Reasoning about Higher-Order Processes Roberto M. Amadio Mads Dam CRIN-INRIA , Nancy 1 SICS , Stockholm 2 October 20 , 1994 SICS Research Report RR :94 -LCB- 18 1CRIN-INRIA , BP 239 , F-54506 , Vandoeuvre , FRANCE , e-mail : amadio@loria.fr . The first author is partially supported by ESPRIT BRA 6454 CONFER , part of this work was done while visiting SICS . 2SICS , Box 1263 , S-164 28 , Kista , SWEDEN , e-mail : mfd@sics.se . The second author is partially supported by ESPRIT BRA 8130 LOMAPS . Abstract We address the specification and verification problem for process calculi such as Chocs , CML and Facile where processes or functions are transmissible values . Our work takes place in the context of a static treatment of restriction and of a bisimulation-based semantics . As a paradigmatic and simple case we concentrate on -LRB- Plain -RRB- Chocs . We show that Chocs bisimulation can be characterized by an extension of Hennessy-Milner logic including a constructive implication , or function space constructor . This result is a non-trivial extension of the classical characterization result for labelled transition systems . In the second part of the paper we address the problem of developing a proof system for the verification of process specifications . Building on previous work for CCS we present an infinitary sound and complete proof system for the fragment of the calculus not handling restriction . 1 Introduction In the last years there has been a rising interest in calculi and programming languages where complex data such as processes and functions are transmissible values -LSB- 4 , 6 , 13 , 16 , 20 -RSB- . At least two main motivations for these studies can be identified : -LRB- i -RRB- to generalize the functional model of computation to a parallel and/or concurrent framework , and -LRB- ii -RRB- to model the notion of code transmission which is relevant to the programming of distributed systems . A key issue in these languages is the interaction between process transmission and the static scoping discipline for communication channels . Here we consider Thomsen 's Plain Chocs . This is an extension of CCS where processes are transmissible values and the restriction operator is subject to a static scoping discipline . A considerable effort has been put into the development of a bisimulation based semantics for this calculus -LRB- c.f. -LSB- 20 , 2 , 17 -RSB- -RRB- . The specification of Plain Chocs processes -LRB- and processes in related calculi -RRB- is a much less developed topic . Two notable attempts in this direction are described in -LSB- 19 , 7 -RSB- . These works are based on logics extracted from a domain theoretic interpretation of the calculus , following general ideas described in , e.g. , -LSB- 1 -RSB- . This approach has been rather successful in the case of dynamic scoping . On the other hand it is not clear how to obtain a fully abstract denotational semantics of restriction in the case of static scoping -LRB- c.f. -LSB- 15 -RSB- for some typical problems -RRB- . This motivates our shift towards an operational approach to the problem , along the lines of Hennessy and Milner -LSB- 9 -RSB- . What to specify ? First , let us fix some notation for a process calculus of higherorder processes : c!P :P is the process which sends P along the channel c and then becomes P , c?x :P is the process which performs an input along the channel c , and upon reception of some process Q becomes -LSB- Q = x -RSB- P . In ? c :P the restriction operator ? creates a new channel which will be local to the process P . Finally + is the non-deterministic choice , j is the parallel composition , and is the nil process , with the usual CCS semantics -LSB- 11 -RSB- . We briefly refer to this calculus as Chocs , after -LSB- 19 -RSB- . Second , we should determine some requirements for our candidate specification logic . Roughly , we expect it to be an extension of Hennessy-Milner logic which characterizes some standard Chocs bisimulation . Previous work on extending Hennessy-Milner logic to calculi including value and channel transmission -LRB- c.f. -LSB- 5 , 8 , 12 -RSB- -RRB- relies on the recurrent idea of introducing modalities that state properties of the transmitted values . For instance , one can specify that a process P can output the value 3 on channel c and then satisfy property OE by writing : P : hc ! 3i : OE . This approach does not seem to scale up to process transmission . The naive idea of writing : P : hc!OE0i : OE if P c!P ! Q and P : OE0 and Q : OE does not take into account the fact that P and Q might share local channels . For instance , consider the process P = ? a : c ! -LRB- a?x : x -RRB- : a ! 