A calculus of communicating systems

Lecture Notes in Computer Science Edited by G. Goos and J. Hartmanis

92 IIII

Robin Milner

A Calculus of Communicating Systems

Springer-Verlag Berlin Heidelberg New York 1980

Editorial Board

W. Brauer P. Brinch Hansen D. Gries C. Moler G. SeegmiJIler J..q;toer N. Wirth Author

Robin Milner University of Edinburgh Dept. of Computer Science James Clerk Maxwell Building The King's Buildings Mayfield Road Edinburgh EH9 3JZ Great Britain

AMS Subject Classifications (1979): 68-02 CR Subject Classifications (1974): 4.30, 5.20, 5.22, 5.24 ISBN 3-540-10235-3 Springer-Verlag Berlin Heidelberg New York ISBN 0-38?-10235-3 Springer-Verlag NewYork Heidelberg Berlin Library of Congress Cataloging in Publication Data. Milner, Robin. A calculus of communicating systems. (Lecture notes in computer science; 92) Bibliography: p. Includes index, t. Machine theory. 2. Formal languages. I. Title. 11.Series. CIA26?.M53. 511.3 80-21068 This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically those of translation, reprinting, re-use of illustrations, broadcasting, reproduction by photocopying machine or similar means, and storage in data banks. Under § 54 of the German Copyright Law where copies are made for other than private use, a fee is payable to the publisher, the amount of the fee to be determined by agreement with the publisher. © by Springer-Verlag Berlin Heidelberg 1980 Printed in Germany Printing and binding: Beltz Offsetdruck, Hemsbach/Bergstr. 9145/3140-543210

work was mainly done during my six-month appo_i n - - t , ~ t

frcm

1979 to January 1980, at the Ommouter Science deoalb~ent in

Aarhus University, ~ k .

Although much of the ground work had been

done previously it was mainly in response to their encouragement (to make the theory more accessible and related to practice), and to their informed criticism, that the material reached a scmewhat coherent form. I an deeply grateful to them and their students for allowing me to lecture once a week on what was, at first, a loosely connected set of ideas, and for the welccming enviromnent in which I was able to put the ideas in order.

I also thank Edinburgh University for awarding me

five months sabbatical leave subsequently, which helped me to cc~plete the task in a reasonable time. The calculus presented here 9~ew out of work which was inspired by Dana Scott's theory of computation, though it has since diverged in some respects. Plotkin;

At every stage I have been influenced by Gordon

even where I cannot trace particular ideas to him I have

been greatly illtmlinated by our discussions and by his chance remarks, and without them the outccme would certainly be less than it is. would also like to thank others with whom I have worked: with whom I worked out the Laws of Flow Algebra;

I

George Milne,

Matthew Hennessy, with

whcm the notion of observation equivalence developed;

and Tony Hoare,

whose parallel work cn different but strongly related ideas, expressed in his "Ccamtmicating Sequential Processes", has been a strong stimulus. Many people have given detailed and helpful criticisms of the manuscript, and thus improved its final form.

In particular I thank Michael

Gordon and David MacQueem, who went through it all in detail in a Seminar at the Information Sciences Institute, University of California;

this

not only exposed same mistakes and obscurities but gave me more csnfidence in the parts they didn't criticise. Finally, I am very thank~=ul to Dorothy McKie and Gina Temple for their patience and skill in the long and involved task of typing.

O.

Introduction Purpose - Character - Related ~ r k

!.

- Evolution - Outline.

Emperimentin 9 on Nondeterministic Machines Traditional equivalence of finite state acceptors - E x p e r ~ t i n g upon acceptors - Behaviour as a tree - Algebra of RSTs Unobservable acticns.

2.

S[nchronizaticn

19

Mutual experimentation - Composition,

restriction and relabelling -

Extending the Algebra of STs - A sinple ~ l e :

binary semaphores -

The ST Expansion Theorem.

3.

A case study in synchronizaticn and proof t e ~ i q u e s

33

A scheduling problem - Building the scheduler as a Petri Net Observation equivalence - Proving the scheduler.

4.

Case studies in value-cc~6~1~dnication Review - Passing values - An exanple: An example:

5.

47 Data Flow - Derivations -

Zero searching.

65

Syntax and Semantics of CCS Introduction - Syntax - Semantics by derivations - Defining behaviour identifiers - Sorts and programs - Direct equivalence of behaviour programs - Congruence of behaviour programs - Congruence of behaviour expressions and the Expansion ~neorem.

6.

Cu,,~!~cation Trees (CTs) as a model of CCS CTs and the dynamic o p e r a t i c n s CTs defined by recursion - A ~ c

84

C'fs and the static operations actions and derivations of CTs -

Strong equivalence of CTs - Equality in the CT model - S ~ .

7.

Cb~ticn

~_iivalence and its properties

Review - Observation equi%ralence in CCS - Observation oongruence Laws of observation congruence - Proof ted%niques - Proof of Theor~n 7.7 - Further exercises.

98

VJ

8.

111

Some proofs about Data Structures Introduction - Registers and mamories - Chaining operations Pushdc~s

9.

and queues.

126

Translaticn into CCS Discussion - The language P - Sorts and auxiliary definiticns Translation of P - Adding pzocedures to P - Protection of resources.

i0.

~tezminacy

138

and Confluence

Discussion - Strong confluence - ~ i t e ccnfluence - Strcng determinacy: Proof in DCCS:

guards and the use of

Confluent detezminate CCS -

the scheduler again - abservaticn confluence and

detezminacy.

II.

158

Conclusion What has been achieved? - Is OCS a programming language? The question of fairness - The notion of behaviour - Directions for further work.

~

:

References

Properties of cc~gruence and equivalence.

166

16 9

CHAPTER

0

Introduction

O.i

Pu~se These notes present a calculus of concurrent systems.

is partly infozrflal, and aimed

at practice;

The presentation

we unfold the calculus through

the medium of examples each of which illustrates first its expressive power, and second the techniques which it offers for verifying properties of a system. A useful calculus, of cGmputing systems as of anything else, must have a high level of articulacy in a full sense of the word implying not only rid%ness in expression but also flexibility in manipulation.

It should be

possible to describe existing systems, to specify and progr~n new systems, and to argue mathematically about them, all without leaving the notational frame%~rk of the calculus. These are demanding criteria, and it may be impossible to meet them even for the full range of concurrent syst~ns which are the proper concern of a ccmputer scientist, let alone for syste~ns in general. n~st be made.

But the attempt

We believe that our calculus succeeds at least to this extent:

the sane notations are used both in defining and in reasoning about systems, a n d - as our examples will show - it appears to be applicable not only to prograns (e.g. operating systems or parts of them) but also to data structures and, at a certain level of abstraction,

to hardware systems.

For

the latter however, we do not claim to reach the detailed level at which the correct functicr/ng of a s y s t ~ depends on timing considerations. Apart from artioulacy, we aim at an underlying, theory whose basis is a small well-knit collection of ideas and which justifies the manipulations of the calculus.

~nis is as important as generality - perhaps even mere

in~portant. Any theory will be superseded sooner or latem;

during its life,

understanding it and assessing it are only possible and worthwhile if it is seen as a logical 9~owth frcm rather fewbasic assumptions and concepts. We take this further in the next section, where we introduce our chosen conoeptual basis. One purpose of these notes is to provide material for a graduate course. With this in mind (indeed, the notes grew as a graduate course at Aarhus University in A u t ~

1979) we have tried to find a good expository sequence,

and have cmitted scme parts of the theory - which will appear in technical publications - in favour of case studies.

There are plenty of exercises,

and anyone who bases a course on the notes should be able to think of others; one pleasant feature of concurrent systems is the wealth and variety of small but non-trivial e~maples'

We could have included many more examples

in the text, and thereby given greater evidence for the fairly wide applicability of the calculus;

but, since

our main

aim is to present

it as a calculus, it seemed a good rule that every example program or syste~ should be subjected to scrne proof or to same manipulation.

O.2

Character Our calculus if founded on two central ideas.

The first is Observation;

we aim to describe a ooncurrent system fully enough to determine e~mctly what behaviour will be seen or experienced by an external observer. the approach is tho~oughly extensional;

Thus

two systems are indistinguishable

if we cannot tell the~ apart without pulling thegn apart.

We therefore

give a fomaal definition of observation equivalence (in Chapter 7) and investigate its properties. This by no meaD~ prevents us frcm studying the structure of systems. Every interesting concurrent system is built frcrn independent agents which ccmmunicate, and s~nchronized communication is our second central idea. We regard a cut~t~nication between two component agents as an indivisible action of the ccr~0osite system, and the heart of our algebra of systems is concurrent c c ~ s i t i o n ,

a binary operation which c c ~ e s

pendent agents, allowing thegn to coma~anicate.

two inde-

It is as eentral for us

as sequential ccmioosition is for sequential programming, and indeed subsumes the latter as a special case.

Since for us a program or system description

is just a tel~n of the calculus, the structure of the program or system (its intension) is reflected in the structure of the term.

Our ~nanipulations

often consist of transfozndng a tezm, yielding a term with different intension but identical behaviour (extension).

Such transfozmations az~ faniliar

in sequential progranmiing, where the extension may just be a mathematical function (the "input/output be/qaviour"); for concurrent systems however, it seer,s clear that functions are inadequate as extensions. These two central ideas are really one.

For we suppose that the only

way to observe a system is to o.xL'municate with it, which r0akes the observer

and system together a larger system.

The other side of this ooin is

that to place two ccr~ponents in ~ c a t i o n is just to let them observe each other.

(i.e. to cc~pose them) If observing and cut~u~cating

are the s~ne, it follows that one cannot Observe a syste~ without its participation.

The analogy with quantum physics may or may not be super-

ficial, but the approach is unifying and appears natural. We call the calculus CCS (Calculus of C~m.~nicating Systems). temps of CCS stand for behaviours to equational laws.

(extensions)of systems and are subject

This gives us an algebra, and we are in agreement

with van Erode Boas and Janssen [EHJ] who argue that ~rege's

principle

of ocmpositionality of meaning requires an algebraic framework. is s ~ a t

The

more than algebra;

But CCS

for example, derivatives and derivations

of terms play an inportant part in describing the dynamics of behaviours. The variety of systems which can be expressed and discussed in CCS is illustrated by the exanples in the text:

an agent for scheduling

task perfomaance by several other agents (Chapter 3);

'data flow'

cc~putations and a concurrent n%~rerical algorithm (Chapter 4); devices and data structures (Chapter 8); parallel progranlming language (Chapter 9).

n~mnory

semantic description of a In addition, G. Milne [Mln 33

modelled and verified a peripheral hardware device - a cardreader - using an earlier version of the present ideas. After these remarks, the character of the calculus is best discovered by a quick look through Chapters 1-4, ignoring tedanical details.

§O.5

(Outline) may also help, but the next two sections are not essential for a quick appraisal.

O. 3

Related Work At present, the most fully developed theory of concurrency is that

of Petri and his colleagues.

(See for example C.A. Petri, "Introduction

to General Net ~heory" [Pet3, and H.J. Genrich, K. Lautenbach, P.S. Thiagarajan, "An Overview of Net Y~leory" [GLT].)

It is i~portant to

contrast our calculus with Net Theory, in tez~as of underlying concepts. For Net Theory, a (perhaps the) basic notion is the concurrenc~ relation system;

over the places (conditions)

and transitions (events) of a

if two events (say) are in this relation, it indicates that

they a~e causally independent and may occur in either order or simultaneously.

This relation is conspicuously absent in our theory, at

least as a basic notion.

Hen

we o ~ p o s e two agents it is the synchroni-

zation of their mutual cc~amlnications which d e t ~ e s

the cc~oosite;

we

treat their independent actions as occurring in arbitrary order but not simultaneously.

The reason is that we assLlre of our external observer

that he can make only one observation at a time;

this i~plies that he

is blind to the possibility that the syst~n can support two observations simultaneously, so this possibility is irrelevant to the extension of the systea in our sense.

