October

c

Carlos

H.

C.

Duarte

A

Proof-Theoretic

Foundation

for

Actor

Specification

and

Verification

Carlos

H.

C.

Duarte

Department

of

Computing

Imperial

College

Queen

's

Gate

London

United

Kingdom

e-mail

Actors

has

been

regarded

as

a

promising

model

for

open

distributed

systems

Although

the

operational

semantics

of

actor

programs

has

already

been

studied

in

some

recent

work

means

of

reasoning

about

the

behaviour

of

communities

of

interconnected

actors

at

a

high

abstraction

level

are

still

lacking

In

this

paper

we

argue

that

a

proof-theoretic

semantics

would

be

better

suited

to

this

purpose

We

present

an

abstract

data

type

like

axiomatisation

for

the

kernel

primitives

of

Actors

showing

how

to

reason

from

specifications

of

actor

communities

and

how

to

compose

them

within

the

framework

of

temporal

logics

of

objects

Introduction

Actors

has

been

regarded

as

a

promising

model

for

open

distributed

systems

An

actor

is

a

computational

agent

with

encapsulated

state

that

changes

only

by

processing

messages

in

a

way

free

from

global

side-effects

Message

passing

between

actors

is

buffered

point-to-point

and

asynchronous

and

relies

on

a

local

naming

scheme

As

a

result

of

processing

messages

new

concurrent

actors

can

be

created

and

actor

names

can

be

communicated

With

these

characteristics

actors

support

desirable

run-time

capabilities

such

as

configurability

and

extensibility

In

addition

the

Actors

model

integrates

the

functional

and

the

object-oriented

approaches

for

software

development

thus

enforcing

design

principles

as

modularity

and

incrementability

Due

to

these

peculiarities

it

seems

natural

to

search

for

a

semantic

foundation

that

could

allow

the

rigorous

step-by-step

development

of

actor

systems

Since

the

work

described

in

-LSB-

-RSB-

we

know

how

to

compose

and

execute

actor

programs

correctly

In

-LSB-

-RSB-

and

-LSB-

-RSB-

the

operational

semantics

of

individual

actors

and

of

communities

of

interacting

actors

is

further

studied

formally

Yet

the

authors

recognise

that

it

would

be

necessary

to

characterise

properties

of

interest

to

specifiers

and

users

of

systems

organised

as

actor

communities

and

also

that

it

would

be

nice

to

have

logical

means

of

reasoning

about

such

objects

This

is

the

motivating

factor

for

the

present

paper

We

believe

that

a

sufficiently

abstract

semantic

foundation

for

the

specification

composition

and

verification

of

actors

should

encode

in

the

axioms

and

inference

rules

of

a

deductive

system

the

meaning

of

Actor

primitives

Ultimately

designers

and

programmers

need

to

deal

in

a

rigorous

and

systematic

manner

with

the

syntactic

representation

of

such

primitives

as

parts

of

specifications

and

programs

Our

view

can

be

captured

in

a

development

process

where

such

software

artifacts

are

represented

as

theory

presentations

of

some

logic

and

are

interconnected

by

means

of

translations

between

their

languages

-LSB-

-RSB-

Techniques

for

constructing

similar

formalisms

have

been

popularised

by

Institutions

-LSB-

-RSB-

in

studying

the

theory

of

abstract

data

types

using

some

sort

of

equational

logic

However

we

have

to

point

out

that

when

concurrency

comes

to

place

and

in

particular

because

Actors

requires

computation

to

be

fair

the

use

of

a

temporal

logic

for

specification

and

verification

is

almost

unavoidable

This

leaves

us

very

close

to

the

view

put

forward

in

-LSB-

-RSB-

Hence

we

organise

actor

specifications

using

signatures

and

presentations

of

temporal

theories

We

axiomatise

the

primitives

for

sending

and

receiving

asynchronous

messages

and

for

creating

objects

deriving

inference

rules

to

support

reasoning

about

concurrent

behaviour

in

terms

of

safety

and

liveness

properties

Having

developed

such

a

formalism

we

see

the

main

contribution

of

this

work

as

a

logic

that

establishes

a

firm

proof-theoretic

basis

for

actor

specification

composition

and

verification

which

follows

to

some

extent

previous

work

developed

by

the

abstract

data

types

school

We

proceed

by

discussing

some

of

the

issues

in

designing

a

proof-theory

for

Actors

Subsequently

we

introduce

our

approach

to

the

specification

and

verification

of

actor

systems

illustrating

the

involved

technicalities

by

means

of

an

example

Our

conclusions

a

comparison

with

related

work

and

directions

for

future

research

are

presented

in

the

final

section

Issues

in

the

Design

of

a

Proof-Theory

for

Actors

One

question

naturally

arises

in

working

out

a

proof-theory

for

Actors

Can

we

apply

directly

some

existing

logic

to

provide

the

desired

semantics

To

the

best

of

our

knowledge

the

answer

is

negative

because

no

such

a

logic

captures

all

the

required

ingredients

and

provides

the

proper

abstraction

level

Other

logics

for

concurrent

object-based

systems

development

are

described

in

-LSB-

-RSB-

In

the

concluding

section

we

shall

compare

them

with

our

work

Because

the

constituent

entities

of

the

Actors

model

are

formal

and

our

approach

to

specification

is

logical

we

need

to

determine

the

characteristics

of

a

logic

to

allow

the

rigorous

representation

of

all

these

entities

To

begin

with

an

actor

deals

with

distinct

sets

of

values

in

message

exchange

and

computation

Values

may

be

considered

actors

with

unserialised

behaviour

-LSB-

-RSB-

which

are

not

history

sensitive

and

have

a

fixed

meaning

in

every

computation

Here

however

in

order

to

keep

a

clear

distinction

between

values

and

actors

we

represent

the

first

family

as

objects

of

a

sort

in

a

many-sorted

language

instead

of

using

an

unsorted

language

In

a

way

sorts

define

types

for

values

which

is

indeed

the

usual

representation

of

properties

of

fixed

meaning

objects

in

programming

languages

Actors

in

turn

have

observable

behaviour

and

state-independent

identity

and

can

be

considered

modules

Hence

they

are

specified

using

theory

presentations

as

suggested

in

-LSB-

-RSB-

Actors

interact

via

buffered

message

passing

Since

-LSB-

-RSB-

temporal

logic

is

the

formal

framework

wherein

most

of

the

study

on

buffered

communication

has

been

carried

out

Even

among

such

logics

there

are

several

possibilities

to

choose

In

order

to

avoid

restricting

the

data

domain

of

messages

to

finite

sets

at

the

least

a

first-order

logic

must

be

used

-LSB-

-RSB-

Because

the

Actors

model

requires

both

message

delivery

to

be

guaranteed

and

possible

computations

to

be

performed

fairness

requirements

branching

time

logic

has

to

be

used

-LSB-

-RSB-

To

complete

the

picture

we

need

to

address

the

naming

and

creation

schemes

adopted

by

Actors

In

producing

an

specification

we

are

in

fact

defining

a

template

for

the

behaviour

of

a

population

of

similar

actors

so

that

each

of

them

receives

at

creation

time

a

mail

address

to

serve

as

its

name

in

communications

The

usual

way

of

representing

this

fact

is

to

regard

the

specification

as

implicitly

parameterised

by

a

sort

of

names

for

the

population

extending

the

original

specification

-LSB-

-RSB-

In

addition

to

avoid

conflicts

between

the

creation

of

new

actors

and

the

satisfiability

of

Barcan

formulae

which

state

that

the

domain

of

quantification

of

variables

do

not

vary

every

actor

needs

to

carry

an

existential

attribute

-LSB-

-RSB-

According

to

this

approach

Actor

BufferCell

data

types

addr

bool

int

attributes

cont

int

nxt

addr

empty

bool

lst

bool

actions

item

-LRB-

int

-RRB-

local

birth

void

link

-LRB-

addr

-RRB-

local

comput

put

-LRB-

int

-RRB-

get

-LRB-

addr

-RRB-

local

extrn

message

reply

-LRB-

int

-RRB-

extrn

message

axioms

n

addr

v

int

b

bool

A

-LRB-

X

-LRB-

empty

T

lst

T

-RRB-

-RRB-

-LRB-

A.

-RRB-

A

-LRB-

item

-LRB-

v

-RRB-

X

-LRB-

cont

v

empty

F

lst

T

-RRB-

-RRB-

-LRB-

A.

-RRB-

A

-LRB-

void

-LRB-

nxt

n

lst

b

X

-LRB-

nxt

n

empty

T

lst

b

-RRB-

-RRB-

-RRB-

-LRB-

A.

-RRB-

A

-LRB-

link

-LRB-

n

-RRB-

-LRB-

cont

v

empty

b

X

-LRB-

cont

v

nxt

n

empty

b

lst

F

-RRB-

-RRB-

-RRB-

-LRB-

A.

-RRB-

A

-LRB-

put

-LRB-

v

-RRB-

lst

T

X

-LRB-

new

-LRB-

item

n

v

-RRB-

link

-LRB-

n

-RRB-

-RRB-

-RRB-

-LRB-

A.

-RRB-

A

-LRB-

-LRB-

X

-LRB-

new

-LRB-

item

n

v

-RRB-

link

-LRB-

n

-RRB-

-RRB-

-RRB-

W

-LRB-

put

-LRB-

v

-RRB-

lst

T

-RRB-

-RRB-

-LRB-

A.

-RRB-

A

-LRB-

put

-LRB-

v

-RRB-

lst

F

X

-LRB-

send

-LRB-

put

nxt

v

-RRB-

-RRB-

-RRB-

-LRB-

A.

-RRB-

A

-LRB-

-LRB-

get

-LRB-

n

-RRB-

empty

F

X

-LRB-

send

-LRB-

reply

n

cont

-RRB-

-RRB-

-RRB-

-LRB-

get

-LRB-

n

-RRB-

empty

F

X

-LRB-

void

-RRB-

-RRB-

-RRB-

-LRB-

A.

-RRB-

A

-LRB-

get

-LRB-

n

-RRB-

empty

T

lst

F

X

-LRB-

send

-LRB-

get

nxt

n

-RRB-

-RRB-

-RRB-

-LRB-

A.

-RRB-

End

-LRB-

put

v

-RRB-

End

-LRB-

get

n

-RRB-

-LRB-

A.

-RRB-

A

-LRB-

-LRB-

item

-LRB-

v

-RRB-

void

link

-LRB-

n

-RRB-

-RRB-

Enp

-LRB-

put

v

-RRB-

Enp

-LRB-

get

n

-RRB-

-RRB-

-LRB-

A.

-RRB-

End

Figure

Specification

of

buffer

cells

objects

that

have

not

-LRB-

yet

-RRB-

been

created

do

not

play

any

role

paraphrasing

-LSB-

-RSB-

Considering

this

rationale

specifications

of

actors

should

look

like

Figure

There

is

represented

a

buffer

cell

which

dynamically

allocates

other

cells

for

the

integers

stored

Attribute

symbols

represent

the

actor

state

while

messages

and

local

computations

are

represented

by

action

symbols

The

operators

A

X

W

and

are

temporal

connectives

to

state

that

a

property

holds

in

every

behaviour

in

the

next

local

instant

while

another

property

does

not

hold

or

that

two

properties

are

causally

connected

Axiom

A.

e.g.

states

that

in

any

behaviour

if

item

happens

in

the

next

instant

the

content

of

the

cell

will

be

equal

to

the

value

v

provided

Then

the

cell

will

not

be

empty

-LRB-

empty

F

-RRB-

and

will

be

the

last

element

in

the

queue

of

integers

-LRB-

lst

T

-RRB-

We

shall

continue

to

explain

this

example

in

the

following

section

Axiomatising

Actors

In

this

section

we

introduce

our

approach

to

the

specification

and

verification

of

actors

First

we

show

how

to

represent

their

internal

structure

as

theory

signatures

Next

the

specification

of

actor

behaviour

using

theory

presentations

is

discussed

We

then

present

an

axiomatisation

of

the

consequence

relation

which

supports

reasoning

and

describe

how

specifications

can

be

combined

Finally

we

extend

our

example

providing

a

practical

application

of

all

these

ideas

Representing

Actors

A

theory

signature

provides

the

language

to

be

used

in

an

specification

Signatures

bring

both

the

notion

of

scope

and

interface

to

the

logic

by

forcing

every

used

symbol

to

be

declared

locally

and

by

allowing

the

definition

of

translations

between

symbols

in

order

to

connect

distinct

specifications

Theory

signatures

for

actor

specification

are

defined

as

follows

Definition

-LRB-

Actor

Signature

-RRB-

An

actor

signature

is

a

triple

of

disjoint

and

finite

families

-LRB-

A

-RRB-

where

ffl

-LRB-

S

-RRB-

is

an

universe

signature

in

the

algebraic

sense

-LSB-

-RSB-

i.e.

S

is

a

set

of

sort

symbols

and

is

an

S

S-indexed

family

of

operation

symbols

We

assume

that

addr

S

ffl

A

is

an

S

S-indexed

family

of

attribute

symbols

ffl

-LRB-

e

l

c

-RRB-

is

a

triple

of

S

indexed

families

of

action

symbols

such

that

-LRB-

e

-LSB-

l

-RRB-

c

is

empty

c

is

a

set

of

local

computation

symbols

The

elements

of

e

and

l

represent

respectively

the

events

that

can

be

requested

from

the

environment

and

provided

locally

Each

of

these

sets

contains

distinguished

sub-sets

of

message

and

birth

computation

symbols

e.g.

l

lb

and

lb

such

that

eb

lb

f

For

ffl

denoting

the

empty

sequence

we

write

an

ffl

s-indexed

family

of

symbols

as

if

s

were

its

single

index

Also

given

a

set

X

we

denote

the

sub-set

of

X

symbols

of

sort

sni

s

as

sni

s

In

making

reference

to

specific

sets

of

signature

symbols

we

shall

operate

with

subscripts

to

denote

operations

on

sub-sets

For

instance

eb

lb

eb

lb

f

g

In

our

previous

example

addr

bool

and

int

are

the

sorts

that

constitute

together

with

their

constants

and

operations

the

universe

signature

Clearly

the

sort

of

mail

addresses

addr

must

be

part

of

every

signature

Otherwise

some

specified

actors

would

be

useless

without

the

ability

of

exchanging

messages

or

creating

new

actors

Still

in

the

example

we

can

see

that

cont

nxt

empty

and

lst

are

the

attributes

in

A.