0 : Q . In this example the actions of the process transmitted on channel c and of the relative continuation are clearly inter-dependent . We did not find any satisfying way to express this dependency . An alternative is to express properties of processes like P above in terms of the effect the output has when P is put in a receiving environment . Since receiving environments are just abstractions this suggests a simple extension of Hennessy-Milner logic by means of a constructive implication , say -RRB- . We can now write specifications such as : P : -LSB- c ? -RSB- -LRB- OE -RRB- -RRB- Q : hc!i -LRB- -LRB- OE -RRB- -RRB- -RRB- -RRB- For inputs the interpretation is the expected one : P satisfies -LSB- c ? -RSB- -LRB- OE -RRB- -RRB- if whenever P makes an input action on channel c and receives an input satisfying OE then the continuation will satisfy . In first approximation , the intuition for output is the following : Q satisfies hc!i -LRB- -LRB- OE -RRB- -RRB- -RRB- -RRB- if it is possible for Q to output a process , say Q1 , along c such that in any receiving context , say > = x : Q2 , if > = x : Q2 satisfies OE -RRB- , and if Q3 is the continuation of Q after performing its output , then -LRB- -LSB- Q1 = x -RSB- Q2 -RRB- j Q3 satisfies . In general Q1 and Q3 may share channels local to Q , say c1 ; : : : ; cn , whose scope is extruded by the output communication . Note that in the specification we never need to speak about these extruded channels . Operational Semantics . Reflecting this intuition , a labelled transition system is given to Plain Chocs that maps -LRB- closed -RRB- processes to -LRB- closed -RRB- process functionals , depending on the action performed . More precisely , a process Q rewrites by an input action to a process function > = x : Q2 and by an output action to a process functional > = f : ? c1 : : : cn : -LRB- fQ1 j Q3 -RRB- , where as in the previous explication Q1 is the transmitted process , Q3 is the continuation , and c1 ; : : : ; cn are shared local channels . The result of a communication is simply computed by applying the process functional to the process function : -LRB- > = f : ? c1 : : : cn : -LRB- fQ1 j Q3 -RRB- -RRB- -LRB- > = x : Q2 -RRB- ? ? c1 : : : cn :-LRB- -LSB- Q1 = x -RSB- Q2 j Q3 -RRB- The standard rules for substitution avoid clashes between local channels . Also note that in this formulation Plain Chocs actions coincide with standard CCS actions . Of course one has to pay a price for this , namely one has to lift the notion of bisimulation higher-order by introducing a suitable notion of exponentiation . Section 2 will show that this can be achieved in an elegant and simple way . It should be remarked that the resulting bisimulation coincides with the one considered in -LSB- 2 , 17 -RSB- , which in turn has been shown to be compatible with the ss-calculus semantics . Logical Characterization . Having found a suitable way to specify properties of Chocs processes we pursue our programme of relating logical equivalence to bisimulation equivalence . In the CCS case , this is achieved by means of a coinductive view of bisimulation . Roughly , the bisimulation relation , say ? , can be seen as the limit of a descending sequence of equivalence relations ? k. Equivalence in ? k is then related to logical equivalence w.r.t. formulas having modal depth bound by k . In the higher-order case the task is complicated by the contravariance of the constructive implication in its first argument . This is discussed in more detail in section 2 once some notation has been introduced . We obtain a logical characterization of Chocs bisimulation modulo a technical lemma that relates the approximation ? k to a sharpened approximation ? k -RSB- . Towards a Proof System . As a second contribution , we address the problem of developing a sound and complete proof system to verify that a process meets -LRB- or realizes -RRB- a specification . We found a simple and clean solution for the restrictionfree fragment of the calculus . The basic judgment ? ` P : states that the process P realizes the specification under the hypothesis ? . Hypotheses state assumptions on the parameters of P . The system thus allows for reasoning about open processes . Completeness is achieved by the introduction of an ! - rule and by the hypothesis that there is only a finite number of channels . It appears that a treatment of restriction would require a considerable complication of the proof system as one has to represent the dependencies among functional variables and dynamically generated channels . We leave this problem for further investigation . Paper Organization . Section 2 presents the Chocs calculus and the relative notion of bisimulation . Section 3 introduces a Hennessy-Milner logic to specify properties of Chocs processes and shows that it captures exactly Chocs bisimulation . Section 4 describes a sound and complete formal system for proving properties of processes . 2 The Calculus and its Bisimulation Based Se - mantics Language . The expressions of the language are classified in two kinds : channels and processes . Channels are variables and ranged over by c ; d ; : : : . Actions have one of the forms o , c ? or c ! and they are ranged over by ff ; ; : : : . To each process is associated a unique order among the orders : -LRB- processes -RRB- , 1 -LRB- process functions -RRB- , and 2 -LRB- process functionals -RRB- . We use x ; x0 ; : : : , f ; f : : : , and F ; F : : : , for variables of order ; 1 ; 2 , respectively . We use z ; z0 : : : as generic variables . Open processes of order are then generated by the following grammar : P : : = X fP -LRB- P + P -RRB- -LRB- P j P -RRB- -LRB- ? c :P -RRB- -LRB- c!P :P -RRB- -LRB- c?x :P -RRB- Whenever we write P -LSB- z -RSB- we intend that z is the only variable that can be free in P and moreover we identify P with the function > = z :P . Thus alpha-conversion applies to identify P -LSB- z -RSB- with -LRB- -LSB- z0 = z -RSB- P -RRB- -LSB- z0 -RSB- whenever z0 does not occur freely in > = z :P , and to identify , e.g. , ? c : -LRB- P -LSB- z -RSB- -RRB- with -LRB- ? c :P -RRB- -LSB- z -RSB- . We also write P -LRB- z -RRB- for an open process in which z is the only variable that can occur free . If z is free then P -LRB- z -RRB- is identified with P -LSB- z -RSB- . If z is not free then P -LRB- z -RRB- can ambiguously represent either a closed process or the constant function > = z :P . The context will allow us to disambiguate this situation . Operational semantics . The labelled transition system is based on three kinds of judgments : P o ! Q , P c ?! Q0 -LSB- x -RSB- , and P c !! Q00 -LSB- f -RSB- , where P ; Q are closed processes . We assume that sum and parallel composition are associative and commutative operators , and that restriction commutes with parallel composition according to the standard law -LRB- ? c :P -RRB- j P = ? c : -LRB- P j P -RRB- whenever c is not free in P . Then it can be showed that whenever P c !! Q00 -LSB- f -RSB- in the transition system specified below then Q00 -LSB- f -RSB- has the form ? c1 : ? ? ? ? cn : -LRB- fP j P 00 -RRB- -LSB- f -RSB- . Finally , note that in the rule -LRB- !? -RRB- a second-order substitution is employed . That is , one replaces first Q0 -LSB- x -RSB- for f , and then the argument of f for x. -LRB- ! -RRB- c!P :P c !! -LRB- fP j P -RRB- -LSB- f -RSB- -LRB- ? -RRB- c?x :P c ?! P -LSB- x -RSB- -LRB- !? -RRB- if P c !! P -LSB- f -RSB- and Q c ?! Q0 -LSB- x -RSB- then P j Q o ! -LSB- Q0 -LSB- x -RSB- = f -RSB- P -LSB- f -RSB- -LRB- + -RRB- if P ! P then P + Q ! P -LRB- j -RRB- if P ! P then P j Q ! P j Q -LRB- ? -RRB- if P ! P and < > c ! ; c ? then ? c :P ! ? c :P Bisimulation . Let P r0 be the collection of closed processes , P r1 be the collection of P -LSB- x -RSB- processes , and P r2 be the collection of P -LSB- f -RSB- processes . Because of the input-output actions a notion of bisimulation over P r0 needs to be lifted to P r1 and P r2 . For this purpose the following general notion of exponentiation is introduced : P -LSB- z -RSB- -LSB- S -RRB- S0 -RSB- P -LSB- z -RSB- if Q -LRB- w -RRB- S Q0 -LRB- w -RRB- implies -LSB- Q -LRB- w -RRB- = z -RSB- P S0 -LSB- Q0 -LRB- w -RRB- = z -RSB- P Given a relation S over P r20 and an action we define the relations S -LSB- -RSB- as follows , where Id0 = f -LRB- P ; P -RRB- j P 2 P r0g , and Id1 = f -LRB- P -LSB- x -RSB- ; P -LSB- x -RSB- -RRB- j P -LSB- x -RSB- 2 P r1g : S -LSB- o -RSB- = S S -LSB- c ? -RSB- = -LSB- Id0 -RRB- S -RSB- S -LSB- c ! -RSB- = -LSB- Id1 -RRB- S -RSB- Definition 2.1 -LRB- Bisimulation -RRB- A bisimulation S is a relation over P r0 such that whenever PSQ and P ! P -LRB- z -RRB- then for some Q0 -LRB- z -RRB- , Q ! Q0 -LRB- z -RRB- and P -LRB- z -RRB- S -LSB- -RSB- Q0 -LRB- z -RRB- ; and symmetrically . We denote with ? the largest bisimulation . Up to some notational conventions ? is the bisimulation studied in -LSB- 2 , 17 -RSB- . The relation ? is extended to process functionals by considering their equivalence on all closed instances , e.g. P -LSB- f -RSB- ? Q -LSB- f -RSB- if any R -LSB- x -RSB- , -LSB- R -LSB- x -RSB- = f -RSB- P ? -LSB- R -LSB- x -RSB- = f -RSB- Q. Define now the function F : P r20 ! P r20 by P F -LRB- S -RRB- Q if whenever P ! P -LRB- z -RRB- then Q ! Q0 -LRB- z -RRB- for some Q0 -LRB- z -RRB- and P -LRB- z -RRB- S -LSB- -RSB- Q0 -LRB- z -RRB- ; and symmetrically . Also , let ? 0 = P r20 , ? < = +1 = F -LRB- ? <=-RRB- , and ? > == T < = < > = ? < = . The relations ? < = are extended to functionals following the convention for ? . Proposition 2.2 -LRB- Properties of F -RRB- The set 2P r20 is a complete lattice when ordered by set inclusion . Then : 1 . F is monotone . 2 . S is a bisimulation iff S ? F -LRB- S -RRB- . 3 . If fXigi2I is a codirected set , then F -LRB- Ti2I Xi -RRB- = Ti2I F -LRB- Xi -RRB- . 4 . The greatest bisimulation ? exists and coincides with ?! . Proof . -LRB- 1 -RRB- Observe that S ? S0 implies S -LSB- -RSB- ? S0 -LSB- -RSB- . -LRB- 2 -RRB- Immediate . -LRB- 3 -RRB- Since F is monotone it remains to show : F -LRB- Ti2I Xi -RRB- ? Ti2I F -LRB- Xi -RRB- . Suppose : P Ti2I F -LRB- Xi -RRB- Q and P ! P -LRB- z -RRB- . By hypothesis : 8i 2 I :9 Q0 -LRB- z -RRB- : -LRB- Q ! Q0 -LRB- z -RRB- ^ P -LRB- z -RRB- Xi -LSB- -RSB- Q0 -LRB- z -RRB- -RRB- . Since the labelled transition system is image finite and fXi -LSB- -RSB- gi2I is a directed set , one can switch the two quantifications and derive : 9Q0 -LRB- z -RRB- :8 i 2 I : -LRB- Q ! Q0 -LRB- z -RRB- ^ P -LRB- z -RRB- Xi -LSB- -RSB- Q0 -LRB- z -RRB- -RRB- . This concludes the proof in the case ? o . In the other cases observe : 8i 2 I : -LRB- P -LSB- z -RSB- Xi -LSB- -RSB- Q0 -LSB- z -RSB- -RRB- is equivalent to P -LSB- z -RSB- -LRB- Ti2I Xi -LSB- -RSB- -RRB- Q0 -LSB- z -RSB- which is what we need to prove . -LRB- 4 -RRB- Corollary of -LRB- 3 -RRB- . 2 Proposition 2.3 -LRB- Congruence -RRB- The relations ? k , for k < = ! , are congruences with respect to all the calculus operators . That is , Pi ? k Qi , i = 1 ; 2 -RRB- P1 + P2 ? k Q1 + Q2 , P1 j P2 ? k Q1 j Q2 , c!P1 : P2 ? k c!Q1 : Q2 P ? k Q -RRB- ? c :P ? k ? c : Q P -LSB- x -RSB- ? k Q -LSB- x -RSB- -RRB- c?x :P ? k c?x : Q Proof . The only difficulty arises with parallel composition . For instance , in the case k = ! one shows that f -LRB- ? c1 : ? ? ? ? cn : -LRB- P j Q -RRB- ; ? c1 : ? ? ? ? cn : -LRB- P j Q -RRB- -RRB- j P ? P g is a bisimulation . 