Translating between models of concurrency

TL;DR

This paper introduces a method to transform refinement questions across various finite observational models of CSP into trace refinement tests using a priority operator, enhancing practical verification tools.

Contribution

It generalizes the use of the priority operator to any rational finite observational model, enabling broader refinement checking capabilities in tools like FDR4.

Findings

Transform refinement questions into trace refinement tests

Generalize to any rational finite observational model

Enable practical refinement checking in Timed CSP

Abstract

Hoare's Communicating Sequential Processes (CSP) admits a rich universe of semantic models closely related to the van Glabbeek spectrum. In this paper we study finite observational models, of which at least six have been identified for CSP, namely traces, stable failures, revivals, acceptances, refusal testing and finite linear observations. We show how to use the recently-introduced \emph{priority} operator to transform refinement questions in these models into trace refinement (language inclusion) tests. Furthermore, we are able to generalise this to any (rational) finite observational model. As well as being of theoretical interest, this is of practical significance since the state-of-the-art refinement checking tool FDR4 currently only supports two such models. In particular we study how it is possible to check refinement in a discrete version of the Timed Failures model that supports Timed CSP.

Tables

Table 1. Table 1: Tests distinguishing levels of the model precision heir achy. △ △ \triangle is the interrupt operator; see [ 21 ] for details.

Specification	Implementation	Passes	Fails
$a\to \mathrm{𝐝𝐢𝐯}$	$a\to \mathrm{𝑆𝑇𝑂𝑃}$	$𝒯$	$ℱ$
$\left(\left(a\to \mathrm{𝐝𝐢𝐯}\right)\square \mathrm{𝐝𝐢𝐯}\right)\sqcap \mathrm{𝑆𝑇𝑂𝑃}$	$a\to \mathrm{𝐝𝐢𝐯}$	$ℱ$	$ℛ$
$\left(a\to \mathrm{𝐝𝐢𝐯}\right)\sqcap \left(\mathrm{𝐝𝐢𝐯}△\left(a\to \mathrm{𝑆𝑇𝑂𝑃}\right)\right)$	$a\to \mathrm{𝑆𝑇𝑂𝑃}$	$ℛ,𝒜$	$ℛ𝒯,ℱℒ$
$\left(a\to \mathrm{𝑆𝑇𝑂𝑃}\right)\sqcap \left(b\to \mathrm{𝑆𝑇𝑂𝑃}\right)$	$\left(a\to \mathrm{𝑆𝑇𝑂𝑃}\right)\square \left(b\to \mathrm{𝑆𝑇𝑂𝑃}\right)$	$ℛ,ℛ𝒯$	$𝒜,ℱℒ$

Table 2. Table 2: Experimental results comparing the performance of our construction with FDR3’s inbuilt failures refinement check. | S | 𝑆 |S| is the number of states, | Δ | Δ |\Delta| is the number of transitions, T 𝑇 T is the time (in seconds), all state and transition counts are in millions.

	Inbuilt $ℱ$			CF			CF’			FL
File	$\left|S\right|$	$\left|\Delta \right|$	$T\left(s\right)$	$\left|S\right|$	$\left|\Delta \right|$	$T\left(s\right)$	$\left|S\right|$	$\left|\Delta \right|$	$T\left(s\right)$	$\left|S\right|$	$\left|\Delta \right|$	$T\left(s\right)$
inv	21	220	23	21	220	78	21	220	125	21	220	145
nspk	6.9	121	22	6.3	114	73	4.1	72	55	5.4	97M	92
swp	24	57	16	30	123	61	43	76	107	42	93	131

Equations

$${RUN}_X={\text{vbox}\square }_{x\in X}x\to {RUN}_X$$

$$\frac{P\stackrel{a}{\text{relbar}\text{joinrel}\to }{P}^{\prime }\wedge \forall b\ne a.a\le b\Rightarrow b\notin initials(P)}{\mathbf{prioritise}(P,\le ,X)\stackrel{a}{\text{relbar}\text{joinrel}\to }\mathbf{prioritise}(P^{\prime },\le ,X)}(a\in \Sigma \cup \{\tau \}).$$

$${\mathcal{C}}_1[P]=\mathbf{prioritise}(P\text{mathchar}618\text{mathchar}618\text{mathchar}618{RUN}_{{\Sigma }^{\prime }\cup \{stab\}},{\le }_1,\Sigma ).$$

$$\begin{array}[]{rl}\mathit{UNSTABLE}=&\mathop{\mathop{\vbox{\hbox{\Large$\mathstrut{{\Box}}$}}}\nolimits}\nolimits_{x\in\Sigma}x\mathrel{\rightarrow}\mathit{UNSTABLE}\\ \mathrel{{\Box}}&\mathop{\mathop{\vbox{\hbox{\Large$\mathstrut{{\Box}}$}}}\nolimits}\nolimits_{x\in\Sigma^{\prime}\cup\{\mathit{stab}\}}x\mathrel{\rightarrow}\mathit{STABLE}\\ \mathit{STABLE}=&\mathop{\mathop{\vbox{\hbox{\Large$\mathstrut{{\Box}}$}}}\nolimits}\nolimits_{x\in\Sigma^{\prime}\cup\{\mathit{stab}\}}x\mathrel{\rightarrow}\mathit{STABLE},\end{array}$$

$$\mathcal{C}[P]={\mathcal{C}}_1[P]\underset{\Sigma \cup {\Sigma }^{\prime }\cup \{stab\}}{\Vert }UNSTABLE.$$

$$\mathcal{C}(P)=\mathcal{C}(P\text{mathchar}24635term\to SKIP)\text{mathchar}622term$$

$${\mathcal{F}\mathcal{L}}_{\Sigma }:=\{⟨A_0,a_1,A_1,\dots ,A_{n-1},a_n,A_n⟩:n\in \mathbb{N},a_i\in \Sigma ,A_i\subseteq \Sigma \mathtt{or}{A}_i=\text{mathchar}527\},$$

$$\mathcal{F}\mathcal{L}(P\square Q):=\left\{⟨A\cup B⟩\text{mbox}\text{textasciicircum}\alpha ,⟨A\cup B⟩\text{mbox}\text{textasciicircum}\beta :⟨A⟩\text{mbox}\text{textasciicircum}\alpha \in \mathcal{F}\mathcal{L}(P),⟨B⟩\text{mbox}\text{textasciicircum}\beta \in \mathcal{F}\mathcal{L}(Q)\right\}$$

$$\begin{array}[]{c}\{\langle A_{0},b_{1},A_{1},\ldots,A_{n-1},b_{n},A_{n}\rangle\mid\langle Z_{0},b_{1},Z_{1},\ldots,Z_{n-1},b_{n},Z_{n}\rangle\in P\}\\ \cup\\ \{\langle A_{0},b_{1},A_{1},\ldots,A_{n-1},b_{n},\bullet,\tick\rangle\mid\langle Z_{0},b_{1},Z_{1},\ldots,Z_{n-1},b_{n},\bullet,\tick\rangle\in P\}\end{array}$$

$${\mathcal{M}}_{\Sigma }(P):={\mathcal{M}}_{\Sigma }({\mathcal{F}\mathcal{L}}_{\Sigma }(P))=\{y\in {\mathrm{obs}}_{\Sigma }(\mathcal{M}):\exists x\in {\mathcal{F}\mathcal{L}}_{\Sigma }(P).(x,y)\in {\mathcal{M}}_{\Sigma }\}.$$

$$\mathcal{M}\left(⨁(P_i{)}_{i=1\dots k}\right)=\mathcal{M}\left(⨁(Q_i{)}_{i=1\dots k}\right).$$

$$⨁(X_i{)}_{i=1\dots k}=\mathcal{M}\left(⨁(P_i{)}_{i=1\dots k}\right).$$

$${\mathrm{obs}}_{\Sigma }(\mathcal{T})={\Sigma }^{\ast },{\mathcal{T}}_{\Sigma }={trace}_{\Sigma }$$

$${\mathrm{obs}}_{\Sigma }(\mathcal{F})={\Sigma }^{\ast }\times (\mathcal{P}(\Sigma )\cup \{\text{mathchar}527\}),{\mathcal{F}}_{\Sigma }={fail}_{\Sigma },$$