Using

the

Actors

model

terminology

acquaintance

lists

-LRB-

parameters

to

be

received

at

creation

time

-RRB-

and

communication

lists

-LRB-

other

attributes

to

store

values

received

in

subsequent

messages

-RRB-

constitute

this

set

The

structure

of

the

set

of

action

symbols

differs

from

other

similar

logics

-LSB-

-RSB-

Each

actor

may

provide

some

externally

visible

functionality

and

may

request

provision

of

functionality

from

other

actors

An

actor

may

also

perform

local

computations

Because

of

these

distinctions

the

set

of

action

symbols

is

divided

into

three

sub-sets

e

l

and

c

The

first

two

are

dismembered

in

sub-sets

of

actions

to

represent

synchronous

and

asynchronous

interactions

eb

and

e?eb

for

instance

In

general

actors

send

asynchronous

messages

members

of

e?eb

like

put

in

send

-LRB-

put

nxt

v

-RRB-

In

some

particular

cases

however

synchrony

is

also

required

This

is

the

mode

of

interaction

when

a

newly

created

actor

receives

its

name

because

the

occurrence

of

birth

action

of

eb

has

just

been

For

our

example

all

these

families

can

be

inferred

from

the

statements

in

Figure

As

it

is

usual

in

a

proof-theoretic

approach

to

specification

-LRB-

cf.

-LSB-

-RSB-

-RRB-

we

need

to

extend

actor

signatures

with

some

logical

symbols

The

situation

here

resembles

the

use

of

hidden

symbols

in

algebraic

specifications

-LSB-

-RSB-

There

the

specifier

wants

to

use

the

language

of

previously

defined

data

types

to

specify

a

more

complex

one

Here

we

want

a

simpler

language

to

specify

complex

patterns

of

behaviour

presented

by

every

actor

defined

in

terms

of

a

more

complex

language

This

extended

language

will

be

used

in

providing

a

semantics

for

the

actor

primitives

and

that

is

why

it

should

not

be

required

from

the

specifier

of

each

signature

Definition

-LRB-

Extended

Actor

Signature

-RRB-

Given

an

actor

signature

-LRB-

A

-RRB-

the

triple

-LRB-

A

-RRB-

is

said

to

be

the

extended

signature

of

where

the

target

of

exchanged

messages

can

be

determined

at

run

time

only

and

may

be

the

sender

itself

e?eb

and

l?lb

should

not

be

disjoint

in

general

simplicity

we

assume

that

there

are

only

two

pure

modes

of

interaction

between

objects

synchronous

and

asynchronous

and

that

creation

follows

the

first

one

ffl

-LRB-

S

fboolg

fTbool

Fbool

NOTbool!boolg

-RRB-

ffl

A

-LRB-

Al

Ai

As

Ad

-RRB-

such

that

Al

A

for

each

c

lb

of

sort

sni

there

is

an

initc

sni

bool

for

each

c

-LRB-

e?eb

-RRB-

-LSB-

-LRB-

l?lb

-RRB-

of

sort

sni

there

is

a

sentc

Ashaddr

sni

bool

and

for

each

c

l?lb

of

sort

sni

there

is

a

delivdc

sni

bool

ffl

-LRB-

e

out

l

in

c

rcv

-RRB-

where

for

each

c

e

of

sort

sni

there

is

an

outc

outhaddr

addr

sni

for

each

c

l

of

sort

sni

there

is

an

inc

inhaddr

addr

sni

and

for

each

c

l?lb

of

sort

sni

there

is

a

rcvc

sni

such

that

inc

outc

whenever

c

e

l

and

also

that

-LRB-

in

-LSB-

out

-RRB-

rcv

f

g.

Hereafter

we

will

not

make

any

distinction

between

extended

signatures

and

actor

signatures

assuming

the

use

of

extensions

when

referring

to

the

orignal

signatures

provided

That

is

to

say

the

original

universal

signature

is

extended

with

the

sort

of

booleans

new

attributes

are

provided

to

deal

with

the

existence

of

actors

and

buffering

of

messages

and

new

actions

are

introduced

to

handle

creation

and

interaction

A

central

feature

of

actors

is

interaction

Here

it

is

simulated

using

the

synchronous

case

by

the

actions

outc

and

ind

happening

simultaneously

for

c

e

and

d

which

belong

to

the

actor

communities

-LRB-

populations

of

actors

with

same

specification

-RRB-

requesting

and

providing

the

event

respectively

The

occurrence

of

these

logical

actions

play

the

role

of

the

interaction

steps

described

in

-LSB-

-RSB-

For

an

interaction

between

actors

of

the

same

community

represented

by

action

c

hence

required

and

provided

internally

and

member

of

e

l

the

new

actions

above

have

already

been

synchronised

since

they

are

equalised

by

the

constraint

inc

outc

in

Definition

Otherwise

this

synchronisation

must

be

supported

by

a

morphism

identifying

shared

actions

in

the

distinct

signatures

as

discussed

in

Section

Asynchrony

is

guaranteed

by

obliging

rcvd

to

happen

after

ind

and

before

d

itself

Finally

-LRB-

double

-RRB-

buffering

is

captured

by

the

attribute

delivdd

-LRB-

sentc

-RRB-

becoming

true

for

some

values

when

they

are

delivered

-LRB-

sent

-RRB-

as

message

contents

Of

course

all

these

new

symbols

do

not

explicitly

appear

in

specifications

but

their

behavioural

constraints

will

have

to

be

captured

by

our

axiomatisation

Also

according

to

the

proposed

extended

signatures

ill

formed

messages

are

not

allowed

-LRB-

as

actions

messages

always

have

a

locally

correct

representation

at

the

sender

-RRB-

although

messages

sent

to

actors

which

can

not

provide

the

required

functionality

will

never

be

delivered

According

to

-LSB-

-RSB-

in

a

given

state

of

the

system

it

should

only

be

possible

to

mention

the

objects

that

exist

in

that

state

In

our

case

existing

actors

will

have

some

initc

attribute

set

to

T

for

some

sequence

of

values

vc

if

the

occurrence

of

an

action

inc

-LRB-

vc

-RRB-

c

lb

created

it

The

structure

of

communities

of

similar

actors

is

defined

below

and

provides

a

syntactic

representation

for

the

actor

configurations

of

-LSB-

-RSB-

and

the

actor

fragments

of

-LSB-

-RSB-

Definition

-LRB-

Actor

Community

Signature

-RRB-

Given

a

signature

-LRB-

A

-RRB-

a

community

signature

P

is

obtained

by

parameterising

with

sort

P

as

follows

ffl

P

-LRB-

S

fPg

-RRB-

ffl

AP

is

obtained

from

A

by

adding

the

parameter

sort

P

to

each

attribute

of

Al

Ai

and

Ad

The

other

attributes

of

A

remain

the

same

in

AP

ffl

P

is

obtained

from

by

adding

the

parameter

sort

P

to

each

action

of

e

l

c

and

rcv

The

other

actions

of

remain

the

same

in

P

The

notation

n

s

represents

s

-LRB-

n

-RRB-

for

n

of

sort

P

and

sentence

s

If

s

does

not

contain

parameterised

symbols

n

s

is

s

itself

Such

s

sentences

can

be

attribute

or

action

symbols

and

also

terms

or

formulae

-LRB-

to

be

introduced

-RRB-

which

are

canonically

extended

by

the

parameterisation

-LSB-

-RSB-

Prefixes

will

be

ignored

when

clear

from

the

It

seems

obvious

that

the

parameter

sort

P

of

every

community

should

be

addr

Indeed

according

to

-LSB-

-RSB-

every

actor

semantics

should

be

parameterised

by

a

set

of

actor

addresses

Due

to

our

definition

a

new

parameter

is

added

to

each

relevant

signature

symbol

to

represent

the

name

of

an

actor

In

this

way

the

basic

operations

on

object

references

equality

test

and

dereferencing

-LSB-

-RSB-

are

supported

However

community

signatures

alone

do

not

support

a

modular

design

discipline

obliging

the

structure

of

entire

systems

to

be

defined

as

a

single

signature

The

required

means

of

composition

will

be

provided

in

Section

Specifying

and

Interpreting

Actor

Behaviours

Actor

specifications

stand

for

the

behaviour

definitions

of

-LSB-

-RSB-

To

be

able

to

define

them

we

need

to

assume

the

existence

of

an

infinite

family

of

variables

Each

of

these

variables

is

considered

to

be

always

bound

to

values

of

some

sort

Their

set

can

be

classified

accordingly

Definition

-LRB-

Classification

-RRB-

Given

a

signature

a

classification

is

meant

to

be

a

function

S

from

the

collection

of

variables

to

the

set

of

sorts

of

the

universe

signature

S.

s

also

denotes

the

S-indexed

set

given

by

s

fx

j

-LRB-

x

-RRB-

sg

Terms

stand

for

meaningful

values

In

their

definition

a

classification

and

a

signature

are

used

These

are

assumed

to

be

given

in

the

sequel

Definition

-LRB-

Terms

-RRB-

The

S-indexed

set

of

terms

T

-LRB-

-RRB-

is

defined

as

follows

s

-LSB-

s

-LSB-

As

T

-LRB-

-RRB-

s

if

p

sni

s

and

ti

T

-LRB-

-RRB-

si

then

p

-LRB-

tn

-RRB-

T

-LRB-

-RRB-

s

if

f

sni

s

and

ti

T

-LRB-

-RRB-

si

then

f

-LRB-

tn

-RRB-

T

-LRB-

-RRB-

s

That

is

terms

consist

in

variables

nulary

function

and

attribute

symbols

-LRB-

-RRB-

or

function

and

attribute

symbols

applied

to

terms

-LRB-

-RRB-

As

explained

previously

to

give

an

account

of

actor

behaviour

in

terms

of

formulae

firstorder

branching

time

temporal

logic

is

required

In

what

follows

we

take

formulae

as

defined

in

CTL

-LSB-

-RSB-

and

introduce

the

necessary

extensions

Definition

-LRB-

Formulae

-RRB-

The

set

F

-LRB-

-RRB-

of

formulae

is

defined

by

the

mutual

recursion

between

state

and

path

formula

below

if

c

sni

and

ti

T

-LRB-

-RRB-

si

then

c

-LRB-

tn

-RRB-

is

a

state

formula

if

T

-LRB-

-RRB-

s

then

-LRB-

s

-RRB-

is

a

state

formula

if

and

are

state

formulae

and

y

is

a

free

variable

in

then

and

are

state

formulae

each

state

formulae

is

a

path

formulae

and

parameterised

signatures

may

be

given

a

more

convincing

definition

by

closing

the

category

of

sorts

through

products

-LRB-

resulting

in

a

category

of

sorts

internal

to

each

signature

-RRB-

and

by

using

this

fact

in

connecting

actor

signatures

through

morphisms

-LSB-

-RSB-

This

shall

be

clarified

in

Section

if

g

is

a

path

formula

then

Eg

is

a

state

formula

if

and

are

path

formulae

and

y

is

a

free

variable

in

then

and

are

path

formulae

if

and

are

path

formulae

then

and

are

path

formulae

For

s

-LSB-

A

-LSB-

of

sort

sni

and

a

sequence

of

terms

vc

we

write

s

-LRB-

vn

-RRB-

as

s

-LRB-

vc

-RRB-

Formulae

stand

for

action

occurrences

-LRB-

-RRB-

equality

of

terms

-LRB-

-RRB-

a

formula

holding

in

some

possible

behaviour

-LRB-

-RRB-

in

the

next

instant

or

until

another

formula

holds

-LRB-

-RRB-

or

formulae

aggregation

using

first-order

logic

connectives

Our

syntax

is

not

very

restrictive

and

allows

the

definition

of

behaviours

that

might

not

be

realised

as

actor

programs

However

it

expressive

enough

to

permit

reasoning

about

components

-LRB-

which

are

not

necessarily

single

actors

-RRB-

A

formal

definition

of

actor

specifications

exemplified

here

by

BufferCell

is

as

follows

Definition

-LRB-

Actor

Specification

-RRB-

An

actor

specification

is

a

pair

-LRB-

-RRB-

where

is

an

actor

signature

and

is

a

finite

set

of

formulae

over

-LRB-

the

specification

axioms

-RRB-

Formulae

containing

derived

first-order

logic

connectives

and

inequalities

stand

for

their

usual

translations

Moreover

free

variables

in

axioms

are

considered

to

be

universally

quantified

Other

necessary

operators

and

abbreviations

are

defined

as

follows

For

of

type

formula

reads

represents

g

F

-LRB-

-RRB-

Ag

in

any

behaviour

E

g

g

F

-LRB-

-RRB-

Xng

in

the

next

n-th

instant

X

Xg

-LRB-

n

times

-RRB-

g

F

-LRB-

-RRB-

Fg

eventually

in

the

future

-LRB-

g

g

-RRB-

Ug

g

F

-LRB-

-RRB-

Gg

always

in

the

future

F

g

F

-LRB-

-RRB-

waiting

for

G

-LRB-

-RRB-

F

-LRB-

-RRB-

cause/consequence

-LRB-

-RRB-

c

ni

vc

T

-LRB-

-RRB-

new

-LRB-

c

vc

-RRB-

creation

of

an

actor

outc

-LRB-

vc

-RRB-

c

eb

inc

-LRB-

vc

-RRB-

c

lb

c

ni

vc

T

-LRB-

-RRB-

send

-LRB-

c

vc

-RRB-

dispatch

of

a

message

outc

-LRB-

vc

-RRB-

c

e?eb

inc

-LRB-

vc

-RRB-

c

l?lb

c

n

vc

T

-LRB-

-RRB-

n

deliv

-LRB-

c

vc

-RRB-

delivery

of

a

message

rcvc

-LRB-

vc

-RRB-

c

l?lb

c

vc

T

-LRB-

-RRB-

End

-LRB-

c

vc

-RRB-

enabled

for

delivery

A

-LRB-

sentc

-LRB-

vc

-RRB-

T

E

-LRB-

deliv

-LRB-

c

vc

-RRB-

-RRB-

-RRB-

c

vc

T

-LRB-

-RRB-

Enp

-LRB-

c

vc

-RRB-

enabled

for

processing

A

-LRB-

delivdc

-LRB-

vc

-RRB-

T

E

-LRB-

c

-LRB-

vc

-RRB-

-RRB-

-RRB-

The

operators

above

are

conventional

in

temporal

logic

except

for

that

establishes

causality

relations

that

the

occurrence

of

a

get

causes

the

dispatch

of

a

reply

which

can

not

happen

otherwise

for

instance

The

primitives

are

usual

in

Actors

-LRB-

cf.