2 We give an alternative characterisation of the ? k relations in terms of \ sharpened '' approximations , ? k -RSB- . These will be important when it comes to relating the logical and bisimulation based equivalences . These sharpened relations ? k -RSB- are defined as follows : P ? 0 -RSB- Q always P ? k +1 -RSB- Q if P ! P -LRB- z -RRB- implies Q ! Q0 -LRB- z -RRB- for some Q0 -LRB- z -RRB- such that P -LRB- z -RRB- ? k -RSB- Q0 -LRB- z -RRB- ; and symmetrically P -LSB- x -RSB- ? k -RSB- Q -LSB- x -RSB- if P -LSB- x -RSB- -LSB- ? k -RSB- -RRB- ? k -RSB- -RSB- Q -LSB- x -RSB- P -LSB- f -RSB- ? k -RSB- Q -LSB- f -RSB- if P -LSB- f -RSB- -LSB- -LSB- ? k -RSB- -RRB- ? k -RSB- -RSB- -RRB- ? k -RSB- -RSB- Q -LSB- f -RSB- We can now show that the sharpened approximation relations coincide with the approximations ? k . This result relies on the congruence properties of ? k. Proposition 2.4 For any k < ! , ? k coincides with ? k -RSB- : Proof . By induction on k and the order . We present the order 1 case . Suppose P -LSB- x -RSB- ? k +1 -RSB- Q -LSB- x -RSB- . For any R we know : R ? k +1 -RSB- R. Hence -LSB- R = x -RSB- P ? k +1 -RSB- -LSB- R = x -RSB- Q . This implies by ind. hyp . -LSB- R = x -RSB- P ? k +1 -LSB- R = x -RSB- Q. Conclude : P -LSB- x -RSB- ? k +1 Q -LSB- x -RSB- . Vice versa , suppose P -LSB- x -RSB- ? k +1 Q -LSB- x -RSB- and R ? k +1 -RSB- R0 . By ind. hyp . R ? k +1 R0 . By congruence properties : -LSB- R = x -RSB- P ? k +1 -LSB- R0 = x -RSB- P and -LSB- R = x -RSB- Q ? k +1 -LSB- R0 = x -RSB- Q. By hypothesis : -LSB- R = x -RSB- P ? k +1 -LSB- R = x -RSB- Q and -LSB- R0 = x -RSB- P ? k +1 -RSB- -LSB- R0 = x -RSB- Q. By transitivity : -LSB- R = x -RSB- P ? k +1 -LSB- R0 = x -RSB- Q. By ind. hyp . -LSB- R = x -RSB- P ? k +1 -LSB- R0 = x -RSB- Q. Conclude : P -LSB- x -RSB- ? k +1 -RSB- Q -LSB- x -RSB- . 2 3 Logical Characterization Modal Formulas . Process properties are specified by the modal formulas which are generated by the following grammar , where X is a countable set . As in the case of processes , specifications also have an order . A specification of a certain order can only be predicated of a process of the same order . Conjunction and disjunction apply to formulas of the same order . OE : : = ^ x2X OEx _ x2X OEx h iOE -LSB- -RSB- OE OE -RRB- OE The truth - and falsehood constants > and ? are defined as usual : > = V ; and ? = W ; . These formulas are overloaded as they may have order 0 , 1 , and 2 . We sometimes use -LRB- ? -RRB- as a meta-connective ranging over fh?i ; -LSB- ? -RSB- g. Realizability . We specify when a process P -LRB- z -RRB- realizes a formula OE , written as j = P -LRB- z -RRB- : OE , by induction on the structure of OE . Note that a realizer of a formula OE -RRB- is always a function , and a realizer of a modality is always a ground process . j = P -LRB- z -RRB- : Vx2X OEx if for all x 2 X j = P -LRB- z -RRB- : OEx j = P -LRB- z -RRB- : Wx2X OEx if for some x 2 X j = P -LRB- z -RRB- : OEx j = P -LSB- z -RSB- : OE -RRB- if for all Q -LRB- z0 -RRB- , j = Q -LRB- z0 -RRB- : OE implies j = -LSB- Q -LRB- z0 -RRB- = z -RSB- P : j = P : h iOE if for some P -LRB- z -RRB- , P ! P -LRB- z -RRB- and j = P -LRB- z -RRB- : OE j = P : -LSB- -RSB- OE if whenever P ! P -LRB- z -RRB- , j = P -LRB- z -RRB- : OE The modal depth jOEj of a formula OE is defined as follows : j Vx2X OExj = j Wx2X OExj = supx2XjOExj jOE -RRB- j = j j jh iOEj = j -LSB- -RSB- OEj = 1 + jOEj Definition 3.1 -LRB- Logical equivalences -RRB- We define the family of equivalence relations on process -LRB- functionals -RRB- ? < = L by P -LRB- z -RRB- ? < = L Q -LRB- z0 -RRB- if for all OE such that jOEj < = < = , j = P -LRB- z -RRB- : OE if and only if j = Q -LRB- z0 -RRB- : OE . Also set : P -LRB- z -RRB- ? L Q -LRB- z0 -RRB- if P -LRB- z -RRB- ? < = L Q -LRB- z0 -RRB- , for any < = . Proposition 3.2 -LRB- 1 -RRB- For any < = , if P -LRB- z -RRB- ? < = Q -LRB- z0 -RRB- then P -LRB- z -RRB- ? < = L Q -LRB- z0 -RRB- . -LRB- 2 -RRB- If P -LRB- z -RRB- ? Q -LRB- z0 -RRB- then P -LRB- z -RRB- ? L Q -LRB- z0 -RRB- . Proof . -LRB- 1 -RRB- We show that if P -LRB- z -RRB- ? < = Q -LRB- z0 -RRB- , jOEj < = < = , and j = P -LRB- z -RRB- : OE then j = Q -LRB- z0 -RRB- : OE by induction on the structure of OE . The only non-standard case is when OE has the form OE1 -RRB- OE2 . Suppose j = P1 -LRB- z1 -RRB- : OE1 . Then j = -LSB- P1 -LRB- z1 -RRB- = z -RSB- P : OE2 . By congruence of ? < = , -LSB- P1 -LRB- z1 -RRB- = z -RSB- P ? < = -LSB- P1 -LRB- z1 -RRB- = z0 -RSB- Q. By the induction hypothesis , j = -LSB- P1 -LRB- z1 -RRB- = z0 -RSB- Q : OE2 as desired . -LRB- 2 -RRB- Immediate from -LRB- 1 -RRB- . 