$${\mathrm{obs}}_{\Sigma }(\mathcal{R})={\Sigma }^{\ast }\times (\mathcal{P}(\Sigma )\cup \{\text{mathchar}527\})\times (\Sigma \cup \{\text{mathchar}527\}),{\mathcal{R}}_{\Sigma }={rev}_{\Sigma }),$$

$${\mathrm{obs}}_{\Sigma }(\mathcal{A})={\Sigma }^{\ast }\times (\mathcal{P}(\Sigma )\cup \{\text{mathchar}527\}),{\mathcal{A}}_{\Sigma }={acc}_{\Sigma },$$

$${\mathrm{obs}}_{\Sigma }(\mathcal{R}\mathcal{T})=\{⟨X_0,a_1,X_1,\dots ,a_n,X_n⟩:n\in \mathbb{N},a_i\in \Sigma ,X_i\subseteq \Sigma \mathtt{or}{X}_i=\text{mathchar}527\}$$

$${\mathcal{R}\mathcal{T}}_{\Sigma }={rt}_{\Sigma },$$

$${\mathcal{C}}_1[X]=\mathbf{prioritise}(X\text{mathchar}618\text{mathchar}618\text{mathchar}618{RUN}_{{\Sigma }^{\prime }},{\le }_1,\Sigma ).$$

$${\mathcal{C}}_2[X]=\mathbf{prioritise}({\mathcal{C}}_1[X]\text{mathchar}618\text{mathchar}618\text{mathchar}618{RUN}_{{\Sigma }^{\prime \prime }},{\le }_2,\Sigma ).$$

$$\begin{array}[]{rl}\mathit{UNSTABLE}&=\mathop{\mathop{\vbox{\hbox{\Large$\mathstrut{{\Box}}$}}}\nolimits}\nolimits_{x\in\Sigma}x\mathrel{\rightarrow}\mathit{UNSTABLE}\\ &\qquad\mathrel{{\Box}}a^{\prime}\mathrel{\rightarrow}\mathit{STABLE}(a)\mathrel{{\Box}}a^{\prime\prime}\mathrel{\rightarrow}\mathit{STABLE}(a)\\ \mathit{STABLE}(x)&=x^{\prime}\mathrel{\rightarrow}\mathit{STABLE}({\tt succ}x)\mathrel{{\Box}}x^{\prime\prime}\mathrel{\rightarrow}\mathit{STABLE}({\tt succ}x)\qquad(x\neq z)\\ \mathit{STABLE}(z)&=\mathit{done}\mathrel{\rightarrow}\mathit{UNSTABLE},\end{array}$$

$${\mathcal{C}}_{\mathcal{F}\mathcal{L}}[X]=\left({\mathcal{C}}_2[X]\underset{\Sigma \cup {\Sigma }^{\prime }\cup {\Sigma }^{\prime \prime }}{\Vert }UNSTABLE\right)\text{mathchar}622{\Sigma }^{\prime }.$$

$${\omega }_3=⟨x^{\prime \prime }<y^{\prime \prime }:y{<}_{\alpha }x⟩\cup ⟨done<x^{\prime \prime }:x\in \Sigma ⟩,$$

$${\mathcal{C}}_3[X]=\mathbf{prioritise}({\mathcal{C}}_2[X]\text{mathchar}618\text{mathchar}618\text{mathchar}618{RUN}_{done},{\omega }_3,\Sigma ).$$

$$\begin{array}[]{rl}DREG&=\left(\mathop{\mathop{\vbox{\hbox{\Large$\mathstrut{{\Box}}$}}}\nolimits}\nolimits_{x\in\Sigma}x\mathrel{\rightarrow}DREG\right)\mathrel{{\Box}}\left(\mathop{\mathop{\vbox{\hbox{\Large$\mathstrut{{\Box}}$}}}\nolimits}\nolimits_{x\in\Sigma}x^{\prime\prime}\mathrel{\rightarrow}DREG^{\prime}\right)\\ DREG^{\prime}&=\left(\mathop{\mathop{\vbox{\hbox{\Large$\mathstrut{{\Box}}$}}}\nolimits}\nolimits_{x\in\Sigma}x^{\prime\prime}\mathrel{\rightarrow}DREG^{\prime}\right)\mathrel{{\Box}}\mathit{done}\mathrel{\rightarrow}DREG,\end{array}$$

$${\mathcal{C}}_{\mathcal{F}\mathcal{L}}[X]={\mathcal{C}}_3[X]\underset{\Sigma \cup {\Sigma }^{\prime \prime }\cup \{done\}}{\Vert }DREG.$$

$$\begin{array}[]{rl}\pi(s\mbox{\textasciicircum}\langle\mathrel{\mathchar 527\relax}\rangle)&=\pi(s)\\ \pi(s\mbox{\textasciicircum}\langle x\rangle)&=\pi(s)\mbox{\textasciicircum}\langle x\rangle\\ \pi(s\mbox{\textasciicircum}\langle A&=\{x_{1},\ldots,x_{k}\}\rangle)=\pi(s)\mbox{\textasciicircum}\langle x_{1}^{\prime\prime}\ldots x_{k}^{\prime\prime}\mathit{done}\rangle,\end{array}$$

$${\mathcal{C}}_1[X]={\mathcal{C}}_{\mathcal{F}\mathcal{L}}[X]\mathrm{left}.x.$$

$${\mathcal{C}}_2[X]=\left(\left({\mathcal{C}}_1[X]\underset{\{|\mathrm{left}|\}}{\Vert }{P}_{\mathcal{A}}\right)\text{mathchar}622\{|\mathrm{left}|\}\right)x.$$

$${\mathcal{C}}^{\prime \prime }(P)=(\mathbf{prioritise}(\mathcal{C}(P),{\le }^{\prime \prime },\Sigma \cup {\Sigma }^{\prime })\underset{\Sigma \cup {\Sigma }^{\prime }\cup {\Sigma }^{\prime \prime }\cup \{stab\}}{\Vert }Re{g}^{\prime \prime }$$

Full text

1 Introduction

In this paper we re-examine part of the Linear-Time spectrum that forms part of the field of study of van Glabbeek in [31, 30], specifically the part characterised by finite linear observations.

A number of different forms of process calculus have been developed for the modeling of concurrent programs, including Hoare’s Communicating Sequential Processes (CSP) [8], Milner’s Calculus of Communicating Systems (CCS) [12], and the $\pi$-calculus [13]. Unlike the latter two, CSP’s semantics are traditionally given in behavioural semantic models coarser than bisimulation, normally ones that depend on linear observations only. Thus, while the immediate range of options possible from a state can be observed, only one of them can be followed in a linear observation and so branching behaviour is not recorded.

In this paper, we study finite111Models that use a mixture of finite and infinite linear behaviours are also frequently used, the latter involving, inter alia, divergences and infinite traces. linear-time observational models for CSP; that is, models where all observations considered can be determined in a finite time by an experimenter who can see the visible events a process communicates and the sets of events it can offer in any stable state. While the experimenter can run the process arbitrarily often, he or she can only record the results of individual finite executions. Thus each behaviour recorded can be deduced from a single finite sequence of events and the visible events that link them, together with the sets of events accepted in stable states during and immediately after this trace. The representation in the model is determined purely by the sent of these linear behaviours that it is possible to observe of the process being examined.

At least six such models have been actively considered for CSP, but the state-of-the art refinement checking tool, FDR4 [5, 6]222See https://www.cs.ox.ac.uk/projects/fdr/. At the time of writing there is no major academic paper as a source for FDR4 as opposed to its predecessor FDR3., currently only supports two, namely traces and * stable failures*333The word stable here emphasises that the refusal components of failures are only recorded in stable (namely $\tau$-free) states. This distinguishes it both from other models where failures are recorded for other reasons: van Glabbeek (private correspondence) argues that there is in fact an unstable failures model (though anything but finite observation), citing [3] as evidence, and several versions have included failures on divergent traces or because of divergence-strictness. We emphasise that all of the models considered in this paper only observe acceptances and refusals in stable states.. FDR4 also supports the (divergence-strict) failures-divergences model, which is not finite observational.

The question we address in this paper supposes that we have an automated proof tool such as FDR that answers questions about how a process is represented in model A, and asks under what circumstances it is possible to answer questions posed in model B, especially the core property of refinement.