This assumption is certainly open to (extensive')

debate, but gives our calculus a sinplicity which would be absent otherwise.

To answer the natural objection that it is unwieldy to consider all

possible sequences (interleavings) of a set of causally independent events, we refer the reader to our case studies, for exanple in Chapters 3 and 8, to satisfy himself that our methods can avoid this unwieldiness almost

~Zetely. Cn the other hand, Net Theory provides many strong analytic techniques; we must justify the proposal of another theory. is upon synthesis and upon extension;

The emphasis in our calculus

algebra appears to be a natural tool

for expressing how systems are built, and in showing that a system meets its specification we are demanding properties of its extension.

~

activity

of programming - more generally, of system synthesis - falls naturally into CCS, and we believe our approach to be more articulate in this respect than Net Theory, at lea_st on present evidence.

It remains for us to

develop analytic techniques to match these of ~Net Theory, whose achievements will be a valuable guide. As a bridge between Net Theory and programming languages for concurrency, we should mention the early work of Karp and Miller [KM] on parallel program schemata.

This work bears a relation to Net Theory in yielding an

analysis of properties of concurrent systems, such as deadlock and liveness; it also esmes closer to programming (in the ccnventional sense), being a generalisaticn

of the familiar notion of a sequential flow chart.

In recent proposals for concurrent programming languages there is

a

trend towards direct ccrm~nication between cc~i0onents or modules, and away from c~i~unication through shared registers or variables.

Examples are:

N. Wirth "MCDUIA:

A language for modular multiprogramling", [Wir];

P. Brinch Hansen "Distributed Processes; [Bri 2];

a concurrent programming ccnoept",

C.A.R. Hoare "C~ti~nicating Sequential Processes", [Hoa 3].

Hoare's "monitors" [Hoa 2] gave a discipline for the administration of shared resources in concurrent programming.

These papers have helped

towards understanding the art of concurrent programming. differs frcm all of them in two ways:

Our calculus

first, it is not in the accepted

sense an imperative language - there are no commands, only expressions; second, it has evolved as part of a mathematical study.

In the author's

v i ~ it is hard to do mathematics with imperative languages, though one may add mathematics (or logic) to them to get a proof methodology, as in the well-known "assertion" method or Hoare's axicmatic method. One of the main encumbrances to proof in imperative languages is the presence of a more-or-less global m~mory (the assignable variables). was recognized by Hoare in "Communicating Sequential Processes"; CSP is imperative

~his

although

Hoare avoids one aspect of global m~nory which makes

concarrent programs hard to analyse, by forbidding any member of a set of concurrent programs to alter the value of a variable mentioned by another m~.

This significant step brings CSP quite close to our calculus, the

more so because the treatment of eutmunication is similar and expressed in similar notation.

Indeed, algorithms can often be translated easily from

one to the other, and it is reasonable to hope that a semantics and proof theory for CSP can be developed frGm CCS.

Hoare, in his paper and more

recently, gives encouraging evidencs for the expressiveness of CSP. We now turn to two models based on non-synchronized o~t,manication. One, with strong expressive power, is Hewitt's Actor Systems; reference is [HAL].

Here the ~ c a t i o n

a recent

discipline is that each

message sent by an actor will, after finite time, arrive at its destination actor ; no structure over waiting messages (e.g. ordering by send-time) is imposed.

This, together with the dynamic creation of actors, yields

an interesting programming method.

Hc~ever, it see~ns to the author that

the fluidity of structure in the model, and the need to handle the collection of waiting messages, poses difficulties for a tractable extensional theory. Another non-synchronized model, deliberately less expressive, was first studied by Kahn and relx)rted by him and MacQueen [KMQ].

Here the

interc~Li~t.~nicationof agents is via unbounded buffers and queues, the

whole being determinate.

Problems have arisen in extending it to non-

determinate systems, but many non-trivial algorithms find their best expression in this medit~n, and it is an example of applicative (i.e. non-imperative)

prograrmling which yields to extensional treatment by

the semantic techniques of Scott.

Moreover, Wadge [Wad] has recently

shown how simple calculations can demonstrate the livemess of such systems. A lucid oc~parative account of three approaches - Hewitt, Kahn/ MacQueen and Milner - is given in [MQ]. In Chapter 9 of these notes we show how one type of concurrent language - where ccmmmnication is via shared variables - may be derived frc~ or expressed in terms of CCS.

This provides sane evidence that our

calculus is rich in expression, but we certainly do not claim to be able to derive every language for concurrency. A rather different style of presenting a concurrent system is exer~olified by the path expressions of Campbell and Habermann [CaH]. Here the active parts of the system are defined separately from the constraints

(e.g. the path expressions) which dictate how they must

synchronize.

More recent work by Lauer, Shields and others - mainly

at Newcastle - shows that this model indeed yields to mathematical analysis.

A very different example of this separation is the elegant

work of Maggiolo-Schettini et al [ ~ ] ;

here the constraints are

presented negatively, by stating what conjunctions of states (of separate ccnponent agents) may not occur.

This approach has an advantage for

systems whose crmponents are largely independent (the authors call it "loose coupling"), since then only few constraints need to be expressed. This section has shown the surprising variety of possible treatments of concurrent systems.

It is nothing like a cc~prehensive survey, and

the author is aware that important work has not been mentioned, but it will serve to provide sc~e perspective on the work presented here.

O. 4

Evolution %Tuis work evolved frc~n an atter~ot to treat c~L~nication mathemati-

cally. [Mil 11

In Milner : "Processes:

a mathematical model of ~ t i n

9 agents"

a model of interacting agents was constructed, using Scott's

theory of dcrm~ms. and Milner:

~his was refined and grew more algebraic in G. Milne

"Concurrent Prooesses and their syntax"

EMM3.

At this

point we proposed no programming language, but were able to prove properties of defined c o n ~ n t

behaviours.

For example, Milne in his

Ph.D. Thesis "A mathematical model of concurrent computation" [Mln] proved partial correctness of a piece of hardware, a card-reader, built from four separate cc~ponents as detailed in its hardware description. Our model at this stage drew upon Plotkin's and Sa~yth's P ~ e r ~ constructions,

[PIo i, Sa~y]. which extended Scott's theory to admit

non-detenminism.

Part of our algebra is studied in depth in [Mil 2].

At this point there were two crucial develo~aents.

First - as we

had hoped - our behaviour definitions looked considerably like programs, and the rescm%blance was increased by merely improving notation. result, essentially the language of CCS, was partly p ~ t e d

The

is reported in [Mii 3] and

by discussions with Hoare and Scott.

(For completeness,

two other papers [Mil 4,5] by the author are included in the reference list.

Each gives a slightly different perspective from [Mil 3], and

different examples. )

The second develolm~nt was to realise that the

resulting language has many interpretations;

and that the P c ~ r ~

model, and variants of it, may not be the correct ones. needed, to reject the wrong interpretations. to observation equivalence;

A criterion was

For this purpose, we turned

two behaviour expressions should have the

sane interpretation in the model iff in all contexts they are indistinguishable by observation. It now turns out that a definition of observation equivalence (for which admittedly there are a few alternatives)

detemnines a model, up

to isc~orphism, and moreover yields algebraic laws which are of practical use in arguing about be2~iriours. which are in some sense complete;

We have strong hope for a set of laws in fact the laws given in Chapters 5

and 7 have been shown cc~!olete for a sinplified class of finite (ten~inating) behaviours.

In this case, "complete" means that if two behaviour expressions

are observation-equivalent in all contexts then they may be proved equal by the laws; 0.5

this completeness is shown in [HM].

Outline In Chapter 1 we discuss informally the idea of experimenting on, or

observing, a non-dete2xninistic agent;

this leads to the notion of

synd0monisation tree (ST) as the behaviour of an agent.

Chapter 2 dis-

ct~ses m t u a l experiment, or c~mL~nicaticn, between agents, and develops an algebra of STs.

In Chapter 3 we do a small case-study (a scheduling

system) and prove scxnething about it, anticipating the formal definition of observation equivalence and its properties to be dealt with fully in Chapter 7. Chapter 4 enriches our cul,udnications - up to now they have been just syndlronizations - to allow the passing of values frcm one agent to another, and illustrates the greater expressive p ~ e r

in two more exar~les;

cne is

akin to Data Flow, and the other is a concurrent algorithm for finding a zero of a continuous function.

The notion of derivative of a behaviour

is introduced, and used in the seccnd example. In Chapter 5 we define CCS formally, giving its dynamics in terms of derivations

(derivative sequences).

~his yields our strong congruence

relation, under which two programs are ccngruent iff they have essentially the same derivations, and we establish several laws obeyed by the congruence. In Chapter 6 we present c~mlunicaticn trees (CTs, a generalisation of STs) as a model which obeys these laws;

this model is not necessary for the

further development, but meant as an aid to understanding. Chapter 7 is the core of the theory;

observation equivalence is

treated in depth, and from it we gain our main congruence relation, observation congruence, under which two prograns are congruent ~iff they cannot be distinguished by observation in any context.

Having derived

scme properties of the congruence, we use them in Chapter 8 to prove the correct behaviour of two further systems, both to do with data structures. In Chapters 9 and IO we look at sane derived Algebras.

One takes the

form of an imperative concurrent programming language, with a s s i s t statements, "cobegin-coend" statements, and procedures.

In effect, we

show how to translate this language directly into CCS.

The other is a

restriction of CCS in which determinacy is guaranteed, and we indicate how proofs about such programs can be sir~ler than in the general case. Finally, in Chapter ii we try to evaluate what has been achieved, and indicate directions for future research.

CHAPTER

1

Experimenting on nondetenninisticmachines

ioi

Traditional equivalence of finite state acceptors Take a pair

={a,b,c,d}

S,T

of nondetezadnistic

acceptors over the alphabet

:

T

The accepting states of

S

and

T

are

s 2 and

t 2 respectively;

in non-

deterministic acceptors we can always make do, as here, with a single

'dead'

accepting state. A standard ~

t

accept the same language

that

S

and

T

are equivalent, meaning that they

(set of strings), run~ as follows.

t i) to represent the language accepted starting frcm state get a set of equations for

S , and for

Taking

s i (resp

s i (resp t i) , we

T :

s O = as I

t O = at 1 + at~

s I = bs 2 + cs 3

t I = bt 2

S2 = ~

t I = ct 3

S 3 = ds 0

t2 = £

!

t 3 =dt 0 Here as usual

+

stands for union of languages,

e

for the language

containing ~nly the 6~pty string, and we can think of the symbol for a function over languages:

as = a(s) = {a~; ~ E s} .

Now by sinlole substitution we deduce s O = a(bc + cds0) . By applying the distributive law s O = ab~ + acds 0

a(s + s') = as + as'

we deduce

a

standing

10

and we can go further, using a standard rule for solving such equations known as Arden' s rule, to get sO = (acd)*abe . For

T

it is even simpler;

we get directly (without using distributivity)

t O = ab~ + acdt 0 and the unique solvability of such equations tells us that and

T

sO = t O , so

S

are equivalent acceptors.

But are they equivalent, in all useful senses?

1.2

Experimentin 9 upon acceptors Think differently about an acceptor over

{a,b,c,d> .

It is a black

box, whose behaviour you want to investigate by asking it to accept symbols one at a time.

So each box has four buttons, one for each symbol: a

a w

S

b

sO t

i d

There are four atomic e x p e r ~ t s a-experiment on

S

T

I

b

tO

you can do, cne for each symbol. Doing an

(secretly in state

s O , but you don't know that) con-

sists in trying to press the a-button, with two possible outccmes in general: (i)

Failure - the button is locked;

(ii)

Success - the button is unlocked, and goes down (and secretly a state transiticn occurs).

In fact we cannot distinguish between by any single atcndc experiment;

S

and

T , in their initial states,

the a-experiment succeeds in each case, and

the other three fail. After a successful a-experiment on each machine, which may yield a S

bl

a #

s1~d t

.

