2 Examples

We introduce here three examples of compositional specification. They are meant as a quick introduction to Maude and to our previous work (Martín et al. Reference Martní, Verdejo and Martí-Oliet2020), especially to compositional specification with the extended syntax we proposed. The formal definitions and results are in Section 3. Also, these examples set the base on which we later illustrate the techniques for compositional verification and simulation. They have been chosen to be illustrative, so they are quite simple. We are using Maude because of its availability, its toolset, and its efficient implementation. All the concepts and examples, however, are valid for rewriting logic in general.

The first example presents three buffers assembled in line. The second shows how to exert an external mutual exclusion control on two systems, provided they inform on when they are visiting their critical sections. Later, this gives us the opportunity of using componentwise simulation and a very simple case of assume/guarantee. The third example concerns the well-known puzzle of a farmer and three belongings crossing a river. We compose a system implementing the mere rules of the puzzle with several other components implementing, in particular, two guidelines which prove to be enough to reach a solution. The assume/guarantee technique is later used on this system.

The complete specification for all the examples in this paper is available online (Martín 2021b). Our prototype implementation, able to deal with these examples, is also available there, though the reader is warned that, in its current state, it is not a polished tool but, rather, a proof of concept.

2.1 Chained buffers

We model a chain of three buffers. We describe the system top-down. This is the specification of the composed system:

The sentence is not standard Maude, but part of our extension. That sentence expects three Maude modules to exist, called BUFFER1, BUFFER2, and BUFFER3, each defining the values of the so-called properties mentioned in the part of the sentence: isSending and isReceiving. We use the sign to access a property defined in a Maude module. In words, that models a composed system in which the three buffers synchronize so that when one sends the next receives. The properties are assumed to be Boolean in this example, modeling the passing of tokens. Synchronizing on more complex values is also possible, as shown in other examples.

We call the result of the composition above 3BUFFERS. For this to be a complete model, we need to provide the specification of the internal workings of the three buffers, including the definition of the properties. There is no reason for the three buffers to be specified exactly the same. In principle, they even could be coded in different languages, as long as there is a way to access the values of the properties defined inside each of them. For the sake of simplicity, in this example the three modules are identical. This is the very simple code for each of them:

There are two states, represented by the State constants idle and gotToken, and two transitions between them, represented by the Trans constants receiving and sending. The keyword introduces the declaration of operators with their arities. The singular can be used when only one operator is being declared. In this code, we are declaring constants, so the argument sorts are absent. The keyword introduces each rewrite rule and the symbols separate the terms. We assume throughout the paper that the sort representing the states of the system is called State and the one representing transitions is called Trans. Also, it is convenient to have a supersort of both (not shown above), which we call Stage. Usually, we omit declarations of sorts and operators when they are clear from context.

Readers knowledgeable of rewriting logic and Maude would expect the rules above to be written instead as:

Here, receiving and sending are rule labels. The syntax we use does not only consists of moving the label to the middle of the rule. In our case, receiving and sending are not labels, but algebraic terms of sort Trans, in the same way that idle and gotToken are terms of sort State. In general, both States and Transs can be terms of any algebraic complexity. Other examples below make this clearer.

We call these rules egalitarian, because transitions are represented by terms, the same as states. The rewrite systems which include them are also called egalitarian. More precisely, each buffer is an atomic egalitarian rewrite system. The result of their composition is still called egalitarian, but not atomic.

As illustrated above, the way we have chosen to specify composition of systems is by equality of properties. These are functions which take values at each state and transition of each component system. The properties of a system provide a layer of isolation between the internals of each component and the specification of the composition. This is similar to the concept of ports in other settings. It is important that properties are defined not only on states, but also on transitions, because synchronization is more often than not specified on them. That is why we have developed egalitarian systems in which transitions are promoted to first-class citizenship.

We declare and define two properties in each buffer:

The sentence introduced by the keyword is part of our extended syntax, as is the symbol @ representing the evaluation of a property on a state or transition. Thus, these lines declare two Boolean properties and define by means of equations (introduced by the keyword ) their values at each state and transition. The fact that receiving and sending are algebraic terms allows their use in equations.

The attribute (short for otherwise) in two of the equations is an extralogical feature of Maude: that equation is used whenever the term being reduced matches the left-hand side and the case is not dealt with by other equations. The variable G, whose declaration is not shown, has sort Stage, so that all properties evaluate to false except in the two cases explicitly set to true.

Any property defined in a component can be used as well as a property for the resulting composed system. In this case, the properties isReceiving in BUFFER1 and isSending in BUFFER3 are defined but not used for synchronization. Those properties can be useful if the composed module 3BUFFERS is used in turn as a component to be synchronized with other modules.

It is a common case that a property is defined to be true exactly at one state or transition and false everywhere else, as above. This calls for some syntactic shortcut to help the user. We do not discuss in this paper how to implement such shortcuts (of which this is not at all the only possible one), and our prototype implementation does not include them.

The execution of the composed system 3BUFFERS consists in the independent execution of each of its three components, restricted by the need to keep the equality between properties. To that composed system, the operation we call the split can be applied to obtain an equivalent standard rewrite system. The resulting split system has as states triples like < idle, gotToken, idle >, formed from the states of the components, and has rewrite rules like

The split is named after this translation of each rule into two halves. The term split is also used later to describe related translations, though in some of those cases there is nothing split in the literal sense. The split is formally defined in Section 3.3. We usually do not care to show the internal appearance of a split system, but are only interested in the fact that it represents in a single system the global behavior of the composition.

2.2 Mutual exclusion

Consider a very simple model of a train, which goes round a closed railway in which there are three stations and a crossing with another railway. We use the three stations as the states of our model, and there are three transitions for moving between them. Using our extended syntax, we model it with the rule:

The keyword introduces a conditional rewrite rule. We omit the needed declarations for the integer variable N and the constructors atStation and comingFrom.

The stations are numbered 0–2. But the transit from station 2 to 0 is different, because it passes through the crossing:

Indeed, we have two trains, modeled in this example by the same specification, but as two separate components. They share the crossing, so we need safety in the access to it. To this aim, we define for each train a Boolean property isCrossing to be true at the transition crossing and false everywhere else:

We call the two systems thus defined TRAIN1 and TRAIN2.

The mutex controller for safe access to the crossing is specified by these two rules:

We call this system MUTEX and define in it the parametric Boolean property isGranting, which is defined to be true at the respective transitions and false everywhere else:

The final system is the composition of the two trains and MUTEX so that each isCrossing property is synchronized with the corresponding isGranting one:

In due time, in Sections 8.3 and 9.2, we will show how we can use simulation to work with even simpler models of the trains, and how we can justify that mutual exclusion holds for the composed system.

We want to insist in the value of modularity in our examples. The system MUTEX with its two properties can be used unchanged to control any two given systems, as long as they inform, by means of properties, of their being in their critical section. For general systems, the synchronization instruction would look something like

Mutual exclusion between the two systems, whatever they are, is guaranteed by MUTEX satisfying the appropriate formula – see Section 9.2.

We find cases like this of particular interest. We mean a component controlling others and imposing its behavior (mutual exclusion in this case) on the compound. This is the idea behind strategies, controllers, coordination, etc. In contrast, in the example of the chained buffers in Section 2.1, the composed behavior is emergent. Our next example involves both techniques.

2.3 Crossing the river

For a quick reminder, this is the statement of the puzzle. A farmer has got a wolf, a goat and a cabbage, and needs to cross a river using a boat with capacity for the farmer and, at most, one of the belongings. The wolf and the goat should not be left alone, because the wolf would eat the goat. In the same way, the goat would eat the cabbage if left unattended. The goal is to get the farmer and the three belongings at the opposite side of the river safely.

Our specification consists of two rules: one encompasses all possible ways the farmer can cross the river; the other represents eating. This is the rule for a crossing, explained below:

Each state term contains the symbol |~| representing the river. To each side of this symbol there is a set of items, which may include the farmer and the three belongings, respectively represented by the constants farmer, wolf, goat, and cabbage. Also, there is always a special item mark which marks the side that the farmer is trying to reach with her belongings. Thus, the initial state is defined like this:

The variables II1 and II2 are sets of items which, in particular, may be empty. The sort of the variable B? is MaybeBelong, that is, either one of the three belongings or the special value noBelong. Indeed, noBelong is also the identity element for sets of items. In this way, the transition term II1 | B? > II2 represents all possible crossings, with $\texttt{B?}=\texttt{noBelong}$ interpreted as the farmer crossing alone. The symbol |~| is formally a commutative operator, so that the same rule represents movements from any side to the other. That rule is rather terse. Alternative specifications, using more than one rule, would probably be easier to grasp. That is not important for the main purpose of this paper, which has to do with composition.

The rule for eating is this one:

Thus, when the goat and some other belonging are at one side with the farmer at the other side, eating can take place. The function survivor is defined by these equations:

Thus, the goat survives if the other belonging is the cabbage, but it dies (disappears from the state term) if the other belonging is the wolf.

Our specification does not require that eating happens as soon as it is possible, but only that it can happen. So our aim is to avoid all danger and ensure a safe transit.

This was the specification of the rules of the game. We propose now two guidelines for the farmer to follow. The first is to avoid all movements which lead to a dangerous situation, that is, one with the goat and some other belonging left by themselves. The second is to avoid undoing the most recent crossing: for example, after crossing one way with the goat, avoid going back the other way with the goat again. These are both quite obvious guidelines to follow, and we hypothesize that they are enough to ensure that the farmer reaches the goal. As it turns out, the hypothesis is false, and we will need to strengthen the second guideline; but let us work with this for the time being.

The guidelines are enforced by avoiding certain transitions to be triggered. For that, we need to identify said transitions. First, the dangerous ones:

The variable B represents a belonging, while B?, as before, can be either a belonging or noBelong. In words: there is danger if the farmer is in the boat and the goat has been left alone with some other belonging.

We need to restrict the execution of RIVER so that

at all times. This is another instance where a syntactic shortcut would help, but also this requirement can be enforced by a composition with an appropriate controller.

Let us call the following system AVOID. It is as simple as a system can possibly be:

There is a single state, called init, no transitions and no rules, and the property avoid is always false. Thus, the composed system

indeed avoids all situations at which danger is true.

Implementing the other guideline, avoidance of the undoing of movements, requires one more step, because we need to, somehow, store the previous movement so as to be able to compare it with the potential new one. We are after a composed system like this

where RIVER informs the new system PREVIOUS about the moves being made, and PREVIOUS stores at each moment the latest move. We name this composed system RIVER-W-PREV.

The new component PREVIOUS needs only this rule:

Its state sort is MaybeBelong, that is, either actually one of the three belongings or the value noBelong. In this case they are representing movements: the farmer crossing either with the specified belonging or alone. The transition term includes two such movements: the previous one and the new one. In this way, we can check them for equality when needed. To synchronize with the main system RIVER, we use this property in PREVIOUS:

Correspondingly, we need this property in RIVER:

We need to include the new constant noMove for when, indeed, no move is taking place.

Storing information about the past execution of the system is called instrumentation and is a common technique in system analysis. This is another instance calling for syntactic sugar. As shown with the RIVER || PREVIOUS example, it can be achieved by composition of atomic rewrite systems.

Whenever RIVER is executing a crossing, PREVIOUS is showing, in its transition term, the previous and the current moves, giving us the possibility of checking if they are equal:

Now, we need to restrict RIVER-W-PREV so as to avoid undoing movements. For that, we can use AVOID, as above. But we need two instances of that system, one to avoid danger, the other to avoid undoings, to which we refer as AVOID1 and AVOID2.

At the end, the system we are interested in is

This completes the specification of the system. Later in the paper, in Section 9.3, we show how to verify that it leads to a solution… or, rather, that it does not. But we will also show a sufficient strengthening of the concept of undoing.

As in the previous examples, we want to draw the reader’s attention to the modularity of our specification. Some previous treatments of this problem in rewriting logic (Palomino et al. Reference Palomino, Martí-Oliet and Verdejo2005; Rubio et al. Reference Rubio, Martí-Oliet, Pita and Verdejo2021) used several rules to model the different ways of crossing. But this is irrelevant to us, because any specification that defines the properties move and danger will do as well.

3 Background

This section is a formal summary of our previous work on the synchronous composition of rewrite systems (Martín et al. Reference Martní, Verdejo and Martí-Oliet2020). Detailed explanations and proofs can be found there. This whole section is quite theoretical, consisting of many definitions and a few propositions, to complement the informal and example-based introduction in Section 2.

We define below a number of structures and systems. This is a list of them with the abbreviations we use to refer to them:

The polyhedron in Figure 1 shows the whole set of structures and systems with their related maps. Slanted dashed arrows represent the several concepts of split, that is, of obtaining plain transition structures or rewrite systems from egalitarian ones. Double horizontal arrows represent synchronous composition of systems or structures: composing systems or structures of the same kind produces another one of the same kind. Downward snake arrows represent semantic maps, assigning transition structures to rewrite systems. The two horizontal hooked arrows on the left represent inclusion: atomic systems and structures are particular cases of general systems and structures, respectively. All the elements in the diagram are defined below, and better explained in our previous paper (Martín et al. Reference Martní, Verdejo and Martí-Oliet2020).

