An

Algebraic

Theory

of

Distributed

Real-Time

Rance

Cleaveland

and

Gerald

L?uttgeny

e-mail

france,luettgeng@eos.ncsu.edu

Technical

Report

Department

of

Computer

Science

North

Carolina

State

University

Raleigh

NC

USA

March

Abstract

This

paper

develops

a

real-time

process

algebra

TPLmc

for

modeling

and

reasoning

about

distributed

real-time

systems

Like

the

algebra

PMC

TPLmc

includes

operators

for

binding

processes

to

different

clocks

unlike

PMC

however

TPLmc

includes

a

version

of

the

maximal

progress

assumption

Using

simple

examples

we

motivate

why

these

features

are

useful

and

in

some

cases

necessary

for

modeling

and

verifying

distributed

systems

we

also

present

a

behavioral

congruence

based

on

Milner

's

observational

equivalence

and

develop

logical

characterizations

of

the

behavioral

relations

Introduction

Process

algebras

-LSB-

-RSB-

provide

a

well-studied

framework

for

modeling

and

verifying

concurrent

systems

-LSB-

-RSB-

These

theories

typically

consist

of

a

simple

language

with

a

rigorously

defined

semantics

mapping

terms

to

labeled

transition

systems

They

also

usually

support

equational

reasoning

as

a

basis

for

system

verification

an

equivalence

on

processes

is

defined

that

relates

systems

on

the

basis

of

their

observable

behavior

and

this

relation

is

used

to

relate

specifications

which

describe

desired

system

behavior

and

implementations

In

order

to

support

compositional

reasoning

researchers

have

typically

concentrated

on

equivalences

that

are

also

congruence

relations

for

the

given

languages

Traditionally

process

algebras

have

been

developed

with

a

view

toward

modeling

the

nondeterministic

behavior

of

concurrent

and

distributed

systems

More

recent

work

has

incorporated

Research

supported

by

NSF/DARPA

grant

NSF

grant

ONR

Young

Investigator

Award

NSF

Young

Investigator

Award

NSF

grant

and

AFOSR

grant

yResearch

support

provided

by

the

German

Academic

Exchange

Service

under

grant

-LRB-

Doktorandenstipendium

HSP

II

AUFE

-RRB-

other

aspects

of

system

behavior

including

real

time

-LSB-

-RSB-

priorities

-LSB-

-RSB-

and

probability

-LSB-

-RSB-

Most

of

this

later

work

however

has

been

devoted

to

modeling

centralized

as

opposed

to

distributed

systems

the

real-time

work

in

particular

has

-LRB-

implicitly

or

explicitly

-RRB-

focused

on

systems

with

a

single

clock

In

this

paper

we

present

a

temporal

process

algebra

called

TPLmc

which

is

aimed

at

modeling

distributed

real-time

systems

that

contain

a

number

of

different

clocks

The

algebra

extends

Hennessy

and

Regan

's

TPL

-LSB-

-RSB-

with

operators

from

PMC

-LSB-

-RSB-

for

managing

multiple

clocks

Like

Yi

's

real-time

calculus

-LSB-

-RSB-

TPL

enjoys

the

maximal

progress

assumption

which

has

been

shown

in

practice

to

ease

greatly

the

task

of

modeling

realtime

systems

-LSB-

-RSB-

but

it

only

supports

the

modeling

of

systems

with

a

single

clock

PMC

can

model

systems

with

many

clocks

but

in

practice

its

lack

of

maximal

progress

limits

its

utility

for

verification

purposes

Combining

the

two

features

into

one

model

yields

semantic

subtleties

whose

solutions

constitute

the

body

of

this

paper

The

rest

of

the

paper

is

organized

as

follows

The

remainder

of

this

section

is

devoted

to

an

example

illustrating

the

desirability

of

multiple

clocks

and

maximal

progress

in

modeling

realtime

distributed

systems

The

next

section

defines

the

syntax

and

semantics

of

TPLmc

while

Section

provides

two

further

examples

illustrating

the

utility

of

our

language

In

the

next

section

strong

bisimulation

-LSB-

-RSB-

is

adapted

to

our

language

and

its

theory

is

developed

while

the

corresponding

observational

theory

is

presented

in

Section

The

final

section

contains

our

conclusions

and

directions

for

future

research

while

the

appendices

contain

proofs

of

some

of

the

results

stated

in

the

paper

requestanswer

s

s

requestanswer

Server

ss

ss

answer

s

s

request

Figure

Client-server

model

Motivating

Example

We

motivate

the

two

main

characteristics

of

TPLmc

multiple

clocks

and

maximal

progress

by

a

generic

example

Consider

the

basic

architecture

of

a

client-server

system

as

given

in

Figure

The

clients

and

the

server

are

physically

different

computers

having

their

own

clocks

and

oes

respectively

Clients

repeatedly

attempt

to

send

requests

to

the

server

which

is

capable

of

processing

one

such

request

at

a

time

A

client

whose

request

is

accepted

then

awaits

an

answer

while

the

other

client

idles

until

the

server

is

ready

to

process

another

request

The

server

waits

for

a

request

which

he

processes

directly

and

offers

the

answer

to

the

requesting

client

Receiving

the

answer

from

the

server

the

client

starts

over

again

From

the

description

of

the

system

it

is

clear

that

an

adequate

model

for

it

should

include

support

for

multiple

clocks

since

the

system

components

are

running

on

different

machines

Moreover

clients

should

receive

responses

as

soon

as

they

are

offered

any

delay

could

force

the

server

to

wait

which

is

unacceptable

in

practice

This

argues

for

the

inclusion

of

a

maximal

progress

assumption

Moreover

the

example

shows

why

we

would

like

a

localized

version

of

the

maximal

progress

assumption

Suppose

that

we

have

one

client

which

engages

in

an

infinite

internal

computation

Although

this

situation

seems

to

be

artificial

at

first

sight

it

naturally

occurs

when

abstracting

from

timing

aspects

of

some

part

of

a

distributed

system

e.g.

from

the

timing

behavior

of

a

particular

client

Ideally

this

should

not

effect

the

proper

work

at

other

sites

Unfortunately

the

usual

maximal

progress

assumption

has

the

side-effect

that

no

clock

is

able

to

tick

in

such

a

situation

Thus

by

localizing

the

maximal

progress

assumption

we

formalize

an

important

aspect

of

our

intuition

of

distributed

systems

Syntax

and

Semantics

of

TPLmc

In

this

section

we

define

the

syntax

and

semantics

of

our

language

TPLmc

which

is

based

on

the

temporal

process

algebras

TPL

-LSB-

-RSB-

and

PMC

-LSB-

-RSB-

Syntax

of

TPLmc

The

syntax

of

TPLmc

is

essentially

the

same

as

in

PMC

It

differs

from

CCS

by

the

introduction

of

timed

actions

a

timeout

operator

and

an

ignore

operator

Formally

let

be

a

countable

set

of

action

labels

not

including

the

so

called

silent

or

internal

action

o

For

every

input

action

a

there

exists

a

complementary

action

a

the

corresponding

output

action

Further

let

dffa

j

a

g

and

let

us

denote

the

set

of

all

actions

-LSB-

-LSB-

fog

where

o

by

A

Intuitively

an

action

indicates

that

a

process

is

willing

to

perform

a

synchronization

on

the

port

associated

with

the

action

name

i.e.

