Rob van Glabbeek (Sydney)
Marc Voorhoeve (TUE) department of mathematics and computer science
1 of 21
Contents
1. Motivation
2. IF equivalence
3. Results department of mathematics and computer science
2 of 21
fair testing
Context
Why yet another equivalence relation?
IF
contrasim weak bisim weak+div trace failure ready simulation strong bisim department of mathematics and computer science
3 of 21
Motivation
System development: modelbased vs. requirementbased.
Combination often preferable.
Equivalence implementation
– model: branching/weak bisimilarity?
Advantages: compositional, preservation of any requirement.
Disadvantage: restrictive.
Nonbisim equivalence: compositional when congruence increases implementer’s freedom.
department of mathematics and computer science
4 of 21
Compositional verification f t nok ok f t t
c c
t
(
nok
.
f
.
t
) *
ok
.
c
c abstraction
{
ok
,
nok
}
(
t
(
nok
.
f
.
t
) *
ok
.
c
) reduction (contrasim) f t
(
t
.
f
) *
tc
department of mathematics and computer science
5 of 21
Too much freedom!
Processes
v,w
: failures/ready simulation equivalent!
s f
v
t f t
w
Legend: t: try c: connect f: fail s: stop visible
c
hidden
s f
u
s t
corrupted states
Corrupted state
u
: action
c
impossible.
u rea
chable from
w
not
v.
6 of 21 department of mathematics and computer science
Motivation (conclusion)
Nonbisim equivalences: more freedom for implementer.
Needed: knowledge about preservation of properties.
IF (impossible future) equivalence preserves AGEF properties.
department of mathematics and computer science
7 of 21
Contents
1. Motivation
2. IF Equivalence
3. Results
• Preliminary notions
• Definition
• Properties preserved
• Connection with liveness and fairness department of mathematics and computer science
8 of 21
Transition systems
Process: state in labeled transition system (LTS)
Legend: t: try c: connect f: fail s: stop
f
gsmspec
s
v
t c
gsmimpl
f t
w
s f s t
department of mathematics and computer science
9 of 21
Transition relations
Set
A
of visible actions:
Special hidden action
A
S a set (of states)
S
(
A
:
{
})
S
ternary transition relation
f v
= gsmspec
s f
v
t
c b d
c
e v
t c
,
f
f v
,
c
v
s b
.
f
, trace relation
S
A
*
S v
v
,
v
t f
,
v
t c
,
v
tfs b
.
10 of 21 department of mathematics and computer science
Impossible futures equivalence
IF: decorated trace
IF
(
p
) :
{(
,
B
) 
p
' :
p
p
' :
B
::
p
'
}
(
t
, {
fs
,
ft
})
IF
(
v
)
v
t d
d fs
d ft f
f
v
t s
c b d
c
(
t
, {
fs
,
c
})
IF
(
v
)
v
t d
d
c v
t c
c
c v
t f
f
fs e
IF equivalence: same IFs
p
IF q
IF
(
p
)
IF
(
q
) department of mathematics and computer science
Congruence with root condition:
ax
x
ay
y
IF
IF
x a
(
x
(
x
y
)
y
)
11 of 21
Properties preserved by IF
(
,
B
)
IF
(
p
)
p
' :
p
p
' : (
B
::
p
'
)
IF
(
p
) :
{(
,
B
) 
p
' :
p
p
' :
B
::
p
'
}
Having observed
, with a trace
from
B.
it is possible to continue mcalculus
:
B
T
CTL:
AG
EF (
B
)
(AGEF property)
Not IF preserved
(not AGEF):
(
T
T)
12 of 21 department of mathematics and computer science
Some AGEF properties
No deadlock/livelock:
Soundness:
T T
T *
√
Delivery (
d
) possible after order (
o
)
:
T *
o
T *
T *
d
T
Order that is not confirmed (
c
)
T * can be aborted (
a
):
o
(
c
)
*
T *
a
T
An order that can be confirmed, can be aborted
(at the same time):
T *
o
T *
(
c
T
a
T)
Not AGEF:
o b
o
(
c
a
))
IF o b
o
(
b
c
)
o
(
c
a
) department of mathematics and computer science
13 of 21
GSM example
Legend: t: try c: connect f: fail s: stop
f
v
t s f c
Corrupted state
u
: no connection possible.
Corrupted state reachable from
w
not
v
.
mcalculus predicates
(AGEF properties)
t
w
T
*
c
T
Paths terminating with
f
,
can
eventually do
c
f
s
testable
f
tc
T
Paths terminating with
f
,
can continue with
tc
nontestable
u
s t
14 of 21 department of mathematics and computer science
Liveness
Infinite
tf
sequence impossible:
CTL:
AG AF (
{
t
,
f
} *
(
c
m
X s
))
[
tf
]
X
Implies liveness combined with AGEF property
(fairness assumption)
Verify AGEF instead of liveness!
f
v
s t c f t
w
s f s t
department of mathematics and computer science
15 of 21
Contents
1. Motivation
2. IF Equivalence
3. Results
• Preservation
• Fair testing
• Proof method department of mathematics and computer science
16 of 21
Preservation results
1. IF congruence preserves all AGEF properties.
2. Any congruence preserving any nontestable AGEF property is at least as fine as IF.
3. Any congruence at least as coarse as weak bisim, satisfying RSP and preserving any nontrivial AGEF property is at least as fine as IF.
department of mathematics and computer science
17 of 21
Fair testing (FT)
FT preserves all testable AGEF properties and (assuming fairness) all AGAF properties
abx
aby
FT a
(
bx
by
) but different IF’s a
FT does not satisfy RSP: two processes satisfy
X
FT aX
ab
: a b a a a a b department of mathematics and computer science
18 of 21
Proof method
Suppose ~ is a congruence w.r.t. CCS composition and there exist
,B,p,q
with
p
~
q
such that
(
,
B
)
IF
(
p
) \
IF
(
q
)
Let
a
1
a n
,
A
act
(
p
)
act
(
q
), and set
C
(
X
)
(
X