T

b

i

d

t

t we may try another atc~tic experiment, in our aim to see if the machines are equivalent or not.

Clearly a b-experiment now succeeds for

S

and fails

11

for

T , though the other three e x p e r ~ t s

fail to distinguish the~.

trying the b-experiment, then, can we conclude that

S

and

T

After

are not

equivalent? No, because

S's response to the a-experiment could have been different

(for all we know) and locked the b-button, while

T's response could have

been different (for all we know - and it could indeed') and unlocked the b-button.

Following this argLm~nt further, we may feel forced to admit that

no finite amount of experiment could prove to us that

S

and

T

are, or are

not, equivalent'. But suppose (i)

It is the weather at any mcn~nt which determines the choice of transition (in case of ambiguity, e.g. a-experiment)

(ii)

T

at

t O under an

;

The weather has only finitely many states - at least as far as choice-resolution is concerned ;

(iii) We can control the weather . For sane machines these assunptions are not so outrageous; for example, one of two pulses may always arrive first within a certain temperature range, and outside this range the other may always arrive first.

(At the boundary of

the range we have the well-known glitch problem, which we shall ignore here.) Nc~, by conducting an a-experiment an

S

and

T

under all weather con-

ditions (always in their start states, which we have to assume are recoverable), we can find that

S's b-button is always unlocked, but that

T's

b-button is sc~etimes locked, and we can conclude that the machines are not equivalent. Is this sense of equivalence, in which a meaningful one?

S

and

T

are not equivalent,

We shall find that we can make it precise and shall adopt

it - partly because it yields a nice theory, partly because it is a finer (s~aller) equivalence relation than the standard cne (which we can always recover by introducing the distributive law used in §i.i), but more for the following reason.

Imagine that the b-buttons on

Then in all weathers every successful e x p e r ~ t visible button: S (with

b

hidden) is not deadlockable

S upon

and S

T

are hidden.

unlocks same

12

while in sc~e weathers, and after same experiments, all of

T's visible

buttons will be lo~ked: T (with

b

hidden) is deadlockable.

We wish to think of a nondeterministic choice in such machines as being resolved irreversibly, at a particular manent, by information flowing into the system from an unseen source;

if a deadlock can thus arise in one machine

but not in another, we do not regard them as behaviourally equivalent.

1.3

Behaviour as a tree Because we reject the distributive law

a(x + y) = ax + ay , we can no

longer take languages (sets of strings) as the behaviours of our machines. We proceed to an alternative.

Frcm now on we will use

NIL

instead of

e

to stand for a behaviour which can do nothing (= admits no experiment) ; we shall also use Greek letters for our ~ i s should consider

~,~,y ,5

- i.e. names of buttons - so you

as replace~_nts for

First, take the transition graph for

a,b,c,d

S

in our sinple example.

and unfold it into a tree with

states as node labels and symbols as arc labels:

B

Because state na~es are present we have lost no information; the state transition graph can be recovered frcm such a tree. see the state - he can only see the transitions.

But the experimenter cannot This leads us to drop the

node labels, and take the infinite tree

U as the behaviour of I Definition We are using

S .

a

A label is a n~mber of a given (fixed) label set ~,B,Y,.. to stand for labels.

-A .

(The use of the word 'label' in

place of 'symbol' will be further motivated later.)

13

I Definition

A sort is a subset of A

We shall usually use

g

L,M,N, .. to stand for sorts.

We shall also often use

the word a~ent in place of 'madline' or 'acceptor', so 'S is an acceptor over the alphabet

Z'

becomes 'S is an agent of sort Definition

L'

A Rigid Synchronization Tree (RST) of sort

unordered, finitely b r a n ~ member of

L

is a rooted,

tree each of whose arcs is labelled by a

L .

Thus the tree in the last diagran is an RST of sort

{~, B, ~, 8} .

(It is also

an RST of any larger sort.) Why 'rigid'?

Because it is the behaviour of a rigid agent - one which

can make no transition except that corresponding to an atomic experiment.

We

shall soon meet other transitions. Why 'synchronizaticn'?

Because we shall later see how the oammunication

of two agents can be represented in fozrcing their joint tree frcm their separate trees.

Then the joint tree will not be rigid, in general, since

intercuf,udnication between cc~ponent agents is not observable. Notice that finite RSTs can be represented as expressions:

B//~

is

~ ~

is

(BNIL + ~NIL)

~BNIL + ~ N I L

and usually there is more than one natural expression: ~rIn + (~NIL + 7NIL) , or

is

(c~LL + BNIL) + yNIL . Indeed,

+

is both oactuutative and associative, since we declared RSTs to

be unordered trees - and

NIL

is easily seen to be a zero for summation.

To justify these remarks we nc~ define the algebra of RSTs.

14

i. 4

Algebra of RSTs Ignoring sorts for a mcn~nt, we have an elementary algebra over RSTs,

whose operations are: NIL

(nullary operation) NIL

+

is the tree

•

;

(binary operation) + A

is the t r e e ~

(unary operation, for each

(identify roots) ~

), ~ A)

They obey the follc~ing laws, as you can easily see: Associativity

x + (y + z) = (x + y) + z

Ccurnutativity

x + y = y + x

Nullity

x + NIL = x

In fact, these laws are ccalolete:

any true equaticn between RST expressions

can be deduced frcm them. If we consider sorts, and let then

NIL

is of sort NIL

Further,

and

~

~

L

for any

RST L

be the set of RSTs of sort

L ,

L :

RST L .

+

takes trees of sort

+

E

L,M

RST L × RST M ÷ RSTLu M

takes a tree of sort

L

respectively to a tree of sort

LuM :

,

to a tree of sort

Lu{l} :

We shall usually forget about sorts for the present, but there are times later when they will be essential. Consider now solving recursive equations over RSTs. ations for our agent

S

We wish the equ-

of §l.1

s O = ~s I

s I = ~s 2 + ys 3

s 2 = NIL

s 3 = 6s 0

to define the (infinite) behaviour of

S

as an RST of sort

{~,8,Y,8} -

15

This set of equations has a unique, solution for the variables

s0 ' ""s3

;

you can see this by the fact that the entire tree can be developed top-down to any depth: =

sO

=

=

...

and so on.

Not every set of recursive equations has a unique solution; consider the simple equation s

=

s

which is satisfied by any RST (or anything else, for that matter) . Again, scrne sets of equatioD~ define no RST at all. s

=

s +~NIL

Consider the equation

;

a solution would have to be infinitely branching at the root.

Even if we

allowed infinitely branching RSTs, so that

would be a solution, it would not be unique since be a solution for any Exercise i. 1

sO + t

t . We defer this problem to Chapter 5.

Can you find a condition on a set of equations

sO =

Q

•

•

O

i

O

(with RST expressions involving si =

s O ,.. ,sn

on the right-hand sides)

ooo S n

would also

=

which ensures that it possesses a unique solution in RSTs? (Hint:

1.5

consider cycles of

c-transitions in transition graphs.)

Unobservable actions Under the conventional definition, a nondeterministic acceptor may

have transitions labelled by fication of our

R

S

~ ~ the null string.

Consider

R , a modi-

of §i.I (reverting briefly to Rcn~ml alphabet):

a

~

~

d

~

~

16

(The loop fomaed by the

d-transition is irrelevant to our ccrnparison.)

In the conventional sense,

R

and

S

are equivalent.

But what does the

c-transition mean, in our more mechanistic interpretation? R

in state

r i (i.e. after the

r I' , and that if a

move silently to state

It means that

a-button has been pressed) may at any time b-experiment is never attesloted

it will do so. Thus, if we attespt a

b-experiment on

R , after the successful

experiment, there are sc~e weather conditions in which we find the button peamanently locked; (after the

if on the other hand we a t t ~

a

a-

b-

c-experiment

a-experiment) we shall in all weather conditions find the

c-button eventually unlocked (eventually, because although little t ~

to decide on its

R

may take a

e-transition, it will do so since no

b-

experiment is attespted). Exercise 1.2 and

T

Use this as the basis of an ~

are equivalent.

t

that no pair of

A rigorous basis for the a r ~ t

R, S

will be given

later. Let us return to our Greek alphabet, and ask how we should write the equations specifying e

R's behaviour.

We choose the symbol

T

in place of

(to avoid confusion with the null string), and use it as a new unary

operation uponbehaviours. r0,..,r 3

The equations dete_~mining the behaviours

are: !

r 0 = ~r I

r i = 8r 2 + xr~

r 2 = NIL

r 3 = ~r 0

We are ass~aing that Definition

r I = yr 3

T % A (the fixed label set).

A Synchronization Tree (ST) of sort

L

is a rooted, unordered,

finitely branching tree eac~ of whose arcs is labelled by a ~ r Lu{~}

of

.

Thus a rigid ST (an RST) is just an ST with no arcs labelled

T ;

it is

the behaviour of an agent which can make no silent transitions. Since we are taking the unary operation

we can of course deduce the ST-behaviour of

T

R .

over STs to be given by

It is

17

Y

y

-

STs are a sinlole and useful notion of behaviour.

They are just the

unfoldings of behaviour equations, which in turn follow directly fran transition graphs.

Of course in this way different transition graphs can

yield the sane ST, frcrn which we can be certain that they are i n d i s ~ s h -

able by experiment. Exercise 1.3

Convince yourse1_f that the transition graphs

have the same unfolding. However, different STs (or transition graphs yielding different STs) may be indistinguishable by experiment.

This is true even for RSTs;

consider the simple pair

each of which adaits a single

~-experiment and then nothing else.

But it is even more true in the case of unobservable actions. we shall study an equivalence relation, c~servation equivalence,

Later

over STs,

which can (for finite STs) be axicmatized by a finite set of equations added to those given in §1.4 above.

To get a foretaste of the equivalence

consider the following exercise. Exercise 1.4

ExamiD~ each of the following pairs of s ~ p l e STs and try to

decide by infozmal ~ t ,

as in Exercise 1.2 above, which are observation

equivalent (i.e. indistinguishable by experiment).

You may reasonably

conclude that four pairs are equivalent, or that six pairs are equivalent, but you should also find that the notion of equivalence is not yet precise. Ehe point of this exercise is that it is not trivial to capture our infozmal arguments by a precise notion.

oH~

oH ~

c~

o~

v

~

f

O

~o

Chapter 2

Synchronization

2.1

Mutual experimentation ~he success of an

s-experiment enables the machine to proceed (to

offer further experiments);

it also allows the observer to proceed (to

attempt further experiments).

This suggests an ~bvious symmetry;

we

would like to represent the observer as a machine, then to represent the ccmposite observer/machine as a machine, then to understand how this m c h i n e behaves for a new observer. How should two machines interact?

S

~

T

0

We must say which experiments offered by which experiments of

T

S

may combine with or (ccraplement)

to yield an interaction.

label correspondence (e.g.

a ++~, ~++ n)

for each machine ccmbination,

we introduce a little structure on our label set We ass~ne a fixed set

A

of names.

Rather than set up a

We use

A. ~, B, y, ... to stand for

names° We assume a set with it;

o~(~A) ~ and we call we have

~

of co-names, disjoint frc~

~

~.

Using ( ) also for the inverse bijection,

~ = ~.

to range over

A.

A =

A u

We call

to be our set of labels. l

and

[

in particular for any sort

L,

~, = {~;

We shall scmetimes need the function name(a) = name (~) = which we extend to sorts by defining

We shall use

X

cc~plementary_ labels.

The function (-) is now a bijection over A;

and in bijection

O)

~ ~2 ~n = p, P = P0 - - ~ P l ---~ P2 . . . . . >Pn " Now consider the result(s) of performing a sequence experiments on

p

k0 P •

(n ~0).

ki lIT

~l,...,In

The result may be any

p'

of atcmzic

for which

kn 12...I T ...... n > p'

(ki > O)

;

that is, an arbitrary number of silent moves may occur before, among and after the Definition

I.. 1 for

s ~ A* , define the relation

P s___>p, iff for sc~e

Tk01sTk112. •.

