Lecture Notes in Computer Science Edited by G. Goos and J. Hartmanis
92 IIII
Robin Milner
A Calculus of Communicating Systems
SpringerVerlag Berlin Heidelberg New York 1980
Editorial Board
W. Brauer P. Brinch Hansen D. Gries C. Moler G. SeegmiJIler J..q;toer N. Wirth Author
Robin Milner University of Edinburgh Dept. of Computer Science James Clerk Maxwell Building The King's Buildings Mayfield Road Edinburgh EH9 3JZ Great Britain
AMS Subject Classifications (1979): 6802 CR Subject Classifications (1974): 4.30, 5.20, 5.22, 5.24 ISBN 3540102353 SpringerVerlag Berlin Heidelberg New York ISBN 038?102353 SpringerVerlag NewYork Heidelberg Berlin Library of Congress Cataloging in Publication Data. Milner, Robin. A calculus of communicating systems. (Lecture notes in computer science; 92) Bibliography: p. Includes index, t. Machine theory. 2. Formal languages. I. Title. 11.Series. CIA26?.M53. 511.3 8021068 This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically those of translation, reprinting, reuse of illustrations, broadcasting, reproduction by photocopying machine or similar means, and storage in data banks. Under § 54 of the German Copyright Law where copies are made for other than private use, a fee is payable to the publisher, the amount of the fee to be determined by agreement with the publisher. © by SpringerVerlag Berlin Heidelberg 1980 Printed in Germany Printing and binding: Beltz Offsetdruck, Hemsbach/Bergstr. 9145/3140543210
work was mainly done during my sixmonth appo_i n   t , ~ t
frcm
1979 to January 1980, at the Ommouter Science deoalb~ent in
Aarhus University, ~ k .
Although much of the ground work had been
done previously it was mainly in response to their encouragement (to make the theory more accessible and related to practice), and to their informed criticism, that the material reached a scmewhat coherent form. I an deeply grateful to them and their students for allowing me to lecture once a week on what was, at first, a loosely connected set of ideas, and for the welccming enviromnent in which I was able to put the ideas in order.
I also thank Edinburgh University for awarding me
five months sabbatical leave subsequently, which helped me to cc~plete the task in a reasonable time. The calculus presented here 9~ew out of work which was inspired by Dana Scott's theory of computation, though it has since diverged in some respects. Plotkin;
At every stage I have been influenced by Gordon
even where I cannot trace particular ideas to him I have
been greatly illtmlinated by our discussions and by his chance remarks, and without them the outccme would certainly be less than it is. would also like to thank others with whom I have worked: with whom I worked out the Laws of Flow Algebra;
I
George Milne,
Matthew Hennessy, with
whcm the notion of observation equivalence developed;
and Tony Hoare,
whose parallel work cn different but strongly related ideas, expressed in his "Ccamtmicating Sequential Processes", has been a strong stimulus. Many people have given detailed and helpful criticisms of the manuscript, and thus improved its final form.
In particular I thank Michael
Gordon and David MacQueem, who went through it all in detail in a Seminar at the Information Sciences Institute, University of California;
this
not only exposed same mistakes and obscurities but gave me more csnfidence in the parts they didn't criticise. Finally, I am very thank~=ul to Dorothy McKie and Gina Temple for their patience and skill in the long and involved task of typing.
O.
Introduction Purpose  Character  Related ~ r k
!.
 Evolution  Outline.
Emperimentin 9 on Nondeterministic Machines Traditional equivalence of finite state acceptors  E x p e r ~ t i n g upon acceptors  Behaviour as a tree  Algebra of RSTs Unobservable acticns.
2.
S[nchronizaticn
19
Mutual experimentation  Composition,
restriction and relabelling 
Extending the Algebra of STs  A sinple ~ l e :
binary semaphores 
The ST Expansion Theorem.
3.
A case study in synchronizaticn and proof t e ~ i q u e s
33
A scheduling problem  Building the scheduler as a Petri Net Observation equivalence  Proving the scheduler.
4.
Case studies in valuecc~6~1~dnication Review  Passing values  An exanple: An example:
5.
47 Data Flow  Derivations 
Zero searching.
65
Syntax and Semantics of CCS Introduction  Syntax  Semantics by derivations  Defining behaviour identifiers  Sorts and programs  Direct equivalence of behaviour programs  Congruence of behaviour programs  Congruence of behaviour expressions and the Expansion ~neorem.
6.
Cu,,~!~cation Trees (CTs) as a model of CCS CTs and the dynamic o p e r a t i c n s CTs defined by recursion  A ~ c
84
C'fs and the static operations actions and derivations of CTs 
Strong equivalence of CTs  Equality in the CT model  S ~ .
7.
Cb~ticn
~_iivalence and its properties
Review  Observation equi%ralence in CCS  Observation oongruence Laws of observation congruence  Proof ted%niques  Proof of Theor~n 7.7  Further exercises.
98
VJ
8.
111
Some proofs about Data Structures Introduction  Registers and mamories  Chaining operations Pushdc~s
9.
and queues.
126
Translaticn into CCS Discussion  The language P  Sorts and auxiliary definiticns Translation of P  Adding pzocedures to P  Protection of resources.
i0.
~tezminacy
138
and Confluence
Discussion  Strong confluence  ~ i t e ccnfluence  Strcng determinacy: Proof in DCCS:
guards and the use of
Confluent detezminate CCS 
the scheduler again  abservaticn confluence and
detezminacy.
II.
158
Conclusion What has been achieved?  Is OCS a programming language? The question of fairness  The notion of behaviour  Directions for further work.
~
:
References
Properties of cc~gruence and equivalence.
166
16 9
CHAPTER
0
Introduction
O.i
Pu~se These notes present a calculus of concurrent systems.
is partly infozrflal, and aimed
at practice;
The presentation
we unfold the calculus through
the medium of examples each of which illustrates first its expressive power, and second the techniques which it offers for verifying properties of a system. A useful calculus, of cGmputing systems as of anything else, must have a high level of articulacy in a full sense of the word implying not only rid%ness in expression but also flexibility in manipulation.
It should be
possible to describe existing systems, to specify and progr~n new systems, and to argue mathematically about them, all without leaving the notational frame%~rk of the calculus. These are demanding criteria, and it may be impossible to meet them even for the full range of concurrent syst~ns which are the proper concern of a ccmputer scientist, let alone for syste~ns in general. n~st be made.
But the attempt
We believe that our calculus succeeds at least to this extent:
the sane notations are used both in defining and in reasoning about systems, a n d  as our examples will show  it appears to be applicable not only to prograns (e.g. operating systems or parts of them) but also to data structures and, at a certain level of abstraction,
to hardware systems.
For
the latter however, we do not claim to reach the detailed level at which the correct functicr/ng of a s y s t ~ depends on timing considerations. Apart from artioulacy, we aim at an underlying, theory whose basis is a small wellknit collection of ideas and which justifies the manipulations of the calculus.
~nis is as important as generality  perhaps even mere
in~portant. Any theory will be superseded sooner or latem;
during its life,
understanding it and assessing it are only possible and worthwhile if it is seen as a logical 9~owth frcm rather fewbasic assumptions and concepts. We take this further in the next section, where we introduce our chosen conoeptual basis. One purpose of these notes is to provide material for a graduate course. With this in mind (indeed, the notes grew as a graduate course at Aarhus University in A u t ~
1979) we have tried to find a good expository sequence,
and have cmitted scme parts of the theory  which will appear in technical publications  in favour of case studies.
There are plenty of exercises,
and anyone who bases a course on the notes should be able to think of others; one pleasant feature of concurrent systems is the wealth and variety of small but nontrivial e~maples'
We could have included many more examples
in the text, and thereby given greater evidence for the fairly wide applicability of the calculus;
but, since
our main
aim is to present
it as a calculus, it seemed a good rule that every example program or syste~ should be subjected to scrne proof or to same manipulation.
O.2
Character Our calculus if founded on two central ideas.
The first is Observation;
we aim to describe a ooncurrent system fully enough to determine e~mctly what behaviour will be seen or experienced by an external observer. the approach is tho~oughly extensional;
Thus
two systems are indistinguishable
if we cannot tell the~ apart without pulling thegn apart.
We therefore
give a fomaal definition of observation equivalence (in Chapter 7) and investigate its properties. This by no meaD~ prevents us frcm studying the structure of systems. Every interesting concurrent system is built frcrn independent agents which ccmmunicate, and s~nchronized communication is our second central idea. We regard a cut~t~nication between two component agents as an indivisible action of the ccr~0osite system, and the heart of our algebra of systems is concurrent c c ~ s i t i o n ,
a binary operation which c c ~ e s
pendent agents, allowing thegn to coma~anicate.
two inde
It is as eentral for us
as sequential ccmioosition is for sequential programming, and indeed subsumes the latter as a special case.
Since for us a program or system description
is just a tel~n of the calculus, the structure of the program or system (its intension) is reflected in the structure of the term.
Our ~nanipulations
often consist of transfozndng a tezm, yielding a term with different intension but identical behaviour (extension).
Such transfozmations az~ faniliar
in sequential progranmiing, where the extension may just be a mathematical function (the "input/output be/qaviour"); for concurrent systems however, it seer,s clear that functions are inadequate as extensions. These two central ideas are really one.
For we suppose that the only
way to observe a system is to o.xL'municate with it, which r0akes the observer
and system together a larger system.
The other side of this ooin is
that to place two ccr~ponents in ~ c a t i o n is just to let them observe each other.
(i.e. to cc~pose them) If observing and cut~u~cating
are the s~ne, it follows that one cannot Observe a syste~ without its participation.
The analogy with quantum physics may or may not be super
ficial, but the approach is unifying and appears natural. We call the calculus CCS (Calculus of C~m.~nicating Systems). temps of CCS stand for behaviours to equational laws.
(extensions)of systems and are subject
This gives us an algebra, and we are in agreement
with van Erode Boas and Janssen [EHJ] who argue that ~rege's
principle
of ocmpositionality of meaning requires an algebraic framework. is s ~ a t
The
more than algebra;
But CCS
for example, derivatives and derivations
of terms play an inportant part in describing the dynamics of behaviours. The variety of systems which can be expressed and discussed in CCS is illustrated by the exanples in the text:
an agent for scheduling
task perfomaance by several other agents (Chapter 3);
'data flow'
cc~putations and a concurrent n%~rerical algorithm (Chapter 4); devices and data structures (Chapter 8); parallel progranlming language (Chapter 9).
n~mnory
semantic description of a In addition, G. Milne [Mln 33
modelled and verified a peripheral hardware device  a cardreader  using an earlier version of the present ideas. After these remarks, the character of the calculus is best discovered by a quick look through Chapters 14, ignoring tedanical details.
§O.5
(Outline) may also help, but the next two sections are not essential for a quick appraisal.
O. 3
Related Work At present, the most fully developed theory of concurrency is that
of Petri and his colleagues.
(See for example C.A. Petri, "Introduction
to General Net ~heory" [Pet3, and H.J. Genrich, K. Lautenbach, P.S. Thiagarajan, "An Overview of Net Y~leory" [GLT].)
It is i~portant to
contrast our calculus with Net Theory, in tez~as of underlying concepts. For Net Theory, a (perhaps the) basic notion is the concurrenc~ relation system;
over the places (conditions)
and transitions (events) of a
if two events (say) are in this relation, it indicates that
they a~e causally independent and may occur in either order or simultaneously.
This relation is conspicuously absent in our theory, at
least as a basic notion.
Hen
we o ~ p o s e two agents it is the synchroni
zation of their mutual cc~amlnications which d e t ~ e s
the cc~oosite;
we
treat their independent actions as occurring in arbitrary order but not simultaneously.
The reason is that we assLlre of our external observer
that he can make only one observation at a time;
this i~plies that he
is blind to the possibility that the syst~n can support two observations simultaneously, so this possibility is irrelevant to the extension of the systea in our sense.
