Strategies

for

Consistency

Checking

the

Choice

of

Unification

H.

Bowman

E.A.

Boiten

J.

Derrick

and

M.W.A.

Steen

Computing

Laboratory

University

of

Kent

Canterbury

UK

-LRB-

Phone

44 1227 764000

Fax

44 1227 762811

Email

fH.Bowman,E.A.Boiten,J.Derrick,mwasg@ukc.ac.uk

-RRB-

Abstract

There

is

increasing

interest

in

models

of

system

development

which

use

Multiple

Viewpoints

Each

viewpoint

offers

a

different

perspective

on

the

target

system

and

system

development

involves

parallel

refinement

of

the

multiple

views

Our

work

particularly

focuses

on

the

use

of

viewpoints

in

Open

Distributed

Processing

-LRB-

ODP

-RRB-

which

is

an

ISO/ITU

standardisation

framework

Multiple

viewpoints

though

prompt

the

issue

of

consistency

between

viewpoints

This

paper

describes

an

interpretation

of

consistency

which

is

general

enough

to

meet

the

requirements

of

consistency

in

ODP

Furthermore

the

paper

investigates

strategies

for

checking

this

consistency

definition

Particular

emphasis

is

placed

on

mechanisms

to

obtain

global

consistency

-LRB-

between

an

arbitrary

number

of

viewpoints

-RRB-

from

a

series

of

binary

consistency

checks

The

consistency

checking

strategies

we

develop

are

illustrated

using

the

formal

description

technique

LOTOS

Introduction

There

has

been

significant

recent

interest

in

using

viewpoints

in

system

development

In

such

modelling

each

viewpoint

offers

a

different

perspective

on

the

target

system

and

system

development

involves

parallel

refinement

of

the

multiple

views

Notable

proponents

of

viewpoints

modelling

include

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

All

these

approaches

prompt

the

central

issue

of

viewpoint

consistency

i.e.

how

to

check

that

multiple

specifications

of

the

system

do

not

conflict

with

one

another

and

are

in

some

sense

consistent

Our

perspective

on

consistency

is

tinged

by

the

particular

application

of

viewpoints

that

our

work

has

been

targetted

at

viz

the

viewpoints

model

defined

in

the

ISO/ITU

Open

Distributed

Processing

-LRB-

ODP

-RRB-

standardisation

framework

ODP

defines

a

generic

framework

to

support

the

open

interworking

of

distributed

systems

components

A

central

tenet

of

ODP

is

the

use

of

viewpoints

in

order

to

decompose

the

task

of

specifying

distributed

systems

ODP

supports

five

viewpoints

Enterprise

Information

Computational

Engineering

and

Technology

In

contrast

to

many

other

viewpoint

models

ODP

viewpoints

are

predefined

and

in

this

sense

static

i.e.

new

viewpoints

can

not

be

added

Each

of

the

viewpoints

has

a

specific

purpose

and

is

targetted

at

a

particular

class

of

specification

A

complete

ODP

specification

should

contain

a

description

of

the

system

from

each

of

the

defined

viewpoints

In

addition

formal

description

techniques

-LRB-

FDTs

-RRB-

are

variously

applicable

to

the

specification

requirements

of

the

different

viewpoints

For

example

Z

-LSB-

-RSB-

is

being

proposed

for

the

information

viewpoint

and

LOTOS

-LSB-

-RSB-

for

the

computational

viewpoint

Figure

-LSB-

-RSB-

depicts

the

relationships

that

are

involved

in

relating

ODP

viewpoints

Development

yields

a

specification

that

defines

the

system

being

described

more

closely

The

term

development

embraces

many

mechanisms

for

evolving

descriptions

towards

implementations

one

of

which

is

refinement

Because

all

five

viewpoint

specifications

will

eventually

be

realized

by

one

system

there

must

be

a

way

to

combine

specifications

from

different

viewpoints

during

development

this

is

known

as

unification

For

specifications

in

different

FDTs

to

be

combined

or

unified

a

translation

mechanism

is

needed

to

transform

a

specification

in

one

language

to

a

specification

in

another

language

Consistency

is

a

relation

between

groups

of

specifications

In

our

work

on

consistency

we

distinguish

between

intra

and

inter

language

consistency

checking

Intra

language

consistency

considers

how

multiple

specifications

in

the

same

language

can

be

shown

to

be

consistent

while

inter

language

consistency

considers

relations

between

specifications

in

different

FDTs

The

latter

issue

is

a

significantly

more

demanding

topic

than

the

former

This

work

was

partially

funded

by

British

Telecom

Research

Labs.

Martlesham

Ipswich

U.K.

and

the

Engineering

and

Physical

Sciences

Research

Council

under

grant

number

in

in

in

Specification

'S

TRANSLATION

to

UNIFICATIONVi

Viewpoint

i

Li

Language

i

Si

Specification

i

DEVELOPDEVELOP

Figure

Relating

Viewpoints

In

order

to

inform

the

definition

of

consistency

we

choose

it

is

worth

considering

what

we

require

of

such

a

definition

We

offer

the

following

list

as

a

set

of

general

requirements

The

consistency

definition

we

seek

must

ffl

be

applicable

intra

language

for

many

different

FDTs

e.g.

must

make

sense

between

two

Z

specifications

and

also

between

two

LOTOS

specifications

ffl

be

applicable

inter

language

between

different

FDTs

e.g.

relate

a

Z

specification

to

a

LOTOS

specification

ffl

support

different

classes

of

consistency

check

There

are

many

different

forms

of

consistency

and

the

appropriate

check

to

apply

depends

on

the

viewpoint

specifications

being

considered

and

the

relationship

between

these

viewpoints

-LSB-

-RSB-

For

example

it

would

be

inappropriate

to

check

two

specifications

which

express

exactly

corresponding

functionality

with

the

same

notion

of

consistency

that

is

applicable

to

checking

consistency

between

specifications

which

extend

each

other

's

functionality

ffl

support

global

consistency

Much

of

the

work

to

date

on

consistency

has

only

considered

the

case

of

two

viewpoints

-LRB-

what

we

will

call

binary

consistency

-RRB-

for

full

generality

we

need

any

arbitrary

number

of

viewpoints

greater

than

zero

ffl

allow

viewpoints

to

relate

to

the

target

system

in

different

ways

Thus

not

only

are

there

different

forms

of

consistency

check

but

within

a

consistency

check

specifications

are

related

in

different

ways

For

example

the

enterprise

specification

is

likely

to

express

global

requirements

while

the

computational

specification

defines

an

interaction

model

Thus

the

relationship

between

the

system

being

developed

and

the

enterprise

specification

is

very

different

from

the

relationship

of

the

system

to

the

computational

specification

The

last

point

prompts

our

work

on

so

called

unbalanced

consistency

in

which

each

viewpoint

is

potentially

related

to

the

system

under

development

by

a

different

development

relation

For

example

the

enterprise

viewpoint

may

be

related

by

a

logical

satisfaction

relation

while

the

computational

viewpoint

may

be

related

by

a

behavioural

conformance

relation

Note

also

that

unbalanced

consistency

is

needed

to

support

inter

language

consistency

This

aspect

of

our

work

represents

a

significant

departure

from

existing

theoretical

work

on

relating

partial

specifications

e.g.

-LSB-

-RSB-

-LSB-

-RSB-

which

has

universally

looked

at

what

we

call

balanced

consistency

We

have

considered

viewpoint

consistency

for

ODP

in

a

number

of

papers

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

and

most

fully

in

-LSB-

-RSB-

In

particular

we

have

located

a

general

definition

of

consistency

and

investigated

properties

of

the

definition

However

the

issue

of

strategies

for

checking

consistency

remains

open

In

response

this

paper

considers

in

general

terms

strategies

for

checking

consistency

according

to

our

basic

definition

The

main

contribution

of

the

paper

is

to

investigate

how

to

obtain

global

consistency

incrementally

from

a

series

of

probably

binary

consistency

checks

The

paper

will

highlight

a

number

of

different

classes

of

consistency

checking

These

vary

from

the

very

poorly

behaved

where

realistically

it

is

impossible

to

check

global

consistency

incrementally

to

the

very

well

behaved

where

all

groups

of

specifications

are

trivially

consistent

Throughout

we

will

illustrate

the

consistency

checking

problem

using

LOTOS

and

Z

although

particular

emphasis

will

be

placed

on

LOTOS

The

paper

begins

by

reviewing

our

interpretation

of

consistency

in

section

and

proving

some

simple

properties

of

the

definition

Then

in

section

we

present

background

on

LOTOS

and

some

of

its

development

relations

Section

highlights

basic

strategies

for

checking

global

consistency

In

particular

two

classes

of

consistency

checking

are

identified

when

a

unique

least

developed

unification

does

not

exist

and

when

such

a

unique

least

development

can

be

found

These

two

classes

are

considered

separately

in

sections

and

respectively

Then

section

discusses

another

restricted

class

of

consistency

checking

i.e.

balanced

consistency

checking

Concluding

remarks

are

presented

in

section

A

General

Interpretation

of

Consistency

We

will

give

general

definitions

of

the

consistency

checking

relationships

consistency

both

intra

and

inter

language

and

unification

First

though

we

present

the

notation

that

we

will

work

with

Importantly

this

notation

reflects

the

search

for

a

general

interpretation

of

consistency

by

defining

very

general

notational

conventions

Notation

We

begin

by

assuming

a

set

DES

of

formal

descriptions

which

contains

both

formal

specifications

in

languages

such

as

LOTOS

and

Z

and

semantic

descriptions

in

notations

such

as

labelled

transition

systems

and

ZF

set

theory

We

assume

a

set

DEV

P

-LRB-

DES

DES

-RRB-

of

development

relations

These

are

written

dv

and

if

X

dv

then

in

some

sense

X

is

a

valid

development

of

Our

concept

of

a

development

relation

generalises

all

notions

of

evolving

a

formal

description

towards

an

implementation

and

thus

embraces

the

many

such

notions

that

have

been

proposed

In

particular

DEV

contains

refinement

relations

equivalences

and

relations

which

can

broadly

be

classed

as

implementation

relations

-LSB-

-RSB-

such

as

the

LOTOS

conformance

relation

conf

These

different

classes

of

development

are

best

distinguished

by

their

basic

properties

Refinement

is

typically

reflexive

and

transitive

-LRB-

i.e.

a

preorder

-RRB-

equivalences

are

reflexive

symmetric

and

transitive

and

implementation

relations

are

only

reflexive

Our

general

definition

of

consistency

which

follows

does

not

require

that

development

relations

support

any

specific

properties

and

we

have

considered

the

consequences

of

such

unconstrained

development

elsewhere

-LSB-

-RSB-

However

this

paper

is

particularly

concerned

with

strategies

for

incremental

consistency

checking

and

in

order

to

obtain

a

rich

enough

theory

to

work

with

we

will

have

to

put

some

immediate

constraints

on

development

Firstly

we

assume

all

our

development

relations

are

reflexive

This

is

a

natural

requirement

although

it

can

be

problematic

for

inter

language

consistency

We

will

say

more

about

the

position

of

inter

language

consistency

later

In

addition

to

reflexivity

we

will

assume

transitivity

of

development

This

is

slightly

restrictive

as

it

rules

out

implementation

relations

-LRB-

e.g.

LOTOS

conf

-RRB-

but

it

seems

necessary

in

order

to

obtain

a

rich

enough

theory

Furthermore

this

paper

is

motivated

by

the

search

for

incremental

development

strategies

and

transitivity

of

development

seems

a

prerequisite

of

such

incremental

evolution

of

specifications

In

particular

without

transitivity

we

may

develop

a

specification

A

into

a

specification

B

and

then

evolve

B

into

C

and

find

that

C

is

not

a

development

of

A.