U
0
) \
A
with
c
A
U i

1
U n
a i
U i
c
B c
(
(
c c
)
) ( 1
i
n
)
19 of 21 department of mathematics and computer science
Context C
(
,
B
)
IF
(
p
) \
IF
(
q
)
U
0
_ a
1
p
' :
p
p
' : (
B
::
p
'
_ a
2
_ a n
U n
c
)
C
(
X
)
(
X

U
0
) \
A
c
_
i
C
(
p
)
(
p
'
U n
) \
A cc
(
p
C
(
q
'
U n
)
)
\
(
A q
'
U n
) \
A
cc
c
(
, {
cc
})
IF
(
C
(
p
)) \
IF
(
C
(
q
))
20 of 21 department of mathematics and computer science
Conclusions
1. Many system safety and liveness properties are of AGEF kind.
AGAF liveness: AGEF + fairness
.
2. IF and FT: compositional verification of AGEF properties.
3. FT: only testable AGEF properties,
RSP cannot be used.
Thank you for your attention department of mathematics and computer science
21 of 21
Composition
Systems built from components a
(
C
1
C
1

C
2
(
D
1


C
3
)
D
2
)
\ {
d
,
e
}
\ {
f
}
_ e
C3 d e
_ e
_ d
D1
C1
D2
_ d
_ b
_ d
C2
D1 f
_ f
D2 department of mathematics and computer science c c
22 of 21
Verification b
Verify property, e.g.:
b
may eventually occur after
a
T *
b
T a
Possible: prove e.g.
{
c
}
(
S
)
w a
*
ab
Advantage: compositionality.
Simplify components
Disadvantage: cumbersome, restrictive.
Alternative:
Nonbisim equivalence that is congruence w.r.t. composition and preserves requirements!
c
23 of 21 department of mathematics and computer science