Fig. 1. The types of systems we use and their relations.

3.1 Egalitarian structures and systems

As we mentioned above, we use transition structures (of particular types) as semantics for our rewrite systems. In due time, we define execution paths for transition structures, and satisfaction based on those paths. In this section we define atomic egalitarian transition structures, atomic egalitarian rewrite systems, the semantic relation between them, and their compositions.

Definition 1 (atomic egalitarian transition structure) An atomic egalitarian transition structure is a tuple $\mathcal{T}=(Q,T,\mathrel{\rightarrow},P,g_0)$ , where:

• Q is the set of states;

• T is the set of transitions;

• is the bipartite adjacency relation;

• P is the set of properties, each one a total function p from $Q\mathrel{\cup} T$ to some codomain $C_p$ ;

• is the initial state or transition.

We refer to the elements of $Q\mathrel{\cup} T$ as stages. The class of atomic egalitarian transition structures is denoted by atEgTrStr.

The adjacency relation allows for several arrows in and out of a transition, as well as a state. The egalitarian goal also mandates that not only an initial state is possible, but also an initial transition. We use variables typically called g, with or without ornaments, to range over stages.

The definition of an atomic egalitarian transition structure is almost identical to that of a Petri net. The difference, however, is in the semantics: we are interested in a simple path semantics, instead of sets of marked places. This is better explained in Section 4.

In the definitions below, for a given signature $\Sigma$ , we denote by $T_\Sigma$ the set of terms on $\Sigma$ , by $T_\Sigma(X)$ the terms with sorted variables from the set X, and by $T_{\Sigma,s}$ and $T_\Sigma(X)_s$ the terms of sort s from the respective sets. Finally, $\Sigma|_s=\{f:s\to s' \mid \text{ for some } s'\in S\}$ denotes the set of totally defined unary operators in $\Sigma$ with domain $s\in S$ .

Definition 2 (atomic egalitarian rewrite system)

An atomic egalitarian rewrite system is a tuple $\mathcal{R}=(S,{\le},\Sigma,E,R)$ , where:

• $(S,{\le})$ is a poset of sorts. We assume $\texttt{State}, \texttt{Trans},\texttt{Stage}\in S$ with $\texttt{State}\le\texttt{Stage}$ and $\texttt{Trans}\le\texttt{Stage}$ . The terms of sort Stage are called stages.

• $\Sigma$ is a signature of operators (and constants) $f : \omega \to s$ for some $\omega\in S^*$ and $s\in S$ . We assume there is a constant $\texttt{init}\in\Sigma$ of sort Stage.

• E is a set of left-to-right oriented equations

  
  where $t,t'\in T_\Sigma(X)_s$ for some $s\in S$ and the condition C (which may be absent) is a conjunction $\bigwedge_i u_i=u_i'$ of equational conditions, for $u_i,u_i'\in T_\Sigma(X)_{s_i}$ for some $s_i\in S$ .

• The set R contains egalitarian rules, that is, rules of the form

  
  where $u,u'\in T_\Sigma(X)_\texttt{State}$ , $t\in T_\Sigma(X)_\texttt{Trans}$ and C (which may be absent) is as above.

We also refer as signature to the triple $(S,{\le},\Sigma)$ . A property is any element of $\Sigma|_\texttt{Stage}$ , that is, any unary operator in $\Sigma$ totally defined on Stage terms.

The main point in which we depart from the standard definitions of rewrite system (often called rather rewrite theory) (Meseguer Reference Meseguer1992) is that our rules are egalitarian, by which we mean that they include an explicit transition term. Properties are also a nonstandard ingredient. As a passing note, we have shown (Martín 2021a, Section 6.2.4) that requiring properties to be totally defined, as we do, is not a meaningful restriction.

In Maude, and in our examples in this paper, equations are introduced by the keywords or and rules by ; in each case the form is used when conditions are present. The signature is represented by sentences with keywords though we often omit such sentences in the examples in this paper.

Some of the definitions and results that follow are very similar for transition structures and for rewrite systems. In particular, the synchronization mechanism is the same for one and the other. To minimize repetition, we deal with both of them jointly as much as possible. We refer to them in abstract as systems and with the letter $\mathcal{S}$ .

We compose atomic systems and structures to create complex ones. In all this paper we consider each system to be its own namespace, so that the sets of properties, sorts and operators from different systems are disjoint.

Definition 3 (suitable synchronization criteria)

Given a set of atomic structures or systems, one for each $n=1,\dots,N$ , either all of them in atEgTrStr or all of them in atEgRwSys, each with set of properties $P_n$ , a set of synchronization criteria for them is a set $Y\subseteq\bigcup_nP_n\times\bigcup_nP_n$ .

We say that a set Y of synchronization criteria is suitable if it satisfies the following conditions. For transition structures, we require that, if $(p,p')\in Y\mathrel{\cap} (P_m\times P_n)$ , for some $m,n\in\{1,\dots,N\}$ , with $p : Q_m\mathrel{\cup} T_m\to C$ and $p' : Q_n\mathrel{\cup} T_n\to C'$ , then the elements in C and C’ can be compared for equality. Correspondingly, for rewrite systems $\mathcal{R}_n=(S_n,\le_n,\Sigma_n,E_n,R_n)$ , we require that, if $(p,p')\in Y\mathrel{\cap}(P_m\times P_n)$ , with $p : \texttt{Stage}_m \to s$ and $p' : \texttt{Stage}_n \to s'$ , then there exists a sort $s_0$ , common to $\mathcal{R}_m$ and $\mathcal{R}_n$ , with $s_m\le_m s_0$ and $s_n\le_n s_0$ , and an equational theory $\mathcal{E}_0$ of $s_0$ , included as subtheory in both $\mathcal{R}_m$ and $\mathcal{R}_n$ , in which the values of p and p’ can be checked for equality.

To be precise, we should require that $\mathcal{E}_0$ be embedded (rather than included) by means of injective maps into the equational theories of $\mathcal{R}_m$ and $\mathcal{R}_n$ . In that way, the namespaces of different systems are kept disjoint. While it is technically imprecise, we use the shorthand of saying that $\mathcal{E}_0$ is the common equational theory of $s_0$ .

Definition 4 (synchronous composition)

The synchronous composition of $\mathcal{S}_n$ for $n=1,\dots,N$ , either all of them in atEgTrStr or all of them in atEgRwSys, with respect to the suitable synchronization criteria Y is denoted by $\|_Y\{\mathcal{S}_n\mid n=1,\dots,N\}$ , or usually just $\|_Y\mathcal{S}_n$ . From now on, whenever we write $\|_Y\mathcal{S}_n$ , we are assuming Y is suitable. When only two components are involved, we usually write $\mathcal{S}_1\|_Y\mathcal{S}_2$ .

Definition 5 (egalitarian structures and systems)

We define the classes of egalitarian transition structures, denoted by EgTrStr, and, respectively, of egalitarian rewrite systems, denoted by EgRwSys, as the smallest ones that contain atEgTrStr or, respectively, atEgRwSys, and are closed with respect to the synchronous composition operation described above.

We need to consider a notion of equivalence: the one given by the different ways of composing the same components. For example, $(\mathcal{S}_1\|_{Y}\mathcal{S}_2)\|_{Y'}\mathcal{S}_3$ is equivalent to $\|_{Y\mathrel{\cup} Y'}\{\mathcal{S}_1, \mathcal{S}_2, \mathcal{S}_3\}$ .

Definition 6 (equivalent structures and systems)

The set of atomic components of an egalitarian transition structure or rewrite system is:

• $\mathop{\textrm{atoms}}(\mathcal{S}) = \{\mathcal{S}\}$ if $\mathcal{S}$ is atomic,

• $\mathop{\textrm{atoms}}(\|_Y\mathcal{S}_n) = \bigcup_n\mathop{\textrm{atoms}}(\mathcal{S}_n)$ .

The total set of criteria of an egalitarian transition structure or rewrite system is:

• $\mathop{\mathrm{criteria}}(\mathcal{S}) = \emptyset$ if $\mathcal{S}$ is atomic,

• $\mathop{\mathrm{criteria}}(\|_Y\mathcal{S}_n) = \widetilde{Y} \mathrel{\cup} \bigcup_n\mathop{\mathrm{criteria}}(\mathcal{S}_n)$ ,

where $\widetilde{Y}=\{\{p,q\} \mid (p,q)\in Y\}$ (so that (p,q) and (q,p) represent the same criterion).

Two egalitarian structures or systems $\mathcal{S}_1$ and $\mathcal{S}_2$ are said to be equivalent iff $\mathop{\textrm{atoms}}(\mathcal{S}_1)=\mathop{\textrm{atoms}}(\mathcal{S}_2)$ and $\mathop{\mathrm{criteria}}(\mathcal{S}_1)=\mathop{\mathrm{criteria}}(\mathcal{S}_2)$ .

Proposition 1 (equivalence to composition of atoms)

Every egalitarian transition structure or rewrite system is equivalent to one of the form $\|_Y\mathcal{S}_n$ where each $\mathcal{S}_n$ is atomic.

Namely, $\mathcal{S}=\|_Y\mathcal{S}_n$ is equivalent to $\|_{Y'}\mathop{\textrm{atoms}}(\mathcal{S})$ , where $Y'=\{(p,q) \mid \{p,q\}\in\mathop{\textrm{criteria}}(\mathcal{S})\}$ .

In our previous work (Martín et al. Reference Martní, Verdejo and Martí-Oliet2020; Martín 2021a) we showed that equivalent systems represent the same behavior, as given by paths and satisfaction of temporal formulas. This allows us to group the atomic components in the most suitable way for a modular design. Thus, in the example in Section 2.3, we first composed RIVER || PREVIOUS to obtain RIVER-W-PREV, which was then used in the composition RIVER-W-PREV || AVOID1 || AVOID2.

In short, the compound $\|_Y\mathcal{S}_n$ is a set of atomic components linked by synchronization criteria. The behavior it models is that in which each component evolves according to its internal specification, with the added restriction that all synchronization criteria have to be satisfied at all times.

Definition 7 (signature and properties of a compound)

Let for $n=1,\dots,N$ . Let Y be a set of suitable synchronization criteria. The set of properties for $\mathcal{R}_n$ has already being defined as $\Sigma|_{\texttt{Stage}_n}$ . The set of properties for $\|_Y\mathcal{R}_n$ is defined to be $\biguplus_nP_n$ . Also, the signature for $\|_Y\mathcal{R}_n$ is defined to be $(\bigcup_nS_n,\bigcup_n{\le}_n,\bigcup_n\Sigma_n)$ .

This definition, as was the case for Definition 3, is not technically precise, because we require at the same time that the namespaces be disjoint and that they share the common equational theories. A precise definition would involve pushouts. We avoid it and allow the slight informality of saying that each rewrite system is its own namespace, disjoint from the rest except for those common equational theories.

Definition 8 (semantics in the atomic case)

Given , we define by:

• $Q = T_{\Sigma/E,\texttt{State}}$ (that is, E-equational classes of State terms);

• $T = T_{\Sigma/E,\texttt{Trans}}$ (that is, E-equational classes of Trans terms);

• $\mathrel{\rightarrow}$ is the half-rewrite relation $\mathrel{\rightarrow}^{\text{eg}}_{\mathcal{R}}$ induced by R (Martín et al. Reference Martní, Verdejo and Martí-Oliet2020, Definition 6);

• $P=\Sigma|_\texttt{Stage}$ ;

• $g_0=[\texttt{init}]_{E}$ (that is, the E-equational class of init).

The half-rewrite relation $\to$ takes the system from a state to a transition, or vice versa, in contrast to the usual state-to-state rewrites. Roughly speaking, a rewrite rule produces half rewrites from instances of u to instances of t, and from there to instances of u′.

Definition 9 (semantics for the general egalitarian case)

Given we define its semantics componentwise:

A path semantics for the composition of egalitarian structures is given in Section 4.

4 Distributed and global paths

In preparation for the definition of satisfaction in following sections, we need an operational, or step, semantics for all our transition structures. They are given by paths (for atomic and plain structures) and sets of compatible paths (for compounds). They are defined in this section.

Similarly, a path in $\mathcal{T}=(Q,\mathrel{\rightarrow},P,q_0)\in{{\textsf{TrStr}}}$ is a sequence of adjacent states $\overline{q}=q_0\mathrel{\rightarrow} q_1\mathrel{\rightarrow}\dots$ . We call such a path maximal if it is either infinite or it is finite and its final state has no states adjacent to it.

Compatibility of paths is defined by means of a relation between indices which shows a way in which all paths can be traversed together, interleaving some steps, making other simultaneous, and keeping compatibility of stages at all times. The intuitive meaning of the following definition is that, if $\langle i_1,\dots,i_N\rangle$ is in the relation X, then the stages $g_{1i_1},\dots,g_{Ni_N}$ are visited at the same time, each in its structure. Thus, each relation X describes a possible execution of the composed system.