So

this

paper

assumes

transitivity

and

reflexivity

of

the

development

relations

used

i.e.

they

are

preorders

We

will

need

to

talk

about

sets

of

possible

developments

of

a

specification

Thus

we

introduce

the

following

notation

Definition

For

X

DES

and

dv

DEV

D

-LRB-

X

dv

-RRB-

dv

Xg

So

D

-LRB-

X

dv

-RRB-

is

the

set

of

all

developments

of

X

by

dv

We

must

also

consider

what

interpretation

of

equivalence

-LRB-

which

we

denote

-RRB-

we

should

adopt

A

natural

and

standard

interpretation

is

X

dv

iff

X

dv

dv

X

Thus

two

descriptions

are

equivalent

if

and

only

if

they

are

both

developments

of

the

other

With

transitivity

of

dv

this

interpretation

gives

us

that

two

specifications

in

any

cycle

by

the

relation

dv

are

equivalent

dv

will

play

the

role

of

identity

in

our

theory

The

following

results

can

be

easily

determined

-LRB-

see

-LSB-

-RSB-

for

proofs

-RRB-

Proposition

-LRB-

i

-RRB-

dv

is

an

equivalence

-LRB-

ii

-RRB-

dv

is

a

partial

order

with

identity

dv

Another

important

property

of

equivalence

is

that

two

equivalent

descriptions

have

identical

development

sets

i.e.

every

description

that

is

a

development

of

one

will

be

a

development

of

the

other

Furthermore

this

situation

only

arises

when

the

two

descriptions

are

equivalent

by

dv

This

demonstrates

that

during

system

development

we

really

can

choose

any

one

of

a

set

of

equivalent

specifications

without

affecting

the

possibilities

for

future

development

In

order

to

simplify

presentation

we

will

consider

strict

development

i.e.

relations

dv

which

are

subsets

of

the

relations

dv

with

equivalence

by

dv

factored

out

Definition

Overlining

is

an

operation

that

can

be

applied

to

an

arbitrary

partial

order

dv

with

the

following

effect

dv

dvn

dv

dv

enables

us

to

consider

directly

the

part

of

dv

that

excludes

identical

descriptions

by

dv

dv

is

strict

with

regard

to

dv

in

the

same

way

that

ae

is

strict

with

regard

to

Note

in

particular

that

dv

is

not

reflexive

as

all

descriptions

are

equivalent

to

themselves

Descriptions

are

written

in

formal

techniques

A

formal

technique

is

characterised

by

the

set

of

possible

descriptions

in

the

notation

a

set

of

associated

development

relations

and

a

set

of

semantic

maps

For

a

particular

formal

technique

ft

we

denote

the

set

of

all

descriptions

in

ft

as

DESft

the

set

of

all

development

relations

as

DEVft

and

the

set

of

all

semantic

maps

as

SEMft

Basic

Definition

In

its

general

form

consistency

is

a

check

which

takes

any

number

of

descriptions

Xn

and

returns

true

if

all

the

descriptions

are

consistent

and

false

otherwise

This

check

will

be

performed

according

to

a

group

of

development

relations

dvn

one

per

description

and

is

denoted

C

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

dvn

Xn

-RRB-

a

shorthand

for

which

is

n

C

-LRB-

dvi

Xi

-RRB-

The

validity

of

the

check

has

two

elements

type

correctness

and

consistency

Type

correctness

ensures

that

the

consistency

check

being

attempted

is

sensible

For

example

it

would

prevent

a

development

relation

being

applied

to

a

specification

written

in

a

different

language

to

that

which

the

development

relation

is

defined

over

Type

correctness

becomes

an

issue

when

determining

an

appropriate

inter

language

consistency

check

to

apply

For

simplicity

in

this

paper

all

consistency

checks

will

be

assumed

to

be

type

correct

Intuitively

we

view

n

specifications

Xn

as

consistent

if

and

only

if

there

exists

a

physical

implementation

which

is

a

realization

of

all

the

specifications

i.e.

through

to

Xn

can

be

implemented

in

a

single

system

However

we

can

only

work

in

the

formal

setting

so

we

express

consistency

in

terms

of

a

common

-LRB-

formal

-RRB-

description

X

and

a

list

of

development

relations

dvn

Definition

states

that

n

descriptions

are

consistent

if

and

only

if

a

description

can

be

found

which

is

a

development

of

according

to

according

to

through

to

Xn

according

to

dvn

and

the

description

is

internally

valid

written

-LRB-

X

-RRB-

The

structure

of

the

consistency

check

is

depicted

in

figure

and

is

formalized

in

definition

We

denote

this

interpretation

of

consistency

as

C.

Definition

-LRB-

Consistency

-RRB-

n

C

-LRB-

dvi

Xi

-RRB-

holds

iff

DES

s

t

-LRB-

X

X

dvn

Xn

-RRB-

-LRB-

X

-RRB-

The

internal

validity

check

in

the

above

definition

formalizes

the

notion

of

implementability

It

is

required

because

descriptions

relate

to

physical

implementations

in

different

ways

for

different

languages

and

in

particular

for

some

FDTs

not

all

specifications

are

implementable

For

some

FDTs

it

is

possible

to

find

a

description

which

is

a

common

development

of

a

pair

of

specifications

but

is

not

itself

implementable

The

property

-LRB-

X

-RRB-

is

true

if

and

only

if

the

description

X

has

a

real

implementation

Thus

acts

as

a

receptacle

for

properties

of

particular

languages

that

make

descriptions

in

that

language

unimplementable

For

example

a

Z

specification

which

contains

contradictions

would

not

be

internally

valid

e.g.

a

Z

specification

that

contains

an

operation

-LSB-

n

INjn

n

-RSB-

has

no

real

implementation

This

ensures

that

definition

in

the

case

that

n

coincides

with

what

is

commonly

called

consistency

of

a

single

specification

Unification

is

the

mechanism

by

which

descriptions

are

composed

in

such

a

way

that

the

composition

is

a

development

of

all

the

descriptions

X

is

internally

valid

Figure

A

Consistency

Check

Definition

-LRB-

Unification

Set

-RRB-

U

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

dvn

Xn

-RRB-

fX

DES

X

X

dvn

Xng

We

will

use

the

notation

n

U

-LRB-

dvi

Xi

-RRB-

as

a

shorthand

for

U

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

dvn

Xn

-RRB-

The

unification

set

is

the

set

of

all

common

developments

of

a

list

of

descriptions

i.e.

the

set

of

all

unifications

Clearly

n

C

-LRB-

dvi

Xi

-RRB-

holds

if

and

only

if

U

such

that

-LRB-

X

-RRB-

In

fact

one

approach

to

consistency

checking

is

to

perform

a

unification

and

then

to

show

that

this

unification

is

internally

valid

-LSB-

-RSB-

The

following

result

can

be

immediately

observed

Proposition

f

-LRB-

-RRB-

-LRB-

dvn

Xn

-RRB-

g

f

-LRB-

-RRB-

-LRB-

-RRB-

g

=-RRB-

U

-LRB-

-RRB-

-LRB-

dvn

Xn

-RRB-

U

-LRB-

-RRB-

-LRB-

-RRB-

Proof

If

n

U

-LRB-

dvi

Xi

-RRB-

the

result

follows

trivially

So

take

X

n

U

-LRB-

dvi

Xi

-RRB-

i.e.

X

X

dvn

Xn

For

any

s

t

j

m

X

since

by

the

hypothesis

-LRB-

for

i

n

-RRB-

such

that

dvi

and

Xi

So

X

U

-LRB-

-RRB-

-LRB-

-RRB-

as

required

This

proposition

expresses

the

obvious

result

that

a

unification

of

n

specifications

is

a

unification

of

a

subset

of

the

n

specifications

An

immediate

corollary

of

proposition

is

Corollary

n

U

-LRB-

dvi

Xi

-RRB-

U

-LRB-

dvi

Xi

-RRB-

-LRB-

dvj

Xj

-RRB-

for

i

j

n

Our

interpretation

of

consistency

C

meets

the

requirements

for

a

definition

of

consistency

that

we

highlighted

earlier

in

the

following

ways

ffl

Different

development

relations

can

be

instantiated

which

are

appropriate

both

to

different

FDTs

and

to

assessing

different

forms

of

consistency

ffl

Both

intra

and

inter

language

consistency

are

incorporated

In

particular

note

that

in

most

cases

Xn

in

the

above

definition

will

all

be

specifications

however

X

will

commonly

be

a

semantic

representation

In

particular

if

some

of

Xn

are

in

different

languages

then

X

is

likely

to

be

in

a

common

semantic

notation

ffl

Consistency

checking

between

an

arbitrary

number

of

descriptions

can

be

supported

and

checked

according

to

a

list

of

development

relations

Binary

consistency

e.g.

C

-LRB-

-RRB-

-LRB-

-RRB-

is

just

a

special

case

of

this

global

consistency

Binary

consistency

is

a

binary

relation

we

will

often

write

it

as

ffl

Both

balanced

and

unbalanced

consistency

are

incorporated

Unbalanced

consistency

arises

if

dvi

dvj

for

some

i

j

It

is

beyond

the

scope

of

this

paper

to

fully

document

the

properties

of

our

interpretation

of

consistency

the

interested

reader

is

referred

to

-LSB-

-RSB-

however

a

number

of

classes

of

consistency

will

be

used

later

in

this

paper

and

are

thus

reviewed

in

the

following

subsections

Complete

Consistency

It

is

possible

that

the

application

of

a

consistency

check

on

a

particular

FDT

may

always

be

consistent

i.e.

any

set

of

descriptions

chosen

from

the

language

will

be

consistent

This

property

is

called

complete

consistency

and

is

defined

as

Definition

Complete

Consistency

A

formal

description

technique

ft

is

completely

consistent

according

to

a

group

of

development

relations

dvn

if

and

only

if

for

all

Xn

in

DESft

n

C

-LRB-

dvi

Xi

-RRB-

Thus

if

an

FDT

is

known

to

be

completely

consistent

there

is

no

need

to

undertake

consistency

checking

This

for

example

is

the

case

for

LOTOS

specifications

when

balanced

consistency

according

to

extension

or

trace

preorder

are

being

considered

These

examples

will

be

returned

to

in

section

Implementation

Complete

There

are

a

number

of

languages

in

which

all

specifications

are

internally

valid

This

for

example

is

the

case

with

LOTOS

and

behavioural

specification

languages

such

as

LOTOS

Estelle

and

SDL

in

general

We

will

discuss

this

aspect

of

the

LOTOS

language

further

in

section

Thus

we

introduce

the

following

notation

Notation

-LRB-

Implementation

Complete

-RRB-

A

formal

technique

ft

is

called

implementation

complete

iff

DESft

-LRB-

X

-RRB-

Pairwise

Consistency

An

important

issue

is

in

what

way

we

can

determine

consistency

for

example

can

we

assert

consistency

between

three

or

more

descriptions

by

performing

a

series

of

pairwise

consistency

checks

In

order

to

determine

this

we

consider

the

notion

of

a

pairwise

consistency

check

Definition

-LRB-

Pairwise

Consistency

-RRB-

Descriptions

Xn

are

pairwise

consistent

according

to

development

relations

dvn

iff

j

s

t

i

j

n

Xi

Cdvi

dvj

Xj

The

following

result

characterizes

the

broad

relationship

between

pairwise

and

normal

consistency

Proposition

-LRB-

i

-RRB-

Consistency

implies

pairwise

consistency

-LRB-

ii

-RRB-

Pairwise

consistency

of

three

or

more

specifications

does

not

imply

consistency

Proof

-LRB-

i

-RRB-

Assume

DES

s

t

-LRB-

X

X

X

dvn

Xn

-RRB-

-LRB-

X

-RRB-

Now

clearly

Xi

Cdvi

dvj

Xj

for

any

i

j

n

since

X

can

act

as

the

internally

valid

common

development

-LRB-

ii

-RRB-

We

demonstrate

this

by

counterexample

Consider

the

three

specifications

-LSB-

x

y

INjx

y

-RSB-

-LSB-

x

z

INjx

z

-RSB-

and

-LSB-

z

y

INjz

y

-RSB-

Intuitively

these

are

balanced

pairwise

consistent

i.e.

C

C

C

but

they

are

not

globally

consistent

Intuitively

the

second

part

of

the

above

proposition

arises

because

pairwise

consistency

only

requires

the

existence

of

a

common

development

for

each

of

the

consistuent

binary

checks

Thus

many

binary

consistency

results

may

exist

each

of

which

focuses

on

a

different

common

development

This

is

not

sufficient

to

induce

global

consistency

which

requires

the

existence

of

a

single

common

development

Balanced

Consistency

Balanced

consistency

reflects

the

situation

in

which

the

specifications

being

checked

for

consistency

are

at

the

same

level

of

abstraction

balanced

consistency

is

written

n

C

dvXi

Definition

-LRB-

Balanced

Consistency

-RRB-

n

C

-LRB-

dvi

Xi

-RRB-

is

balanced

iff

dvi

dvj

j

s

t

i

j

n

Once

again

we

can

consider

the

special

case

of

binary

balanced

consistency

Cdv

-LRB-

-RRB-

which

is

often

written

as

Cdv

Notation

Meaning

P

P

denotes

a

transition

i.e.

P

can

do

and

consequently

behaves

as

P

ffl

=-RRB-

reflexive

and

transitive

closure

of

i

P

ffoe

-RRB-

P

P

ffl

=-RRB-

Q

oe

-RRB-

P

P

oe

=-RRB-

P

oe

-RRB-

P

P

oe

-RRB-

P

oe

-RRB-

P

Table

Derived

transition

denotations

Background

on

LOTOS

Subsequent

sectios

of

this

paper

apply

the

framework

to

the

FDT

LOTOS

-LSB-

-RSB-

However

introducing

LOTOS

is

beyond

the

scope

of

this

paper

thus

this

section

will

assume

familiarity

with

the

language

An

introduction

to

LOTOS

can

be

found

in

-LSB-

-RSB-

We

reiterate

the

standard

definitions

of

a

number

of

the

LOTOS

development

relations

which

we

will

use

in

this

paper

First

we

introduce

some

notation

Notation

In

the

following

P

P

Q

stand

for

processes

L

is

the

alphabet

of

observable

actions

associated

with

a

certain

process

while

i

is

the

invisible

or

internal

action

We

use

the

variable

to

range

over

L.