-LSB-

-RSB-

-RRB-

while

the

enableness

formulae

are

to

say

that

an

actor

may

evolve

under

proper

stimuli

the

delivery

of

messages

In

our

syntax

the

reader

may

have

noticed

the

absence

of

primitive

become

which

defines

that

an

actor

will

behave

according

to

a

distinct

specification

in

its

subsequent

computation

In

fact

actions

in

c

like

void

of

our

example

together

with

a

selective

use

of

attributes

simulate

this

in

a

diselegant

manner

On

the

one

hand

it

would

be

easy

to

present

become

as

another

definition

by

introducing

death

actions

in

signatures

-LRB-

cf.

-LSB-

-RSB-

-RRB-

and

by

considering

the

primitive

as

the

death

of

an

actor

and

its

subsequent

resurrection

with

a

distinct

behaviour

keeping

the

same

mail

address

in

this

process

On

the

other

hand

we

have

reasons

to

avoid

treating

this

here

in

the

first

place

to

simplify

our

presentation

and

secondly

because

it

would

bring

methodological

complications

for

reasoning

These

complications

shall

be

addressed

in

the

concluding

section

that

since

j?lb

j

-LSB-

-LSB-

we

allow

actors

to

have

multiple

constructors

Concerning

the

formal

meaning

of

signature

symbols

we

assume

that

sorts

are

interpreted

as

constant

sets

while

operations

on

sorts

denote

constant

functions

Attributes

differ

from

operations

in

that

they

may

have

a

different

meaning

at

each

instant

-LRB-

i.e.