" p

if

s = I I " " % n ' then

in~kn >p'

s-experiment

" p

s

(se h*), and then

admits an s-experLme/~t and can transform to

also say more briefly

by:

k 0 ..... kn_>O

p We may talk of an

s

~

can produce

Note that for the empty sequence

p'

p ~ p'

under

p,

means

as a result" ;

we may

s ".

E • A* , an e-experiment ccnsists of

lettJ_ng the agent proceed silently as it wishes, while observing nothing; for ~.~ have p ~

p'

iff for scme

Note also the special case

p ~

k>-O p

when

k p ,,,~,~ p' . k = 0 .

Now we can state in words what we shall mean by equivalent agents. p

and

q

are equivalent iff for every

(i) For every result

p'

of an s-experiment on

is an equivalent result (ii) For every result equivalent result

q' p'

se A*

q'

p , there

of a s-experiment on

of an s-experiment on of a s-experiment on

q .

q , there is an p .

42

qhis appears to be a circular definition (the formal definition will take care of this point) but note first that it implies that, for each

s , p

admits an s-experiment iff

But it implies much more;

q

does.

for example, the two ST's

admit exactly the same s - e x p e r ~ t s ,

but neither of the two possible

results of an s-experiment on the first tree is equivalent to the result of an s-experiment on the seccnd. The motivation for our definition is this: on, perfomT/ng an e x p e r ~ t ,

we imagine switching

and switching it off again.

equivalent, it must be possible to switch

q

For

p

to be

on, do the sane e x p e r ~ t ,

and switch it off in a state equivalent to the state in which switched off (and the same, interchanging

q

p

and

p

was

q ).

Our fomnal definition is in terms of a decreasing sequence ~0' ~i . . . . .

=k ....

of (finer and finer) equivalence relations:

Definition (Observation equivalence)

Exercise 3.3

(i) if

p =>

S

p,

(ii) if

s q ~

q,

iff Vk->O.

then for scme

q', q ~

s

q,

then for same

p', p ~

p'

P ~k q

(a) Prove that each

induction on that

is always true;

iff V S e A*

P ~k+i q

p m q

P ~0 q

p ~k+l q

k .

(i.e. ~ = ~ = k k

~k

q "

and

p,

~k

q,

;

P' ~k q' ;

)

is an equivalence relation, by

(b) Prove by induction that

ini°lies p ~

and

~k+l c_ ~k ' i.e.

43

This equivalence relation has many interesting properties, which we need not exmnine until Chapter 7 - except one or two. First, it is not necessarily true that recurrence relation defining p~q

~k+l

V s e A* s p~ (i) if p = >

~

itself satisfies the

in terms of

~k ' that is, the property

iff

(ii) if

(*) then

~> q,

q

then

3q'.q S > q , 3p'.p

s> p,

& &

p,~q, p,

~q'

(which is a formal version Of our verbal recursive definition of equivalence given earlier in this section). but not in general. one which satisfies

It is true if

case we shall call

~cise ~[

3.4

and

q

are finite STs,

However, our definition has nioer properties than (*).

For STs, our binary relations t _~I t' (resp. t

p

T> t') t'

iff

a

and

T.

has a branch

are obvious; It' (resp. Tt').

l-son (resp. •-son) of

Prove that

inductive proof that

t

)'>

t ~ Tt

for

STs.

In this

t .

(You need a veiny simple

t ~ k ~Zt).

Let us consider one exanple of equivalent STs:

t

To check equivalence, i.e. step:

t ~u

implies

identical trees under and

t ~k u

t ~

t ~k+lU. s ; ~lder

by induction.

u

for all

k , we must prove the inductive

Now for every

s~ c, t and u produce

e , t produces only

t

and

u

cnly

u ,

44

Definition

(Note that

If

P s p,

p

(o e A*)

p'

is an s-derivative of p.

is always an s-derivative of itself).

rephrase the definition of " P ~k+l q

Zk+l

iff, for all p

Exercise 3.5

in t e ~

s(A*

and

q

up to

of

We can thus

~k :

, s-derivatives

have the same

~k

equivalence.

"

Re-examine Exercise 1.4, and verify precisely which pairs are

observation equivalent.

Exercise 3.6

then

(Deadlock)

You should find exactly four pairs.

Prove that if

p~q

is true of both or of neither, for given "It is possible to do a

11 . .. In

reach a state where a

then the following statement 11,. .. ,ln,ln+ 1 :

experiment and

kn+i-experiment is impossible"

One property of agents is not respected by our equivalence. possible for

p

and

q

to be equivalent even though

p

It is

possesses an

infinite silent cc~mputation P J-~ Pl - ~ {diver~enoe)

while

P2 - ~ q

.... Pk ~

Pk+l ~-~

cannot diverge in this way.

be refined to exclude this possibility.

3.4

"'" The equivalence can

See the remarks in §7.3.

Proving the scheduler It is ~ s o m e

to use the direct definition of ~ ; we shall instead

use a few of its key properties, ~hich are derived fomaally in Chapter 7. We begin by listing them, so that Chapter 7 need not be read first. (~ 1 )

t ~ Tt

NoW we can see that t

by

t' (when

(see Exercise 3.4) ~

is not a ccngruence relation;

t ~ t ')

exanlole , N I L ~ TNIL,

in

but

u

to get

~NIL + NIL

u'

that is, replacing

does not ensure

~ ~NIL + TNIL •

u~u'.

For

45

I Exe_r_cise 3.7

Verify this fact.

So ingeneral

t ~ t'

other operations do preserve (~ 2)

t ~ t'

t + u ~ t' + u .

does not imply

implies

But all our

= pt ~ ut'

(.see below for

tlu~t'lu

and

~ )

ult~u'It

t\~ ~ t'\~ t[S] = t'[S] Fortunately, too, when we apply a guard p to equivalent STs get not cnly

pt~t',

but

ut ~ pt' , where

t,t'

we

~ is a strQnger relation than

which is preserved by all our operaticns. (~ 3)

~

is a oongrue.nce relaticn, and t c t'

inplies

t ~ t'

Beyond these, we need one more property ~ i c h may look a little surprising; we leave its discussion to Chapter 7 . (~ 4)

t + Tt c Tt

Apart fran this, the proof below will use only rather natural properties of our operations, including the Expansion ~heorem, all justified by Qhapter 5. ~

treat only the first constraint, namely S~h

Define the left

[I (~i

I " ' " IBn '~ ) ~

hand s i d e t o be

(%" - ..~n )~

Sch'

satisfies the defining equation of

.

(I)

We s h a l l

actually

show t h a t Sch'

(~i o . .~n )~ , namely

Sch' ~ ~ l " " ~ n Sch' .

(2)

frc~ which (i) follows, by general principles which we shall not treat here (but see Exercise 7.7). We may write SCh' =

Sch'

as

(s fell ... I C'n)\71"''\Yn

(using general properties of

I and \e ), where

C'l = (ci I B~m)\~il represents the ith cycler with

(3)

(4) ~i

pe~nitted.

Now we shall discover

46

below that w

--Yi~iYi+l c ,l'

C

Ci so ~

(5)

can use these expressicns interchangably, by (~ 3), to assist our

expansion of Sch', which runs as follows:

schl

c

(?:[NILIYI~I?2c; I . . . . t ~ n % ? l C n , ) \ ¥ 1 . . . \ ¥ n

C

--

--

(the start buttcn has worked)

c ~h~2"

.~npf-~ p,", p , ~ p-~, q 4 c~y > p..-., p,--, pr~ p , ~ p,"~ p,"~ p r , p~-, q •

After

.etc .....

n

Exercise 4.1

u's, 2n - I 7's (and no more) can have occurred. (For fun).

Describe the behaviour of

precisely - e.g. how many Exercise 4.2 which

y's

p~q

a bit more

must have occurred after

Build a counter of sort

n

~'s?

{i ,6 ,~}

(i) Can always be incremented by an 1-experJ/nent; (ii) Can be decremented by a f-experiment if non-zero; (iii) Can admit a ~-experiment only when it is zero. Hint:

in state

about

n

by one;

n, it will be sGmething like a chain of

cells.

Incrementing must increase the cell-count

d~ting

must decrease the cell-count by one by

causing one cell to die - i.e. became NIL.

You m y

need a

doubly linked dnain, built by a suitably generalised chaining operator, and looking like

"0:

0:

But our calculus so far has an irmportant restriction which makes it inadequate for programming;

all ccm,I~mication is pure syndqronization,

and no data-values are passed fram one agent to another.

True, we could

in principle 'read' the contents of the counter of Exercise 4.2 by. seeing how many decrements (6) are needed before a ~ Tnis would be ~ c m e ,

(test for zero) is offerred.

to say the least, and for the counter as specified

it would destroy the count stored in it:

49

So we now proceed to a generalisation of the algebra. so we are forced to abandon our ST interpretation. place must wait till Chapters 5 and 6;

In doing

What takes its

meanwhile the reader must

realise that - for example - the equality symbol between our more general behaviour expressions is not explained in this chapter.

4.2

Pass in~ values Consider the simple behaviour

%_

P = ~ 8 ~ p

S~p~8

It's no more than the cycler of Exercise 2.7, but if we think of positive labels (e,8) and negative labels

(~)

?

as accepting input pulses,

as giving output pulses, then

p

beccmes

a behaviour which "gi~_s an output whenever it has received two inputs" (the inputs being demanded in a particular order). Suppose that an input at a value (an integer, say).

~

consists of more than a pulse;

it is

qhat is, attempting an a-experiment on

consists of offerrin9 a value to

p

at s .

p

We may then wish to represent

p 's behaviour as p = ex.--where

x

is a variable (supposed to become bound to the value received

in an s-experiment), and - - - is sc~e behaviour expression _dependent upon x

x , i.e. containing

is bound by

x

as a free variable.

We say that the variable

a, and its sco~e is - - - .

(This is very f~niliar to anyone who knows the l-calculus;

the difference

here is that any positive label e may bind a variable, while in the l-calculus there is only one binder - the symbol "I".) We can go further, in our aim to transfo~n

p

into a behaviour whose

output values depend on its input values, and write p = ~x.Sy. - - Here

8

binds the variable

while the scope of

y

since then any occurence of to

x ;

y .

Note that the scope of

is just - - - . x

the value bound by

x

is

By.---,

(It would be stupid to write

ax.Sx.---

in - - - would refer to the value bound by a

to

x

is inaccessible.)

50

Suppose we want the s~n of

x

and

y

to be output at

~ .

That is, in general for negative labels, attespting a ~-experi1nemt on

p

cc~sists of ~ d i n ~

a value fram

p

at

~ .

Thus negative

labels do not bind variables - instead they qualify value expressions (which may contain variables).

SO we write

p = ~x. 8y.~ (x+y) .p it is now proper to talk of an " ~ v-experiment" rather than an "~-exp~_r~t",

where

v

is the value submitted by the c~server, and

similarly of a "~ v-experiment" where observer.

v is the value received by the l So, generalising the relation --~ of §3.3, we say p X_~Vp,

means ,,p admits a I v - e x p e r ~ t ,

and can

transfozm to p' as result". (Note the different sense, according to the sign of I .) As a general rule then, we can state ~x.B where

v

eV~

is any value,

B{v/x} B

B{v/x}

is a behaviour expression, and

the result of replacing all unbound occurrences of

x

in

B

by

means v.

And similarly (more sin!sly) ~v.B

~V;B

for the 2articular value on

v o

So the following derivation is possible

p: p = ~x.By.~ (x+y) .p ~3 ~ By.~(3+y) .p 84 ~ (3+4) .p

~7~

p

(See §4.4 for more about derivations.) Now we have hardly anything more to add to our language before finding that it can be used conveniently for progranming.

As for its inter-

pretation, we can introduce a generalised fona of ST which we call Cxa~,t~nication Trees (C~), but for the present we wish to rely on intuitive understanding.