Furthermore

L

denotes

strings

-LRB-

or

traces

-RRB-

over

L

The

constant

ffl

L

denotes

the

empty

string

and

the

variable

oe

ranges

over

L

In

table

the

notion

of

transition

is

generalised

to

traces

Using

the

notation

derived

in

table

we

can

define

the

following

T

r

-LRB-

P

-RRB-

foe

L

j

P

oe

=-RRB-

g

denotes

the

set

of

traces

of

a

process

P

P

after

oe

fP

j

P

oe

-RRB-

P

g

denotes

the

set

of

all

states

reachable

from

P

by

the

trace

oe

Ref

-LRB-

P

oe

-RRB-

fX

j

-LRB-

P

after

oe

-RRB-

s.t.

X

P

-RRB-

g

denotes

the

refusals

of

P

after

oe

Trace

Preorder

An

important

category

of

system

properties

that

one

would

like

have

satisfied

are

safety

properties

Safety

properties

state

that

something

bad

should

not

happen

where

something

bad

can

be

interpreted

as

a

certain

trace

of

the

specification

Observe

that

if

S

is

a

safety

property

then

we

have

if

then

S

-LRB-

-RRB-

-RRB-

S

-LRB-

-RRB-

i.e.

if

S

holds

for

the

trace

it

also

holds

for

all

its

prefixes

In

particular

all

safety

properties

hold

for

the

empty

trace

ffl

When

a

specification

is

refined

it

seems

reasonable

to

require

that

the

refinement

is

at

least

as

safe

as

the

specification

This

intuition

is

reflected

by

the

trace

preorder

Definition

-LRB-

trace

preorder

-RRB-

Given

two

process

specifications

P

and

Q

then

P

is

a

trace

refinement

of

Q

denoted

P

tr

Q

iff

T

r

-LRB-

P

-RRB-

T

r

-LRB-

Q

-RRB-

Reduction

In

addition

to

safety

properties

the

liveness

-LRB-

or

deadlock

-RRB-

properties

of

a

system

are

also

important

A

liveness

property

states

that

something

good

must

eventually

happen

It

may

be

required

that

a

development

of

a

specification

does

not

deadlock

in

a

situation

where

the

specification

would

not

deadlock

in

other

words

every

trace

that

the

specification

must

do

the

development

must

do

as

well

A

refinement

relation

that

combines

both

the

preservation

of

safety

and

liveness

properties

is

the

reduction

relation

red

defined

in

-LSB-

-RSB-

Definition

-LRB-

reduction

-RRB-

Given

two

process

specifications

P

and

Q

then

P

-LRB-

deterministically

-RRB-

reduces

Q

denoted

P

red

Q

iff

P

tr

Q

and

T

r

-LRB-

Q

-RRB-

Ref

-LRB-

P

oe

-RRB-

Ref

-LRB-

Q

oe

-RRB-

Extension

Another

refinement

relation

proposed

in

-LSB-

-RSB-

is

the

extension

relation

This

relation

allows

new

possible

traces

to

be

introduced

while

preserving

the

liveness

properties

of

the

specification

Extension

seems

particularly

relevant

in

the

context

of

partial

specification

Definition

-LRB-

extension

-RRB-

Given

two

process

specifications

P

and

Q

then

P

extends

Q

denoted

P

ext

Q

iff

T

r

-LRB-

P

-RRB-

T

r

-LRB-

Q

-RRB-

and

T

r

-LRB-

Q

-RRB-

Ref

-LRB-

P

oe

-RRB-

Ref

-LRB-

Q

oe

-RRB-

Testing

Equivalence

A

standard

interpretation

of

equivalence

is

given

by

the

testing

equivalence

relation

In

particular

notice

that

P

te

Q

-LRB-

-RRB-

P

red

red

Q

-LRB-

-RRB-

P

ext

ext

Q.

So

testing

equivalence

is

a

sensible

identity

in

the

sense

of

for

both

red

and

ext.

Definition

-LRB-

testing

equivalence

-RRB-

P

te

Q

iff

T

r

-LRB-

P

-RRB-

T

r

-LRB-

Q

-RRB-

T

r

-LRB-

P

-RRB-

Ref

-LRB-

P

oe

-RRB-

Ref

-LRB-

Q

oe

-RRB-

Internal

Validity

At

least

theoretically

we

can

view

all

LOTOS

specifications

as

implementable

Even

degenerate

specifications

such

as

those

containing

deadlocks

for

example

have

a

physical

implementation

equivalent

Thus

all

LOTOS

descriptions

are

internally

valid

This

is

a

fundamental

characteristic

of

behavioural

languages

that

distinguishes

them

from

logically

based

specification

notations

Proposition

LOTOS

is

implementation

complete

This

proposition

is

important

as

it

considerably

simplifies

the

class

of

consistency

that

must

be

considered

for

LOTOS

Basic

Strategies

for

Consistency

Checking

Up

to

this

point

we

have

investigated

consistency

in

terms

of

a

set

of

possible

unifications

i.e.

descriptions

Xn

are

consistent

if

firstly

the

set

of

possible

unifications

n

U

-LRB-

dvi

Xi

-RRB-

is

non-empty

and

secondly

the

set

contains

an

internally

valid

description

Such

a

unification

set

could

be

very

large

and

often

infinite

Clearly

if

a

system

development

trajectory

is

to

be

provided

for

viewpoint

models

then

it

is

important

that

we

reduce

the

choice

of

unification

In

particular

we

would

like

to

select

just

one

description

from

the

set

of

unifications

This

would

enable

an

incremental

development

strategy

in

which

a

group

of

viewpoints

are

unified

and

then

this

unification

is

further

composed

with

another

group

of

viewpoints

This

situation

amounts

to

obtaining

global

consistency

from

a

series

of

non-global

-LRB-

probably

binary

-RRB-

consistency

checks

and

unifications

The

objective

of

the

remainder

of

this

paper

is

to

characterise

the

unification

that

should

be

chosen

from

the

unification

set

This

section

considers

basic

strategies

for

consistency

checking

In

particular

the

issue

of

representative

unification

is

considered

in

subsection

Then

general

formats

for

binary

consistency

checking

are

considered

in

section

and

the

central

issue

of

least

developed

unification

is

discussed

in

These

basic

strategies

will

be

used

in

later

sections

when

we

consider

the

properties

required

in

order

to

realise

a

binary

consistency

checking

strategy

Representative

Unification

A

particular

unification

algorithm

will

construct

just

one

member

of

the

unification

set

Importantly

we

need

to

know

that

the

unification

that

we

construct

is

internally

valid

if

and

only

if

an

internally

valid

unification

exists

otherwise

we

may

construct

an

internally

invalid

unification

despite

the

fact

that

an

alternative

unification

may

be

internally

valid

Thus

we

introduce

the

concept

of

a

representative

unification

which

is

defined

as

follows

Definition

X

n

U

-LRB-

dvi

Xi

-RRB-

is

a

representative

unification

iff

-LRB-

n

U

-LRB-

dvi

Xi

-RRB-

s

t

-LRB-

-RRB-

-RRB-

=-RRB-

-LRB-

X

-RRB-

The

following

result

is

very

straightforward

Proposition

ft

is

implementation

complete

and

Xn

DESft

=-RRB-

n

U

-LRB-

dvi

Xi

-RRB-

X

is

a

representative

unification

So

this

result

implies

that

for

a

language

such

as

LOTOS

representativeness

of

unification

does

not

arise

We

would

certainly

expect

the

unification

functions

that

we

adopt

to

yield

a

representative

unification

and

it

would

be

a

major

flaw

in

the

strategy

if

it

did

not

As

a

reflection

of

this

for

the

remainder

of

this

paper

we

will

assume

representativeness

of

the

unification

functions

that

we

consider

Binary

Consistency

Checking

Strategies

We

would

like

to

obtain

global

consistency

through

a

series

of

binary

consistency

checks

We

have

found

that

naive

pairwise

checking

does

not

give

us

this

see

proposition

However

a

combination

of

binary

consistency

checks

and

binary

unification

of

the

form

shown

in

figure

should

intuitively

work

i.e.

and

are

checked

for

consistency

then

a

unification

of

and

is

obtained

which

is

checked

for

consistency

against

then

a

unification

of

and

the

previous

unification

is

performed

This

process

is

continued

through

the

n

viewpoint

descriptions

Thus

the

base

case

is

a

binary

consistency

check

and

then

repeated

unification

and

binary

consistency

checks

are

performed

against

the

next

description

Of

course

this

is

just

one

possible

sequence

of

binary

consistency

checks

We

would

like

to

obtain

full

associativity

results

which

support

any

appropriate

incremental

consistency

checking

strategy

However

as

an

archetypal

approach

the

binary

consistency

checking

strategy

of

figure

will

serve

as

an

initial

focus

for

our

investigations

The

advantages

of

such

incremental

consistency

checking

strategies

are

that

they

do

not

force

the

involvement

of

all

viewpoints

in

every

consistency

check

In

particular

it

may

be

possible

to

incrementally

correct

inconsistencies

In

addition

such

an

approach

will

aid

maintaining

structure

when

unifying

One

of

the

main

problems

with

unification

algorithms

is

that

the

generated

unification

is

almost

certain

to

be

devoid

of

high

level

specification

structure

-LRB-

e.g.

operators

such

as

j

-LSB-

-RSB-

j

in

LOTOS

are

expanded

out

-RRB-

-LSB-

-RSB-

This

is

a

big

problem

if

the

unification

is

to

be

further

developed

It

is

very

unlikely

that

a

single

unification

of

a

large

group

of

viewpoints

will

be

able

to

reconcile

the

structure

of

all

the

views

however

an

incremental

focus

of

restructuring

may

be

possible

The

next

definition

characterises

the

binary

consistency

checking

strategy

that

we

are

interested

in

We

denote

the

strategy

U

where

U

is

a

particular

binary

unification

function

incorporates

a

series

of

binary

consistency

checks

each

of

which

uses

U

to

perform

the

binary

unification

U

has

the

general

form

U

-LRB-

DEV

DES

-RRB-

-LRB-

DEV

DES

-RRB-

P

-LRB-

DES

-RRB-

i.e.

it

takes

two

pairs

-LRB-

each

comprising

a

development

relation

and

a

description

-RRB-

and

yields

a

set

of

descriptions

A

typical

application

of

the

function

e.g.

U

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

generates

a

set

of

descriptions

which

are

intuitively

possible

unifications

of

X

and

according

to

dv

and

respectively

We

will

investigate

the

suitability

of

specific

binary

unification

functions

by

instantiating

these

functions

for

U

in

U

Thus

U

gives

us

a

general

structure

for

obtaining

global

consistency

from

a

series

of

binary

unifications

but

it

is

parameterised

on

the

particular

binary

unification

function

to

use

Obviously

the

spectrum

of

possible

instantiations

of

U

is

very

large

from

functions

that

yield

all

possible

binary

unifications

i.e.

U

to

functions

which

select

just

one

unification

Clearly

our

ultimate

objective

is

to

use

a

unification

function

which

yields

a

single

unification

however

this

will

not

turn

out

to

be

possible

in

all

cases

Thus

at

this

stage

we

have

chosen

to

be

most

general

and

let

U

generate

a

set

of

unifications

Definition

U

-LRB-

-RRB-

-LRB-

dvn

Xn

-RRB-

def

-LRB-

-LRB-

U

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

-RRB-

Step

-LRB-

U

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

-RRB-

Step

-LRB-

U

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

-RRB-

Step

-LRB-

U

-LRB-

dvn

Yn

-RRB-

-LRB-

dvn

Xn

-RRB-

-LRB-

Yn

-RRB-

-RRB-

Step

-LRB-

U

-LRB-

dvn

Yn

-RRB-

-LRB-

dvn

Xn

-RRB-

-LRB-

Yn

-RRB-

-RRB-

-RRB-

Step

Thus

each

step

in

the

algorithm

considers

a

unification

set

using

the

binary

unification

function

U

The

ith

step

is

satisfied

if

a

description

Yi

can

be

found

in

the

set

of

unifications

generated

by

the

function

U

that

is

internally

valid

and

can

be

used

to

satisfy

the

i

step

A

depiction

of

U

with

n

is

given

in

figure

It

should

be

apparent

that

consistency

checking

is

implicit

in

each

step

Thus

the

existence

of

an

internally

valid

ith

unification

Yi

ensures

that

Yi

and

Xi

are

consistent

Clearly

if

an

internally

valid

unification

does

not

exist

for

a

particular

step

then

consistency

would

be

lost

tency

Figure

Binary

Consistency

Algorithm

U

-LRB-

-RRB-

U

-LRB-

-RRB-

U

-LRB-

-RRB-

A

A

A

A

AAU

A

A

A

A

AAU

A

A

A

A

AAU

Figure

Formal

Depiction

of

Binary

Consistency

Algorithm

In

addition

notice

how

when

we

have

performed

a

binary

unification

e.g.

