Introduction

A model for reactive computation, for example that of labelled transition systems [Kel76], or a process algebra (such asACP [BW90], CCS [Mil89], CSP [Hoa85]) can be used to describe both implementations of processes and specifications of their expected behaviours. Process algebras and labelled transition systems therefore naturally support the so-called single-language approach to process theory, that is, the approach in which a single language is used to describe both actual processes and their specifications. An important ingredient of the theory of these languages and their associated semantic models is therefore a notion of behavioural equivalence or behavioural approximation between processes. One process description, say SYS, may describe an implementation, and another, say SPEC, may describe a specification of the expected behaviour. To say that SYS and SPEC are equivalent is taken to indicate that these two processes describe essentially the same behaviour, albeit possibly at different levels of abstraction or refinement. To say that, in some formal sense, SYS is an approximation of SPEC means roughly that every aspect of the behaviour of this process is allowed by the specification SPEC, and thus that nothing unexpected can happen in the behaviour of SYS. This approach to program verification is also sometimes called implementation verification or equivalence checking.

Designers using implementation verification to validate their (models of) reactive systems need only learn one language to describe both their systems and their specifications, and can benefit from the intrinsic compositionality of their descriptions, at least when they are using a process algebra for denoting the labelled transition systems in their models and an equivalence (or preorder) that is preserved by the operations in the algebra.

We have previously remarked that CCS, like all other process algebras, can be used to describe both implementations of processes and specifications of their expected behaviours. A language like CCS therefore supports the so-called single-language approach to process theory – that is, the approach in which a single language is used to describe both actual processes and their specifications. An important ingredient of these languages is therefore a notion of behavioural equivalence or behavioural approximation between processes. One process description, say SYS, may describe an implementation and another, say SPEC, may describe a specification of the expected behaviour. To say that SYS and SPEC are equivalent is taken to indicate that these two processes describe essentially the same behaviour, albeit possibly at different levels of abstraction or refinement. To say that, in some formal sense, SYS is an approximation of SPEC means roughly that every aspect of the behaviour of this process is allowed by the specification SPEC and thus that nothing unexpected can happen in the behaviour of SYS. This approach to program verification is also sometimes called implementation verification or equivalence checking.

Criteria for good behavioural equivalence

We have already argued informally that some processes that we have met so far ought to be considered as behaviourally equivalent.

This book is based on courses that have been held at Aalborg University and at Reykjavík University over the last six years or so. The aim of these semester-long courses has been to introduce computer science students, at an early stage of their M.Sc. degrees or late in their B.Sc. degree studies, to the theory of concurrency and to its applications in the modelling and analysis of reactive systems. This is an area of formal-methods study that is finding increasing application outside academic circles and allows students to appreciate how techniques and software tools based on sound theoretical principles are very useful in the design and analysis of nontrivial reactive computing systems.

In order to carry this message across to students in the most effective way, the courses on which the material in this book is based have presented:

• some prime models used in the theory of concurrency (with special emphasis on state-transition models of computation such as labelled transition systems and timed automata);

• languages for describing actual systems and their specifications (with a focus on classic algebraic process calculi such as Milner's calculus of communicating systems and logics such modal and temporal logics); and

• the embodiment of these models and languages in tools for the automatic verification of computing systems.

Aims of this book

The aim of the first part of this book is to introduce three basic notions that we shall use to describe, specify and analyse reactive systems, namely

• Milner's calculus of communicating systems (CCS) (Milner, 1989),

• the model known as labelled transition systems (LTSs) (Keller, 1976), and

• Hennessy–Milner logic (HML) (Hennessy and Milner, 1985) and its extension with recursive definitions of formulae (Larsen, 1990).

We shall present a general theory of reactive systems and its applications. In particular, we intend to show the following:

1. how to describe actual systems using terms in our chosen models (i.e. either as terms in the process description language CCS or as labelled transition systems);

2. how to offer specifications of the desired behaviour of systems either as terms of our models or as formulae in HML; and

3. how to manipulate these descriptions, possibly (semi-)automatically, in order to analyse the behaviour of the model of the system under consideration.

In the second part of the book, we shall introduce a similar trinity of basic notions that will allow us to describe, specify and analyse real-time systems – that is, systems whose behaviour depends crucially on timing constraints. There we shall present the formalisms of timed automata (Alur and Dill, 1994) and timed CCS (Yi, 1990, 1991a, b) to describe real-time systems, the model of timed labelled transition systems (TLTSs) and a real-time version of Hennessy–Milner logic (Laroussinie, Larsen and Weise, 1995).

Introduction

Mutual exclusion algorithms, like those we discussed in Chapter 7, have an abstract behaviour described by the following pseudocode:

1. while true do

2. begin

1. remainder region

2. trying region

3. critical section

4. exit region

1. end

It is supposed that such algorithms satisfy the following two properties.

• Mutual exclusion No two processes are in their critical sections at the same time.

• Deadlock freedom If some process is in its trying region then eventually some process is in its critical section. (Note that the process in the critical section might be different from the one initially in its trying region.) Moreover, if a process is in its exit region then that process will eventually enter its remainder region.