This assumption is certainly open to (extensive')
debate, but gives our calculus a sinplicity which would be absent otherwise.
To answer the natural objection that it is unwieldy to consider all
possible sequences (interleavings) of a set of causally independent events, we refer the reader to our case studies, for exanple in Chapters 3 and 8, to satisfy himself that our methods can avoid this unwieldiness almost
~Zetely. Cn the other hand, Net Theory provides many strong analytic techniques; we must justify the proposal of another theory. is upon synthesis and upon extension;
The emphasis in our calculus
algebra appears to be a natural tool
for expressing how systems are built, and in showing that a system meets its specification we are demanding properties of its extension.
~
activity
of programming  more generally, of system synthesis  falls naturally into CCS, and we believe our approach to be more articulate in this respect than Net Theory, at lea_st on present evidence.
It remains for us to
develop analytic techniques to match these of ~Net Theory, whose achievements will be a valuable guide. As a bridge between Net Theory and programming languages for concurrency, we should mention the early work of Karp and Miller [KM] on parallel program schemata.
This work bears a relation to Net Theory in yielding an
analysis of properties of concurrent systems, such as deadlock and liveness; it also esmes closer to programming (in the ccnventional sense), being a generalisaticn
of the familiar notion of a sequential flow chart.
In recent proposals for concurrent programming languages there is
a
trend towards direct ccrm~nication between cc~i0onents or modules, and away from c~i~unication through shared registers or variables.
Examples are:
N. Wirth "MCDUIA:
A language for modular multiprogramling", [Wir];
P. Brinch Hansen "Distributed Processes; [Bri 2];
a concurrent programming ccnoept",
C.A.R. Hoare "C~ti~nicating Sequential Processes", [Hoa 3].
Hoare's "monitors" [Hoa 2] gave a discipline for the administration of shared resources in concurrent programming.
These papers have helped
towards understanding the art of concurrent programming. differs frcm all of them in two ways:
Our calculus
first, it is not in the accepted
sense an imperative language  there are no commands, only expressions; second, it has evolved as part of a mathematical study.
In the author's
v i ~ it is hard to do mathematics with imperative languages, though one may add mathematics (or logic) to them to get a proof methodology, as in the wellknown "assertion" method or Hoare's axicmatic method. One of the main encumbrances to proof in imperative languages is the presence of a moreorless global m~mory (the assignable variables). was recognized by Hoare in "Communicating Sequential Processes"; CSP is imperative
~his
although
Hoare avoids one aspect of global m~nory which makes
concarrent programs hard to analyse, by forbidding any member of a set of concurrent programs to alter the value of a variable mentioned by another m~.
This significant step brings CSP quite close to our calculus, the
more so because the treatment of eutmunication is similar and expressed in similar notation.
Indeed, algorithms can often be translated easily from
one to the other, and it is reasonable to hope that a semantics and proof theory for CSP can be developed frGm CCS.
Hoare, in his paper and more
recently, gives encouraging evidencs for the expressiveness of CSP. We now turn to two models based on nonsynchronized o~t,manication. One, with strong expressive power, is Hewitt's Actor Systems; reference is [HAL].
Here the ~ c a t i o n
a recent
discipline is that each
message sent by an actor will, after finite time, arrive at its destination actor ; no structure over waiting messages (e.g. ordering by sendtime) is imposed.
This, together with the dynamic creation of actors, yields
an interesting programming method.
Hc~ever, it see~ns to the author that
the fluidity of structure in the model, and the need to handle the collection of waiting messages, poses difficulties for a tractable extensional theory. Another nonsynchronized model, deliberately less expressive, was first studied by Kahn and relx)rted by him and MacQueen [KMQ].
Here the
interc~Li~t.~nicationof agents is via unbounded buffers and queues, the
whole being determinate.
Problems have arisen in extending it to non
determinate systems, but many nontrivial algorithms find their best expression in this medit~n, and it is an example of applicative (i.e. nonimperative)
prograrmling which yields to extensional treatment by
the semantic techniques of Scott.
Moreover, Wadge [Wad] has recently
shown how simple calculations can demonstrate the livemess of such systems. A lucid oc~parative account of three approaches  Hewitt, Kahn/ MacQueen and Milner  is given in [MQ]. In Chapter 9 of these notes we show how one type of concurrent language  where ccmmmnication is via shared variables  may be derived frc~ or expressed in terms of CCS.
This provides sane evidence that our
calculus is rich in expression, but we certainly do not claim to be able to derive every language for concurrency. A rather different style of presenting a concurrent system is exer~olified by the path expressions of Campbell and Habermann [CaH]. Here the active parts of the system are defined separately from the constraints
(e.g. the path expressions) which dictate how they must
synchronize.
More recent work by Lauer, Shields and others  mainly
at Newcastle  shows that this model indeed yields to mathematical analysis.
A very different example of this separation is the elegant
work of MaggioloSchettini et al [ ~ ] ;
here the constraints are
presented negatively, by stating what conjunctions of states (of separate ccnponent agents) may not occur.
This approach has an advantage for
systems whose crmponents are largely independent (the authors call it "loose coupling"), since then only few constraints need to be expressed. This section has shown the surprising variety of possible treatments of concurrent systems.
It is nothing like a cc~prehensive survey, and
the author is aware that important work has not been mentioned, but it will serve to provide sc~e perspective on the work presented here.
O. 4
Evolution %Tuis work evolved frc~n an atter~ot to treat c~L~nication mathemati
cally. [Mil 11
In Milner : "Processes:
a mathematical model of ~ t i n
9 agents"
a model of interacting agents was constructed, using Scott's
theory of dcrm~ms. and Milner:
~his was refined and grew more algebraic in G. Milne
"Concurrent Prooesses and their syntax"
EMM3.
At this
point we proposed no programming language, but were able to prove properties of defined c o n ~ n t
behaviours.
For example, Milne in his
Ph.D. Thesis "A mathematical model of concurrent computation" [Mln] proved partial correctness of a piece of hardware, a cardreader, built from four separate cc~ponents as detailed in its hardware description. Our model at this stage drew upon Plotkin's and Sa~yth's P ~ e r ~ constructions,
[PIo i, Sa~y]. which extended Scott's theory to admit
nondetenminism.
Part of our algebra is studied in depth in [Mil 2].
At this point there were two crucial develo~aents.
First  as we
had hoped  our behaviour definitions looked considerably like programs, and the rescm%blance was increased by merely improving notation. result, essentially the language of CCS, was partly p ~ t e d
The
is reported in [Mii 3] and
by discussions with Hoare and Scott.
(For completeness,
two other papers [Mil 4,5] by the author are included in the reference list.
Each gives a slightly different perspective from [Mil 3], and
different examples. )
The second develolm~nt was to realise that the
resulting language has many interpretations;
and that the P c ~ r ~
model, and variants of it, may not be the correct ones. needed, to reject the wrong interpretations. to observation equivalence;
A criterion was
For this purpose, we turned
two behaviour expressions should have the
sane interpretation in the model iff in all contexts they are indistinguishable by observation. It now turns out that a definition of observation equivalence (for which admittedly there are a few alternatives)
detemnines a model, up
to isc~orphism, and moreover yields algebraic laws which are of practical use in arguing about be2~iriours. which are in some sense complete;
We have strong hope for a set of laws in fact the laws given in Chapters 5
and 7 have been shown cc~!olete for a sinplified class of finite (ten~inating) behaviours.
In this case, "complete" means that if two behaviour expressions
are observationequivalent in all contexts then they may be proved equal by the laws; 0.5
this completeness is shown in [HM].
Outline In Chapter 1 we discuss informally the idea of experimenting on, or
observing, a nondete2xninistic agent;
this leads to the notion of
synd0monisation tree (ST) as the behaviour of an agent.
Chapter 2 dis
ct~ses m t u a l experiment, or c~mL~nicaticn, between agents, and develops an algebra of STs.
In Chapter 3 we do a small casestudy (a scheduling
system) and prove scxnething about it, anticipating the formal definition of observation equivalence and its properties to be dealt with fully in Chapter 7. Chapter 4 enriches our cul,udnications  up to now they have been just syndlronizations  to allow the passing of values frcm one agent to another, and illustrates the greater expressive p ~ e r
in two more exar~les;
cne is
akin to Data Flow, and the other is a concurrent algorithm for finding a zero of a continuous function.
The notion of derivative of a behaviour
is introduced, and used in the seccnd example. In Chapter 5 we define CCS formally, giving its dynamics in terms of derivations
(derivative sequences).
~his yields our strong congruence
relation, under which two programs are ccngruent iff they have essentially the same derivations, and we establish several laws obeyed by the congruence. In Chapter 6 we present c~mlunicaticn trees (CTs, a generalisation of STs) as a model which obeys these laws;
this model is not necessary for the
further development, but meant as an aid to understanding. Chapter 7 is the core of the theory;
observation equivalence is
treated in depth, and from it we gain our main congruence relation, observation congruence, under which two prograns are congruent ~iff they cannot be distinguished by observation in any context.
Having derived
scme properties of the congruence, we use them in Chapter 8 to prove the correct behaviour of two further systems, both to do with data structures. In Chapters 9 and IO we look at sane derived Algebras.
One takes the
form of an imperative concurrent programming language, with a s s i s t statements, "cobegincoend" statements, and procedures.
In effect, we
show how to translate this language directly into CCS.
The other is a
restriction of CCS in which determinacy is guaranteed, and we indicate how proofs about such programs can be sir~ler than in the general case. Finally, in Chapter ii we try to evaluate what has been achieved, and indicate directions for future research.
CHAPTER
1
Experimenting on nondetenninisticmachines
ioi
Traditional equivalence of finite state acceptors Take a pair
={a,b,c,d}
S,T
of nondetezadnistic
acceptors over the alphabet
:
T
The accepting states of
S
and
T
are
s 2 and
t 2 respectively;
in non
deterministic acceptors we can always make do, as here, with a single
'dead'
accepting state. A standard ~
t
accept the same language
that
S
and
T
are equivalent, meaning that they
(set of strings), run~ as follows.
t i) to represent the language accepted starting frcm state get a set of equations for
S , and for
Taking
s i (resp
s i (resp t i) , we
T :
s O = as I
t O = at 1 + at~
s I = bs 2 + cs 3
t I = bt 2
S2 = ~
t I = ct 3
S 3 = ds 0
t2 = £
!
t 3 =dt 0 Here as usual
+
stands for union of languages,
e
for the language
containing ~nly the 6~pty string, and we can think of the symbol for a function over languages:
as = a(s) = {a~; ~ E s} .
Now by sinlole substitution we deduce s O = a(bc + cds0) . By applying the distributive law s O = ab~ + acds 0
a(s + s') = as + as'
we deduce
a
standing
10
and we can go further, using a standard rule for solving such equations known as Arden' s rule, to get sO = (acd)*abe . For
T
it is even simpler;
we get directly (without using distributivity)
t O = ab~ + acdt 0 and the unique solvability of such equations tells us that and
T
sO = t O , so
S
are equivalent acceptors.
But are they equivalent, in all useful senses?
1.2
Experimentin 9 upon acceptors Think differently about an acceptor over
{a,b,c,d> .
It is a black
box, whose behaviour you want to investigate by asking it to accept symbols one at a time.
So each box has four buttons, one for each symbol: a
a w
S
b
sO t
i d
There are four atomic e x p e r ~ t s aexperiment on
S
T
I
b
tO
you can do, cne for each symbol. Doing an
(secretly in state
s O , but you don't know that) con
sists in trying to press the abutton, with two possible outccmes in general: (i)
Failure  the button is locked;
(ii)
Success  the button is unlocked, and goes down (and secretly a state transiticn occurs).
In fact we cannot distinguish between by any single atcndc experiment;
S
and
T , in their initial states,
the aexperiment succeeds in each case, and
the other three fail. After a successful aexperiment on each machine, which may yield a S
bl
a #
s1~d t
.