an

action

a

means

that

the

process

wants

to

receive

a

message

from

port

a

whereas

a

means

that

the

process

wants

to

send

a

message

via

port

a

The

action

o

either

indicates

an

internal

action

of

a

process

or

the

synchronization

of

two

processes

on

some

port

in

order

to

communicate

with

each

other

Finally

we

let

a

b

range

over

and

ff

over

A

We

extend

the

set

A

of

ordinary

actions

by

a

finite

set

T

of

timed

actions

Sometimes

we

refer

to

a

timed

action

as

a

clock

or

a

timer

We

let

oe

range

over

T

A

timed

action

oe

models

idling

until

the

next

clock

cycle

of

the

clock

oe

In

contrast

to

the

synchronization

of

ordinary

actions

on

complementary

ports

timed

actions

synchronize

in

a

broadcasting

fashion

in

which

all

components

of

a

parallel

composition

or

a

summation

have

to

take

part

For

the

sake

of

simplicity

we

write

for

a

representative

of

A

-LSB-

T

Further

we

use

the

standard

definitions

for

sort

of

a

process

where

timed

actions

are

never

included

in

sorts

free

and

bound

variables

open

and

closed

terms

and

contexts

A

process

variable

is

called

guarded

in

a

process

term

if

each

occurrence

of

the

variable

is

in

the

scope

of

a

prefix

or

in

the

scope

of

the

second

argument

of

a

timeout

-LRB-

see

below

-RRB-

We

refer

to

closed

and

guarded

terms

as

processes

and

denote

syntactic

equality

on

P

by

Let

P

Q

R

range

over

the

set

P

of

processes

The

syntax

of

our

language

is

defined

by

the

BNF

presented

in

Table

where

f

A

A

is

a

finite

relabeling

L

A

n

fog

a

restriction

set

and

C

a

process

constant

A

finite

relabeling

satisfies

the

properties

f

-LRB-

o

-RRB-

o

and

jf

j

f

-LRB-

-RRB-

g

j

Moreover

is

called

ignore

operator

and

b?coe

-LRB-

-RRB-

timeout

operator

Table

Syntax

of

TPLmc

P

j

:P

j

P

P

j

P

jP

j

P

-LSB-

f

-RSB-

j

P

n

L

j

P

oe

j

bP

coe

-LRB-

P

-RRB-

j

C

def

P

In

order

to

avoid

too

many

parentheses

we

refine

the

binding

power

hierarchy

of

CCS

-LSB-

-RSB-

Our

operators

have

decreasing

binding

power

in

the

following

order

restriction

and

relabeling

and

ignore

prefix

and

timeout

parallel

composition

summation

Semantics

of

TPLmc

The

-LRB-

operational

-RRB-

semantics

of

a

TPLmc

process

P

P

is

given

by

a

labeled

transition

system

hP

A

;P

i

where

P

is

the

set

of

states

A

the

alphabet

the

transition

relation

and

P

the

start

state

We

define

the

semantics

in

such

a

fashion

that

communications

must

occur

if

they

are

possible

This

assumption

which

is

often

referred

to

as

maximal

progress

ensures

that

a

process

can

not

delay

if

it

is

able

to

perform

a

communication

However

we

are

dealing

with

distributed

systems

As

discussed

in

the

introduction

it

is

natural

to

localize

the

maximal

progress

assumption

with

respect

to

clocks

Incorporating

maximal

progress

in

the

PMC-style

semantics

or

local

clocks

in

the

TPL-style

semantics

leads

to

a

more

intuitive

operational

semantics

as

discussed

in

the

previous

example

Despite

its

intuitivity

our

new

semantics

provides

several

challenges

in

developing

a

semantic

theory

In

contrast

to

the

PMC-semantics

we

do

not

choose

a

timestop

interpretation

for

and

prefixing

since

we

feel

that

time

can

not

be

stopped

Therefore

a

:P

should

model

a

process

which

waits

for

a

communication

partner

on

port

a

and

does

not

deadlock

if

no

such

partner

is

available

immediately

Avoiding

unnatural

time-stops

also

helps

us

to

define

an

intuitive

notion

of

equivalence

on

processes

The

transition

relation

P

-LRB-

A

-LSB-

T

-RRB-

P

for

TPLmc

is

defined

in

Table

using

Plotkinstyle

-LSB-

-RSB-

operational

rules

We

write

P

P

instead

of

hP

P

i

We

say

that

P

may

engage

in

action

and

thereafter

behaves

like

process

P

Sometimes

it

is

convenient

to

write

P

for

P

P

P

The

presentation

of

the

operational

rules

requires

initial

action

sets

Beside

the

usual

definition

I

-LRB-

P

-RRB-

for

the

initial

action

set

of

a

process

P

-LCB-

where

I

-LRB-

P

oe

-RRB-

and

I

-LRB-

bPcoe

-LRB-

Q

-RRB-

-RRB-

are

given

by

I

-LRB-

P

-RRB-

-LCB-

we

define

the

set

Ioe

-LRB-

P

-RRB-

of

all

initial

actions

of

P

within

the

scope

of

the

timer

oe

as

the

least

set

satisfying

the

rules

in

Table

We

also

define

analogue

initial

actions

sets

ignoring

o-actions

by

II

-LRB-

P

-RRB-

df

I

-LRB-

P

-RRB-

nfog

and

IIoe

-LRB-

P

-RRB-

df

Ioe

-LRB-

P

-RRB-

nfog

respectively

The

definition

Ioe

-LRB-

P

oe

-RRB-

reflects

our

intuition

of

localizing

clocks

The

initial

actions

of

P

oe

are

not

in

the

scope

of

the

clock

oe

i.e.

the

process

P

is

not

attached

to

oe

or

in

other

words

P

ignores

oe

Note

that

these

action

sets

are

defined

independently

from

the

transition

relation

Therefore

is

well-defined

although

its

definition

contains

negative

premises

-LRB-

side

conditions

-RRB-

-LSB-

-RSB-

Table

Initial

action

sets

Ioe

-LRB-

ff

:P

-RRB-

dff

g

Ioe

-LRB-

P

Q

-RRB-

df

Ioe

-LRB-

P

-RRB-

-LSB-

Ioe

-LRB-

Q

-RRB-

Ioe

-LRB-

C

-RRB-

df

Ioe

-LRB-

P

-RRB-

where

C

def

P

Ioe

-LRB-

P

-LSB-

f

-RSB-

-RRB-

dfff

-LRB-

-RRB-

j

Ioe

-LRB-

P

-RRB-

g

Ioe

-LRB-

P

n

L

-RRB-

df

Ioe

-LRB-

P

-RRB-

n

-LRB-

L

-LSB-

L

-RRB-

Ioe

-LRB-

P

jQ

-RRB-

df

Ioe

-LRB-

P

-RRB-

-LSB-

Ioe

-LRB-

Q

-RRB-

-LSB-

fo

j

IIoe

-LRB-

P

-RRB-

II

-LRB-

Q

-RRB-

or

IIoe

-LRB-

Q

-RRB-

II

-LRB-

P

-RRB-

g

Ioe

-LRB-

bP

-LRB-

Q

-RRB-

-RRB-

df

Ioe

-LRB-

P

-RRB-

Ioe

-LRB-

P

-RRB-

df

ae

if

oe

Ioe

-LRB-

P

-RRB-

otherwise

The

semantics

of

TPLmc

for

ordinary

action

transitions

is

the

same

as

the

usual

TPL

or

PMC

semantics

which

is

basically

that

of

CCS

The

difference

to

PMC

arises

by

the

side

conditions

in

the

rules

for

timed

transitions

which

guarantee

that

our

localized

maximal

progress

assumption

holds

-LRB-

cf.

Proposition

-RRB-

and

by

disallowing

time-stops

The

process

ff

:P

may

engage

in

action

and

then

behave

like

P

If

o

it

may

also

idle

for

each

timer

oe

Similarly

oe

:P

can

perform

the

timed

action

oe

and

become

P

or

idle

for

all

other

clocks

The

summation

operator

denotes

nondeterministic

choice

The

process

P

Q

may

behave

like

process

P

-LRB-

Q

-RRB-

Time

has

to

proceed

equally

on

both

sides

of

summation

i.e.

P

Q

can

engage

in

a

timed

action

and

thus

delay

the

nondeterministic

choice

if

and

only

if

both

P

and

Q

can

engage

in

the

timed

action

The

restriction

operator

nL

prohibits

the

execution

of

actions

in

L

-LSB-

L

Thus

the

restriction

operator

permits

the

scoping

of

actions

P

-LSB-

f

-RSB-

behaves

exactly

as

the

process

P

where

ordinary

actions

are

renamed

with

respect

to

the

relabeling

f

The

process

P

jQ

stands

for

the

parallel

composition

of

P

and

Q

according

to

an

interleaving

semantics

with

synchronized

communication

on

complementary

actions

resulting

in

the

internal

action

o

Also

here

time

has

to

proceed

equally

on

both

sides

of

the

operator

The

side

conditions

ensure

that

P

jQ

can

only

idle

on

oe

if

it

can

not

engage

in

an

internal

computation

which

is

in

the

scope

of

oe

The

process

P

oe

behaves

like

the

process

P

for

all

actions

but

the

timed

action

oe

Additionally

P

oe

is

capable

of

performing

a

timed

action

oe

to

P

oe

itself

i.e.

P

ignores

oe

This

allows

the

scoping

of

clocks

in

such

a

way

that

the

traditional

temporal

semantics

for

the

summation

and

parallel

operator

needs

not

to

be

changed

A

central

operator

in

a

temporal

process

algebra

is

the

timeout

operator

The

process

bPcoe

-LRB-

Q

-RRB-

behaves

as

the

process

P

but

it

can

perform

a

oe-action

only

to

the

process

Q

whenever

P

can

not

engage

in

an

internal

action

which

is

in

the

scope

of

the

clock

oe

Finally

C

def

P

denotes

a

constant

definition

i.e.

C

is

a

recursively

defined

process

which

behaves

as

a

distinguished

solution

of

the

equation

C

P

We

want

to

remark

that

the

side

condition

of

Rule

tCOM

can

be

written

as

o

Ioe

-LRB-

P

jQ

-RRB-

-LRB-

cf.

Proposition

below

-RRB-

Although

this

is

a

shorter

notation

the

one

used

in

the

operational

semantic

Rule

tCom

is

more

convenient

for

the

proofs

of

our

main

theorems

which

we

present

in

the

appendices

of

the

paper

In

contrast

to

PMC

timed

prefixing

is

no

longer

a

derived

operator

since

the

semantics

of

the

processes

oe

:P

and

-LRB-

P

-RRB-

are

different

The

former

process

can

engage

in

a

timed

action

to

oe

:P

where

oe

while

the

latter

can

only

engage

in

a

to

the

process

which

is

obviously

semantically

different

from

the

process

oe

:P

for

most

processes

P

Table

Operational

semantics

for

TPLmc

tNil

oe

a

:P

oe

a

:P

Act

ff

:P

P

oe

:P

oe

P

oe

:P

oe

:P

oe

P

P

P

Q

P

tSum

P

oe

P

Q

oe

P

Q

oe

P

Q

P

Q

Rel

P

P

P

-LSB-

f

-RSB-

f

-LRB-

-RRB-

P

-LSB-

f

-RSB-

tRel

P

oe

P

P

-LSB-

f

-RSB-

oe

P

-LSB-

f

-RSB-

Res

P

P

P

n

L

P

n

L

L

-LSB-

L

tRes

P

oe

P

P

n

L

oe

P

n

L

P

P

P

jQ

P

jQ

Q

P

jQ

P

tCom

P

oe

P

Q

oe

P

jQ

oe

P

IIoe

-LRB-

P

-RRB-

II

-LRB-

Q

-RRB-

and

IIoe

-LRB-

Q

-RRB-

II

-LRB-

P

-RRB-

P

a

P

Q

a

P

jQ

o

P

Ign

P

P

P

oe

P

oe

P

oe

oe

P

oe

P

P

P

oe

P

oe

oe

TO

P

P

bP

coe

-LRB-

Q

-RRB-

P

bP

coe

-LRB-

Q

-RRB-

oe

Q

o

Ioe

-LRB-

P

-RRB-

P

P

bP

coe

-LRB-

Q

-RRB-

P

oe

Con

P

P

C

P

C

def

P

tCon

P

oe

P

C

oe

P

C

def

P

The

presented

operational

semantics

for

TPLmc

possesses

the

following

important

properties

Proposition

-LRB-

Associativity

Commutativity

-RRB-

The

summation

and

the

parallel

operator

of

TPLmc

are

associative

and

commutative

modulo

renaming

of

states

The

following

proposition

is

essential

for

the

congruence

proofs

of

some

of

the

behavioral

relations

presented

in

the

next

sections

Its

validity

is

a

consequence

of

the

idling

capability

of

the

processes

and

a

:P

for

a

A

n

fog

and

P

P

Proposition

Let

P

P

and

oe

T

satisfying

o

Ioe

-LRB-

P

-RRB-

Then

P

oe

holds

Moreover

the

semantics

satisfies

the

local

maximal

progress

and

the

local

time

determinacy

property

Both

are

adaptions

of

the

well-known

maximal

progress

and

time

determinacy

properties

-LSB-

-RSB-

which

deal

with

a

global

notion

of

time

to

our

situation

of

multiple

local

clocks

Proposition

-LRB-

Local

Maximal

Progress

-RRB-

Let

P

P

and

oe

T

Then

P

oe

implies

o

Ioe

-LRB-

P

-RRB-

Proposition

-LRB-

Local

Time

Determinacy

-RRB-

Let

P

P

P

P

and

oe

T

satisfying

P

oe

P

and

P

oe

P

Then

P

P

holds

Both

propositions

can

easily

be

checked

by

induction

on

the

depth

of

the

derivation

tree

of

P

oe

P

and

the

maximum

of

the

depths

of

the

derivation

trees

of

P

oe

P

and

P

oe

P

respectively

Examples

In

this

section

we

demonstrate

that

our

operators

and

their

semantics

are

well-chosen

In

the

first

part

we

deal

with

modeling

distributed

control

systems

This

example

shows

the

usefulness

of

multiple

local

abstract

clocks

in

a

specification

language

In

the

second

part

we

deal

with

a

simple

communication

protocol

which

shows

that

our

algebra

is

more

suitable

for

verification

purposes

than

PMC

Modeling

a

Distributed

Control

System

A

distributed

control

system

typically

consists

of

several

sensors

which

continuously

measure

sizes

of

an

environment

e.g.