It seems intuitive that if model A records more details than model B, then by looking carefully at how A codes the details recorded in B, the above ought to be possible. We will later see some techniques for achieving this. However it does not intuitively seem likely that we can do the reverse. Surprisingly, however, we find it can be done by the use of process operators for which the coarser model B is not compositional. Sometimes we can use such operators to transform observable features of behaviour that B does not see into ones that it does.

The operator we choose in the world of CSP is the relatively new priority operator. While simple to define in operational semantics, this is only compositional over the finest possible finite-linear-obseration model of CSP. Priority is not part of “standard” CSP, but is implemented in the model checker FDR4 and greatly extends the expressive power of the notation.

We present first a construction which produces a context $\mathcal{C}$ such that refinement questions in the well-known stable failures model correspond to trace refinement questions under the application of $\mathcal{C}$. We then generalise this to show (Theorem 1) that a similar construction is possible not only for the six models which have been studied, but also for any sensible finite observational model (where ‘sensible’ means that the model can be recognised by a finite-memory computer, in a sense which we shall make precise). In fact we can seemingly handle any equivalence determined in a compact way by finitary observations, even though not a congruence.

We first briefly describe the language of CSP. We next give an informal description of our construction for the stable failures model. To prove the result in full generality, we first give a formal definition of a finite observational model, and of the notion of rationality. We then describe our general construction. In a case study we consider the discrete version of the Timed Failures model of Timed CSP, a closely related notation which already depends on priority thanks to its need to enforce the principle of maximal progress. For that we show not only how model shifting can obtain exactly what is needed but also show how Timed Failures checking can be reduced to its relative Refusal Testing. Finally we discuss performance and optimisation issues.

The present paper is a revised and extended version of [11], with the main additions being the study of Timed CSP and the model translation options available there, plus a description of how to include CSP termination .

2 The CSP language

We provide a brief outline of the language, largely taken from [20]; the reader is encouraged to consult [21] for a more comprehensive treatment.

Throughout, $\Sigma$ is taken to be a finite nonempty set of communications that are visible and can only happen when the observing environment permits via handshaken communication. The actions of every process are taken from $\Sigma\cup\{\tau\}$, where $\tau$ is the invisible internal action that cannot be prevented by the environment. We extend this to $\Sigma\cup\{\tau,\tick\}$ if we want the language to allow the successful termination process $\mathord{{\it SKIP}}$ and sequential compositions as described below. is different from other events, because it is observable but not controllable: in that sense it is between a regular $\Sigma$ event and $\tau$. It only ever appears at the end of traces and from a state which has refusal set $\Sigma$ and acceptance set $\{\tick\}$, although that state is not stable in the usual sense. It thus complicates matters a little so the reader might prefer to ignore it when first studying this paper. We will later contemplate a second event with special semantics: $tock$ signifying the passage of time.

The constant processes of our core version of CSP are:

• •

$\mathord{{\it STOP}}$ which does nothing—a representation of deadlock.

• •

$\mathord{{\bf div}}$ which performs (only) an infinite sequence of internal $\tau$ actions—a representation of divergence or livelock.

• •

$\mathord{{\it CHAOS}}$ which can do anything except diverge, though this absence of divergence is unimportant when studying finite behaviour models.

• •

$\mathord{{\it SKIP}}$ which terminates successfully.

The prefixing operator introduces communication:

• •

$a\mathrel{\rightarrow}P$ communicates the event $a$ before behaving like $P$.

There are two main forms of binary choice between a pair of processes:

• •

$P\mathrel{\mathchar 629\relax}Q$ lets the process decide to behave like $P$ or like $Q$: this is nondeterministic or internal choice.

• •

$P\mathrel{{\Box}}Q$ offers the environment the choice between the initial $\Sigma$-events of $P$ and $Q$. If the one selected is unambiguous then it continues to behave like the one chosen; if it is an initial event of both then the subsequent behaviour is nondeterministic. The occurence of $\tau$ in one of $P$ and $Q$ does not resolve the choice (unlike CCS $+$). This is external choice.

A further form of binary choice is the asymmetric $P\rhd Q$, sometimes called sliding choice. This offers any initial visible action of $P$ from an unstable (in the combination) state and can (until such an action happens) perform a $\tau$ action to $Q$. It can be re-written in terms of prefix, external choice and hiding. It represents a convenient shorthand way of creating processes in which visible actions happen from an unstable state, so this is not an operator one is likely to use much for building practical systems, rather a tool for analysing how systems can behave. As discussed in [21], to give a full treatment of CSP in any model finer than stable failures, it is necessary to contemplate processes that have visible actions performed from unstable states.

We only have a single parallel operator in our core language since all the usual ones of CSP can be defined in terms of it as discussed in Chapter 2 etc. of [21].

• •

$P{\mathrel{\,\mathop{\parallel}\limits_{X}\,}}Q$ runs $P$ and $Q$ in parallel, allowing each of them to perform any action in $\Sigma\setminus X$ independently, whereas actions in $X$ must be synchronised between the two.

There are two operators that change the nature of a process’s communications.

• •

$P\mathrel{\mathchar 622\relax}X$, for $X\subseteq\Sigma$, hides $X$ by turning all $P$’s $X$-actions into $\tau$s.

• •

$P\mathchar 91\relax\mkern-2.0mu\mathchar 91\relax R\mathchar 93\relax\mkern-2.0mu\mathchar 93\relax$ applies the renaming relation $R\subseteq\Sigma\times\Sigma$ to $P$: if $(a,b)\in R$ and $P$ can perform $a$, then $P\mathchar 91\relax\mkern-2.0mu\mathchar 91\relax R\mathchar 93\relax\mkern-2.0mu\mathchar 93\relax$ can perform $b$. The domain of $R$ must include all visible events used by $P$. Renaming by the relation $\{(a,b)\}$ is denoted {\mathchar 91\relax\mkern-2.0mu\mathchar 91\relax\raisebox{3.01385pt}{\hbox{\smalla}}/\hbox{\smallb}\mathchar 93\relax\mkern-2.0mu\mathchar 93\relax}.

• •

Sequential composition $P\mathbin{\mathchar 24635\relax}Q$ allows $P$ to run until it terminates successfully (). $P$’s is turned into $\tau$ and then $Q$ is started. So if $P$ and $Q$ respectively have traces $s\mbox{\textasciicircum}\langle\tick\rangle$ and $t$, then $P\mathbin{\mathchar 24635\relax}Q$ has the trace $s\mbox{\textasciicircum}t$.

There is another operator that allows one process to follow another:

• •

$P\>\Theta_{a:A}\>Q$ behaves like $P$ until an event in the set $A$ occurs, at which point $P$ is shut down and $Q$ is started. This is the throw operator, and it is important for establishing clean expressivity results.

The final CSP construct is recursion: this can be single or mutual (including mutual recursions over infinite parameter spaces), can be defined by systems of equations or (in the case of single recursion) in line via the notation $\mathop{\mathstrut{\mu\>p.P}}\nolimits$, for a term $P$ that may include the free process identifier $p$. Recursion can be interpreted operationally as having a $\tau$-action corresponding to a single unwinding. Denotationally, we regard $P$ as a function on the space of denotations, and interpret $\mathop{\mathstrut{\mu\>p.P}}\nolimits$ as the least (or sometimes provably unique) fixed point of this function.

We also make use of the interleaving operator $\mathrel{\mathchar 618\relax\mathchar 618\relax\mathchar 618\relax}$, which allows processes to perform actions independently and is equivalent to ${\mathrel{\,\mathop{\parallel}\limits_{\emptyset}\,}}$, and the process $\mathord{{\it RUN}}_{X}$, which always offers every element of the set $X$ and is defined by

[TABLE]

This completes our list of operators other than priority. While others, for example $\triangle$ (interrupt) are sometimes used, they are all expressible in terms of the above (see ch.9 of [21]).

2.1 Priority

The priority operator is introduced and discussed in detail in Chapter 20 of [21] as well as [23]. It allows us to specify an ordering on the set of visible events $\Sigma$, and prevents lower-priority events from occuring whenever a higher-priority event or $\tau$ is available.