T
b
i
d
t
t we may try another atc~tic experiment, in our aim to see if the machines are equivalent or not.
Clearly a bexperiment now succeeds for
S
and fails
11
for
T , though the other three e x p e r ~ t s
fail to distinguish the~.
trying the bexperiment, then, can we conclude that
S
and
T
After
are not
equivalent? No, because
S's response to the aexperiment could have been different
(for all we know) and locked the bbutton, while
T's response could have
been different (for all we know  and it could indeed') and unlocked the bbutton.
Following this argLm~nt further, we may feel forced to admit that
no finite amount of experiment could prove to us that
S
and
T
are, or are
not, equivalent'. But suppose (i)
It is the weather at any mcn~nt which determines the choice of transition (in case of ambiguity, e.g. aexperiment)
(ii)
T
at
t O under an
;
The weather has only finitely many states  at least as far as choiceresolution is concerned ;
(iii) We can control the weather . For sane machines these assunptions are not so outrageous; for example, one of two pulses may always arrive first within a certain temperature range, and outside this range the other may always arrive first.
(At the boundary of
the range we have the wellknown glitch problem, which we shall ignore here.) Nc~, by conducting an aexperiment an
S
and
T
under all weather con
ditions (always in their start states, which we have to assume are recoverable), we can find that
S's bbutton is always unlocked, but that
T's
bbutton is sc~etimes locked, and we can conclude that the machines are not equivalent. Is this sense of equivalence, in which a meaningful one?
S
and
T
are not equivalent,
We shall find that we can make it precise and shall adopt
it  partly because it yields a nice theory, partly because it is a finer (s~aller) equivalence relation than the standard cne (which we can always recover by introducing the distributive law used in §i.i), but more for the following reason.
Imagine that the bbuttons on
Then in all weathers every successful e x p e r ~ t visible button: S (with
b
hidden) is not deadlockable
S upon
and S
T
are hidden.
unlocks same
12
while in sc~e weathers, and after same experiments, all of
T's visible
buttons will be lo~ked: T (with
b
hidden) is deadlockable.
We wish to think of a nondeterministic choice in such machines as being resolved irreversibly, at a particular manent, by information flowing into the system from an unseen source;
if a deadlock can thus arise in one machine
but not in another, we do not regard them as behaviourally equivalent.
1.3
Behaviour as a tree Because we reject the distributive law
a(x + y) = ax + ay , we can no
longer take languages (sets of strings) as the behaviours of our machines. We proceed to an alternative.
Frcm now on we will use
NIL
instead of
e
to stand for a behaviour which can do nothing (= admits no experiment) ; we shall also use Greek letters for our ~ i s should consider
~,~,y ,5
 i.e. names of buttons  so you
as replace~_nts for
First, take the transition graph for
a,b,c,d
S
in our sinple example.
and unfold it into a tree with
states as node labels and symbols as arc labels:
B
Because state na~es are present we have lost no information; the state transition graph can be recovered frcm such a tree. see the state  he can only see the transitions.
But the experimenter cannot This leads us to drop the
node labels, and take the infinite tree
U as the behaviour of I Definition We are using
S .
a
A label is a n~mber of a given (fixed) label set ~,B,Y,.. to stand for labels.
A .
(The use of the word 'label' in
place of 'symbol' will be further motivated later.)
13
I Definition
A sort is a subset of A
We shall usually use
g
L,M,N, .. to stand for sorts.
We shall also often use
the word a~ent in place of 'madline' or 'acceptor', so 'S is an acceptor over the alphabet
Z'
becomes 'S is an agent of sort Definition
L'
A Rigid Synchronization Tree (RST) of sort
unordered, finitely b r a n ~ member of
L
is a rooted,
tree each of whose arcs is labelled by a
L .
Thus the tree in the last diagran is an RST of sort
{~, B, ~, 8} .
(It is also
an RST of any larger sort.) Why 'rigid'?
Because it is the behaviour of a rigid agent  one which
can make no transition except that corresponding to an atomic experiment.
We
shall soon meet other transitions. Why 'synchronizaticn'?
Because we shall later see how the oammunication
of two agents can be represented in fozrcing their joint tree frcm their separate trees.
Then the joint tree will not be rigid, in general, since
intercuf,udnication between cc~ponent agents is not observable. Notice that finite RSTs can be represented as expressions:
B//~
is
~ ~
is
(BNIL + ~NIL)
~BNIL + ~ N I L
and usually there is more than one natural expression: ~rIn + (~NIL + 7NIL) , or
is
(c~LL + BNIL) + yNIL . Indeed,
+
is both oactuutative and associative, since we declared RSTs to
be unordered trees  and
NIL
is easily seen to be a zero for summation.
To justify these remarks we nc~ define the algebra of RSTs.
14
i. 4
Algebra of RSTs Ignoring sorts for a mcn~nt, we have an elementary algebra over RSTs,
whose operations are: NIL
(nullary operation) NIL
+
is the tree
•
;
(binary operation) + A
is the t r e e ~
(unary operation, for each
(identify roots) ~
), ~ A)
They obey the follc~ing laws, as you can easily see: Associativity
x + (y + z) = (x + y) + z
Ccurnutativity
x + y = y + x
Nullity
x + NIL = x
In fact, these laws are ccalolete:
any true equaticn between RST expressions
can be deduced frcm them. If we consider sorts, and let then
NIL
is of sort NIL
Further,
and
~
~
L
for any
RST L
be the set of RSTs of sort
L ,
L :
RST L .
+
takes trees of sort
+
E
L,M
RST L × RST M ÷ RSTLu M
takes a tree of sort
L
respectively to a tree of sort
LuM :
,
to a tree of sort
Lu{l} :
We shall usually forget about sorts for the present, but there are times later when they will be essential. Consider now solving recursive equations over RSTs. ations for our agent
S
We wish the equ
of §l.1
s O = ~s I
s I = ~s 2 + ys 3
s 2 = NIL
s 3 = 6s 0
to define the (infinite) behaviour of
S
as an RST of sort
{~,8,Y,8} 
15
This set of equations has a unique, solution for the variables
s0 ' ""s3
;
you can see this by the fact that the entire tree can be developed topdown to any depth: =
sO
=
=
...
and so on.
Not every set of recursive equations has a unique solution; consider the simple equation s
=
s
which is satisfied by any RST (or anything else, for that matter) . Again, scrne sets of equatioD~ define no RST at all. s
=
s +~NIL
Consider the equation
;
a solution would have to be infinitely branching at the root.
Even if we
allowed infinitely branching RSTs, so that
would be a solution, it would not be unique since be a solution for any Exercise i. 1
sO + t
t . We defer this problem to Chapter 5.
Can you find a condition on a set of equations
sO =
Q
•
•
O
i
O
(with RST expressions involving si =
s O ,.. ,sn
on the righthand sides)
ooo S n
would also
=
which ensures that it possesses a unique solution in RSTs? (Hint:
1.5
consider cycles of
ctransitions in transition graphs.)
Unobservable actions Under the conventional definition, a nondeterministic acceptor may
have transitions labelled by fication of our
R
S
~ ~ the null string.
Consider
R , a modi
of §i.I (reverting briefly to Rcn~ml alphabet):
a
~
~
d
~
~
16
(The loop fomaed by the
dtransition is irrelevant to our ccrnparison.)
In the conventional sense,
R
and
S
are equivalent.
But what does the
ctransition mean, in our more mechanistic interpretation? R
in state
r i (i.e. after the
r I' , and that if a
move silently to state
It means that
abutton has been pressed) may at any time bexperiment is never attesloted
it will do so. Thus, if we attespt a
bexperiment on
R , after the successful
experiment, there are sc~e weather conditions in which we find the button peamanently locked; (after the
if on the other hand we a t t ~
a
a
b
cexperiment
aexperiment) we shall in all weather conditions find the
cbutton eventually unlocked (eventually, because although little t ~
to decide on its
R
may take a
etransition, it will do so since no
b
experiment is attespted). Exercise 1.2 and
T
Use this as the basis of an ~
are equivalent.
t
that no pair of
A rigorous basis for the a r ~ t
R, S
will be given
later. Let us return to our Greek alphabet, and ask how we should write the equations specifying e
R's behaviour.
We choose the symbol
T
in place of
(to avoid confusion with the null string), and use it as a new unary
operation uponbehaviours. r0,..,r 3
The equations dete_~mining the behaviours
are: !
r 0 = ~r I
r i = 8r 2 + xr~
r 2 = NIL
r 3 = ~r 0
We are ass~aing that Definition
r I = yr 3
T % A (the fixed label set).
A Synchronization Tree (ST) of sort
L
is a rooted, unordered,
finitely branching tree eac~ of whose arcs is labelled by a ~ r Lu{~}
of
.
Thus a rigid ST (an RST) is just an ST with no arcs labelled
T ;
it is
the behaviour of an agent which can make no silent transitions. Since we are taking the unary operation
we can of course deduce the STbehaviour of
T
R .
over STs to be given by
It is
17
Y
y

STs are a sinlole and useful notion of behaviour.
They are just the
unfoldings of behaviour equations, which in turn follow directly fran transition graphs.
Of course in this way different transition graphs can
yield the sane ST, frcrn which we can be certain that they are i n d i s ~ s h 
able by experiment. Exercise 1.3
Convince yourse1_f that the transition graphs
have the same unfolding. However, different STs (or transition graphs yielding different STs) may be indistinguishable by experiment.
This is true even for RSTs;
consider the simple pair
each of which adaits a single
~experiment and then nothing else.
But it is even more true in the case of unobservable actions. we shall study an equivalence relation, c~servation equivalence,
Later
over STs,
which can (for finite STs) be axicmatized by a finite set of equations added to those given in §1.4 above.
To get a foretaste of the equivalence
consider the following exercise. Exercise 1.4
ExamiD~ each of the following pairs of s ~ p l e STs and try to
decide by infozmal ~ t ,
as in Exercise 1.2 above, which are observation
equivalent (i.e. indistinguishable by experiment).
You may reasonably
conclude that four pairs are equivalent, or that six pairs are equivalent, but you should also find that the notion of equivalence is not yet precise. Ehe point of this exercise is that it is not trivial to capture our infozmal arguments by a precise notion.
oH~
oH ~
c~
o~
v
~
f
O
~o
Chapter 2
Synchronization
2.1
Mutual experimentation ~he success of an
sexperiment enables the machine to proceed (to
offer further experiments);
it also allows the observer to proceed (to
attempt further experiments).
This suggests an ~bvious symmetry;
we
would like to represent the observer as a machine, then to represent the ccmposite observer/machine as a machine, then to understand how this m c h i n e behaves for a new observer. How should two machines interact?
S
~
T
0
We must say which experiments offered by which experiments of
T
S
may combine with or (ccraplement)
to yield an interaction.
label correspondence (e.g.
a ++~, ~++ n)
for each machine ccmbination,
we introduce a little structure on our label set We ass~ne a fixed set
A
of names.
Rather than set up a
We use
A. ~, B, y, ... to stand for
names° We assume a set with it;
o~(~A) ~ and we call we have
~
of conames, disjoint frc~
~
~.
Using ( ) also for the inverse bijection,
~ = ~.
to range over
A.
A =
A u
We call
to be our set of labels. l
and
[
in particular for any sort
L,
~, = {~;
We shall scmetimes need the function name(a) = name (~) = which we extend to sorts by defining
We shall use
X
cc~plementary_ labels.
The function () is now a bijection over A;
and in bijection
O)
~ ~2 ~n = p, P = P0   ~ P l ~ P2 . . . . . >Pn " Now consider the result(s) of performing a sequence experiments on
p
k0 P •
(n ~0).
ki lIT
~l,...,In
The result may be any
p'
of atcmzic
for which
kn 12...I T ...... n > p'
(ki > O)
;
that is, an arbitrary number of silent moves may occur before, among and after the Definition
I.. 1 for
s ~ A* , define the relation
P s___>p, iff for sc~e
Tk01sTk112. •.