temperature

and

wind

and

of

several

evaluators

who

use

the

data

collected

by

the

sensors

to

compute

values

of

interest

e.g.

the

wind-chill

temperature

Figure

depicts

the

architecture

of

a

typical

distributed

control

system

consisting

of

three

sensors

and

two

evaluators

where

dashed

lines

represent

clocks

and

solid

lines

represent

usual

communication

channels

is

connected

to

via

port

and

to

via

port

Similarly

is

connected

to

via

port

and

to

via

port

Moreover

and

share

the

clock

whereas

and

share

the

clock

r

v

s

s

s

r

v

v

s

s

Figure

Distributed

control

system

Each

sensor

measures

continuously

its

environment

The

event

of

measuring

is

modeled

by

the

action

si

i

Upon

a

tick

of

the

clock

the

sensors

and

send

their

latest

values

via

channels

and

respectively

to

Similarly

and

send

their

latest

values

via

channels

and

to

at

each

tick

of

the

clock

respectively

Upon

reception

of

the

values

each

evaluator

computes

a

new

value

depending

on

the

values

received

and

offers

it

via

the

output

channel

-LRB-

-RRB-

Using

the

process

algebra

TPLmc

we

can

formalize

the

distributed

control

system

System

as

follows

System

def

-LRB-

j

j

j

j

-RRB-

n

where

def

-LRB-

-RRB-

def

-LRB-

-RRB-

-LRB-

-RRB-

def

-LRB-

-RRB-

def

o

def

o

This

example

makes

intensive

use

of

the

timeout

operator

The

timeout

operator

enables

us

to

model

interrupts

invoked

by

the

ticking

of

the

attached

clocks

Our

maximal

progress

assumption

plays

an

essential

role

in

our

model

One

would

intuitively

demand

the

property

that

the

sequence

of

actions

and

o

and

the

sequence

of

actions

and

o

are

executed

atomically

i.e.

no

ticking

of

the

clocks

and

can

interfere

or

delay

the

sequences

respectively

This

is

important

since

an

evaluator

can

typically

only

produce

a

useful

result

when

its

parameters

and

or

and

have

been

measured

at

approximately

the

same

time

Our

maximal

progress

assumption

ensures

the

atomicity

of

the

mentioned

sequences

However

the

above

intuition

can

also

be

modeled

in

PMC

by

using

the

time-stop

prefixing

operator

in

those

sequences

A

time-stop

prefixing

of

a

process

P

with

an

action

a

disallows

a

tick

to

occur

after

the

execution

of

a

and

before

the

execution

of

P

However

we

give

an

example

below

where

time-stop

prefixing

can

not

replace

our

maximal

progress

assumption

We

want

to

remark

on

our

localized

version

of

the

maximal

progress

property

In

this

example

we

have

abstracted

from

the

internal

clocks

of

the

sensors

since

we

are

not

concerned

about

real-time

constraints

of

the

measuring

processes

This

concept

of

abstraction

emphasizes

again

the

utility

of

the

localized

maximal

progress

assumption

e.g.

if

we

model

the

environment

of

by

df

then

we

introduce

a

o

loop

in

our

system

Thus

the

usual

maximal

progress

assumption

would

prevent

the

ticking

of

any

clock

This

shows

that

our

notion

of

localized

maximal

progress

is

necessary

when

dealing

with

abstraction

from

local

timing

constraints

and

with

multiple

clocks

in

one

process

algebra

Distributed

control

systems

represent

a

large

class

of

real-time

systems

where

multiple

clocks

which

run

independent

from

each

other

are

a

useful

mean

for

modeling

Moreover

this

class

of

systems

shows

that

time

constraints

often

introduce

qualitative

aspects

which

effect

the

causal

behavior

of

a

system

Those

constraints

are

in

practice

often

more

important

than

constraints

dealing

with

quantitative

aspects

of

time

A

Simple

Communication

Protocol

The

next

example

models

a

simple

communication

protocol

It

consists

of

a

sender

a

medium

and

a

receiver

Both

sender

and

receiver

possess

an

own

clock

since

they

are

supposed

to

be

at

different

physical

locations

e.g.

the

sender

and

the

receiver

are

two

computers

The

following

equation

Protocol

defines

the

protocol

formally

in

TPLmc

Protocol

def

-LRB-

Sender

oeR

j

Medium

oeS

oeR

j

Receiver

oeS

-RRB-

n

fs

r

sack

rack

sfail

rfailg

where

Sender

def

send

oeS

S

S

def

s

-LRB-

rack

Sender

rfail

S

-RRB-

Medium

def

s

r

Medium

sack

rack

Medium

sfail

rfail

Medium

Receiver

def

br

RcoeR

-LRB-

sfail

Receiver

-RRB-

R

def

sack

receive

R

The

sender

accepts

a

message

from

its

environment

and

puts

it

on

the

medium

immediately

after

the

next

clock

tick

oeS

Then

it

waits

for

an

acknowledgment

after

which

the

sender

is

ready

to

accept

a

new

message

from

the

environment

or

a

failure

message

which

indicates

that

the

receiver

has

not

received

a

message

for

a

long

time

In

such

a

case

the

message

is

resent

We

consider

a

reliable

medium

i.e.

every

message

and

acknowledgment

put

in

the

medium

is

delivered

and

can

not

get

lost

Moreover

we

abstract

from

the

delay

which

could

be

caused

by

transporting

a

message

since

we

are

not

interested

in

the

timing

behavior

of

the

medium

However

we

plug

a

receiver

out

of

the

box

in

our

system

which

as

the

sender

can

also

handle

unreliable

media

The

receiver

works

in

the

following

fashion

It

waits

to

receive

a

message

from

the

medium

However

if

no

message

is

offered

from

the

medium

then

the

receiver

may

timeout

and

send

a

failure

message

back

to

the

sender

A

received

message

is

acknowledged

and

delivered

to

the

environment

before

the

receiver

is

ready

to

accept

a

new

message

The

point

of

this

example

is

that

Protocol

can

deadlock

when

we

interprete

the

operators

as

in

PMC

also

if

the

prefix

operator

is

interpreted

as

relaxed

prefix

i.e.

the

semantics

for

prefixing

is

as

in

TPLmc

One

path

to

a

deadlock

which

is

a

state

without

outgoing

transitions

is

given

by

performing

the

action

send

a

synchronization

on

s

and

a

timeout

on

oeR

The

reason

for

this

is

that

the

receiver

can

choose

to

timeout

although

a

message

is

offered

from

the

medium

However

in

TPLmc

the

localized

maximal

progress

assumption

forces

the

synchronization

on

r

to

occur

such

that

the

timeout

on

oeR

is

preempted

This

shows

that

the

new

temporal

process

algebra

TPLmc

is

more

suitable

for

verifying

systems

than

PMC

Another

example

showing

the

same

phenomenon

as

above

is

the

well-known

Alternating

Bit

Protocol

In

the

following

sections

we

develop

a

semantic

theory

for

TPLmc

Temporal

Strong

Bisimulation

In

this

section

we

present

a

congruence

on

TPLmc

processes

which

is

based

on

bisimulation

-LSB-

-RSB-

Our

aim

is

to

characterize

the

largest

congruence

contained

in

the

standard

strong

bisimulation

-LSB-

-RSB-

where

we

treat

timed

actions

as

any

other

action

Definition

-LRB-

Naive

Strong

Bisimulation

-RRB-

A

symmetric

relation

R

P

P

is

called

naive

strong

bisimulation

if

for

every

hP

Qi

R

A

and

oe

T

the

following

conditions

hold

P

P

implies

Q

and

hP

R

P

oe

P

implies

Q

oe

and

hP

R

We

write

P

Q

if

there

exists

a

naive

strong

bisimulation

R

such

that

hP

Qi

R

It

is

straightforward

to

establish

that

is

the

largest

naive

strong

bisimulation

and

that

is

an

equivalence

relation

Unfortunately

is

not

a

congruence

which

is

a

necessary

requirement

for

an

equivalence

relation

to

be

suitable

for

compositional

reasoning

The

lack

of

compositionality

is

demonstrated

by

the

following

example

involving

the

parallel

operator

We

have

a

a

oe

but

a

j

-LRB-

a

oe

-RRB-

-LRB-

a

oe

-RRB-

j

-LRB-

a

oe

-RRB-

since

the

latter

can

do

a

oe-transition

while

the

corresponding

oe-transition

of

the

former

process

is

preempted

because

the

a-transition

of

the

former

process

is

in

the

scope

of

the

timer

oe

The

above

observation

is

not

surprising

because

the

scope

of

timers

has

influence

on

the

preemption

of

transitions

and

consequently

on

the

bisimulation

Thus

in

order

to

find

the

largest

congruence

relation

contained

in

we

have

to

take

the

scopes

of

timers

into

account

In

the

following

we

define

which

repairs

the

congruence

defect

of

shown

above

Definition

-LRB-

Temporal

Strong

Bisimulation

-RRB-

A

symmetric

relation

R

P

P

is

a

temporal

strong

bisimulation

if

for

every

hP

Qi

R

A

and

oe

T

the

following

conditions

hold

P

P

implies

Q

and

hP

R

P

oe

P

implies

Q

oe

IIoe

-LRB-

Q

-RRB-

IIoe

-LRB-

P

-RRB-

and

hP

R

We

write

P

Q

if

there

exists

a

temporal

strong

bisimulation

R

such

that

hP

Qi

R

The

difference

between

this

definition

and

the

definition

of

is

the

additional

requirement

concerning

the

initial

action

sets

-LCB-

parameterized

in

the

appropriate

timer

-LCB-

in

the

second

condition

Intuitively

the

initial

action

set

of

a

process

with

respect

to

some

clock

is

a

measure

of

the

preemptive

power

of

the

process

relative

to

the

clock

Thus

the

second

condition

of

Definition

states

that

a

timed

action

oe

of

the

process

P

has

to

be

matched

by

the

same

timed

action

of

Q

Moreover

the

preemptive

power

of

Q

with

respect

to

oe

is

at

most

as

strong

as

the

preemptive

power

of

P

with

respect

to

oe

Theorem

The

relation

is

a

congruence

with

respect

to

all

operators

i.e.

