11/19/20151 Metodi formali nello sviluppo software a.a.2013/2014 Prof.Anna Labella

11/19/ CCS: Calculus of communicating processes Main issues: How to specify concurrent processes in an abstract way? Which are the basic relations between concurrency and non-determinism? Which basic methods of construction (= operators) are needed? When do two processes behave differently? When do they behave the same? Rules of calculation: –Replacing equals for equals –Substitutivity –R. Milner, A Calculus of Communicating Systems. LNCS 92 (1980).

3 CCS Language for describing communicating transition systems Behaviours as algebraic terms Calculus: Centered on observational equivalence Elegant mathematical treatment Emphasis on process structure and modularity Recent extensions to security and mobile systems CSP - Hoare: Communicating Sequential Processes (85) ACP - Bergstra and Klop: Algebra of Communicating Processes (85) CCS - Milner: Communication and Concurrency (89) Pi-calculus – Milner (99), Sangiorgi and Walker (01) SPI-calculus – Abadi and Gordon (99) Many recent successor for security and mobility (more in 2G1517)

4 CCS - Combinators The idea: 7 elementary ways of producing or putting together labelled transition systems Pure CCS: Turing complete – can express any Turing computable function Value-passing CCS: Additional operators for value passing Definable Convenient for applications Here only a taster

5 Actions Names a,b,c,d,... Co-names: a,b,c,d,... –Sorry: Overbar not good in texpoint! –a = a In CCS, names and co-names synchronize Labels l: Names [ co-names  2 Actions =  = Labels [ {  } Define  by: – l = l, and –  = 

6 CCS Combinators, II Nil0No transitions Prefix .Pin.out.0  in out.0  out 0 DefinitionA == PBuffer == in.out.Buffer Buffer  in out.Buffer  out Buffer inout in out

7 CCS Combinators, Choice Choice P + QBadBuf == in.( .0 + out.BadBuf) BadBuf  in .0 + out.BadBuf   0or  out BadBuf Obs: No priorities between  ’s, a’s or a’s CCS doesn’t ”know” which labels represent input, and which output May use  notation:  i2{1,2}  i.P i =  1.P 1 +  2.P 2 in out 

8 Example: Boolean Buffer 2-place Boolean Buffer Buf 2 : Empty 2-place buffer Buf 2 0 : 2-place buffer holding a 0 Buf 2 1 : Do. holding a 1 Buf 2 00 : Do. Holding etc.... Buf 2 == in 0.Buf in 1.Buf 2 1 Buf 2 0 == out 0.Buf 2 + in 0.Buf in 1.Buf 2 01 Buf 2 1 ==... Buf 2 00 == out 0.Buf 2 0 Buf 2 01 == out 0.Buf 2 1 Buf 2 10 ==... Buf 2 11 ==...

9 Example: Scheduler a i : start task i b i : stop task i Requirements: 1. a 1,...,a n to occur cyclically 2. a i /b i to occur alternately beginning with a i 3. Any a i /b i to be schedulable at any time, provided 1 and 2 not violated Let X  {1,...,n} Sched i,X : i to be scheduled X pending completion Scheduler == Sched 1,  Sched i,X ==  j  X b j.Sched i,X-{j}, if i  X ==  j  X b j.Sched i,X-{j} + a i.Sched i+1,X  {i}, if i  X

10 Example: Counter Basic example of infinite-state system Count == Count 0 Count 0 == zero.Count 0 + inc.Count 1 Count i+1 == inc.Count i+2 + dec.Count i Can do stacks and queues equally easy – try it!

11 CCS Combinators, Composition Composition P | QBuf 1 == in.comm.Buf 1 Buf 2 == comm.out.Buf 2 Buf 1 | Buf 2  in comm.Buf 1 | Buf 2   Buf 1 | out.Buf 2  out Buf 1 | Buf 2 But also, for instance: Buf 1 | Buf 2  comm Buf 1 | out.Buf 2  out Buf 1 | Buf 2

12 Composition, Example Buf 1 == in.comm.Buf 1 Buf 2 == comm.out.Buf 2 Buf 1 | Buf 2 : Buf 1 |Buf 2 comm.Buf 1 |Buf 2 comm.Buf 1 |out.Buf 2 Buf 1 |out.Buf 2 in comm out comm out in comm 