2 Definition 3.3 -LRB- Characteristic formula -RRB- For any process functional P -LRB- z -RRB- , and ordinal k < = ! we inductively define a formula Ck -LRB- P -LRB- z -RRB- -RRB- : C0 -LRB- P -LRB- z -RRB- -RRB- = > Ck +1 -LRB- P -RRB- = ^ P!P -LRB- z -RRB- -LRB- h i : Ck -LRB- P -LRB- z -RRB- -RRB- -RRB- ^ ^ 2Act -LRB- -LSB- -RSB- : _ P!P -LRB- z -RRB- Ck -LRB- P -LRB- z -RRB- -RRB- -RRB- Ck +1 -LRB- P -LSB- z -RSB- -RRB- = ^ R -LRB- z0 -RRB- Ck +1 -LRB- R -LRB- z0 -RRB- -RRB- -RRB- Ck +1 -LRB- -LSB- R -LRB- z0 -RRB- = z -RSB- P -RRB- C ! -LRB- P -LRB- z -RRB- -RRB- = ^ k < ! Ck -LRB- P -LRB- z -RRB- -RRB- Observe that for any k < = ! , jCk -LRB- P -LRB- z -RRB- -RRB- j < = k. Proposition 3.4 For any k < ! , -LRB- 1 -RRB- For all P -LRB- z -RRB- , j = P -LRB- z -RRB- : Ck -LRB- P -LRB- z -RRB- -RRB- . -LRB- 2 -RRB- For all P -LRB- z -RRB- ; Q -LRB- z0 -RRB- , j = P -LRB- z -RRB- : Ck -LRB- Q -LRB- z0 -RRB- -RRB- iff P -LRB- z -RRB- ? k Q -LRB- z0 -RRB- . Proof . One proves -LRB- 1 -RRB- and -LRB- 2 -RRB- at the same time , by induction on k and the order . We present the function case . -LRB- 1 -RRB- We have to show : j = P -LSB- x -RSB- : VR Ck +1 -LRB- R -RRB- -RRB- Ck +1 -LRB- -LSB- R = x -RSB- P -RRB- . Suppose : j = R0 : Ck +1 -LRB- R -RRB- . By ind. hyp . and -LRB- 2 -RRB- : R0 ? k +1 R. By congruence : -LSB- R0 = x -RSB- P ? k +1 -LSB- R = x -RSB- P . By ind. hyp . and -LRB- 2 -RRB- : j = -LSB- R0 = x -RSB- P : Ck +1 -LRB- -LSB- R = x -RSB- P -RRB- . -LRB- 2 -RRB- Suppose j = P -LSB- x -RSB- : Ck +1 -LRB- Q -LSB- x -RSB- -RRB- . That is any R , j = P -LSB- x -RSB- : Ck +1 -LRB- R -RRB- -RRB- Ck +1 -LRB- -LSB- R = x -RSB- Q -RRB- . By ind. hyp and -LRB- 1 -RRB- : j = R : Ck +1 -LRB- R -RRB- . Hence : j = -LSB- R = x -RSB- P : Ck +1 -LRB- -LSB- R = x -RSB- Q -RRB- . That is : -LSB- R = x -RSB- P ? k +1 -LSB- R = x -RSB- Q. Vice versa , suppose P -LSB- x -RSB- ? k +1 Q -LSB- x -RSB- . Given any R , let j = R0 : Ck +1 -LRB- R -RRB- . Then R0 ? k +1 R , which implies : -LSB- R0 = x -RSB- P ? k +1 -LSB- R = x -RSB- P ? k +1 -LSB- R = x -RSB- Q. 2 We thus obtain Corollary 3.5 For any k < ! , P ? kL Q implies P ? k Q. 2 Theorem 3.6 -LRB- Logical characterization -RRB- For any processes P ; Q , P ? Q iff P ? L Q : Proof . Follows immediately from previous results . 2 Remark . We can now explain a technical problem that would arise in a direct proof of the logical characterization theorem . We want to show by contradiction that P ? L P implies P ? P . We consider the function case . Suppose P -LSB- x -RSB- -LSB- Id -RRB- ? -RSB- P -LSB- x -RSB- does not hold . Then neither does P -LSB- x -RSB- -LSB- Id -RRB- ? k -RSB- P -LSB- x -RSB- for some k , i.e. there is a Q such that -LSB- Q = x -RSB- P ? k -LSB- Q = x -RSB- P fails . Inductively one can find a formula that separates -LSB- Q = x -RSB- P from -LSB- Q = x -RSB- P , and such that j j < = k . The problem is that -LRB- apparently -RRB- we have no control on Q which can be an arbitrarily complex process . However , our approach shows that it is possible to give a sufficiently good description of Q by means of a formula of modal depth bounded by k . A Characterization of Chocs Bisimulation . There is an alternative and natural definition of bisimulation , which resembles the definition of sharpened approximation . Given a relation S over P r20 and an action we define the relations Sf g as follows : Sfog = S Sfc?g = -LSB- S -RRB- S -RSB- Sfc!g = -LSB- -LSB- S -RRB- S -RSB- -RRB- S -RSB- Definition 3.7 -LRB- Modified bisimulation -RRB- A modified bisimulation S is a relation over P r0 such that whenever PSQ and P ! P -LRB- z -RRB- then for some Q0 -LRB- z -RRB- , Q ! Q0 -LRB- z -RRB- and P -LRB- z -RRB- Sf gQ0 -LRB- z -RRB- ; and symmetrically . Proposition 3.8 Among the modified bisimulations S such that Id0 ? S and -LSB- S -RRB- S -RSB- ? Id1 there is largest one and it coincides with the largest bisimulation . Proof . Let S be a modified bisimulation with the required properties . Then for any action , Sf g ? S -LSB- -RSB- . Hence S is a bisimulation . Next observe that ? is a modified bisimulation by its congruence properties . So it is also the largest modified bisimulation with the required properties . 2 Intervals . The notion of modified bisimulation is rather hard to handle as it does not induce a monotone function on the space 2P r20 , because of the contravariance of the constructive implication . There is a well-known technique to overcome this problem which consists in lifting the problem to a space of intervals . In our case an interval is a pair -LSB- I ; J -RSB- , where : I ? J ? P r20 . Intervals are an example of threevalued interpretation in which one speaks about what is true , what is possibly true -LRB- or false -RRB- and what is false . Intervals can be ordered by -LSB- I ; J -RSB- < = -LSB- I ; J -RSB- if and only if I ? I and J ? J . Over this space the following interpretation of the constructive implication is monotone : -LSB- I ; J -RSB- -RRB- -LSB- I ; J -RSB- = -LSB- J -RRB- I ; I -RRB- J -RSB- Following these ideas it would be possible to base our work on the notion of modified bisimulation . 4 Towards a Proof System In this section we develop a proof system to prove properties of processes stated in the finitary fragment of the Hennessy-Milner logic previously introduced . These results are of a preliminary nature as they are obtained under the following strong assumptions : 1 . We drop restriction . 2 . We assume an infinitary ! - rule . 3 . We suppose that the calculus has a finite number of channels . The ! - rule reduces the provability of open terms to the provability of their closed instances . Whether some weak completeness result can be obtained while dropping this rule remains to be seen . The restriction to finite label alphabet has two important corollaries . First , the following rule Par-box-o is finitary . Without this hypothesis a finitary statement of the Par-box-o rule could be obtained , for instance , by introducing a channel quantifier in the specification language . Indeed it appears that this would be a natural extension of the language . For example , note that the property that a process can perform no actions could be stated as : 8c :-LRB- -LSB- c ! -RSB- ? ^ -LSB- o -RSB- ? ^ -LSB- c ? -RSB- ? -RRB- . Second , the k-th characteristic formula of any process is finite , for k < ! . This is quite useful in arguing about the completeness of the system . We regard -LRB- 1 -RRB- as the main limitation of our system as in practice it is possible to prove interesting facts without applying the ! - rule and assuming a finite number of channels . 