for

all

TPLmc

contexts

C

we

have

P

Q

implies

C

-LSB-

P

-RSB-

C

-LSB-

Q

-RSB-

It

is

worth

mentioning

the

following

observation

Remark

If

we

would

adopt

the

semantics

of

and

the

prefix

operator

as

presented

in

-LSB-

-RSB-

where

time-stops

are

intended

then

the

relation

would

not

be

a

congruence

In

order

to

see

this

take

a

look

at

the

processes

o

oe

a

and

o

a

which

are

temporal

strong

bisimular

according

to

the

modified

semantics

However

bo

oe

a

coe

-LRB-

b

-RRB-

and

bo

a

coe

-LRB-

b

-RRB-

are

not

temporal

strong

bisimular

since

the

former

can

timeout

on

oe

to

become

the

process

b

The

latter

process

can

not

timeout

since

the

o-action

is

in

the

scope

of

oe

Therefore

such

a

step

would

contradict

our

maximal

progress

assumption

It

is

relatively

easy

to

see

that

a

necessary

condition

for

to

be

compositional

with

respect

to

the

timeout

operator

would

be

P

Q

implies

-LRB-

o

Ioe

-LRB-

P

-RRB-

o

Ioe

-LRB-

Q

-RRB-

-RRB-

However

this

condition

is

not

sufficient

since

it

is

in

conflict

with

the

compositionality

of

the

parallel

operator

As

an

example

take

the

processes

-LRB-

a

oe

-RRB-

j

b

and

a

j

b

and

the

context

C

-LSB-

X

-RSB-

df

X

j

-LRB-

a

oe

-RRB-

Thus

our

definition

of

the

semantics

of

and

the

prefix

operator

which

prohibits

time-stop

is

not

only

more

intuitive

than

the

PMC-semantics

but

also

better

treatable

from

a

technical

point

of

view

Before

we

continue

to

present

the

theoretical

results

concerning

temporal

strong

bisimulation

we

provide

an

example

Example

We

return

to

the

example

of

the

communication

protocol

introduced

in

Section

Considering

the

semantics

of

Protocol

it

is

easy

to

see

that

Protocol

Specs

where

Specs

def

send

oeS

o

o

-LRB-

o

receive

Specs

receive

o

Specs

-RRB-

The

next

theorem

states

the

main

result

of

this

section

Theorem

The

congruence

is

the

largest

congruence

contained

in

We

conclude

this

section

by

providing

a

logical

characterization

of

We

adapt

the

wellknown

Hennessy-Milner

Logic

-LSB-

-RSB-

by

changing

the

semantics

of

the

modal

operators

The

syntax

of

the

logic

we

use

is

defined

by

the

following

BNF

where

L

A

n

fog

tt

j

j

j

h

i

j

hoe

Li

The

set

of

all

formulae

which

can

be

generated

by

the

BNF

above

is

denoted

by

F

and

ranged

over

by

For

convenience

we

also

introduce

the

following

dual

operators

tt

df

df

:-LRB-

-RRB-

-LSB-

-RSB-

df

h

i

-LRB-

-RRB-

and

-LSB-

oe

L

-RSB-

df

hoe

Li

-LRB-

-RRB-

Further

we

abbreviate

n

for

some

n

N

by

Vni

i

We

define

the

satisfaction

relation

j

P

F

between

processes

and

formulae

inductively

on

the

structure

of

formulae

P

j

tt

P

j

if

not

P

j

P

j

if

P

j

and

P

j

P

j

h

i

if

P

P

P

and

P

j

P

j

hoe

Li

if

P

P

oe

P

IIoe

-LRB-

P

-RRB-

L

and

P

j

Intuitively

P

satisfies

hoe

Li

if

P

possesses

a

oe-transition

to

a

process

satisfying

Moreover

the

preemptive

power

of

P

with

respect

to

the

clock

oe

may

be

at

most

L

The

above

defined

logic

characterizes

temporal

strong

bisimulation

Theorem

-LRB-

Characterization

of

-RRB-

Let

P

Q

P

We

have

P

Q

if

and

only

if

f

F

j

P

j

g

f

F

j

Q

j

g

Temporal

Observation

Congruence

The

semantic

congruence

developed

in

the

previous

section

is

too

strong

for

verifying

systems

in

practice

Temporal

strong

bisimulation

requires

that

two

equivalent

systems

have

to

match

exactly

each

others

transitions

even

those

labeled

with

internal

actions

Therefore

we

want

to

abstract

from

internal

actions

and

develop

a

semantic

congruence

from

the

point

of

view

of

an

external

observer

Our

approach

follows

the

lines

of

-LSB-

-RSB-

We

start

off

with

the

definition

of

a

naive

temporal

weak

bisimulation

which

abstracts

from

internal

actions

This

relation

is

an

adaption

of

observation

equivalence

-LSB-

-RSB-

Definition

-LRB-

Naive

Temporal

Weak

Transition

Relation

-RRB-

We

define

df

ffl

if

o

and

df

otherwise

ffl

=-RRB-

df

o

=-RRB-

df

ffl

=-RRB-

ffi

ffi

ffl

=-RRB-

oe

=-RRB-

df

ffl

=-RRB-

ffi

oe

ffi

ffl

=-RRB-

Now

we

define

naive

temporal

weak

bisimulation

as

follows

Definition

-LRB-

Naive

Temporal

Weak

Bisimulation

-RRB-

A

symmetric

relation

R

P?P

is

a

naive

temporal

weak

bisimulation

if

for

every

hP

Qi

R

A

and

oe

T

the

following

conditions

hold

P

P

implies

Q

=-RRB-

and

hP

R

P

oe

P

implies

Q

oe

=-RRB-

and

hP

R

We

write

P

ss

Q

if

there

exists

a

naive

temporal

weak

bisimulation

R

such

that

hP

Qi

R

Since

no

initial

action

sets

are

considered

it

is

easy

to

see

that

ss

is

not

a

congruence

In

order

to

get

closer

to

our

goal

to

define

a

temporal

observation

congruence

we

redefine

the

weak

transition

relation

for

timed

actions

Definition

-LRB-

Temporal

Weak

Transition

Relation

-RRB-

We

introduce

the

following

notation

where

L

M

A

n

fog

P

ffl

=-RRB-

P

iff

P

ffl

=-RRB-

P

P

=-RRB-

P

iff

P

=-RRB-

P

P

oe

=-RRB-

L

MP

iff

P

ffl

=-RRB-

P

oe

ffi

ffl

=-RRB-

P

IIoe

-LRB-

P

-RRB-

L

and

II

-LRB-

P

-RRB-

M

In

the

remainder

we

drop

the

operator

ffi

which

denotes

the

relation

product

Recall

that

the

visible

initial

action

set

of

a

process

-LRB-

with

respect

to

a

clock

-RRB-

is

a

measure

for

its

preemptive

power

There

are

two

slightly

different

perspectives

of

preemption

which

are

encoded

in

the

sets

L

and

M

in

the

definition

of

P

oe

=-RRB-

L

MP

respectively

Whereas

L

is

concerned

with

the

influence

of

the

environment

i.e.

a

parallel

context

on

the

timed

action

oe

the

set

M

reflects

the

impact

of

P

on

potential

synchronization

partners

-LRB-

cf.

Rule

tCom

-RRB-

Accordingly

we

define

the

following

notion

of

temporal

weak

bisimulation

Definition

-LRB-

Temporal

Weak

Bisimulation

-RRB-

A

symmetric

relation

R

P

P

is

a

temporal

weak

bisimulation

if

for

every

hP

Qi

R

A

and

oe

T

the

following

conditions

hold

P

P

implies

Q

=-RRB-

and

hP

R

P

oe

P

implies

Q

oe

=-RRB-

L

L

IIoe

-LRB-

P

-RRB-

M

II

-LRB-

P

-RRB-

and

hP

R

We

write

P

ss

Q

if

there

exists

a

temporal

weak

bisimulation

R

such

that

hP

Qi

R

From

this

definition

we

may

conclude

that

ss

is

the

largest

temporal

weak

bisimulation

and

that

ss

is

an

equivalence

relation

Moreover

we

have

the

following

proposition

Proposition

The

equivalence

relation

ss

is

a

congruence

with

respect

to

all

TPLmc

operators

except

the

summation

operator

the

timeout

operator

and

recursion

The

reason

for

the

non-compositionality

of

the

summation

and

the

recursion

operators

is

similar

to

that

with

respect

to

observation

equivalence

in

CCS

-LSB-

-RSB-

In

order

to

see

why

ss

is

not

compositional

with

respect

to

the

timeout

operator

take

a

look

at

the

processes

and

o

which

are

temporal

weak

bisimular

and

the

context

C

-LSB-

X

-RSB-

dfbXcoe

-LRB-

a

-RRB-

Observe

that

C

-LSB-

-RSB-

can

engage

in

a

oe-transition

but

C

-LSB-

o

-RSB-

can

not

because

o

Ioe

-LRB-

o

-RRB-

The

summation

fix

presented

in

-LSB-

-RSB-

is

not

sufficient

in

order

to

achieve

a

congruence

relation

This

is

first

because

of

the

same

reason

that

naive

strong

bisimulation

is

not

a

congruence

with

respect

to

parallel

composition

in

TPLmc

and

second

because

of

the

semantics

of

the

timeout

operator

Definition

-LRB-

Temporal

Observation

Congruence

-RRB-

We

define

P

ss

Q

if

for

all

A

and

oe

T

the

following

conditions

hold

P

P

implies

Q

=-RRB-

and

P

ss

P

oe

P

implies

Q

oe

ffl

=-RRB-

IIoe

-LRB-

Q

-RRB-

IIoe

-LRB-

P

-RRB-

II

-LRB-

Q

-RRB-

II

-LRB-

P

-RRB-

and

P

ss

Q

implies

P

=-RRB-

P

and

P

ss

Q

oe

implies

P

oe

ffl

=-RRB-

P

IIoe

-LRB-

P

-RRB-

IIoe

-LRB-

Q

-RRB-

II

-LRB-

P

-RRB-

II

-LRB-

Q

-RRB-

and

P

ss

The

timeout

operator

is

also

responsible

that

a

oe-transition

has

to

be

matched

by

a

weak

oetransition

not

having

any

leading

o

's

E.g.

