Abstract Semantics by Observable Contexts

The operational behavior of interactive systems is usually given in terms of transition systems labeled with actions, which, when visible, represent both observations and interactions with the external world. The abstract semantics is given in terms of behavioral equivalences, which depend on the action labels and on the amount of branching structure considered. Behavioural equivalences are often congruences with respect to the operations of the language, and this property expresses the compositionality of the abstract semantics. A simpler approach, inspired by classical formalisms like pi-calculus, Petri nets, term and graph rewriting, and pioneered by the Chemical Abstract Machine [13], defines operational semantics by means of structural axioms and reaction rules. Process calculi representing complex systems, in particular those able to generate and communicate names, are often defined in this way, since structural axioms give a clear idea of the intended structure of the states while reaction rules, which are often non-conditional, give a direct account of the possible steps. Transitions caused by reaction rules, however, are not labeled, since they represent evolutions of the system without interactions with the external world. Thus reduction semantics in itself is neither abstract nor compositional. One standard solution, pioneered in [89], is that of defining a saturated transition system as follows: a process p can do a move with label C[-] and become q, iff C[p]--> q. Saturated semantics, i.e., the abstract semantics defined over the saturated transition system, are always congruences, but they are usually untractable since they have to tackle all possible contexts of which there are usually an infinite number. Moreover, in several paradigmatic cases, saturated semantics are too coarse. For example, in Milner's Calculus of Communicating Systems (CCS), saturated bisimilarity cannot distinguish "always divergent processes" and for this reason Milner and Sangiorgi introduced barbs. These are observations on the states representing the ability to interact over some channels. Sewell introduced a different approach that consists in deriving a transition system where labels are not all contexts but just the minimal ones allowing a system to reach a rule. In such a way, one obtains two advantages: firstly one avoids considering all contexts, and secondly, labels precisely represent interactions, i.e., the portion of environment that is really needed to react. This idea was then refined by Leifer and Milner in the theory of reactive systems, where the categorical notion of idem relative pushout precisely captures this idea of minimal context. In this thesis, we show that in some cases this approach works well (e.g., CCS) but often, the resulting abstract semantics are too strict. In our opinion, they are not really observational since the observer can know exactly how much structure a process needs to reach a specific rule, and thus the observation depends on the rules. One result of the thesis is that of providing evidence of this through several interesting formalisms modeled as reactive systems: Logic Programming, a fragment of open pi-calculus, and an interactive version of Petri nets. Moreover, we introduce two alternative definitions of bisimilarity that efficiently characterize saturated bisimilarity, namely semi-saturated bisimilarity and symbolic bisimilarity. These allow us to reason about saturated semantics without considering all contexts, but saturated semantics are in several cases too coarse. In order to have a framework that is suitable for many formalisms, we add to the above approach observations. Indeed, in our opinion, labels cannot represent both interactions and observations, because these two concepts are in general different, like for example, in the asynchronous calculi where receiving is not observable. Thus, we believe that some notion of observation, either on transitions or on states (e.g. barbs), is necessary. A further result of the thesis is that of providing a generalization of the above theory starting not just from purely reaction rules, but from transition systems labeled with observations. Here we can easily reuse saturated transition systems by defining them as follows: a process p can do a move with context C[-] and observation o and become q iff C[p] --o--> q. Again, saturated semantics, i.e. abstract semantics defined over the above transition systems, are congruences. Analogously to the case of reactive systems, we can define semi-saturated bisimilarity and symbolic bisimilarity as efficient characterizations of saturated semantics. The definition of symbolic bisimilarity which arises from this generalization is similar to the abstract semantics of several works. Here we consider open and asynchronous pi-calculus, by showing that their abstract semantics are instances of our general concepts of saturated and symbolic semantics. We also apply our approach to open Petri nets (that are an interactive version of P/T Petri nets) obtaining a new symbolic semantics for them, that efficiently characterizes their abstract semantics. We round up the thesis with a coalgebraic characterization for saturated, semi-saturated and symbolic bisimilarity. Universal Coalgebra provides a categorical framework where abstract semantics of interactive systems are described as morphisms to their minimal representatives. More precisely, if the category of coalgebras has final object 1, then the unique morphisms from a certain coalgebra to 1 equates all the bisimilar states. In other words, the final object can be seen as a universe of abstract behaviors and the unique morphism as a function assigning to each system its abstract behavior. This characterization of abstract semantics is not only theoretically interesting, but also pragmat- ically useful, since it suggests an algorithm which can check the equivalence: one computes the image of some coalgebras through the unique morphism (that for the finite lts corresponds to the list partitioning algorithm by Kanellakis and Smolka), and these coalgebras are behaviorally equivalent if their images are the same. Ordinary labeled transition systems can be represented as coalgebras, and the resulting abstract semantics exactly coincides with canonical bisimilarity. Then, providing a coalgebraic characterization of saturated bisimilarity is almost straightforward. The case of semi-saturated and symbolic bisimilarities are more complicated because their definitions are asymmetric. In order to properly characterizes semi-saturated and symbolic cases, we first introduce a new notion of redundancy on transitions and then normalized coalgebras: a special kind of coalgebras without redundant transitions. We prove that the category of normalized coalgebras is isomorphic to the category of saturated coalgebras (the coalgebras containing all the redundant transitions), where the large saturated transition system can be directly modelled. In doing this, we use the notions of normalization that throws away all the redundant transitions, and of saturation that adds all the redundant transitions. Both are natural transformations between the endofunctors (defining the two categories of coalgebras) and one is the inverse of the other. As a corollary of the isomorphism theorem, saturated bisimilarity can be characterized as bisimilarity in the category of normalized coalgebras, i.e., abstracting away from redundant transitions. This is interesting because, on the one hand, it provides us with a canonical representatives for ~S without redundant transitions (and then much smaller with respect to the saturated ones), on the other hand, it suggests a minimization algorithm for "efficiently" computing ~S