Further, a set of paths is said to be maximally compatible if no path or subset of paths in it can be extended with new stages in the respective components while maintaining compatibility.

The conditions, specially Condition 2, make it possible to arrange all the tuples in X in a linear sequence, which is shown in Proposition 5 to correspond to a path in the split system. Thus, paths in the split can be seen as global paths.

Condition 5 entails that the paths are all traversed together in their entirety. This, however, does not mean each path is maximal in its component: a partial path can be a member of a compatible set, as long as X shows how to traverse it to its last (though maybe not terminal) stage.

For example, consider the paths for the chained buffers from Section 2.1

• in BUFFER1: idle $\to$ receiving $\to$ gotToken $\to$ sending $\to\cdots$ ;

• in BUFFER2: the same as in BUFFER1;

• in BUFFER3: the single-stage path idle.

A set X showing how to traverse these three paths would include, among others, the following triples:

• $\langle 0,0,0\rangle$ , representing the three paths starting at idle;

• $\langle 1,0,0\rangle$ and $\langle 2,0,0\rangle$ , representing only the first path advancing one step and two steps;

• $\langle 3,1,0\rangle$ , representing the first and second paths advancing to the respective stages sending and receiving, which are compatible.

As a side note, compatibility of paths cannot be defined pairwise, as we did for compatibility of stages in Definition 16. It need not be the case that three paths can be traversed simultaneously keeping compatibility of stages, even if any two of them can.

Consider $\mathop{\mathrm{split}}(\|_Y\mathcal{T}_n)$ . Its states are tuples of components’ stages. Thus, for each atomic component $\mathcal{T}_n$ of $\mathcal{T}$ , a projection map $\pi_n$ can be defined from the states of $\mathop{\mathrm{split}}(\|_Y\mathcal{T}_n)$ to the stages of $\mathcal{T}_n$ . This projection can be extended to paths. However, our definitions allow for a component to advance while others stay in the same stage, so, in general, a pure projection would produce repeated stages (stuttering) that we want to remove.

The paths in a compatible set are not required to be maximal. Indeed, any projection of $\overline{q}$ may fail to be maximal in its component, even if $\overline{q}$ is in the split.

Next, we prove that, given paths $\overline{g_n}$ in $\mathcal{T}_n$ , for $n=1,\dots,N$ , which are compatible, there is a unique path $\overline{q}$ in $\mathop{\mathrm{split}}(\|_Y\mathcal{T}_n)$ such that $\pi_n(\overline{q})=\overline{g_n}$ . Let X be the relation whose existence is given by compatibility of paths in Definition 18. Let the initial state of $\overline{q}$ be $q_0=\langle g_{10},\dots,g_{N0}\rangle$ . Then, inductively, for each state $q_k$ already in the path, let the next state $q_{k+1}$ be the tuple whose existence is required by Condition 2 in Definition 18. Condition 5 ensures that the projections of this $\overline{q}$ produce the complete $\overline{g_n}$ ’s.

The maximal part now follows: to any hypothetical extension for a set of compatible paths would correspond an extension to the corresponding path in the split, and vice versa.

We are not saying too much here: there is an almost trivial correspondence between tuples of paths and paths of tuples. But there are useful consequences. The split provides global, monolithic concepts of states and paths. The equivalence between those concepts and the distributed ones validates our definitions and allows us to work using the most suitable view in each case. Also, as discussed in Section 6.1, it allows us to reason about models of distributed systems, or even execute them, by performing the split and using existing techniques and tools for the corresponding global, monolithic result.

4.1 A short diversion on locality

Even though the definition of compatibility involves all paths at once, and thus all components at once, there is room to see locality somewhat concealed in it. We have already mentioned that the contrast between local and global, or, equivalently, between a distributed view of complex systems and a monolithic one is a motivation for our work, so a short diversion is in order.

For an example, consider a system composed of a sender and a receiver, which synchronize on a Boolean property, very much in the same way as the chained buffers in Section 2.1 did:

While the SENDER is not ready to send, its property isSending keeps being false, the same as Meanwhile, SENDER can evolve in whatever way fits to its function. The system SENDER may even be a composed system on its own, and then its components can interact among them as they need to, with no concern about RECEIVER. Of course, the same is true of RECEIVER. This is the sense in which locality is included in our definitions. This view is more difficult to appreciate when only considering global, monolithic definitions of composition. Let us be more precise.

Proposition 6 (compatibility and locality)

Suppose given the egalitarian transition structure $\mathcal{T} = \|_Y\{\mathcal{T}_n \mid n=1,\dots,N\}$ , which we rather prefer to view grouped as $\mathcal{T} = \mathcal{T}'\|_{Y_3}\mathcal{T}''$ with $\mathcal{T}'= \|_{Y_1}\{\mathcal{T}_n \mid n=1,\dots,N'\}$ and $\mathcal{T}''=\|_{Y_2}\{\mathcal{T}_n \mid n=N'+1,\dots,N\}$ (therefore, $Y=Y_1\uplus Y_2\uplus Y_3$ ). Suppose further that the stages $\{g_n\}_n$ , $n=1,\dots,N$ , are compatible and that, for each n, there is a $g'_n$ such that either $g_n\mathrel{\rightarrow}_n g'_n$ or $g_n=g'_n$ (that is, either $\mathcal{T}_n$ advances one step or stays where it was). We have that the stages $\{g'_n \mid n=1,\dots,N\}$ are compatible if (but not only if) the three following conditions hold:

• the stages in the set $\{g'_n \mid n=1,\dots,N'\}$ are compatible respect to $Y_1$ ;

• the stages in the set $\{g'_n \mid n=N'+1,\dots,N\}$ are compatible respect to $Y_2$ ; and

• for each p used in $Y_3$ , if $p\in P_m$ , we have $p(g_m)=p(g'_m)$ .

Proof. Let (p,q) be a criterion in $Y\mathrel{\cap}(P_i\times P_j)$ , that is, property p is defined in $\mathcal{T}_i$ and property q in $\mathcal{T}_j$ . We need to show that $p(g'_i)=q(g'_j)$ if the three conditions hold.

If $i,j\in\{1,\dots,N'\}$ , it means that $(p,q)\in Y_1$ , and then $p(g_i)=q(g_j)$ because of the first item in the proposition statement. Similarly if $i,j\in\{N'+1,\dots,N\}$ . Finally, if $i\in\{1,\dots,N'\}$ and $j\in\{N'+1,\dots,N\}$ , or vice versa, then $(p,q)\in Y_3$ , so that, because of the third item in the statement and the compatibility of $\{g_n\}_n$ , we have $p(g'_i)=p(g_i)=q(g_j)=q(g'_j)$ .

5 Linear temporal logic

The temporal logic we use in this work is LTL (Clarke et al. Reference Clarke, Grumberg and Peled1999, Ch. 3) with two deviations from the standard that we discuss below. LTL is appropriate for compositional verification because its formulas are implicitly universally quantified over execution paths. Thus, when the possible executions of a system are restricted by its interaction with the environment, the remaining ones still satisfy whatever LTL formulas were satisfied in isolation. ACTL* (Clarke et al. Reference Clarke, Grumberg and Peled1999, Ch. 3) is a superset of LTL that shares this universality property, but we restrict to LTL in this paper.

The first difference between our logic, which we call , and standard LTL is that we avoid the use of the next temporal operator, usually represented by (or, alternatively, $\mathbf{N}$ or $\mathbf{X}$ ). The reason for avoiding is that its reference (the next stage) is not preserved by composition, nor by refinement. If we want to be ready for them, we should treat time as if it were dense: between the present and any next stage, a new stage may show up. Also, the semantics for the operator is not clear when we have to evaluate it at both states and transitions. The resulting logic is still quite common in the literature. If we are allowed to bring in some experts to support us:

[…] increasing the expressiveness of our temporal logic with a next operator would destroy the entire logical foundation for its use in hierarchical methods. (Lamport Reference Lamport1983)

This definition is appropriate for reasoning about asynchronous processes since there is no notion of next system state in such cases. (Clarke et al. Reference Clarke, Long and McMillan1989)

The downside of quitting the next operator is that, well, sometimes it is useful. In particular, in our examples, we have found often the need to specify that a formula holds at each state from the current one but excluding the current one, which in LTL would be written as . However, we have also found that the next state of interest can often be characterized by particular changes in the values of propositions (or, rather, properties). For example, for a proposition p and a temporal formula $\varphi$ , the expression $p\land(p \mathrel{\mathbf{U}} (\neg p \land \varphi))$ can be interpreted as saying that a change in the value of p identifies the next state of interest, at which point we require $\varphi$ to hold.

The second difference between and standard LTL is that, instead of atomic propositions, we use in our formulas properties and terms involving them – that is what $\Pi$ is for. We usually denote by $\Pi$ the set of property symbols to build formulas on, and by P the set of actual properties defined in a transition structure. We decided that properties are the interfaces of systems, and that they are all that is to be observed and known from the external world. It makes sense to use them in formulas. For instance, $\Diamond(p=5)$ and $(p_1+p_2<p_3) \mathrel{\mathbf{U}} (p_4=\texttt{true})$ are valid temporal formulas for us, interpretable on structures in which the respective properties, p, $p_i$ , are defined. Using properties instead of propositions does not increase the expressive power of our formulas, because any Boolean expression involving properties can be turned into an atomic proposition (see Propositions 10 and 11), but properties fit better in our setting.

When we get to semantics below, we will need a means to evaluate expressions involving properties. For now, from a merely syntactic point of view, we need a signature on which such expressions are built. Remember from Definitions 2 and 11 that a signature in rewriting logic is a triple $(S,{\le},\Sigma)$ . To such a signature we add $\Pi$ , a set of S-sorted symbols to represent properties. Then, similarly to the notations $T_\Sigma(X)$ and $T_\Sigma(X)_s$ for terms with variables from X, we use the notations $T_\Sigma(\Pi)$ and $T_\Sigma(\Pi)_s$ for terms which can include sorted symbols from $\Pi$ . Thus, viewing such symbols as new constants, $T_\Sigma(\Pi)=T_{\Sigma\mathrel{\cup}\Pi}$ and $T_\Sigma(\Pi)_s=T_{\Sigma\mathrel{\cup}\Pi,s}$ .

We define $\land$ , $\mathrel{\rightarrow}$ , $\mathrel{\leftrightarrow}$ , $\Diamond$ , $\\Box$ , $\mathrel{\mathbf{W}}$ , and $\mathrel{\mathbf{R}}$ as the usual abbreviations.

In the particular case in which $t\in T_\Sigma(\Pi)_\texttt{Bool}$ (and assuming the sort Bool includes the value true), it is often convenient to allow the mere t as a shortcut for the formula $t=\texttt{true}$ , so that we can write $p_1+p_2<p_3$ instead of $(p_1+p_2<p_3)=\texttt{true}$ .

6 Basic satisfaction relations

The satisfaction relations studied in this section consider systems as closed entities, with no environment, no interaction with other systems. Sections 8 and, specially, Section 9 deal with open, interacting systems.

We need two elements to jointly provide a basis to evaluate the satisfaction of formulas. One is a $\Sigma$ -algebra on which terms in $T_{\Sigma}$ are evaluated. The other element we need is a transition structure on which temporal formulas make sense; for this, we use egalitarian transition structures and plain ones. Transition structures also provide interpretations for the property symbols in $\Pi$ . Thus, we are dealing with satisfaction relations of the form ${\mathcal{T}\!,\mathcal{A}}\models\varphi$ , where $\mathcal{T}$ is a transition structure (which, in our definition, includes its initial state or stage), $\mathcal{A}$ is a $\Sigma$ -algebra, and $\varphi$ is a temporal formula in .

The algebra $\mathcal{A}$ is a $\Sigma$ -algebra in the usual sense that it is implicitly equipped with an interpretation map for all the elements in $\Sigma$ . We denote the interpretations of $s\in S$ and $f\in\Sigma$ in $\mathcal{A}$ , respectively, as $s_{\mathcal{A}}$ and $f_{\mathcal{A}}$ . In the same way, a transition structure $\mathcal{T}$ with set of properties P is a $\Pi$ -transition structure, in the sense that it is implicitly equipped with an interpretation map that assigns to each element in $\Pi$ an element in P. We denote the interpretation of $p\in\Pi$ in $\mathcal{T}$ as $p_{\mathcal{T}}$ . Also, this interpretation has to be sort-preserving, that is, if $p\in\Pi$ has been given sort s, then the codomain of $p_{\mathcal{T}}$ has to be $s_{\mathcal{A}}$ . Often, $\Sigma$ and $\Pi$ are clear from context, and we omit them and say just algebra and transition structure.