4.1 Syntactic Conventions Judgments . A context ? is a set z1 : 1 ; : : : ; zn : n where all zi are pairwise distinct . The basic judgments are sequents of the following shape : ? ` P : The process P and the context ? might contain variables of order ; 1 ; 2 . There can be at most one variable which is free in P and does not occur in ? . Following our conventions this variable should be intended as > = - abstracted -LRB- note that in our specific case this variable can be of order ; 1 -RRB- . The grammars of processes P0 ; P1 ; P2 of orders ; 1 ; 2 , respectively , in a context ? can be given as follows : P0 : : = x P0 + P0 c!P0 : P0 c?x : P0 fP0 FP1 P1 : : = P0 -LSB- x -RSB- P2 : : = P0 -LSB- f -RSB- In the following P will denote a generic process and a generic formula . Eta-expansions . By convention we eta-expand functional variables so that : f = fx -LSB- x -RSB- ; F = Ff -LSB- f -RSB- . This allows to fit functional variables in the grammar for P1 and P2 . In the following we will write z1 j P0 . If z1 ? f1 then z1 j P0 ? -LRB- f1x j P0 -RRB- -LSB- x -RSB- , and , similarly , if z1 ? F1 then z1 j P0 ? -LRB- F1f j P0 -RRB- -LSB- f -RSB- -LRB- x ; f fresh variables -RRB- . Interpretation . We write z1 : 1 ; : : : ; zn : n j = P : if for all closed Pi such that j = Pi : i -LRB- i = 1 ; : : : ; n -RRB- we have j = -LSB- P1 = z1 ; : : : ; Pn = zn -RSB- P : . 4.2 Proof System We divide the rules of the proof system in three groups : general rules for the manipulation of the sequents , sequent calculus rules which allow for the -LRB- right and left -RRB- introduction of logical operators , and finally rules which exploit the process structure -LRB- see fig. 1 -RRB- . While the first two groups are quite stable -LRB- coming straight from proof theory -RRB- the last group is still open to debate . Here we follow quite closely previous work by Colin Stirling -LSB- 18 -RSB- concerning proof systems for CCS -LRB- note however the different formulation of the rules for parallel composition -RRB- . The rules reflect very closely the operational semantics . The most involved rules are those for parallel composition . To prove a property OE of a parallel composition , say , P j Q , one needs in general to : 1 . guess properties of the parallel constituents P and Q , 2 . show that they hold , and 3 . show that the holding of these properties for the constituents entails the holding of OE for their parallel composition . We regard this as quite natural and reflecting closely the compositional nature of the proof system . We do not expect that any of these three tasks can be automated in general though they can be for certain special cases . For instance for finite state CCS processes it is possible to efficiently transform the guess for one parallel component to a property required to hold for the other -LRB- c.f. -LSB- 10 , 3 -RSB- -RRB- . In general , however , we can as yet provide no assistance , and in practice during a proof one is often forced to backtrack in order to modify the hypotheses . This is clearly a potential problem , and it remains to be seen if a more efficient proof system can be developed . We have omitted the rules symmetric to And-l , Or-r , Sum-dia , Par-dia , and Par-dia-o . Really , ^ ; _ ; + ; and j should be understood as commutative operators . Most rules should be self-explanatory . The essential idea is that in general the holding of ? ` P : OE depends on the structure of both P and OE . In all cases , but for the modal operators , P can be dealt with uniformly | these are the logical rules . For the modal operators , however , the structure of P is essential , and its transition behaviour is exposed by the operational semantics from which the rules for the modal operators are derived in a quite systematic fashion . 4.3 Soundness and Completeness In this section we establish the soundness and completeness of the proof system w.r.t. the proposed interpretation . Proposition 4.1 -LRB- Soundness -RRB- If ? ` P : then ? j = P : . Proof . Proofs are well-founded , countably branching trees . To every proof one can associate a -LRB- transfinite -RRB- ordinal which measures its depth . Proceed by transfinite induction on the proof depth . 2 We next turn to the issue of completeness . First notice that without the ! - rule the proof system is incomplete , even if we restrict attention to closed processes . For instance one can not prove the following valid judgment : ` c?x : x : hc?i -LRB- > -RRB- -LRB- ho i > _ -LSB- o -RSB- ? -RRB- -RRB- . However , even without using the ! - rule it is possible to prove simple , but non-trivial , properties of processes . In fig. 2 we give an example proof of the judgment ` a ! -LRB- b ! 0 -RRB- : b?y : c ! 