51

We shall usually be handing expressions of the fo~m [ ~ixi.B i i ! Bi,Bj, ~ It

where

and the

E

+

[ ~jEj.B i j

+

[ T.B~ k

are behaviour expressions, the

are value expressions.

xi

are variables,

As for expressions involving

3 cc~position (I) and the other operations, it will be enough to look at a simple example and then give a generalised Expansion Theorem (§2.5). Consider B = (~x.B I + BY.B2) i ~v.B 3

We expect a s~n of 4 temas, one involving

~ :

B = ~x.(BII~v.B 3) + 8y.(H21~v.B 3) + ~v.((ex.B 1+Sy.B 2) I B 3) + Y-(HI{v/x}IH 3) Note that the "label" • does not bind a variable or qualify a value expression.

We shall also reselcve the right to use other labels in

this simple way when they only represent synchronization. shall allow a positive label to bind a tuple

x = Xl,...,x n

variables, and a negative label, to qualify a tuple value expressions;

g

of (distinct)

E = El,... ,En

of

then for pure synchronization we just use O-tuples.

We shall use the term guard to ccr~prise the prefixes and use

In fact we

to stand for a guard.

Dijkstra [Dij]

~,6~

and T,

invented the notion

of guard, to stand for same condition to be met before the execution of a program part. is

It is natural to adapt it to the case where the condition

the acceptance of an offerred c~Lunication, as Hoare [Hoa 3] has

also done in his CSP.

We then find that the analogue of Dijkstra's

guarded ccn~ands is provided by st~mation; Egk. ~

we refer to an expression

as a sum of 9~ards, and call each

expression.

Expansion Theorem Let

gk'~

a s ~ n a n d of the

We denote the nan~ of g's label by name(g). (stated and proved as Theorem 5.8).

B = (Bll...IBm) kA , where each

Bi

B = [{g.((BIO...IBII...IBm)\A) ; g.B l

is a s~n of guards. a summand of

+ ~{T.((BII...IB~{~/~}I...IB~I...IBm) A); Hi, eE.B 3

a summand of

B 3• ,

~.B'.l

g.

Bi, name(g)% A} a simTnand of

i~j}

provided that, in the first tena, no free variable in by

Then

Bk(k ~ i)

is bound

52

The meaning

of the Theorem is that all unrestricted actions and all

internal c~,~Lunications in

B

may occur.

Note that our language contains two distinct kinds of expression value expressions and behaviour expressions. the first kind, B the second.

Consider

~ E.B ;

E

is

We allow the following simple but

important constructs in our language: (i) Conditional behaviour expressions. if where

E

E

then

B 1 else

B2

is boolean-valued.

ex.(if x->O

then

Consider for example

~x.B

else

{x.B)

(ii) Paraneterised behaviour definitions. a(y) = ax.(if

x->y

then

(iii) Local variable declarations. let

x=6

and

y=lO

in

For example:

~x.a(y)else

{x a(y))

We shall allow constructs like B

and B

where

x = 6

and

y = i0

.

They mean exactly the same - namely, the same as substituting 6

for

x

and

i0

for

y

throughout

B.

We hope that the language is simple enough to be understoc~ intuitively, without fonmal syntax.

4.3

An example

-

Exact f o ~ a t i o n

comes later'

Data Flow

We will now show how to build and verify a simple system which bears a strong relation to the Data Flow Schemata of Dennis et al [DFL] o The task is to build a net which will ccmpute integer

2x

for arbitrary non-negative

x , given components for cc~puting more primitive functions and

predicates, and same standard gating and switching ~xml0o~ts.

That is,

we want a net whose behaviour is observation equivalent to a = ix.o2 x. a (We shall often use standard ccm~nents.

~

(i) for input, o for output).

First, we define same

53

(i) Unary functic~ agent For arbitrary unary function DO f

=

f , we define the agent

ix.o(f(x)).(DO f)

(2)

~DOf/

0 we shall only use sinple f's ; we are actually trying to build the b e h a ~ o ~

~b~p where

bexp (x) = 2x , as you can see by oanloaring (I) and (2).

(ii) Unary predicate agent For arbitrary unary predicate

p , we define

A S K p = ~x. i_~fp(x) then

olx. (ASKp)

else

~2x. (ASK p)

Note that the value

x

4 ol

o2

is passed unchanged out of one of the

output ports. (iii) A ~ate

4~I C~TE

=

~x.ox.y.GATE

~ G ~ /

%~e gate transmits a value unchanged, but n~st be r e - ~ e d

at

y to repeat.

=

ix.y.ox.TRIG

TRIG

y~T~G/

Like a gate, but must be triggered (or trigger sc~neone

O

else') after receipt and before transmission. (v) A source For arbitrary constant value

v , a ~ent

source of

is given by DOv

=

~.ov.(DOv) O

We use

D O , because the unary function agent is easily

generalised to just

n-ary function agents, and constants are

o-azy functions.

v's

54

(vi) A sink SINK

=

Ix.SINK

~S'INKy

For discarding ur~anted values. 1

(vii) A switch

t

SWITCH

=

Ix. (YI.OlX.SWITCH + Y2.o2x.SWITCH)

Y1 ~-~TI~y2 o/

02

A generalisation of a trigger; triggering

Yi

selects output port

This is all we need for our example;

oi "

it is not a cc~plete (or necessarily

best) set, and it would be interesting to design a good set of cc~ponents which could be shown adequate for a wide class of data-flow computations. We would like to factor our design into a control part and a controlled part.

For the control part, it will be convenient to build

an agent observation-equivalent to x times CONTROL = ix:y. • • • .y.'~.CONTROL i.e. for input

x

it will admit

x

and return to its original 'state'.

(3)

y-experiments followed by a 6-experinent, We show the net for realising CONTROL;

it can be shown by Expansion to satisfy an equation like (3) with many intervening w's, and this is observation equivalent to CCNTROL, as we shall see in Chapter 7.

55

I

i I !

CONTROL

I

t I

\ \ ! ! ! b i

\

i i : I

t

Y \ I

\ ##

\ % %

6

# ! I I I

| | I I I !

One can check for the right b~haviour infozmally, by "arrow-swinging". Note that the initial state is restored, and that if either trigger is replaced by a gate then 'overtaking' can occur, yielding the wrong behaviour.

56

The oontrolled part, or body, is to admit a value then after

n

v

at

~' ,

y-experiments follow~d by a ~-experiment it will emit

× v at o and restore itself. BODY = 1'y. b(y)

That is, we want to realise

where

(4)

b(y) = ~.b(2y) + ~.oy.BODY

I' BODY

~

i ¢ s j r

s (k

I

"Irr~

I

!

i Exercise 4.3

Put this net together, as a restricted ~ i t i o n

of

relabelled standard components, and show that it satisfies an equation like (4) (but with intervening T's), using the Expansion Theorem.

57

Having established the behaviour of BODY and C ~ L ,

it is a simple

matter to put them together in sud% a way that an input

x

to the

whole system first gates a i into BODY, then enters C O N S U L itself. ~e

outer pair of gates (present also in BODY and CONTROL) is to

prevent overlappin 9

of successive ccmputations. I

II t

DO bexp

! | 1 I

t I 1

I !

t 1

BODY

-7

k~ %

L

T! -! I

O

58

Exercise 4.4

Treating BODY and CONTROL as given by (3) and (4)~put

the net together as in the last exercise, and show that it behaves like DO be~xp, but with intervening

T's.

See (i) and (2).

The exa~ole shows how nets may be built in modules which are verified separately.

There are two remarks:

(i) The use of the Expansion Theorem is tedious, but as we mentioned earlier it can be mechanised. (ii) We have implicitly assigned that if two behaviours are observation equivalent, then replacing one by another in any system context will yield an observation equivalent system.

(This is what justified our treatment of BODY

and CONTROL - replacing them by their s ~ c i f i e d behaviours). This asstmption is justified for the contexts we have considered, but it is not trivial to prove that this is so.

Exercise 4.5

Construct data flow nets to cc~pute the value of

input values

x

and

y

frcm

y , for each of the following prograns:

(i) while

p(x)

do

(y:= f(x,y) ; x: = g(x))

(ii) while

p(y)

do

(y:= if q(x,y) then

f(x,y) else

f(y,x) ;

x:= g(x) ) You will almost oertainly need same other 'standard' agents, and a different way of handling predicates - since the construct 'ASK q' doesn't generalise very well for non-unary predicates.

4.4

Derivations In

§4.2

Similarly,

we gave an exarmple of a derivation of

B = ((~x.B1 + 8y.B 2) I ~voyz-B3)\S

p = ~x.Sy.y(x+y).p :

has derivations

B ~ (B1{5/x} t ~v-~z.B3)\S ; B ~-->(B2{v/y} I Yz-B3)\8

~

(B2{v/Y} I B3{7/z})\8

-

59

A general derivation takes the form B

PlVl) BI____ ~2v2 ~B2

__.>...

p v n n B n

(which has length

n) or may be infinite.

derivation of length n as UlVl ~2v2

We shall often ~a~ite a ~1vl.~2v2..

Pnv ,

or

....

B

~

v

n n, B

n n we can abbreviate

B -J--~B' m

and abbreviate

by B ~ B'

(n ->O)

n

B ~ . ~ V . T B'

k57 B ~ > B '

(m,n >_O).

(see also §3.3). A cc~01ete derivation is either an infinite derivation, or a finite derivation which cannot be extended (this means Exercis____~e4.__66 Using equations (3) and (4) in

I

derivations of BODY, ~ L

B

n

= NIL).

4.3, write sc~e of the

and (BODY I CONTROL)\y\6 .

derivations are there?

A ccrmplete finite derivation of

B

represents a possibility that

can reach a point where no further action is Ix)ssible;

4.5

What ccr~piete

B

it may deadlock.

An example - Zero s ~ c h i n ~ We want to set two agents

a root for the equation function

p

f(X) = 0

and

q

in the range

[A,B] , for a continuous

f , knowing that such a root exists - i.e.

It is natural to make

p

and

q

calculate

and concurrently, for two internal F~ints

If

to work together in finding

p

finishes first, and finds that

he can leave a message for

q

A'

f(A) ×f(B) - NIL

as the only complete deri~ation~ and we are done.

For size > O, we can

use the Expansion ~qeore~ to show the following, which is enouc~ to cfm_~_lete the proof: conditions (i) and (ii) , every complete derivation of Sys(A,B,a,b,X,Y)

extends a derivation

T,T

' ~ Sys(A',B',a',b',X',Y')

where the parameters again satisfy (i) and (ii), and (a) if

X = £[A,B]

and

(b) otherwise either X' = £[A,B]

~

Exercise 4.7

t I

and

Y = r[A,B]

[A',B']

then

[A',B']

has ~naller size;

has smaller size or

[A',B'] = [A,B],

Y' = r[A,B] .

Verify the above statement by expanding

Note that the interval decreases in size after ~

Sys(A,B,a,b,X,Y). cc~outations, though

not always after one.

_Exercise 4.8

It isn't necessary for

distinct ports. and similarly E~ercise 4.9

P and q Redesign Int so that ports e I , 81

e2' 82;

Int through are identified,

it's easy but not cc~pletely trivial.

Kung remarks that a rcot-seardli~ algorithm for three

cooperating agents can be designed so that the interval subdivision adoptS one of the two patterns

~/4

~./4

~/4

. Program this algorithm.

~/4

~/3

~/6 ~/6

9./3

64

I Exercis____~e 4.1___OO Suffuse that p (q similarly) can pause during its evaluation of f (X) at certain times, to ask the interval "should I continue or start on a new point?" Adjust the in~ agent to respond to these interrupts.

CHAPTER 5

Syntax and Semantics of CCS

5.1

Introduction We have seen some examples of expressions of OCS, representing both

programs and their specifications.

We sm~ that, with the introduction

of value-passing, we had to abandon the simple interpretation of behaviour expressions as syndqronizaticn trees, but in §4.2 we talked of atamic e~periments on behaviour expressions

(or on the behaviours for which they

stand), and this was developed further in §4.4 on derivations. We are now reaahy to present CCS precisely, and to define precisely the atnmic actions (and hence the derivaticns) of every OCS program.