Satisfaction is formalized below but, intuitively, evaluating for an atomic $\mathcal{T}$ entails: (i) finding the properties in $\mathcal{T}$ that are the interpretations of $p_1$ , $p_2$ , and $p_3$ ; (ii) finding the values of those properties at each of $\mathcal{T}$ ’s stages; (iii) using $\mathcal{A}$ to evaluate $(p_1(g)+p_2(g)<p_3(g))=\texttt{true}$ for each stage g; and (iv) using the results from the previous step and the adjacency relation in $\mathcal{T}$ to decide whether holds.

The previous discussion is equally valid for the three types of transition structures: plain or egalitarian, atomic or otherwise. The definition of satisfaction of formulas is very similar in all cases, so we present the three definitions at once, in part to avoid repetitions, but also to highlight the similarities.

Remember from Definition 4 that the set of properties of a composed transition structure is the disjoint union of the properties of its components. So, if each $\mathcal{T}_n$ is a $\Pi_n$ -transition structure, then $\mathcal{T}=\|_Y\mathcal{T}_n$ is a $(\biguplus_n\Pi_n)$ -transition structure. The interpretation of p in $\mathcal{T}$ , $p_\mathcal{T}$ , is also $p_{\mathcal{T}_n}$ for some n.

The mapping v can be extended to $T_\Sigma(\Pi)$ homomorphically in the standard way: $\overline{v}(p)=v(p)$ , and $\overline{v}(f(t_1,\dots,t_n))=f_{\mathcal{A}}(\overline{v}(t_1),\dots,\overline{v}(t_n))$ . We denote as $t_{{\mathcal{T}\!,\mathcal{A}}}$ the image of t under $\overline{v}$ , that is, the evaluation of the term t in $\mathcal{T}$ and $\mathcal{A}$ .

The type of v(p) is what we called $C_p$ in Definition 1, so it is dependent on p.

Syntactically speaking, the role of $\Pi$ in $T_\Sigma(\Pi)$ is analogous to the role of a set of variables in $T_\Sigma(X)$ . In this sense, the valuation v for properties is analogous to the classical valuation maps that assign to each variable in X an element in the algebra.

There is a technical point regarding interpretations and the split that we need to take care of: both $\mathcal{T}$ and $\mathop{\mathrm{split}}(\mathcal{T})$ are $\Pi$ -transition structures, both with the same set of properties, say P, so that they are both equipped with an interpretation from $\Pi$ to P, respectively, $p\mapsto p_\mathcal{T}\in P$ and $p\mapsto p_{\mathop{\mathrm{split}}(\mathcal{T})}\in P$ . In principle, the interpretations need not be the same, but that is the natural and convenient way to proceed.

Now, we can define the satisfaction relation for each of our three classes of transition structures.

Finally, let $t,u\in T_\Sigma(\Pi)_s$ for some $s\in S$ , and let $\varphi,\psi$ be formulas in . The satisfaction relation ${\mathcal{T}\!,\mathcal{A}}\models\varphi$ is defined by:

• ${\mathcal{T}\!,\mathcal{A}} \models t=u$ iff $t_{{\mathcal{T}\!,\mathcal{A}}}=u_{{\mathcal{T}\!,\mathcal{A}}}$ ;

• otherwise, ${\mathcal{T}\!,\mathcal{A}} \models \varphi$ iff

• for each maximal path $\pi$ in $\mathcal{T}$ ,

• respectively, for each maximally compatible set of paths $\pi$ in $\mathcal{T}$ ,

• respectively, for each maximal path $\pi$ in $\mathcal{T}$ ,

we have ${\mathcal{T}\!,\mathcal{A}},\pi\models\varphi$ .

Satisfaction of a formula by a path is defined by:

• ${\mathcal{T}\!,\mathcal{A}},\pi \models t=u$ iff ${\mathcal{T}\!,\mathcal{A}} \models t=u$ ;

• ${\mathcal{T}\!,\mathcal{A}},\pi \models \neg\varphi$ iff not ${\mathcal{T}\!,\mathcal{A}},\pi \models \varphi$ ;

• ${\mathcal{T}\!,\mathcal{A}},\pi \models \varphi\lor\psi$ iff ${\mathcal{T}\!,\mathcal{A}},\pi \models \varphi$ or ${\mathcal{T}\!,\mathcal{A}},\pi \models \psi$ ;

• ${\mathcal{T}\!,\mathcal{A}},\pi \models \varphi\mathrel{\mathbf{U}}\psi$ iff there is some $i\ge0$ such that $\mathcal{T}(\pi_i),\mathcal{A},\pi^i \models \psi$ , and for all $j<i$ , we have $\mathcal{T}(\pi_j),\mathcal{A},\pi^j \models \varphi$ .

These definitions are not only formally similar, but also equivalent in a sense made precise in the two propositions that follow. This is again an instance of the equivalence of the distributed and the monolithic views achieved through the split.

Proof. We proceed by structural induction on the shape of the formula. First:

\begin{align*}{\mathcal{T}\!,\mathcal{A}}\models t=u &\iff t_{\mathcal{T}\!,\mathcal{A}}=u_{\mathcal{T}\!,\mathcal{A}}\\&\iff t_{\mathop{\mathrm{split}}(\mathcal{T}),\mathcal{A}}=u_{\mathop{\mathrm{split}}(\mathcal{T}),\mathcal{A}}\\&\iff \mathop{\mathrm{split}}(\mathcal{T}),\mathcal{A}\models t=u.\end{align*}

The second equivalence is because of Proposition 7; the other two are by the definition of satisfaction.

For the inductive case, satisfaction is defined in terms of paths. We need to use the bijection between compatible sets of paths in (the atomic components of) $\mathcal{T}$ and paths in its split, and between their maximal versions, from Proposition 5. We did not give a name to that bijection in the proposition, but it will be useful to have one now. For consistency, we denote by $\mathop{\mathrm{split}}(\pi)$ the path in $\mathop{\mathrm{split}}(\|_Y\mathcal{T}_n)$ that corresponds to the set of paths $\pi$ . (There is nothing being actually split here in the literal sense of the word, so we take it just as a convenient name.)

Then, we want to prove these equivalences:

\begin{align*}{\mathcal{T}\!,\mathcal{A}}\models\varphi &\iff \text{for each } \pi \text{ max. compat. set of paths in } \mathcal{T} \text{, we have } {\mathcal{T}\!,\mathcal{A}},\pi\models\varphi\\&\iff \text{for each } \pi \text{ max. path in } \mathop{\mathrm{split}}(\mathcal{T}) \text{, we have } \mathop{\mathrm{split}}(\mathcal{T}),\mathcal{A},\pi\models\varphi\\&\iff \mathop{\mathrm{split}}(\mathcal{T}),\mathcal{A}\models\varphi.\end{align*}

The middle equivalence is the one that still needs a proof. More concretely, we are going to prove something a little stronger: for each $\pi$ which is a maximally compatible set of paths in (the atomic components of) $\mathcal{T}$ we have ${\mathcal{T}\!,\mathcal{A}},\pi\models\varphi$ iff $\mathop{\mathrm{split}}(\mathcal{T}),\mathcal{A},\mathop{\mathrm{split}}(\pi)\models\varphi$ . Because each path in $\mathop{\mathrm{split}}(\mathcal{T})$ is the split of a set of compatible paths in $\mathcal{T}$ , the result follows.

We proceed again by induction on the structure of the formula. The case $t=u$ is now dealt with easily, as are negation and disjunction. Thus, what remains to be proved is: for each $\pi$ which is a maximally compatible set of paths in (the atomic components of) $\mathcal{T}$ , we have

\[{\mathcal{T}\!,\mathcal{A}},\pi\models\varphi\mathrel{\mathbf{U}}\psi \quad\text{iff}\quad \mathop{\mathrm{split}}(\mathcal{T}),\mathcal{A},\mathop{\mathrm{split}}(\pi)\models\varphi\mathrel{\mathbf{U}}\psi.\]

This chain of equivalences is quite trivial except maybe for the third one:

\begin{align*}{\mathcal{T}\!,\mathcal{A}},\pi\models\varphi\mathrel{\mathbf{U}}\psi&\iff \exists i\ge0 \text{ such that } \mathcal{T}(\pi_i),\mathcal{A},\pi^i\models\psi\\&\qquad\qquad\text{ and } \forall j<i,\; \mathcal{T}(\pi_j),\mathcal{A},\pi^j\models\varphi\\&\iff \exists i\ge0 \text{ such that } \mathop{\mathrm{split}}(\mathcal{T}(\pi_i)),\mathcal{A},\mathop{\mathrm{split}}(\pi^i)\models\psi\\&\qquad\qquad\text{ and } \forall j<i,\; \mathop{\mathrm{split}}(\mathcal{T}(\pi_j)),\mathcal{A},\mathop{\mathrm{split}}(\pi^j)\models\varphi\\&\iff \exists i\ge0 \text{ such that } \mathop{\mathrm{split}}(\mathcal{T})(\mathop{\mathrm{split}}(\pi)_i),\mathcal{A},\mathop{\mathrm{split}}(\pi)^i\models\psi\\&\qquad\qquad\text{ and } \forall j<i,\; \mathop{\mathrm{split}}(\mathcal{T})(\mathop{\mathrm{split}}(\pi)_j),\mathcal{A},\mathop{\mathrm{split}}(\pi)^j\models\varphi\\&\iff \mathop{\mathrm{split}}(\mathcal{T}),\mathcal{A},\mathop{\mathrm{split}}(\pi)\models\varphi\mathrel{\mathbf{U}}\psi.\end{align*}

For the third equivalence to hold, we need $\mathop{\mathrm{split}}(\mathcal{T}(\pi_i))=\mathop{\mathrm{split}}(\mathcal{T})(\mathop{\mathrm{split}}(\pi)_i)$ , and $\mathop{\mathrm{split}}(\pi^i)=\mathop{\mathrm{split}}(\pi)^i$ . Both are easy to justify, and will not be proved here.

Proof.

\begin{align*}\mathcal{R}\models\varphi&\iff \mathop{\mathrm{sem}}(\mathcal{R}),\mathcal{A}(\mathcal{R})\models\varphi\\&\iff \mathop{\mathrm{split}}(\mathop{\mathrm{sem}}(\mathcal{R})),\mathcal{A}(\mathcal{R})\models\varphi\\&\iff \mathop{\mathrm{sem}}(\mathop{\mathrm{split}}(\mathcal{R})),\mathcal{A}(\mathcal{R})\models\varphi\\&\iff \mathop{\mathrm{sem}}(\mathop{\mathrm{split}}(\mathcal{R})),\mathcal{A}(\mathop{\mathrm{split}}(\mathcal{R}))\models\varphi\\&\iff \mathop{\mathrm{split}}(\mathcal{R})\models\varphi.\end{align*}

The third equivalence is because of Proposition 3. The fourth is because $\mathcal{A}(\mathcal{R})=\mathcal{A}(\mathop{\mathrm{split}}(\mathcal{R}))$ , given that the equational theories from $\mathcal{R}$ are copied as such into $\mathop{\mathrm{split}}(\mathcal{R})$ .

Sometimes, we say that a formula is a formula in the language of $\mathcal{T}$ or in the language of $\mathcal{R}$ , meaning that $\Sigma$ and $\Pi$ are the signature and property symbols associated with the transition structure $\mathcal{T}$ or the rewrite system $\mathcal{R}$ , but we do not care to make $\Sigma$ and $\Pi$ explicit.

6.1 Back to the standards

Plain transition structures are very much like standard Kripke structures; also Boolean properties and atomic propositions are equivalent. So, in the particular case in which all properties in a plain transition structure are Boolean and all atomic formulas have the shape $p=\texttt{true}$ , our definitions agree with the standard ones for Kripke structures and LTL. Even out of this particular case, everything expressible in using properties is also expressible in LTL with Boolean propositions. And it may be worth doing so, because it would allow the use of existing tools on our nonstandard specifications. We make it formal in this section.

Definition 26 (translation into LTL) We define $[\varphi]$ for any formula inductively on the structure of $\varphi$ .

• From each atomic formula $t=u$ in , we create an atomic proposition, which we denote as $[t=u]$ .

• For each nonatomic formula $\varphi$ , the ${{\mathrm{LTL}}}$ formula $[\varphi]$ is the result of replacing each atomic subformula of $\varphi$ by its corresponding atomic proposition. That is:

• $[\neg\xi] = \neg[\xi]$ ;

• $[\xi\lor\xi'] = [\xi]\lor[\xi']$ ;

• $[\xi\mathrel{\mathbf{U}}\xi'] = [\xi]\mathrel{\mathbf{U}}[\xi']$ .

Definition 27 (standardization of structures) Consider given $\Sigma$ , $\Pi$ , and $\mathcal{A}$ as usual, and an formula $\varphi$ . Let $\mathcal{T}=(Q,{\mathrel{\rightarrow}},P,q_0)\in{{\textsf{TrStr}}}$ . We generate a Kripke structure $\mathcal{K}=\mathcal{K}(\mathcal{T},\mathcal{A},\varphi)$ as $\mathcal{K}=(Q,{\mathrel{\rightarrow}},\mathrm{AP},\mathcal{L},q_0)$ , where:

• Q, ${\mathrel{\rightarrow}}$ , and $q_0$ are in $\mathcal{K}$ the same as in $\mathcal{T}$ ;

• ;

• for $q\in Q$ and $\mathcal{T}(q)$ being the transition structure that results by replacing $\mathcal{T}$ ’s initial stage by q.