" p
if
s = I I " " % n ' then
in~kn >p'
sexperiment
" p
s
(se h*), and then
admits an sexperLme/~t and can transform to
also say more briefly
by:
k 0 ..... kn_>O
p We may talk of an
s
~
can produce
Note that for the empty sequence
p'
p ~ p'
under
p,
means
as a result" ;
we may
s ".
E • A* , an eexperiment ccnsists of
lettJ_ng the agent proceed silently as it wishes, while observing nothing; for ~.~ have p ~
p'
iff for scme
Note also the special case
p ~
k>O p
when
k p ,,,~,~ p' . k = 0 .
Now we can state in words what we shall mean by equivalent agents. p
and
q
are equivalent iff for every
(i) For every result
p'
of an sexperiment on
is an equivalent result (ii) For every result equivalent result
q' p'
se A*
q'
p , there
of a sexperiment on
of an sexperiment on of a sexperiment on
q .
q , there is an p .
42
qhis appears to be a circular definition (the formal definition will take care of this point) but note first that it implies that, for each
s , p
admits an sexperiment iff
But it implies much more;
q
does.
for example, the two ST's
admit exactly the same s  e x p e r ~ t s ,
but neither of the two possible
results of an sexperiment on the first tree is equivalent to the result of an sexperiment on the seccnd. The motivation for our definition is this: on, perfomT/ng an e x p e r ~ t ,
we imagine switching
and switching it off again.
equivalent, it must be possible to switch
q
For
p
to be
on, do the sane e x p e r ~ t ,
and switch it off in a state equivalent to the state in which switched off (and the same, interchanging
q
p
and
p
was
q ).
Our fomnal definition is in terms of a decreasing sequence ~0' ~i . . . . .
=k ....
of (finer and finer) equivalence relations:
Definition (Observation equivalence)
Exercise 3.3
(i) if
p =>
S
p,
(ii) if
s q ~
q,
iff Vk>O.
then for scme
q', q ~
s
q,
then for same
p', p ~
p'
P ~k q
(a) Prove that each
induction on that
is always true;
iff V S e A*
P ~k+i q
p m q
P ~0 q
p ~k+l q
k .
(i.e. ~ = ~ = k k
~k
q "
and
p,
~k
q,
;
P' ~k q' ;
)
is an equivalence relation, by
(b) Prove by induction that
ini°lies p ~
and
~k+l c_ ~k ' i.e.
43
This equivalence relation has many interesting properties, which we need not exmnine until Chapter 7  except one or two. First, it is not necessarily true that recurrence relation defining p~q
~k+l
V s e A* s p~ (i) if p = >
~
itself satisfies the
in terms of
~k ' that is, the property
iff
(ii) if
(*) then
~> q,
q
then
3q'.q S > q , 3p'.p
s> p,
& &
p,~q, p,
~q'
(which is a formal version Of our verbal recursive definition of equivalence given earlier in this section). but not in general. one which satisfies
It is true if
case we shall call
~cise ~[
3.4
and
q
are finite STs,
However, our definition has nioer properties than (*).
For STs, our binary relations t _~I t' (resp. t
p
T> t') t'
iff
a
and
T.
has a branch
are obvious; It' (resp. Tt').
lson (resp. •son) of
Prove that
inductive proof that
t
)'>
t ~ Tt
for
STs.
In this
t .
(You need a veiny simple
t ~ k ~Zt).
Let us consider one exanple of equivalent STs:
t
To check equivalence, i.e. step:
t ~u
implies
identical trees under and
t ~k u
t ~
t ~k+lU. s ; ~lder
by induction.
u
for all
k , we must prove the inductive
Now for every
s~ c, t and u produce
e , t produces only
t
and
u
cnly
u ,
44
Definition
(Note that
If
P s p,
p
(o e A*)
p'
is an sderivative of p.
is always an sderivative of itself).
rephrase the definition of " P ~k+l q
Zk+l
iff, for all p
Exercise 3.5
in t e ~
s(A*
and
q
up to
of
We can thus
~k :
, sderivatives
have the same
~k
equivalence.
"
Reexamine Exercise 1.4, and verify precisely which pairs are
observation equivalent.
Exercise 3.6
then
(Deadlock)
You should find exactly four pairs.
Prove that if
p~q
is true of both or of neither, for given "It is possible to do a
11 . .. In
reach a state where a
then the following statement 11,. .. ,ln,ln+ 1 :
experiment and
kn+iexperiment is impossible"
One property of agents is not respected by our equivalence. possible for
p
and
q
to be equivalent even though
p
It is
possesses an
infinite silent cc~mputation P J~ Pl  ~ {diver~enoe)
while
P2  ~ q
.... Pk ~
Pk+l ~~
cannot diverge in this way.
be refined to exclude this possibility.
3.4
"'" The equivalence can
See the remarks in §7.3.
Proving the scheduler It is ~ s o m e
to use the direct definition of ~ ; we shall instead
use a few of its key properties, ~hich are derived fomaally in Chapter 7. We begin by listing them, so that Chapter 7 need not be read first. (~ 1 )
t ~ Tt
NoW we can see that t
by
t' (when
(see Exercise 3.4) ~
is not a ccngruence relation;
t ~ t ')
exanlole , N I L ~ TNIL,
in
but
u
to get
~NIL + NIL
u'
that is, replacing
does not ensure
~ ~NIL + TNIL •
u~u'.
For
45
I Exe_r_cise 3.7
Verify this fact.
So ingeneral
t ~ t'
other operations do preserve (~ 2)
t ~ t'
t + u ~ t' + u .
does not imply
implies
But all our
= pt ~ ut'
(.see below for
tlu~t'lu
and
~ )
ult~u'It
t\~ ~ t'\~ t[S] = t'[S] Fortunately, too, when we apply a guard p to equivalent STs get not cnly
pt~t',
but
ut ~ pt' , where
t,t'
we
~ is a strQnger relation than
which is preserved by all our operaticns. (~ 3)
~
is a oongrue.nce relaticn, and t c t'
inplies
t ~ t'
Beyond these, we need one more property ~ i c h may look a little surprising; we leave its discussion to Chapter 7 . (~ 4)
t + Tt c Tt
Apart fran this, the proof below will use only rather natural properties of our operations, including the Expansion ~heorem, all justified by Qhapter 5. ~
treat only the first constraint, namely S~h
Define the left
[I (~i
I " ' " IBn '~ ) ~
hand s i d e t o be
(%"  ..~n )~
Sch'
satisfies the defining equation of
.
(I)
We s h a l l
actually
show t h a t Sch'
(~i o . .~n )~ , namely
Sch' ~ ~ l " " ~ n Sch' .
(2)
frc~ which (i) follows, by general principles which we shall not treat here (but see Exercise 7.7). We may write SCh' =
Sch'
as
(s fell ... I C'n)\71"''\Yn
(using general properties of
I and \e ), where
C'l = (ci I B~m)\~il represents the ith cycler with
(3)
(4) ~i
pe~nitted.
Now we shall discover
46
below that w
Yi~iYi+l c ,l'
C
Ci so ~
(5)
can use these expressicns interchangably, by (~ 3), to assist our
expansion of Sch', which runs as follows:
schl
c
(?:[NILIYI~I?2c; I . . . . t ~ n % ? l C n , ) \ ¥ 1 . . . \ ¥ n
C


(the start buttcn has worked)
c ~h~2"
.~npf~ p,", p , ~ p~, q 4 c~y > p..., p,, pr~ p , ~ p,"~ p,"~ p r , p~, q •
After
.etc .....
n
Exercise 4.1
u's, 2n  I 7's (and no more) can have occurred. (For fun).
Describe the behaviour of
precisely  e.g. how many Exercise 4.2 which
y's
p~q
a bit more
must have occurred after
Build a counter of sort
n
~'s?
{i ,6 ,~}
(i) Can always be incremented by an 1experJ/nent; (ii) Can be decremented by a fexperiment if nonzero; (iii) Can admit a ~experiment only when it is zero. Hint:
in state
about
n
by one;
n, it will be sGmething like a chain of
cells.
Incrementing must increase the cellcount
d~ting
must decrease the cellcount by one by
causing one cell to die  i.e. became NIL.
You m y
need a
doubly linked dnain, built by a suitably generalised chaining operator, and looking like
"0:
0:
But our calculus so far has an irmportant restriction which makes it inadequate for programming;
all ccm,I~mication is pure syndqronization,
and no datavalues are passed fram one agent to another.
True, we could
in principle 'read' the contents of the counter of Exercise 4.2 by. seeing how many decrements (6) are needed before a ~ Tnis would be ~ c m e ,
(test for zero) is offerred.
to say the least, and for the counter as specified
it would destroy the count stored in it:
49
So we now proceed to a generalisation of the algebra. so we are forced to abandon our ST interpretation. place must wait till Chapters 5 and 6;
In doing
What takes its
meanwhile the reader must
realise that  for example  the equality symbol between our more general behaviour expressions is not explained in this chapter.
4.2
Pass in~ values Consider the simple behaviour
%_
P = ~ 8 ~ p
S~p~8
It's no more than the cycler of Exercise 2.7, but if we think of positive labels (e,8) and negative labels
(~)
?
as accepting input pulses,
as giving output pulses, then
p
beccmes
a behaviour which "gi~_s an output whenever it has received two inputs" (the inputs being demanded in a particular order). Suppose that an input at a value (an integer, say).
~
consists of more than a pulse;
it is
qhat is, attempting an aexperiment on
consists of offerrin9 a value to
p
at s .
p
We may then wish to represent
p 's behaviour as p = ex.where
x
is a variable (supposed to become bound to the value received
in an sexperiment), and    is sc~e behaviour expression _dependent upon x
x , i.e. containing
is bound by
x
as a free variable.
We say that the variable
a, and its sco~e is    .
(This is very f~niliar to anyone who knows the lcalculus;
the difference
here is that any positive label e may bind a variable, while in the lcalculus there is only one binder  the symbol "I".) We can go further, in our aim to transfo~n
p
into a behaviour whose
output values depend on its input values, and write p = ~x.Sy.   Here
8
binds the variable
while the scope of
y
since then any occurence of to
x ;
y .
Note that the scope of
is just    . x
the value bound by
x
is
By.,
(It would be stupid to write
ax.Sx.
in    would refer to the value bound by a
to
x
is inaccessible.)
50
Suppose we want the s~n of
x
and
y
to be output at
~ .
That is, in general for negative labels, attespting a ~experi1nemt on
p
cc~sists of ~ d i n ~
a value fram
p
at
~ .
Thus negative
labels do not bind variables  instead they qualify value expressions (which may contain variables).
SO we write
p = ~x. 8y.~ (x+y) .p it is now proper to talk of an " ~ vexperiment" rather than an "~exp~_r~t",
where
v
is the value submitted by the c~server, and
similarly of a "~ vexperiment" where observer.
v is the value received by the l So, generalising the relation ~ of §3.3, we say p X_~Vp,
means ,,p admits a I v  e x p e r ~ t ,
and can
transfozm to p' as result". (Note the different sense, according to the sign of I .) As a general rule then, we can state ~x.B where
v
eV~
is any value,
B{v/x} B
B{v/x}
is a behaviour expression, and
the result of replacing all unbound occurrences of
x
in
B
by
means v.
And similarly (more sin!sly) ~v.B
~V;B
for the 2articular value on
v o
So the following derivation is possible
p: p = ~x.By.~ (x+y) .p ~3 ~ By.~(3+y) .p 84 ~ (3+4) .p
~7~
p
(See §4.4 for more about derivations.) Now we have hardly anything more to add to our language before finding that it can be used conveniently for progranming.
As for its inter
pretation, we can introduce a generalised fona of ST which we call Cxa~,t~nication Trees (C~), but for the present we wish to rely on intuitive understanding.