As stated in Lynch and Shavit (1992), the known asynchronous mutual exclusion algorithms for n processes require O(n) read and write registers and O(n) operations to access the critical section. These bounds make them rather impractical for large-scale applications, where the number of processes could be very large. This raises the question whether it is possible to achieve mutual exclusion in asynchronous systems consisting of n processes by using a smaller number of shared registers and/or fewer than O(n) operations to access the critical section. Unfortunately, this is impossible for ‘classic reactive systems’ in an asynchronous setting. In fact, Burns and Lynch (1980, 1993) showed the following theorem.

Introduction to Hennessy–Milner logic

In the previous chapters we have seen that implementation verification is a natural approach to establishing the correctness of (models of) reactive systems described, for instance, in the language CCS. The reason is that CCS, like all other process algebras, can be used to describe both actual systems and their specifications. However, when establishing the correctness of our system with respect to a specification using a notion of equivalence such as observational equivalence, we are forced to specify in some way the overall behaviour of the system.

Suppose, for instance, that all we want to know about our system is whether it can perform an a-labelled transition ‘now’. Phrasing this correctness requirement in terms of observational equivalence seems at best unnatural and maybe cannot be done at all! (See the paper Boudol and Larsen (1992) for an investigation of this issue.)

We can imagine a whole array of similar properties of a process that we might be interested in specifying and checking. For instance, we may wish to know whether our computer scientist of Chapter 2

• is not willing to drink tea now,

• is willing to drink both coffee and tea now,

• is willing to drink coffee, but not tea, now,

• never drinks alcoholic beverages, or

• always produces a publication after drinking coffee.

Real-time reactive systems

In the first part of this book, we motivated and developed a general-purpose theory that can be used to describe, and reason about, reactive systems. The key ingredients in our approach were:

• an algebraic language, namely Milner's CCS, for the syntactic description of reactive systems;

• automata, e.g. labelled transition systems (LTSs), for describing the dynamic behaviour of process terms;

• structural operational semantics allowing us to associate systematically an LTS with each process term in a syntax-directed fashion;

• notions of behavioural equivalence for the comparison of process behaviours; and

• modal and temporal logics to specify desired properties of reactive systems.

These ingredients gave the foundations for the formal modelling and verification of reactive systems and are the bedrock for the development of (semi-)automatic verification tools for reactive systems.

The theory that we have developed so far, however, does not allow us to describe naturally all the important aspects in reactive computation. Consider, for instance, some, by now ubiquitous, examples of reactive systems, namely embedded systems like the ABS and air bags in cars, cruise-control systems, digital watches, mobile phones, computer monitors, production lines and video-game consoles. These are all examples of real-time systems. A real-time system is a system whose correct behaviour depends not only on the logical order in which events are performed but also on their timing.

The aim of this chapter is to collect under one roof all the mathematical notions from the theory of partially ordered sets and lattices needed to introduce Tarski's classic fixed point theorem. You might think that this detour into some exotic looking mathematics is unwarranted in this textbook. However, we shall then put these possible doubts of yours to rest by using this fixed point theorem to give an alternative definition of strong bisimulation equivalence. This reformulation of the notion of strong bisimulation equivalence is not just mathematically pleasing but also yields an algorithm for computing the largest strong bisimulation over finite labelled transition systems (LTSs), i.e. labelled transition systems with only finitely many states, actions and transitions. This is an illustrative example of how apparently very abstract mathematical notions turn out to have algorithmic content and, possibly unexpected, applications in computer science. As you will see, we shall also put Tarski's fixed point theorem to good use in Chapter 6, where the theory developed in this chapter will allow us to understand the meaning of recursively defined properties of reactive systems.

Posets and complete lattices

We start our technical developments in this chapter by introducing the notion of a partially ordered set (also known as a poset) and some useful classes of such structures that will find application in what follows. As you will see, many examples of posets that we shall mention in this chapter are familiar.

In this chapter we will have a close look at the elegant timed process algebra TCCS introduced by Yi (1990, 1991a, b). Syntactically, TCCS extends CCS with just a single construct, a new prefix ε(d).P that means ‘delay d units of time and then behave as P’. As is the case for a number of other timed process algebras, TCCS takes the view that a real-time system has a two-phase behaviour, phases when the system idles while time passes and phases when the system performs atomic actions, assumed to be instantaneous in time. As we shall see, this separation of concerns – together with other design decisions (e.g. so-called time determinism and maximal progress) – makes for a very elegant TCCS semantics.

Intuition

All the types of reactive system mentioned in Chapter 8 should give us sufficient motivation to describe and analyze formally real-time reactive computations. In the first part of the book, we introduced a collection of languages and models based on the flexible and intuitive idea of communicating state machines, and we argued, by means of several examples, that the resulting formalisms can be used to describe and analyze non-trivial reactive systems. When real-time constraints become important to the proper functioning of reactive systems, we should like to continue building on the time-honoured formalisms we have introduced previously. But are those formalisms sufficiently powerful to describe timing constraints in computation? Can we use them to specify, for instance, features such as timeouts?