they

are

nonrigid

-RRB-

Actions

in

turn

may

happen

concurrently

if

this

is

allowed

by

specification

axioms

In

fact

action

symbols

are

a

syntactic

representation

of

the

events

of

-LSB-

-RSB-

which

may

proceed

concurrently

if

unrelated

As

a

result

of

all

these

assumptions

it

is

easy

to

see

that

we

are

adopting

an

interleaving

model

of

parallelism

where

actions

have

a

fixed

granularity

Since

our

approach

here

is

proof-theoretic

the

reader

is

referred

to

-LSB-

-RSB-

for

semantic

considerations

Axiomatising

Actors

In

this

section

we

develop

a

deductive

system

A

for

Actors

consisting

of

a

set

of

axiom

schemes

and

inference

rules

We

assume

the

existence

of

a

deductive

system

B

for

the

many-sorted

first-order

branching

time

temporal

logic

of

objects

used

here

-LRB-

see

-LSB-

-RSB-

for

an

axiomatisation

of

a

particular

linear

time

version

-RRB-

and

concentrate

on

the

peculiarities

of

our

work

We

shall

develop

axiom

schemes

for

a

consequence

relation

where

the

specification

is

used

as

an

index

to

remind

us

that

such

relation

depends

of

the

structure

of

a

signature

in

order

to

support

localised

reasoning

We

will

assume

that

a

specification

-LRB-

-LRB-

A

-RRB-

-RRB-

is

given

Also

we

will

drop

from

the

schemes

the

temporal

quantifier

A

and

the

classical

universal

quantifier

over

apparently

free

variables

to

simplify

our

presentation

and

will

use

the

meta-variable

n

for

actor

names

decorated

with

indexes

when

necessary

The

following

notation

shall

be

used

to

express

in

an

abbreviated

manner

the

invariance

of

an

attribute

or

a

modification

in

its

value

and

the

fairness

requirement

over

the

occurrence

of

an

action

For

s

as

of

type

formula

represents

t

T

-LRB-

-RRB-

Inv

-LRB-

s

-RRB-

st

-LRB-

X

-LRB-

t

k

-RRB-

t

k

-RRB-

f

-LRB-

vf

-RRB-

v

F

-LRB-

-RRB-

Mod

-LRB-

s

-RRB-

p

s

vf

-LRB-

p

vf

X

-LRB-

f

-LRB-

p

-RRB-

v

-RRB-

-RRB-

Inv

-LRB-

f

-LRB-

p

-RRB-

-RRB-

c

-LRB-

vc

-RRB-

F

-LRB-

-RRB-

F

air

-LRB-

s

-RRB-

AF

c

-LRB-

vc

-RRB-

AG

V

vd

sd

:d

-LRB-

vd

-RRB-

In

temporal

logics

of

objects

the

so-called

locality

property

is

regarded

as

a

crucial

assumption

to

support

modular

specification

and

reasoning

-LSB-

-RSB-

It

is

also

a

key

feature

of

the

Actors

model

-LSB-

-RSB-

Generally

speaking

locality

requires

that

or

an

action

happens

or

else

the

values

of

the

attributes

remain

the

same

This

means

that

each

actor

has

an

encapsulated

state

changes

must

be

witnessed

by

the

occurrence

of

some

of

its

own

actions

Locality

is

captured

by

the

following

schemes

W

-LSB-

c

vc

sc

n

c

-LRB-

vc

-RRB-

V

vf

sf

Inv

-LRB-

n

f

-LRB-

vf

-RRB-

-RRB-

V

vc

sc

new

-LRB-

c

vc

-RRB-

Inv

-LRB-

initc

-LRB-

vc

-RRB-

-RRB-

V

vc

sc

W

vd

new

-LRB-

d

vd

-RRB-

send

-LRB-

c

vc

-RRB-

deliv

-LRB-

c

vc

-RRB-

Inv

-LRB-

sentc

-LRB-

vc

-RRB-

-RRB-

V

vc

sc

W

vd

sd

new

-LRB-

d

vd

-RRB-

deliv

-LRB-

c

vc

-RRB-

c

-LRB-

vc

-RRB-

Inv

-LRB-

delivdc

-LRB-

vc

-RRB-

-RRB-

The

first

schema

says

that

either

a

birth

or

a

local

computation

happens

or

all

the

nonlogical

attributes

remain

invariant

In

the

BufferCell

example

this

captures

the

fact

that

or

item

void

or

link

occur

or

else

cont

nxt

empty

and

lst

do

not

change

According

to

the

second

schema

or

an

actor

is

created

with

some

name

or

the

possible

existence

of

an

object

with

such

name

is

not

disturbed

The

other

two

schemas

are

to

guarantee

that

buffering

attributes

vary

only

when

the

actor

is

created

or

message

passing

takes

place

Another

characteristic

of

actors

systems

is

their

sequentialised

behaviour

Observers

of

actor

systems

can

only

record

the

effects

of

action

occurrences

as

if

they

happen

in

a

nondeterministic

sequential

manner

-LSB-

-RSB-

In

other

words

observations

that

are

not

predicted

for

some

serial

behaviour

do

not

arise

as

a

consequence

of

the

occurrence

of

isolated

concurrent

actions

This

property

has

already

been

finitely

axiomatised

in

-LSB-

-RSB-

as

follows

C

For

every

transaction

T

and

values

vT

of

sort

sT

such

that

each

finite

formula

in

the

set

OT

determines

a

serial

occurrence

order

for

the

actions

in

T

with

the

respective

values

n

c

-LRB-

vcT

-RRB-

T

vd

sd

n

:d

-LRB-

vd

-RRB-

V

vf

sf

k

s

-LRB-

-LRB-

o

XjT

j

-LRB-

n

f

-LRB-

vf

-RRB-

k

-RRB-

-RRB-

X

-LRB-

n

f

-LRB-

vf

-RRB-

k

-RRB-

-RRB-

This

means

that

attribute

values

are

always

consistent

-LRB-

in

the

distributed

shared

memories

sense

-LSB-

-RSB-

-RRB-

for

every

transaction

when

all

the

actions

occur

together

-LRB-

-RRB-

and

in

isolation

-LRB-

-RRB-

there

is

a

serial

order

defining

their

effect

on

each

attribute

-LRB-

-RRB-

Therefore

the

schema

does

not

impose

any

constraint

on

the

permission

for

actions

to

occur

concurrently

but

on

their

effects

on

the

attributes

The

responsibility

for

defining

consistency

properties

as

well

as

locality

could

be

left

to

the

specifier

who

would

have

to

state

them

as

part

of

each

specification

However

they

are

provided

by

our

axiomatisation

-LRB-

that

is

they

are

logical

-RRB-

precisely

to

capture

their

character

of

laws

that

must

be

obeyed

by

every

actor

and

thus

can

not

be

customised

It

is

precisely

this

logical

treatment

that

allows

modular

specification

and

proof

as

argued

in

-LSB-

-RSB-

Permission

schemes

constrain

the

occurrence

of

actions

V

vc

sc

send

-LRB-

c

vc

-RRB-

W

vd

sd

initd

-LRB-

vd

-RRB-

T

V

vc

sc

n

deliv

-LRB-

c

vc

-RRB-

W

vd

sd

n

initd

-LRB-

vd

-RRB-

T

V

-LRB-

l?lb

-RRB-

-LSB-

c

vc

sc

n

c

-LRB-

vc

-RRB-

W

vd

sd

n

initd

-LRB-

vd

-RRB-

T

V

vc

sc

new

-LRB-

c

vc

-RRB-

W

vd

sd

initd

-LRB-

vd

-RRB-

T

V

vc

sc

new

-LRB-

c

vc

-RRB-

V

vd

sd

initd

-LRB-

vd

-RRB-

F

V

vc

sc

new

-LRB-

c

vc

-RRB-

X

-LRB-

c

-LRB-

vc

-RRB-

-RRB-

V

c

c

vc

sc

new

-LRB-

c

vc

-RRB-

sc

vd

sd

new

-LRB-

c

-RRB-

vc

new

-LRB-

d

vd

-RRB-

V

vc

sc

n

deliv

-LRB-

c

vc

-RRB-

sentc

-LRB-

n

vc

-RRB-

T

V

c

c

vc

sc

n

deliv

-LRB-

c

vc

-RRB-

sc

vd

sd

n

deliv

-LRB-

c

-RRB-

vc

n

deliv

-LRB-

d

vd

-RRB-

V

vc

sc

n

c

-LRB-

vc

-RRB-

n

delivdc

-LRB-

vc

-RRB-

T

V

c

-LSB-

c

=d

vc

sc

n

c

-LRB-

vc

-RRB-

sc

vd

sd

n

c

-LRB-

-RRB-

vc

n

:d

-LRB-

vd

-RRB-

The

first

four

schemes

say

that

the

dispatch

delivery

and

consumption

of

messages

and

the

local

computation

and

creation

of

actors

happen

only

if

the

requesting

actor

exists

The

other

schemes

say

that

a

new

actor

can

be

created

only

if

this

has

not

happened

before

-LRB-

-RRB-

the

occurrence

of

birth

actions

is

causally

connected

to

actor

creation

-LRB-

-RRB-

two

actors

with

the

same

name

can

not

be

concurrently

created

-LRB-

-RRB-

messages

can

be

delivered

only

if

they

were

previously

sent

-LRB-

-RRB-

only

one

message

can

be

delivered

at

each

time

-LRB-

-RRB-

messages

can

be

consumed

only

if

they

were

previously

delivered

-LRB-

-RRB-

the

consumption

of

messages

and

the

processing

of

births

and

local

computations

are

totally

ordered

-LRB-

-RRB-

which

means

that

two

such

actions

can

not

occur

at

the

same

time

Although

the

consistency

schema

alone

permits

the

correct

occurrence

of

concurrent

actions

the

last

schema

above

is

provided

in

order

to

facilitate

specification

and

reasoning

Notice

that

every

actor

can

still

present

some

internal

concurrency

in

this

way

they

can

create

new

actors

and

send

messages

at

the

same

time

Many

logical

attributes

are

introduced

in

the

extension

of

actor

signatures

How

they

change

according

to

the

occurrence

of

actions

is

defined

below

V

vc

sc

new

-LRB-

c

vc

-RRB-

Mod

-LRB-

initc

-LRB-

vc

-RRB-

T

-RRB-

V

vc

sc

vd

sd

new

-LRB-

c

vc

-RRB-

Mod

-LRB-

sentd

-LRB-

vd

-RRB-

F

-RRB-

Mod

-LRB-

delivdd

-LRB-

vd

-RRB-

F

-RRB-

V

vc

sc

send

-LRB-

c

vc

-RRB-

send

-LRB-

c

-RRB-

Mod

-LRB-

sentc

-LRB-

vc

-RRB-

T

-RRB-

V

vc

sc

n

deliv

-LRB-

c

vc

-RRB-

Mod

-LRB-

sentc

-LRB-

n

vc

-RRB-

F

-RRB-

Mod

-LRB-

n

delivdc

-LRB-

vc

-RRB-

T

-RRB-

V

vc

sc

n

c

-LRB-

vc

-RRB-

Mod

-LRB-

n

delivdc

-LRB-

vc

-RRB-

F

-RRB-

That

is

if

the

creation

of

an

actor

has

been

requested

there

will

exist

a

new

actor

in

the

next

instant

with

an

empty

message

buffer

-LRB-

-RRB-

if

a

message

is

sent

then

it

will

be

buffered

in

the

output

queue

-LRB-

-RRB-

if

a

delivery

happens

the

message

will

be

removed

from

the

output

queue

and

buffered

in

the

input

queue

-LRB-

-RRB-

and

if

a

message

is

processed

it

will

be

removed

from

the

input

queue

-LRB-

-RRB-

As

it

can

be

seen

the

effect

of

sending

messages

over

output

buffers

is

explicitly

defined

only

for

such

actions

happening

in

isolation

since

the

effect

of

concurrent

aoccurrences

can

inferred

using

the

consistency

schema

Furthermore

the

delay

in

buffering

messages

in

the

next

instant

only

rules

out

the

existence

of

actors

that

reply

infinitely

fast

Finally

fairness

schemes

are

required

to

guarantee

a

correct

actor

behaviour

Without

fairness

it

could

be

the

case

that

messages

fail

to

be

delivered

because

the

receiver

always

postpones

the

delivery

or

that

always

possible

computations

are

never

performed

V

vc

sc

n

delivdc

-LRB-

vc

-RRB-

T

n

Enp

-LRB-

c

vc

-RRB-

n

F

air

-LRB-

c

-LRB-

vc

-RRB-

-RRB-

V

vc

sc

sentc

-LRB-

vc

-RRB-

T

n

End

-LRB-

c

vc

-RRB-

n

F

air

-LRB-

deliv

-LRB-

c

vc

-RRB-

-RRB-

The

first

schema

says

that

if

the

processing

of

a

message

is

obliged

because

the

message

was

delivered

and

has

been

buffered

in

the

input

queue

and

it

is

also

permitted

-LRB-

enabled

-RRB-

then

the

message

will

be

processed

or

the

entire

actor

will

become

always

disabled

unable

to

consume

pending

messages

Mutatis

mutandis

this

is

what

the

second

schema

says

for

message

delivery

An

important

simplification

was

made

in

the

axiomatisation

above

concerning

message

passing

We

should

have

treated

the

fact

that

identical

messages

may

be

exchanged

in

sequence

and

therefore

some

of

them

could

be

missed

or

duplicated

-LSB-

-RSB-

In

Actors

the

usual

treatment

of

this

problem

is

to

attach

tags

to

the

messages

so

that

they

become

distinct

from

each

other

-LSB-

-RSB-

To

avoid

obliging

the

specifier

to

deal

with

such

details

logical

means

of

dealing

with

the

problem

could

have

been

provided

much

in

the

way

that

buffering

is

treated

here

through

auxiliary

attributes

These

are

omitted

in

this

paper

All

the

properties

above

have

already

been

stated

in

the

literature

some

appear

in

-LSB-

-RSB-

for

instance

although

they

remained

without

a

formal

axiomatization

Hereafter

we

call

the

set

of

logical

axioms

of

containing

C

g

as

L

while

the

set

L

contains

only

the

barred

axioms

wherein

logical

variables

do

not

appear

The

axiom

schemes

above

allow

us

to

derive

more

or

less

standard

rules

for

reasoning

about

the

concurrent

behaviour

of

actor

communities

In

what

follows

we

shall

use

Hoare

triples

fpg

a

fqg

to

represent

A

-LRB-

a

p

Xq

-RRB-

Moreover

sequents

like

P

q

stand

for

the

fact

that

the

formula

q

is

derivable

from

the

set

of

formulae

P

together

with

the

-LRB-

logical

and

non-logical

-RRB-

axioms

of

using

the

inference

rules

of

the

proof

system

We

shall

drop

the

index

from

the

sequent

when

it

is

clear

from

the

context

Proposition

-LRB-

Derived

Rules

of

Inference

-RRB-

Given

an

actor

specification

-LRB-

-LRB-

A

-RRB-

-RRB-

the

following

are

inference

rules

for

deriving

properties

of

existing

actors

n

new

-LRB-

d

m

vd

-RRB-

p

q

W

vc

sc

new

-LRB-

c

m

vc

-RRB-

-LSB-

EXIST

-RSB-

AXAG

-LRB-

p

q

-RRB-

V

vc

sc

fpg

n

c

-LRB-

vc

-RRB-

fqg

V

vc

sc

fqg

n

c

-LRB-

vc

-RRB-

fqg

-LSB-

SAFE

-RSB-

AGq

V

vc

sc

fpg

n

c

-LRB-

vcT

-RRB-

fp

qg

fpg

n

:d

-LRB-

vd

-RRB-

fqg

p

W

AF

-LRB-

vc

sc

n

Enp

-LRB-

c

vc

-RRB-

-RRB-

-LSB-

RESP

-RSB-

n

deliv

-LRB-

d

vd

-RRB-

AXA

-LRB-

-LRB-

p

AFq

-RRB-

U

-LRB-

p

n

:d

-LRB-

vd

-RRB-

-RRB-

-RRB-

V

vc

sc

fpg

n

deliv

-LRB-

c

vcT

-RRB-

fp

qg

fpg

n

deliv

-LRB-

d

vd

-RRB-

fqg

p

W

AF

-LRB-

vc

sc

n

End

-LRB-

c

vc

-RRB-

-RRB-

-LSB-

COM

-RSB-

m

send

-LRB-

d

n

vd

-RRB-

AXA

-LRB-

-LRB-

p

AFq

-RRB-

U

-LRB-

p

n

deliv

-LRB-

d

vd

-RRB-

-RRB-

-RRB-

Using

our

axiom

schemes

L

and

the

axiomatisation

of

the

temporal

logic

B

it

is

not

difficult

to

derive

the

inference

rules

above

which

are

more

convenient

to

use

together

with

L

because

the

logical

symbols

have

been

hidden

or

eliminated

Rule

EXIST

is

a

direct

consequence

of

The

SAFE

rule

which

allows

the

deduction

of

properties

that

an

actor

will

always

have

and

corresponds

to

a

form

of

actor

induction

as

described

in

-LSB-

-RSB-

is

a

consequence

of

axioms

and

The

other

rules

are

a

consequence

of

and

respectively

Although

these

last

two

rules

are

for

the

derivation

of

properties

in

the

general

liveness

family

which

an

actor

will

eventually

present

they

are

distinguished

to

keep

apart

properties

that

arise

as

a

result

of

local

and

cooperative

behaviour

The

COM

rule

is

to

be

used

in

proving

properties

that

arise

from

the

interaction

between

two

-LRB-

potentially

distinct

-RRB-

actors

The

situation

here

is

different

from

that

described

in

-LSB-

-RSB-

where

interaction

between

objects

is

captured

through

action

sharing

in

a

more

explicit

and

unconstrained

manner

Therein

an

even

stronger

form

of

fairness

is

proposed

since

a

shared

action

may

loose

its

permission

to

happen

in

one

of

the

components

while

it

is

obliged

to

happen

by

the

other

For

Actors

however

such

a

fairness

strengthening

is

not

required

since

shared

actions

must

be

local

to

one

actor

only

and

can

not

have

their

permission

to

occur

constrained

by

other

actors

as

external

actions

Let

us

illustrate

the

use

of

our

deductive

system

From

the

BufferCell

specification

we

can

see

that

each

cell

is

created

and

may

be

subsequently

consumed

or

linked

to

another

cell

of

the

buffer

If

a

cell

is

empty

and

it

is

not

the

last

element

in

the

queue

the

cell

will

never

perform

any

local

computation

again

This

property

can

be

formally

stated

as

BufferCell

AG

-LRB-

empty

T

lst

F

AG

-LRB-

void

link

-LRB-

n

-RRB-

-RRB-

-RRB-

-LRB-

-RRB-

Hence

the

cell

will

forward

every

incoming

message

to

the

next

buffer

element

Assuming

familiarity

with

the

axiomatisation

of

the

temporal

logic

Property

can

be

verified

as

follows

empty

T

lst

F

void

empty

T

lst

F

link

-LRB-

n

-RRB-

I

empty

T

lst

F

void

link

-LRB-

n

-RRB-

AG

I

empty

T

lst

F

AG

-LRB-

void

link

-LRB-

n

-RRB-

-RRB-

I

empty

T

lst

F

AG

-LRB-

void

link

-LRB-

n

-RRB-

-RRB-

AG

I

AG

-LRB-

empty

T

lst

F

AG

-LRB-

void

link

-LRB-

n

-RRB-

-RRB-

-RRB-

Now

we

are

able

to

decompose

the

remainder

of

the

proof

into

two

sub-proofs

The

leftmost

sequent

can

be

proved

in

the

following

way

A

-LRB-

X

-LRB-

void

-RRB-

-RRB-

W

-LRB-

get

-LRB-

n

-RRB-

empty

F

-RRB-

DEF

W

G

-LRB-

-LRB-

get

-LRB-

n

-RRB-

empty

F

-RRB-

-RRB-

G

-LRB-

X

-LRB-

void

-RRB-

-RRB-

X

COMMU

SAFE

G

-LRB-

get

-LRB-

n

-RRB-

empty

T

-RRB-

G

-LRB-

void

-RRB-

ID

empty

T

empty

T

I

empty

T

get

-LRB-

n

-RRB-

empty

T

G

I

empty

T

G

-LRB-

get

-LRB-

n

-RRB-

empty

T

-RRB-

MP

empty

T

G

-LRB-

void

-RRB-

Gp

p

E

empty

T

lst

F

void

Notice

that

specification

axioms

like

A.

may

be

used

as

premises

in

each

proof

We

also

allow

non-atomic

rule

applications

in

each

step

to

abbreviate

sub-proofs

In

general

the

axiomatization

of

both

Actors

and

temporal

logic

of

objects

are

heavily

used

to

justify

such

steps

An

abuse

of

notation

appears

above

as

well

knowing

under

which

circumstances

X

-LRB-

void

-RRB-

is

implied

from

A.