The operator described in [21] as implemented in FDR4 [5] is parametrised by three arguments: a process $P$, a partial order $\leq$ on the event set $\Sigma$, and a subset $X\subseteq\Sigma$ of events that can occur when a $\tau$ is available. We require that all elements of $X$ are maximal with respect to $\leq$ and additionally require that if $a$ is any event incomparable to $\tau$, then $a$ is also maximal. Failing to respect these principles means that the operator might undermine some basic principles of CSP. Writing $\mathit{initials}(P)\subseteq\Sigma\cup\{\tau\}$ for the set of events that $P$ can immediately perform, and extending $\leq$ to a partial order on $\Sigma\cup\{\tau\}$ by adding $y\leq\tau\mathop{\mathstrut{\forall}}\nolimits y\in\Sigma\setminus X$, we define the operational semantics of $\mathrm{\bf prioritise}$ as follows:

[TABLE]

$\mathrm{\bf prioritise}$ makes enormous contributions to the expressive power of CSP as explained in [23], meaning that CSP+$\mathrm{\bf prioritise}$ can be considered a universal language for a much wider class of operational semantics than the CSP-like class described in [22, 21].

It should not therefore be surprising that $\mathrm{\bf prioritise}$ is not compositional over denotational finite observation models other than the most precise model, as we will discuss below. So we think of it as an optional addition to CSP rather than an integral part of it; when we refer below to particular types of observation as giving rise to valid models for CSP, we will mean CSP without priority.

If we admit successful termination , then it must have the same priority as $\tau$.

3 Example: the stable failures model

We introduce our model shifting construction using the stable failures model: we will produce a context $\mathcal{C}$ such that for any processes $P,Q$, we have that $Q$ refines $P$ in the stable failures model if and only $\mathcal{C}[Q]$ refines $\mathcal{C}[P]$ in the traces model.

3.1 The traces and failures models

The traces model $\mathcal{T}$ is familiar from both process algebra and automata theory, and represents a process by the set of (finite) strings of events it is able to accept. Thus each process is associated (for fixed alphabet $\Sigma$) to a subset of $\Sigma^{*}$ the set of finite words over $\Sigma$ (plus words of the form $w\langle\tick\rangle$ if we allow $SKIP$ and sequential composition). The stable failures model $\mathcal{F}$ also records sets $X$ of events that the process is able to stably refuse after a trace $s$ (that is, the process is able after trace $s$ to be in a state where no $\tau$ events are possible, and where the set of initial events is disjoint from $X$). Thus a process is associated to a subset of $\Sigma^{*}\times(\mathcal{P}(\Sigma)\cup\{\mathrel{\mathchar 527\relax}\})$, where $\mathrel{\mathchar 527\relax}$ represents the absence of a recorded refusal set.444This is equivalent to the standard presentation in which a process is represented by a subset of $\Sigma^{*}$ and one of $\Sigma^{*}\times\mathcal{P}(\Sigma)$: the trace component is just $\{s:(s,\mathrel{\mathchar 527\relax})\in\mathcal{F}(P)\}$. We would add the symbol to this set when including termination. Note that recording $\bullet$ does not imply that there is no refusal to observe, simply that we have not observed stability. The observation of the refusal $\emptyset$ implies that the process can be stable after the present trace, whereas observing $\bullet$ does not.

In any model $\mathcal{M}$, we say that $Q$ $\mathcal{M}$-refines $P$, and write $P\mathrel{\sqsubseteq_{M}}Q$, if the set associated to $Q$ is a subset of that corresponding to $P$.

Because can be seen, but happens automatically, we need to distinguish a process like $\mathord{{\it SKIP}}$ which must terminate from one that can but may not like $\mathord{{\it STOP}}\mathrel{\mathchar 629\relax}\mathord{{\it SKIP}}$. After all if these are subsituted for $P$ in $P\mathbin{\mathchar 24635\relax}Q$ we get processes equivalent to $Q$ and $\mathord{{\it STOP}}\mathrel{\mathchar 629\relax}Q$. However the state that accepts can be thought of as being able to refuse the rest of the visible events $\Sigma$, since it can terminate all by itself.

3.2 Model shifting for the stable failures model

We first consider this without . The construction is as follows:

Lemma 1

For each finite alphabet $\Sigma$ there exists a context $\mathcal{C}$ (over an expanded alphabet) such that for any processes $P$ and $Q$ we have that $P\mathrel{\sqsubseteq_{F}}Q$ if and only if $\mathcal{C}[P]\mathrel{\sqsubseteq_{T}}\mathcal{C}[Q]$.

**Proof

Step 1:** We use priority to produce a process (over an expanded alphabet) that can communicate an event $x^{\prime}$ if and only if the original process $P$ is able to stably refuse $x$.

This is done by expanding the alphabet $\Sigma$ to $\Sigma\cup\Sigma^{\prime}$ (where $\Sigma^{\prime}$ contains a corresponding primed event $x^{\prime}$ for every event $x\in\Sigma$), and prioritising with respect to the partial order which prioritises each $x$ over the corresponding $x^{\prime}$ and makes $\tau$ incomparable to $x$ and greater than $x^{\prime}$.

We must also introduce an event $\mathit{stab}$ to signify the observation of stability (i.e. no $\tau$ is possible in this state) without requiring any refusals to be possible. This is necessary in order to be able to record an empty refusal set. The priority order $\leq_{1}$ is then the above (i.e. $x^{\prime}<x$ for all $x\in\Sigma$) extended by making $stab$ less than only $\tau$ and independent of all $x$ and $x^{\prime}$.

We can now fire up these new events as follows:

[TABLE]

This process has a state $\xi^{\prime}$ for each state $\xi$ of $P$, where $\xi^{\prime}$ has the same unprimed events (and corresponding transitions) as $\xi$. Furthermore $\xi^{\prime}$ can communicate $x^{\prime}$ just when $\xi$ is stable and can refuse $X$, and $\mathit{stab}$ just when $\xi$ is stable.

Step 2: We now recall that the definition of the stable failures model only allows a refusal set to be recorded at the end of a trace, and is not interested in (so does not record) what happens after the refusal set.

We gain this effect by using a regulator process to prevent a primed event (or $\mathit{stab}$) from being followed by an unprimed event. Let

[TABLE]

and define $\mathcal{C}$ by

[TABLE]

A trace of $\mathcal{C}[P]$ consists of: firstly, a trace $s$ of $P$; followed by, if $P$ can after $s$ be in a stable state, then for some such state $\sigma_{0}$ any string formed from the events that can be refused in $\sigma_{0}$, together with $\mathit{stab}$. The lemma clearly follows.

It is clear that any such context must involve an operator that is not compositional over traces, for otherwise we would have $P\mathrel{\sqsubseteq_{\mathrm{T}}}Q$ implies $\mathcal{C}[P]\mathrel{\sqsubseteq_{\mathrm{T}}}\mathcal{C}[Q]$, which is equivalent to $P\mathrel{\sqsubseteq_{\mathrm{F}}}Q$, and this is not true for general $P$ and $Q$ (consider for instance $P=a\mathrel{\rightarrow}\mathord{{\it STOP}}$, $Q=(a\mathrel{\rightarrow}\mathord{{\it STOP}})\mathrel{\mathchar 629\relax}\mathord{{\it STOP}}$). It follows that only contexts which like ours involve priority or some operator with similar status can achieve this.

Adding to the model causes a few issues with the above. For one thing it creates a refusal (namely of everything except ) from what could be an unstable state, namely a state that can perform and perhaps also a $\tau$. And secondly we need to find an effective way of making processes show their refusal of , and their refusal of all events other than , when respectively appropriate. One way of doing these things is to add to the state space so that termination goes through multiple stages. Create a new event $term$ and consider $P\mathbin{\mathchar 24635\relax}term\mathrel{\rightarrow}\mathord{{\it SKIP}}$. This performs any behaviour of $P$ except that all s of $P$ become $\tau$s and lead to $term\mathrel{\rightarrow}\mathord{{\it SKIP}}$. That of course is a stable state. If we now (treating $term$ as a member of $\Sigma$) apply $\mathcal{C}$ as defined above, this will be able to perform $term^{\prime}$ in any stable state that cannot terminate, and will perform every $a^{\prime}$ event other than $term^{\prime}$ every time it reaches the state $term\mathrel{\rightarrow}\mathord{{\it SKIP}}$. Thus if we define

[TABLE]

we get exactly the decorated traces we might have expected from the stable failures representation of $P$ except that instead of having an event ′ we have $term^{\prime}$.

4 Semantic models

In order to generalise this construction to arbitrary finite observational semantic models, we must give formal definitions not only of particular models but of the very notion of a finite observational model.

