents and B is the glue. A glue in CAB can evolve over time and it is given by the terms of process calculus, which they call the glue language. It has the following features. Action prefix α.b, where B is a continuation glue (i.e. after execution of the action α glue evolves to the state B), allows the definition of dynamic glues. Parallel composition B 1 B 2 combines constraints from both B 1 and B 2. Note that two branches do not interact. Recursion recx.b, where X is a process variable, allows a definition of glue with cyclic behaviour. Actions in the glue language are triplets of the form <pr, tag, syn>, where syn is a synchronization constraint, i.e. events to be synchronized between subcomponents, pr is a priority constraint, i.e. events in subcomponents which would preempt the synchronization syn, and tag is an event to be visible by the composite as a result of successful synchronization. Formally, the CAB calculus is parametrised by a set of primitive components defined as labelled transition systems. The set of CAB(P) processes is described by the following grammar: Grammar. S ::= l[c B] l[p ] C ::= 0 S C; C B ::= 0 <Act, T ag, Act>.B B B recx.b X Act ::= {evt} evt ::= l : a evt, evt T ag ::= τ a, where a is a port name, l is a component name. For example, a glue <{l : a}, t, {l 1 : c 1, l 2 : c 2 }>.B specifies a synchronization constraint between two subcomponents l 1 and l 2 : if the first one is ready to perform c 1, and the second can perform c 2, then the composition is ready to perform t, provided that l cannot perform a. When the event t is performed, a new glue B is then put in place to control the behaviour of the composite. The CAB calculus is an extension of BIP. Theorem V.1. BIP system defined over a set P of components can be encoded in CAB(P).

EDIC RESEARCH PROPOSAL 7 B. Turing-Completeness of CAB To show the intrinsic expressiveness power of the CAB glue language no primitive components will be used. Component systems will be constructed using only glue language terms. It is equivalent to consider only primitive components of the form l[0 B], where B is a term with actions of the form <, α, >. To prove Turing-completeness of CAB, the encoding of Minsky machines into CAB is presented. Minsky machine is a Turing-complete model of computation. It is composed of a set of sequential, labelled instructions, two registers, which can contain arbitrary large natural numbers, and a counter, showing the current instruction. There are two types of instructions: first type (Inc(r i )) is an increment of one of the registers, while the second one (Dec(r i,s)) jumps to the instruction s if the value is 0 in the register, otherwise decreases a value in the register. A configuration of the Minsky machine is a tuple <i, m 0, m 1 >, where i is the number of instruction currently executed and m i are values in registers. The intuition of the encoding is the following. Numbers inside registers are represented as the parallel composition of as many occurrences of the unit process <, u j, > as the number to be encoded. An increment simply adds one more process <, u j, >. A decrement removes one occurrence of the process <, u j, >, if such occurrence is available. The jump branch is guarded by a priority rule, i.e. in order to execute a jump it is necessary to check that the register is empty (there are no occurrences of process <, u j, > ). The instructions are encoded into a glue. The full encoding and proof of its correctness can be found in the paper. CAB is proved to be Turing-complete, but the authors made additional investigations in expressiveness power, by varying the glue language. The first result is that the presence of priorities is essential. If we remove the priorities so that glue language in CAB will only have actions of the form <, α, syn>, then we lost Turing-completeness. CAB without priorities can be encoded into Petri nets, which are non Turing-complete. On the other hand priorities can be substituted by a possibility to add a new subcomponent inside a system (a new operator of the glue language), without the loss of Turing-completeness. Minsky machines again can be encoded into this variation of CAB, thanks to the interplay between creation of the new components and recursion. C. Conclusion One of the most well-known benchmarks for expressiveness is Turing-completeness. It can be applied to glue languages and characterize the intrinsic expressive power of the glue. The priority model is a very powerful mechanism, and its removal leads to the loss of Turing-completeness. On the other hand this paper shows that the separation of concepts (computation and coordination) is quite delicate. The slight modification of BIP glue leads to Turing-completeness, which makes it possible to construct non-trivial systems without a single component. VI. VARIATION OF BIP SEMANTICS A. Variation of semantics The standard BIP semantics leaves some open questions. First one is to find a boolean representation of a complete BIP glue. One more important question is the one of flattening. BIP glue can be applied hierarchically, and flattening means finding the BIP glue application of which is equivalent to application of all hierarchical structure. Unfortunately, some systems cannot be flattened. In [4] a variation of BIP semantics is introduced, which solves this problems. It also allows to define connector representation of the entire BIP glue, including priorities. Definition VI.1. A behaviour is a pair B = (S, ) consisting of an LTS S = (Q, P, ) and an offer predicate on Q P such that q p holds (a port p P is offered in a state q Q) whenever there is a transition from q containing p, that is ( a 2 P : p a q ) a q p. We write B = (Q, P,, ) for B = ((Q, P, ), ). The offer predicate extends to sets of ports: for a 2 P, q a def = p a q p. Notice that q true. def = Let P be a set of ports. We denote P {ṗ p P } and P def = {p p P }. We call the elements of P, P and P respectively activation, firing and negative port typings. Definition VI.2. An interaction is a subset a P P P. For a given interaction a, we define the following sets of ports: act(a) def = a P, the activation support of a, fire(a) def = {p P ṗ a}, the firing support of a, neg(a) def = {p P p a}, the negative support of a.