the

processes

oe

and

o

oe

are

not

observation

congruent

since

the

context

C

-LSB-

X

-RSB-

dfbXcoe

-LRB-

a

-RRB-

distinguishes

them

Again

we

take

a

look

at

our

example

of

the

communication

protocol

Example

Let

Protocol

be

the

communication

protocol

introduced

in

Section

and

define

Specw

def

send

oeS

receive

Spec

Then

we

have

Protocol

ss

Specw

Since

both

Protocol

and

Specw

are

stable

i.e.

they

can

initially

engage

only

in

visible

actions

it

is

by

Definitions

and

sufficient

to

show

that

Protocol

ss

Specw

Consider

the

following

relation

R

where

L

dffs

r

sack

rack

sfail

rfailg

R

df

f

hProtocol

Specwi

h

-LRB-

oeS

S

j

Medium

j

Receiver

-RRB-

n

L

oeS

Si

h

-LRB-

S

j

Medium

j

Receiver

-RRB-

n

L

receive

Specwi

h

-LRB-

-LRB-

rack

Sender

rfail

S

-RRB-

j

r

Medium

j

Receiver

-RRB-

n

L

receive

Specwi

h

-LRB-

-LRB-

rack

Sender

rfail

S

-RRB-

j

Medium

j

R

-RRB-

n

L

receive

Specwi

h

-LRB-

-LRB-

rack

Sender

rfail

S

-RRB-

j

rack

Medium

j

receive

R

-RRB-

n

L

receive

Specwi

h

-LRB-

Sender

j

Medium

j

receive

R

-RRB-

n

L

receive

Specwi

h

-LRB-

-LRB-

rack

Sender

rfail

S

-RRB-

j

rack

Medium

j

R

-RRB-

n

L

Specwi

g

Then

the

symmetric

closure

of

R

is

a

temporal

weak

bisimulation

which

includes

the

pair

hProtocol

Specwi

We

leave

it

to

the

interested

reader

to

check

that

R

is

indeed

a

temporal

weak

bisimulation

according

to

Definition

Now

we

are

able

to

present

the

main

theorem

of

this

section

Theorem

The

relation

ss

is

the

largest

congruence

contained

in

ss

We

want

to

conclude

this

section

by

a

remark

on

the

logical

characterization

of

ss

Defining

a

suitable

logic

can

simply

be

done

by

replacing

the

hoe

Li

operators

from

the

logic

in

the

previous

section

by

new

operators

hhoe

L

Mii

where

a

process

P

P

satisfies

the

formulae

hhoe

L

Mii

if

there

exists

a

process

P

P

such

that

P

oe

=-RRB-

L

MP

and

P

j

Additionally

the

operators

h

i

have

to

be

replaced

by

operators

hh

ii

We

define

P

j

hh

ii

if

P

:P

=-RRB-

P

and

P

j

The

proof

that

the

new

logic

characterizes

ss

can

be

done

along

the

lines

of

-LSB-

-RSB-

Conclusions

and

Future

Work

We

have

presented

a

temporal

process

algebra

with

multiple

clocks

and

localized

maximal

progress

assumption

which

is

closely

related

to

the

process

algebras

TPL

and

PMC

Whereas

TPL

does

not

deal

with

multiple

clocks

and

the

semantics

of

PMC

does

not

ensure

maximal

progress

our

process

algebra

combines

both

features

In

contrast

to

PMC

we

concentrate

in

defining

an

intuitive

operational

semantics

and

provide

a

semantic

equivalence

in

terms

of

bisimulations

The

characterizations

of

the

largest

congruences

in

the

usual

strong

and

weak

bisimulation

are

of

special

importance

for

compositional

reasoning

which

underlies

most

of

the

existing

verification

techniques

Future

work

should

especially

focus

on

two

aspects

On

the

one

hand

an

adaption

of

standard

partitioning

algorithms

-LSB-

-RSB-

to

compute

temporal

strong

and

weak

equivalence

is

necessary

in

order

to

incorporate

TPLmc

in

automatic

verification

tools

e.g.

the

NCSU

Concurrency

Workbench

On

the

other

hand

an

axiomatic

characterization

of

the

behavioral

relations

would

support

a

better

understanding

of

the

underlying

semantic

theory

and

simplify

a

comparison

with

other

temporal

process

algebras

Acknowledgments

The

second

author

would

like

to

thank

V.

Natarajan

for

many

helpful

discussions

References

-LSB-

-RSB-

J.

Leach

Albert

B.

Monien

and

M.

Rodr?iguez

Artalejo

editors

Automata

Languages

and

Programming

-LRB-

ICALP

-RRB-

volume

of

Lecture

Notes

in

Computer

Science

Madrid

July

Springer-Verlag

-LSB-

-RSB-

H.R.

Andersen

and

M.

Mendler

Complete

axiomatization

of

observational

congruence

for

PMC

Technical

Report

ID-TR

Department

of

Computer

Science

Technical

University

of

Denmark

December

-LSB-

-RSB-

H.R.

Andersen

and

M.

Mendler

A

process

algebra

with

multiple

clocks

Technical

Report

ID

TR

Department

of

Computer

Science

Technical

University

of

Denmark

August

-LSB-

-RSB-

J.C.M.

Baeten

and

W.P.

Weijland

Process

Algebra

volume

of

Cambridge

Tracts

in

Theoretical

Computer

Science

Cambridge

University

Press

Cambridge

England

-LSB-

-RSB-

R.N.

Bol

and

J.F.

Groote

The

meaning

of

negative

premises

in

transition

system

specifications

In

Albert

et

al.

-LSB-

-RSB-

pages

-LCB-

-LSB-

-RSB-

J.

Camilleri

and

G.

Winskel

CCS

with

priority

choice

In

Sixth

Annual

Symposium

on

Logic

in

Computer

Science

-LRB-

LICS

-RRB-

pages

-LCB-

Amsterdam

July

IEEE

Computer

Society

Press

-LSB-

-RSB-

R.

Cleaveland

Analyzing

concurrent

systems

using

the

Concurrency

Workbench

In

P.E.

Lauer

editor

Functional

Programming

Concurrency

Simulation

and

Automated

Reasoning

volume

of

Lecture

Notes

in

Computer

Science

pages

-LCB-

Springer-Verlag

-LSB-

-RSB-

R.

Cleaveland

and

M.C.B.

Hennessy

Priorities

in

process

algebra

Information

and

Computation

-LRB-

-RRB-

-LCB-

July/August

-LSB-

-RSB-

R.

Cleaveland

G.

L?uttgen

and

V.

Natarajan

A

process

algebra

with

distributed

priorities

Technical

Report

North

Carolina

State

University

March

-LSB-

-RSB-

R.

Cleaveland

J.

Parrow

and

B.

Steffen

The

Concurrency

Workbench

A

semantics-based

tool

for

the

verification

of

finite-state

systems

ACM

Transactions

on

Programming

Languages

and

Systems

-LRB-

-RRB-

-LCB-

January

-LSB-

-RSB-

W.

Elseaidy

R.

Cleaveland

and

J.

Baugh

Verifying

an

intelligent

structure

control

system

A

case

study

In

Proceedings

of

the

Real-Time

Systems

Symposium

pages

-LCB-

San

Juan

Puerto

Rico

December

IEEE

Computer

Society

Press

-LSB-

-RSB-

M.C.B.

Hennessy

Algebraic

Theory

of

Processes

MIT

Press

Boston

-LSB-

-RSB-

M.C.B.

Hennessy

and

T.

Regan

A

process

algebra

for

timed

systems

Technical

Report

University

of

Sussex

Brighton

England

April

-LSB-

-RSB-

C.A.R.

Hoare

Communicating

Sequential

Processes

Prentice-Hall

London

-LSB-

-RSB-

P.

Kanellakis

and

S.A.

Smolka

CCS

expressions

finite

state

processes

and

three

problems

of

equivalence

Information

and

Computation

-LRB-

-RRB-

-LCB-

May

-LSB-

-RSB-

R.

Milner

A

Calculus

of

Communicating

Systems

volume

of

Lecture

Notes

in

Computer

Science

Springer-Verlag

Berlin

-LSB-

-RSB-

R.

Milner

Communication

and

Concurrency

Prentice-Hall

London

-LSB-

-RSB-

F.

Moller

and

C.

Tofts

A

temporal

calculus

of

communicating

systems

In

J.C.M.

Baeten

and

J.W.

Klop

editors

CONCUR

volume

of

Lecture

Notes

in

Computer

Science

pages

-LCB-

Amsterdam

August

Springer-Verlag

-LSB-

-RSB-

R.

Paige

and

R.E.

Tarjan

Three

partition

refinement

algorithms

SIAM

Journal

of

Computing

-LRB-

-RRB-

-LCB-

December

-LSB-

-RSB-

D.M.R.

Park

Concurrency

and

automata

on

infinite

sequences

In

Proceedings

of

G.I.

Conference

on

Theoretical

Computer

Science

volume

of

Lecture

Notes

in

Computer

Science

pages

-LCB-

Springer-Verlag

-LSB-

-RSB-

G.D.

Plotkin

A

structural

approach

to

operational

semantics

Technical

Report

Computer

Science

Department

Aarhus

University

Denmark

-LSB-

-RSB-

D.

Sangiorgi

and

R.

Milner

The

problem

of

weak

bisimulation

up

to

In

R.

Cleaveland

editor

CONCUR

volume

of

Lecture

Notes

in

Computer

Science

pages

-LCB-

Stony

Brook

New

York

August

Springer-Verlag

-LSB-

-RSB-

R.

van

Glabbeek

S.A.

Smolka

B.

Steffen

and

C.M.N.

Tofts

Reactive

generative

and

stratified

models

of

probabilistic

processes

In

Fifth

Annual

Symposium

on

Logic

in

Computer

Science

-LRB-

LICS

-RRB-

pages

-LCB-

Philadelphia

June

IEEE

Computer

Society

Press

-LSB-

-RSB-

W.

Yi

CCS

time

an

interleaving

model

for

real

time

systems

In

Albert

et

al.

-LSB-

-RSB-

pages

-LCB-

A

Congruence

Proofs

A.

Temporal

Strong

Bisimulation

In

this

section

we

present

an

outline

of

the

proof

that

is

a

congruence

Since

the

semantics

of

all

operators

beside

prefixing

parallel

composition

and

timeout

is

the

same

as

in

PMC

we

obtain

the

compositionality

relatively

easy

by

adapting

the

results

presented

in

-LSB-

-RSB-

under

consideration

of

the

definition

of

visible

initial

action

sets

with

respect

to

the

scope

of

timed

actions

Therefore

we

concentrate

on

the

more

interesting

cases

Lemma

A.