U

-LRB-

dv

Y

-RRB-

-LRB-

dvi

Xi

-RRB-

the

next

binary

unification

will

intersect

dv

and

dvi

this

ensures

that

the

final

unification

-LRB-

using

transitivity

of

development

-RRB-

is

a

development

by

dvi

of

Xj

for

all

j

As

mentioned

earlier

the

unification

construction

function

U

yields

a

set

of

unifications

which

could

be

a

singleton

We

assume

U

satisfies

the

following

constraints

Definition

A

binary

unification

function

U

is

valid

if

and

only

if

-LRB-

U

i

-RRB-

U

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

U

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

and

-LRB-

U

ii

-RRB-

U

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

=-RRB-

U

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

These

are

minimal

constraints

that

ensure

U

is

a

sensible

binary

unification

method

-LRB-

U.i

-RRB-

guarantees

that

the

unifications

generated

by

U

are

in

the

set

of

all

unifications

obtained

by

U

-LRB-

remember

U

is

our

base

unification

function

see

definiton

-RRB-

and

-LRB-

U.ii

-RRB-

ensures

that

if

a

unification

exists

U

will

not

yield

the

empty

set

Using

these

constraints

we

can

show

that

if

our

binary

consistency

checking

strategy

is

satisfied

then

consistency

follows

Proposition

Assuming

dvi

i

n

is

a

preorder

and

U

satisfies

-LRB-

U.i

-RRB-

and

-LRB-

U.ii

-RRB-

n

U

-LRB-

dvi

Xi

-RRB-

=-RRB-

n

C

-LRB-

dvi

Xi

-RRB-

Proof

Assume

n

U

-LRB-

dvi

Xi

-RRB-

holds

Now

from

step

in

U

we

deduce

s

t

Y

-LRB-

dvn

-RRB-

Yn

-LRB-

-RRB-

Y

dvn

Xn

-LRB-

-RRB-

-LRB-

Y

-RRB-

-LRB-

-RRB-

We

will

show

that

Y

is

the

required

common

development

of

through

to

Xn

to

give

us

n

C

-LRB-

dvi

Xi

-RRB-

Firstly

-LRB-

-RRB-

and

-LRB-

-RRB-

give

us

immediately

that

-LRB-

Y

-RRB-

and

Y

dv

Xn

Now

from

-LRB-

-RRB-

and

Yn

U

-LRB-

dvn

Yn

-RRB-

-LRB-

dvn

Xn

-RRB-

we

can

deduce

that

Y

dvn

Yn

and

Yn

dvn

Xn

thus

from

transitivity

of

dvn

we

have

Y

dvn

Xn

We

can

perform

similar

arguments

down

through

the

construction

of

to

determine

that

Y

dvn

Xn

Y

Y

Thus

Y

is

the

required

common

development

and

n

C

-LRB-

dvi

Xi

-RRB-

holds

Using

this

result

we

can

show

that

performing

with

the

full

unification

set

function

i.e.

instantiating

U

for

U

is

equal

to

consistency

Clearly

we

would

expect

this

to

be

the

case

and

if

it

was

not

we

would

have

to

worry

about

Proposition

Assume

dvi

i

n

is

a

preorder

Then

U

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

dvn

Xn

-RRB-

n

C

-LRB-

dvi

Xi

-RRB-

Proof

-LRB-

=-RRB-

-RRB-

U

trivially

satisfies

-LRB-

U.i

-RRB-

and

-LRB-

U.ii

-RRB-

thus

we

can

use

the

previous

result

proposition

to

give

this

direction

of

implication

-LRB-

-LRB-

=-RRB-

Assume

n

C

-LRB-

dvi

Xi

-RRB-

holds

i.e.

n

U

-LRB-

dvi

Xi

-RRB-

such

that

-LRB-

Y

-RRB-

We

will

show

that

Y

can

act

as

the

unification

in

all

steps

of

Firstly

the

internal

validity

requirement

of

each

step

will

clearly

be

satisfied

for

Y

In

addition

using

corollary

we

get

Y

U

-LRB-

-RRB-

-LRB-

-RRB-

and

thus

step

Step

follows

since

Y

by

our

assumption

and

Y

Y

from

the

reflexivity

of

development

i.e.

Y

U

-LRB-

Y

-RRB-

-LRB-

-RRB-

Using

similar

arguments

we

can

get

step

and

all

steps

up

to

as

required

However

if

we

use

a

valid

unification

construction

function

-LRB-

i.e.

one

that

satisfies

-LRB-

U.i

-RRB-

and

-LRB-

U.ii

-RRB-

-RRB-

other

than

U

the

converse

to

proposition

does

not

in

general

follow

i.e.

C

-RRB-

U

and

we

clearly

require

this

direction

if

is

to

be

used

Example

We

will

give

two

simple

examples

of

why

a

simple

binary

consistency

checking

strategy

may

not

give

global

consistency

The

first

example

is

for

LOTOS

and

the

second

is

for

Z.

LOTOS

Consider

the

three

LOTOS

specifications

i

a

stop

-LSB-

-RSB-

i

b

stop

a

stop

-LSB-

-RSB-

i

b

stop

and

a

stop

Further

consider

the

consistency

check

Cred

-LRB-

-RRB-

where

red

is

the

LOTOS

reduction

relation

which

refines

through

reduction

of

non-determinism

-LRB-

see

section

-RRB-

The

three

specifications

are

consistent

by

reduction

since

is

a

reduction

of

all

three

specifications

However

if

we

attempt

a

binary

consistency

checking

algorithm

and

started

with

and

we

may

choose

as

the

unification

of

these

two

the

process

P

i

b

stop

and

Cred

-LRB-

P

-RRB-

does

not

hold

Z.

Consider

the

three

Z

specifications

-LSB-

n

IN

j

n

n

-RSB-

-LSB-

n

IN

j

n

n

-RSB-

and

-LSB-

n

IN

j

n

-RSB-

The

first

two

specifications

could

be

unified

to

yield

-LSB-

n

IN

j

n

-RSB-

which

is

not

consistent

with

the

third

But

the

third

specification

could

act

as

a

refinement

of

all

three

These

examples

suggest

the

class

of

unifications

that

we

must

select

Specifically

we

should

choose

the

least

developed

unification

i.e.

the

one

that

is

most

abstract

and

is

in

terms

of

development

closest

to

the

original

descriptions

In

both

the

above

examples

this

will

give

the

required

result

In

the

LOTOS

example

itself

should

have

been

chosen

as

the

unification

of

and

as

it

is

the

least

reduced

unification

up

to

testing

equivalence

Similarly

in

the

Z

example

either

of

the

identical

specifications

or

should

have

been

chosen

initially

The

issue

is

that

we

could

choose

a

unification

of

two

descriptions

that

is

too

developed

to

be

reconciled

with

a

third

description

while

a

less

developed

unification

that

could

be

reconciled

exists

The

problem

is

evolving

the

two

original

specifications

unnecessarily

far

towards

the

concrete

during

unification

We

will

consider

the

issue

of

least

developed

unifications

next

Least

Developed

Unifications

In

traditional

single

threaded

-LRB-

waterfall

-RRB-

models

of

system

development

the

issue

of

least

development

does

not

arise

This

is

because

assuming

development

is

a

preorder

each

description

is

a

least

development

of

itself

i.e.

is

a

development

of

itself

-LRB-

because

of

reflexivity

-RRB-

and

is

less

developed

than

any

other

development

Unfortunately

the

situation

is

not

so

straightforward

when

we

generalise

to

viewpoints

and

when

we

must

reconcile

the

development

trajectory

of

more

than

one

description

First

our

interpretation

of

least

developed

unification

We

assume

dvi

i

n

are

preorders

Definition

-LRB-

Least

Developed

Unification

-RRB-

X

n

U

-LRB-

dvi

Xi

-RRB-

is

a

least

developed

unification

iff

-LRB-

n

U

-LRB-

dvi

Xi

-RRB-

s

t

X

n

dvi

-RRB-

where

n

dvi

is

a

shorthand

for

dvn

This

definition

ensures

that

a

unification

which

X

is

a

strict

development

of

does

not

exist

Notice

the

interpretation

of

development

that

X

and

are

related

by

dvn

i.e.

the

set

of

unifications

is

ordered

by

the

intersection

of

the

development

relations

used

in

unification

Figure

depicts

a

typical

situation

X

and

are

unifications

of

and

and

X

and

are

ordered

by

In

this

diagram

X

is

the

least

developed

unification

of

and

dvn

is

a

natural

interpretation

of

development

between

unifications

because

all

descriptions

in

the

unification

set

that

are

descendents

of

a

least

developed

unification

X

are

developments

of

X

by

all

relevant

development

relations

Note

that

another

way

of

looking

at

the

least

development

is

that

it

is

a

maximal

element

in

the

set

of

possible

developments

Thus

by

reversing

the

point

of

reference

we

can

exchange

least

for

maximal

At

some

points

in

the

text

it

will

be

most

convenient

to

make

this

reversal

and

talk

in

terms

of

maximal

elements

of

sets

of

developments

Unfortunately

for

inter

language

consistency

the

least

developed

of

the

set

of

unifications

is

a

problematic

concept

Specifically

descriptions

in

the

unification

set

n

U

-LRB-

dvi

Xi

-RRB-

are

likely

to

be

in

a

different

notation

from

Xn

thus

it

is

unlikely

that

the

unifications

can

be

related

in

a

type

correct

manner

using

dvn

Thus

this

definition

and

the

remaining

theory

will

only

be

applied

to

intra

language

consistency

Ongoing

work

is

addressing

generalisation

of

least

developed

unification

to

the

inter

language

setting

It

is

also

disappointing

to

discover

that

for

arbitrary

development

relations

-LRB-

even

when

constrained

to

be

preorders

and

in

the

intra

language

setting

-RRB-

the

least

developed

unification

will

not

necessarily

be

unique

-LRB-

By

way

of

clarification

here

we

are

talking

about

uniqueness

up

to

equivalence

where

equivalence

is

interpreted

as

n

dvi

for

dvn

the

relevant

development

relations

Throughout

the

remainder

of

the

paper

when

we

talk

about

uniqueness

we

mean

unique

up

to

equivalence

-RRB-

XX

X

Set

Figure

A

Typical

Least

Developed

Unification

Situation

Example

If

we

have

four

descriptions

and

and

the

development

relations

between

descriptions

indicated

in

figure

both

and

are

least

developed

unifications

of

and

i.e.

they

are

clearly

both

in

U

-LRB-

-RRB-

-LRB-

-RRB-

and

neither

has

an

ancestor

by

in

U

-LRB-

-RRB-

-LRB-

-RRB-

Furthermore

examples

of

this

form

are

characteristic

of

situations

that

foil

Specifically

consider

the

development

relations

in

figure

In

this

situation

we

may

unify

and

to

and

then

fail

to

find

a

common

development

with

even

though

could

act

as

the

required

common

development

of

and

We

can

illustrate

such

a

situation

by

considering

the

LOTOS

consistency

check

C

-LRB-

tr

-RRB-

-LRB-

ext

-RRB-

-LRB-

tr

-RRB-

where

a

b

c

stop

a

stop

a

stop

-LSB-

-RSB-

c

stop

and

a

b

stop

Now

both

and

-LRB-

amongst

others

-RRB-

are

least

unifications

from

within

U

-LRB-

tr

-RRB-

-LRB-

ext

-RRB-

-LRB-

a

subset

of

the

relevant

development

relations

is

shown

in

figure

-RRB-

In

particular

notice

that

and

are

not

related

by

tr

ext

thus

neither

is

less

developed

than

the

other

Furthermore

if

we

now

consider

the

full

consistency

check

C

-LRB-

tr

-RRB-

-LRB-

ext

-RRB-

-LRB-

tr

-RRB-

the

choice

of

least

developed

unification

is

extremely

significant

since

tr

but

tr

Thus

in

order

to

perform

this

consistency

check

we

need

to

check

against

the

set

of

all

least

developed

unifications

of

and

which

would

include

both

and

In

response

to

these

observations

we

will

divide

our

discussion

of

least

developed

unification

into

two

parts

First

we

will

consider

the

situation

in

which

the

least

developed

unification

is

not

unique

then

we

will

discuss

the

situation

in

which

it

is

unique

These

two

cases

will

be

discussed

in

the

following

two

sections

In

the

former

case

we

consider

unification

according

to

the

set

of

all

least

developed

unifications

This

is

a

compromise

of

our

ultimate

objective

which

is

to

locate

a

single

unification

but

it

allows

us

to

in

general

reduce

the

specification

set

to

some

extent

Our

objective

is

to

consider

the

consequence

of

using

the

least

developed

unification

set

as

unification

function

If

this

gives

us

the

required

relationship

between

and

C

then

we

will

attempt

to

be

more

selective

from

amongst

the

least

developed

unification

set

and

locate

under

what

circumstances

we

can

take

just

one

element

from

the

set

Non

Unique

Least

Developed

Unification

Relating

Consistency

and

Least

Development

We

define

the

least

developed

unification

set

which

we

denote

LU

-LRB-

-RRB-

-LRB-

dvn

Xn

-RRB-

or

n

LU

-LRB-

dvi

Xi

-RRB-

as

follows

Definition

-LRB-

Least

Developed

Unification

Set

-RRB-

n

LU

-LRB-

dvi

Xi

-RRB-

fX

X

n

U

-LRB-

dvi

Xi

-RRB-

-LRB-

n

U

-LRB-

dvi

Xi

-RRB-

s

t

X

n

dvi

Figure

Development

Relations

Figure

More

Development

Relations

addition

all

nodes

are

related

to

themselves

by

both

relations

where

denotes

trace

preorder

and

denotes

extension

Figure

LOTOS

Development

Relations

Thus

the

least

developed

unification

set

is

the

set

of

all

unifications

that

do

not

have

a

non-equivalent

ancestor

in

the

unification

set

In

order

to

use

LU

as

the

unification

function

in

we

must

show

that

LU

is

valid

with

regard

to

U

i.e.