EDIC RESEARCH PROPOSAL 8 a γ { q i fire(a) P i q i } n { } n q i (act(a) P i ) q 1... q n fire(a) q 1... q n { } n q i p p neg(a) P i. (11) Definition VI.3. Let B i = (Q i, P i,, ), with i [1, n] and P = n P i, be a set of component behaviours. Let γ 2 P P P be a set of interactions. The composition of {B i } n with γ is a behaviour γ(b 1,..., B n ) def = (Q, P,, ) with the set of states Q = n Q i the cartesian product of the sets of states Q i, the offer predicate inductively defined by the following rules, for i [1, n], q i p q 1... q n p, the transition relation inductively defined by the rule (11). B. Expressiveness Turing-completeness is not a good benchmark for comparison of different approaches, as this benchmark gives a boolean answer, and many formalisms are expressively equivalent independently of their features. In [3] a notion of glue expressiveness is presented, which allows to compare glue coordination capabilities. Glue is represented as a set of operators transforming behaviour, i.e. mapping set of behaviours to behaviours. Two n-ary glues are equivalent if for any set of behaviours they give equivalent behaviours (the equivalence relation on behaviours is required). The comparison of two glues is made by considering whether for any glue operator from the first glue there exists an equivalent one from the second glue (strong expressiveness). Weak expressiveness is defined by allowing a finite number of additional behaviours as additional arguments for the second glue operator. This definition does not deal with some problems, for example two BIP semantics are non-comparable. VII. RESEARCH PROPOSAL The state-of-art will benefit from having a formal framework for studying component coordination, sufficiently general to provide the insight into how the component-based systems should be modelled and compared. A first goal is to define a consolidated notion of glue. The first step in this direction is already done. Semantics with offer predicate seems to solve existing problems and it allows to synthesise complete BIP glue from boolean encoding. Research on this semantics will continue. The next step is to define an expressive power of glue, which will allow to compare different approaches to model the coordination among components. It is the first long-term goal. Comparison between different approaches can be done in order to find, which one can be more convenient for particular purposes, and how they can be extended. The composition of glues is another interesting topic for research. Assuming we have set of glues, application of each glue in this set ensures some property of the global system. For example, one glue ensures mutual exclusion, another one ensures round-robin scheduling. Unfortunately, application of both glues will not ensure both properties, moreover, the composed system will have none of this properties with high probability. The second long-term goal is to research possibility of compositional application of glues, how and in what circumstances compositional application of glues can ensure properties of the composed system. REFERENCES [1] Farhad Arbab. Reo: a channel-based coordination model for component composition. Mathematical Structures in Computer Science, 14(3):329 366, 2004. [2] Simon Bliudze and Joseph Sifakis. The algebra of connectors: structuring interaction in bip. In Proceedings of the 7th ACM & IEEE international conference on Embedded software, pages 11 20. ACM, 2007. [3] Simon Bliudze and Joseph Sifakis. A notion of glue expressiveness for component-based systems. In CONCUR 2008-Concurrency Theory, pages 508 522. Springer, 2008. [4] Simon Bliudze and Joseph Sifakis. Synthesizing glue operators from glue constraints for the construction of component-based systems. In Software Composition, pages 51 67. Springer, 2011. [5] Roberto Bruni, Ivan Lanese, and Ugo Montanari. A basic algebra of stateless connectors. Theoretical Computer Science, 366(1):98 120, 2006. [6] Roberto Bruni, Hernán Melgratti, and Ugo Montanari. Connector algebras, petri nets, and bip. In Perspectives of Systems Informatics, pages 19 38. Springer, 2012. [7] Roberto Bruni, Hernán Melgratti, and Ugo Montanari. A survey on basic connectors and buffers. In Formal Methods for Components and Objects, pages 49 68. Springer, 2013. [8] Paweł Sobociński. Representations of petri net interactions. In CONCUR 2010-Concurrency Theory, pages 554 568. Springer, 2010.