4.1 Finite observations

We consider only models arising from finite linear observations. Intuitively, we postulate that we are able to observe the process performing a finite number of visible actions, and that where the process was stable (unable to perform a $\tau$) immediately before an action, we are able to observe the acceptance set of actions it was willing to perform.

Note that there cannot be two separate stable states before visible event $b$ without another visible event $c$ between them, even though it is possible to have many visible events between stable states. Thus it makes no sense to record two separate refusals or acceptance sets between consecutive visible events. Similarly it does not make sense to record both an acceptance and a refusal, since observing an acceptance set means that recording a refusal conveys no extra information: if acceptance $A$ is observed then no other is seen before the next visible event, and observable refusals are exactly those disjoint from $A$.

We are unable to finitely observe instability: the most we are able to record from an action in an unstable state is that we did not observe stability. Thus in any context where we can observe stability we can also fail to observe it by simply not looking.

We take models to be defined over finite alphabets $\Sigma$, and take an arbitrary linear ordering on each finite $\Sigma$ to be alphabetical.

The most precise finite observational model is that considering all finite linear observations, and is denoted $\mathcal{FL}$:

Definition 1

The set of finite linear observations over an alphabet $\Sigma$ is

[TABLE]

where the $a_{i}$ are interpreted as a sequence of communicated events, and the $A_{i}$ denote stable acceptance sets, or in the case of $\mathrel{\mathchar 527\relax}$ failure to observe stability. Let the set of such observations corresponding to a process $P$ be denoted $\mathcal{FL}_{\Sigma}(P)$. This needs to be extended to encompass final s if we want to include termination.

(Sometimes we will drop the $\Sigma$ and just write $\mathcal{FL}(P)$).

More formally, $\mathcal{FL}(P)$ can be defined inductively; for instance

[TABLE]

(where $X\cup\bullet:=\bullet$ for any set $X$). See Section 11.1.1 of [21] for further details.

Observe that $\mathcal{FL}$ has a natural partial order corresponding to extensions (where $\alpha\mbox{\textasciicircum}\langle\mathrel{\mathchar 527\relax}\rangle\mbox{\textasciicircum}\beta$ and $\alpha\mbox{\textasciicircum}\langle A\rangle$ are both extended by $\alpha\mbox{\textasciicircum}\langle A\rangle\mbox{\textasciicircum}\beta$ for any set $A$ and any $\alpha$ and $\beta$). Note that for any process $P$ we have that $\mathcal{FL}(P)$ is downwards-closed with respect to this partial order.

The definition of priority over $\mathcal{FL}$ (accommodating final s) is as follows. $\mathrm{\bf prioritise}(P,\leq,X)$ is, with $\leq$ extended to the whole of $\Sigma\cup\{\tau\}$ by making all elements not in $X$ incomparable to all others

[TABLE]

where for each $i$ one of the following holds:

• •

$b_{i}$ is maximal under $\leq$ and $A_{i}=\bullet$ (so there is no condition on $Z_{i}$ except that it exists).

• •

$a_{i}$ is not maximal under $\leq$ and $A_{i-1}=\bullet$ and $Z_{i}$ is not $\bullet$ and neither does $Z_{i}$ contain any $c>b_{i}$.

• •

Neither $A_{i}$ nor $Z_{i}$ is $\bullet$, and $A_{i}=\{a\in Z_{i}\mid\neg\mathop{\mathstrut{\exists}}\nolimits b\in Z_{i}.b>a\}$,

• •

and in each case where $A_{i-1}\neq\bullet$, $a_{i}\in A_{i-1}$.

This is not possible for the other studied finite behaviour models of CSP: the statement that it is for refusal testing $\mathcal{RT}$ in [21] is not true, though it is possible for some partical orders $\leq$ including those needed for maximal progress in timed modelling of the sort we will see later.

4.2 Finite observational models

We consider precisely the models which are derivable from the observations of $\mathcal{FL}$, which are well-defined in the sense that they are compositional over CSP syntax (other than priority), and which respect extension of the alphabet $\Sigma$.

Definition 2

A finite observational pre-model $\mathcal{M}$ consists for each (finite) alphabet $\Sigma$ of a set of observations, $\mathrm{obs}_{\Sigma}(\mathcal{M})$, together with a relation $\mathcal{M}_{\Sigma}\subseteq\mathcal{FL}_{\Sigma}\times\mathrm{obs}_{\Sigma}(\mathcal{M})$. The representation of a process $P$ in $\mathcal{M}_{\Sigma}$ is denoted $\mathcal{M}_{\Sigma}(P)$, and is given by

[TABLE]

For processes $P$ and $Q$ over alphabet $\Sigma$, if we have $\mathcal{M}_{\Sigma}(Q)\subseteq\mathcal{M}_{\Sigma}(P)$ then we say $Q$ $\mathcal{M}$-refines $P$, and write $P\mathrel{\sqsubseteq_{M}}Q$.

(As before we will sometimes drop the $\Sigma$).

Note that this definition is less general than if we had defined a pre-model to be any equivalence relation on $\mathcal{P}\left(\mathcal{FL}_{\Sigma}\right)$. For example, the equivalence relating sets of the same cardinality has no corresponding pre-model. Definition 2 agrees with that sketched in [21].

Without loss of generality, $\mathcal{M}_{\Sigma}$ does not identify any elements of $\mathrm{obs}_{\Sigma}(\mathcal{M})$; that is, we have $\mathcal{M}_{\Sigma}^{-1}(x)=\mathcal{M}_{\Sigma}^{-1}(y)$ only if $x=y$ (otherwise quotient by this equivalence relation). Subject to this assumption, $\mathcal{M}_{\Sigma}$ induces a partial order on $\mathrm{obs}_{\Sigma}(\mathcal{M})$:

Definition 3

The partial order induced by $\mathcal{M}_{\Sigma}$ on $\mathrm{obs}_{\Sigma}(\mathcal{M})$ is given by: $x\leq y$ if and only if for all $b\in\mathcal{M}_{\Sigma}^{-1}(y)$ there exists $a\in\mathcal{M}_{\Sigma}^{-1}(x)$ with $a\leq b$.

Observe that for any process $P$ it follows from this definition that $\mathcal{M}(P)$ is downwards-closed with respect to this partial order (since $\mathcal{FL}(P)$ is downwards-closed).

Definition 4

A pre-model $\mathcal{M}$ is compositional if for all CSP operators $\bigoplus$, say of arity $k$, and for all processes $P_{1},\ldots,P_{k}$ and $Q_{1},\ldots,Q_{k}$ such that $\mathcal{M}(P_{i})=\mathcal{M}(Q_{i})$ for all $i$, we have

[TABLE]

This means that the operator defined on processes in $\mathrm{obs}(\mathcal{M})$ by taking the pushforward of $\bigoplus$ along $\mathcal{M}$ is well-defined: for any sets $X_{1},\ldots,X_{k}\subseteq\mathrm{obs}(\mathcal{M})$ which correspond to the images of CSP processes, take processes $P_{1},\ldots,P_{k}$ such that $X_{i}=\mathcal{M}(P_{i})$, and let

[TABLE]

Definition 4 says that the result of this does not depend on the choice of the $P_{i}$.

Note that it is not necessary to require the equivalent of Definition 4 for recursion in the definition of a model, because of the following lemma which shows that least fixed point recursion is automatically well-defined (and formalises some arguments given in [21]):

Lemma 2

Let $\mathcal{M}$ be a compositional pre-model. Let $\mathcal{C}_{1},\mathcal{C}_{2}$ be CSP contexts, such that for any process $P$ we have $\mathcal{M}(\mathcal{C}_{1}[P])=\mathcal{M}(\mathcal{C}_{2}[P])$. Let the least fixed points of $\mathcal{C}_{1}$ and $\mathcal{C}_{2}$ (viewed as functions on $\mathcal{P}(\mathcal{FL})$ under the subset order) be $P_{1}$ and $P_{2}$ respectively. Then $\mathcal{M}(P_{1})=\mathcal{M}(P_{2})$.