51
We shall usually be handing expressions of the fo~m [ ~ixi.B i i ! Bi,Bj, ~ It
where
and the
E
+
[ ~jEj.B i j
+
[ T.B~ k
are behaviour expressions, the
are value expressions.
xi
are variables,
As for expressions involving
3 cc~position (I) and the other operations, it will be enough to look at a simple example and then give a generalised Expansion Theorem (§2.5). Consider B = (~x.B I + BY.B2) i ~v.B 3
We expect a s~n of 4 temas, one involving
~ :
B = ~x.(BII~v.B 3) + 8y.(H21~v.B 3) + ~v.((ex.B 1+Sy.B 2) I B 3) + Y(HI{v/x}IH 3) Note that the "label" • does not bind a variable or qualify a value expression.
We shall also reselcve the right to use other labels in
this simple way when they only represent synchronization. shall allow a positive label to bind a tuple
x = Xl,...,x n
variables, and a negative label, to qualify a tuple value expressions;
g
of (distinct)
E = El,... ,En
of
then for pure synchronization we just use Otuples.
We shall use the term guard to ccr~prise the prefixes and use
In fact we
to stand for a guard.
Dijkstra [Dij]
~,6~
and T,
invented the notion
of guard, to stand for same condition to be met before the execution of a program part. is
It is natural to adapt it to the case where the condition
the acceptance of an offerred c~Lunication, as Hoare [Hoa 3] has
also done in his CSP.
We then find that the analogue of Dijkstra's
guarded ccn~ands is provided by st~mation; Egk. ~
we refer to an expression
as a sum of 9~ards, and call each
expression.
Expansion Theorem Let
gk'~
a s ~ n a n d of the
We denote the nan~ of g's label by name(g). (stated and proved as Theorem 5.8).
B = (Bll...IBm) kA , where each
Bi
B = [{g.((BIO...IBII...IBm)\A) ; g.B l
is a s~n of guards. a summand of
+ ~{T.((BII...IB~{~/~}I...IB~I...IBm) A); Hi, eE.B 3
a summand of
B 3• ,
~.B'.l
g.
Bi, name(g)% A} a simTnand of
i~j}
provided that, in the first tena, no free variable in by
Then
Bk(k ~ i)
is bound
52
The meaning
of the Theorem is that all unrestricted actions and all
internal c~,~Lunications in
B
may occur.
Note that our language contains two distinct kinds of expression value expressions and behaviour expressions. the first kind, B the second.
Consider
~ E.B ;
E
is
We allow the following simple but
important constructs in our language: (i) Conditional behaviour expressions. if where
E
E
then
B 1 else
B2
is booleanvalued.
ex.(if x>O
then
Consider for example
~x.B
else
{x.B)
(ii) Paraneterised behaviour definitions. a(y) = ax.(if
x>y
then
(iii) Local variable declarations. let
x=6
and
y=lO
in
For example:
~x.a(y)else
{x a(y))
We shall allow constructs like B
and B
where
x = 6
and
y = i0
.
They mean exactly the same  namely, the same as substituting 6
for
x
and
i0
for
y
throughout
B.
We hope that the language is simple enough to be understoc~ intuitively, without fonmal syntax.
4.3
An example

Exact f o ~ a t i o n
comes later'
Data Flow
We will now show how to build and verify a simple system which bears a strong relation to the Data Flow Schemata of Dennis et al [DFL] o The task is to build a net which will ccmpute integer
2x
for arbitrary nonnegative
x , given components for cc~puting more primitive functions and
predicates, and same standard gating and switching ~xml0o~ts.
That is,
we want a net whose behaviour is observation equivalent to a = ix.o2 x. a (We shall often use standard ccm~nents.
~
(i) for input, o for output).
First, we define same
53
(i) Unary functic~ agent For arbitrary unary function DO f
=
f , we define the agent
ix.o(f(x)).(DO f)
(2)
~DOf/
0 we shall only use sinple f's ; we are actually trying to build the b e h a ~ o ~
~b~p where
bexp (x) = 2x , as you can see by oanloaring (I) and (2).
(ii) Unary predicate agent For arbitrary unary predicate
p , we define
A S K p = ~x. i_~fp(x) then
olx. (ASKp)
else
~2x. (ASK p)
Note that the value
x
4 ol
o2
is passed unchanged out of one of the
output ports. (iii) A ~ate
4~I C~TE
=
~x.ox.y.GATE
~ G ~ /
%~e gate transmits a value unchanged, but n~st be r e  ~ e d
at
y to repeat.
=
ix.y.ox.TRIG
TRIG
y~T~G/
Like a gate, but must be triggered (or trigger sc~neone
O
else') after receipt and before transmission. (v) A source For arbitrary constant value
v , a ~ent
source of
is given by DOv
=
~.ov.(DOv) O
We use
D O , because the unary function agent is easily
generalised to just
nary function agents, and constants are
oazy functions.
v's
54
(vi) A sink SINK
=
Ix.SINK
~S'INKy
For discarding ur~anted values. 1
(vii) A switch
t
SWITCH
=
Ix. (YI.OlX.SWITCH + Y2.o2x.SWITCH)
Y1 ~~TI~y2 o/
02
A generalisation of a trigger; triggering
Yi
selects output port
This is all we need for our example;
oi "
it is not a cc~plete (or necessarily
best) set, and it would be interesting to design a good set of cc~ponents which could be shown adequate for a wide class of dataflow computations. We would like to factor our design into a control part and a controlled part.
For the control part, it will be convenient to build
an agent observationequivalent to x times CONTROL = ix:y. • • • .y.'~.CONTROL i.e. for input
x
it will admit
x
and return to its original 'state'.
(3)
yexperiments followed by a 6experinent, We show the net for realising CONTROL;
it can be shown by Expansion to satisfy an equation like (3) with many intervening w's, and this is observation equivalent to CCNTROL, as we shall see in Chapter 7.
55
I
i I !
CONTROL
I
t I
\ \ ! ! ! b i
\
i i : I
t
Y \ I
\ ##
\ % %
6
# ! I I I
  I I I !
One can check for the right b~haviour infozmally, by "arrowswinging". Note that the initial state is restored, and that if either trigger is replaced by a gate then 'overtaking' can occur, yielding the wrong behaviour.
56
The oontrolled part, or body, is to admit a value then after
n
v
at
~' ,
yexperiments follow~d by a ~experiment it will emit
× v at o and restore itself. BODY = 1'y. b(y)
That is, we want to realise
where
(4)
b(y) = ~.b(2y) + ~.oy.BODY
I' BODY
~
i ¢ s j r
s (k
I
"Irr~
I
!
i Exercise 4.3
Put this net together, as a restricted ~ i t i o n
of
relabelled standard components, and show that it satisfies an equation like (4) (but with intervening T's), using the Expansion Theorem.
57
Having established the behaviour of BODY and C ~ L ,
it is a simple
matter to put them together in sud% a way that an input
x
to the
whole system first gates a i into BODY, then enters C O N S U L itself. ~e
outer pair of gates (present also in BODY and CONTROL) is to
prevent overlappin 9
of successive ccmputations. I
II t
DO bexp
!  1 I
t I 1
I !
t 1
BODY
7
k~ %
L
T! ! I
O
58
Exercise 4.4
Treating BODY and CONTROL as given by (3) and (4)~put
the net together as in the last exercise, and show that it behaves like DO be~xp, but with intervening
T's.
See (i) and (2).
The exa~ole shows how nets may be built in modules which are verified separately.
There are two remarks:
(i) The use of the Expansion Theorem is tedious, but as we mentioned earlier it can be mechanised. (ii) We have implicitly assigned that if two behaviours are observation equivalent, then replacing one by another in any system context will yield an observation equivalent system.
(This is what justified our treatment of BODY
and CONTROL  replacing them by their s ~ c i f i e d behaviours). This asstmption is justified for the contexts we have considered, but it is not trivial to prove that this is so.
Exercise 4.5
Construct data flow nets to cc~pute the value of
input values
x
and
y
frcm
y , for each of the following prograns:
(i) while
p(x)
do
(y:= f(x,y) ; x: = g(x))
(ii) while
p(y)
do
(y:= if q(x,y) then
f(x,y) else
f(y,x) ;
x:= g(x) ) You will almost oertainly need same other 'standard' agents, and a different way of handling predicates  since the construct 'ASK q' doesn't generalise very well for nonunary predicates.
4.4
Derivations In
§4.2
Similarly,
we gave an exarmple of a derivation of
B = ((~x.B1 + 8y.B 2) I ~voyzB3)\S
p = ~x.Sy.y(x+y).p :
has derivations
B ~ (B1{5/x} t ~v~z.B3)\S ; B ~>(B2{v/y} I YzB3)\8
~
(B2{v/Y} I B3{7/z})\8

59
A general derivation takes the form B
PlVl) BI____ ~2v2 ~B2
__.>...
p v n n B n
(which has length
n) or may be infinite.
derivation of length n as UlVl ~2v2
We shall often ~a~ite a ~1vl.~2v2..
Pnv ,
or
....
B
~
v
n n, B
n n we can abbreviate
B J~B' m
and abbreviate
by B ~ B'
(n >O)
n
B ~ . ~ V . T B'
k57 B ~ > B '
(m,n >_O).
(see also §3.3). A cc~01ete derivation is either an infinite derivation, or a finite derivation which cannot be extended (this means Exercis____~e4.__66 Using equations (3) and (4) in
I
derivations of BODY, ~ L
B
n
= NIL).
4.3, write sc~e of the
and (BODY I CONTROL)\y\6 .
derivations are there?
A ccrmplete finite derivation of
B
represents a possibility that
can reach a point where no further action is Ix)ssible;
4.5
What ccr~piete
B
it may deadlock.
An example  Zero s ~ c h i n ~ We want to set two agents
a root for the equation function
p
f(X) = 0
and
q
in the range
[A,B] , for a continuous
f , knowing that such a root exists  i.e.
It is natural to make
p
and
q
calculate
and concurrently, for two internal F~ints
If
to work together in finding
p
finishes first, and finds that
he can leave a message for
q
A'
f(A) ×f(B)  NIL
as the only complete deri~ation~ and we are done.
For size > O, we can
use the Expansion ~qeore~ to show the following, which is enouc~ to cfm_~_lete the proof: conditions (i) and (ii) , every complete derivation of Sys(A,B,a,b,X,Y)
extends a derivation
T,T
' ~ Sys(A',B',a',b',X',Y')
where the parameters again satisfy (i) and (ii), and (a) if
X = £[A,B]
and
(b) otherwise either X' = £[A,B]
~
Exercise 4.7
t I
and
Y = r[A,B]
[A',B']
then
[A',B']
has ~naller size;
has smaller size or
[A',B'] = [A,B],
Y' = r[A,B] .
Verify the above statement by expanding
Note that the interval decreases in size after ~
Sys(A,B,a,b,X,Y). cc~outations, though
not always after one.
_Exercise 4.8
It isn't necessary for
distinct ports. and similarly E~ercise 4.9
P and q Redesign Int so that ports e I , 81
e2' 82;
Int through are identified,
it's easy but not cc~pletely trivial.
Kung remarks that a rcotseardli~ algorithm for three
cooperating agents can be designed so that the interval subdivision adoptS one of the two patterns
~/4
~./4
~/4
. Program this algorithm.
~/4
~/3
~/6 ~/6
9./3
64
I Exercis____~e 4.1___OO Suffuse that p (q similarly) can pause during its evaluation of f (X) at certain times, to ask the interval "should I continue or start on a new point?" Adjust the in~ agent to respond to these interrupts.
CHAPTER 5
Syntax and Semantics of CCS
5.1
Introduction We have seen some examples of expressions of OCS, representing both
programs and their specifications.
We sm~ that, with the introduction
of valuepassing, we had to abandon the simple interpretation of behaviour expressions as syndqronizaticn trees, but in §4.2 we talked of atamic e~periments on behaviour expressions
(or on the behaviours for which they
stand), and this was developed further in §4.4 on derivations. We are now reaahy to present CCS precisely, and to define precisely the atnmic actions (and hence the derivaticns) of every OCS program.