we

can

use

I

with

-LRB-

-RRB-

to

produce

a

sequent

a

void

X

-LRB-

void

-RRB-

for

each

action

a

of

BufferCell

and

only

then

apply

rule

SAFE

to

show

that

G

-LRB-

void

-RRB-

Along

the

same

lines

the

proof

of

the

second

sequent

above

can

be

developed

as

follows

ID

lst

F

lst

F

I

lst

F

put

-LRB-

v

-RRB-

lst

F

G

I

lst

F

G

-LRB-

put

-LRB-

v

-RRB-

lst

F

-RRB-

A

-LRB-

X

-LRB-

link

-LRB-

n

-RRB-

-RRB-

-RRB-

W

-LRB-

put

-LRB-

v

-RRB-

lst

T

-RRB-

DEF

W

G

-LRB-

-LRB-

put

-LRB-

v

-RRB-

lst

T

-RRB-

-RRB-

G

-LRB-

X

-LRB-

link

-LRB-

n

-RRB-

-RRB-

-RRB-

X

COMMU

SAFE

G

-LRB-

put

-LRB-

v

-RRB-

lst

F

-RRB-

G

-LRB-

link

-LRB-

n

-RRB-

-RRB-

MP

lst

F

G

-LRB-

link

-LRB-

n

-RRB-

-RRB-

Gp

p

E

empty

T

lst

F

link

-LRB-

n

-RRB-

In

general

in

order

to

produce

specifications

directly

realisable

as

actor

programs

we

must

include

formulae

stating

cause/consequence

connections

as

specification

axioms

to

relate

the

processing

of

messages

to

local

computations

The

premises

of

our

proof

above

belong

to

this

category

Although

we

have

presented

simplified

causal

connections

that

the

effect

of

processing

a

message

is

produced

just

after

its

consumption

to

consider

that

the

cause

of

some

current

activity

resides

in

a

event

of

the

remote

past

would

not

present

any

new

difficulty

to

our

reasoning

methods

other

than

requiring

more

complex

proofs

Composing

Actor

Communities

In

Section

we

discovered

that

to

give

an

account

of

what

is

usually

considered

to

be

a

component

in

Actors

we

need

at

least

to

be

able

to

put

distinct

signatures

together

to

represent

the

structure

of

yet

another

component

or

an

entire

system

The

view

that

complex

components

should

be

defined

in

terms

of

smaller

components

connected

together

has

been

developed

within

the

theory

of

Institutions

-LSB-

-RSB-

which

requires

the

definition

of

basic

entities

to

be

regarded

as

connectable

units

In

our

case

these

will

be

extended

actor

specifications

Next

it

is

necessary

provide

means

of

connecting

these

objects

to

each

other

Traditionally

in

a

logical

approach

to

specification

this

is

achieved

by

providing

translations

between

the

languages

of

the

related

theories

-LSB-

-RSB-

If

a

symbol-to-symbol

mapping

-LRB-

morphism

-RRB-

between

two

signatures

is

given

the

existence

of

a

translation

between

the

respective

languages

can

be

guaranteed

along

with

an

interpretation

between

their

theories

Definition

-LRB-

Signature

Morphisms

-RRB-

Given

two

actor

signatures

-LRB-

-RRB-

and

-LRB-

-RRB-

a

signature

morphism

o

consists

of

ffl

a

limit

preserving

morphism

of

algebraic

structures

oAE

such

that

oAE

-LRB-

-RRB-

and

oAE

-LRB-

-RRB-

and

also

that

oAE

-LRB-

-RRB-

oAE

-LRB-

-RRB-

and

oAE

-LRB-

-RRB-

ffl

for

each

f

sni

s

an

attribute

symbol

o

-LRB-

f

-RRB-

oAE

-LRB-

-RRB-

oAE

-LRB-

sn

-RRB-

oAE

-LRB-

s

-RRB-

in

such

that

o

-LRB-

-RRB-

and

that

-LCB-

o

-LRB-

-RRB-

where

for

each

initc

o

-LRB-

initc

-RRB-

inito

-LRB-

c

-RRB-

-LCB-

o

-LRB-

-RRB-

where

for

each

sentc

o

-LRB-

sentc

-RRB-

sento

-LRB-

c

-RRB-

-LCB-

o

-LRB-

-RRB-

where

for

each

delivdc

o

-LRB-

delivdc

-RRB-

delivdo

-LRB-

c

-RRB-

ffl

for

each

c

sni

an

action

symbol

o

-LRB-

c

-RRB-

oAE

-LRB-

-RRB-

oAE

-LRB-

sn

-RRB-

in

such

that

o

-LRB-

-RRB-

and

that

-LCB-

o

-LRB-

-RRB-

where

o

-LRB-

-RRB-

-LSB-

and

o

-LRB-

-RRB-

-LRB-

-RRB-

-LSB-

-LRB-

-RRB-

o

-LRB-

-RRB-

where

o

-LRB-

-RRB-

and

o

-LRB-

-RRB-

such

that

o

-LRB-

-RRB-

-LCB-

o

-LRB-

-RRB-

o

-LRB-

-RRB-

and

o

-LRB-

-RRB-

where

for

each

inc

o

-LRB-

inc

-RRB-

ino

-LRB-

c

-RRB-

for

each

outc

o

-LRB-

outc

-RRB-

outo

-LRB-

c

-RRB-

-LCB-

o

-LRB-

-RRB-

where

for

each

rcvc

o

-LRB-

rcvc

-RRB-

rcvo

-LRB-

c

-RRB-

It

is

straightforward

to

define

inductively

the

translation

of

sets

of

symbols

classifications

terms

and

formulae

under

o

Since

renaming

is

one

of

the

features

of

the

translation

morphisms

capture

the

relabelling

operation

described

in

-LSB-

-RSB-

used

to

equalise

identifiers

of

distinct

composed

components

Not

only

a

translation

between

the

languages

of

two

signatures

is

provided

by

a

morphism

but

also

a

set

of

characteristics

to

allow

the

connected

actors

to

exchange

messages

and

to

create

new

actors

For

example

the

requirement

that

morphisms

between

universal

signatures

be

limit

preserving

appears

because

the

parameterisation

of

actor

specifications

can

be

better

seen

as

a

translation

of

sort

morphisms

rather

than

as

the

sort

inclusion

described

in

Section

Instead

of

adding

sorts

to

signatures

one

may

consider

that

products

of

sorts

used

as

parameters

of

symbols

define

sort

morphisms

-LRB-

projections

-RRB-

internal

to

each

signature

Some

product

sorts

and

their

morphisms

can

then

be

mapped

to

products

of

sorts

of

the

target

signature

equiped

with

a

new

projection

onto

the

new

parameter

sort

which

defines

the

set

of

actor

names

If

limits

-LRB-

which

generalise

products

-RRB-

were

not

preserved

the

translation

might

not

be

correct

In

addition

we

can

see

that

symbols

belonging

only

to

the

extension

of

original

signatures

have

their

translation

determined

by

the

translation

of

the

symbols

provided

This

means

that

the

specifier

in

defining

a

morphism

to

connect

distinct

signatures

does

not

need

to

be

concerned

with

the

new

symbols

introduced

in

the

signature

extension

Furthermore

signature

morphisms

allow

some

external

symbols

-LRB-

members

of

e

-RRB-

to

become

internal

This

captures

the

fact

that

in

a

complex

component

there

may

be

events

required

from

the

environment

of

a

sub-component

which

are

not

required

by

the

whole

component

because

they

are

provided

by

another

sub-component

of

the

same

configuration

Of

course

we

want

to

be

always

able

to

combine

distinct

signatures

in

such

a

way

that

the

structure

to

support

interaction

between

actors

is

provided

This

can

be

accomplished

if

we

can

show

that

for

every

three

generic

signatures

connected

through

morphisms

so

that

one

contains

symbols

to

be

shared

by

the

others

there

is

a

way

of

collapsing

such

objects

into

a

new

larger

signature

wherein

the

shared-to-be

symbols

are

equalised

As

a

consequence

any

such

aggregations

through

morphisms

will

be

possible

Using

Category

Theory

this

is

equivalent

to

show

that

the

category

of

signatures

has

an

initial

object

-LRB-

the

empty

signature

shared

by

disjoint

components

-RRB-

and

pushouts

A

category

with

these

characteristics

is

called

co-complete

Theorem

Actor

signatures

and

signature

morphisms

constitute

a

finitely

co-complete

category

Sig

That

Sig

is

a

category

follows

from

the

definition

of

signature

morphisms

and

from

the

constraints

in

Definitions

and

In

particular

since

actions

in

are

equalised

in

Definition

and

the

functional

nature

of

morphisms

preserves

this

characteristic

identities

always

exist

The

initial

object

of

Sig

is

-LRB-

up

to

isomorphism

-RRB-

-LRB-

-LRB-

faddr

boolg

fT

F

NOTg

-RRB-

-LRB-

f

g

f

g

f

g

f

g

-RRB-

-LRB-

f

g

f

g

f

g

f

g

f

g

f

g

-RRB-

-RRB-

From

the

definition

of

extended

signatures

and

signature

morphisms

we

can

see

that

a

pushout

of

two

morphisms

and

is

given

by

and

such

that

ffl

-LRB-

-RRB-

-LRB-

-RRB-

where

and

are

a

pushout

of

and

ffl

o

-LRB-

-RRB-

Al

o

-LRB-

-RRB-

finitcjc

lbg

fsentcjc

-LRB-

e?eb

-RRB-

-LSB-

-LRB-

l?lb

-RRB-

g

and

fdelivdcjc

lbg

ffl

o

-LRB-

-RRB-

e

o

-LRB-

-RRB-

and

o

-LRB-

-RRB-

l

o

-LRB-

-RRB-

where

l

o

-LRB-

-RRB-

e

l

o

-LRB-

-RRB-

foutcjc

fincjc

and

frcvcjc

lbg

That

is

a

pushout

of

two

signatures

is

given

by

the

union

of

each

of

their

sets

of

symbols

after

renaming

them

accordingly

-LRB-

i.e.

their

amalgamed

sum

-RRB-

Notice

that

the

pushout

preserves

the

intersection

between

the

sets

of

local

and

external

action

symbols

of

the

shared

component

for

the

sake

of

correctness

of

composition

Clearly

to

the

eyes

of

the

specifier

composition

also

appears

to

happen

at

the

level

of

actor

signatures

since

symbols

appearing

only

in

extensions

have

their

combination

determined

by

the

combination

of

the

original

symbols

provided

The

notion

of

interpretation

between

theories

induced

by

the

signature

morphisms

above

does

not

capture

the

expected

combination

of

object

behavior

as

usual

in

Institutions

-LSB-

-RSB-

This

happens

because

such

morphisms

do

not

translate

some

logical

axioms

of

the

source

theory

which

are

necessary

to

guarantee

a

correct

collective

behaviour

In

order

to

support

this

the

definition

of

non-standard

specification

morphisms

is

necessary

Definition

-LRB-

Specification

Morphisms

-RRB-

Given

two

actor

specifications

-LRB-

-RRB-

and

-LRB-

-RRB-

an

specification

morphism

o

is

a

signature

morphism

such

that

o

-LRB-

g

-RRB-

for

every

g

o

-LRB-

g

-RRB-

for

every

g

L

The

inclusion

of

the

logical

axioms

L

into

is

necessary

since

these

properties

are

not

always

a

consequence

of

L

because

they

depend

on

the

set

of

symbols

of

the

signature

Once

the

signature

is

augmented

using

a

morphism

these

properties

may

fail

to

hold

The

locality

scheme

for

non-logical

symbols

say

is

not

preserved

by

the

translation

-LSB-

-RSB-

and

the

same

happens

with

consistency

-LSB-

-RSB-

It

is

easy

to

see

that

some

other

schemes

also

fail

to

hold

Another

category

is

determined

by

specification

morphisms

Theorem

-LRB-

Category

of

Actor

Specifications

-RRB-

Actor

specifications

and

specification

morphisms

constitute

the

finitely

co-complete

category

Actor

That

Actor

is

a

category

follows

from

the

canonical

translations

between

the

connected

theory

presentations

induced

by

signature

morphisms

and

from

the

fact

that

Sig

is

already

a

category

The

initial

object

of

Actor

is

-LRB-

f

g

-RRB-

the

empty

signature

and

the

empty

set

of

axioms

A

pushout

of

two

specification

morphisms

-LRB-

-RRB-

-LRB-

-RRB-

and

-LRB-

-RRB-

-LRB-

-RRB-

is

given

by

-LRB-

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

g

-RRB-

jg

L

-LRB-

g

-RRB-

jg

L

-RRB-

where

and

are

a

pushout

of

and

as

morphisms

of

Sig

A

comparison

between

our

notion

of

composability

and

that

presented

in

-LSB-

-RSB-

is

in

order

here

As

a

concurrent

objects

composition

a

pushout

of

specification

morphisms

is

commutative

and

has

as

identity

In

addition

given

a

set

of

specifications

with

their

pairwise

shared

sub-components

fixed

all

their

possible

compositions

in

any

distinct

order

are

isomorphic

among

themselves

which

yields

associativity

up

to

isomorphism

-LRB-

in

the

Category

Theory

sense

-RRB-

Although

the

notion

of

composability

presented

therein

is

semantic

and

fails

to

compose

components

having

in

common

identical

names

of

existing

actors

this

is

syntactically

immaterial

since

there

is

a

canonical

way

of

relating

actor

syntax

and

semantics

as

hinted

in

-LSB-

-RSB-

and

implicitly

followed

here

by

obliging

the

composed

specifications

to

entail

configurations

with

disjunct

sets

of

existing

actor

addresses

Consequently

we

have

presented

an

entirely

syntactic

formalisation

of

the

composition

notion

described

in

that

works

Arguably

some

information

could

have

been

hidden

in

our

presentation

of

the

logic

For

instance

instead

of

defining

the

specification

language

in

terms

of

full

branching

time

temporal

logic

we

could

have

used

a

linear

time

logic

augmented

with

enableness

predicates

We

should

stress

however

that

we

are

not

proposing

particular

specification

language

or

specification

constructs

but

a

proof-theoretic

foundation

on

top

of

which

such

objects

could

be

defined

Example

Revisited

and

Extended

Using

the

technique

described

in

the

previous

section

we

can

now

study

communities

of

heterogeneous

actors

A

good

example

is

obtained

by

composing

a

buffer

as

described

in

Section

Actor

Terminal

data

types

addr

int

attributes

buf

addr

actions

rst

-LRB-

addr

-RRB-

local

birth

rd

-LRB-

int

-RRB-

local

comput

trx

-LRB-

addr

-RRB-

extrn

message

axioms

m

addr

v

int

A

-LRB-

rst

-LRB-

m

-RRB-

X

-LRB-

buf

m

-RRB-

-RRB-

-LRB-

A.

-RRB-

A

-LRB-

rd

-LRB-

v

-RRB-

X

-LRB-

send

-LRB-

trx

buf

v

-RRB-

-RRB-

-RRB-

-LRB-

A.

-RRB-

End

Actor

Processor

data

types

addr

int

attributes

inp

me

addr

done

int

actions

ini

-LRB-

addr

addr

-RRB-

local

birth

exc

-LRB-

int

-RRB-

nop

local

comput

rcv

-LRB-

int

-RRB-

local

message

req

-LRB-

addr

-RRB-

extrn

message

axioms

m

n

addr

v

int

A

-LRB-

ini

-LRB-

m

n

-RRB-

X

-LRB-

me

m

inp

n

-RRB-

-RRB-

-LRB-

A.

-RRB-

A

-LRB-

nop

exc

-LRB-

v

-RRB-

-LRB-

me

n

X

-LRB-

me

n

-RRB-

-RRB-

-RRB-

-LRB-

A.

-RRB-

A

-LRB-

nop

exc

-LRB-

v

-RRB-

-LRB-

inp

n

X

-LRB-

inp

n

-RRB-

-RRB-

-RRB-

-LRB-

A.

-RRB-

A

-LRB-

nop

-LRB-

done

v

X

-LRB-

done

v

-RRB-

-RRB-

-RRB-

-LRB-

A.

-RRB-

A

-LRB-

nop

send

-LRB-

req

inp

me

-RRB-

-RRB-

-LRB-

A.

-RRB-

A

-LRB-

exc

-LRB-

v

-RRB-

X

-LRB-

done

v

-RRB-

-RRB-

-LRB-

A.

-RRB-

A

-LRB-

ini

-LRB-

m

n

-RRB-

rcv

-LRB-

c

-RRB-

exc

-LRB-

v

-RRB-

nop

-RRB-

-LRB-

A.

-RRB-

A

-LRB-

rcv

-LRB-

v

-RRB-

X

-LRB-

exc

-LRB-

v

-RRB-

-RRB-

-RRB-

-LRB-

A.

-RRB-

End

-LRB-

rcv

v

-RRB-

-LRB-

A.

-RRB-

A

-LRB-

-LRB-

ini

-LRB-

m

n

-RRB-

nop

exc

-LRB-

v

-RRB-

-RRB-

Enp

-LRB-

rcv

v

-RRB-

-RRB-

-LRB-

A.