**Proof

**Using the fact that CSP contexts induce Scott-continuous functions on $\mathcal{P}(\mathcal{FL})$ (see [8], Section 2.8.2), the Kleene fixed point theorem gives that $P_{i}=\bigcup_{n=0}^{\infty}\mathcal{C}_{i}^{n}(\bot)$. Now any $x\in\mathcal{M}(P_{1})$ is in the union taken up to some finite $N$, and since finite unions correspond to internal choice, and $\bot$ to the process $\mathord{{\bf div}}$, we have that the unions up to $N$ of $\mathcal{C}_{1}$ and $\mathcal{C}_{2}$ agree under $\mathcal{M}$ by compositionality. Hence $x\in\mathcal{M}(P_{2})$, so $\mathcal{M}(P_{1})\subseteq\mathcal{M}(P_{2})$. Similarly $\mathcal{M}(P_{2})\subseteq\mathcal{M}(P_{1})$.

Definition 5

A pre-model $\mathcal{M}$ is extensional if for all alphabets $\Sigma_{1}\subseteq\Sigma_{2}$ we have that $\mathrm{obs}_{\Sigma_{1}}(\mathcal{M})\subseteq\mathrm{obs}_{\Sigma_{2}}(\mathcal{M})$, and $\mathcal{M}_{\Sigma_{2}}$ agrees with $\mathcal{M}_{\Sigma_{1}}$ on $\mathcal{FL}(\Sigma_{1})\times\mathrm{obs}_{\Sigma_{1}}(\mathcal{M})$.

Definition 6

A pre-model is a model if it is compositional and extensional.

In this setting, we now describe the five main finite observational models coarser than $\mathcal{FL}$: traces, stable failures, revivals, acceptances and refusal testing.

4.2.1 The traces model

The coarsest model measures only the traces of a process; that is, the sequences of events it is able to accept. This corresponds to the language of the process viewed as a nondeterministic finite automaton (NFA).

Definition 7

The traces model, $\mathcal{T}$, is given by

[TABLE]

*where $\mathit{trace}$ is the equivalence relation which relates the observation

$\langle A_{0},a_{1},A_{1},\ldots,a_{n},A_{n}\rangle$ to the string $a_{1}\ldots a_{n}$.*

4.2.2 Failures

The traces model gives us information about what a process is allowed to do, but it in some sense tells us nothing about what it is required to do. In particular, the process $\mathord{{\it STOP}}$ trace-refines any other process.

In order to specify liveness properties, we can incorporate some information about the events the process is allowed to refuse, begining with the stable failures model. Intuitively, this captures traces $s$, together with the sets of events the process is allowed to stably refuse after $s$.

Definition 8

The stable failures model, $\mathcal{F}$, is given by

[TABLE]

where $\mathit{fail}_{\Sigma}$ relates the observation $\langle A_{0},\ldots,a_{n},A_{n}\rangle$ to all pairs $(a_{1}\ldots a_{n},X)$, for all $X\subseteq\Sigma\setminus A_{n}$ if $A_{n}\neq\,\mathrel{\mathchar 527\relax}$, and for $X=\,\mathrel{\mathchar 527\relax}$ otherwise.

4.2.3 Revivals

The next coarsest model, first introduced in [20], is the revivals model. Intuitively this captures traces $s$, together with sets $X$ that can be stably refused after $s$, and events $a$ (if any) that can then be accepted.

Definition 9

The revivals model, $\mathcal{R}$, is given by

[TABLE]

where $\mathit{rev}_{\Sigma}$ relates the observation $\langle A_{0},a_{1},\ldots,a_{n-1},A_{n-1},a_{n},A_{n}\rangle$ to

1. (i)

the triples $(a_{1}\ldots a_{n-1},X,a_{n})$, for all $X\subseteq\Sigma\setminus A_{n-1}$ if $A_{n-1}\neq\,\mathrel{\mathchar 527\relax}$ and for $X=\,\mathrel{\mathchar 527\relax}$ otherwise, and 2. (ii)

the triples $(a_{1}\ldots a_{n},X,\mathrel{\mathchar 527\relax})$, for all $X\subseteq\Sigma\setminus A_{n}$ if $A_{n}\neq\,\mathrel{\mathchar 527\relax}$ and for $X=\,\mathrel{\mathchar 527\relax}$ otherwise.

A finite linear observation is related to all triples consisting of: its initial trace; a stable refusal that could have been observed, or $\mathrel{\mathchar 527\relax}$ if the original observation did not observe stability; and optionally (part (i) above) a single further event that can be accepted.

4.2.4 Acceptances

All the models considered up to now refer only to sets of refusals, which in particular are closed under subsets. The next model, acceptances (also known as ‘ready sets’), refines the previous three and also considers the precise sets of events that can be stably accepted at the ends of traces.

Definition 10

The acceptances model, $\mathcal{A}$, is given by

[TABLE]

where $\mathit{acc}_{\Sigma}$ relates the observation $\langle A_{0},a_{1},\ldots,a_{n},A_{n}\rangle$ to the pair $(a_{1}\ldots a_{n},A_{n})$.

It is convenient to note here that, just as we were able to use $a^{\prime}$ as a cipher for the refusal of $a$ when model shifting, we can introduce a second one $a^{\prime\prime}$ as a chipher for stable acceptance of $a$: it is performed (without changing the state) just when $a^{\prime}$ is stably refused. We will apply this idea and discuss it further below.

4.2.5 Refusal testing

The final model we consider is that of refusal testing, first introduced in [16]. This refines $\mathcal{F}$ and $\mathcal{R}$ by considering an entire history of events and stable refusal sets. It is incomparable to $\mathcal{A}$, because it does not capture precise acceptance sets.

Definition 11

The refusal testing model, $\mathcal{RT}$, is given by

[TABLE]

[TABLE]

where $\mathit{rt}_{\Sigma}$ relates the observation $\langle A_{0},\ldots,a_{n},A_{n}\rangle$ to $\langle X_{0},\ldots,a_{n},X_{n}\rangle$, for all $X_{i}\subseteq\Sigma\setminus A_{i}$ if $A_{i}\neq\,\mathrel{\mathchar 527\relax}$, and for $X_{i}=\,\mathrel{\mathchar 527\relax}$ otherwise.

The correct way to handle , if needed, in any of these models is to add to the respective transformation in exactly the same way we did for stable failures. This is to be expected because only ever happens at the end of traces. Clearly we will need to use $term^{\prime\prime}$ as a cipher for ′′ in appropriate cases.

4.3 Rational models

We will later on wish to consider only models $\mathcal{M}$ for which the correspondence between $\mathcal{FL}$-observations and $\mathcal{M}$ observations is decidable by a finite memory computer. We will interpret this notion as saying the the relation $\mathcal{M}_{\Sigma}$ corresponds to the language accepted by some finite state automaton. In order to do this, we must first decide how to convert elements of $\mathcal{FL}_{\Sigma}$ to words in a language. We do this in the obvious way (the reasons for using fresh variables to represent the $A_{i}$ will become apparent in Section 5).

Definition 12

The canonical encoding of $\mathcal{FL}_{\Sigma}$ is over the alphabet $\Xi:=\Sigma\cup\Sigma^{\prime\prime}\cup\mathit{Sym}$, where $\Sigma^{\prime\prime}:=\{a^{\prime\prime}:a\in\Sigma\}$ and $\mathit{Sym}=\{\langle,\rangle,`{\tt,}^{\prime},\mathrel{\mathchar 527\relax}\}$.555Note that this somewhat unsatisfactory notation denotes a set of four elements: the angle brackets $\langle$ and $\rangle$, the comma , and the symbol $\mathrel{\mathchar 527\relax}$. It is given by the representation in Definition 1, where sets $A_{i}$ are expressed by listing the elements of $\Sigma^{\prime\prime}$ corresponding to the members of $A_{i}$ in alphabetical order. We denote this encoding by $\phi_{\Sigma}:\mathcal{FL}_{\Sigma}\rightarrow\Xi^{*}$.

We now define a model to be rational (borrowing a term from automata theory) if its defining relation can be recognised (when suitably encoded) by some nondeterministic finite automaton.