State-based and process-based value passing

State-based and process-based formalisms each come with their own distinct set of assumptions and properties. To combine them in a useful way it is important to be sure of these assumptions in order that the formalisms are combined in ways which have, or which allow, the intended combined properties. Consequently we cannot necessarily expect to take on state-based formalism and one process-based formalism and combine them and get something sensible, especially since the act of combining can have subtle consequences. Here we concentrate on value-passing, how it is treated in each formalism, and how the formalisms can be combined so as to preserve certain properties. Specifically, the aim is to take from the many process-based formalisms definitions that will best fit with our chosen stat-based formalism, namely Z, so that the fit is simple, has no unintended consequences and is as elegant as possible

Flexible refinement

To help make refinement more usable in practice we introduce a general, flexible model of refinement. This is defined in terms of what contexts an entity can appear in, and what observations can be made of it in those contexts. Our general model is expressed in terms of an operational semantics, and by exploiting the well-known isomorphism between state-based relational semantics and event-based labelled transition semantics we were able to take particular models from both the state- and event-based literature, reflect on them and gradually evolve our general model. We are also able to view our general model both as a testing semantics and as a logical theory with refinement as implication. Our general model can used as a bridge between different particular special models and using this bridge we compare the definition of determinism found in different special models. We do this because the reduction of nondeterminism underpins many definitions of refinement found in a variety of special models. To our surprise we find that the definition of determinism commonly used in the process algebra literature to be at odds with determinism as defined in other special models. In order to rectify this situation we return to the intuitions expressed by Milner in CCS and by formalising these intuitions we are able to define determinism in process algebra in such a way that it no longer at odds with the definitions we have taken from other special models. Using our abstract definition of determinism we are able to construct a new model, interactive branching programs, that is an implementable subset of process algebra. Later in the chapter we show explicitly how five special models, taken from the literature, are instances of our general model. This is done simply by fixing the sets of contexts and observations involved. Next we define vertical refinement on our general model. Vertical refinement can be seen both as a generalisation of what, in the literature, has been called action refinement or non-atomic refinement. Alternatively, by viewing a layer as a logical theory, vertical refinement is a theory morphism, formalised as a Galois connection. By constructing a vertical refinement between broadcast processes and interactive branching programs we can see how interactive branching programs can be implemented on a platform providing broadcast communication. But we have been unable to extend this theory morphism to implement all of process algebra using broadcast communication. Upon investigation we show the problem arises with the examples that caused the problem with the definition of determinism on process algebra. Finally we illustrate the usefulness of our flexible general model by formally developing a single entity that contains events that use handshake communication and events that use broadcast communication

Contexts, refinement and determinism

In this paper we have been influenced by those who take an “engineering view” of the problem of designing systems, i.e. a view that is motivated by what someone designing a real system will be concerned with, and what questions will arise as they work on their design. Specifically, we have borrowed from the testing work of Hennessy, de Nicola and van Glabbeek, e.g. [13, 5, 21, 40, 39]. Here we concentrate on one fundamental part of the engineering view and where consideration of it leads. The aspects we are concerned with are computational entities in contexts, observed by users. This leads to formalising design steps that are often left informal, and that in turn gives insights into non-determinism and ultimately leads to being able to use refinement in situations where existing techniques fail

Stepwise refinement of processes

Industry is looking to create a market in reliable "plug-and-play" components. To model components in a modular style it would be useful to combine event-based and state-based reasoning. One of the first steps in building an event-based model is to decide upon a set of atomic actions. This choice will depend on the formalism used, and may restrict in quite unexpected ways what we are able to formalise. In this paper we illustrate some limits to developing real world processes using existing formalisms, and we define a new notion of refinement, vertical refinement, which addresses some of these limitations. We show that using vertical refinement we can rewrite specification into a different formalism, allowing us to move between handshake processes, broadcast processes and abstract data types

LSB - Live and Safe B: Alternative semantics for Event B

We define two lifted, total relation semantics for Event B machines: Safe B for safety-only properties and Live B for liveness properties. The usual Event B proof obligations, Safe, are sufficient to establish Safe B refinement. Satisfying Safe plus a simple additional proof obligation ACT REF is sufficient to establish Live B refinement. The use of lifted, total relations both prevents the ambiguity of the unlifted relational semantics and prevents operations being clairvoyant

Constructing programs or processes

We define interacting sequential programs, motivated originally by constructivist considerations. We use them to investigate notions of implementation and determinism. Process algebras do not define what can be implemented and what cannot. As we demonstrate it is problematic to do so on the set of all processes. Guided by constructivist notions we have constructed interacting sequential programs which we claim can be readily implemented and are a subset of processes