On
this basis, we proceed in this chapter and in Chapter 7 to develop our central notion, observation equivalence of programs. short step to a congruence relation; iff they are observation equivalent in every context.
Frcm this it is a
two prograns are observaticn congTuent (i.e. indistinguishable by observation)
Our proposal is that an observation congruence class is
a behaviour, so that 0CS is indeed an algebra of behaviours, in which each progran stands for its congruence class. This main development is independent of the notion of ST. now be regarded as a first approximation
STs may
(not sufficiently abstract) to a
model of CCS without valuepassing, and in Chapter 6 we show how they may be generalised to CTs (cca~m~ication trees) to give a first approximation to a model of OCS with valuepassing;
again, the main development is in
dependent of CTs, which are only discussed to aid understanding.
~hen we
eventually define observation equivalence over prograns in Chapter 7, it will look just like the corresponding definition in §3.3 over STs, which generalises to CTs in an obvious way.
Indeed, we expect to find that two programs
are equivalent iff the correslxlnding CTs are so;
in that case CTs, though
not technically essential, fit naturally into our picture. ~his chapter is devoted to a ocmgruence over programs which we call stron~ congruence, since it is stronger than the observation o0ngruence studied in Chapter 7.
By approaching our proposal in two stages we intro
duce the properties of behaviour gradually, and with greater insight than if we tackled observation ccngruence immediately.
In fact we even subdivide
the first stage in this chapter, approaching strong congruence via an even
66
stronger relation called d i ~ c t equivalence. The CCS
language
was introduced in the author's "Synthesis of
C~,~nicating Behaviour" [Mil 3].
However, the semantic sToecificaticn
by derivations was not given there in detail.
Value e~0~ssicns E Value expressions are built frGm (i) Variables
x,y,...
(ii) Constant s y ~ I s ,
and functicn symbols standing
for knc~n total functicns over values using conventional notation. value expressions.
We also allow tuples
(El .... ,En)
of
ThUS each value expressicn without variables stands
for a uniquely defined value;
we shall not worry about the distinction
between such expressions and their values. We shall also avoid details about the types of values and value expressions, though we shall have to mention sane syntactic constraints depending cn such details (which are standard). Labels, sorts and
[email protected] As in Chapter 2, our labels are We use
e,8,.,
A u{% } .
to range over
A = A u A , together with
~, I over A, and
A sort L is a subset of A ;
u,v,..,
~.
to range over
to each behaviour expression
B will be assigned a sort L(B). % A relabelling
S : L÷M
However, scme positive labels and the~ that
S
~
between sorts ~
L
and
M
is as in §2.2.
will be used to bind (tuples of) variables,
will qualify (tuples of) value expressic~s;
preserves the sign of such labels
we must ensure
(i.e. S (e) e A ).
Moreover, in
a ccr~plete treatment we should have to assign types to value variables and value e~pressions, hence also to labels, and to ensure that relabellings respect the types of labels.
We will avoid these details;
they need care,
but would only obscure the more important aspects of semantics which we want to discuss here. % We shall only meet finite sorts in examples. However, all we need to ass~ne  for technical reasons  is that A is never exhausted. Infinite sorts may be of use; see the end of Chapter 6.
67
Behaviour identifiers ~
b
presuppose a collection of such identifiers, each having
preassigned (i) an arit~ (ii) a sort
n(b)  the n~m%ber of value parameters. L(b).
We assume that the meaning of such identifiers is given, often r ~ s i v e l y , by a behaviour expression. behaviour identifier p
For example, in §4.5 we gave meaning to the
by
p(x) = ~i(x,f(x)).~gx'. p(x') where
n(p) = i, L(p) = {~i,~2}
o
Again, a cGmplete treatment would specify not just an ~ type (i.e. list of parameter types) for each
Behaviour expressions
but a
b .
B
Behaviour expressions are formed by our six kinds of behaviour operator (§4.1), by parameterising behaviour identifiers, and by conditionals. It's convenient to present the forma~tion rules as a table (see below), giving for each expression
B
its sort
L(B)
and its free variable set
FV(B). We should regard the language given by the table as a core language, which we are free to extend by defining derived behaviour operators chaining ccmbinator
~
(the
of §4.1 for example) and by alternative syntax
for cc~monly occurring patterns. In what follows, we shall use ....
}
to denote the result of substituting expression x i (i s i ; we shall call such
We shall oontent ourselves with a rather
I , \~, [S]
using pictures of branches, rather
than defining them formally in temas of multisets.
,I.......
(binary operation) I~CTL x C~fM÷ CTLu M
Let
tcCTL, ueCT M.
Then
tlu
has the following brandles:
vI
v0 (i)
For each branch
vo
vI
Tc~
"
of t, a branch
T~
(ii) For each branch ~ /
(iii) For eachbranch ~ T
of t, a branch 
X
of t, a branch
i
88 and similarly for the branches of u. (iv) For each pair of branches
[
of t, and
of u,
a branch
and similarly for brandles (~nus an output branch of input branch.
>
of
for each member
for every
v
u;
and
are in the
v.
List the atomic actions of the typical CT diagrammed in
§6.1.
IF~ercise 6.4 or
Prove that
tI + t2
~ v t'
iff either
t 1 ~v> t'
t2 ~ v t'. Exercise 6.4
action relations the rules Sum+
gives a hint of the h ~ y ~v
we expect between the
over CTs and over prograns.
For if we recall
of §5.3, we can rephrase them as follows:
B I + B 2 ~v > B'
iff
either
B1 ~V~B,
or
B2 ~ > B '
(the 'iff' being justified by the fact that S~n+ is the only rule by which actions of
Bi + B2
Similarly, the CT
can be inferred).
~f, which is the multiset whose only member is
, has only the actions ef
ev> f(v) , for each
v,
which we can cc~pare with the fact, frcm Act+ (1) in §5.3, that the program
ax.B
has only the actions
~x.B ~v> B{v/x}, for each Exercise 6.5 the CT
v.
Using the definition of
I over CTs in §6.2, show that
tllt 2 has exactly the actions
(i)
t. It^ ~v t' It^ when _fLY_ , (ii) tllt 2 tllt 2 when (iii) tllt 2 T t~it ~ when
Cc~pare Corn+ in §5.3.
t~ ~v t' ; ~ , t 2 ' t2; tl lv t~
~v and
t2
!
t2.
93
Surely then the atomic actions of related.
B
and its CT
[B ~ are closely
We state the relation in a theorem:
Theorem 6.2 (i)
If
B
(2)
If
[B~
Proof
WV>B,
then
Wv>t,,
~
Uv> ~,~;
then for same
B', B
Mainly by induction on the structure of
is needed when
B = b(9),
~v>B,
B;
and
[B'~ = t I.
but particular care
and the asstmlotion that the b's are guardedly
well defined is important. In other words, the atcmic actions of where
B
~v >B'
is an atomic action of
[B~ B;
are exactly
~B~
Wv > [B'
this means that in con
sidering atrm~c acticns, it makes no difference whether we think of programs or of the CTs that they stand for. The next step is to show that this holds too in considering strong equivalence.
6.5
Strong equivalence of CTs We proceed in the sane style;
that is, we define strong equivalence
(~) over CTs independently, and then show how it hanmonises with strong equivalence of programs. ~
Our definition is entirely analogous to that of
for programs (§5.8) ; we use a decreasing sequence
~0' ~I '"" "'~ k'""
of equivalences:
Definition t~k+lU
t~0u
is always true;
iff for all
u,v
(i)
if
t
~v. t'
then for same
u',
u ~v ~ u' and
t' ~k u';
(ii)
if
u
Bv
then for some
t',
t Bv
t' ~k u'.
t~u
iff V k >0.t~ku.
u'
t' and
Although we don't need it at present, we may as well state the a n a ! ~ of Theorem 5.4.
Theorem 6.3 precisely,
~
is a congruence relaticn in the algebra of C~s.
t l ~ t 2 inlolies
More
94
tI + u ~ t 2 + u , u + t i ~ u + t
2
~v0) by B  ~ B ' m n B ~" ~v.T >B' (re,n_>0) by B
We abbreviated
~v >B'
More generally, we now abbreviate
~ . ~iv:Tm~ ....~kVk. ~ B
by
B
(k> 0, m 0 .....ink> 0)
~B'
~IVl ..... ~ k V k B '
which includes the above cases (they correspond to k = 0, k = i).
It also
includes the possibility
means
B
Tm
>B'
for some
m>0,
~i =
T, so that for example
while
m >0 ; but usually we shall have For each
s =
e~ >B'
means
B S>B'
define Observaticn Equivalence
B
m
T ~B'
for sane
u ic A.
XIv I ..... IkVk ~(A × V)*, ~
relation, and each instance
7.2
B
B ~B'
=
is the sexperiment
is called a sexperimemt.
We now
in tezms of sexperiments.
Qbservatic n equivalence in CCS Analogous to §3.3, =
of equivalences:
is defined for programs by a decreasing sequence
99
Definition
B z0C
is always true;
B Dk+l C iff for all
s%(A x V)*
(i) if
B
s .~B' then for same
(ii) if
C
s~C'
B=C
iff
k/k >0.
C',
C
S ;C' andB' ~k C';
then for scrae B',
B
s ~B' and B' ~k C';
B ~k C.
Remarks (i)
There is a
question
as to whether we need to consider all sexperiments
in this definition, or if it is enough to coD~ider only those of length 1  i.e. we might replace
se(A x V)* by
sea
× V
in the definition.
The relation ~ thus obtained is different, but it turns out that the congruence (§7.3) which it induces is the same (assuming only that CCS includes an equality predicate over values), t/qough we shall not prove it here~
Our present definition, using
(AxV)* , has sc~aewhat
nicer properties. (2)
Our definition has a
property
which must be pointed out.
It all(x~s
the program (CTs)
T
and
=
to be equivalent'
~iExercise i " ~ ~7.1
Prove
T~
(T~
~.~
NIL = •
can be defined by
to
T~ Tm >Tm
T.b.)
NIL by induction on k.
Notice that the 0nly experiment on I i
b~
for any m)
R
T~
is
~%~ ;'T~
(corresponding
and NIL's only experiraent is
Thus, whenever we have proved
NIL
e > NIL.
B~C (e.g. B may be a program and C
its specification) we cannot deduce that B has no infinite unsee~ action, even if C has none.
In one sense we can argue for our def
inition, since infinite unseen action is  by Our rules  unobservable'
But the problem is deeper;
it is related to socalled
fairness, which we discuss briefly in §11.3.
In any case, there is
a more refined notion of ~ which respects the presence of infinite unseen action, with properties close to those we mention for the present one.
I00
(3)
Disregarding the question of which equivalence is correct, if indeed there is a single 'correct' one, the finer equivalence (under a slight further refin~Inent)has interesting properties. Plotkin
[HP 2]
Hennessy and
have recently found that it can be axic~atized, in
a sense which we cannot explain here.
Much more needs to be known
before we can say which equivalence yields better proof methods; at least we can say that, if an equivalence can be proved und~_r the refined definition, then it holds also under ours. We now turn to the properties of
z.
There are many, but three are
enough to give a feeling for it, and to allow you to read the first case study in Chapter 8, if you wish, before proceeding to §7.3. The main thing which distinguishes
Proposition 7.1 Proof (i)
Let
k
B ~kr.B and
by induction on
prove for
B s~B'.
~k
from
~
is the following:
B ~T •B
We show
asst~ne for
z
Then also
k.
k=0
is trivial, so we
k+1: s.  B' , a n d w e know
~.B
B'~kB'
(each
is an equivalence relation:)
(ii) Let
T.B ~ C ' .
either (a)
s=e,
Then and
C'
induction or
(b)
~.B ~ B
is
~.B;
but then also
i.e.
B
B
B, and by
B ~kT.B s
C',
S;c,
also, and again
C' ~k c' This completes the inductive step, yielding
B=k+IT.B.