Definition 13

A model $\mathcal{M}$ is rational if for every alphabet $\Sigma$, there is some finite alphabet $\Theta$ and a map $\psi_{\Sigma}:\mathrm{obs}_{\Sigma}(\mathcal{M})\rightarrow\Theta^{*}$, such that there is a (nondeterministic) finite automaton $\mathcal{A}$ recognising $\left\{\left(\phi_{\Sigma}(x),\psi_{\Sigma}(y)\right):(x,y)\in\mathcal{M}_{\Sigma}\right\}$, and such that $\psi_{\Sigma}$ is order-reflecting (that is, $\psi_{\Sigma}(x)\leq\psi_{\Sigma}(y)$ only if $x\leq y$), with respect to the prefix partial order on $\Theta^{*}$, and the partial order induced by $\mathcal{M}_{\Sigma}$ on $\mathrm{obs}_{\Sigma}(\mathcal{M})$.

What does it mean for an automaton to ‘recognise’ a relation?

Definition 14

For alphabets $\Sigma$ and $T$, a relation $\mathcal{R}\subseteq\Sigma^{*}\times T^{*}$ is recognised by an automaton $\mathcal{A}$ just when:

1. (i)

The event-set of $\mathcal{A}$ is $\mathrm{left}.\Sigma\cup\mathrm{right}.T$, and 2. (ii)

For any $s\in\Sigma^{*},t\in T^{*}$, we have $s\mathcal{R}t$ if and only if there is some interleaving of $\mathrm{left}.s$ and $\mathrm{right}.t$ accepted by $\mathcal{A}$.

Note that recognisability in the sense of Definition 14 is easily shown to be equivalent to the common notion of recognisability by a finite state transducer given for instance in [29], but the above definition is more convenient for our purposes. Note also that $\mathcal{FL}$ itself (viewing $\mathcal{FL}_{\Sigma}$ as the diagonal relation) is trivially rational.

Lemma 3

The models $\mathcal{T},\mathcal{F},\mathcal{R},\mathcal{A}$ and $\mathcal{RT}$ are rational.

**Proof

**By inspection of Definitions 7–11. We take $\Theta=\Sigma\cup\Sigma^{\prime}\cup\Sigma^{\prime\prime}\cup\mathit{Sym}$, with $\Sigma^{\prime\prime}$ and the expression of acceptance sets as in the canonical encoding of $\mathcal{FL}$, and refusal sets expressed in the corresponding way over $\Sigma^{\prime}:=\{a^{\prime}:a\in\Sigma\}$.

Note that not all relations are rational. For instance, the ‘counting relation’ mapping each finite linear observation to its length is clearly not rational. We do not know whether the additional constraint of being a finite observational model necessarily implies rationality; however, no irrational models are known. We therefore tentatively conjecture: that every finite observational model is rational.

5 Model shifting

We now come to the main substance of this paper: we prove results on ‘model shifting’, showing that there exist contexts allowing us to pass between different semantic models and the basic traces model. The main result is Theorem 1, which shows that this is possible for any rational model.

5.1 Model shifting for $\mathcal{FL}$

We begin by proving the result for the finest model, $\mathcal{FL}$. We show that there exists a context $\mathcal{C}_{\mathcal{FL}}$ such that for any process $P$, the finite linear observations of $P$ correspond to the traces of $\mathcal{C}_{\mathcal{FL}}(P)$.

Lemma 4** **(Model shifting for $\mathcal{FL}$)

For every alphabet $\Sigma$, there exists a context $\mathcal{C}_{\mathcal{FL}}$ over alphabet $T:=\Sigma\cup\Sigma^{\prime}\cup\Sigma^{\prime\prime}\cup\{\mathit{done}\}$, and an order-reflecting map $\pi:\mathcal{FL}_{\Sigma}\rightarrow T^{*}$ (with respect to the extension partial order on $\mathcal{FL}_{\Sigma}$ and the prefix partial order on $T^{*}$) such that for any process $P$ over $\Sigma$ we have $\mathcal{T}(\mathcal{C}_{\mathcal{FL}}[P])=\mathrm{pref}(\pi(\mathcal{FL}(P)))$ (where $\mathrm{pref}(X)$ is the prefix-closure of the set $X$).

**Proof

**We will use the unprimed alphabet $\Sigma$ to denote communicated events from the original trace, and the double-primed alphabet $\Sigma^{\prime\prime}$ to denote (members of) stable acceptances. $\Sigma^{\prime}$ will be used in an intermediate step to denote refusals, and $\mathit{done}$ will be used to distinguish $\emptyset$ (representing an empty acceptance set) from $\mathrel{\mathchar 527\relax}$ (representing a failure to observe anything).

Step 1: We first produce a process which is able to communicate events $x_{i}^{\prime}$, just when the original process can stably refuse the corresponding $x_{i}$. Define the partial order $\leq_{1}=\langle x^{\prime}<_{1}x:x\in\Sigma\rangle$, which prevents refusal events when the corresponding event can occur.

Let the context $\mathcal{C}_{1}$ be given by

[TABLE]

Note that the third argument prevents primed events from occurring in unstable states.

Step 2: We now similarly introduce acceptance events, which can happen in stable states when the corresponding refusal can’t. The crucial difference between $a$ and $a^{\prime\prime}$ is that $a$ usually changes the underlying process state, whereas $a^{\prime\prime}$ leaves it alone. $a^{\prime\prime}$ means that $P$ can perform $a$ from its present stable state, but does not explore what happens when it does.

Similarly define the partial order $\leq_{2}=\langle x^{\prime\prime}<_{2}x^{\prime}:x\in\Sigma\rangle$, which prevents acceptance events when the corresponding refusal is possible. Let the context $\mathcal{C}_{2}$ be defined by

[TABLE]

Step 3: We now ensure that an acceptance set inferred from a trace is a complete set accepted by the process under examination. This is most straightforwardly done by employing a regulator process, which can either accept an unprimed event or accept the alphabetically first refusal or acceptance event, followed by a refusal or acceptance for each event in turn. In the latter case it then communicates a $\mathit{done}$ event, and returns to its original state. It has thus recorded the complete set of events accepted by $P$’s present state.

The $\mathit{done}$ event is necessary in order to distinguish between a terminal $\emptyset$, which can have a $\mathit{done}$ after the last event, and a terminal $\mathrel{\mathchar 527\relax}$, which cannot (observe that a $\emptyset$ cannot occur other than at the end). Along the way, we hide the refusal events.

Let $a$ and $z$ denote the alphabetically (by which me mean in a fixed but arbitrary linear order on $\Sigma$) first and last events respectively, and let ${\tt succ}x$ denote the alphabetical successor of $x$. Define the processes

[TABLE]

and let

[TABLE]

A little care is required here. We can prevent acceptances from being ‘skipped over’ by prioritising the double-primed events in alphabetical order, but we also have to prevent acceptances from ending early, i.e. prevent an unprimed event from happening prematurely.

The most obvious solution is to prioritise acceptance events over unprimed events. This does not work, however, because the prioritise operator forces all events which can be performed in unstable states to be maximal in the order, and in the LTS representing the underlying process, any event can happen as an alternative to $\tau$.

We instead use the event $\mathit{done}$ to mark the end of an acceptance set, and use a regulator process to prevent a double-primed event from being followed by an unprimed event without an intervening $\mathit{done}$. This also distinguishes between $\emptyset$, represented by a $\mathit{done}$ between two unprimed events, and $\mathrel{\mathchar 527\relax}$, represented by consecutive unprimed events.

Define the partial order

[TABLE]

which prevents jumps in acceptance sets, and allows $\mathit{done}$ only in stable states where no double-primed events are left to be communicated. Let the context $\mathcal{C}_{3}$ be defined by

[TABLE]

We now define the regulator process which prevents sequences of double-primed events not concluded by $\mathit{done}$:

[TABLE]

and then define the context $\mathcal{C}_{\mathcal{FL}}$ by

[TABLE]

Step 4: We now complete the proof by defining the function $\pi$ inductively as follows:

[TABLE]

where without loss of generality the $x_{i}$ are listed in alphabetical order.

It is clear that this is order-reflecting, and by the construction above satisfies $\mathcal{T}(\mathcal{C}_{\mathcal{FL}}[P])=\mathrm{pref}(\pi(\mathcal{FL}(P)))$.

This result allows us to translate questions of $\mathcal{FL}$-refinement into questions of trace refinement under $\mathcal{C}_{\mathcal{FL}}$, as follows:

Corollary 1

For $\mathcal{C}_{\mathcal{FL}}$ as in Lemma 4, and for any processes $P$ and $Q$, we have $P\mathrel{\sqsubseteq_{\mathrm{FL}}}Q$ if and only if $\mathcal{C}_{\mathcal{FL}}[P]\mathrel{\sqsubseteq_{\mathrm{T}}}\mathcal{C}_{\mathcal{FL}}[Q]$.