it

satisfies

conditions

-LRB-

U.i

-RRB-

and

-LRB-

U.ii

-RRB-

The

first

of

these

is

straightforward

it

follows

directly

from

the

next

proposition

Proposition

n

LU

-LRB-

dvi

Xi

-RRB-

n

U

-LRB-

dvi

Xi

-RRB-

Proof

Take

X

n

LU

-LRB-

dvi

Xi

-RRB-

by

the

definition

of

LU

X

n

U

-LRB-

dvi

Xi

-RRB-

Corollary

LU

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

U

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

-LRB-

U.ii

-RRB-

though

is

more

difficult

and

obtaining

this

validity

constraint

is

central

to

showing

that

LU

is

equal

to

C

We

will

have

to

impose

certain

well

behavedness

constraints

on

development

in

order

to

obtain

this

property

With

the

constraints

that

we

have

already

imposed

on

development

i.e.

preorder

these

properties

give

us

a

set

of

requirements

that

development

in

a

particular

formalism

must

satisfy

in

order

for

it

to

be

used

in

our

framework

of

unification

In

order

not

to

lose

the

flow

of

our

current

argument

we

will

refrain

for

the

moment

from

consideration

of

these

constraints

they

will

be

discussed

in

section

For

the

moment

we

simply

state

the

result

that

we

want

section

will

provide

proofs

We

actually

need

a

stronger

property

than

-LRB-

U.ii

-RRB-

in

order

to

prove

the

forthcoming

theorem

The

property

that

we

need

is

Property

X

n

U

-LRB-

dvi

Xi

-RRB-

=-RRB-

n

LU

-LRB-

dvi

Xi

-RRB-

s

t

X

n

dvi

This

property

states

that

all

unifications

have

an

ancestor

in

the

least

developed

unification

set

In

other

words

all

unifications

are

developments

by

n

dvi

of

a

least

developed

unification

Notice

a

least

developed

unification

is

a

development

of

itself

Further

notice

implicit

in

the

condition

of

the

unification

n

U

-LRB-

dvi

Xi

-RRB-

You

may

think

that

such

a

requirement

would

naturally

hold

but

section

shows

that

this

is

not

the

case

Once

we

have

property

we

can

easily

obtain

-LRB-

U.ii

-RRB-

it

is

an

immediate

corollary

of

the

following

more

general

result

Proposition

Property

=-RRB-

-LRB-

n

U

-LRB-

dvi

Xi

-RRB-

=-RRB-

n

LU

-LRB-

dvi

Xi

-RRB-

;-RRB-

Proof

Assume

n

U

-LRB-

dvi

Xi

-RRB-

and

take

X

n

U

-LRB-

dvi

Xi

-RRB-

Now

we

can

use

property

to

get

n

LU

-LRB-

dvi

Xi

-RRB-

So

n

LU

-LRB-

dvi

Xi

-RRB-

as

required

Corollary

Property

=-RRB-

-LRB-

U

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

=-RRB-

LU

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

;-RRB-

We

now

have

enough

theory

to

tackle

the

main

concern

of

this

section

obtaining

global

consistency

from

binary

consistency

checking

and

to

relate

C

to

LU

Theorem

Given

property

and

LU

a

representative

unification

strategy

n

C

-LRB-

dvi

Xi

-RRB-

LU

-LRB-

-RRB-

-LRB-

dvn

Xn

-RRB-

Proof

The

first

section

of

the

appendix

contains

an

induction

proof

-LRB-

proposition

-RRB-

where

LU

is

a

slightly

stronger

constraint

than

LU

that

n

C

-LRB-

dvi

Xi

-RRB-

=-RRB-

LU

-LRB-

-RRB-

-LRB-

dvn

Xn

-RRB-

From

an

examination

of

the

conditions

of

if

LU

is

representative

LU

-LRB-

-RRB-

-LRB-

dvn

Xn

-RRB-

=-RRB-

LU

-LRB-

-RRB-

-LRB-

dvn

Xn

-RRB-

In

addition

proposition

gives

us

the

other

direction

of

implication

Figure

Infinite

chain

of

candidate

least

developed

unifications

This

is

the

result

we

are

seeking

it

states

that

subject

to

property

holding

and

LU

a

representative

unification

strategy

we

can

equate

the

binary

consistency

checking

strategy

LU

with

consistency

i.e.

if

each

binary

unification

considers

the

set

of

all

least

developed

unifications

then

we

will

obtain

consistency

However

in

order

to

obtain

this

identity

we

it

is

sufficient

to

verify

property

The

next

subsection

considers

constraints

on

development

that

realise

this

property

Constraints

on

Development

The

difficulty

surrounding

obtaining

property

-LRB-

and

hence

constraint

-LRB-

U.ii

-RRB-

-RRB-

is

that

the

chain

of

candidate

least

unifications

may

be

infinite

as

depicted

in

figure

and

a

maximal

member

of

the

chain

Yi

may

not

exist

This

is

unlikely

to

arise

in

practice

but

is

theoretically

possible

for

arbitrary

preorders

Notice

that

it

is

certain

that

the

unification

set

can

be

infinite

e.g.

consider

the

LOTOS

ext

relation

We

would

like

to

locate

a

constraint

on

development

that

prevents

the

unification

set

being

infinitely

increasing

in

the

manner

highlighted

Property

states

X

n

U

-LRB-

dvi

Xi

-RRB-

=-RRB-

n

LU

-LRB-

dvi

Xi

-RRB-

s

t

X

n

dvi

i.e.

if

the

unification

set

is

non-empty

all

unifications

are

descendents

of

a

least

developed

unification

In

order

to

characterise

when

this

property

can

be

obtained

we

need

some

definitions

Definition

For

S

DES

and

dv

DEV

M

-LRB-

S

dv

-RRB-

-LRB-

S

s

t

-LRB-

S

s

t

Y

dv

Y

-RRB-

-RRB-

Such

a

Y

is

called

a

maximal

element

of

S.

Thus

M

-LRB-

S

dv

-RRB-

will

hold

if

and

only

if

the

set

S

of

descriptions

has

a

maximal

element

by

dv

i.e.

an

element

Y

which

has

no

ancestor

by

dv

in

S

When

we

are

considering

maximal

elements

of

unification

sets

we

will

talk

about

maximal

unifications

The

next

two

definitions

are

interpretations

of

standard

mathematical

concepts

see

for

example

-LSB-

-RSB-

Definition

An

infinite

set

of

descriptions

g

is

said

to

be

an

infinitely

ascending

chain

according

to

dv

iff

Xi

dv

Xi

for

all

i

IN

Definition

-LRB-

Well

Founded

Set

-RRB-

S

is

called

a

well

founded

-LRB-

WF

-RRB-

set

by

dv

iff

S

-LRB-

=-RRB-

M

-LRB-

dv

-RRB-

-RRB-

Thus

a

partial

order

-LRB-

S

dv

-RRB-

is

well

founded

-LRB-

WF

-RRB-

if

and

only

if

all

non-empty

subsets

of

S

have

at

least

one

maximal

element

Clearly

we

could

consider

dual

definitions

which

focus

on

the

opposite

direction

of

the

development

partial

order

e.g.

minimal

elements

of

ancestors

by

development

However

our

focus

is

on

evolution

of

descriptions

towards

development

Notice

that

a

maximal

element

of

a

set

is

not

necessarily

unique

up

to

equivalence

There

could

be

a

number

of

unifications

with

no

ancestor

by

development

in

the

unification

set

see

for

example

figure

The

following

is

a

standard

result

from

mathematical

set

theory

see

-LSB-

-RSB-

for

example

-LRB-

a

proof

of

the

result

is

reproduced

in

-LSB-

-RSB-

-RRB-

Proposition

-LRB-

i

-RRB-

-LRB-

S

dv

-RRB-

is

well

founded

-LRB-

-RRB-

-LRB-

ii

-RRB-

There

is

no

infinitely

ascending

chain

in

-LRB-

S

dv

-RRB-

With

these

concepts

we

can

characterise

under

what

circumstances

property

can

be

obtained

Proposition

-LRB-

i

-RRB-

There

is

no

infinite

ascending

chain

by

n

dvi

of

descriptions

in

n

U

-LRB-

dvi

Xi

-RRB-

=-RRB-

-LRB-

ii

-RRB-

X

n

U

-LRB-

dvi

Xi

-RRB-

=-RRB-

n

LU

-LRB-

dvi

Xi

-RRB-

s

t

X

n

dvi

i.e.

-LRB-

i

-RRB-

=-RRB-

property

Proof

By

contradiction

so

assume

-LRB-

i

-RRB-

Now

-LRB-

ii

-RRB-

gives

n

U

-LRB-

dvi

Xi

-RRB-

s

t

-LRB-

n

LU

-LRB-

dvi

Xi

-RRB-

s

t

X

n

dvi

-RRB-

Now

consider

the

following

construction

X.