-RRB-

End

Figure

Simplified

specification

of

terminals

and

processors

with

a

processor

and

a

set

of

terminals

to

represent

a

uniprocessor

time-sharing

architecture

The

intended

behaviour

of

this

complex

component

whose

specification

shall

be

called

UTSA

is

to

allow

commands

typed

by

terminal

users

to

be

always

eventually

executed

The

specification

of

terminal

and

processor

actors

for

this

purpose

appear

in

Figure

Terminals

become

aware

of

the

mail

address

of

a

cell

that

will

serve

as

their

buffer

at

creation

time

-LRB-

A.

-RRB-

Afterwards

they

always

transmit

typed

commands

to

the

buffer

to

wait

for

processing

-LRB-

A.

-RRB-

Processors

in

turn

have

a

more

complex

behaviour

since

they

have

to

request

the

next

command

from

the

buffer

at

each

free

processing

cycle

-LRB-

A.

-RRB-

Once

a

command

is

received

by

the

processor

it

is

subsequently

executed

-LRB-

A.

-RRB-

The

local

computation

cycle

of

the

processor

alternates

among

the

occurrence

of

the

actions

nop

rcv

and

exc

-LRB-

A.

-RRB-

which

starts

only

after

the

initialisation

of

its

behaviour

through

ini

-LRB-

A.

-RRB-

Of

course

the

above

specified

actors

can

not

work

as

a

single

component

unless

the

proper

connections

between

them

are

provided

Morphisms

must

establish

physical

shared

channels

to

enable

message

exchange

as

defined

by

Figure

As

expected

and

UTSA

which

result

from

the

composition

of

the

three

specified

components

are

defined

up

to

isomorphism

by

the

pushout

of

the

respective

sub-components

This

means

that

any

name

for

their

symbols

suffices

as

long

as

the

symbols

to

be

shared

and

only

them

are

equalised

They

are

defined

according

to

the

two

connectors

and

their

morphisms

as

follows

Terminal?BufferCell

BufferCell?Processor

trx

oe

x

put

get

oe

y

req

reply

oe

z

rcv

That

is

the

signature

of

contains

one

external

message

symbol

only

called

x

which

is

mapped

to

the

trx

action

of

terminals

and

to

the

put

action

of

buffers

-LRB-

notice

that

UTSA

aeaeae

-RCB-

ZZZ

aeaeae

-RCB-

ZZZ

aeaeae

-RCB-

ZZZ

Terminal

Buffer

Processor

-RCB-

ZZZ

aeaeae

-RCB-

ZZZ

aeaeae

Figure

Static

configuration

of

the

component

both

actions

have

the

same

arity

-RRB-

has

two

actions

which

are

mapped

to

get

and

reply

at

the

buffer

side

and

to

req

and

rcv

at

the

processor

side

respectivelly

It

is

easy

to

check

that

these

morphisms

satisfy

the

constraints

in

Definition

So

far

we

have

specified

components

consisting

of

individual

actors

To

describe

communities

of

similar

actors

though

morphisms

can

also

be

used

Each

diamond

of

the

diagram

above

should

actually

have

the

following

structure

to

allow

similar

actors

to

exist

concurrently

-LSB-

addr

-RSB-

Terminal

-LSB-

addr

-RSB-

QQQs

QQQs

Buffer

-LSB-

addr

-RSB-

-LSB-

addr

-RSB-

Terminal

QQQs

QQQs

Buffer

The

vertical

arrows

add

a

new

sort

morphism

to

each

specification

For

instance

the

product

sort

p

which

is

the

parameter

of

item

having

a

projection

ssa

p

int

should

be

mapped

accordingly

to

and

to

such

that

has

another

projection

addr

to

cater

for

the

new

parameter

sort

Using

this

kind

of

structure

it

is

possible

to

state

properties

like

addr

-LRB-

k

new

-LRB-

buffer

n

-RRB-

-LRB-

addr

k

new

-LRB-

processor

m

n

m

-RRB-

-RRB-

addr

k

new

-LRB-

terminal

n

-RRB-

addr

k

new

-LRB-

terminal

tl

n

-RRB-

-RRB-

-LRB-

-RRB-

provided

that

the

following

translations

-LRB-

renamings

-RRB-

for

the

birth

actions

are

given

rst

ffi

terminal

ffi

buffer

ini

ffi

ffi

processor

This

kind

of

property

should

be

provided

by

the

environment

-LRB-

a

different

component

connected

to

UTSA

-RRB-

to

guarantee

the

creation

of

a

set

of

actors

configured

in

the

intended

way

Therefore

the

specifier

is

not

only

required

to

provide

morphisms

-LRB-

which

allow

actors

in

different

communities

to

interact

-RRB-

but

also

to

assume

that

the

environment

guarantees

the

existence

of

some

logical

shared

channels

-LRB-

names

to

bind

the

actors

to

each

other

-RRB-

to

be

able

to

verify

properties

of

actor

components

in

a

correct

way

The

characteristic

property

of

UTSA

that

the

processing

of

typed

commands

is

always

eventually

completed

can

be

stated

as

follows

UTSA

AG

-LRB-

ti

rd

-LRB-

v

-RRB-

AF

-LRB-

m

done

v

-RRB-

-RRB-

-LRB-

-RRB-

This

is

an

instance

of

what

is

called

Fair

Merge

Problem

in

the

literature

In

other

words

the

processing

of

sequences

of

commands

from

each

user

must

be

fair

which

means

that

each

of

them

must

not

have

the

completion

of

its

execution

indefinitely

delayed

This

kind

of

inacceptable

behaviour

would

appear

for

example

if

the

processor

could

ignore

commands

from

specific

users

We

should

point

out

here

that

by

stating

the

problem

as

Property

we

have

already

made

one

important

assumption

that

user

commands

can

only

be

consumed

by

the

processor

whose

mail

address

is

m

This

is

guaranteed

by

Formula

which

should

be

part

of

an

axiom

of

the

environment

as

it

was

presented

with

the

existential

quantifiers

hiding

the

name

of

the

actors

Actually

it

is

possible

to

be

more

permissive

and

allow

the

name

of

the

buffer

to

be

visible

in

order

to

have

a

dynamically

configurable

system

where

other

terminals

can

subsequently

be

connected

to

the

configuration

for

instance

as

soon

as

the

environment

does

not

allow

the

name

of

the

buffer

to

become

known

by

additional

actors

which

could

consume

its

cells

Axiom

A.

allow

us

to

rewrite

Property

in

a

slightly

different

manner

in

order

to

facilitate

the

application

of

the

derived

rules

of

our

proof

system

UTSA

AG

-LRB-

ti

send

-LRB-

trx

n

v

-RRB-

AF

-LRB-

m

done

v

-RRB-

-RRB-

-LRB-

-RRB-

To

verify

this

property

we

rely

on

the

fact

that

buffers

are

organised

as

finite

queues

of

logically

linked

cells

so

that

each

cell

either

processes

incoming

messages

or

forwards

them

to

be

dealt

with

by

its

successors

because

the

cell

has

already

been

consumed

or

is

not

the

last

element

of

the

queue

or

else

it

ignores

each

message

because

the

entire

buffer

is

empty

Some

auxiliary

definitions

are

required

to

state

these

properties

Rn

-LRB-

x

y

-RRB-

y

nxt

x

y

lst

F

P

-LRB-

v

-RRB-

n

cont

v

n

empty

F

Q

-LRB-

m

v

-RRB-

n

cont

v

n

send

-LRB-

reply

m

v

-RRB-

The

formal

proof

of

Property

is

started

as

ti

send

-LRB-

trx

n

v

-RRB-

AFP

-LRB-

v

-RRB-

AG

-LRB-

m

send

-LRB-

req

n

m

-RRB-

nop

-RRB-

P

-LRB-

v

-RRB-

AG

-LRB-

m

send

-LRB-

req

n

m

-RRB-

nop

-RRB-

AFQ

-LRB-

m

v

-RRB-

MP

P

-LRB-

v

-RRB-

AFQ

-LRB-

m

v

-RRB-

I

P

-LRB-

v

-RRB-

AFQ

-LRB-

m

v

-RRB-

Q

-LRB-

m

v

-RRB-

AF

-LRB-

m

done

v

-RRB-

TRANS

AF

P

-LRB-

v

-RRB-

AF

-LRB-

m

done

v

-RRB-

TRANS

AF

UTSA

ti

send

-LRB-

trx

n

v

-RRB-

AF

-LRB-

m

done

v

-RRB-

AG

I

UTSA

AG

-LRB-

ti

send

-LRB-

trx

n

v

-RRB-

AF

-LRB-

m

done

v

-RRB-

-RRB-

This

root

proof

tree

exemplifies

how

our

deductive

system

can

be

used

to

decompose

the

verification

of

global

properties

of

complex

actor

components

into

local

proofs

We

know

that

a

proof

about

a

single

component

can

be

translated

to

the

language

of

the

composite

component

because

of

the

existence

of

an

importing

morphism

Due

to

the

necessity

of

using

the

derived

rules

of

Section

in

order

to

complete

the

proof

above

the

property

of

UTSA

is

decomposed

into

the

numbered

sequents

which

remain

to

be

proved

using

the

local

verification

contexts

provided

by

Processor

and

our

proofs

while

IDEMP

and

TRANS

denote

the

idempotence

and

transitivity

of

a

temporal

operator

its

distributivity

over

and

commutability

with

logical

connectives

are

represented

by

DISTR

and

COMMU

Notice

that

Rn

determines

a

binary

relation

between

linked

cells

of

a

buffer

whose

initial

actor

has

mail

address

n

If

this

relation

is

well-founded

meaning

that

infinitely

decreasing

sequences

do

not

exist

we

could

use

a

basic

proof

rule

of

temporal

logic

WELL

-LSB-

page

-RSB-

as

a

means

of

induction

for

proving

that

a

message

eventually

arrives

at

a

cell

which

can

treat

it

Using

the

notation

of

Section

the

well-foundedness

of

Rn

is

formalised

as

Rn

-LRB-

x

x

-RRB-

AG

-LRB-

n

nxt

x

Mod

-LRB-

n

nxt

-RRB-

Rn

-LRB-

x

-RRB-

-RRB-

Inv

-LRB-

n

nxt

-RRB-

AFAG

-LRB-

Inv

-LRB-

n

nxt

-RRB-

-RRB-

-LRB-

-RRB-

Since

Figure

prescribes

that

every

queue

is

created

having

a

last

element

-LRB-

according

to

A.

and

A.

-RRB-

and

each

subsequent

local

computation

preserves

this

characteristic

-LRB-

from

A.

and

A.