On

this basis, we proceed in this chapter and in Chapter 7 to develop our central notion, observation equivalence of programs. short step to a congruence relation; iff they are observation equivalent in every context.

Frcm this it is a

two prograns are observaticn congTuent (i.e. indistinguishable by observation)

Our proposal is that an observation congruence class is

a behaviour, so that 0CS is indeed an algebra of behaviours, in which each progran stands for its congruence class. This main development is independent of the notion of ST. now be regarded as a first approximation

STs may

(not sufficiently abstract) to a

model of CCS without value-passing, and in Chapter 6 we show how they may be generalised to CTs (cca~m~ication trees) to give a first approximation to a model of OCS with value-passing;

again, the main development is in-

dependent of CTs, which are only discussed to aid understanding.

~hen we

eventually define observation equivalence over prograns in Chapter 7, it will look just like the corresponding definition in §3.3 over STs, which generalises to CTs in an obvious way.

Indeed, we expect to find that two programs

are equivalent iff the correslxlnding CTs are so;

in that case CTs, though

not technically essential, fit naturally into our picture. ~his chapter is devoted to a ocmgruence over programs which we call stron~ congruence, since it is stronger than the observation o0ngruence studied in Chapter 7.

By approaching our proposal in two stages we intro-

duce the properties of behaviour gradually, and with greater insight than if we tackled observation ccngruence immediately.

In fact we even subdivide

the first stage in this chapter, approaching strong congruence via an even

66

stronger relation called d i ~ c t equivalence. The CCS

language

was introduced in the author's "Synthesis of

C~,~nicating Behaviour" [Mil 3].

However, the semantic sToecificaticn

by derivations was not given there in detail.

Value e~0~ssicns E Value expressions are built frGm (i) Variables

x,y,...

(ii) Constant s y ~ I s ,

and functicn symbols standing

for knc~n total functicns over values using conventional notation. value expressions.

We also allow tuples

(El .... ,En)

of

ThUS each value expressicn without variables stands

for a uniquely defined value;

we shall not worry about the distinction

between such expressions and their values. We shall also avoid details about the types of values and value expressions, though we shall have to mention sane syntactic constraints depending cn such details (which are standard). Labels, sorts and relabellin@ As in Chapter 2, our labels are We use

e,8,.,

A u{% } .

to range over

A = A u A , together with

~, I over A, and

A sort L is a subset of A ;

u,v,..,

~.

to range over

to each behaviour expression

B will be assigned a sort L(B). % A relabelling

S : L÷M

However, scme positive labels and the~ that

S

~

between sorts ~

L

and

M

is as in §2.2.

will be used to bind (tuples of) variables,

will qualify (tuples of) value expressic~s;

preserves the sign of such labels

we must ensure

(i.e. S (e) e A ).

Moreover, in

a ccr~plete treatment we should have to assign types to value variables and value e~pressions, hence also to labels, and to ensure that relabellings respect the types of labels.

We will avoid these details;

they need care,

but would only obscure the more important aspects of semantics which we want to discuss here. % We shall only meet finite sorts in examples. However, all we need to ass~ne - for technical reasons - is that A is never exhausted. Infinite sorts may be of use; see the end of Chapter 6.

67

Behaviour identifiers ~

b

presuppose a collection of such identifiers, each having

preassigned (i) an arit~ (ii) a sort

n(b) - the n~m%ber of value parameters. L(b).

We assume that the meaning of such identifiers is given, often r ~ s i v e l y , by a behaviour expression. behaviour identifier p

For example, in §4.5 we gave meaning to the

by

p(x) = ~i(x,f(x)).~gx'. p(x') where

n(p) = i, L(p) = {~i,~2}

o

Again, a cGmplete treatment would specify not just an ~ type (i.e. list of parameter types) for each

Behaviour expressions

but a

b .

B

Behaviour expressions are formed by our six kinds of behaviour operator (§4.1), by parameterising behaviour identifiers, and by conditionals. It's convenient to present the forma~tion rules as a table (see below), giving for each expression

B

its sort

L(B)

and its free variable set

FV(B). We should regard the language given by the table as a core language, which we are free to extend by defining derived behaviour operators chaining ccmbinator

~

(the

of §4.1 for example) and by alternative syntax

for cc~monly occurring patterns. In what follows, we shall use ....

}

to denote the result of substituting expression x i (i s i- ; we shall call such

We shall oontent ourselves with a rather

I , \~, [S]

using pictures of branches, rather

than defining them formally in temas of multisets.

,I.......

(binary operation) I~CTL x C~fM÷ CTLu M

Let

tcCTL, ueCT M.

Then

tlu

has the following brandles:

vI

v0 (i)

For each branch

vo

vI

Tc~

"

of t, a branch

T~

(ii) For each branch ~ /

(iii) For eachbranch ~ T

of t, a branch -

X

of t, a branch

i

88 and similarly for the branches of u. (iv) For each pair of branches

[

of t, and

of u,

a branch

and similarly for brandles (~nus an output branch of input branch.

>

of

for each member



for every

v

u;

and

are in the

v.

List the atomic actions of the typical CT diagrammed in

§6.1.

IF~ercise 6.4 or

Prove that

tI + t2

~ v t'

iff either

t 1 ~v> t'

t2 ~ v t'. Exercise 6.4

action relations the rules Sum+

gives a hint of the h ~ y ~v

we expect between the

over CTs and over prograns.

For if we recall

of §5.3, we can rephrase them as follows:

B I + B 2 ~v > B'

iff

either

B1 ~V~B,

or

B2 ~ > B '

(the 'iff' being justified by the fact that S~n+ is the only rule by which actions of

Bi + B2

Similarly, the CT

can be inferred).

~f, which is the multiset whose only member is

, has only the actions ef

ev> f(v) , for each

v,

which we can cc~pare with the fact, frcm Act+ (1) in §5.3, that the program

ax.B

has only the actions

~x.B ~v> B{v/x}, for each Exercise 6.5 the CT

v.

Using the definition of

I over CTs in §6.2, show that

tllt 2 has exactly the actions

(i)

t. It^ -~v t' It^ when _fLY_ , (ii) tllt 2 tllt 2 when (iii) tllt 2 T t~it ~ when

Cc~pare Corn+ in §5.3.

t~ ~v t' ; ~ , t 2 ' t2; tl lv t~

~v and

t2

!

t2.

93

Surely then the atomic actions of related.

B

and its CT

[B ~ are closely

We state the relation in a theorem:

Theorem 6.2 (i)

If

B

(2)

If

[B~

Proof

WV>B,

then

Wv>t,,

~

Uv> ~,~;

then for same

B', B

Mainly by induction on the structure of

is needed when

B = b(9),

~v>B,

B;

and

[B'~ = t I.

but particular care

and the asstmlotion that the b's are guardedly

well defined is important. In other words, the atcmic actions of where

B

~v >B'

is an atomic action of

[B~ B;

are exactly

~B~

Wv > [B'

this means that in con-

sidering atrm~c acticns, it makes no difference whether we think of programs or of the CTs that they stand for. The next step is to show that this holds too in considering strong equivalence.

6.5

Strong equivalence of CTs We proceed in the sane style;

that is, we define strong equivalence

(~) over CTs independently, and then show how it hanmonises with strong equivalence of programs. ~

Our definition is entirely analogous to that of

for programs (§5.8) ; we use a decreasing sequence

~0' ~I '"" "'~ k'""

of equivalences:

Definition t~k+lU

t~0u

is always true;

iff for all

u,v

(i)

if

t

~v. t'

then for same

u',

u ~v ~ u' and

t' ~k u';

(ii)

if

u

Bv

then for some

t',

t Bv

t' ~k u'.

t~u

iff V k >0.t~ku.

u'

t' and

Although we don't need it at present, we may as well state the a n a ! ~ of Theorem 5.4.

Theorem 6.3 precisely,

~

is a congruence relaticn in the algebra of C~s.

t l ~ t 2 inlolies

More

94

tI + u ~ t 2 + u , u + t i ~ u + t

2

~v-0) by B - ~ B ' m n B ~" ~v.T >B' (re,n_>0) by B

We abbreviated

~v >B'

More generally, we now abbreviate

~ . ~iv:Tm~ ....~kVk. ~ B

by

B

(k-> 0, m 0 .....ink> 0)

~B'

~IVl ..... ~ k V k B '

which includes the above cases (they correspond to k = 0, k = i).

It also

includes the possibility

means

B

Tm

>B'

for some

m>0,

~i =

T, so that for example

while

m >-0 ; but usually we shall have For each

s =

e~ >B'

means

B -S->B'

define Observaticn Equivalence

B

m

T ~B'

for sane

u ic A.

XIv I ..... IkVk ~(A × V)*, ~

relation, and each instance

7.2

B

B ~B'

=

is the s-experiment

is called a s-experimemt.

We now

in tezms of s-experiments.

Qbservatic n equivalence in CCS Analogous to §3.3, =

of equivalences:

is defined for programs by a decreasing sequence

99

Definition

B z0C

is always true;

B Dk+l C iff for all

s%(A x V)*

(i) if

B

s .~B' then for same

(ii) if

C

s-~C'

B=C

iff

k/k >0.

C',

C

S ;C' andB' ~k C';

then for scrae B',

B

s ~B' and B' ~k C';

B ~k C.

Remarks (i)

There is a

question

as to whether we need to consider all s-experiments

in this definition, or if it is enough to coD~ider only those of length 1 - i.e. we might replace

se(A x V)* by

sea

× V

in the definition.

The relation ~ thus obtained is different, but it turns out that the congruence (§7.3) which it induces is the same (assuming only that CCS includes an equality predicate over values), t/qough we shall not prove it here~

Our present definition, using

(AxV)* , has sc~aewhat

nicer properties. (2)

Our definition has a

property

which must be pointed out.

It all(x~s

the program (CTs)

T

and

=

to be equivalent'

~iExercise i " ~ ~7.1

Prove

T~

(T~

~.~

NIL = •

can be defined by

to

T~ Tm >Tm

T.b.)

NIL by induction on k.

Notice that the 0nly experiment on I i

b~

for any m)

R

T~

is

~%-~ ;'T~

(corresponding

and NIL's only experiraent is

Thus, whenever we have proved

NIL

e > NIL.

B~C (e.g. B may be a program and C

its specification) we cannot deduce that B has no infinite unsee~ action, even if C has none.

In one sense we can argue for our def-

inition, since infinite unseen action is - by Our rules - unobservable'

But the problem is deeper;

it is related to so-called

fairness, which we discuss briefly in §11.3.

In any case, there is

a more refined notion of ~ which respects the presence of infinite unseen action, with properties close to those we mention for the present one.

I00

(3)

Disregarding the question of which equivalence is correct, if indeed there is a single 'correct' one, the finer equivalence (under a slight further refin~Inent)has interesting properties. Plotkin

[HP 2]

Hennessy and

have recently found that it can be axic~atized, in

a sense which we cannot explain here.

Much more needs to be known

before we can say which equivalence yields better proof methods; at least we can say that, if an equivalence can be proved und~_r the refined definition, then it holds also under ours. We now turn to the properties of

z.

There are many, but three are

enough to give a feeling for it, and to allow you to read the first case study in Chapter 8, if you wish, before proceeding to §7.3. The main thing which distinguishes

Proposition 7.1 Proof (i)

Let

k

B ~kr.B and

by induction on

prove for

B s--~-B'.

~k

from

~

is the following:

B ~T •B

We show

asst~ne for

z

Then also

k.

k=0

is trivial, so we

k+1: s. - B' , a n d w e know

~.B

B'~kB'

(each

is an equivalence relation:)

(ii) Let

T.B ~ C ' .

either (a)

s=e,

Then and

C'

induction or

(b)

~.B ~ B

is

~.B;

but then also

i.e.

B

B

B, and by

B ~kT.B s

C',

S;c,

also, and again

C' ~k c' This completes the inductive step, yielding

B=k+IT.B.