Proposition 10 (standardization of satisfaction) Let $\Sigma$ , $\Pi$ , $\mathcal{A}$ , $\varphi$ , $\mathcal{T}$ , $[\varphi]$ , and $\mathcal{K}$ as in the previous paragraphs. We have ${\mathcal{T}\!,\mathcal{A}}\models\varphi$ iff $\mathcal{K}\models[\varphi]$ .

The satisfaction relation for Kripke structures and ${{\mathrm{LTL}}}$ formulas is the standard one (Clarke et al. Reference Clarke, Grumberg and Peled1999).

Proof. The proof is an easy induction on the structure of formulas. We also need to prove the equivalence for paths: ${\mathcal{T}\!,\mathcal{A}},\overline{q}\models\varphi$ iff $\mathcal{K},\overline{q}\models[\varphi]$ . We illustrate it with just two cases:

\begin{align*}{\mathcal{T}\!,\mathcal{A}}\models t=u & \iff [t=u]\in\mathcal{L}(q^0)\\ & \iff \mathcal{K}\models[t=u].\end{align*}

We are using here the fact that, for $\mathcal{K}=\mathcal{K}(\mathcal{T},\mathcal{A},\varphi)$ , the Kripke structure $\mathcal{K}(\pi_i)$ , that is, $\mathcal{K}$ with its initial state replaced by $\pi_i$ , can be obtained as $\mathcal{K}(\mathcal{T}(\pi_i),\mathcal{A},\varphi)$ , which is easy to prove.

An immediate consequence is that, for $\mathcal{T}\in{{\textsf{EgTrStr}}}$ , we have ${\mathcal{T}\!,\mathcal{A}}\models\varphi$ iff $\mathop{\mathrm{split}}(\mathcal{T}),\mathcal{A}\models\varphi$ iff $\mathcal{K}\models[\varphi]$ . This allows verifying the satisfaction of formulas in egalitarian structures by using standard tools.

It is worth noting that this procedure does not work componentwise. Suppose, for an example, that for the structure $\mathcal{T}_1$ we are interested in the formula for some numerical property $p_1$ . In the same way, in the structure $\mathcal{T}_2$ we have the formula for a numerical property $p_2$ , which is to be synchronized with $p_1$ . After performing the standardization procedure above on both structures, we get two Boolean propositions $[p_1\le5]$ and $[p_2\ge5]$ which are unrelated and the relation between $p_1$ and $p_2$ cannot be preserved. The implicit message is that using properties instead of Boolean propositions does not increase the expressive power of our formulas, but does increase the possibilities for synchronization.

Plain rewrite systems are close relatives of standard ones. As we have just done for transition structures, we take the final step into the standard setting.

Definition 28 (standardization of rewrite systems)

From a plain rewrite system $\mathcal{R}=(S,{\le},\Sigma,E,R)\in{{\textsf{RwSys}}}$ and an formula $\varphi$ (for some set of property symbols $\Pi$ ), we define AP and $[\varphi]$ as in Definitions 26 and 27. We generate a standard rewrite system $\mathcal{R}(\varphi)=(S^+,{\le},\Sigma^+,E^+,R)$ in the following way. The new set of sorts $S^+$ is defined to be S plus new sorts Bool and Prop (for atomic propositions). To obtain $\Sigma^+$ we add to $\Sigma$ , for each $[\xi]\in\mathrm{AP}$ , the declaration of a Boolean proposition, which we also denote by $[\xi]$ , and also an operator ${\models} : \texttt{State} \times \texttt{Prop} \to \texttt{Bool}$ . Finally, we obtain $E^+$ by adding to E equations to define $\models$ for each new proposition in AP:

• $\big(g\models[t(\overline{p})=u(\overline{p})]\big) = \big(t[\overline{p}(g)/\overline{p}]=u[\overline{p}(g)/\overline{p}]\big)$ , where $\overline{p}$ is the sequence of properties in t (and in u) and $t[\overline{p}(g)/\overline{p}]$ is the result of replacing in t each p by its evaluation at g, that is, by p(g).

Thus, for example, $\big(g\models[p=3]\big) = \big(p(g) = 3)\big)$ , assuming $p=3$ is an atomic formula in $\varphi$ for a numeric property p.

Proposition 11 (standardization of satisfaction) Let $\Sigma$ , $\Pi$ , $\mathcal{A}$ , $\varphi$ , $\mathcal{R}$ , $[\varphi]$ , and $\mathcal{R}(\varphi)$ as in Definition 28. We have $\mathcal{R}\models\varphi$ iff $\mathcal{R}(\varphi)\models[\varphi]$ .

Proof. We have that $\mathcal{R}\models\varphi$ iff $\mathop{\mathrm{sem}}(\mathcal{R}),\mathcal{A}(\mathcal{R})\models\varphi$ iff $\mathcal{K}(\mathop{\mathrm{sem}}(\mathcal{R}),\mathcal{A}(\mathcal{R}),\varphi)\models[\varphi]$ (the first equivalence by Definition 25; the second by Proposition 10). We assert that the Kripke structure $\mathcal{K}(\mathop{\mathrm{sem}}(\mathcal{R}),\mathcal{A}(\mathcal{R}),\varphi)$ is isomorphic to the standard semantics for rewrite systems associated to $\mathcal{R}(\varphi)$ . From that, the proposition follows. The assertion is not difficult to check. For example, the terms of sort State are the same in $\mathcal{R}$ and in $\mathcal{R}(\varphi)$ , and they produce state nodes in the transition structure $\mathop{\mathrm{sem}}(\mathcal{R})$ , which correspond to state nodes in the Kripke structure $\mathcal{K}(\mathop{\mathrm{sem}}(\mathcal{R}),\mathcal{A}(\mathcal{R}),\varphi)$ . Similarly, the adjacency relation and the values of propositions can be checked to correspond.

7 On fairness and deadlocks

When a system $\mathcal{S}$ interacts with an environment $\mathcal{E}$ , its repertoire of execution paths is restricted to a subset of the ones that are possible when $\mathcal{S}$ is run in isolation. For an LTL formula $\varphi$ in the language of $\mathcal{S}$ , the statement $\mathcal{S}\models\varphi$ means that all maximal paths in $\mathcal{S}$ satisfy $\varphi$ . In particular, all maximal paths in $\mathcal{S}$ that remain after the environment restriction still satisfy $\varphi$ . And because $\varphi$ only speaks about $\mathcal{S}$ (and not about $\mathcal{E}$ ), we may be willing to assert that $\mathcal{S}\models\varphi$ implies $\mathcal{S}\|_Y\mathcal{E}\models\varphi$ for any environment $\mathcal{E}$ and criteria Y. Except this does not hold when the interaction with the environment prevents $\mathcal{S}$ from executing long enough to satisfy $\varphi$ . This may be the case when paths in $\mathcal{S}$ that are not maximal become maximal in $\mathcal{S}\|_Y\mathcal{E}$ , which can happen because of lack of fairness between components or because of emerging deadlocks.

Some models of interaction avoid these issues by establishing that only fair executions are part of the semantics (Pnueli Reference Pnueli1985; Grumberg and Long Reference Grumberg and Long1994), or that all interactions consist of message passing and the receiver is at all times ready to receive (Lynch and Tuttle Reference Lynch and Tuttle1989), thus preventing emerging deadlocks. We are taking a more permissive approach, which both requires and allows a discussion of the details. This section introduces such a discussion. We consider only transition structures, but the results are equally valid for rewrite systems by means of their semantics.

First, consider deadlocks. More precisely, emerging deadlocks, that is, the ones which result from the failure of the component systems to agree on a next action to perform.

According to this definition, there is no deadlock as long as some component system keeps running, even if only one does. Moreover, if one path in the set is finite in its system and reaches its final state in the compatible set, there is no deadlock, even though the composed system may come to a halt. This is our working definition, certainly not the only possible one. This capability to accommodate different definitions within the same framework is made possible by a permissive concept of composition like ours.

Deadlock can be prevented with some extra work on the part of the specifier. Being aware that the system is meant to work inside a largely unknown environment, the specifier should be able to anticipate unfriendly behaviors and be ready to deal with them. That is, the specification should include reactions to wrong environment behaviors, even if only with the aim of raising exceptions or performing error recovery. The following proposition shows a particular case in which this is achieved.

Because of the statement of the proposition, each possible value v of p is realized in a $g_v$ in $\mathcal{T}_1$ such that $g_1^1\mathrel{\rightarrow}_1 g_v$ . Now, suppose the relation X from Definition 18 (the one which shows how the two paths can be traversed) pairs $g_1^1$ with $g_2^1$ , and then consider the particular value $v=q(g_2^1)$ . Then, the path in $\mathcal{T}_1$ that has taken us to $g_1^1$ can be extended to $g_v$ while $\mathcal{T}_2$ stays at $g_2^1$ , so that $\overline{g_1}$ can run indefinitely, or as long as $\mathcal{T}_1$ allows it to.

The conditions in Proposition 12 can be paraphrased as one component acting as a receiver which is ready to receive any value at any time. Less demanding conditions would be enough to guarantee absence of deadlocks.

This technique may seem too convoluted, but something similar is implicitly used in some models of composition. Typically, those models divide the possible interactions of a component with its environment into inputs and outputs. Inputs represent the reception of a value from the environment. The input value is controlled only by the environment, and the component is assumed to be ready to receive it, at any time, whatever it is. In the same way, the environment is assumed to be ready to receive any value the component outputs. For example, input/output automata (Lynch and Tuttle Reference Lynch and Tuttle1989), explicitly state that input events are not in control of the automata that receives them. The technique proposed in the previous paragraph is no more than an explicit implementation of this.

Consider now fairness between components. Fairness is difficult to characterize in the presence of deadlocks, so we only define it for non-deadlocked sets of paths.

Thus, fairness entails that, if a partial path can be extended in its component alone, then it gets eventually extended in the composition as well. This is different from intracomponent fairness: for our purposes here, we do not care about fairness inside each individual component, but only in their interactions.

Our definition of synchronous composition does not require fairness, so it is possible that a component starves. An extreme case is that in which no synchronization criteria are specified, so that the different systems are just put together, but allowed to execute independently. In this case, $\mathcal{S}\models\varphi$ does not entail $\mathcal{S}\|_\emptyset\mathcal{E}\models\varphi$ , because a possible evolution of the composed system is that $\mathcal{E}$ executes but $\mathcal{S}$ does not perform a single step.

A way in which fairness is ensured is by requiring synchronization infinitely often. For example, as in the following proposition.

Proposition 13 (a case of fairness) Let $\mathcal{T}_n\in{{\textsf{atEgTrStr}}}$ for $n=1,\dots,N$ . Suppose that for each $i,j\in\{1,\dots,N\}$ , $i\ne j$ , there is a pair of Boolean properties $(p,q)\in Y\mathrel{\cap}(\mathcal{T}_i\times\mathcal{T}_j)$ , such that

and

Then any set of compatible (and not deadlocked) paths in $\|_Y\mathcal{T}_n$ is fair.

Let X be the relation from Definition 18 which shows how to traverse the compatible paths. Let us say $g_1^1$ and $g_i^1$ are compatible stages in $\mathcal{T}_1$ and $\mathcal{T}_i$ , resp., appearing in $\overline{g_1}$ and $\overline{g_i}$ , resp., which are paired by X. Further, suppose, again without loss of generality, that $p(g_1^1)=q(g_i^1)=\texttt{true}$ . Because $\overline{g_1}\models\Box\Diamond(p=\texttt{false})$ , there is a stage $g_1^2$ in $\overline{g_1}$ which does not satisfy p. Therefore, so that the criterion (p,q) is kept, $\overline{g_i}$ must contain a stage $g_i^2$ which does not satisfy q and that is accessible from $g_i^1$ , that is, $g_i^1\mathrel{\rightarrow}\cdots\mathrel{\rightarrow} g_i^2$ . Thus, $\overline{g_i}$ is infinite.

The condition in Proposition 13 is an example. It is nice in that it can be expressed as a temporal logic formula and, thus, checked by the usual means. More general and easy to meet conditions may be found which are sufficient to ensure fairness. As mentioned above, in some models of computation and composition, fairness is included from the start, that is, the path semantics of a specification includes, by definition, only fair executions, even though the specification, textually taken, would allow unfair ones. This is different from our view, in which we require the specification to be fair as given. The two views, however, are not completely disjoint. In Section 9, we consider the assume/guarantee technique and mention that temporal formulas expressing fairness requirements can be added to the assume part of a specification. This, in a sense, makes fair semantics a particular case of our model. Also, sometimes a system can be externally controlled to allow only fair executions in it. Maybe, even, such a control can be exerted via a synchronous composition with a suitable system. But many different concepts of fairness are possible, and it is not to be expected that all of them can be dealt with in this way.

