Deciding observational congruence of finite-state CCS expressions by rewriting

AbstractWe propose a term rewriting approach to verify observational congruence between guarded recursive (finite-state) CCS expressions. Starting from the complete axiomatization of observational congruence for this subset of CCS, a non-terminating rewriting relation has been defined. This rewriting relation is ω-canonical over a subclass of infinite derivations, structured fair derivations, which compute all the ω-normal forms. The rewriting relation is shown to be complete with respect to the axiomatization by proving that every structured fair derivation computes a term that denotes an rτ-normal process graph. The existence of a finite representation for ω-normal forms allows the definition of a rewriting strategy that, in a finite number of rewriting steps, decides observational congruence of guarded recursive (finite-state) CCS expressions

A formalization of unique solutions of equations in process algebra

In this thesis, a comprehensive formalization of Milner's Calculus of Communicating Systems (also known as CCS) has been done in HOL theorem prover (HOL4), based on an old work in HOL88. This includes all classical properties of strong/weak bisimulation equivalences and observation congruence, a theory of congruence for CCS, various versions of ``bisimulation up to'' techniques, and several deep theorems, namely the ``coarsest congruence contained in weak equivalence'', and three versions of the ``unique solution of equations'' theorem in Milner's book. This work is further extended to support recent developments in Concurrency Theory, namely the ``contraction'' relation and the related ``unique solutions of contractions'' theorem found by Prof. Davide Sangiorgi, University of Bologna. As a result, a rather complete theory of ``contraction'' (and a similar relation called ``expansion'') for CCS is also formalized in this thesis. Further more, a new variant of contraction called ``observational contraction'' was found by the author during this work, based on existing contraction relation. It's formally proved that, this new relation is preserved by direct sums of CCS processes, and has a more elegant form of the ``unique solutions of contractions'' theorem without any restriction on the CCS grammar. The contribution of this thesis project is at least threefold: First, it can be seen as a formal verification of the core results in Prof.\ Sangiorgi's paper, and it provides all details for the informal proof sketches given in the paper. Second, a large piece of old proof scripts from the time of Hol88 (1990s) has been ported to HOL4 and made available to all its users. Third, it's a proof engineering research by itself on the correct formalization of process algebra, because the work has made extensive uses of some new features (e.g. coinductive relation) provided in recent versions of HOL4 (Kananaskis-11 and later)

Verification of LOTOS Specifications Using Term Rewriting Techniques

Recently the use of formal methods in describing and analysing the behaviour of (computer) systems has become more common. This has resulted in the proliferation of a wide variety of different specification formalisms, together with analytical techniques and methodologies for specification development. The particular specification formalism adopted for this study is LOTOS, an ISO standard formal description technique. Although there are many works dealing with how to write LOTOS specifications and how to develop a LOTOS specification from the initial abstract requirements specification to concrete implementation, relatively few works are concerned with the problems of expressing and proving the correctness of LOTOS specifications, i.e. verification. The main objective of this thesis is to address this shortfall by investigating the meaning of verification as it relates to concurrent systems in general, and in particular to those systems described using LOTUS. Further goals are to automate the verification process using equational reasoning and term rewriting, and also to attempt to make the results of this work, both theoretical and practical, as accessible to LOTOS practitioners as possible. After introducing the LOTUS language and related formalisms, the thesis continues with a survey of approaches to verification of concurrent systems with a view to identifying those approaches suitable for use in verification of properties of systems specified using LOTOS. Both general methodology and specific implementation techniques are considered. As a result of this survey, two useful approaches are identified. Both are based on the technique of expressing the correctness of a LOTUS specification by comparison with another, typically more abstract, specification. The second approach, covered later in the thesis, uses logic for the more abstract specification. The main part of the thesis is concerned with the first approach, in which both specifications are described in LOTUS, and the comparison is expressed by a behavioural equivalence or preorder relation. This approach is further explored by means of proofs based on the paradigm of equational reasoning, implemented by term rewriting. Initially, only Basic LOTUS (i.e. the process algebra) is considered. A complete (i.e. confluent and terminating) rule set for weak bisimulation congruence over a subset of Basic LOTOS is developed using RRL (Rewrite Rule Laboratory). Although fully automatic, this proof technique is found to be insufficient for anything other than finite toy examples. In order to give more power, the rule set is supplemented by an incomplete set of rules expressing the expansion law. The incompleteness of the rule set necessitates the use of a strategy in applying the rules, as indiscriminate application of the rules may lead to non-termination of the rewriting. A case study illustrates the use of these rules, and also the effect of different interpretations of the verification requirement on the outcome of the proof. This proof technique, as a result of the deficiencies of the tool on which it is based, has two major failings: an inability to handle recursion, and no opportunity for user control in the proof. Moving to a different tool, PAM (Process Algebra Manipulator), allows correction of these faults, but at the cost of automation. The new implementation acts merely as computerised pencil and paper, although tactics can be defined which allow some degree of automation. Equations may be applied in either direction, therefore completion is no longer as important. (Note that the tactic language could be used to describe a a complete set of rules which would give an automatic proof technique, therefore some effort towards completion is still desirable. However, since LOTOS weak bisimulation congruence is undecidable, there can never be a complete rule set for deciding equivalence of terms from the full LOTUS language.) The composition of the rule set is re-considered, with a. view to using alternative axiomatisations of weak bisimulation congruence: two main axiomatisations are described and their relative merits compared. The axiomatisation of other LOTUS relations is also considered. In particular, we consider the pitfalls of axiomatising the cred preorder relation. In order to demonstrate the use of the PAM proof system developed, the case study, modified to use recursion, is re-examined. Four other examples taken from the literature, one substantial, the others fairly small, are also investigated to further demonstrate the applicability of the PAM proof system to a variety of examples. The above approach considers Basic LOTUS only; to be more generally applicable the verification of properties of full LOTOS specifications (i.e. including abstract data types) must also be studied. Methods for proving the equivalence of full LOTUS specifications are examined, including a modification of the technique used successfully above. The application of this technique is illustrated via proofs of the equivalence of three variants of the well-known stack example

Proof techniques for CCS

Proofs of observational equivalence of behaviour expressions in Milner's Calculus of Communicating Systems can be quite lengthy, and as larger and more practical systems of agents are considered the need for shorter proof techniques becomes more important. In this thesis a number of results about the calculus are proved which give rise to give more natural techniques. Three principal areas of research are presented:(i) A study of strong confluence and determinacy is made, extending Hilner's work to the whole calculus - the appropriate modifications to take value-passing into account are motivated and defined, and a strong confluence theorem is proved. It is shown that a useful subcalculus of CCS is strongly confluent.(ii) An investigation into criteria for uniqueness of solution of equations pf the form b = Fib] is performed. To do this a concept of derivations of an agent A "causing" derivations of FlAl is defined; using this, conditions are imposed on F which imply uniqueness, and a study follows of how these conditions relate to the structure of F.(iii) By using an alternative, stronger, definition of observational equivalence as a maximal fixed point it is found that equivalences can be demonstrated by constructing bisimulations between agents, and results leading to an algorithm for such constructions are presented. Also, using this alternative definition a weaker form of confluence can be defined very easily, and this is investigated.The theoretical material in this thesis is supplemented by examples demonstrating how the results proved can be applied to give proof techniques for use within the calculus