Select

n

U

-LRB-

dvi

Xi

-RRB-

such

that

n

dvi

Such

an

must

exist

otherwise

would

be

a

least

developed

unification

and

a

development

by

n

dvi

of

itself

which

contradicts

out

assumption

of

-LRB-

ii

-RRB-

If

Xj

n

U

-LRB-

dvi

Xi

-RRB-

for

j

such

that

n

dvi

n

dvi

Xj

n

dvi

Xj

have

already

been

chosen

then

a

description

Xj

such

that

Xj

n

dvi

Xj

can

be

found

Such

an

Xj

must

exist

otherwise

Xj

would

be

a

least

developed

unification

and

by

transitivity

of

development

and

an

ancestor

by

n

dvi

of

which

would

contradict

our

assumption

of

-LRB-

ii

-RRB-

This

construction

will

generate

an

infinite

ascending

chain

by

n

dvi

of

descriptions

n

U

-LRB-

dvi

Xi

-RRB-

which

contradicts

our

assumption

of

-LRB-

i

-RRB-

as

required

Using

this

result

we

can

obtain

the

following

important

corollary

Corollary

-LRB-

i

-RRB-

-LRB-

n

U

-LRB-

dvi

Xi

-RRB-

n

dvi

-RRB-

is

well

founded

=-RRB-

-LRB-

ii

-RRB-

Property

This

result

characterises

the

properties

that

are

required

of

n

U

-LRB-

dvi

Xi

-RRB-

in

order

to

obtain

property

In

order

to

use

a

particular

FDT

we

would

actually

like

to

know

that

any

combination

of

development

relations

and

descriptions

in

the

language

will

yield

a

unification

set

that

satisfies

property

We

will

clearly

obtain

this

if

an

FDT

up

holds

the

following

Property

FDT

ft

satisfies

property

iff

Xn

DESft

dvn

DEVft

-LRB-

n

U

-LRB-

dvi

Xi

-RRB-

n

dvi

-RRB-

is

well

founded

Another

way

to

express

property

is

Xn

DESft

dvn

DEVft

-LRB-

n

D

-LRB-

xi

dvi

-RRB-

n

dvi

-RRB-

is

well

founded

since

n

D

-LRB-

xi

dvi

-RRB-

n

U

-LRB-

dvi

Xi

-RRB-

In

order

to

verify

that

property

holds

for

a

particular

FDT

we

would

like

to

obtain

a

constraint

that

can

be

realistically

checked

for

actual

development

relations

Thus

we

consider

a

series

of

Well

Behavedness

properties

on

development

These

results

are

listed

in

the

appendix

but

not

proved

The

interested

reader

is

referred

to

-LSB-

-RSB-

for

a

complete

discussion

of

these

properties

and

proofs

of

results

If

a

particular

FDT

can

be

shown

to

satisfy

any

of

these

properties

then

property

and

hence

property

will

follow

which

in

turn

imply

that

a

binary

consistency

checking

strategy

using

least

developed

unification

sets

can

be

safely

used

Unique

Least

Developed

Unification

Clearly

we

would

like

to

unify

to

a

single

description

So

far

we

have

only

considered

situations

in

which

we

have

to

test

every

element

of

a

set

of

unifications

in

order

to

obtain

global

consistency

Although

the

set

of

least

developed

unifications

is

likely

to

be

significantly

smaller

than

the

full

unification

set

it

could

still

be

very

large

This

subsection

considers

under

what

circumstances

we

can

safely

select

any

member

from

the

set

of

least

developed

unifications

and

know

that

further

consistency

checking

and

unification

with

the

chosen

unification

will

yield

global

consistency

In

order

to

do

this

we

need

to

impose

stronger

constraints

on

the

unification

set

In

particular

we

must

ensure

that

unification

sets

possess

a

greatest

element

Definition

An

element

X

S

is

a

greatest

element

of

a

partially

ordered

set

-LRB-

S

dv

-RRB-

iff

S

dv

X

We

denote

such

a

greatest

element

as

g

-LRB-

S

dv

-RRB-

If

a

greatest

element

does

not

exist

g

-LRB-

S

dv

-RRB-

It

is

worth

pointing

out

again

that

we

are

considering

uniqueness

up

to

equivalence

Thus

in

effect

the

description

that

is

generated

by

g

-LRB-

S

dv

-RRB-

will

be

randomly

chosen

from

within

an

equivalence

class

Greatest

elements

are

stronger

than

maximal

elements

since

for

greatest

elements

all

other

members

of

the

set

must

be

developments

of

the

greatest

element

This

is

not

required

with

maximal

elements

for

which

their

may

exist

elements

that

are

not

ancestors

or

descendents

of

a

maximal

element

We

introduce

the

following

obvious

notation

Notation

If

it

exists

we

call

g

-LRB-

n

U

-LRB-

dvi

Xi

-RRB-

n

dvi

-RRB-

the

greatest

unification

We

have

a

number

of

immediate

results

proofs

of

these

results

can

be

found

in

-LSB-

-RSB-

Proposition

-LRB-

i

-RRB-

A

greatest

element

is

a

maximal

element

-LRB-

ii

-RRB-

If

it

exists

g

-LRB-

n

U

-LRB-

dvi

Xi

-RRB-

n

dvi

-RRB-

n

LU

-LRB-

dvi

Xi

-RRB-

i.e.

the

greatest

element

is

a

least

developed

unification

-LRB-

iii

-RRB-

A

greatest

element

is

unique

up

to

equivalence

-LRB-

iv

-RRB-

Assuming

property

n

LU

-LRB-

dvi

Xi

-RRB-

X

n

dvi

-LRB-

-RRB-

g

-LRB-

n

U

-LRB-

dvi

Xi

-RRB-

n

dvi

-RRB-

The

last

of

these

results

is

important

as

it

shows

that

the

existence

of

a

greatest

unification

is

the

only

circumstance

that

will

yield

a

unique

least

developed

unification

i.e.

the

least

developed

unification

is

unique

up

to

equivalence

if

and

only

if

the

unification

set

has

a

greatest

element

As

expected

the

property

that

we

will

impose

on

the

unification

set

in

order

to

allow

us

to

choose

any

member

of

the

set

of

least

developed

unifications

is

that

it

has

a

greatest

element

i.e.

Property

If

n

U

-LRB-

dvi

Xi

-RRB-

then

g

-LRB-

n

U

-LRB-

dvi

Xi

-RRB-

n

dvi

-RRB-

We

assume

the

following

greatest

unification

function

L

Definition

If

g

-LRB-

n

U

-LRB-

dvi

Xi

-RRB-

n

dvi

-RRB-

then

n

L

-LRB-

dvi

Xi

-RRB-

otherwise

n

L

-LRB-

dvi

Xi

-RRB-

fg

-LRB-

n

U

-LRB-

dvi

Xi

-RRB-

n

dvi

-RRB-

g.

So

the

function

L

returns

the

empty

set

if

a

greatest

unification

does

not

exist

and

a

singleton

set

containing

the

greatest

unification

otherwise

Now

we

need

to

validate

that

L

up

holds

-LRB-

U.i

-RRB-

and

-LRB-

U.ii

-RRB-

These

arise

as

immediate

consequences

of

the

next

results

-LRB-

proofs

can

be

found

in

-LSB-

-RSB-

Proposition

Given

property

-LRB-

i

-RRB-

nL

-LRB-

dvi

Xi

-RRB-

n

U

-LRB-

dvi

Xi

-RRB-

-LRB-

ii

-RRB-

n

U

-LRB-

dvi

Xi

-RRB-

=-RRB-

n

L

-LRB-

dvi

Xi

-RRB-

We

can

also

consider

the

equivalent

of

property

for

L.

Property

X

n

U

-LRB-

dvi

Xi

-RRB-

=-RRB-

X

n

dvi

Y

where

Y

n

L

-LRB-

dvi

Xi

-RRB-

We

can

see

that

this

property

follows

directly

from

the

existence

of

a

greatest

element

Proposition

Property

=-RRB-

property

Proof

n

U

-LRB-

dvi

Xi

-RRB-

=-RRB-

n

L

-LRB-

dvi

Xi

-RRB-

the

result

follows

immediately

from

the

definition

of

L.

We

will

also

use

the

following

simple

result

Proposition

Given

property

Y

L

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

Y

L

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

=-RRB-

Y

dv

Y

Proof

Clearly

Y

U

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

but

we

can

use

corollary

to

get

Y

U

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

and

by

the

definition

of

L

we

have

Y

dv

Y

as

required

We

are

now

in

a

position

to

relate

binary

consistency

strategies

to

global

consistency

when

greatest

unifications

exist

We

seek

an

associativity

result

and

in

order

to

express

this

clearly

we

consider

a

function

which

is

derived

from

L

The

function

returns

a

pair

with

first

element

the

intersection

of

the

development

relations

considered

and

second

element

the

greatest

unification

Notice

a

bottom

element

is

returned

as

greatest

unification

if

either

a

greatest

unification

does

not

exist

or

one

of

the

descriptions

given

as

an

argument

is

undefined

Definition

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

-LRB-

dv

Y

-RRB-

where

if

X

L

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

then

Y

otherwise

Y

L

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

We

will

prove

associativity

of

by

relating

the

two

possible

binary

bracketings

of

to

L

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

Proposition

Given

property

r

-LRB-

-LRB-

dv

X

-RRB-

-LRB-

-LRB-

-RRB-

-LRB-

-RRB-

-RRB-

-RRB-

dv

Y

where

Y

L

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

and

r

is

the

right

projection

function

which

yields

the

second

element

of

a

pair

Proof

Take

Y

r

-LRB-

-LRB-

dv

X

-RRB-

-LRB-

-LRB-

-RRB-

-LRB-

-RRB-

-RRB-

-RRB-

and

Y

L

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

By

transitivity

of

development

Y

U

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

so

by

the

definition

of

L

we

get

Y

dv

Y

Also

let

Y

r

-LRB-

-LRB-

-RRB-

-LRB-

-RRB-

-RRB-

By

proposition

Y

Y

Also

Y

U

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

so

Y

dv

X

and

therefore

Y

U

-LRB-

dv

X

-RRB-

-LRB-

Y

-RRB-

But

Y

L

-LRB-

dv

X

-RRB-

-LRB-

Y

-RRB-

so

it

is

the

greatest

element

in

U

-LRB-

dv

X

-RRB-

-LRB-

Y

-RRB-

and

thus

Y

dv

Y

This

gives

us

Y

dv

Y

and

Y

dv

Y

and

thus

Y

dv

Y

as

required

Proposition

Given

property

r

-LRB-

-LRB-

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

-RRB-

-LRB-

-RRB-

-RRB-

dv

Y

where

Y

L

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

Proof

Similar

to

proof

of

proposition

Now

if

we

define

equality

pairwise

as

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

iff

dv

X

dv

the

following

result

is

straightforward

Corollary

Given

property

-LRB-

dv

X

-RRB-

-LRB-

-LRB-

-RRB-

-LRB-

-RRB-

-RRB-

-LRB-

-LRB-

dv

X

-RRB-

-LRB-

-RRB-

-RRB-

-LRB-

-RRB-

Proof

Follows

immediately

from

previous

two

results

propositions

and

This

is

a

full

associativity

result

which

gives

us

that

any

bracketing

of

-LRB-

-RRB-

-LRB-

dvn

Xn

-RRB-

is

equal

Since

is

just

an

alternative

coding

of

L

that

facilitates

clarity

of

expression

we

have

full

associativity

of

L

and

that

a

consistency

strategy

using

L

can

be

composed

of

any

ordering

of

binary

consistency

checks

in

particular

L

C.

So

if

greatest

unifications

exist

we

can

obtain

global

consistency

from

any

appropriate

series

of

binary

consistency

checks

This

is

an

important

result

that

arises

from

a

very

well

behaved

class

of

unification

We

know

that

the

existence

of

a

greatest

unification

will

allow

us

to

safely

choose

just

one

description

from

the

least

developed

unification

set

What

conditions

can

we

impose

on

development

in

order

to

obtain

the

existence

of

such

a

greatest

element

In

a

similar

way

to

in

section

we

generalise

the

condition

we

require

to

all

possible

unifications

that

can

be

performed

in

an

FDT

Property

An

FDT

ft

satisfies

property

iff

Xn

DESft

dvn

DEVft

-LRB-

n

U

-LRB-

dvi

Xi

-RRB-

=-RRB-

g

-LRB-

n

U

-LRB-

dvi

Xi

-RRB-

n

dvi

-RRB-

-RRB-

This

property

ensures

that

any

possible

combination

of

descriptions

and

development

relations

in

ft

will

generate

a

unification

set

with

a

greatest

element

Satisfaction

of

this

property

will

guarantee

that

we

can

always

safely

select

just

one

element

from

the

least

developed

unification

set

The

interested

reader

is

referred

to

the

appendix

for

a

list

of

well

behavedness

properties

on

development

which

imply

this

property

Strategies

for

Checking

Balanced

Consistency

The

majority

of

work

to

be

found

in

the

literature

on

consistency

has

addressed

more

restricted

classes

of

consistency

than

we

have

considered

In

particular

to

date

balanced

consistency

has

almost

exclusively

been

focused

on

So

what

happens

to

the

theory

considered

so

far

in

this

paper

in

these

circumstances

This

section

then

restricts

itself

to

balanced

intra

language

consistency

and

dv

a

preorder

We

have

a

number

of

preparatory

definitions

The

following

is

the

standard

set

theoretic

notion

of

a

lower

bound

of

a

set

Definition

X

DESft

is

a

lower

bound

of

Z

DESft

iff

Z

X

dv

The

set

of

all

lower

bounds

of

Z

is

denoted

lb

-LRB-

Z

dv

-RRB-

If

a

lower

bound

does

not

exist

lb

-LRB-

Z

dv

-RRB-

A

lower

bound

of

Z

is

a

development

of

all

elements

of

Z.

Notice

a

lower

bound

does

not

have

to

be

a

member

of

Z

in

contrast

to

a

maximal

or

greatest

element

It

should

be

clear

that

for

balanced

consistency

lower

bounds

correspond

to

unifications

i.e.

Udv

-LRB-

Xn

-RRB-

lb

-LRB-

Xng

dv

-RRB-

In

particular

the

fact

that

the

ordering

of

descriptions

in

balanced

unification

is

unimportant

is

reflected

by

the

descriptions

being

interpreted

as

a

set

in

lb

In

standard

fashion

we

can

also

define

the

concept

of

a

greatest

lower

bound

Definition

For

Z

DESft

glb

-LRB-

Z

dv

-RRB-

is

a

lower

bound

such

that

all

other

lower

bounds

are

a

development

of

glb

-LRB-

Z

dv

-RRB-

i.e.

glb

-LRB-

Z

dv

-RRB-

lb

-LRB-

Z

dv

-RRB-

-LRB-

lb

-LRB-

Z

dv

-RRB-

X

dv

glb

-LRB-

Z

dv

-RRB-

-RRB-

If

a

greatest

lower

bound

does

not

exist

glb

-LRB-

Z

dv

-RRB-

It

should

again

be

clear

that

a

greatest

lower

bound

of

a

set

of

descriptions

is

a

greatest

unification

of

the

descriptions

In

particular

note

that

the

ordering

of

the

unification

set

by

n

dvi

in

the

general

-LRB-

unbalanced

-RRB-

case

has

been

collapsed

to

just

dv

We

can

now

define

consistency

in

this

restricted

setting

Definition

Cdv

-LRB-

Xn

-RRB-

-LRB-

-RRB-

lb

-LRB-

Xng

dv

-RRB-

s

t

-LRB-

X

-RRB-

With

this

theory

we

can

also

simply

characterise

when

all

descriptions

in

an

FDT

are

balanced

consistent

by

dv

i.e.

the

FDT

is

completely

consistent

by

dv

Proposition

DESft

dv

DEVft

lb

-LRB-

Z

dv

-RRB-

-LRB-

X

-RRB-

-LRB-

-RRB-

Xn

DESft

Cdv

-LRB-

Xn

-RRB-

holds

Proof

Straightforward

i.e.

if

all

subsets

of

DESft

have

a

lower

bound

then

all

specifications

are

consistent

by

dv

An

alternative

check

for

complete

consistency

is

that

an

internally

valid

terminal

element

exists

for

dv

A

development

relation

dv

has

a

terminal

or

bottom

element

denoted

dv

if

and

only

if

DESft

dv

dv

X.