0 j a?x : x : ho iho ihc!i > where we have adopted the abbreviations OE0 = OE1 -RRB- OE1 , OE1 = hb!i -LRB- OE2 -RRB- hc!i > -RRB- , and OE2 = > -RRB- hc!i > . Typically , proofs are constructed bottom up . It is useful to consider successive refinements of the formulas involved in the par-dia-o rule in fig. 2 . In practice one introduces formula variables which are incrementally resolved as the proof goes on . For instance the instantiations of OE0 ; OE1 and OE2 in fig. 2 have been arrived at in this way . Sequent Structure Rules Hyp ? ? ; z : ` z : Cut ? ` P : ? ; z : ` P : ? ` -LSB- P = z -RSB- P : Omega For all P such that j = P : , ? ` -LSB- P = z -RSB- P : ? ; z : ` P : Logical Rules Bot-l ? ; z : ? ` P : Top-r ? ` P : > And-l ? ; z : 1 ` P : ? ; z : 1 ^ 2 ` P : And-r ? ` P : 1 ? ` P : 2 ? ` P : 1 ^ 2 Or-l ? ; z : 2 ` P : ? ; z : 1 ` P : ? ; z : 1 _ 2 ` P : Or-r ? ` P : 1 ? ` P : 1 _ 2 -RRB- - l ? ` P : 1 ? ; x : 2 ` P : ? ; z : 1 -RRB- 2 ` -LSB- zP = x -RSB- P : -RRB- - r ? ; z : ` P : ? ` P -LSB- z -RSB- : -RRB- Process Structure Rules Out-1 ? ` -LRB- fP j P -RRB- -LSB- f -RSB- : ? ` c!P :P : -LRB- c ! -RRB- Out-2 ? ? ` c!P :P : -LSB- -RSB- -LRB- c ! < > -RRB- In-1 ? ` P -LSB- x -RSB- : ? ` c?x :P : -LRB- c ? -RRB- In-2 ? ? ` c?x :P : -LSB- -RSB- -LRB- c ? < > -RRB- Sum-dia ? ` P : h i ? ` P + P : h i Sum-box ? ` P : -LSB- -RSB- ? ` P : -LSB- -RSB- ? ` P + P : -LSB- -RSB- Nil ? ? ` : -LSB- -RSB- Par-dia ? ` P1 : h i 1 ? ; z1 : 1 ` z1 j P2 : ? ` P1 j P2 : h i Par-dia-o ? ` P1 : hd!i 1 ? ` P2 : hd?i 2 z1 : 1 ; z2 : 2 ` z1z2 : ? ` P1 j P2 : ho i Par-box ? ` P1 : -LSB- -RSB- 1 ? ` P2 : -LSB- -RSB- 2 ? ; z1 : 1 ` z1 j P2 : ? ; z2 : 2 ` P1 j z2 : ? ` P1 j P2 : -LSB- -RSB- -LRB- < > o -RRB- Par-box-o ? ` P1 : -LSB- o -RSB- 1 ? ` P2 : -LSB- o -RSB- 2 ? ; x1 : 1 ` x1 j P2 : ? ; x2 : 2 ` P1 j x2 : ? ` P1 : -LSB- d ? -RSB- 1 ;d ? ^ -LSB- d ! -RSB- 1 ;d ! -LRB- all d -RRB- ? ` P2 : -LSB- d ? -RSB- 2 ;d ? ^ -LSB- d ! -RSB- 2 ;d ! -LRB- all d -RRB- z1 : 1 ;d ? ; z2 : 2 ;d ! ` z2z1 : -LRB- all d -RRB- z1 : 1 ;d ! ; z2 : 2 ;d ? ` z1z2 : -LRB- all d -RRB- ? ` P1 j P2 : -LSB- o -RSB- Figure 1 : Proof System ` : > x : hc!i > ` x : hc!i > g : OE2 ` g0 : hc!i > ` g0 -LSB- g -RSB- : OE2 -RRB- hc!i > ` b ! 0 : OE1 x : OE1 ` x : OE1 f : OE0 ` f -LRB- b ! 0 -RRB- : OE1 ` g0 -LSB- g -RSB- : > y : > ` c ! 0 : hc!i > ` c ! 0 -LSB- y -RSB- : OE2 ` b?y : c ! 0 : hb?iOE2 f : OE0 ` f -LRB- b ! 0 -RRB- j b?y : c ! 0 : ho ihc!i > ` a ! -LRB- b ! 0 -RRB- : b?y : c ! 0 : ha!i -LRB- OE0 -RRB- ho ihc!i > -RRB- ` x : OE1 ` x : OE1 ` x -LSB- x -RSB- : OE0 ` a?x : x : ha?iOE0 ` a ! -LRB- b ! 0 -RRB- : b?y : c ! 0 j a?x : x : ho iho ihc!i > Figure 2 : Proof example Proposition 4.2 Suppose that there are a finite number of channels . Then , for any process P and number k < ! : -LRB- 1 -RRB- Ck -LRB- P -RRB- is a finite formula , -LRB- 2 -RRB- fCk -LRB- P -RRB- j P processg is a finite set -LRB- up to identification of with ^ -RRB- . Proof . Prove 1 and 2 together by induction on k and P order . 2 Theorem 4.3 -LRB- Completeness for closed processes -RRB- If j = P : then ` P : . Proof . By induction on the following lexicographic order : -LRB- j j ; order -LRB- -RRB- ; struct -LRB- P -RRB- ; struct -LRB- -RRB- -RRB- One proceeds by case analysis on the structure of P and . 1 . : : = > ? : Direct . 2 . : : = 1 ^ 2 1 _ 2 : struct -LRB- -RRB- decreases . 3 . : : = 1 -RRB- 2 : order -LRB- -RRB- decreases , use ! - rule . 4 . : : = -LRB- -RRB- : We analyse the structure of the process P -LRB- which has order 0 -RRB- . -LRB- a -RRB- P : : = 0 : Direct . -LRB- b -RRB- P : : = c!P :P c?x :P : j j decreases . -LRB- c -RRB- P : : = P + P : struct -LRB- P -RRB- decreases . -LRB- d -RRB- P : : = P j P : There are two subcases . i. : : = h i : We give this case in some detail . ffl Suppose j = P1 j P2 : h i because P1 ! P 1 and j = P 1 j P2 : . Let k = j j and 1 = Ck -LRB- P 1 -RRB- . We know : j = P 1 : 1 . Hence : j = P1 : h i 1 . We can conclude ` P1 : h i 1 , by ind. hyp . on P . Next we show : z1 : 1 j = z1 j P2 : . Suppose j = P 001 : 1 , then P 001 ? k P 1 , which implies P 001 j P2 ? k P 1 j P2 . Conclude : j = P 001 j P2 : . By induction on j j we have : ` P 001 j P2 : . By the ! - rule and Par-dia we prove : ` P1 j P2 : h i . ffl Otherwise suppose ? o and j = P1 j P2 : ho i because P1 d !! P 1 -LSB- f -RSB- , P2 d ?! P 2 -LSB- x -RSB- , and j = -LSB- P 2 -LSB- x -RSB- = f -RSB- P 1 : . Let k = j j , 1 = Ck -LRB- P 1 -LSB- f -RSB- -RRB- , and 2 = Ck -LRB- P 2 -LSB- x -RSB- -RRB- , Clearly : j = P1 : hd!i 1 and j = P2 : hd?i 2 . Conclude : ` P1 : hd!i 1 and ` P2 : hd?i 2 , by ind. hyp . on P . It remains to show z1 : 1 ; z2 : 2 j = z1z2 : . Apply again the logical characterization of the ? k relation . Then apply twice the ! rule to get : z1 : 1 ; z2 : 2 ` z1z2 : . Conclude ` P1 j P2 : ho i , by Par-dia-o . ii . : : = -LSB- -RSB- : This behaves as the previous case w.r.t. the induction hypothesis . We only consider the case : j = P1 j P2 : -LSB- o -RSB- . Let : j j = k , i = W Pi o!P i Ck -LRB- P i -RRB- , i ;d ? = W Pi d ?! P i Ck -LRB- P i -RRB- , and i ;d ! = W Pi d !! P i Ck -LRB- P i -RRB- -LRB- for i = 1 ; 2 , and any channel d -RRB- . Clearly : j = Pi : i. By ind. hyp . on j j follows : ` Pi : i , -LRB- i = 1 ; 2 -RRB- . Next show : x1 : 1 j = x1 j P2 : , using the logical characterization of ? k. By induction on j j and ! - rule follows : x1 : 1 ` x1 j P2 : . A symmetric argument gives : x2 : 2 ` P1 j x2 : . Finally show , e.g. , z1 : 1 ;d ? ; z2 : 2 ;d ! j = z2z1 : , by logical characterization of ? k. By induction on j j and ! - rule follows : z1 : 1 ;d ? ; z2 : 2 ;d ! ` z2z1 : . 