Besides, deadlocks and fairness become unimportant when $\varphi$ is a safety formula: by definition, a safety formula is satisfied by a path iff it is satisfied by every initial segment of that path, even the empty one. Thus, the proof of the following proposition is immediate.

A component from which we only require to satisfy safety formulas can be seen as imposing its behavior on the compound. It acts as a controller or a strategy. This is the case for the mutual exclusion controller example from Section 2.2 (revisited in Sections 8.3 and 9.2).

The next proposition is a simple remark that a kind of converse implication always holds.

We are assuming $(\mathcal{T}\|_Y\mathcal{E}),\mathcal{A}\models\varphi$ for all $\mathcal{E}$ and Y, so, in particular, $(\mathcal{T}\|_\emptyset\mathcal{E}_0),\mathcal{A}\models\varphi$ and, because of the previous paragraph, also ${\mathcal{T}\!,\mathcal{A}}\models\varphi$ . The proof for rewrite systems follows easily.

Concerning deadlocks and fairness, our framework sets the responsibility in the hands of the user. This is also the case in (Glabbeek and Höfner Reference Glabbeek and Höfner2019, Chapter 16), where some actions may need to be explicitly declared as non-blocking. And in (Klai et al. Reference Klai, Haddad and Ilié2005), where an algorithm is provided to check that an interaction between Petri nets is non-constraining, which is a similar concept. This is another point where an actual implementation may include tools to help. We do not go deeper into this issue here.

8 Componentwise simulation and abstraction

A way to analyze a system is to find another one that in some sense behaves the same and is simpler. This is formalized with the concept of simulation (Clarke et al. Reference Clarke, Grumberg and Peled1999). A particular kind of simulation is abstraction, in which the simpler system is obtained by forgetting some features from the original. In rewriting logic, a well studied kind of abstraction is equational abstraction (Meseguer et al. Reference Meseguer, Palomino and Martí-Oliet2008). In this section, we show that componentwise simulation and equational abstraction translate into global ones. That is, roughly speaking, if there is a simulation (resp., equational abstraction) between systems $\mathcal{S}_1$ and $\mathcal{S}'_1$ , then there is also a simulation (resp. equational abstraction) between $\mathcal{S}_1\|_Y\mathcal{S}_2$ and $\mathcal{S}'_1\|_Y\mathcal{S}_2$ . This is sometimes phrased as simulation and equational abstraction being congruences.

Another kind of abstraction that has been studied in relation to rewriting logic is predicate abstraction (Bae and Meseguer Reference Bae and Meseguer2014). According to it, states of the original system which coincide in the values assigned to all atomic propositions are identified in the abstract system. Predicate abstraction in one component does not need to map to predicate abstraction in the composition. However, predicate abstraction induces a simulation in the abstract component, which does map to a simulation at the global level. We have not much else to say about predicate abstraction in this paper, though we use it in the example in Section 8.3.

There are several ways in which abstraction can be useful for compositional verification. First, instead of verifying $\mathcal{S}$ in the environment $\mathcal{E}$ (that is, $\mathcal{S}\|_Y\mathcal{E}$ ), we can verify an abstraction of $\mathcal{S}$ in the same environment. Second, if we verify $\mathcal{S}$ in $\mathcal{E}$ , the result will also hold for any environment of which $\mathcal{E}$ is an abstraction. Often, we model intuitively our systems from scratch as abstractions. This is certainly the case for the example on chained buffers in Section 2.1. The results which follow in this section show that, if we later need to refine our initial specification, verification may not need to be redone.

8.1 Simulation

Up to now, we have been taking care of defining each concept in both the distributed and the monolithic view. For example, we defined a compatible set of paths and showed it equivalent to a path in the split; and we then defined satisfaction of formulas based on both and, again, showed equivalence. Definition 31 just below, however, defines simulation for composed egalitarian structures as simulations for their splits. We proceed in this way from now on, because it makes definitions and results easier. Still, when we want to enforce one or the other view, distributed or monolithic, we use one or the other of the two equivalent notations, like, for example, either $\|_Y\mathcal{S}_n\models\varphi$ or $\mathop{\mathrm{split}}(\|_Y\mathcal{S}_n)\models\varphi$ .

Definition 31 (simulation) Given a set $\Pi$ of property symbols and two atomic egalitarian $\Pi$ -transition structures $\mathcal{T}=(Q,T,{\mathrel{\rightarrow}},P,g_0)$ and $\mathcal{T}'=(Q',T',{\mathrel{\rightarrow}}',P',g'_0)$ , a simulation ${\mathrel{\mathsf{S}}}:\mathcal{T}\to\mathcal{T}'$ is a relation ${\mathrel{\mathsf{S}}}\subseteq(Q\mathrel{\cup} T)\times(Q'\mathrel{\cup} T')$ such that:

• $g_0\mathrel{\mathsf{S}} g'_0$ ;

• if $g\mathrel{\mathsf{S}} g'$ then $p_{\mathcal{T}}(g)=p_{\mathcal{T}'}(g')$ for each $p\in\Pi$ ;

• if $g_1\mathrel{\mathsf{S}} g'_1$ and $g_1\mathrel{\rightarrow} g_2$ in $\mathcal{T}$ , then there exists a finite path in $\mathcal{T}'$ , $g'_1\mathrel{\rightarrow}'\dots\mathrel{\rightarrow}'g'_k$ , with $k\ge1$ , such that $g_1\mathrel{\mathsf{S}} g'_i$ for $i=1,\dots,k-1$ and $g_2\mathrel{\mathsf{S}} g'_k$ .

If both $\mathrel{\mathsf{S}}$ and $\mathrel{\mathsf{S}}^{-1}$ are simulations, we say that $\mathrel{\mathsf{S}}$ is a bisimulation.

The definition for plain transition structures is a straightforward adaptation of the above. Finally, a simulation between nonatomic egalitarian transition structures $\|_Y\mathcal{T}_n$ and $\|_{Y'}\mathcal{T}'_n$ is, by definition, a simulation between their splits: ${\mathrel{\mathsf{S}}} : \mathop{\mathrm{split}}(\|_Y\mathcal{T}_n) \rightarrow \mathop{\mathrm{split}}(\|_{Y'}\mathcal{T}'_n)$ .

A (bi)simulation is with respect to the symbols in $\Pi$ . When we need to make this explicit, we say it is a $\Pi$ -(bi)simulation.

The third item in the definition allows, in particular, $k=1$ , so that the requirement becomes $g_1\mathrel{\mathsf{S}} g'_1$ and $g_2\mathrel{\mathsf{S}} g'_1$ – so to speak, $\mathcal{T}$ advances while $\mathcal{T}'$ waits.

The concept defined above is analogous to the ones called stuttering (bi)simulation and weak (bi)simulation in the literature. However, we decided to avoid the use of the next operator in our temporal logic, and also decided that only the values of properties are important, not paying attention to possible internal steps. Thus, we are always working in a way that pretty much corresponds to stuttering or weakness. So, we drop adjectives and call our concept just (bi)simulation.

Theorem 1 (simulation and satisfaction) Consider $\Sigma$ , $\Pi$ , and $\mathcal{A}$ as usual, and $\mathcal{T},\mathcal{T}'\in{{\textsf{EgTrStr}}}\mathrel{\cup}{{\textsf{TrStr}}}$ . If there exists a simulation ${\mathrel{\mathsf{S}}}:\mathcal{T}\to\mathcal{T}'$ , then for every formula $\varphi$ we have that $\mathcal{T}',\mathcal{A}\models\varphi$ implies ${\mathcal{T}\!,\mathcal{A}}\models\varphi$ . If $\mathrel{\mathsf{S}}$ is a bisimulation, then ${\mathcal{T}\!,\mathcal{A}}\models\varphi$ iff $\mathcal{T}',\mathcal{A}\models\varphi$ .

Proof . It is an easy adaptation of the proof for more traditional settings (Clarke et al. Reference Clarke, Grumberg and Peled1999). It proceeds by induction on the structure of $\varphi$ . It relies on two lemmas that hold whenever there is a simulation ${\mathrel{\mathsf{S}}}:\mathcal{T}\to\mathcal{T}'$ (they are easy, and we do not prove them here): first, that $t_{\mathcal{T}\!,\mathcal{A}} = t_{\mathcal{T}',\mathcal{A}}$ for any term $t\in T_\Sigma(\Pi)$ ; second, that for each path in $\mathcal{T}$ there is a (stuttering, weak) corresponding path in $\mathcal{T}'$ . Let us sketch just one base case and one inductive case:

\begin{align*}\mathcal{T}',\mathcal{A}\models t=u &\iff t_{\mathcal{T}',\mathcal{A}}=u_{\mathcal{T}',\mathcal{A}}\\ &\iff t_{{\mathcal{T}\!,\mathcal{A}}}=u_{{\mathcal{T}\!,\mathcal{A}}}\\ &\iff {\mathcal{T}\!,\mathcal{A}}\models t=u.\end{align*}

The second equivalence is justified by the first lemma mentioned above.

\begin{align*}\mathcal{T}',\mathcal{A}\models\varphi\mathrel{\mathbf{U}}\psi & \iff \textrm{for each path } \overline{g}' \textrm{ in } \mathcal{T}' \textrm{ we have } \mathcal{T}',\mathcal{A},\overline{g}'\models\varphi\mathrel{\mathbf{U}}\psi\\ & \iff \textrm{for each path } \overline{g}' \textrm{ in } \mathcal{T}' \textrm{ there exists } i'\ge0 \textrm{ such that }\\ & \qquad\quad \mathcal{T}'(g'_{i'}),\mathcal{A},\overline{g}'^{i'}\models\psi \textrm{ and, for all } j'<i', \mathcal{T}'(g'_{j'}),\mathcal{A},\overline{g}'^{j'}\models\varphi\\ & \implies \textrm{for each path } \overline{g} \textrm{ in } \mathcal{T} \textrm{ there exists } i\ge0 \textrm{ such that }\\ & \qquad\quad \mathcal{T}(g_i),\mathcal{A},\overline{g}^i\models\psi \textrm{ and, for all } j<i, \mathcal{T}(g_j),\mathcal{A},\overline{g}^j\models\varphi\\ & \iff \textrm{for each path } \overline{g} \textrm{ in } \mathcal{T} \textrm{ we have } {\mathcal{T}\!,\mathcal{A}},\overline{g}\models\varphi\mathrel{\mathbf{U}}\psi\\ & \iff {\mathcal{T}\!,\mathcal{A}}\models\varphi\mathrel{\mathbf{U}}\psi.\end{align*}

The “ $\implies$ ” step in the middle is justified by the second lemma mentioned above.

The next theorem is our main result about simulations, stating that componentwise simulations induce global ones. It can be seen as an adaptation of (Clarke et al. Reference Clarke, Grumberg and Peled1999, Ch. 12).

Definition 32 ( $\sim$ for synchronization criteria)

For $n=1,\dots,N$ , let

\[A_n=(Q_{A_n},T_{A_n},{\mathrel{\rightarrow}_{A_n}},P_{A_n},g_{A_n}^0) \quad\text{and}\quad B_n=(Q_{B_n},T_{B_n},{\mathrel{\rightarrow}_{B_n}},P_{B_n},g_{B_n}^0)\]

be atomic egalitarian $\Pi_n$ -transition structures such that there are $\Pi_n$ -simulations ${\mathrel{\mathsf{S}}}_n : A_n\to B_n$ . Consider the composed systems $\|_Y A_n$ and $\|_Z B_n$ . We denote by $Y\sim Z$ the fact that, for $p,q\in\bigcup_n\Pi_n$ , we have $(p_{A_n},q_{A_m})\in Y\mathrel{\cap}(P_{A_n}\times P_{A_m})$ iff $(p_{B_n},q_{B_m})\in Z\mathrel{\cap}(P_{B_n}\times P_{B_m})$ .

Theorem 2 (simulation and composition) Let $A_n$ and $B_n$ be atomic egalitarian $\Pi_n$ -transition structures such that there are $\Pi_n$ -simulations ${\mathrel{\mathsf{S}}}_n : A_n\to B_n$ for $n=1,\dots,N$ . (The identity is a bisimulation, so this includes the case that $A_n=B_n$ for some or all n.) Consider $A=\mathop{\mathrm{split}}(\|_Y A_n)$ and $B=\mathop{\mathrm{split}}(\|_Z B_n)$ for some Y and Z with $Y\sim Z$ . Then, there is a simulation ${\mathrel{\mathsf{S}}} : A \to B$ (as plain transition structures). In addition, if all $\mathrel{\mathsf{S}}_n$ are bisimulations, then $\mathrel{\mathsf{S}}$ can be taken to be a bisimulation as well.

Proof. The simulation $\mathrel{\mathsf{S}}$ is defined by

\[\langle g_{A_1},\dots,g_{A_N}\rangle \mathrel{\mathsf{S}} \langle g_{B_1},\dots,g_{B_N}\rangle \iff g_{A_n} \mathrel{\mathsf{S}}_n g_{B_n} \textrm{ for all }n.\]

We must show that this is indeed a simulation (if each $\mathrel{\mathsf{S}}_n$ is), that is, that the three items in Definition 31 hold.