This proposition should make you immediately suspicious of because we can show that it cannot be a ccngruence. B~C
does not imply
B + D ~ C + D;
e.g. take
B
as
thenB~C
byProp. 7.1, but
as
NIL,
C
T.NIL, B +D
D
as
=,
In particular
e.NIL
~2 C + D .
IExerci______se 7__.2 Show that NIL + ~.NIL ~2T.NIL + ~.NIL, by observing that
I
RHS
E> NIL, but the only eexperiment on IHS yields a result which
is
~I NIL
101
Even so, Theorem 7.3 b e l ~ tells us that gruence for many purposes. Theorem 7.2 Proof
B~C
it is trivial; at k+l. (i)
~ .
B ~ C.
B~C
implies
ass~ne it at
Assume
is near exKx~h a ccn
First we need to see its relation with
implies
We show that
~
k
B~kC
(for all
by induction on B
and
C),
k.
At k=0
and prove it
B~C:
let
B ~Bn,
say
the
~ivi may be
B T,
~I~I>B ........
÷
BnVn Bn,
..,
where sane of
while the re~rainder ccnstitute
Theor~n 5.6 used repeatedly, there exist
Ci, ..., %
s.
Then by
with
ivl ~nVn C ~ C 1 ÷ ... ~ C n , i.e. n with B. ~C. for all iE;
then
q,r
must be
B'ID' , with
B
(ccntaining ccr~lementary ~ s
B ' ~ k C'
But then
Then for same
C'
by assumption.
C JD S;. C' 1D', and by the induce_ive hypothesis
B'JD'~kC'ID' , i.e. CID
q;B', D ~ D '
which 'rcerge' to
s .> in a way which we need not detail)
C :q'c' and
(ii) Let
E
E~kC'ID'.
s~ .....E, then similarly we find
BID ~ B ' I D ' ~ k
B'ID'
such that
E.
The e s s e n o e o f P r q 0 o s i t i c n 7 . 1 and Theorems 7 . 2 , 7 . 3 i s t h a t we can use a l l o u r laws, and c a n c e l
T's
too, in proving observation
e q u i v a l e n c e  p r o v i d e d o n l y t h a t we i n f e r n o t h i n g a b o u t t h e r e s u l t o f
substituting
C
for
B
under
+,
when we only know
B~C.
The next section tells us what such inferences can be made. Exercise 7.2 on k.
Prove that
B~kC
implies
Why is induction neaessary? As we did for
Definition B=C
Let
~, we extend
x
if, for all
av.B~k~V.C
(Consider ~
by induction
~experiments).
to expressions by:
be the free variables in
B
or
C
or both.
Then
v
Then we have
Theorem 7.4
Proposition 7.1 and Theorems 7.2, 7.3 hold also for expres
sions. Proof
Routine.
Frgn now on, we deal with expressions.
103
7.3
Observation Congruence We must nc~ face the fact that
7.2).
~
is not a ccngruence (see Exercise
But we would like a congruence relation, because we would like to
know that if replace
B
B
by
and C
C
are equivalent, then in whatever context we
the result of the replacement will be equivalent to
the original  which is cnly trae for an equivalence relation which is a congruence.
We have one congruence  strcng congruence (~)  but it is
too strong;
for exarp!e
~.~.NIL ~ ~.NIL.
Can we find a ccngruence relation which is weaker than
~ (so that
all our laws, Theorems 5.3 and 5.5 will hold for it), and has sane of the properties of
% (so that for example ~.T.NIL and
~.NIL will be congruent)i
Let us draw the order relation (part of the lattice of equivalence relations) among our existing equivalence relations with stronger relations to the leftj and square boxes representing ccngruences: Equivalences over behaviour programs:
Identity _~ ~ .Relation
~
We want to fill in "?".
~
~
Universal 1 Relation
It must be strcnger than
ccngruent prograns to be observation equivalent.
~
because we do want
We get what we want by
the following: I Definition context
B ~
c
C
(Obse#vation congruence) iff
for every expression
C[ ], C[B]~C[C].
Theorem 7.5 (i) (2)
c If
is a congruence relation; @ is a ccngruence and
BSC
implies
B~C,
then
BSC
implies
BC~c. Proof
Omitted;
it is ccmpletely standard, and has no~dling to do with
particular properties of the equivalence
Z
[~
104
c
Our Theorem says that (smaller than)
~.
Cor011ary 7.6
B~
Proof
C
is the weakest congruence stronger than
implies
B
c
C
implies
B=C
°
Immediate. It is cne thing to define a congruence, another to know its properties. c = to =; in the next
We first find out more about the relation of c secticn we find sc~e laws satisfied by ~ .
We saw earlier that sign ccntexts were critical for B~C
does not imply B + D ~C + D. + = :
~, because
~lis leads us to explore a new equi
valence relation Definition
B~+C
iff
YD.
B + D~C
+ D
(equivalence in all sun contexts.) Now the critical result is the following: Theorem 7.7 Proof
~+
See
§7.6.
definition of
is a congruence. This proof is not standard, but depends strongly on the
~;
it is not true for the alternative in Remark (i) of §7.2,
and that is why we chose our definition.
Theorem 7.3 is critical.
Frcm this we get, fortunately: Theorem 7.8
~
c
and
~
+
are the sane congruence.
Proof + (i)
B =+ C
implies
stronger than (ii) B
c
B ~ c C by Theorems 7.5(2) and 7.7, since ~
= (take
C
implies
D
is
to be NIL in the definition).
B ~+ C, since
[ ]+ D
is just a special kind of
context. Now we know that we preserve texts.
What do we do if we have
B + D and C + D? C
B
by substitution exoept in '+' conand wish to know s c m e t h i ~ about
Luckily, for an important class of expressions
we can infer from
Definition
~ B~ C
B=C
that B ~c C, and then infer that
is stable iff
B~B'
B
and
B + D ~c C + D.
is impossible for any B'.
Thus a stable behaviour is one which cannot 'move' unless you observe it. Stability is ir~portant in practice;
one reason why our scheduler in
Chapter 3 works, for exanple, is that it will always reach a stable state if it is deprived of external c~,tlunication for long enough. the notion of "rigid" in Chapter I~
Cc~pare
we may define a rigi d program to be
one whose derivatives, including itself, are all stable.
105
There are two main propositions about stability;
first we prove a
lesma in a slightly more general form than we need for the propositions but the general fozm helps in the proof of Theorem 7.7 (skip the lemma if you are only interested in main results, not proofs). Lenm~ 7.9
If
B z+C and
that
C ~ ;'C' and
Proof
S~ppose
B~B',
then for each
C'
does not exist;
we find
centrary to assir~ption. Take
D
sort of
B~B',
C+D
B
~E
B'
or
C.
Now sinoe
then either (i)
E
(ii) C ~ E ,
~k B'
; or
impossible since Hence
D
to be
D
there is a
such that
1 ° .NIL, where we have
is C + D,
C'
such
~'
B + D ~ C + D,
Io
is not in the
B+D~B'.
But if
since C +DI~;NIL, but
by supposition;
or
(iii)
D ~TE

is stable.
B+D ~ C+D, contradicting
Proposition 7.10 Proof
k
B' ~k C'.
If
B ~Cc
B =+C.
then either both are stable or neither is.
Direct frcm Lemma 7.9 (B ~ ~k C' not needed). More important, for proof methods, is the following:
Proposition 7.11 Proof
If
B
and
C
are stable, and
It is enough to show that
induction on
k.
B + D =k C + D
B=C,
then
B ~Cc.
for arbitrary
D, by
We do the inductive step.
Let B+D ~ E : (i)
If
s=e
then either
by induction, or
E
is
D ~ ET,,
B + D, and then C + D and then
C + D
e;~E
e;C + D , ~ k B + D also
(B .... ~ ;E impossible
by stability). (ii) Otherwise either whence
C
D
s
S;F=kE
s ~E, and then C + D ~E also, or
(because
B ~ C ) , whence a l s o C + D
Thus we have found in each case an F s.t.C ÷ D ~ argr~ent is similar, Now for any guard that g.B=g.C
so
B ~E, S>F~kE.
F ~ k E.
The converse
B=C
(for any B,C)
B + D ~ k + I C + D.
g ~ T , we can deduce frmm
(Theorem 7.3) ,
and hence g.B z % . C
since both are stable.
implication holds in fact for any guard, by the following Proposition (which is essential in the proofs of Chapter 8): Proposition 7.12 B~C
i~plies
For any guard g.B~%.C.
g,
t06
Proof
By the above re,harks we need only consider
T.B + D ~ k T . C + D Let (i)
If
for arbitra/ny D, by induction an k.
T~.B + D s=e
S;E.
then either
T.C + D
B c
We prove
Inductive step:
Then E
by induction, or D ~ E , and then
g = T.
is
~.B + D, and then T.C + D ~
and then T.C + D ~ E
e>E, whence C ~ F ~ k
E (since
e
T.C + D ~
also, or
T.B T.~E,
B~C), whence also
; F~kE.
(ii) Otherwise either
s D ........~E, ..... and then C + D ~ E :
~ence C S~F~kE (since B ~ C ) , whence also As in Prop. 7.11, this ca~pletes the proof. By now these inductive proofs of hypothesis only when
=k'
also, or T.C + D
B ~E, S>F=kE.
appealing to the inductive
eexperiments are ccnsidered, are befxmaing familiar;
we shall leave them as exercises in future.
7.4
Laws of Observation C o n ~ We are going to prove three laws, for which we have strong evidence
that they say all that needs to be said about the strange invisible c ~ ; this suggests that the apparently neverending strean of laws
under
is drawing to a close'
The evidence is that these new laws, together
with those of Theorem 5.3, have been shown to be ccrmplete for CCS without recursion and valuepassing. (in this
restricted language)
This means that any true statement can be proved frcm the laws;
B ~Cc
in fact the
laws of Theorem 5.3 are quite a lot simpler without valuepassing, and those of Theorem 5.5 are unnecessary without recursion. One would expect to have to add sane induction principle in the presence of recursicn;
what needs to be added for valuepassing is
less obvious (but in several moreorless natural examples, including those in Chapter 8, we have not needed more than we have already). Theorem 7.13
(2)
( T laws) c g.T.B = g.B c B + T.B ~ T.B
(3)
C g.(B + T.C)+ g.C ~ g.(B + z.C)
(i)
Proof
(i)
follows directly frcm Prop. 7.1 (T.B~ B) and Prop 7.12.
For (2), we must prove for arbitrary D,k B + T . B + D = k T.B + D and this follows the pattern of Props. 7.11, 7.12.
107
For (3) similarly, we need g. (B + T.C)+ g.C + D ~ g . (B + T.C)+ D which follows the same pattern, but needs the extra easy fact that for s s ~ , if g.C  > E then also g.(B + T.C) ~ E . ~ercise
7.3
Ccr~plete the proofs of (2) and (3)
e
A more useful form of (2) is the following: Corollary 7.14
E + T.(B + C) c T.(B + C) .
Proof Exercise 7.4
Prove this, by first applying (2) to
need another law of
~. (B+C);
you will
+.
One may justify the laws intuitively by thinking of any behaviour B
as a collection of action capabilitie s (the branches of its C2),
including perhaps sane Tactions (the Tbranches) which are capable of rejecting the other capabilities. Law (i) may then be explained by saying that, under the guard the Taction of no effect.