This proposition should make you immediately suspicious of because we can show that it cannot be a ccngruence. B~C

does not imply

B + D ~ C + D;

e.g. take

B

as

thenB~C

byProp. 7.1, but

as

NIL,

C

T.NIL, B +D

D

as

=,

In particular

e.NIL-

~2 C + D .

IExerci______se 7__.2 Show that NIL + ~.NIL ~2T.NIL + ~.NIL, by observing that

I

RHS

E> NIL, but the only e-experiment on IHS yields a result which

is

~I NIL

101

Even so, Theorem 7.3 b e l ~ tells us that gruence for many purposes. Theorem 7.2 Proof

B~C

it is trivial; at k+l. (i)

~ .

B ~ C.

B~C

implies

ass~ne it at

Assume

is near exKx~h a ccn-

First we need to see its relation with

implies

We show that

~

k

B~kC

(for all

by induction on B

and

C),

k.

At k=0

and prove it

B~C:

let

B ~Bn,

say

the

~ivi may be

B T,

~I~I>B ........

÷

BnVn Bn,

..,

where sane of

while the re~rainder ccnstitute

Theor~n 5.6 used repeatedly, there exist

Ci, ..., %

s.

Then by

with

ivl ~nVn C ~ C 1 ÷ ... ~ C n , i.e. n with B. ~C. for all iE;

then

q,r

must be

B'ID' , with

B

(ccntaining ccr~lementary ~ s

B ' ~ k C'

But then

Then for same

C'

by assumption.

C JD S;. C' 1D', and by the induce_ive hypothesis

B'JD'~kC'ID' , i.e. CID

q;-B', D ~ D '

which 'rcerge' to

s .> in a way which we need not detail)

C :q'-c' and

(ii) Let

E

E~kC'ID'.

s~ .....E, then similarly we find

BID ~ B ' I D ' ~ k

B'ID'

such that

E.

The e s s e n o e o f P r q 0 o s i t i c n 7 . 1 and Theorems 7 . 2 , 7 . 3 i s t h a t we can use a l l o u r laws, and c a n c e l

T's

too, in proving observation

e q u i v a l e n c e - p r o v i d e d o n l y t h a t we i n f e r n o t h i n g a b o u t t h e r e s u l t o f

substituting

C

for

B

under

+,

when we only know

B~C.

The next section tells us what such inferences can be made. Exercise 7.2 on k.

Prove that

B~kC

implies

Why is induction neaessary? As we did for

Definition B=C

Let

~, we extend

x

if, for all

av.B~k~V.C

(Consider ~

by induction

~-experiments).

to expressions by:

be the free variables in

B

or

C

or both.

Then

v

Then we have

Theorem 7.4

Proposition 7.1 and Theorems 7.2, 7.3 hold also for expres-

sions. Proof

Routine.

Frgn now on, we deal with expressions.

103

7.3

Observation Congruence We must nc~ face the fact that

7.2).

~

is not a ccngruence (see Exercise

But we would like a congruence relation, because we would like to

know that if replace

B

B

by

and C

C

are equivalent, then in whatever context we

the result of the replacement will be equivalent to

the original - which is cnly trae for an equivalence relation which is a congruence.

We have one congruence - strcng congruence (~) - but it is

too strong;

for exarp!e

~.~.NIL ~ ~.NIL.

Can we find a ccngruence relation which is weaker than

~ (so that

all our laws, Theorems 5.3 and 5.5 will hold for it), and has sane of the properties of

% (so that for example ~.T.NIL and

~.NIL will be congruent)i

Let us draw the order relation (part of the lattice of equivalence relations) among our existing equivalence relations with stronger relations to the leftj and square boxes representing ccngruences: Equivalences over behaviour programs:

Identity _~ ~ .Relation

~

We want to fill in "?".

~

~

Universal 1 Relation

It must be strcnger than

ccngruent prograns to be observation equivalent.

~

because we do want

We get what we want by

the following: I Definition context

B ~

c

C

(Obse#vation congruence) iff

for every expression

C[ ], C[B]~C[C].

Theorem 7.5 (i) (2)

c If

is a congruence relation; @ is a ccngruence and

BSC

implies

B~C,

then

BSC

implies

BC~c. Proof

Omitted;

it is ccmpletely standard, and has no~dling to do with

particular properties of the equivalence

Z-

[~

104

c

Our Theorem says that (smaller than)

~.

Cor011ary 7.6

B~

Proof

C

is the weakest congruence stronger than

implies

B

c

C

implies

B=C

°

Immediate. It is cne thing to define a congruence, another to know its properties. c = to =; in the next

We first find out more about the relation of c secticn we find sc~e laws satisfied by ~ .

We saw earlier that sign ccntexts were critical for B~C

does not imply B + D ~C + D. + = :

~, because

~lis leads us to explore a new equi-

valence relation Definition

B~+C

iff

YD.

B + D~C

+ D

(equivalence in all sun contexts.) Now the critical result is the following: Theorem 7.7 Proof

~+

See

§7.6.

definition of

is a congruence. This proof is not standard, but depends strongly on the

~;

it is not true for the alternative in Remark (i) of §7.2,

and that is why we chose our definition.

Theorem 7.3 is critical.

Frcm this we get, fortunately: Theorem 7.8

~

c

and

~

+

are the sane congruence.

Proof + (i)

B =+ C

implies

stronger than (ii) B

c

B ~ c C by Theorems 7.5(2) and 7.7, since ~

= (take

C

implies

D

is

to be NIL in the definition).

B ~+ C, since

[ ]+ D

is just a special kind of

context. Now we know that we preserve texts.

What do we do if we have

B + D and C + D? C

B

by substitution exoept in '+' conand wish to know s c m e t h i ~ about

Luckily, for an important class of expressions

we can infer from

Definition

~ B~ C

B=C

that B ~c C, and then infer that

is stable iff

B-~B'

B

and

B + D ~c C + D.

is impossible for any B'.

Thus a stable behaviour is one which cannot 'move' unless you observe it. Stability is ir~portant in practice;

one reason why our scheduler in

Chapter 3 works, for exanple, is that it will always reach a stable state if it is deprived of external c~,tlunication for long enough. the notion of "rigid" in Chapter I~

Cc~pare

we may define a rigi d program to be

one whose derivatives, including itself, are all stable.

105

There are two main propositions about stability;

first we prove a

lesma in a slightly more general form than we need for the propositions but the general fozm helps in the proof of Theorem 7.7 (skip the lemma if you are only interested in main results, not proofs). Lenm~ 7.9

If

B z+C and

that

C ~ ;'C' and

Proof

S~ppose

B-~B',

then for each

C'

does not exist;

we find

centrary to assir~ption. Take

D

sort of

B~B',

C+D

B

~E

B'

or

C.

Now sinoe

then either (i)

E

(ii) C ~ E ,

~k B'

; or

impossible since Hence

D

to be

D

there is a

such that

1 ° .NIL, where we have

is C + D,

C'

such

~'

B + D ~ C + D,

Io

is not in the

B+D~B'.

But if

since C +DI~;NIL, but

by supposition;

or

(iii)

D ~TE

-

is stable.

B+D ~ C+D, contradicting

Proposition 7.10 Proof

k

B' ~k C'.

If

B ~Cc

B =+C.

then either both are stable or neither is.

Direct frcm Lemma 7.9 (B ~ ~k C' not needed). More important, for proof methods, is the following:

Proposition 7.11 Proof

If

B

and

C

are stable, and

It is enough to show that

induction on

k.

B + D =k C + D

B=C,

then

B ~Cc.

for arbitrary

D, by

We do the inductive step.

Let B+D ~ E : (i)

If

s=e

then either

by induction, or

E

is

D ~ ET,,

B + D, and then C + D and then

C + D

e;~E

e;-C + D , ~ k B + D also

(B .... ~ ;-E impossible

by stability). (ii) Otherwise either whence

C

D

s

S;-F=kE

s ~E, and then C + D ----~E also, or

(because

B ~ C ) , whence a l s o C + D

Thus we have found in each case an F s.t.C ÷ D ~ argr~ent is similar, Now for any guard that g.B=g.C

so

B ~E, S>F~kE.

F ~ k E.

The converse

B=C

(for any B,C)

B + D ~ k + I C + D.

g ~ T , we can deduce frmm

(Theorem 7.3) ,

and hence g.B z % . C

since both are stable.

implication holds in fact for any guard, by the following Proposition (which is essential in the proofs of Chapter 8): Proposition 7.12 B~C

i~plies

For any guard g.B~%.C.

g,

t06

Proof

By the above re,harks we need only consider

T.B + D ~ k T . C + D Let (i)

If

for arbitra/ny D, by induction an k.

T~.B + D s=e

S;E.

then either

T.C + D

B c

We prove

Inductive step:

Then E

by induction, or D ~ E , and then

g = T.

is

~.B + D, and then T.C + D ~

and then T.C + D ~ E

e>E, whence C ~ F ~ k

E (since

e

T.C + D ~

also, or

T.B T.~E,

B~C), whence also

; F~kE.

(ii) Otherwise either

s D ........~E, ..... and then C + D ~ E :

~ence C S~-F~kE (since B ~ C ) , whence also As in Prop. 7.11, this ca~pletes the proof. By now these inductive proofs of hypothesis only when

=k'

also, or T.C + D

B ~E, S>F=kE.

appealing to the inductive

e-experiments are ccnsidered, are befxmaing familiar;

we shall leave them as exercises in future.

7.4

Laws of Observation C o n ~ We are going to prove three laws, for which we have strong evidence

that they say all that needs to be said about the strange invisible c ~ ; this suggests that the apparently never-ending strean of laws

under

is drawing to a close'

The evidence is that these new laws, together

with those of Theorem 5.3, have been shown to be ccrmplete for CCS without recursion and value-passing. (in this

restricted language)

This means that any true statement can be proved frcm the laws;

B ~Cc

in fact the

laws of Theorem 5.3 are quite a lot simpler without value-passing, and those of Theorem 5.5 are unnecessary without recursion. One would expect to have to add sane induction principle in the presence of recursicn;

what needs to be added for value-passing is

less obvious (but in several more-or-less natural examples, including those in Chapter 8, we have not needed more than we have already). Theorem 7.13

(2)

( T laws) c g.T.B = g.B c B + T.B ~ T.B

(3)

C g.(B + T.C)+ g.C ~ g.(B + z.C)

(i)

Proof

(i)

follows directly frcm Prop. 7.1 (T.B~ B) and Prop 7.12.

For (2), we must prove for arbitrary D,k B + T . B + D = k T.B + D and this follows the pattern of Props. 7.11, 7.12.

107

For (3) similarly, we need g. (B + T.C)+ g.C + D ~ g . (B + T.C)+ D which follows the same pattern, but needs the extra easy fact that for s s ~ , if g.C - > E then also g.(B + T.C) ~ E . ~ercise

7.3

Ccr~plete the proofs of (2) and (3)

e

A more useful form of (2) is the following: Corollary 7.14

E + T.(B + C) c T.(B + C) .

Proof Exercise 7.4

Prove this, by first applying (2) to

need another law of

~. (B+C);

you will

+.

One may justify the laws intuitively by thinking of any behaviour B

as a collection of action capabilitie s (the branches of its C2),

including perhaps sane T-actions (the T-branches) which are capable of rejecting the other capabilities. Law (i) may then be explained by saying that, under the guard the T-action of no effect.