The first item in the definition, that $\langle g_{A_10},\dots,g_{A_N0}\rangle \mathrel{\mathsf{S}} \langle g_{B_10},\dots,g_{B_N0}\rangle$ , follows immediately from $g_{A_n0} \mathrel{\mathsf{S}}_n g_{B_n0}$ holding for each n.

For the second item in Definition 31, we must prove that, for arbitrary $g_{A_n}$ and $g_{B_n}$ , if $\langle g_{A_1},\dots,g_{A_N}\rangle \mathrel{\mathsf{S}} \langle g_{B_1},\dots,g_{B_N}\rangle$ , we have $p_A(\langle g_{A_1},\dots,g_{A_N}\rangle)=p_B(\langle g_{B_1},\dots,g_{B_N}\rangle)$ . So, take a particular $p_A\in\bigcup_n P_{A_n}$ . Suppose $p_A=p_{A_k}\in P_{A_k}$ and, therefore, because $Y\sim Z$ , $p_B=p_{B_k}\in P_{B_k}$ . Then, $p_A(\langle g_{A_1},\dots,g_{A_N}\rangle) = p_{A_k}(g_{A_k}) = p_{B_k}(g_{B_k}) = p_B(\langle g_{B_1},\dots,g_{B_N}\rangle)$ .

For the third item in Definition 31, we consider the simpler case with only two components, that is, $N=2$ . This simplifies the presentation. The case for a general N follows the same lines.

Thus, from $\langle g_{A_1},g_{A_2}\rangle \mathrel{\mathsf{S}} \langle g_{B_1},g_{B_2}\rangle$ and $\langle g_{A_1},g_{A_2}\rangle \mathrel{\rightarrow}_A \langle g'_{A_1},g'_{A_2}\rangle$ we must be able to produce a path in B with the needed properties. From $\langle g_{A_1},g_{A_2}\rangle \mathrel{\mathsf{S}} \langle g_{B_1},g_{B_2}\rangle$ we get $g_{A_1} \mathrel{\mathsf{S}}_1 g_{B_1}$ and $g_{A_2} \mathrel{\mathsf{S}}_2 g_{B_2}$ . And from $\langle g_{A_1},g_{A_2}\rangle \mathrel{\rightarrow}_A \langle g'_{A_1},g'_{A_2}\rangle$ we deduce both $(g_{A_1} \mathrel{\rightarrow}_{A_1} g'_{A_1}$ or $g_{A_1} = g'_{A_1})$ and $(g_{A_2} \mathrel{\rightarrow}_{A_2} g'_{A_2}$ or $g_{A_2} = g'_{A_2})$ .

For $A_1$ , if $g_{A_1} \mathrel{\rightarrow}_{A_1} g'_{A_1}$ , because $\mathrel{\mathsf{S}}_1$ is a simulation, we have that there exist a finite path $g_{B_1}=g_{B_1}^1 \mathrel{\rightarrow}_{B_1} \dots \mathrel{\rightarrow}_{B_1} g_{B_1}^{i_1}$ , $i_1\ge1$ , such that $g_{A_1}\mathrel{\mathsf{S}}_1 g^1_{B_1}$ , …, $g_{A_1}\mathrel{\mathsf{S}}_1 g_{B_1}^{i_1-1}$ and $g'_{A_1}\mathrel{\mathsf{S}}_1 g_{B_1}^{i_1}$ . If instead $g_{A_1}=g'_{A_1}$ , we choose $g_{B_1}=g'_{B_1}$ , which can be seen as a path of length 1. The same can be done for $A_2$ , after which we end with a path in $B_1$ and another in $B_2$ .

From these paths in $B_1$ and in $B_2$ we build now one in $B=B_1\|_ZB_2$ . The idea is to interleave in whichever way the paths $g^1_{B_1}\mathrel{\rightarrow}_{B_1}^*g^{i_1-1}_{B_1}$ and $g^2_{B_2}\mathrel{\rightarrow}_{B_2}^*g^{i_2-2}_{B_2}$ , and then take a last joint step $\langle g^{i_1-1}_{B_1}, g^{i_2-1}_{B_2}\rangle \mathrel{\rightarrow}_B \langle g^{i_1}_{B_1}, g^{i_2}_{B_2}\rangle$ . For example: $\langle g_{B_1},g_{B_2}\rangle=\langle g_{B_1}^1,g_{B_2}^1\rangle \mathrel{\rightarrow}_B^*\langle g_{B_1}^{i_1-1},g_{B_2}^1\rangle\mathrel{\rightarrow}_B^*\langle g_{B_1}^{i_1-1},g_{B_2}^{i_2-1}\rangle\mathrel{\rightarrow}_B\langle g_{B_1}^{i_1},g_{B_2}^{i_2}\rangle$

Two points remain to be proved. First, that $\langle g_{A_1},g_{A_2}\rangle \mathrel{\mathsf{S}} g$ for all stages g in the path, except the last one, and that $\langle g'_{A_1},g'_{A_2}\rangle \mathrel{\mathsf{S}} \langle g_{B_1}^{i_1},g_{B_2}^{i_2}\rangle$ . This is immediate, because it holds componentwise. Second, that the exhibited path is indeed a path in B, that is, that all stages in it satisfy the synchronization criteria in Z. The key here is that stages related by the simulation assign equal values to corresponding properties. For example, for the final stage, we know that $g'_{A_1} \mathrel{\mathsf{S}}_i g^{i_1}_{B_1}$ and $g'_{A_2} \mathrel{\mathsf{S}}_i g^{i_2}_{B_2}$ and, therefore, for each property p we have $p_{A_1}(g'_{A_1}) = p_{B_1}(g^{i_1}_{B_1})$ and $p_{A_2}(g'_{A_2}) = p_{B_2}(g^{i_2}_{B_2})$ . But $\langle g'_{A_1}, g'_{A_2}\rangle$ is a stage in A, and, thus, satisfies all criteria in Y. Finally, because $Y\sim Z$ , the criteria in Z are satisfied by $\langle g^{i_1}_{B_1}, g^{i_2}_{B_2}\rangle$ .

On the other hand, similarly behaved systems can be specified from quite different components, so it is not to be expected that any (bi)simulation $\mathsf{S} : \mathrm{split}(T_1) \to \mathrm{split}(T_2)$ , for $T_1$ , $T_2$ egalitarian transition structures, can be factored as a set of (bi)simulations on the components.

Given the importance of deadlocks and fairness in our setting, as discussed in Section 7, it is necessary to explore how they relate to simulation. It is not difficult to see that a mere simulation does not even preserve maximal compatibility of paths, which is needed to make sense of the definitions. The situation is different with bisimulation.

Proposition 17 (bisimulations preserve fairness and deadlock freeness) Let $\mathcal{T}_n,\mathcal{T}'_n\in{{\textsf{atEgTrStr}}}$ for $n=1,\dots,N$ , with each $\mathcal{T}_n$ and $\mathcal{T}'_n$ being a $\Pi_n$ -transition structure. Let Y be any suitable set of synchronization criteria. For convenience, we say that $\|_Y\mathcal{T}_n$ (resp., $\|_Y\mathcal{T}'_n$ ) is deadlock-free iff no set of maximally compatible paths in it is deadlocked (as defined in Definition 29). Similarly, we say that $\|_Y\mathcal{T}_n$ (resp., $\|_Y\mathcal{T}'_n$ ) is fair iff all non-deadlocked and maximally compatible sets of paths are fair (as defined in Definition 30). Suppose there are bisimulations $\mathrel{\mathsf{S}}_n:\mathcal{T}_n\to\mathcal{T}'_n$ for each n. Then, $\|_Y\mathcal{T}_n$ is deadlock-free iff $\|_Y\mathcal{T}'_n$ is. Also, $\|_Y\mathcal{T}_n$ is fair iff $\|_Y\mathcal{T}'_n$ is.

Proof . Given a path $\overline{g'_n}$ in $\mathcal{T}'_n$ , the bisimulation $\mathrel{\mathsf{S}}_n$ allows us to find a corresponding path in $\mathcal{T}_n$ which we denote as $\mathrel{\mathsf{S}}_n^{-1}(\overline{g'_n})$ . It is easily justified that $\mathrel{\mathsf{S}}_n^{-1}(\overline{g'_n})$ is maximal in $\mathcal{T}_n$ iff $\overline{g'_n}$ is in $\mathcal{T}'_n$ . Also, the set of paths $\{\overline{g'_n}\}_n$ is (maximally) compatible iff the set of paths $\{\mathrel{\mathsf{S}}_n^{-1}(\overline{g'_n})\}_n$ is. The definitions of fairness and deadlock depend only on the concepts of maximal path and of maximally compatible set of paths, hence the proposition.

8.3 Example: mutual exclusion (continued)

We apply now simulation to our mutual exclusion example from Section 2.2. For a reminder, these were the instructions we used in the specification of each of the trains:

The property isCrossing embodies all our model cares about in each train system, and it makes sense to perform abstraction based on it, so that all stages with the same value for that property get equated. In this case, equational abstraction would result in all stages except crossing being equationally reduced to one of them. Equivalently, we can perform predicate abstraction to get one state for the truth of isCrossing and another for its falsehood, producing the following:

The state true represents the former crossing, while false is the abstraction for all the other states. We call the two systems with this specification S-TRAIN1 and S-TRAIN2.

It is quite straightforward to see that the conditions in Definition 31 are met and these are indeed simulations. Because of Theorem 3, we can use this specification instead of the original one in composed systems and draw conclusions based on it.

Now we perform a three-way synchronous composition to build a new system that we call SAFE-TRAINS:

We want to show that mutual exclusion holds for the crossings, that is:

(1)

from which we can readily deduce the same formula holds for TRAIN1 and TRAIN2 and the same MUTEX. One way to prove (1) is to use our prototype implementation to perform the split on SAFE-TRAINS and then use Maude’s model checker. A more compositional way is also possible, which is shown later, in Section 9.2.

9 The assume/guarantee technique

The classical satisfaction relation between a system $\mathcal{S}$ and a temporal formula $\varphi$ , which we write $\mathcal{S}\models\varphi$ , considers the system as if run in isolation – as a non-interacting, closed system. For open systems, techniques have been devised to verify that a component satisfies a given specification in a suitable environment. Well-known among such techniques is assume/guarantee (Pnueli Reference Pnueli1985), A/G from now on. This section is devoted to discussing this technique and its adaptation to our setting for verifying rewrite systems.

Satisfaction, according to the A/G technique, involves two formulas: one stating what can be assumed from the environment; the other stating what one particular component is ready to guarantee based on the assumption and on its own internal behavior. The notation we are using is $\mathcal{S}\models\alpha\mathrel{\triangleright}\gamma$ (Elkader et al. Reference Elkader, Grumberg, Păsăreanu and Shoham2018) (or ${\mathcal{T}\!,\mathcal{A}}\models\alpha\mathrel{\triangleright}\gamma$ for transition structures, or $\mathcal{R}\models\alpha\mathrel{\triangleright}\gamma$ for rewrite systems), where $\alpha$ is the assumption and $\gamma$ the guarantee. Both are formulas expressed in the language of $\mathcal{S}$ . Thus, $\alpha$ speaks about the environment by means of the properties of $\mathcal{S}$ , some of which are to be synchronized with the ones of the environment.

The nave reading of $\mathcal{S}\models\alpha\mathrel{\triangleright}\gamma$ as “ $\mathcal{S}$ guarantees the satisfaction of $\gamma$ if placed in an environment that satisfies $\alpha$ ” is misleading. It is not really necessary that the environment satisfies $\alpha$ – it is the interaction that matters. For example, an environment that behaves according to the CCS expression $a.P\,|\,b.Q$ does not ensure the execution of a in general, but for some processes, like $a.P'\,|\,c.Q'$ , it does: the environments $a.P\,|\,b.Q$ and $a.P$ are equivalent for that process, they induce the same restrictions. More in general, it is not necessary that the environment satisfies $\alpha$ , but only that the interaction of the environment with the process does.

Moreover, the assumption $\alpha$ can sometimes be intuitively thought of as reflecting other convenient laws or facts, not always expected to be realized by an environment, like fairness assumptions, or the fact that time is strictly increasing in the case of timed systems (Abadi and Lamport Reference Abadi and Lamport1995). In those cases, the assumption would only involve properties not used for synchronization, so that it restricts the component and not the environment.

A definition of A/G satisfaction based on the intuitions in the previous paragraphs may consider execution paths in their fullness, that is, they may be ultimately based on assertions like “if some full execution path satisfies $\alpha$ , then it also satisfies $\gamma.$ ” This is unsuitable, however, because it allows that first a system fails to satisfy $\gamma$ and only later the environment fails to satisfy $\alpha$ . This is probably not what we have in mind when we think about A/G. Instead, we can choose an inductive definition (Misra and Chandy Reference Misra and Chandy1981; Jonsson and Yih-Kuen Reference Jonsson and Yih-Kuen1996), which could be stated in this way:

\[\textrm{if }\mathcal{S}\|_Y\mathcal{E}\models_i\alpha\textrm{, then }\mathcal{S}\models_{i+1}\gamma,\]

where $\models_i$ represents the satisfaction up to i steps away from the current state.