P

Q

implies

P

j

R

Q

j

R

for

all

P

Q

R

P

Proof

According

to

the

definition

of

it

is

sufficient

to

prove

that

R

dffhP

j

R

Q

j

Ri

j

P

Qg

is

a

temporal

strong

bisimulation

The

case

P

j

R

S

for

some

A

and

S

P

is

the

same

as

the

corresponding

case

in

CCS

-LSB-

-RSB-

and

therefore

we

omit

it

here

Let

P

j

R

oe

S

for

some

oe

T

and

S

P

According

to

the

only

applicable

semantic

Rule

tCom

we

know

that

P

oe

P

for

some

P

P

IIoe

-LRB-

P

-RRB-

II

-LRB-

R

-RRB-

R

oe

for

some

P

IIoe

-LRB-

R

-RRB-

II

-LRB-

P

-RRB-

and

S

P

j

Since

P

Q

there

exists

a

process

P

such

that

Q

oe

IIoe

-LRB-

Q

-RRB-

IIoe

-LRB-

P

-RRB-

and

P

Additionally

P

Q

implies

that

II

-LRB-

P

-RRB-

II

-LRB-

Q

-RRB-

Therefore

we

may

conclude

that

Q

j

R

oe

j

by

Rule

tCom

Moreover

hP

R

holds

and

we

have

finished

the

proof

Now

we

deal

with

the

timeout

operator

Lemma

A.

P

Q

and

R

S

imply

bPcoe

-LRB-

R

-RRB-

bQcoe

-LRB-

S

-RRB-

for

all

processes

P

Q

R

S

P

and

all

timed

actions

oe

T

Proof

Let

P

Q

R

S

P

satisfying

P

Q

and

R

S

Moreover

let

oe

T

We

show

that

bPcoe

-LRB-

R

-RRB-

bQcoe

-LRB-

S

-RRB-

Let

bPcoe

-LRB-

R

-RRB-

P

for

some

P

P

According

to

the

only

applicable

semantic

Rule

TO

of

TPLmc

we

know

that

P

P

Since

P

Q

holds

the

existence

of

some

P

such

that

Q

and

P

is

guaranteed

By

Rule

TO

we

may

conclude

that

bQcoe

-LRB-

S

-RRB-

Let

bPcoe

-LRB-

R

-RRB-

P

for

some

P

P

where

oe

Thus

P

P

by

Rule

Since

P

Q

it

follows

that

Q

-LRB-

Q

-RRB-

-LRB-

P

-RRB-

and

P

for

some

P

According

to

Rule

we

conclude

that

bQcoe

-LRB-

S

-RRB-

Moreover

we

have

-LRB-

bQcoe

-LRB-

S

-RRB-

-RRB-

-LRB-

bPcoe

-LRB-

R

-RRB-

-RRB-

because

-LRB-

bQcoe

-LRB-

S

-RRB-

-RRB-

-LRB-

Q

-RRB-

and

-LRB-

bPcoe

-LRB-

R

-RRB-

-RRB-

-LRB-

P

-RRB-

Finally

let

bPcoe

-LRB-

R

-RRB-

oe

P

for

some

P

P

By

Rule

we

know

that

P

R

and

o

Ioe

-LRB-

Q

-RRB-

Moreover

Proposition

guarantees

that

P

oe

Because

P

Q

also

Q

oe

is

satisfied

Thus

o

Ioe

-LRB-

Q

-RRB-

by

our

maximal

progress

assumption

-LRB-

cf.

Proposition

-RRB-

and

bQcoe

-LRB-

R

-RRB-

oe

R

The

observation

R

R

concludes

this

case

Also

the

prefixing

of

timed

actions

respects

the

compositionality

of

The

compositionality

of

the

ignore

operator

with

respect

to

temporal

strong

bisimulation

is

trivial

since

IIoe

-LRB-

P

oe

-RRB-

for

all

processes

P

P

However

the

compositionality

of

recursion

requires

to

introduce

a

notion

of

temporal

strong

bisimulation

up

to

This

can

be

done

according

to

the

lines

of

CCS

with

respect

to

strong

bisimulation

-LRB-

cf.

-LSB-

-RSB-

-RRB-

A.

Temporal

Weak

Congruence

In

this

section

we

show

that

ss

is

the

largest

congruence

contained

in

ss

We

start

off

by

proving

that

ss

is

in

fact

a

congruence

Most

cases

are

standard

and

can

be

checked

along

the

lines

of

-LSB-

-RSB-

Therefore

we

restrict

ourselves

to

the

more

interesting

proof

parts

Lemma

A.

P

ss

Q

implies

P

j

R

ss

Q

j

R

for

all

P

Q

R

P

Proof

According

to

the

definition

of

ss

it

is

sufficient

to

prove

that

R

dffhP

j

R

Q

j

Ri

j

P

ss

Qg

is

a

temporal

weak

bisimulation

The

case

where

P

j

R

S

for

some

S

P

and

A

is

standard

Consider

the

case

P

j

R

oe

S

for

some

S

P

and

oe

T

By

the

only

applicable

Rule

tCom

we

know

that

P

oe

P

for

some

P

P

IIoe

-LRB-

P

-RRB-

II

-LRB-

R

-RRB-

R

oe

for

some

P

IIoe

-LRB-

R

-RRB-

II

-LRB-

P

-RRB-

and

S

P

j

Since

P

ss

Q

we

know

of

the

existence

of

a

process

P

such

that

Q

oe

=-RRB-

L

and

P

ss

where

L

IIoe

-LRB-

P

-RRB-

and

M

II

-LRB-

P

-RRB-

This

means

that

Q

ffl

=-RRB-

oe

ffl

=-RRB-

IIoe

-LRB-

-RRB-

L

and

II

-LRB-

-RRB-

M

for

some

P

First

observe

that

-LRB-

IIoe

-LRB-

-RRB-

II

-LRB-

R

-RRB-

-RRB-

-LRB-

IIoe

-LRB-

P

-RRB-

II

-LRB-

R

-RRB-

-RRB-

and

-LRB-

IIoe

-LRB-

R

-RRB-

II

-LRB-

-RRB-

-RRB-

-LRB-

IIoe

-LRB-

R

-RRB-

II

-LRB-

P

-RRB-

-RRB-

Applying

our

semantic

rules

again

we

conclude

that

Q

j

R

ffl

=-RRB-

j

R

oe

j

ffl

=-RRB-

j

since

II

-LRB-

j

R

-RRB-

II

-LRB-

-RRB-

-LSB-

II

-LRB-

R

-RRB-

II

-LRB-

P

-RRB-

-LSB-

II

-LRB-

R

-RRB-

II

-LRB-

P

j

R

-RRB-

and

IIoe

-LRB-

j

R

-RRB-

IIoe

-LRB-

-RRB-

-LSB-

IIoe

-LRB-

R

-RRB-

IIoe

-LRB-

P

-RRB-

-LSB-

IIoe

-LRB-

R

-RRB-

IIoe

-LRB-

P

j

R

-RRB-

holds

Obviously

we

also

have

hP

j

j

R

Observe

that

in

the

proofs

of

the

standard

cases

of

the

above

lemma

a

o-derivation

is

matched

by

at

least

one

o-transition

Moreover

R

is

defined

symmetrically

Therefore

ss

is

compositional

with

respect

to

the

parallel

operator

too

In

the

following

we

establish

the

compositionality

of

ss

with

respect

to

the

timeout

operator

Lemma

A.

P

ss

Q

and

R

ss

S

imply

bPcoe

-LRB-

R

-RRB-

ss

bQcoe

-LRB-

S

-RRB-

for

all

processes

P

Q

R

S

P

and

all

timed

actions

oe

T

Proof

Let

P

Q

R

S

P

satisfying

P

ss

Q

and

R

ss

S

Moreover

let

oe

T

We

show

that

bPcoe

-LRB-

R

-RRB-

ss

bQcoe

-LRB-

S

-RRB-

The

case

where

bPcoe

-LRB-

R

-RRB-

P

for

some

A

and

P

P

is

straightforward

Therefore

we

directly

consider

the

non-standard

case

where

bPcoe

-LRB-

R

-RRB-

P

for

some

P

P

and

oe

According

to

the

only

applicable

Rule

we

have

P

P

Since

P

ss

Q

there

exists

some

P

such

that

Q

ffl

=-RRB-

-LRB-

Q

-RRB-

-LRB-

P

-RRB-

II

-LRB-

Q

-RRB-

II

-LRB-

P

-RRB-

and

P

ss

Applying

Rule

again

we

conclude

bQcoe

-LRB-

S

-RRB-

ffl

=-RRB-

Moreover

the

necessary

inclusion

conditions

hold

since

II

-LRB-

bQcoe

-LRB-

S

-RRB-

-RRB-

II

-LRB-

Q

-RRB-

II

-LRB-

P

-RRB-

II

-LRB-

bP

coe

-LRB-

R

-RRB-

-RRB-

and

-LRB-

bQcoe

-LRB-

S

-RRB-

-RRB-

-LRB-

Q

-RRB-

-LRB-

P

-RRB-

-LRB-

bPcoe

-LRB-

R

-RRB-

-RRB-

We

also

have

ss

because

ss

is

an

equivalence

relation

Finally

let

bPcoe

-LRB-

R

-RRB-

oe

P

for

some

P

P

By

Rule

we

know

that

P

R

Since

P

ss

Q

we

conclude

the

existence

of

some

P

such

that

Q

oe

ffl

=-RRB-

IIoe

-LRB-

Q

-RRB-

IIoe

-LRB-

P

-RRB-

II

-LRB-

Q

-RRB-

II

-LRB-

P

-RRB-

and

P

ss

Because

of

Proposition

and

Rule

we

have

bQcoe

-LRB-

S

-RRB-

oe

S

The

required

initial

action

set

inclusions

follow

similarly

to

the

case

above

Additionally

we

also

have

P

R

ss

S

Because

of

symmetry

reasons

we

have

finished

the

proof

In

order

to

show

that

ss

is

compositional

with

respect

to

recursion

we

need

to

define

a

notion

of

temporal

weak

bisimulation

up

to

ss

-LSB-

-RSB-

With

this

definition

the

proof

is

completely

standard

-LRB-

cf.

-LSB-

-RSB-

-RRB-

Definition

A.