13 CCS Combinators, Restriction Restriction P LBuf 1 == in.comm.Buf 1 Buf 2 == comm.out.Buf 2 (Buf 1 | Buf 2 ) {comm}  in comm.Buf 1 | Buf 2   Buf 1 | out.Buf 2  out Buf 1 | Buf 2 But not: (Buf 1 | Buf 2 ) {comm}  comm Buf 1 | out.Buf 2  out Buf 1 | Buf 2

14 CCS Combinators, Relabelling Relabelling P[f]Buf == in.out.Buf 1 Buf 1 == Buf[comm/out] = in.comm.Buf 1 Buf 2 == Buf[comm/in] = comm.out.Buf 2 Relabelling function f must preserve complements: f(a) = f(a) And  : f(  ) =  Relabelling function often given by name substitution as above

15 Example: 2-way Buffers 1-place 2-way buffer: Buf ab == a +.b -.Buf ab + b +.a -.Buf ab Flow graph: LTS: Buf bc == Buf ab [c + /b +,c - /b -,b - /a +,b + /a - ] (Obs: Simultaneous substitution!) Sys = (Buf ab | Buf bc )\{b +,b - } Intention: What went wrong? a+a+ a-a- b-b- b+b+ Buf ab b -.Buf ab a -.Buf ab a+a+ b+b+ b-b- a-a- a+a+ a-a- b-b- b+b+ b-b- b+b+ c+c+ c-c-

16 Transition Semantics To apply observational equivalence need a formalised semantics Each CCS expression -> state in LTS derived from that expression Compositionality: Construction of LTS follows expression syntax Inference rules: P 1   P 2 P 1 | Q   P 2 | Q Meaning: For all P 1, P 2, Q, , if there is an  transition from P 1 to P 2 then there is an  transition from P 1 | Q to P 2 | Q

17 P   P’ P / L   P’ / L CCS Transition Rules (no rule for 0!) - .P   P Prefix Def P   Q A   Q (A == P) Choice L P   P’ P+Q   P’ Choice L Q   Q’ P+Q   Q’ Com L P   P’ P|Q   P’|Q Com R Q   Q’ P|Q   P|Q’ Com P  l P’ Q  l Q’ P|Q   P’|Q’ Restr ( ,   L) Rel P   P’ P[f]  f(  P’[f]

18 CCS Transition Rules, II Closure assumption: !  is least relation closed under the set of rules Example derivation: Buf 1 == in.comm.Buf 1 Buf 2 == comm.out.Buf 2 (Buf 1 | Buf 2 )/ {comm}  in comm.Buf 1 | Buf 2   Buf 1 | out.Buf 2  out Buf 1 | Buf 2

19 Example: Semaphores Semaphore: Unary semaphore: S 1 == p.S 1 1 S 1 1 == v.S 1 Binary semaphore: S 2 == p.S 2 1 S 2 1 == p.S v.S 2 S 2 2 == v.S 2 1 Result: S 1 | S 1  S 2 Proof: Show that {(S 1 | S 1, S 2 ), (S 1 1 | S 1, S 2 1 ), (S 1 | S 1 1, S 2 1 ), (S 1 1 | S 1 1, S 2 2 )} is a strong bisimulation relation pv

20 Example: Simple Protocol Spec == in.out.Spec Sender == in.Transmit Transmit == transmit.WaitAck WaitAck == ack +.Sender + ack -.Transmit Receiver == transmit.Analyze Analyze == .out.ack +.Receiver + .ack -.Receiver Protocol == (Sender | Receiver)/{transmit,ack +,ack - } Exercise: Prove Spec  Protocol

21 Example: Jobshop i E : input of easy job i N : input of neutral job i D : input of difficult job O: output of finished product A == i E.A’ + i N.A’ + i D.A’ A’ == o.A Spec = A | A Hammer: H == gh.ph.H Mallet: M == gm.pm.M Jobber: J ==  x  {E,N,D} i x.J x J E == o.J J N == gh.ph.J E + gm.pm.J E J D == gh.ph.J E Jobshop == (J | J | H | M)/{gh,ph,gm,pm} Theorem: Spec  Jobshop Exercise: Prove this.

11/19/