A posteriori, the two concepts, the full-path one and the inductive one, turn out to be equivalent, which reflects the fact that a system could only take advantage of the difference if it knew that the environment was going to fail to satisfy $\alpha$ in the future, which it cannot. Similar results are known in other settings (Kupferman and Vardi Reference Kupferman and Vardi2000, Theorem 5.1) (Abadi and Lamport Reference Abadi and Lamport1995, Section 5.1). We prove it now in our own setting. It is Theorem 4 below, but we need some considerations first.

For the same reasons that we avoid the next temporal operator, we prefer to avoid explicit references to steps. For, if we later refine that next step into a sequence of them, the reference to state $i+1$ turns out to be a moving one. The important concept here is that the partial path up to the present time is compatible with the satisfaction of the formula, that is, that some maximal path that extends the partial one satisfies $\alpha$ . We make this formal. The definition of when a path is a prefix (or initial segment) of another is the usual one, denoted by the symbol $<$ , with reflexive closure $\le$ .

Given that $\mathcal{T}$ and $\mathcal{A}$ are going to be fixed, we spare them when writing $\overline{g}\mathrel{|\hspace{-1.7mm}\approx}\varphi$ . Also, sometimes we write just $\overline{g}\models\varphi$ instead of the full ${\mathcal{T}\!,\mathcal{A}},\overline{g}\models\varphi$ .

According to this definition, if $\overline{g}$ is maximal, then $\overline{g}\mathrel{|\hspace{-1.7mm}\approx}\varphi$ iff $\overline{g}\models\varphi$ .

For a simple example, consider a finite path $g_0\dots g_k$ such that at each $g_i$ the value of a certain Boolean property p is true. And suppose there are two possible ways that path can be maximally extended: $g_0\dots g_k g_{k+1}\dots$ and $g_0\dots g_k g'_{k+1}\dots$ , with all unprimed stages still assigning true to p, but $g'_{k+1}$ assigning false. Then

and, therefore,

even though

Our definition of A/G satisfaction is somewhat involved, so we first give an intuitive explanation. Very informally, ${\mathcal{T}\!,\mathcal{A}}\models\alpha\mathrel{\triangleright}\gamma$ is a promise from $\mathcal{T}$ of not being the first to fail to perform its duties – if we see $\gamma$ as its duties and $\alpha$ as the environment’s. Consider this diagram, showing two paths running from left to right, starting at the initial stage $g_0$ .

At present, $\mathcal{T}$ and its environment have traversed together the path from $g_0$ to $g_1$ , and have done so in a way compatible with the satisfaction of $\alpha$ . The component $\mathcal{T}$ cannot know what the environment is going to do in the future; it may choose to go along the upper path, that is, to keep on being compatible with $\alpha$ . To ensure ${\mathcal{T}\!,\mathcal{A}}\models\alpha\mathrel{\triangleright}\gamma$ , the component $\mathcal{T}$ has to keep on being compatible with $\gamma$ at least a little longer than the environment, for instance, until $g_2$ .

In principle, the path that satisfies $\gamma$ needs not be the same one that satisfies $\alpha$ , as shown in the diagram above. However, compatibility has to be preserved up to stages $g_1$ arbitrarily far in the future. The result is that the two branches get zipped into one.

In a similar way, a path $\overline{q}$ in $\mathcal{T}\in{{\textsf{TrStr}}}$ is said to be allowed in $\mathcal{T}\|_Y\mathcal{E}$ , for $\mathcal{E}\in{{\textsf{TrStr}}}$ , if there is a path in $\mathcal{T}\|_Y\mathcal{E}$ whose projection on $\mathcal{T}$ is $\overline{q}$ .

Possibly the simplest alternative concept of A/G satisfaction is ${\mathcal{T}\!,\mathcal{A}}\models\alpha\mathrel{\rightarrow}\gamma$ (being $\mathrel{\rightarrow}$ classical implication); that is, each path that satisfies the assumption also satisfies the guarantee. Though our definition of satisfaction is much more complex than that, a posteriori both concepts turn out to be equivalent.

In the conditions of Definition 35,

\[{\mathcal{T}\!,\mathcal{A}}\models\alpha\mathrel{\triangleright}\gamma \quad\text{iff}\quad {\mathcal{T}\!,\mathcal{A}}\models\alpha\mathrel{\rightarrow}\gamma\]

and

\[\mathcal{R}\models\alpha\mathrel{\triangleright}\gamma \quad\text{iff}\quad \mathcal{R}\models\alpha\mathrel{\rightarrow}\gamma.\]

Now, assume ${\mathcal{T}\!,\mathcal{A}}\models\alpha\mathrel{\rightarrow}\gamma$ . Fix $\mathcal{E}$ and Z. Fix also a path $\overline{g}$ in $\mathcal{T}$ which is allowed in $\mathcal{T}\|_Z\mathcal{E}$ and is compatible with $\alpha$ : $\overline{g}\mathrel{|\hspace{-1.7mm}\approx}\alpha$ . If $\overline{g}$ happens to be maximal in $\mathcal{T}$ , then $\overline{g}\models\alpha$ and, because of the assumption, $\overline{g}\models\gamma$ . Otherwise, if $\overline{g}$ if not maximal in $\mathcal{T}$ , fix a path $\overline{g}'$ which is maximal in $\mathcal{T}$ , extends $\overline{g}$ and satisfies $\alpha$ . Because of the assumption, $\overline{g}'\models\gamma$ . We can take $\overline{g}''=\overline{g}'$ , and this completes the proof for atomic transition structures.

The same proof is almost verbatim valid for plain ones. And because satisfaction for composed structures is equivalent to the one for their splits, the result also holds for TrStr. Finally, because satisfaction for rewrite systems is defined based on their semantics, the result also holds for the three types of rewrite systems.

This is a most welcome result, because it means that we can use standard verification tools to perform compositional verification.

The particular case when $\alpha\equiv\texttt{true}$ is worth stating.

Corollary 1 (true assumption)

In the conditions of Definition 35,

\[{\mathcal{T}\!,\mathcal{A}}\models\mathtt{true}\mathrel{\triangleright}\gamma \quad\text{iff}\quad {\mathcal{T}\!,\mathcal{A}}\models\gamma\]

and

\[\mathcal{R}\models\mathtt{true}\mathrel{\triangleright}\gamma \quad\text{iff}\quad \mathcal{R}\models\gamma.\]

After having Theorem 4, in view of our convoluted definition for A/G satisfaction, and considering also how trivial some of our examples are (maybe specially the one on chained buffers in Section 9.1 below), it is legitimate to ask if it would not have been better to use just implication to characterize A/G to begin with. The answer, in our opinion, is no. The assertion $\mathcal{S}\models\alpha\to\gamma$ is about the internal behavior of $\mathcal{S}$ ; in contrast, $\mathcal{S}\models\alpha\rhd\gamma$ is an assertion about $\mathcal{S}$ ’s interaction with other systems. Their equivalence (in appropriate conditions) is a fortunate, a posteriori fact. Perhaps it could be likened to the equivalence between $\vdash\varphi\to\psi$ and $\varphi\vdash\psi$ in classical first-order logic.

We finish this section with the theorem which justifies the soundness of A/G.

Each of the conditions included in Condition 1a asks for an A/G statement to hold in a component. Often, a single A/G statement is asked from each component, that is, $\ell_n=1$ for some or all n. In particular, the statement that $\mathcal{R}_1\models\varphi$ implies $\mathcal{R}_1\|_Y\mathcal{E}\models\varphi$ , can be seen as the particular case where $n=2$ , $\ell_1=1$ , $\ell_2=0$ , $\mathcal{R}_2=\mathcal{E}$ , and $\alpha_{11}=\alpha=\texttt{true}$ .

This theorem allows to reduce the proof of an A/G statement on a composed system to similar proofs on smaller systems, plus checking the validity of an LTL formula. The word reduce in the previous sentence is questionable, because the number of tasks seems to have increased. In addition, obtaining the formulas needed in the premises is not always easy. (We will have something more to say about this in Section 11.3.) The positive side is that each statement has to be proved now in a smaller model. And that, once proved, each component can be reused with no need for new proofs.

We want to remark that Maude provides the tools needed for compositional verification using Theorem 5: the model checker can be used to verify $\mathcal{R}_1\models\alpha_{11}\mathrel{\rightarrow}\gamma_{11}$ and the other similar results, and the tautology checker can be used to check the validity of the final formula. Maude is not able to handle our properties, so the formulas must be transformed to use only Boolean propositions as discussed in Section 6.1.

Condition 1b holds for safety formulas, as shown in Proposition 15, or in the presence of fairness between components and absence of emerging deadlocks, as shown in Proposition 14. A case of interest is when the assumption $\alpha$ implies such fairness and deadlock freeness requirements. An instance of this is the following. In each $\mathcal{R}_n$ , there is a property $t_n$ defined so that it holds true at each transition and false at each state of $\mathcal{R}_n$ . In addition, the formula $\alpha$ includes as a conjunct (or implies otherwise) the formula $\varphi_n=\bigwedge_n(\Box\Diamond t_n=\texttt{true} \land \Box\Diamond t_n=\texttt{false})$, , which means that component $\mathcal{R}_n$ advances infinitely often, which implies by itself fairness between components and absence of emerging deadlocks. Those formulas $\varphi_n$ need not be appropriate for every case. With our definitions, terminating systems may be fair and still not satisfy $\varphi_n$ . In each case, more refined formulas may be better suited.

It may be worth noting, to avoid confusion, that $\mathcal{R}_n\models\varphi_n$ for all n does not entail fairness or deadlock freeness. The reason is that it may happen that $\mathcal{R}_n\models\varphi_n$ but $\mathcal{R}\not\models\varphi_n$ because, well, deadlocks or lack of fairness. Things are different when we use the $\varphi_n$ , not as guarantees, but as assumptions, which we did in the previous paragraph.

There is another way to verify a compositional specification, which is to split it into a monolithic one and use standard verification techniques on it. This works thanks to the following proposition.

Proposition 19 With the notational conventions used so far, for $\mathcal{R}_n$ egalitarian rewrite systems for $n=1,\dots,N$ , we have that

\[\|_Y\mathcal{R}_n\models\alpha\mathrel{\triangleright}\gamma \quad\text{iff}\quad \mathop{\mathrm{split}}(\|_Y\mathcal{R}_n)\models\alpha\mathrel{\triangleright}\gamma.\]

9.1 Example: chained buffers (continued)

This continues the example from Section 2.1. It is immediate to prove that each of the buffers satisfies $\texttt{BUFFER}n\models\Diamond\texttt{isReceiving}\to\Diamond \texttt{isSending}$ . Therefore, by Theorem 4, $\texttt{BUFFER}n\models\Diamond\texttt{isReceiving}\,{\triangleright}\,\Diamond \texttt{isSending}$ . We expect to be able to prove a similar behavior for the whole chain of buffers, 3BUFFERS, using Theorem 5. Concretely, in this case:

• $N=3$ ,

• $\mathcal{R}_n=\texttt{BUFFER}n$ ,

• $\ell_n=1$ ,

• 

• .

Regarding the conditions in Theorem 5: Condition 1a (that is, $\mathcal{R}_n\models\alpha_{n1}\mathrel{\triangleright}\gamma_{n1}$ for each n) has already been justified, and Condition 2 (implication for temporal formulas) is easily seen to hold. Fairness is ensured by the way the buffers synchronize, and we hope it is clear that no deadlocks can emerge, so also Condition 1b holds. From which we can deduce

The properties can be better seen here as properties of 3BUFFERS, and our extension to Maude’s syntax allows to define synonyms, so that the above can also be written as

9.2 Example: mutual exclusion (continued)

We finish now our discussion of the example from Sections 2.2 and 8.3. It is easy to prove, either by model checking or by mere inspection, that

Reasoning intuitively, we know that the same formula holds when MUTEX is made a component of SAFE-TRAINS. And, because the composition requires each isGranting property to be synchronized with the corresponding isCrossing, we deduce

Formally, we have used Theorem 5 with

• $N=3$ ,

• $\mathcal{R}_1=\texttt{S-TRAIN1}$ , $\mathcal{R}_2=\texttt{S-TRAIN2}$ , $\mathcal{R}_3=\texttt{MUTEX}$ ,

• $\ell_1=\ell_2=0$ , $\ell_3=1$ ,

• 

• 

Component fairness does not always hold, but the formulas involved are safety ones, which is enough according to Proposition 15.

It was observed before that the system MUTEX can be seen as a controller or strategy. The verification task is, in this case, of a different nature from the one in the previous example on chained buffers, in which the behavior of the compound necessarily results from the interactions between the components.