-RRB-

the

property

above

is

valid

The

anti-reflexivity

of

Rn

stated

as

the

first

half

of

Formula

is

proved

using

rule

SAFE

fRn

-LRB-

x

x

-RRB-

g

x

f

R

-LRB-

x

x

-RRB-

g

fRn

-LRB-

x

x

-RRB-

gx

item

-LRB-

v

-RRB-

f

R

-LRB-

x

x

-RRB-

g

f

R

-LRB-

x

x

-RRB-

g

x

void

f

R

-LRB-

x

x

-RRB-

g

f

R

-LRB-

x

x

-RRB-

g

x

link

-LRB-

n

-RRB-

f

R

-LRB-

x

x

-RRB-

g

SAFE

AG

-LRB-

Rn

-LRB-

x

x

-RRB-

-RRB-

AGp

p

Rn

-LRB-

x

x

-RRB-

Now

it

is

easy

to

use

the

axioms

in

Figure

to

prove

each

of

the

premises

above

which

depend

on

the

occurrence

of

one

action

only

A

fx

nxt

x

x

lst

Fg

x

fx

empty

T

x

lst

Tg

ID

x

lst

T

x

lst

T

E

I

x

empty

T

x

lst

T

-LRB-

x

nxt

x

-RRB-

x

lst

T

I

x

empty

T

x

lst

T

-LRB-

x

nxt

x

-RRB-

x

lst

T

LCR

fx

nxt

x

x

lst

Fg

x

f

-LRB-

x

nxt

x

-RRB-

x

lst

Tg

The

derived

rule

called

LCR

described

for

example

in

-LSB-

page

-RSB-

corresponds

to

the

strengthening

of

pre-conditions

and

weakening

of

post-conditions

usually

found

in

assertional

verification

methods

In

a

similar

way

it

is

used

to

verify

the

sequents

involving

item

and

void

To

proof

the

preservation

of

Rn

-LRB-

x

x

-RRB-

by

link

turns

out

to

be

more

delicate

since

such

action

changes

the

organization

of

the

buffer

by

appending

a

new

cell

to

the

end

of

the

queue

x

link

-LRB-

n

-RRB-

X

-LRB-

x

nxt

x

-RRB-

X

-LRB-

x

new

-LRB-

item

x

v

-RRB-

-RRB-

x

link

-LRB-

n

-RRB-

X

-LRB-

x

nxt

x

-RRB-

X

-LRB-

x

new

-LRB-

item

x

v

-RRB-

-RRB-

RAA

x

link

-LRB-

n

-RRB-

X

-LRB-

x

nxt

x

-RRB-

E

I

-LRB-

-LRB-

x

nxt

x

-RRB-

x

lst

T

-RRB-

x

link

-LRB-

n

-RRB-

X

-LRB-

x

nxt

x

-RRB-

X

-LRB-

x

lst

T

-RRB-

X

DISTR

X

COMMU

-LRB-

-LRB-

x

nxt

x

-RRB-

x

lst

T

-RRB-

x

link

-LRB-

n

-RRB-

X

-LRB-

-LRB-

x

nxt

x

-RRB-

x

lst

T

-RRB-

I

-LRB-

-LRB-

x

nxt

x

-RRB-

x

lst

T

-RRB-

x

link

-LRB-

n

-RRB-

X

-LRB-

-LRB-

x

nxt

x

-RRB-

x

lst

T

-RRB-

A

I

f

-LRB-

x

nxt

x

-RRB-

x

lst

Tg

x

link

-LRB-

n

-RRB-

f

-LRB-

x

nxt

x

-RRB-

x

lst

Tg

That

is

we

are

going

to

use

the

fact

that

an

actor

can

not

create

itself

in

order

to

reach

a

contradiction

The

remaining

left

branch

of

the

proof

tree

is

constructed

as

follows

A

x

link

-LRB-

n

-RRB-

X

-LRB-

x

nxt

x

-RRB-

ID

X

-LRB-

x

nxt

x

-RRB-

X

-LRB-

x

nxt

x

-RRB-

I

X

DISTR

x

link

-LRB-

n

-RRB-

X

-LRB-

x

nxt

x

-RRB-

X

-LRB-

x

nxt

n

x

nxt

x

-RRB-

FUNCT

nxt

x

n

RIGID

x

link

-LRB-

n

-RRB-

X

-LRB-

x

nxt

x

-RRB-

n

x

ID

x

link

-LRB-

n

-RRB-

x

link

-LRB-

n

-RRB-

SUBST

x

link

-LRB-

n

-RRB-

n

x

x

link

-LRB-

x

-RRB-

CUT

CONTR

x

link

-LRB-

n

-RRB-

X

-LRB-

x

nxt

x

-RRB-

x

link

-LRB-

x

-RRB-

X

I

x

link

-LRB-

n

-RRB-

X

-LRB-

x

nxt

x

-RRB-

X

-LRB-

x

link

-LRB-

x

-RRB-

-RRB-

A

A

X

-LRB-

x

link

-LRB-

x

-RRB-

-RRB-

X

-LRB-

x

new

-LRB-

item

x

v

-RRB-

-RRB-

MP

x

link

-LRB-

n

-RRB-

X

-LRB-

x

nxt

x

-RRB-

X

-LRB-

x

new

-LRB-

item

x

v

-RRB-

-RRB-

To

justify

that

when

a

link

to

another

cell

happens

and

in

the

next

instant

nxt

points

to

some

buffer

element

both

refer

to

the

same

cell

we

rely

on

the

functional

interpretation

given

to

attributes

they

can

not

be

equal

to

two

distinct

values

at

the

same

time

which

is

formalised

by

the

axiom

scheme

FUNCT

of

-LSB-

page

-RSB-

The

fact

that

variables

are

rigid

-LSB-

-RSB-

they

do

not

vary

as

time

passes

is

also

used

The

right

branch

of

the

same

proof

is

constructed

based

on

an

application

of

rule

EXIST

using

Property

as

an

assumption

-LRB-

-RRB-

ID

k

new

-LRB-

buffer

x

-RRB-

k

new

-LRB-

buffer

x

-RRB-

E

I

-LRB-

-RRB-

k

new

-LRB-

buffer

x

-RRB-

ID

I

x

new

-LRB-

item

x

v

-RRB-

x

new

-LRB-

item

x

v

-RRB-

I

CONTR

x

new

-LRB-

item

x

v

-RRB-

x

new

-LRB-

item

x

v

-RRB-

EXISTS

-LRB-

-RRB-

AXAG

-LRB-

x

new

-LRB-

item

x

v

-RRB-

-RRB-

MP

AXAG

-LRB-

x

new

-LRB-

item

x

v

-RRB-

-RRB-

AXAGp

AGAXp

AGp

p

AX

-LRB-

x

new

-LRB-

item

x

v

-RRB-

-RRB-

Ap

p

X

COMMU

X

-LRB-

x

new

-LRB-

item

x

v

-RRB-

-RRB-

WEAK

x

link

-LRB-

n

-RRB-

X

-LRB-

x

nxt

x

-RRB-

X

-LRB-

x

new

-LRB-

item

x

v

-RRB-

-RRB-

To

be

sure

that

the

second

part

of

Formula

is

valid

first

observe

that

x

nxt

varies

only

as

a

result

of

a

x

link

occurrence

-LRB-

A.

-RRB-

which

changes

the

status

of

the

cell

as

last

of

the

queue

and

links

it

to

the

new

subsequent

cell

behaving

in

this

way

according

to

Rn

From

the

proof

of

Property

we

know

that

another

x

link

will

never

happen

again

Therefore

whether

x

link

ever

happens

or

not

always

yields

x

nxt

becoming

eventually

henceforth

invariant

That

Rn

defines

a

well-founded

relation

authorises

us

to

use

rule

WELL

to

justify

steps

where

a

terminating

sequence

of

interactions

between

cells

of

a

buffer

is

to

be

proved

Resuming

the

main

proof

ti

send

-LRB-

trx

n

v

-RRB-

P

-LRB-

v

-RRB-

is

verified

using

applications

of

this

rule

followed

by

the

transitivity

of

AF

We

first

show

that

the

message

is

eventually

received

by

some

cell

c

ti

send

-LRB-

trx

n

v

-RRB-

AF

-LRB-

n

put

-LRB-

v

-RRB-

-RRB-

a

y

put

-LRB-

v

-RRB-

y

lst

F

AF

-LRB-

y

send

-LRB-

put

y

nxt

v

-RRB-

-RRB-

b

y

send

-LRB-

put

y

nxt

v

-RRB-

AF

-LRB-

Rn

-LRB-

k

y

-RRB-

k

put

-LRB-

v

-RRB-

-RRB-

y

put

-LRB-

v

-RRB-

y

lst

F

AF

-LRB-

Rn

-LRB-

k

y

-RRB-

k

put

-LRB-

v

-RRB-

-RRB-

ID

I

y

put

-LRB-

v

-RRB-

y

lst

T

x

put

-LRB-

v

-RRB-

x

lst

T

p

AFp

I

y

put

-LRB-

v

-RRB-

y

lst

T

AF

-LRB-

x

put

-LRB-

v

-RRB-

x

lst

T

-RRB-

I

y

put

-LRB-

v

-RRB-

AF

-LRB-

Rn

-LRB-

k

y

-RRB-

k

put

-LRB-

v

-RRB-

-RRB-

AF

-LRB-

x

put

-LRB-

v

-RRB-

x

lst

T

-RRB-

AF

DISTR

AG

I

AG

-LRB-

y

put

-LRB-

v

-RRB-

AF

-LRB-

-LRB-

Rn

-LRB-

k

y

-RRB-

k

put

-LRB-

v

-RRB-

-RRB-

-LRB-

x

put

-LRB-

v

-RRB-

x

lst

T

-RRB-

-RRB-

-RRB-

I

AG

-LRB-

y

put

-LRB-

v

-RRB-

AF

-LRB-

-LRB-

Rn

-LRB-

k

y

-RRB-

k

put

-LRB-

v

-RRB-

-RRB-

-LRB-

x

put

-LRB-

v

-RRB-

x

lst

T

-RRB-

-RRB-

-RRB-

WELL

AG

-LRB-

k

put

-LRB-

v

-RRB-

AF

-LRB-

x

put

-LRB-

v

-RRB-

x

lst

T

-RRB-

-RRB-

AGp

p

k

put

-LRB-

v

-RRB-

AF

-LRB-

x

put

-LRB-

v

-RRB-

x

lst

T

-RRB-

I

TRANS

AF

ti

send

-LRB-

trx

n

v

-RRB-

AF

-LRB-

x

put

-LRB-

v

-RRB-

x

lst

T

-RRB-

Sequent

-LRB-

a

-RRB-

is

a

direct

consequence

of

axiom

A.

The

sequents

-LRB-

b

-RRB-

and

-LRB-

c

-RRB-

can

be

proved

using

rules

COM

and

RESP

in

a

canonical

manner

We

use

the

latter

to

exemplify

how

such

kind

of

proof

can

be

produced

A

p

AFp

AF

DISTR

AF

-LRB-

End

-LRB-

put

v

-RRB-

-RRB-

AF

-LRB-

End

-LRB-

get

n

-RRB-

-RRB-

COM

DEF

F

ti

send

-LRB-

trx

n

v

-RRB-

AXAF

-LRB-

n

deliv

-LRB-

put

v

-RRB-

-RRB-

AXp

AFp

IDEMP

AF

ti

send

-LRB-

trx

n

v

-RRB-

AF

-LRB-

n

deliv

-LRB-

put

v

-RRB-

-RRB-

I

ti

send

-LRB-

trx

n

v

-RRB-

AF

-LRB-

n

deliv

-LRB-

put

v

-RRB-

-RRB-

AGAF

-LRB-

Enp

-LRB-

put

v

-RRB-

Enp

-LRB-

get

n

-RRB-

-RRB-

AGp

p

AF

DISTR

AF

-LRB-

Enp

-LRB-

put

v

-RRB-

-RRB-

AF

-LRB-

Enp

-LRB-

get

n

-RRB-

-RRB-

RESP

DEF

F

n

deliv

-LRB-

put

v

-RRB-

AXAF

-LRB-

n

put

-LRB-

v

-RRB-

-RRB-

AXp

AFp

IDEMP

AF

n

deliv

-LRB-

put

v

-RRB-

AF

-LRB-

n

put

-LRB-

v

-RRB-

-RRB-

I

n

deliv

-LRB-

put

v

-RRB-

AF

-LRB-

n

put

-LRB-

v

-RRB-

-RRB-

TRANS

AF

ti

send

-LRB-

trx

n

v

-RRB-

AF

-LRB-

n

put

-LRB-

v

-RRB-

-RRB-

The

application

of

rules

COM

and

RESP

may

be

very

demanding

and

require

many

derivations

starting

from

the

axioms

of

an

specification

depending

on

what

conclusion

is

of

interest

Fortunately

this

is

not

the

case

above

where

we

are

just

interested

in

the

delivery

and

the

consumption

of

the

message

itself

To

apply

such

rules

take

p

and

q

as

in

Definition

to

be

any

tautology

and

derive

the

enableness

of

the

actor

from

the

axioms

in

Figure

While

in

the

application

of

COM

such

derivation

is

straightforward

for

the

case

of

RESP

it

is

first

necessary

to

ensure

using

rule

SAFE

that

the

processing

of

any

BufferCell

message

is

always

eventually

enabled

To

finish

the

proof

of

sequent

number

we

still

have

to

show

that

the

proper

reaction

is

produced

when

the

message

put

is

consumed

A

x

put

-LRB-

v

-RRB-

x

lst

T

X

-LRB-

x

new

-LRB-

item

n

v

-RRB-

-RRB-

A

n

item

-LRB-

v

-RRB-

X

-LRB-

n

cont

v

n

empty

F

-RRB-

X

I

X

DISTR

X

-LRB-

n

item

-LRB-

v

-RRB-

-RRB-

-LRB-

n

cont

v

n

empty

F

-RRB-

x

new

-LRB-

item

n

v

-RRB-

-LRB-

n

cont

v

n

empty

F

-RRB-

X

I

X

DISTR

X

-LRB-

x

new

-LRB-

item

n

v

-RRB-

-RRB-

-LRB-

n

cont

v

n

empty

F

-RRB-

MP

x

put

-LRB-

v

-RRB-

x

lst

T

-LRB-

n

cont

v

n

empty

F

-RRB-

I

Xkp

AFp

x

put

-LRB-

v

-RRB-

x

lst

T

AF

-LRB-

n

cont

v

n

empty

F

-RRB-

I

x

put

-LRB-

v

-RRB-

x

lst

T

AF

-LRB-

n

cont

v

n

empty

F

-RRB-

The

process

of

finding

a

well-founded

relation

and

the

corresponding

application

of

rule

WELL

followed

by

applications

of

COM

and

RESP

can

be

seen

as

the

general

case

in

proving

eventuality

properties

of

actor

components

with

no

a

priori

bound

on

their

intensive

interaction

This

happens

because

a

message

should

always

arrive

at

a

terminal

actor

in

the

interaction

chain

If

this

were

not

the

case

if

we

could

not

find

any

such

relation

we

could

not

be

interested

in

proving

the

eventuality

since

it

would

be

in

fact

a

-LRB-

safety

-RRB-

property

the

actors

in

the

configuration

always

have

The

fact

that

our

architecture

is

fair

in

processing

user

commands

also

relies

on

the

reply

of

the

buffer

containing

the

next

command

to

be

processed

-LRB-

i.e.

sequent

number

-RRB-

This

characteristic

is

proved

much

in

the

way

that

the

proof

of

sequent

-LRB-

c

-RRB-

is

constructed

Sequent

is

a

direct

consequence

of

axiom

A.