-LRB-

Temporal

Weak

Bisimulation

up

to

ss

-RRB-

A

relation

R

P

P

is

a

temporal

weak

bisimulation

up

to

ss

if

for

every

hP

Qi

R

A

and

oe

T

the

following

conditions

hold

P

P

implies

Q

=-RRB-

and

P

R

ss

P

oe

P

implies

Q

oe

=-RRB-

L

L

IIoe

-LRB-

P

-RRB-

M

II

-LRB-

P

-RRB-

and

P

R

ss

Q

implies

P

=-RRB-

P

and

P

ss

R

Q

oe

implies

P

oe

=-RRB-

L

MP

L

IIoe

-LRB-

Q

-RRB-

M

II

-LRB-

Q

-RRB-

and

P

ss

R

As

expected

this

notion

satisfies

the

property

that

if

R

is

a

temporal

weak

bisimulation

up

to

ss

then

R

ss

Now

we

prove

another

property

of

ss

which

turns

out

to

be

useful

in

the

next

section

Proposition

A.

The

congruence

ss

is

the

largest

congruence

contained

in

ss

Proof

Since

the

relation

ss

is

a

congruence

it

is

sufficient

to

show

that

for

all

TPLmc-contexts

C

and

processes

P

Q

P

satisfying

C

-LSB-

P

-RSB-

ss

C

-LSB-

Q

-RSB-

we

have

P

ss

Q

Moreover

it

is

sufficient

to

deal

with

the

contexts

Coe

-LSB-

X

-RSB-

dfbX

c

coe

-LRB-

d

-RRB-

where

c

d

S

-LRB-

P

-RRB-

-LSB-

S

-LRB-

Q

-RRB-

and

oe

T

Let

Coe

-LSB-

P

-RSB-

P

for

some

P

P

some

A

and

some

oe

T

Since

P

ss

Q

there

exists

a

process

P

satisfying

C

-LSB-

Q

-RSB-

=-RRB-

and

P

ss

We

know

that

Coe

-LSB-

Q

-RSB-

because

P

ss

and

P

is

not

capable

of

performing

the

distinguished

c-transition

Therefore

the

matching

step

is

necessary

even

if

o

Now

let

Coe

-LSB-

P

-RSB-

oe

S

for

some

oe

T

By

Rule

we

know

that

o

Ioe

-LRB-

P

-RRB-

and

S

d

Because

of

the

fact

that

Coe

-LSB-

P

-RSB-

ss

Coe

-LSB-

Q

-RSB-

we

have

S

ss

T

and

Coe

-LSB-

Q

-RSB-

oe

=-RRB-

L

MT

where

L

IIoe

-LRB-

Coe

-LSB-

P

-RSB-

-RRB-

and

M

II

-LRB-

Coe

-LSB-

P

-RSB-

-RRB-

Since

d

is

a

distinguished

action

we

may

conclude

by

Rule

that

T

d

Coe

-LSB-

Q

-RSB-

oe

d

and

o

Ioe

-LRB-

Q

-RRB-

as

desired

Similarly

the

symmetric

properties

hold

too

Thus

all

conditions

of

Definition

are

satisfied

and

we

obtain

P

ss

Q

as

desired

B

Proof

of

the

Main

Theorems

In

this

section

we

proof

Theorems

and

which

state

that

is

the

largest

congruence

contained

in

and

ss

is

the

largest

one

contained

in

ss

respectively

In

both

proofs

we

use

-LRB-

parts

of

-RRB-

the

following

fact

from

universal

algebra

Fact

B.

Let

X

and

Y

be

equivalence

relations

Then

the

largest

congruence

X

in

X

exists

X

is

characterized

by

X

fhP

Qi

j

TPLmc-contexts

C

hC

-LSB-

P

-RSB-

C

-LSB-

Q

-RSB-

i

Xg

Moreover

if

X

Y

X

then

X

Y

In

the

following

we

construct

contexts

which

include

the

summation

operator

over

sorts

Since

TPLmc

just

provides

a

binary

summation

operator

i.e.

only

finite

summations

can

be

expressed

in

TPLmc

the

following

lemma

is

important

to

show

the

well-definedness

of

these

contexts

Lemma

B.

-LRB-

Finite

Sorts

-RRB-

Let

P

P

be

a

TPLmc

process

Then

the

sort

of

P

i.e.

the

set

of

actions

occurring

in

the

transition

system

for

P

is

finite

We

denote

the

sort

of

P

by

S

-LRB-

P

-RRB-

This

observation

is

an

immediate

consequence

of

the

fact

that

process

terms

are

finite

and

relabelings

f

satisfy

the

condition

jf

j

f

-LRB-

-RRB-

g

j

B.

Proof

of

Theorem

By

Theorem

we

know

already

that

the

relation

is

a

congruence

and

we

know

by

Fact

B.

that

the

largest

congruence

in

exists

Therefore

it

remains

to

show

that

P

Q

for

some

processes

P

Q

P

whenever

C

-LSB-

P

-RSB-

C

-LSB-

Q

-RSB-

for

all

TPLmc-contexts

C

For

this

it

suffices

to

consider

the

equivalence

relation

a

dffhP

Qi

j

CPQ

-LSB-

P

-RSB-

CPQ

-LSB-

Q

-RSB-

g

Here

using

the

abbreviation

S

df

S

-LRB-

P

-RRB-

-LSB-

S

-LRB-

Q

-RRB-

we

define

CPQ

-LSB-

X

-RSB-

df

X

j

HPQ

and

HPQ

def

X

L

S

oe

T

o

-LRB-

b

-LRB-

DL

oe

-RRB-

doe

L

coe

-LRB-

HPQ

-RRB-

-RRB-

Note

that

HPQ

is

well-defined

because

of

Lemma

B.

and

the

finiteness

of

T

Moreover

the

process

DL

is

defined

as

P

d

The

actions

doe

L

are

supposed

to

be

fresh

actions

i.e.

they

are

not

in

the

sorts

of

the

processes

P

and

Q

The

following

proposition

contains

the

necessary

inclusion

which

has

to

be

established

Proposition

B.

The

inclusion

a

holds

Proof

It

is

sufficient

to

show

that

a

is

a

temporal

strong

bisimulation

Let

P

Q

P

satisfying

P

a

Q

i.e.

by

the

definition

of

a

we

have

CPQ

-LSB-

P

-RSB-

CPQ

-LSB-

Q

-RSB-

In

the

following

we

consider

two

cases

distinguishing

if

the

process

P

performs

a

transition

labeled

with

an

action

in

A

or

in

T

This

transitions

of

P

lead

to

transitions

of

CPQ

-LSB-

P

-RSB-

According

to

the

definition

of

matching

sequences

have

to

exist

which

mimic

each

step

by

a

corresponding

transition

From

these

transitions

we

may

extract

additional

conditions

which

have

to

be

satisfied

according

to

the

semantics

of

TPLmc

Those

conditions

are

sufficient

to

conclude

that

a

is

a

temporal

strong

bisimulation

Case

Let

P

P

for

some

process

P

P

and

some

action

A

According

to

our

operational

semantics

we

have

CPQ

-LSB-

P

-RSB-

P

j

HPQ

P

j

HPQ

CPQ

-LSB-

P

-RSB-

This

transition

can

only

be

matched

by

a

corresponding

transition

of

the

process

Q

say

Q

for

some

process

P

This

is

even

true

in

the

case

o

because

the

o-successors

of

HPQ

have

the

distinguished

actions

doe

L

enabled

Therefore

we

have

CPQ

-LSB-

Q

-RSB-

Q

j

HPQ

j

HPQ

CPQ

-LSB-

-RSB-

and

CPQ

-LSB-

P

-RSB-

CPQ

-LSB-

-RSB-

Because

S

-LRB-

P

-RRB-

S

-LRB-

P

-RRB-

and

S

-LRB-

-RRB-

S

-LRB-

Q

-RRB-

also

CP

-LSB-

P

-RSB-

CP

-LSB-

-RSB-

holds

Thus

P

a

Case

Let

P

oe

P

for

some

process

P

P

and

some

timed

action

oe

T

As

illustrated

in

Figure

we

let

CPQ

-LSB-

P

-RSB-

perform

a

o-transition

to

P

j

Hoe

L

where

Hoe

L

dfb

-LRB-

DL

oe

-RRB-

doe

L

coe

-LRB-

HPQ

-RRB-

and

L

dffc

j

c

S

n

IIoe

-LRB-

P

-RRB-

g

Now

P

j

Hoe

L

can

perform

a

oe-transition

to

P

j

HPQ

according

to

Rule

tCom

The

process

CPQ

-LSB-

Q

-RSB-

has

to

match

the

first

step

by

a

o-transition

to

the

process

Q

j

Hoe

L

since

only

this

process

has

the

distinguished

action

doe

L

enabled

Now

we

take

a

closer

look

at

the

second

step

We

have

to

match

a

oe-transition

Therefore

Q

has

to

perform

a

oe-transition

to

some

process

P

and

the

process

Hoe

L

must

perform

its

only

P

j

HPQ

Q

j

HPQ

o

o

P

j

-LRB-

b

-LRB-

DL

doe

L

-RRB-

oecoe

-LRB-

HPQ

-RRB-

-RRB-

Q

j

-LRB-

b

-LRB-

DL

doe

L

-RRB-

oecoe

-LRB-

HPQ

-RRB-

-RRB-

oe

oe

P

j

HPQ

j

HPQ

Figure

Largest

congruence

proof

of

-LCB-

illustration

of

Case

oe-transition

to

the

state

HPQ

i.e.

Q

j

Hoe

L

oe

j

HPQ

CPQ

-LSB-

-RSB-

and

CPQ

-LSB-

P

-RSB-

CPQ

-LSB-

-RSB-

According

to

Rule

tCom

the

condition

IIoe

-LRB-

Q

-RRB-

II

-LRB-

Hoe

L

-RRB-

has

to

be

satisfied

Because

of

the

choice

of

L

this

implies

IIoe

-LRB-

Q

-RRB-

IIoe

-LRB-

P

-RRB-

Since

S

-LRB-

P

-RRB-

S

-LRB-

P

-RRB-

and

S

-LRB-

-RRB-

S

-LRB-

Q

-RRB-

it

follows

that

CP

-LSB-

P

-RSB-

CP

-LSB-

-RSB-

i.e.

P

a

as

desired

B.

Proof

of

Theorem

Here

we

make

a

stronger

use

of

Fact

B.

