department of mathematics and computer science 1 of 21 Rob van Glabbeek (Sydney) Marc Voorhoeve (TUE) Liveness, Fairness and Impossible Futures

department of mathematics and computer science 2 of 21 1.Motivation 2.IF equivalence 3.Results Contents

department of mathematics and computer science 3 of 21 Context Why yet another equivalence relation? trace fair testing IF contrasim weak bisim strong bisim failureready simulation weak+div

department of mathematics and computer science 4 of 21 Motivation System development: model-based vs. requirement-based. Combination often preferable. Non-bisim equivalence: compositional when congruence increases implementer’s freedom. Equivalence implementation – model: branching/weak bisimilarity? Advantages: compositional, preservation of any requirement. Disadvantage: restrictive.

department of mathematics and computer science 5 of 21 Compositional verification abstraction reduction (contrasim)

department of mathematics and computer science 6 of 21 Too much freedom! vw Processes v,w : failures/ready simulation equivalent! Corrupted state u : action c impossible. u reachable from w not v. u Legend: t: try c: connect f: fail s: stop corrupted states hidden visible 

department of mathematics and computer science 7 of 21 Motivation (conclusion) Non-bisim equivalences: more freedom for implementer. Needed: knowledge about preservation of properties. IF (impossible future) equivalence preserves AGEF properties.

department of mathematics and computer science 8 of 21 1.Motivation 2.IF Equivalence 3.Results Contents Preliminary notions Definition Properties preserved Connection with liveness and fairness

department of mathematics and computer science 9 of 21 Transition systems gsmspecgsmimpl Legend: t: try c: connect f: fail s: stop Process: state in labeled transition system (LTS) vw

department of mathematics and computer science 10 of 21 LTS: pair, S a set (of states) : ternary transition relation v = gsmspec Set A of visible actions: Special hidden action Transition relations trace relation

department of mathematics and computer science 11 of 21 Impossible futures equivalence IF: decorated trace IF equivalence: same IFs Congruence with root condition:

department of mathematics and computer science 12 of 21 Properties preserved by IF Having observed  it is possible to continue with a trace  from B.  calculus : CTL: (AGEF property) Not IF preserved (not AGEF):

department of mathematics and computer science 13 of 21 Some AGEF properties No deadlock/livelock: Soundness: √ Delivery ( d) possible after order ( o) : Order that is not confirmed ( c) can be aborted ( a): An order that can be confirmed, can be aborted (at the same time): Not AGEF:

department of mathematics and computer science 14 of 21 Legend: t: try c: connect f: fail s: stop GSM example vw Corrupted state u : no connection possible. Corrupted state reachable from w not v. (AGEF properties) f  calculus predicates Paths terminating with f, can continue with tc Paths terminating with f, can eventually do c u testable non-testable

department of mathematics and computer science 15 of 21 Liveness Infinite tf- sequence impossible: vw CTL: Verify AGEF instead of liveness! Implies liveness combined with AGEF property (fairness assumption)

department of mathematics and computer science 16 of 21 1.Motivation 2.IF Equivalence 3.Results Contents Preservation Fair testing Proof method

department of mathematics and computer science 17 of 21 Preservation results 1.IF congruence preserves all AGEF properties. 2.Any congruence preserving any non-testable AGEF property is at least as fine as IF. 3.Any congruence at least as coarse as weak bisim, satisfying RSP and preserving any nontrivial AGEF property is at least as fine as IF.

department of mathematics and computer science 18 of 21 Fair testing (FT) FT preserves all testable AGEF properties and (assuming fairness) all AGAF properties but different IF’s FT does not satisfy RSP: two processes satisfy

department of mathematics and computer science 19 of 21 Proof method Suppose ~ is a congruence w.r.t. CCS composition and there exist ,B,p,q with p ~ q such that Let and setwith

department of mathematics and computer science 20 of 21 Context C    i

department of mathematics and computer science 21 of 21 Conclusions 1.Many system safety and liveness properties are of AGEF kind. AGAF liveness: AGEF + fairness. 2.IF and FT: compositional verification of AGEF properties. 3.FT: only testable AGEF properties, RSP cannot be used. Thank you for your attention

department of mathematics and computer science 22 of 21 C1 Composition Systems built from components

department of mathematics and computer science 23 of 21 Verification a b c Possible: prove e.g. Disadvantage: cumbersome, restrictive. Alternative: Non-bisim equivalence that is congruence w.r.t. composition and preserves requirements! Advantage: compositionality. Verify property, e.g.: b may eventually occur after a Simplify components