2 Note that this proof never uses the left introduction rules as hypotheses on the left of the sequent are eliminated by means of the ! - rule . Of course a finitary system would make essential use of the left introduction rules , as in fig. 2 . Corollary 4.4 -LRB- Completeness -RRB- If ? j = P : then ? ` P : . Proof . Use completeness of the system for closed processes and apply n times the ! - rule , where n is the length of the context ? . 2 5 Conclusions and Research Directions We have given a characterization of Chocs bisimulation by means of a HennessyMilner logic and developed a related sound and complete proof system for a fragment of the calculus . We believe that our approach is sufficiently general to be applied to more complex higher-order calculi such as CML and Facile . However in these cases the modal operators for process/function transmission need to be combined with modal operators which specify , e.g. , value and channel transmission . The formalization of this system is a non-trivial task . Probably the most interesting problem which remains to be settled is that of developing a proof system which can handle restriction . In order to appreciate the difficulties , one may try to develop rules to prove the following valid fact , where N il is a formula stating that a process can do no action : ? a : -LRB- b ! -LRB- a?x :0 -RRB- : a?x :0 -RRB- : ha!i -LRB- N il -RRB- N il -RRB- -RRB- N il On a more speculative level we would like to understand the relationships between specifications and types for higher-order process calculi . For instance , type systems for concurrent applicative languages such as CML and Facile have been recently proposed -LSB- 14 , 21 -RSB- which partially describe the input-output behaviour of a program . Is there a connection between these types and specifications as presented here ? Acknowledgments . We are indebted to Lone Leth , Sanjiva Prasad , and Bent Thomsen for several discussions on the topics presented here . References -LSB- 1 -RSB- S. Abramsky . A domain equation for bisimulation . Information and Computation , 92:161 -LCB- 218 , 1991 . -LSB- 2 -RSB- R. Amadio . On the reduction of chocs bisimulation to ss-calculus bisimulation . In Proc . CONCUR 93 , Hildesheim , pages 112 -LCB- 126 . SLNCS 715 , 1993 . Also appeared as Research Report Inria-Lorraine 1786 , October 1992 . -LSB- 3 -RSB- H. Andersen and G. Winskel . Compositional checking of satisfaction . Formal methods in System Design , 1 -LRB- 4 -RRB- , 1992 . -LSB- 4 -RSB- G. Boudol . Towards a lambda calculus for concurrent and communicating systems . SLNCS , 351 , 1989 . In Proc . TAPSOFT . -LSB- 5 -RSB- M. Dam . Model checking mobile processes . In Proc . CONCUR ' 93 , Lecture Notes in Computer Science , 715:22 -LCB- 36 , 1993 . Full version in SICS report RR94 :1 , 1994 . -LSB- 6 -RSB- A. Giacalone , P. Mishra , and S. Prasad . Facile : A symmetric integration of concurrent and functional programming . International Journal of Parallel Programming , 18 -LRB- 2 -RRB- :121 -LCB- 160 , 1989 . -LSB- 7 -RSB- M. Hennessy . A denotational model for higher-order processes . In Proc . IEEE-LICS , 1993 . -LSB- 8 -RSB- M. Hennessy and X. Liu . A modal logic for message passing processes . Dept. of Computer Science , University of Sussex , Report 3/93 , 1993 . -LSB- 9 -RSB- M. Hennessy and R. Milner . Algebraic laws for nondeterminism and concurrency . Journal of the ACM , 32:137 -LCB- 162 , 1985 . -LSB- 10 -RSB- K. G. Larsen and L. Xinxin . Compositionality through an operational semantics of contexts . Journal of Logic and Computation , 1:761 -LCB- 795 , 1991 . -LSB- 11 -RSB- R. Milner . Communication and Concurrency . Prentice Hall , 1989 . -LSB- 12 -RSB- R. Milner , J. Parrow , and D. Walker . Modal logics for mobile processes . TCS , 114:149 -LCB- 171 , 1993 . -LSB- 13 -RSB- F. Nielsen . The typed lambda calculus with first class processes . Springer Lecture Notes in Computer Science , 366 , 1989 . In Proc . PARLE . -LSB- 14 -RSB- F. Nielson and H. R. Nielson . From CML to Process Algebras . Technical Report DAIMI-PB-433 , DAIMI , Aarhus University , 1993 . Appears in Proceedings of CONCUR ' 93 . -LSB- 15 -RSB- A. Pitts and I. Stark . What 's new ? In Proc . Mathematical Foundations of Computer Science , Gda?nsk , Poland . SLNCS 711 , 1993 . -LSB- 16 -RSB- J. Reppy . Cml : A higher-order concurrent language . In Proc . ACM-SIGPLAN 91 , Conf . on Prog . Lang . Design and Impl. , 1991 . -LSB- 17 -RSB- D. Sangiorgi . Expressing mobility in process algebras : first-order and higher order paradigms . PhD thesis , University of Edinburgh , September 1992 . -LSB- 18 -RSB- C. Stirling . Modal logics for communicating systems . Theoretical Computer Science , 49:311 -LCB- 347 , 1987 . -LSB- 19 -RSB- B. Thomsen . A calculus of higher order communicating systems . PhD thesis , Imperial College , London , 1990 . -LSB- 20 -RSB- B. Thomsen . Plain chocs . Acta Informatica , 30:1 -LCB- 59 , 1993 . Also appeared as TR 89/4 , Imperial College , London . -LSB- 21 -RSB- B. Thomsen . Polymorphic sorts and types for concurrent functional programs . Technical report , ECRC , TR-93-10 , 1993 .

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O

higher-order process calculi
program specification
program verification