Proposition

DESft

has

an

internally

valid

bottom

element

=-RRB-

Xn

DESft

Cdv

-LRB-

Xn

-RRB-

holds

Proof

Immediate

Example

As

a

simple

illustration

for

LOTOS

C

tr

and

Cext

are

completely

consistent

since

all

groups

of

specifications

have

common

refinements

For

example

the

process

stop

which

offers

only

the

empty

trace

is

a

bottom

element

for

tr

and

the

process

that

offers

a

choice

of

all

possible

actions

at

all

points

in

the

computation

is

a

bottom

element

for

ext.

What

in

this

restricted

setting

enables

us

to

obtain

global

consistency

from

binary

consistency

We

would

like

to

locate

an

equivalent

of

the

existence

of

greatest

unifications

As

indicated

earlier

the

greatest

lower

bound

gives

us

this

equivalent

Proposition

glb

-LRB-

Xng

dv

-RRB-

=-RRB-

glb

-LRB-

Xng

dv

-RRB-

Ldv

-LRB-

Xn

-RRB-

Proof

By

definition

So

the

property

that

we

require

for

balanced

consistency

checking

to

be

performed

incrementally

is

Property

Xng

DESft

DEVft

lb

-LRB-

Xng

dv

-RRB-

=-RRB-

glb

-LRB-

Xng

dv

-RRB-

This

property

ensures

that

if

a

lower

bound

exists

then

a

greatest

lower

bound

can

be

found

i.e.

the

unification

of

Xn

is

non-empty

implies

a

greatest

unification

exists

It

is

clear

from

the

theory

of

greatest

unifications

we

have

presented

and

from

set

theory

that

taking

greatest

lower

bounds

is

associative

i.e.

glb

-LRB-

fglb

-LRB-

dv

-RRB-

dv

-RRB-

glb

-LRB-

glb

-LRB-

dv

-RRB-

g

dv

-RRB-

With

these

concepts

we

can

identify

what

is

the

most

well

behaved

class

of

development

Definition

-LRB-

DESft

dv

-RRB-

is

cocomplete

iff

DESft

glb

-LRB-

S

dv

-RRB-

Cocompleteness

is

related

to

the

standard

concept

of

a

complete

partial

order

see

for

example

-LSB-

-RSB-

which

considers

the

existence

of

least

upper

bounds

as

opposed

to

greatest

lower

bounds

in

our

framework

If

development

is

cocomplete

for

a

particular

FDT

according

to

a

development

relation

then

all

specifications

are

balanced

consistent

and

we

can

adopt

any

relevant

incremental

consistency

checking

strategy

All

descriptions

are

consistent

since

a

lower

bound

exists

for

all

collections

of

descriptions

and

incremental

consistency

checking

strategies

are

well

behaved

since

a

single

greatest

unification

always

exists

Concluding

Remarks

This

paper

has

presented

a

general

interpretation

of

consistency

for

multiple

viewpoint

models

of

system

development

and

investigated

possible

consistency

checking

strategies

Our

interpretation

of

consistency

is

extremely

broad

embracing

intra

and

inter

language

consistency

balanced

and

unbalanced

consistency

and

both

binary

and

global

consistency

This

generality

arises

as

a

direct

consequence

of

the

requirements

of

viewpoints

modelling

in

Open

Distributed

Processing

The

main

original

contribution

of

this

paper

is

the

investigation

of

possible

strategies

for

consistency

checking

These

address

the

issue

of

obtaining

global

consistency

incrementally

through

a

series

of

possibly

binary

consistency

checks

thus

enabling

global

consistency

to

be

deduced

from

a

number

of

smaller

consistency

checks

This

topic

has

been

investigated

in

the

past

but

only

in

the

context

of

a

restricted

class

of

consistency

In

particular

this

is

the

first

paper

to

investigate

consistency

checking

strategies

for

as

general

an

interpretation

of

consistency

as

ours

The

main

difference

between

our

theory

and

earlier

work

is

that

we

handle

unbalanced

consistency

As

a

reflection

of

our

general

handling

of

consistency

a

spectrum

of

classes

of

consistency

checking

have

been

identifed

These

range

from

the

very

poorly

behaved

to

the

very

well

behaved

These

classes

are

summarised

in

the

following

table

Class

of

Consistency

Implications

Unbalanced

Inter

lang

No

results

Unbalanced

Intra

lang

Not

WF

unif

set

No

incremental

cons

checking

Unbalanced

Intra

lang

WF

unif

set

Set

of

least

developed

unifications

Unbalanced

Intra

lang

Greatest

unifs

Unique

incremental

cons

checking

Balanced

Intra

lang

Not

WF

unif

set

No

incremental

cons

checking

Balanced

Intra

lang

WF

without

glb

's

Set

of

least

developed

unifications

Balanced

Intra

lang

glbs

always

exist

Unique

incremental

cons

checking

Balanced

Intra

lang

Cocomplete

Completely

consistent

and

unique

incremental

cons

checking

In

general

the

consistency

problem

is

more

straightforward

and

well

behaved

the

further

down

the

table

you

go

References

-LSB-

-RSB-

M.

Ainsworth

A.

H.

Cruickshank

L.

J.

Groves

and

P.

J.

L.

Wallis

Viewpoint

specification

and

Z.

Information

and

Software

Technology

-LRB-

-RRB-

-LCB-

February

-LSB-

-RSB-

E.

Boiten

H.

Bowman

J.

Derrick

and

M.

Steen

Cross

viewpoint

consistency

in

Open

Distributed

Processing

-LRB-

intra

language

consistency

-RRB-

Technical

Report

Computing

Laboratory

University

of

Kent

at

Canterbury

-LSB-

-RSB-

T.

Bolognesi

and

E.

Brinksma

Introduction

to

the

ISO

Specification

Language

LOTOS

Computer

Networks

and

ISDN

Systems

-LRB-

-RRB-

-LCB-

-LSB-

-RSB-

H.

Bowman

E.A.

Boiten

J.

Derrick

and

M.W.A.

Steen

Strategies

for

consistency

checking

Technical

Report

Computing

Laboratory

University

of

Kent

at

Canterbury

-LSB-

-RSB-

H.

Bowman

J.

Derrick

and

M.

Steen

Some

results

on

cross

viewpoint

consistency

checking

In

K.

Raymond

and

L.

Armstrong

editors

IFIP

International

Conference

on

Open

Distributed

Processing

pages

-LCB-

Brisbane

Australia

February

Chapman

and

Hall

-LSB-

-RSB-

E.

Brinksma

and

G.

Scollo

Formal

notions

of

implementation

and

conformance

in

LOTOS

Technical

Report

Dept

of

Informatics

Twente

University

of

Technology

-LSB-

-RSB-

G.

Cowen

J.

Derrick

M.

Gill

G.

Girling

-LRB-

editor

-RRB-

A.

Herbert

P.

F.

Linington

D.

Rayner

F.

Schulz

and

R.

Soley

Prost

Report

of

the

Study

on

Testing

for

Open

Distributed

Processing

APM

Ltd

-LSB-

-RSB-

J.

Derrick

H.

Bowman

and

M.

Steen

Maintaining

cross

viewpoint

consistency

using

Z

In

K.

Raymond

and

L.

Armstrong

editors

IFIP

International

Conference

on

Open

Distributed

Processing

pages

-LCB-

Brisbane

Australia

February

Chapman

and

Hall

-LSB-

-RSB-

J.

Derrick

H.

Bowman

and

M.

Steen

Viewpoints

and

Objects

In

Ninth

Annual

Z

User

Workshop

Limerick

September

Springer-Verlag

To

appear

-LSB-

-RSB-

S.

Easterbrook

A.

Finkelstein

J.

Kramer

and

B.

Nuseibeh

Coordinating

distributed

ViewPoints

The

anatomy

of

a

consistency

check

Concurrent

Engineering

Research

and

Applications

-LRB-

-RRB-

-LSB-

-RSB-

J.

Fiadeiro

and

T.

Maibaum

Temporal

theories

as

modularisation

units

for

concurrent

system

specification

Formal

Aspects

of

Computing

-LCB-

-LSB-

-RSB-

G.

Leduc

A

framework

based

on

implementation

relations

for

implementingLOTOS

specifications

Computer

Networks

and

ISDN

Systems

-LCB-

-LSB-

-RSB-

J.

Loeckx

and

K.

Sieber

The

Foundations

of

Program

Verification

Wiley

-LSB-

-RSB-

B.

Potter

J.

Sinclair

and

D.

Till

An

introduction

to

formal

specification

and

Z.

Prentice

Hall

-LSB-

-RSB-

I.

Sommerville

Software

Engineering

Addison-Wesley

-LSB-

-RSB-

M.

Steen

H.

Bowman

and

J.

Derrick

Composition

of

LOTOS

specifications

In

P.

Dembinski

and

M.

Sredniawa

editors

Protocol

Specification

Testing

and

Verification

Warsaw

Poland

Chapman

Hall

-LSB-

-RSB-

P.

Zave

and

M.

Jackson

Conjunction

as

composition

ACM

Transactions

on

Software

Engineering

and

Methodology

-LRB-

-RRB-

-LCB-

October

Appendix

The

appendices

of

this

paper

collect

together

a

number

of

results

that

we

have

not

had

the

room

to

consider

in

the

main

text

Results

for

Section

Proposition

Given

property

U

-LRB-

-RRB-

-LRB-

dvm

Xm

-RRB-

=-RRB-

LU

-LRB-

-RRB-

-LRB-

dvm

Xm

-RRB-

where

LU

-LRB-

-RRB-

-LRB-

dvm

Xm

-RRB-

-LRB-

-LRB-

LU

-LRB-

-RRB-

-LRB-

-RRB-

X

U

-LRB-

-RRB-

-LRB-

-RRB-

-RRB-

-LRB-

LU

-LRB-

-RRB-

-LRB-

-RRB-

X

U

-LRB-

-RRB-

-LRB-

-RRB-

-RRB-

-LRB-

LU

-LRB-

-RRB-

-LRB-

-RRB-

X

U

-LRB-

-RRB-

-LRB-

-RRB-

-RRB-

-LRB-

LU

-LRB-

dvm

Ym

-RRB-

-LRB-

dvm

Xm

-RRB-

X

U

-LRB-

dvm

Ym

-RRB-

-LRB-

dvm

Xm

-RRB-

-RRB-

-LRB-

LU

-LRB-

dvm

Ym

-RRB-

-LRB-

dvm

Xm

-RRB-

X

U

-LRB-

dvm

Ym

-RRB-

-LRB-

dvm

Xm

-RRB-

-RRB-

-RRB-

Notice

that

we

are

not

considering

directly

rather

we

consider

the

unification

strategy

which

adds

a

second

condition

on

every

step

of

the

algorithm

This

condition

states

that

X

the

original

unification

is

in

the

unification

set

relevant

to

that

step

Carrying

this

condition

will

simplify

the

induction

proof

that

we

perform

and

clearly

gives

us

a

stronger

result

than

we

actually

need

We

will

relate

to

as

a

corollary

to

this

theorem

Proof

We

prove

this

result

using

induction

on

the

number

of

descriptions

-LRB-

and

hence

development

relations

-RRB-

that

are

considered

i.e.

induction

on

m

above

We

will

prove

two

base

cases

in

order

to

indicate

the

pattern

of

the

proof

This

pattern

is

reflected

in

the

proof

of

the

inductive

step

Base

Case

m

Notice

m

does

not

exist

-LRB-

although

a

trivial

formulation

could

be

given

-RRB-

We

wish

to

prove

-LRB-

As

-RRB-

U

-LRB-

-RRB-

-LRB-

-RRB-

=-RRB-

-LRB-

-LRB-

a

-RRB-

LU

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

b

-RRB-

X

U

-LRB-

-RRB-

-LRB-

-RRB-

-RRB-

This

is

straightforward

Firstly

-LRB-

b

-RRB-

follows

immediately

from

our

assumption

-LRB-

As

-RRB-

then

-LRB-

a

-RRB-

is

a

direct

consequence

of

-LRB-

b

-RRB-

from

-LRB-

U.ii

-RRB-

Base

Case

m

We

wish

to

prove

-LRB-

As

-RRB-

U

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

=-RRB-

-LRB-

-LRB-

a

-RRB-

LU

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

b

-RRB-

X

U

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

c

-RRB-

LU

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

d

-RRB-

X

U

-LRB-

-RRB-

-LRB-

-RRB-

-RRB-

Firstly

by

observing

that

from

corollary

X

U

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

implies

that

X

U

-LRB-

-RRB-

-LRB-

-RRB-

we

can

reproduce

the

argument

of

base

case

to

obtain

-LRB-

a

-RRB-

and

-LRB-

b

-RRB-

Now

from

-LRB-

a

-RRB-

and

-LRB-

b

-RRB-

we

can

use

property

to

get

LU

-LRB-

-RRB-

-LRB-

-RRB-

such

that

X

-LRB-

-RRB-

Y

and

since

X

from

our

assumption

-LRB-

As

-RRB-

we

have

X

U

-LRB-

Y

-RRB-

-LRB-

-RRB-

which

gives

us

-LRB-

d

-RRB-

and

then

we

can

use

-LRB-

U.ii

-RRB-

to

get

LU

-LRB-

Y

-RRB-

-LRB-

-RRB-

i.e.