The

proof

of

sequent

is

as

long

as

that

of

sequent

we

can

define

for

instance

another

well-founded

relation

using

the

cell

containing

command

v

as

a

terminal

element

instead

of

using

the

last

element

of

the

queue

Since

these

proofs

do

not

serve

to

illustrate

any

new

interesting

characteristic

of

the

logic

they

are

omitted

here

Some

peculiarities

appear

in

the

verification

of

cooperative

safety

properties

of

complex

actor

components

For

instance

to

proof

that

BufferCell

AG

-LRB-

x

empty

F

x

lst

F

x

nxt

empty

F

-RRB-

-LRB-

-RRB-

which

captures

the

FIFO

discipline

maintained

by

buffers

it

is

necessary

to

verify

some

liveness

properties

which

result

from

the

messages

sent

by

x

to

x

nxt

Usually

the

opposite

happens

that

such

properties

are

required

as

premises

in

proving

cooperative

liveness

Due

to

the

asynchronous

message

passing

between

actors

only

safety

properties

which

do

not

depend

on

message

exchange

can

be

proved

independently

as

in

Section

Also

notice

that

even

when

an

actor

with

mail

address

x

nxt

does

not

exist

or

belongs

to

a

different

community

x

nxt

empty

is

a

well

formed

term

In

a

way

every

actor

carries

in

our

formalisation

a

representation

of

all

the

attributes

and

actions

of

the

component

although

only

a

fraction

of

them

should

be

in

use

Concluding

Remarks

Contributions

In

this

paper

we

have

presented

an

axiomatisation

for

the

kernel

primitives

of

Actors

using

a

temporal

logic

of

objects

We

showed

not

only

how

actor

systems

can

be

specified

and

verified

in

this

framework

but

also

how

to

compose

actor

specifications

using

techniques

from

Category

Theory

All

these

developments

were

illustrated

by

means

of

a

concrete

and

practical

example

Our

main

contributions

are

ffl

A

logic

and

in

particular

a

proof

theory

for

actor

specification

and

verification

It

is

important

to

mention

here

that

this

logic

does

not

commit

the

development

process

to

the

use

of

any

particular

programming

language

Even

if

our

axiomatization

assigns

meaning

to

the

Actor

primitives

in

order

to

allow

systematic

reasoning

specifications

could

be

implemented

on

top

of

a

platform

which

does

not

support

such

primitives

as

basic

features

of

the

programming

language

This

is

not

a

problem

but

a

key

feature

of

our

approach

instead

which

allows

implementations

in

diverse

programming

languages

to

be

benefited

by

the

modularity

achieved

in

specifying

concurrent

systems

as

communities

of

interconnected

actors

ffl

A

consistent

integration

of

Actors

to

abstract

data

type

like

specifications

Both

actors

and

ADTs

have

been

successfully

used

in

representing

real

systems

While

actors

provide

a

clean

treatment

to

concurrency

and

interaction

ADTs

have

the

proper

interfacing

and

modularisation

structures

to

support

specification

in

the

large

ffl

A

novel

and

more

elegant

formalisation

of

the

syntactic

notion

of

composability

proposed

in

-LSB-

-RSB-

Other

notions

of

composability

presented

in

-LSB-

-RSB-

have

a

semantic

flavour

The

notion

presented

here

enforces

the

distinction

between

actor

functionality

and

configuration

by

separating

their

definition

from

each

other

In

relation

to

the

usual

compiling

time

composition

of

actor

programs

our

notion

has

the

advantage

of

relying

neither

on

the

choice

of

names

for

actor

symbols

nor

on

the

functional

character

of

the

language

Summarising

we

presented

a

logic

-LRB-

in

the

Institutions

sense

-LSB-

-RSB-

-RRB-

defined

here

around

the

notions

of

temporal

theory

presentations

and

logical

consequence

as

suggested

in

-LSB-

-RSB-

This

logic

appears

to

be

suitable

to

capture

our

intuitions

about

actor

systems

at

a

high

level

of

abstraction

but

is

not

trivial

due

to

the

Actor

features

not

found

together

in

other

existing

logics

-LRB-

a

fairness

mechanism

for

action

occurrences

that

depends

on

the

enableness

of

the

entire

object

a

mode

of

interaction

that

needs

to

support

not

only

asynchrony

but

also

synchrony

to

mention

a

few

-RRB-

Nonetheless

the

complex

characteristics

of

actor

systems

can

be

treated

in

a

modular

and

incremental

manner

because

of

the

categorical

techniques

used

for

composition

which

favour

the

distinction

between

static

versus

dynamic

aspects

-LRB-

what

is

captured

by

a

signature

morphism

or

as

an

assumption

about

actor

names

respectively

-RRB-

as

well

as

the

distinction

between

shared

and

local

resources

-LRB-

what

is

identified

to

be

shared

or

not

by

a

pushout

-RRB-

Similar

benefits

due

to

the

use

of

both

logical

and

categorical

techniques

to

formalise

other

approaches

to

object-based

systems

development

have

been

described

in

the

recent

literature

-LSB-

-RSB-

Related

work

Many

other

logics

for

concurrent

object-based

systems

development

have

been

proposed

In

-LSB-

-RSB-

for

instance

is

described

a

proof

system

based

on

the

CSP

communication

primitives

which

supports

the

verification

of

programs

written

in

a

simplified

version

of

POOL

Although

the

creation

of

new

objects

is

the

central

subject

therein

and

a

complete

proof

system

using

Hoare

triples

is

provided

to

adapt

such

work

to

the

verification

of

actors

would

require

substantial

changes

due

to

the

requirements

of

asynchrony

and

fairness

Furthermore

we

can

not

hope

to

have

a

complete

proof

system

for

Actors

due

to

the

required

use

of

a

first

order

temporal

logic

Following

the

modal

logics

school

a

linear

time

temporal

logic

for

object

specification

is

described

in

-LSB-

-RSB-

The

scheme

for

object

naming

and

the

categorical

techniques

for

composition

are

similar

to

those

used

herein

The

main

difference

in

relation

to

our

work

consists

in

the

strict

use

of

synchronous

interaction

A

logic

resembling

Unity

appears

in

-LSB-

-RSB-

which

treats

asynchronous

communication

and

fairness

but

fails

to

address

object

creation

All

these

issues

may

be

treated

using

the

order-sorted

dynamic

logic

described

in

-LSB-

-RSB-

but

the

absence

of

composition

techniques

therein

would

probably

lead

to

difficulties

in

specifying

and

verifying

actors

in

the

modular

manner

presented

here

Other

more

operational

semantics

for

Actors

have

already

been

proposed

In

-LSB-

-RSB-

and

-LSB-

-RSB-

truly

concurrent

semantics

are

presented

in

terms

of

linear

and

rewriting

logic

respectively

Our

interleaving

model

for

parallelism

resembles

that

in

-LSB-

-RSB-

while

our

syntactic

notion

of

composability

has

similarities

with

the

semantic

one

presented

in

-LSB-

-RSB-

In

all

these

latter

works

it

is

recognised

that

means

of

specifying

and

reasoning

about

actors

would

be

valuable

In

fact

we

see

the

search

for

operational

means

of

understanding

the

behaviour

of

actor

programs

and

for

actor

specification

techniques

as

orthogonal

tasks

While

to

the

former

the

central

interest

appears

to

be

in

equivalences

between

programs

and

therefore

in

compiling

time

optimisations

temporal

logic

favours

actor

understanding

and

reasoning

at

a

higher

abstraction

level

and

also

to

relate

specifications

in

different

stages

of

the

development

process

-LSB-

-RSB-

Future

research

The

above

reminds

us

of

a

natural

extension

of

the

present

work

towards

treating

the

refinement

of

actor

specifications

Although

approaches

to

refinement

and

compositionality

in

temporal

logics

of

objects

do

exist

-LRB-

-LSB-

-RSB-

for

example

-RRB-

one

needs

to

investigate

if

the

axiom

schemes

introduced

here

bring

some

new

difficulty

or

facilitate

the

task

Another

important

topic

to

be

addressed

in

our

future

research

is

the

axiomatisation

of

primitive

become

which

allows

an

actor

to

behave

according

to

a

distinct

specification

in

its

future

computation

As

we

have

already

pointed

out

we

could

have

treated

this

primitive

herein

However

such

a

treatment

would

make

reasoning

a

lot

more

difficult

in

general

To

verify

a

safety

property

of

an

actor

in

this

new

setting

assuming

become

for

example

we

would

have

to

show

that

the

property

does

not

depend

on

the

mutations

suffered

by

the

actor

Since

to

maintain

the

balance

between

ease

to

specify

and

ease

to

verify

is

not

straightforward

a

methodological

study

of

this

primitive

within

our

logic

is

required

Acknowledgements

The

work

described

in

this

paper

has

been

supported

by

CNPq

the

Brazilian

National

Research

Council

The

proof

trees

and

the

category

theory

diagrams

presented

herein

were

produced

using

the

LATEX

styles

created

by

Paul

Taylor

References

-LSB-

-RSB-

Gul

Agha

Actors

A

Model

of

Concurrent

Computation

in

Distributed

Systems

MIT

Press

-LSB-

-RSB-

Gul

Agha

Ian

A.

Mason

Scott

Smith

and

Carolyn

Talcott

A

foundation

for

actor

computation

To

appear

in

Journal

of

Functional

Programming

-LSB-

-RSB-

Pierre

America

and

Frank

de

Boer

A

proof

system

for

process

creation

In

M.

Broy

and

C.

B.

Jones

editors

Programming

Concepts

and

Methods

pages

-LCB-

North

Holland

-LSB-

-RSB-

Nuno

Barreiro

Jos?e

Fiadeiro

and

Tom

Maibaum

Politeness

in

object

societies

In

R.

Wieringa

and

R.

Feenstra

editors

Proc

Information

Systems

Correctness

and

Reusability

pages

-LCB-

World

Scientific

-LSB-

-RSB-

John

Darlington

and

Yike

K.

Guo

Formalising

actors

in

linear

logic

In

Proc

International

Conference

on

Object-Oriented

Information

Systems

-LRB-

OOIS

-RRB-

-LSB-

-RSB-

Carlos

H.

C.

Duarte

Acidity

yields

another

notion

for

modularity

in

formal

object-oriented

specifications

In

Special

Issues

in

Object-Oriented

Programming

Proceedings

of

the

ECOOP

Workshops

-LRB-

to

appear

-RRB-

Dpunkt

Publishing

-LSB-

-RSB-

Hartmut

Ehrig

and

Bernd

Mahr

Fudamentals

of

Algebraic

Specification

Equations

and

Initial

Semantics

Springer

Verlag

-LSB-

-RSB-

E.

Allen

Emerson

Temporal

and

modal

logic

In

J.

Van

Leeuwen

editor

Handbook

of

Theoretical

Computer

Science

pages

-LCB-

North

Holland

-LSB-

-RSB-

Hans-Dieter

Erich

Amilcar

Sernadas

and

Cristina

Sernadas

Objects

object

types

and

object

identity

In

H.

Ehrig

editor

Categorical

Methods

in

Computer

Science

with

Aspects

from

Topology

volume

of

Lecture

Notes

in

Computer

Science

Springer

Verlag

-LSB-

-RSB-

Jos?e

Fiadeiro

and

Tom

Maibaim

Towards

object

calculi

Technical

report

Department

of

Computing

Imperial

College

London

-LSB-

-RSB-

Jos?e

Fiadeiro

and

Tom

Maibaum

Temporal

theories

as

modularisation

units

for

concurrent

systems

specification

Formal

Aspects

of

Computing

-LRB-

-RRB-

-LCB-

-LSB-

-RSB-

Jos?e

Fiadeiro

and

Tom

Maibaum

Sometimes

tomorrow

is

sometime

Action

refinement

in

a

temporal

logic

of

objects

In

D.

Gabbay

and

H.

Ohlbach

editors

Temporal

Logic

volume

of

Lecture

Notes

in

Artificial

Inteligence

Springer

Verlag

-LSB-

-RSB-

Jos?e

Fiadeiro

and

Tom

Maibaum

Categorical

semantics

of

parallel

program

design

To

appear

in

Science

of

Computer

Programming

-LSB-

-RSB-

Joseph

A.

Goguen

and

Rod

M.

Burstall

Institutions

Abstract

model

theory

for

specification

and

programming

Journal

of

the

ACM

-LRB-

-RRB-

-LCB-

January

-LSB-

-RSB-

Carl

Hewitt

and

Henry

Baker

Laws

for

communicating

parallel

processes

In

IFIP

Congress

pages

-LCB-

August

-LSB-

-RSB-

Charles

A.

R.

Hoare

Parallel

programming

an

axiomatic

approach

Computer

Languages

-LRB-

-RRB-

-LCB-

-LSB-

-RSB-

Bengt

Jonsson

Compositional

specification

and

verification

of

distributed

systems

ACM

Transactions

on

Programming

Languages

and

Systems

-LRB-

-RRB-

-LCB-

March

-LSB-

-RSB-

Leslie

Lamport

What

good

is

temporal

logic

In

R.

E.

A.

Mason

editor

Proc

Information

Processing

IFIP

World

Congress

pages

-LCB-

North

Holland

September

-LSB-

-RSB-

Tom

Maibaum

and

Wladyslaw

Tursky

On

what

exactly

is

going

on

when

software

is

developed

step-by-step

In

Proc

International

Conference

on

Software

Engineering

-LRB-

ICSE

-RRB-

pages

-LCB-

IEEE

Computer

Society

Press

March

-LSB-

-RSB-

Jos?e

Meseguer

A

logical

theory

of

concurrent

objects

In

Proc

Object-Oriented

Programming

European

Conference

and

Object-Oriented

Programming

Systems

Languages

and

Applications

-LRB-

ECOOP/OOPSLA

-RRB-

pages

-LCB-

October

-LSB-

-RSB-

Michel

Raynal

and

Masaaki

Mizzymo

How

to

find

his

way

in

this

jungle

of

consistency

criteria

for

distributed

shared

memories

In

Proc

Workshop

on

Future

Trends

of

Distributed

Computing

Systems

pages

-LCB-

IEEE

Computer

Society

Press

September

-LSB-

-RSB-

Am

lcar

Sernadas

Cristina

Sernadas

and

Jos?e

F?elix

Costa

Object

specification

logic

Journal

of

Logic

and

Computation

-LRB-

-RRB-

-LCB-

-LSB-

-RSB-

A.

Prashad

Sistla

Emerson

M.

Clarke

Nissim

Francez

and

Albert

R.

Meyer

Can

message

buffers

be

axiomatized

in

linear

temporal

logic

Information

and

Computation

-LCB-

-LSB-

-RSB-

Carolin

Talcott

Interaction

semantics

for

components

of

distributed

systems

In

Proc

IFIP

Workshop

on

Formal

Methods

for

Open

Object-Based

Distributed

Systems

-LRB-

FMOODS

-RRB-

-LSB-

-RSB-

Roel

Wieringa

Wiebren

de

Jonge

and

Paul

Spruit

Roles

and

dynamic

subclasses

a

modal

logic

approach

In

Mario

Tokoro

and

Remo

Pareschi

editors

Proc

Object

Oriented

Programming

European

Conference

-LRB-

ECOOP

-RRB-

volume

of

Lecture

Notes

in

Computer

Science

pages

-LCB-

actors
distributed systems
specification
verification