T.B
g,
rejects n_~oother capabilities and therefore has
For Law (2), the capabilities represented by
present after the Taction of
T.B
B
are again
in the context B + T.B, SO
T.B
itself has all the power of B + T .B. For Law (3), an
observation of
the left side may reject
in
B
by passing the guard
g
g.C,
but
this rejection is already represented in g. (B + ~.C). But such wordy justifications badly need support;
observation equivalence is what
gives them support here. Laws (2) and (3) are absorption laws;
they yield many other absorp
tions. Exercise 7.5 (i) (ii) (iii)
Prove, directly from the laws, that
~.(B I + ~.(B 2 + ~.B3) ) + B3 c ~ . ( B 1 + x.(B 2 + T.B 3)) ~.(B 1 + T.(B 2 + B 3)) + ~ c T . ( B ~
+ T.(B
+ B 3))
To(B 1 + e.(B 2 + T.B 3)) + ~.B3 ~ T . ( B I +2 .(B2 + T.B 3))
and eonsider how they generalise. On the other hand, disprove 6.(B + C ) + ~.C c 6 . ( B + T.C) by finding 7.5
B,C
which make
them not
~.
Proof Techniques In conducting proofs, we may take the liberty of using "=" in place
of "~" or
,,c,,, adopting the familiar traditicn that "=" means equality
108
this helps us to highlight our uses of
in the intemded interpretation; ,
With t~mls
for which care is needed because it is not a congruence.
convention, let us stmlnarise the ir~portant properties. (i)
The laws of ~ (Chapter 5); B ~T.B
(ii)
(Proposition 7.1) ;
B = C
(iii)
implies
B~ C
(Corollary 7.6) ;
is preserved by all operations except +
(iv)
(v)
B~ C
implies
(vi)
B~ C
in,plies g.5:g.C (Proposition 7.12) ;
(vii)
The
x laws
B=C
when both stable
(Theorem 7.13).
Since we mentioned that the bother with
m
(Theozem 7.3);
(Proposition 7.11) ;
in proofs?
often show that a behaviour
T laws have a cx~npleteness property, why The reason is to do with stability. B
We can
of interest, not stable itself, satisfies
B = T.B* for scrse stable
B*;
This expresses that
so of course B
B~B*
stabilises.
(but B ~ C B *, by Proposition 7.10')
Stable hehaviours are often easier to
handle, and the oonstrained substitutivity of
z
often allows us to conduct
our proofs mainly in tezms of stable behaviours.
Chapter 8 should make this
point clear. Many proofs can be done with our laws without using any induction principle, though the laws are established using induction on
~k "
Xhere is, however, a pcwerful induction principle  C ~ u t a t i c n
Induction
 due to Scott, which we cannot use at present since it involves a
partial order over behaviours.
We believe that this principle can be
invoked for the finer notion of observation equivalence alluded to in §7.2, Remmrk(2);
7.6
Proof of Theorem 7.7
Theorem 7.7 Proof
it remains to be seen how important its use will be.
~+
is a congruence.
First, we show that
implies
B ~+ C
+ B + D ~ C + D;
require (B + D) + E ~ (C + D) + E
for arbitrary E.
But
+ (D + E)
(Theorem 5.3)
C + (D + E)
(since B~C)
(B + D) + E ~ B
~(C +D) Next we require that
B ~+C
+E. implies
g.B ~+g.C ,
I
B\~ ~+C\~ , B[S] ~+C[S] ;
that is, we
t09
e.g.
we want
g.B + E~g.C + E
for any E.
In each case the proof follows
the pattern of proof in Propositions 7.11, 7.12 (these Propositions are stated in terms of c ,
but the proofs are entirely in terms of z ). + The critical case is B + C implies BID zCID. A s s ~ B + C and
prove BID + E ~
CID + E, for arbitrary E,
Inductive Step: (i)
Let BID + E ~
If
s ~e,
or
BID s~E'
B~C (ii) If
then either E ~ E ' ,
~
by induction on k.
E; and then CID + E ~ E '
and then CID S~>F'~kE'
for scme F'
BID=ClD ~ ~ e o ~ m 7.3), w ~ c e
S=e, then either E'
cLD+E
~;cID+E,
then CID + E
is BID + E
%BtD+E
> E'
also,
also, (since
CID + E ~ F ' ~ k E '
also.
itself, and then
byindu~±~,
or E ~ ET ,
o_rr BID ~~ B' ID' ~s> E'.
!
~d
These are now
the three cases: (a) B'
is B, and D  ~ D ' ;
by Theorem 7.3 CID + E (b) D'
F' ~kE'
IV>B'
for sane F',
(this is the only use of
is all that is needed),
sane F'.
and BID'~CID' whence
as required.
So finally CID + E and D!V>D';
B +C
S>E',
k+l B '
 elsewhere
and we also have
frcm Theorem 7.3, so since B'ID (c) B
T>CID'
and B T~~B'; then by lemma 7.9 C ~ C ' =
for same C' B=C
so CID' ~
~:F'~kE'
is D
then CID
B'ID~k+IC'ID
C'ID c~F'=kE'
for
~:.C'ID ~ F ' = k E ' .
then C
IV;c"~k+iB'
for scme C',
9~qence CID ..T;,C' ID' ~k+iB' ID' by Theorem 7.3, whence C'ID'
~"" F' ~k E'
Thus we have found F'
for some F',
whence also CID + E
in every case so that CID + E
~.> F' ~~E'.
S~F'~kE' ; by
symmetry, we have BID + E~k+ICID + E which ccrnpletes the induction.
7.7 Further exercises We end this Chapter with some in the theoretical development.
harder exercises, for readers interested
Exercise 7.6 (Hennessy). Prove the following result, which further clarifies the relation between ~ and c : B~C
iff ( B c C
or
B CT.c
or
T.B Cc)
I10
Exercise 7.7
We would like to know that if
then
b ~CB;
b
I,
(iii)
Prove:
(iv)
Deduce:
if
B ~CCEB]
and
C c C[C]
then
B ~Cc.
(v)
Deduce:
if
b~C[b]
and
B c C[B]
then
b ~CB.
~cise
7.8
if
B~C[B] and
C~C[C]
then
B~C.
Ccnsider a different definition of observaticn equivalence.
First, define a decreasing sequenoe of preorders B ~0 C
~0,~ C ' and
B' ~k C' .
Thus we take only the first clause of the definition of ~k+i" B < C We may take
m
iff Vk. B  0 .
As usual, we have to resort to a
140
Definition A
A
is always
strc~ly Ooonfluent
is strongl [ (k + 1 ) confluent
iff
B~D O_Z . ). C~E
B
(i)
~
iuplies either
~ = ~ and
B~C
C
for some (ii)
A ~+ B
D
and
implies
E ; B
strongly kconfluent.
is strcm~ly ccnfluent
A
iff it is strongly kconfluent for all
k> O.
Let us abbreviate "strongly confluent", "strongly kccnfluent" by SC, SC k
respectively.
We first want to know that SC is a property of strong
equivalence classes, not just of progr~as. Proposition 10.2 Proof A'
If
A
is
SC
We show by induction on is
and at
~
.
k+l
At
k=O
ass~ue
and k
A~A '
that if
A
so is
for sane
A'
is
~k
is SC. and
there is nothing to prove.
A
is
~+I
and
B ;
but
B
is
A~A'
Assurae at
then k ,
A~A'.
For part (ii) of the definition, if A ~ B~B'
then
A' ~ B'
then by Theore~ 5.6
~k' hence by inductive hypothesis
B' . For part (i) , stppose B ! S !
u S U ..~ B
A ,/
A' I,i A /
, yielding for some B,C
C!
~nen (since or
A
for some
D,E
B'
C'
is
~+1 and
) either
~=~
and
B~C,
D' ,E'
~" D' B
~ D
C
P > E P > E'
•
B'
~ > D'
C'
~ > E'
so
so
B'~C'
,
141 c
However, SC is not preserved by c ~
~.~.NIL + 6.~.HIL while the first is
z
or
~ ;
for example
~.6.NIL + B.T.~.NIL
SC, the second is not.
We take up this question
later. For our main property of SC we first need a lemma to do with longer derivaticns. B
Lesma iO.3
If
A
is
and
SC
A
~
then
/.l
either
~ = ~i (some i) and
H
2
C
Proof At
By induction on
n+l
n .
For n = O ,
C
C
is
A
and take
~E
D,E
to be
we have
Af B ~ A
so either or
~=HI
and
~2" "~
A1 ~ B , whence
B
2 ""u n+
(first case of inductive hypothesis for A I)
B
A
~I
.I>D~ C
by Theorem 5.6,
~=~i
(i>2)
~2" "Wil~i+l" ' "~n+l>D
~B i
B f2" "~ilUi+l ' "~n+l > D' 2"" "~n+l
> C
and
B.
142
finding first then
B ,B'
since
A
is
SC , then
D'
since
SC,
A 1 is
D , or (second case of inductive hypothesis)
PJ[
B
]~2" • "Pn+l
>B I
A
> D
B' ~2"°'~n+l
A
..~n+l ~ C
~ D'
~ ~E
Now we can deduce our main property as an important special case. Theorem iO. 4
(Strcng Confluence).
If
A
is
SC
and
A~ B
then
A=B.
Proof
We show that if
on
k.
Trivial at
SC
and
(i)
A
is
and
A~B k,
then
and at
A Zk B, k+l
by induction
ass~ne
A
is
A~ B.
If
B~B'
clearly
(ii) Let
A~A'.
either
B~B'
A~B'
or
B~
B',
B'
A' T~A"
In the second case, since inductive hypothesis; A' ~k B'
also.
Then frcm L~lua 10.3 we have, for sane
A'
case
SC
k0; asstnne it at
but
A' ~
is
SC
implies
(Proposition iO.!), Zk
(Theorem 7.2)
A' =kA'' by so in either
as required.
The usefulness of the Strong Confluence Theorem is simply this: program find a
A B
a
may admit many actions, and so may its derivatives, but to such that
A~B
we need only follow an ederivation (a sequence
of zactions ) starting frcm A,
provided we know
A
to be
SC.
To follow all other derivaticns (as, in effect, the Expansion Theorem would do when repeatedly applied to
A, ~,...)
would often be heavy
work  and is unnecessary in this case. In the next section we illustrate this saving on a toy example, which we ass~ne to be confluent (later it will be seen to be so on general grounds).
But we first need to define a class of derived behaviour
operations, called ommposite action.
143 iO. 3 C c ~ i t e
9uards, and the use of cc~fluence
For ~ i ~ A u {T}, (~lJ..J~n) is a c c ~ s i t e guard (n_>l) whose actions are given as follows, in the style of §5.3 (see Exercise 10.2, end of §10.4, for richer czm~posite guards): n>l
(Z1 j...j~n ) . B ~
n=l
(~I).B,I~B
(~1 j...l~i_lj~i~I...j~n ).B for each
i,
1 _1 , then
(resp. SDk+I).
since ~ + n
implies
SCk+i
Thus far, the operations preserve SC
if n> I .
and SD
separately.
can only show that
rdCamposition preserves them tcgether.
~sition
If A 1
iO.ii
L In L2 = ~ ' then A IlIA2
Proof
and A 2 are ~ , is
with AI:L1,A2:L2 and
SCDk .
Take the inductive step; assume A 1 ,A2
f~st that A ill ~2
is
We
SCk+ i .
are S C ~ + I and show
Suppose
AitiA2~ %~nere are essentially four cases: (i) B
is B III ~ , C
is ~II C 2 (an ~
action), and
Blil ;~
A Bi
A2.~ ~ C2
(ii) B is
action and an ~
~ II c =~~
, yielding
BIlIA 2,
C is
Cll I A 2
(two
A1
B1II c2
acticr, s ) ,
and
/
C1 Then either
U=
v
and
B 1 ~ C1
, ,¢nence also
B1 II
~ ~ c~ 11 N
, or
150
(±i±) B is Bll I ~, ~ ='~, c is c111;'2 (a c~,~,onication and
an
action), and
A2~ B 2
and
(I ~ L 1 n ['2 )
C1
v ~t
But then
II;`2~ c
, since
is impossible.
Hence
Bill B2~o111 B2
Bi~ D 1 I Z C i~ E 1
(iv) B
is
, whence also
ci11 ~Ellt
B ljl B 2, C is
C III C 2,
al
~ =v=T
have
(two ccmmunications), and
A2 4