T.B

g,

rejects n_~oother capabilities and therefore has

For Law (2), the capabilities represented by

present after the T-action of

T.B

B

are again

in the context B + T.B, SO

T.B

itself has all the power of B + T .B. For Law (3), an

observation of

the left side may reject

in

B

by passing the guard

g

g.C,

but

this rejection is already represented in g. (B + ~.C). But such wordy justifications badly need support;

observation equivalence is what

gives them support here. Laws (2) and (3) are absorption laws;

they yield many other absorp-

tions. Exercise 7.5 (i) (ii) (iii)

Prove, directly from the laws, that

~.(B I + ~.(B 2 + ~.B3) ) + B3 c ~ . ( B 1 + x.(B 2 + T.B 3)) ~.(B 1 + T.(B 2 + B 3)) + ~ c T . ( B ~

+ T.(B

+ B 3))

To(B 1 + e.(B 2 + T.B 3)) + ~.B3 ~ T . ( B I +2 .(B2 + T.B 3))

and eonsider how they generalise. On the other hand, disprove 6.(B + C ) + ~.C c 6 . ( B + T.C) by finding 7.5

B,C

which make

them not

~.

Proof Techniques In conducting proofs, we may take the liberty of using "=" in place

of "~" or

,,c,,, adopting the familiar traditicn that "=" means equality

108

this helps us to highlight our uses of

in the intemded interpretation; ,

With t~mls

for which care is needed because it is not a congruence.

convention, let us stmlnarise the ir~portant properties. (i)

The laws of ~ (Chapter 5); B ~T.B

(ii)

(Proposition 7.1) ;

B = C

(iii)

implies

B~ C

(Corollary 7.6) ;

is preserved by all operations except +

(iv)

(v)

B~ C

implies

(vi)

B~ C

in,plies g.5:g.C (Proposition 7.12) ;

(vii)

The

x laws

B=C

when both stable

(Theorem 7.13).

Since we mentioned that the bother with

m

(Theozem 7.3);

(Proposition 7.11) ;

in proofs?

often show that a behaviour

T laws have a cx~npleteness property, why The reason is to do with stability. B

We can

of interest, not stable itself, satisfies

B = T.B* for scrse stable

B*;

This expresses that

so of course B

B~B*

stabilises.

(but B ~ C B *, by Proposition 7.10')

Stable hehaviours are often easier to

handle, and the oonstrained substitutivity of

z

often allows us to conduct

our proofs mainly in tezms of stable behaviours.

Chapter 8 should make this

point clear. Many proofs can be done with our laws without using any induction principle, though the laws are established using induction on

~k "

Xhere is, however, a pcwerful induction principle - C ~ u t a t i c n

Induction

- due to Scott, which we cannot use at present since it involves a

partial order over behaviours.

We believe that this principle can be

invoked for the finer notion of observation equivalence alluded to in §7.2, Remmrk(2);

7.6

Proof of Theorem 7.7

Theorem 7.7 Proof

it remains to be seen how important its use will be.

~+

is a congruence.

First, we show that

implies

B ~+ C

+ B + D ~ C + D;

require (B + D) + E ~ (C + D) + E

for arbitrary E.

But

+ (D + E)

(Theorem 5.3)

C + (D + E)

(since B~C)

(B + D) + E ~ B

~(C +D) Next we require that

B ~+C

+E. implies

g.B ~+g.C ,

I

B\~ ~+C\~ , B[S] ~+C[S] ;

that is, we

t09

e.g.

we want

g.B + E~g.C + E

for any E.

In each case the proof follows

the pattern of proof in Propositions 7.11, 7.12 (these Propositions are stated in terms of c ,

but the proofs are entirely in terms of z ). + The critical case is B + C implies BID zCID. A s s ~ B + C and

prove BID + E ~

CID + E, for arbitrary E,

Inductive Step: (i)

Let BID + E ~

If

s ~e,

or

BID s-~--E'

B~C (ii) If

then either E ~ E ' ,

~

by induction on k.

E; and then CID + E ~ E '

and then CID S~>F'~kE'

for scme F'

BID=ClD ~ ~ e o ~ m 7.3), w ~ c e

S=e, then either E'

cLD+E

~;cID+E,

then CID + E

is BID + E

%BtD+E

> E'

also,

also, (since

CID + E ~ F ' ~ k E '

also.

itself, and then

byindu~±~,

or E ~ ET ,

o_rr BID ~-~ B' ID' ~s> E'.

!

~d

These are now

the three cases: (a) B'

is B, and D - ~ D ' ;

by Theorem 7.3 CID + E (b) D'

F' ~kE'

IV>B'

for sane F',

(this is the only use of

is all that is needed),

sane F'.

and BID'~CID' whence

as required.

So finally CID + E and D-!V>D';

B +C

S>E',

k+l B '

- elsewhere

and we also have

frcm Theorem 7.3, so since B'ID (c) B

T>CID'

and B T-~-~B'; then by lemma 7.9 C ~ C ' =

for same C' B=C

so CID' ~

~:-F'~kE'

is D

then CID

B'ID~k+IC'ID

C'ID c-~F'=kE'

for

~:.C'ID ~ F ' = k E ' .

then C

IV;-c"~k+iB'

for scme C',

9~qence CID ..T;,C' ID' ~k+iB' ID' by Theorem 7.3, whence C'ID'

~"" F' ~k E'

Thus we have found F'

for some F',

whence also CID + E

in every case so that CID + E

~.> F' ~~E'.

S~-F'~kE' ; by

symmetry, we have BID + E~k+ICID + E which ccrnpletes the induction.

7.7 Further exercises We end this Chapter with some in the theoretical development.

harder exercises, for readers interested

Exercise 7.6 (Hennessy). Prove the following result, which further clarifies the relation between ~ and c : B~C

iff ( B c C

or

B CT.c

or

T.B Cc)

I10

Exercise 7.7

We would like to know that if

then

b ~CB;

b
I,

(iii)

Prove:

(iv)

Deduce:

if

B ~CCEB]

and

C c C[C]

then

B ~Cc.

(v)

Deduce:

if

b~C[b]

and

B c C[B]

then

b ~CB.

~cise

7.8

if

B~C[B] and

C~C[C]

then

B~C.

Ccnsider a different definition of observaticn equivalence.

First, define a decreasing sequenoe of pre-orders B ~0 C

~0,~ C ' and

B' ~k C' .

Thus we take only the first clause of the definition of ~k+i" B < C We may take

m

iff Vk. B - 0 .

As usual, we have to resort to a

140

Definition A

A

is always

strc~ly O-oonfluent

is strongl [ (k + 1 ) -confluent

iff

B~D O_Z . ). C~E

B

(i)

~

iuplies either

~ = ~ and

B~C

C

for some (ii)

A ~+ B

D

and

implies

E ; B

strongly k-confluent.

is strcm~ly ccnfluent

A

iff it is strongly k-confluent for all

k-> O.

Let us abbreviate "strongly confluent", "strongly k-ccnfluent" by SC, SC k

respectively.

We first want to know that SC is a property of strong

equivalence classes, not just of progr~as. Proposition 10.2 Proof A'

If

A

is

SC

We show by induction on is

and at

~

.

k+l

At

k=O

ass~ue

and k

A~A '

that if

A

so is

for sane

A'

is

~k

is SC. and

there is nothing to prove.

A

is

~+I

and

B ;

but

B

is

A~A'

Assurae at

then k ,

A~A'.

For part (ii) of the definition, if A ~ B~B'

then

A' ~ B'

then by Theore~ 5.6

~-k' hence by inductive hypothesis

B' . For part (i) , stppose B ! S !

u S U ..-~ B

A ,/

A' I-,i A /

, yielding for some B,C

C!

~nen (since or

A

for some

D,E

B'

C'

is

~+1 and

) either

~=~

and

B~C,

D' ,E'

~" D' B

~ D

C

P > E P > E'

•

B'

~ > D'

C'

~ > E'

so

so

B'~C'

,

141 c

However, SC is not preserved by c ~

~.~.NIL + 6.~.HIL while the first is

z

or

~ ;

for example

~.6.NIL + B.T.~.NIL

SC, the second is not.

We take up this question

later. For our main property of SC we first need a lemma to do with longer derivaticns. B

Lesma iO.3

If

A

is

and

SC

A

~

then

/.l

either

~ = ~i (some i) and

H

2

C

Proof At

By induction on

n+l

n .

For n = O ,

C

C

is

A

and take

~E

D,E

to be

we have

Af B ~ A

so either or

~=HI

and

~2" "~-

A1 ~ B , whence

B

2 ""u n+

(first case of inductive hypothesis for A I)

B

A

~I

.I>D~ C

by Theorem 5.6,

~=~i

(i>2)

~2" "Wi-l~i+l" ' "~n+l>D

~B i

B f2" "~i-lUi+l ' "~n+l > D' 2"" "~n+l

> C

and

B.

142

finding first then

B ,B'

since

A

is

SC , then

D'

since

SC,

A 1 is

D , or (second case of inductive hypothesis)

PJ[

B

]~2" • "Pn+l

>B I

A

> D

B' ~2"°'~n+l

A

..~n+l ~ C

~ D'

~ ~E

Now we can deduce our main property as an important special case. Theorem iO. 4

(Strcng Confluence).

If

A

is

SC

and

A-~ B

then

A=B.

Proof

We show that if

on

k.

Trivial at

SC

and

(i)

A

is

and

A-~B k,

then

and at

A Zk B, k+l

by induction

ass~ne

A

is

A-~ B.

If

B~B'

clearly

(ii) Let

A~A'.

either

B~B'

A~B'

or

B~

B',

B'

A' T~A"

In the second case, since inductive hypothesis; A' ~k B'

also.

Then frcm L~lua 10.3 we have, for sane

A'

case

SC

k--0; asstnne it at

but

A' ~

is

SC

implies

(Proposition iO.!), Zk

(Theorem 7.2)

A' =kA'' by so in either

as required.

The usefulness of the Strong Confluence Theorem is simply this: program find a

A B

a

may admit many actions, and so may its derivatives, but to such that

A~B

we need only follow an e-derivation (a sequence

of z-actions ) starting frcm A,

provided we know

A

to be

SC.

To follow all other derivaticns (as, in effect, the Expansion Theorem would do when repeatedly applied to

A, ~,...)

would often be heavy

work - and is unnecessary in this case. In the next section we illustrate this saving on a toy example, which we ass~ne to be confluent (later it will be seen to be so on general grounds).

But we first need to define a class of derived behaviour

operations, called ommposite action.

143 iO. 3 C c ~ i t e

9uards, and the use of cc~fluence

For ~ i ~ A u {T}, (~lJ..-J~n) is a c c ~ s i t e guard (n_>l) whose actions are given as follows, in the style of §5.3 (see Exercise 10.2, end of §10.4, for richer czm~posite guards): n>l

(Z1 j...j~n ) . B ~

n=l

(~I).B,I~B

(~1 j...l~i_lj~i~I...j~n ).B for each

i,

1 _1 , then

(resp. SDk+I).

since ~ + n

implies

SCk+i

Thus far, the operations preserve SC

if n-> I .

and SD

separately.

can only show that

rd-Camposition preserves them tcgether.

~sition

If A 1

iO.ii

L In L2 = ~ ' then A IlIA2

Proof

and A 2 are ~ , is

with AI:L1,A2:L2 and

SCDk .

Take the inductive step; assume A 1 ,A2

f~st that A ill ~2

is

We

SCk+ i .

are S C ~ + I and show

Suppose

AitiA2~ %~nere are essentially four cases: (i) B

is B III ~ , C

is ~II C 2 (an ~

action), and

Blil ;~

A Bi

A2.~ ~ C2

(ii) B is

action and an ~

~ II c =~~

, yielding

BIlIA 2,

C is

Cll I A 2

(two

A1

B1II c2

acticr, s ) ,

and

/

C1 Then either

U=

v

and

B 1 ~ C1

, ,¢nence also

B1 II

~ ~ c~ 11 N

, or

150

(±i±) B is Bll I ~, ~ ='~, c is c111;'2 (a c~,~,onication and

an

action), and

A2---~ B 2

and

(I ~ L 1 n ['2 )

C1

v ~t

But then

II;`2~ c

, since

is impossible.

Hence

Bill B2~o111 B2

Bi--~ D 1 I Z C i--~ E 1

(iv) B

is

, whence also

ci11 ~Ellt

B ljl B 2, C is

C III C 2,

al

~ =v=T

have

(two ccmmunications), and

A2 4