We

choose

X

ss

and

Y

ss

The

inclusion

ss

ss

follows

immediately

from

the

definition

of

the

naive

and

the

temporal

weak

transition

relation

In

order

to

apply

Fact

B.

we

have

to

establish

ss

ss

This

inclusion

turns

out

to

be

difficult

to

show

Therefore

we

define

the

equivalence

relation

ssa

dffhP

Qi

j

CPQ

-LSB-

P

-RSB-

ss

CPQ

-LSB-

Q

-RSB-

g

Here

abbreviating

S

-LRB-

P

-RRB-

-LSB-

S

-LRB-

Q

-RRB-

by

S

the

process

CPQ

-LSB-

X

-RSB-

represents

X

j

HPQ

where

HPQ

def

e

X

L

M

S

oe

T

o

-LRB-

bDL

doe

L

M

-LRB-

DM

oe

-RRB-

coe

-LRB-

HPQ

-RRB-

-RRB-

The

processes

HPQ

are

well-defined

because

of

Lemma

B.

and

the

finiteness

of

the

set

T

and

DL

and

DM

are

defined

by

P

d

and

P

d

respectively

The

actions

doe

L

M

are

supposed

to

be

fresh

actions

i.e.

they

are

not

in

the

sort

of

the

processes

P

and

Q

By

Fact

B.

we

may

immediately

conclude

that

ss

ssa

The

other

necessary

inclusion

can

be

established

by

using

the

following

proposition

Proposition

B.

The

inclusion

ssa

ss

holds

Proof

It

is

sufficient

to

show

that

ssa

is

a

temporal

weak

bisimulation

Let

P

Q

P

satisfying

P

ssa

Q

Case

Let

P

P

for

some

process

P

P

and

some

action

A

According

to

our

operational

semantics

we

may

derive

CPQ

-LSB-

P

-RSB-

P

j

HPQ

P

j

HPQ

CPQ

-LSB-

P

-RSB-

This

transition

can

only

be

matched

by

a

corresponding

weak

transition

of

the

process

Q

say

Q

=-RRB-

for

some

P

since

only

the

process

HPQ

has

the

distinguished

action

c

enabled

Therefore

we

have

CPQ

-LSB-

Q

-RSB-

Q

j

HPQ

=-RRB-

j

HPQ

CPQ

-LSB-

-RSB-

and

CPQ

-LSB-

P

-RSB-

ss

CPQ

-LSB-

-RSB-

Because

S

-LRB-

P

-RRB-

S

-LRB-

P

-RRB-

and

S

-LRB-

-RRB-

S

-LRB-

Q

-RRB-

also

CP

-LSB-

P

-RSB-

ss

CP

-LSB-

-RSB-

holds

Thus

P

ssa

Case

Let

P

oe

P

for

some

process

P

P

and

some

timed

action

oe

T

As

illustrated

in

Figure

we

let

CPQ

-LSB-

P

-RSB-

perform

a

o-transition

to

the

process

P

j

Hoe

L

M

where

Hoe

L

M

dfbDL

doe

L

M

-LRB-

DM

oe

-RRB-

coe

-LRB-

HPQ

-RRB-

-RRB-

L

dffc

j

c

S

n

II

-LRB-

P

-RRB-

g

and

M

dffc

j

c

S

n

IIoe

-LRB-

P

-RRB-

g

n

L

Now

P

j

Hoe

L

M

can

perform

a

oe-transition

to

P

j

HPQ

according

to

Rule

tCom

P

j

HPQ

ss

Q

j

HPQ

o

ffl

P

j

Hoe

L

M

ss

Q

j

Hoe

L

M

oe

oe

P

j

HPQ

ss

j

HPQ

Figure

Largest

congruence

proof

of

ss

-LCB-

illustration

of

Case

Consider

the

first

step

Since

CPQ

-LSB-

P

-RSB-

ss

CPQ

-LSB-

P

-RSB-

we

have

CPQ

ffl

=-RRB-

W

for

some

W

P

We

know

that

HPQ

has

to

perform

a

o-transition

to

Hoe

L

M

since

doe

L

M

is

a

distinguished

action

However

Q

may

be

able

to

perform

some

o-transitions

to

some

state

Q

P

i.e.

Q

ffl

=-RRB-

Q

and

P

j

Hoe

L

M

ss

Q

j

Hoe

L

M

Now

we

take

a

look

at

the

more

interesting

second

step

Since

P

j

Hoe

L

M

ss

Q

j

Hoe

L

M

we

know

that

some

W

P

exist

such

that

Q

j

Hoe

L

M

oe

=-RRB-

W

and

CPQ

-LSB-

P

-RSB-

ss

W

According

to

our

operational

semantics

Q

and

Hoe

L

M

have

to

perform

a

naive

weak

oe-transition

Since

e

is

a

distinguished

action

we

know

that

Hoe

L

M

oe

HPQ

Therefore

W

j

HPQ

for

some

process

P

such

that

Q

oe

=-RRB-

i.e.

t

N

i

s

j

t

Qs

j

P

Q

Qs

t

such

that

Qi

j

Hoe

L

M

o

Qi

j

Hoe

L

M

Qs

j

Hoe

L

M

oe

Qs

j

HPQ

and

Qs

j

j

HPQ

o

Qs

j

j

HPQ

According

to

the

Rule

tCom

the

following

conditions

must

be

satisfied

in

order

that

the

timed

action

oe

T

may

occur

IIoe

-LRB-

Qs

-RRB-

II

-LRB-

Hoe

L

M

-RRB-

which

implies

IIoe

-LRB-

Qs

-RRB-

IIoe

-LRB-

P

-RRB-

IIoe

-LRB-

Hoe

L

M

-RRB-

II

-LRB-

Qs

-RRB-

which

implies

II

-LRB-

Qs

-RRB-

II

-LRB-

P

-RRB-

We

have

shown

that

Q

oe

=-RRB-

L

according

to

the

definition

of

the

temporal

weak

transition

relation

We

also

have

CP

-LSB-

P

-RSB-

ss

CP

-LSB-

-RSB-

i.e.

P

ssa

since

CPQ

-LSB-

P

-RSB-

ss

CPQ

-LSB-

-RSB-

S

-LRB-

P

-RRB-

S

-LRB-

P

-RRB-

and

S

-LRB-

-RRB-

S

-LRB-

Q

-RRB-

Therefore

the

proof

is

finished

Now

we

are

able

to

put

our

proof

parts

together

in

order

to

obtain

Theorem

Proposition

A.

states

that

ss

is

the

largest

congruence

contained

in

ss

Moreover

ss

is

contained

in

ss

according

to

Proposition

B.

and

the

inclusion

ss

ssa

Therefore

we

may

conclude

by

Fact

B.

that

ss

ss

i.e.

ss

is

the

largest

congruence

contained

in

ss

Figure

depicts

the

proof

situation

where

an

arrow

from

some

relation

to

a

relation

means

that

ss

ss

ssa

ss

ss

oe

Figure

Situation

in

the

proof

of

Theorem

C

Proof

of

the

Logical

Characterization

of

In

this

section

we

prove

Theorem

Most

proof

parts

are

similar

to

the

corresponding

ones

presented

in

-LSB-

-RSB-

First

we

define

a

characterization

of

temporal

strong

bisimulation

for

finite-branching

transition

systems

over

A

-LSB-

T

A

transition

system

hP

A

-LSB-

T

P

i

is

called

finite-branching

if

the

set

fP

j

P

P

A

-LSB-

T

g

is

finite

for

all

reachable

states

P

of

the

process

P

Definition

C.

Let

hP

A

-LSB-

T

;P

i

and

hP

A

-LSB-

T

Qi

be

finite-branching

transition

systems

We

define

df

P

P

and

P

k

Q

for

some

k

N

if

the

following

properties

hold

P

P

implies

Q

and

P

k

P

oe

P

implies

Q

oe

IIoe

-LRB-

Q

-RRB-

IIoe

-LRB-

P

-RRB-

and

P

k

Q

implies

P

P

and

P

k

Q

oe

implies

P

oe

P

IIoe

-LRB-

P

-RRB-

IIoe

-LRB-

Q

-RRB-

and

P

k

The

proof

of

the

next

proposition

follows

the

lines

in

-LSB-

-RSB-

Note

that

for

all

processes

in

TPLmc

the

according

transition

systems

are

finite-branching

Proposition

C.

Let

P

Q

P

We

have

P

Q

if

and

only

if

P

k

Q

for

all

k

N

Now

we

are

able

to

prove

Theorem

By

Proposition

C.

it

is

sufficient

to

establish

the

following

two

lemmata

Lemma

C.

Let

P

Q

P

k

N

and

F

such

that

P

k

Q

and

P

j

Then

Q

j

holds

Proof

We

prove

the

lemma

by

induction

on

k

where

the

induction

step

is

divided

into

several

cases

according

to

the

structure

of

The

only

non-standard

case

is

hoe

Li

for

oe

T

and

L

A

n

fog

By

the

definition

of

j

we

conclude

the

existence

of

a

process

P

P

such

that

P

oe

P

IIoe

-LRB-

P

-RRB-

L

and

P

j

Since

P

k

Q

we

also

know

of

the

existence

of

some

P

such

that

Q

oe

IIoe

-LRB-

Q

-RRB-

IIoe

-LRB-

P

-RRB-

and

P

k

Thus

IIoe

-LRB-

Q

-RRB-

L

and

by

the

induction

hypothesis

that

j

Therefore

Q

j

hoe

Li

as

desired

Lemma

C.

Let

P

Q

P

and

k

N

such

that

P

k

Q

holds

It

exists

a

formula

F

such

that

P

j

but

Q

Proof

We

prove

this

lemma

by

induction

on

k

The

induction

base

is

trivial

since

the

premise

P

Q

does

not

hold

Now

let

k

and

P

k

Q

We

have

to

find

a

formula

F

such

that

P

j

and

Q

Since

P

k

Q

we

have

P

P

for

some

A

-LSB-

T

and

P

P

which

can

not

be

matched

by

a

step

of

Q

The

case

where

A

follows

the

standard

lines

Now

let

oe

T

i.e.

we

know

that

whenever

Q

oe

and

IIoe

-LRB-

Q

-RRB-

IIoe

-LRB-

P

-RRB-

then

P

k

Let

j

Q

oe

and

IIoe

-LRB-

Q

-RRB-

IIoe

-LRB-

P

-RRB-

g

fQi

j

i

Ig

for

some

index

set

I

Note

that

I

is

a

finite

set

because

the

transition

system

for

Q

is

finite-branching

By

induction

hypothesis

we

conclude

the

existence

of

formulae

i

for

i

I

such

that

P

j

i

and

Qi

i

Now

define

dfhoe

Li

V

i

where

L

df

IIoe

-LRB-

P

-RRB-

Because

of

the

choice

of

L

it

is

easy

to

see

that

P

j

Since

no

oe-derivative

of

Q

with

IIoe

-LRB-

Q

-RRB-

L

satisfies

V

i

we

have

Q

bisimulation
distributed systems
maximal progress assumption
multiple clocks
process algebras