-LRB-

c

-RRB-

This

completes

the

verification

of

base

case

Inductive

Step

We

wish

to

prove

that

proposition

-LRB-

-RRB-

=-RRB-

proposition

-LRB-

-RRB-

where

Proposition

-LRB-

-RRB-

states

-LRB-

As.i

-RRB-

U

-LRB-

-RRB-

-LRB-

dvn

Xn

-RRB-

=-RRB-

-LRB-

-LRB-

-RRB-

LU

-LRB-

-RRB-

-LRB-

-RRB-

X

U

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

LU

-LRB-

-RRB-

-LRB-

-RRB-

X

U

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

LU

-LRB-

dvn

Yn

-RRB-

-LRB-

dvn

Xn

-RRB-

X

U

-LRB-

dvn

Yn

-RRB-

-LRB-

dvn

Xn

-RRB-

-LRB-

-RRB-

LU

-LRB-

dvn

Yn

-RRB-

-LRB-

dvn

Xn

-RRB-

X

U

-LRB-

dvn

Yn

-RRB-

-LRB-

dvn

Xn

-RRB-

-RRB-

Proposition

-LRB-

-RRB-

states

-LRB-

As.ii

-RRB-

U

-LRB-

-RRB-

-LRB-

dvn

Xn

-RRB-

=-RRB-

-LRB-

-LRB-

-RRB-

LU

-LRB-

-RRB-

-LRB-

-RRB-

X

U

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

LU

-LRB-

-RRB-

-LRB-

-RRB-

X

U

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

LU

-LRB-

dvn

Yn

-RRB-

-LRB-

dvn

Xn

-RRB-

X

U

-LRB-

dvn

Yn

-RRB-

-LRB-

dvn

Xn

-RRB-

-LRB-

-RRB-

LU

-LRB-

dvn

Yn

-RRB-

-LRB-

dvn

Xn

-RRB-

X

U

-LRB-

dvn

Yn

-RRB-

-LRB-

dvn

Xn

-RRB-

-LRB-

n

-RRB-

LU

-LRB-

dvn

Yn

-RRB-

-LRB-

dvn

Xn

-RRB-

X

U

-LRB-

dvn

Yn

-RRB-

-LRB-

dvn

Xn

-RRB-

-RRB-

So

assume

proposition

-LRB-

-RRB-

It

is

clear

that

the

first

steps

of

proposition

-LRB-

-RRB-

i.e.

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

can

be

obtained

directly

from

proposition

-LRB-

-RRB-

So

we

need

that

proposition

-LRB-

-RRB-

and

assumption

-LRB-

As.ii

-RRB-

imply

-LRB-

n

-RRB-

We

know

LU

-LRB-

dvn

Yn

-RRB-

-LRB-

dvn

Xn

-RRB-

and

X

U

-LRB-

dvn

Yn

-RRB-

-LRB-

dvn

Xn

-RRB-

from

-LRB-

-RRB-

so

we

can

use

property

to

get

that

n

LU

-LRB-

dvn

Yn

-RRB-

-LRB-

dvn

Xn

-RRB-

such

that

X

-LRB-

dvn

-RRB-

dvn

Y

n

which

implies

that

X

U

-LRB-

dvn

Y

n

-RRB-

-LRB-

dvn

Xn

-RRB-

since

X

dvn

Xn

from

-LRB-

As.ii

-RRB-

This

gives

us

the

second

half

of

-LRB-

n

-RRB-

and

the

first

half

follows

directly

from

-LRB-

U.ii

-RRB-

By

the

principle

of

mathematical

induction

the

result

follows

WellBehavedness

Properties

arising

from

Section

The

following

four

well

behavedness

properties

-LRB-

and

-RRB-

all

imply

property

-LRB-

see

-LSB-

-RSB-

for

proofs

-RRB-

Thus

if

any

of

them

can

be

shown

to

hold

for

a

particular

unification

problem

then

theorem

will

hold

and

we

will

be

able

to

obtain

global

consistency

from

binary

consistency

in

the

manner

highlighted

The

first

such

well

behavedness

property

states

that

-LRB-

i

-RRB-

development

sets

are

well

founded

and

-LRB-

ii

-RRB-

if

two

development

sets

are

well

founded

then

the

intersection

of

the

development

sets

is

also

well

founded

Definition

-LRB-

Well

Behaved

Condition

-LRB-

-RRB-

-RRB-

For

an

FDT

ft

we

say

that

development

is

well

behaved

-LRB-

condition

-RRB-

iff

DESft

DEVft

-LRB-

i

-RRB-

-LRB-

D

-LRB-

X

dv

-RRB-

dv

-RRB-

is

WF

-LRB-

ii

-RRB-

-LRB-

D

-LRB-

X

dv

-RRB-

dv

-RRB-

-LRB-

D

-LRB-

-RRB-

-RRB-

are

WF

=-RRB-

-LRB-

D

-LRB-

X

dv

-RRB-

D

-LRB-

-RRB-

dv

-RRB-

is

WF

A

stronger

formulation

of

the

second

of

these

conditions

-LRB-

-RRB-

that

may

be

easier

to

prove

is

DESft

-LRB-

Z

dv

-RRB-

-LRB-

-RRB-

are

WF

=-RRB-

-LRB-

Z

dv

-RRB-

is

WF

This

condition

is

stronger

since

it

is

defined

over

all

subsets

of

DESft

not

just

the

subsets

that

are

development

sets

by

dv

and

It

should

also

be

clear

that

from

associativity

of

and

-LRB-

-RRB-

implies

-LRB-

D

-LRB-

-RRB-

-RRB-

-LRB-

D

-LRB-

Xn

dvn

-RRB-

dvn

-RRB-

are

WF

=-RRB-

-LRB-

n

D

-LRB-

Xi

dvi

-RRB-

n

dvi

-RRB-

is

WF

An

alternative

is

the

following

condition

Definition

-LRB-

Well

Behaved

Condition

-LRB-

-RRB-

-RRB-

Development

is

well

behaved

-LRB-

condition

-RRB-

in

FDT

ft

iff

dvn

DEVft

-LRB-

DESft

n

dvi

-RRB-

is

well

founded

This

states

that

all

non-empty

subsets

of

DESft

have

a

maximal

element

by

n

dvi

This

is

clearly

a

strong

condition

as

it

acts

over

all

subsets

of

DESft

not

just

those

arising

from

development

Both

and

in

some

way

impose

well

behavedness

constraints

on

n

dvi

i.e.

they

require

that

the

intersection

of

the

development

relations

being

used

are

well

behaved

in

some

sense

This

focus

on

the

intersection

of

development

relations

is

not

ideal

It

would

be

better

if

we

could

check

a

well

behavedness

property

on

each

of

the

development

relations

individually

and

not

have

to

consider

the

interplay

of

these

relations

when

their

intersection

is

taken

In

this

way

we

would

be

able

to

check

all

the

development

relations

individually

for

a

particular

FDT

and

know

that

we

can

intersect

them

as

we

like

An

obvious

constraint

to

consider

is

well

foundedness

of

constituent

development

relations

i.e.

can

we

deduce

that

n

dvi

is

well

founded

if

dvi

is

well

founded

for

all

i

n.

Unfortunately

this

does

not

turn

out

to

be

straightforward

see

-LSB-

-RSB-

The

closest

general

result

we

can

get

is

the

following

Definition

-LRB-

Well

Behaved

Condition

-LRB-

-RRB-

-RRB-

Development

is

well

behaved

-LRB-

condition

-RRB-

in

FDT

ft

iff

-LRB-

i

-RRB-

DEVft

dv

is

well

founded

-LRB-

ii

-RRB-

DEVft

dv

So

we

have

failed

to

push

well

behavedness

totally

out

to

checks

on

individual

development

relations

i.e.

we

still

need

to

relate

equivalence

in

the

distinct

development

relations

However

the

following

very

strong

constraint

will

succeed

in

this

respect

If

development

yields

a

finite

development

set

then

property

follows

In

some

circumstances

this

very

strong

condition

will

be

sufficient

to

obtain

the

result

we

require

Definition

-LRB-

Well

Behaved

Condition

-LRB-

-RRB-

-RRB-

For

an

FDT

ft

we

say

development

is

well

behaved

-LRB-

condition

-RRB-

iff

DESft

DEVft

D

-LRB-

X

dv

-RRB-

is

finite

Well

Behavedness

Conditions

arising

from

Section

The

following

two

well

behavedness

conditions

imply

property

They

play

a

similar

role

to

the

conditions

and

considered

in

the

previous

subsection

of

this

appendix

The

first

condition

that

will

ensure

property

corresponds

to

of

section

Definition

-LRB-

Well

Behaved

Condition

a

-LRB-

WBCa

-RRB-

-RRB-

For

an

FDT

ft

development

is

well

behaved

-LRB-

condition

a

-RRB-

iff

DESft

DEVft

-LRB-

i

-RRB-

g

-LRB-

D

-LRB-

X

dv

-RRB-

dv

-RRB-

-LRB-

ii

-RRB-

g

-LRB-

D

-LRB-

X

dv

-RRB-

dv

-RRB-

g

-LRB-

D

-LRB-

-RRB-

-RRB-

D

-LRB-

X

dv

-RRB-

D

-LRB-

-RRB-

=-RRB-

g

-LRB-

D

-LRB-

X

dv

-RRB-

D

-LRB-

-RRB-

dv

-RRB-

The

following

is

an

alternative

condition

that

corresponds

to

of

section

Definition

-LRB-

Well

Behaved

Condition

b

-LRB-

WBCb

-RRB-

-RRB-

For

an

FDT

ft

development

is

well

behaved

-LRB-

condition

b

-RRB-

iff

dvn

DEVft

DESft

-LRB-

S

=-RRB-

g

-LRB-

S

n

dvi

-RRB-

-RRB-

In

a

similar

way

to

in

the

previous

section

we

would

also

like

to

derive

a

property

that

we

can

check

solely

on

individual

development

relations

without

having

to

consider

the

interplay

of

these

relations

on

intersection

The

following

proposition

demonstrates

that

this

can

not

be

easily

obtained

Proposition

DESft

s

t

S

-LRB-

i

-RRB-

g

-LRB-

S

dv

-RRB-

and

g

-LRB-

S

-RRB-

-RRB-

-LRB-

ii

-RRB-

g

-LRB-

S

dv

-RRB-

Proof

By

counterexample

So

assume

-LRB-

i

-RRB-

i.e.

DESft

s

t

S

g

-LRB-

S

dv

-RRB-

and

g

-LRB-

S

-RRB-

Consider

the

set

DESft

with

two

elements

i.e.

and

assume

that

dv

and

the

identities

hold

-LRB-

i

e.

dv

dv

and

-RRB-

and

no

other

relations

hold

between

and

This

gives

us

g

-LRB-

dv

-RRB-

and

g

-LRB-

-RRB-

So

our

assumption

of

-LRB-

i

-RRB-

is

not

invalidated

but

dv

f

-LRB-

-RRB-

-LRB-

-RRB-

g

so

both

and

are

maximal

elements

by

dv

and

neither

are

greatest

elements

Thus

g

-LRB-

dv

-RRB-

and

is

the

required

counterexample

So

in

the

same

way

as

we

struggled

to

push

well

foundedness

solely

into

development

we

are

struggling

to

push

the

existence

of

greatest

elements

solely

into

the

constituent

development

relations

The

following

shows

that

the

strong

condition

that

we

finally

used

to

do

this

in

the

previous

section

does

not

work

here

Proposition

S

is

finite

and

non-empty

-RRB-

g

-LRB-

S

dv

-RRB-

Proof

Consider

the

set

used

as

the

counterexample

in

the

last

propositon

is

finite

but

has

no

greatest

element

So

enforcing

finiteness

of

development

sets

can

not

guarantee

the

existence

of

greatest

elements

in

unification

sets

We

are

left

then

with

a

smaller

set

of

well

behavedness

properties

for

this

section

consistency
formal description techniques
lotos
odp
viewpoints