**Proof

**Certainly if $\mathcal{FL}(Q)\subseteq\mathcal{FL}(P)$ then $\mathcal{T}(\mathcal{C}_{\mathcal{FL}}[Q])=\mathrm{pref}(\pi(\mathcal{FL}(Q)))\subseteq\mathrm{pref}(\pi(\mathcal{FL}(P)))=\mathcal{T}(\mathcal{C}_{\mathcal{FL}}[P])$ and so $\mathcal{C}_{\mathcal{FL}}[P]\mathrel{\sqsubseteq_{\mathrm{T}}}\mathcal{C}_{\mathcal{FL}}[Q]$.

Conversely, suppose there exists $x\in\mathcal{FL}(Q)\setminus\mathcal{FL}(P)$. Then since $\mathcal{FL}(P)$ is downwards-closed, we have $x\nleq y$ for all $y\in\mathcal{FL}(P)$. Since $\pi$ is order-reflecting, we have correspondingly $\pi(x)\nleq\pi(y)$ for all $y\in\mathcal{FL}(P)$. Hence $\pi(x)\notin\mathrm{pref}(\pi(\mathcal{FL}(P)))$, so $\mathrm{pref}(\pi(\mathcal{FL}(Q)))\nsubseteq\mathrm{pref}(\pi(\mathcal{FL}(P)))$.

5.2 Model shifting for rational observational models

We now have essentially all we need to prove the main theorem. We formally record a well known fact, that any Nondeterministic Finite Austomaton (NFA) can be implemented as a CSP process (up to prefix-closure, since trace-sets are prefix-closed but regular languages are not):

Lemma 5** **(Implementation for NFA)

Let $\mathcal{A}=(\Sigma,Q,\delta,q_{0},F)$ be a (nondeterministic) finite automaton. Then there exists a CSP process $P_{\mathcal{A}}$ such that $\mathrm{pref}(L(\mathcal{A}))=\mathrm{pref}(\mathcal{T}(P_{\mathcal{A}}))$.

See Chapter 7 of [18] for the proof.

Theorem 1** **(Model shifting for rational models)

For every rational model $\mathcal{M}$, there exists a context $\mathcal{C}_{\mathcal{M}}$ such that for any process $P$ we have $\mathcal{T}(\mathcal{C}_{\mathcal{M}}[P])=\mathrm{pref}(\psi(\mathcal{M}(P)))$.

**Proof

**Let $\mathcal{A}$ be the automaton recognising $(\phi\times\psi)(\mathcal{M})$ (as from Definition 13), and let $P_{\mathcal{A}}$ be the corresponding process from Lemma 5.

We first apply Lemma 4 to produce a process whose traces correspond to the finite linear observations of the original process, prefixed with $\mathrm{left}$: let $\mathcal{C}_{\mathcal{FL}}$ be the context from Lemma 4, and let the context $\mathcal{C}_{1}$ be defined by

[TABLE]

We now compose in parallel with $P_{\mathcal{A}}$, to produde a process whose traces correspond to the $\mathcal{M}$-observations of the original process. Let $\mathcal{C}_{2}$ be defined by

[TABLE]

Then the traces of $\mathcal{C}_{2}[X]$ are precisely the prefixes of the images under $\psi$ of the observations corresponding to $X$, as required.

By the same argument as for Corollary 1, we have

Corollary 2

For any rational model $\mathcal{M}$, let $\mathcal{C}_{\mathcal{M}}$ be as in Theorem 1. Then for any processes $P$ and $Q$, we have $P\mathrel{\sqsubseteq_{M}}Q$ if and only if $\mathcal{C}_{\mathcal{M}}[P]\mathrel{\sqsubseteq_{\mathrm{T}}}\mathcal{C}_{\mathcal{M}}[Q]$.

6 Implementation

We demonstrate the technique by implementing contexts with the property of Corollary 2; source code may be found at [1].

For the sake of efficiency we work directly rather than using the general construction of Theorem 1. The context C1 introduces refusal events and a stab event, which can occur only when the corresponding normal events can be refused. This implements the refusal testing model, and the context CF which allows only normal events optionally followed by some refusals (and stab) implements the stable failures model.

This is however suboptimal over large alphabets, in the typical situation where most events are refused most of the time. FDR4’s inbuilt failures refinement checking codes refusal in terms of minimal acceptance sets (checking that each such acceptance of the specification is a superset of one of the implementation). Minimal acceptances are typically smaller than maximal refusal sets.

For models based on acceptance sets rather than refusal sets, we have to consider the whole collection of them rather than just the minimal ones. We can introduce a second extra copy of $\Sigma$, namely $\Sigma^{\prime\prime}$, where $a^{\prime\prime}$ will mean that the current stable state of $P$ can accept $a$, but the communication of $a^{\prime\prime}$ will not change the state of $P$. We can do this essentially by applying the previous construction (creating $a^{\prime}$) to itself. This uses an order $\leq^{\prime\prime}$ under which $a^{\prime\prime}<^{\prime}a^{\prime}$ on the process ${\cal C}(P)$:

[TABLE]

Here $Reg^{\prime\prime}$ is a process that initially will accept a $\Sigma$ event or $a^{\prime}$ or $a^{\prime\prime}$ for the alphabetically first member $a$ of $\Sigma$. If either of the latter it will insist on getting each subsequent member of $\Sigma$ in one of these two forms until it has pieced together the complete acceptance set. Thus as soon as the present state of $P$ is recognised as stable, $Reg^{\prime\prime}$ establishes its complete acceptance set before permitting to $P$ to carry on further if desired. (For the acceptances model with only acceptances at the ends of traces, there is no need to do so.) As an alternative, $Reg^{\prime\prime}$ could communicate an event such as $done$ when it gets to the end of the list of events, which would enable us to hide the refusal events $\Sigma^{\prime}$.

Similar constructions with slightly different restrictions on the permissible sequences of events produce efficient processes for the revivals and refusal testing models. We will generalise this below.

6.1 Testing

We test this implementation by constructing processes which are first distinguished by the stable failures, revivals, refusal testing and acceptance models respectively (the latter two being also distinguished by the finite linear observations model). The processes, and the models which do and do not distinguish them, are shown in Table 1 (recall the precision hierarchy of models: $\mathcal{T}\leq\mathcal{F}\leq\mathcal{R}\leq\{\mathcal{A},\mathcal{RT}\}\leq\mathcal{FL}$). The correct results are obtained when these checks are run in FDR4 with the implementation described above.

6.2 Performance

We assess the performance of our simulation by running those examples from Table 1 of [7] which involve refinement checks (as opposed to deadlock- or divergence-freedom assertions), and comparing the timings for our construction against the time taken by FDR4’s inbuilt failures refinement check (since $\mathcal{F}$ is the only model for which we have a point of comparison between a direct implementation and the methods developed in this paper). Results are shown in Table 2, for both the original and revised contexts described above; the performance of the $\mathcal{FL}$ check is also shown. As may be seen, performance is somewhat worse but not catastrophically so. Note however that these processes involve rather small alphabets; performance is expected to be worse for larger alphabets.

6.3 Example: Conflict detection

We now illustrate the usefulness of richer semantic models than just traces and stable failures by giving a sample application of the revivals model. Suppose that we have a process $P$ consisting of the parallel composition of two sub-processes $Q$ and $R$. The stable failures model is able to detect when $P$ can refuse all the events of their shared alphabet, or deadlock in the case when they are synchronised on the whole alphabet. However, it is unable to distinguish between the two possible causes of this: it may be that one of the arguments is able to refuse the entire shared alphabet, or it may be that each accepts some events from the shared alphabet, but the acceptances of $Q$ and $R$ are disjoint. We refer to the latter situation as a ‘conflict’. The absence of conflict (and similar situations) is at the core of a number of useful ways of proving deadlock-freedom for networks of processes running in parallel [24].

The revivals model can be used to detect conflicts. For a process $P=Q\mathrel{\vphantom{\parallel}{}_{X}\mathord{\parallel_{Y}}}R$, we introduce a fresh event $a$ to represent a generic event from the shared alphabet, and form the process $P^{\prime}=Q^{\prime}\mathrel{\vphantom{\parallel}{}_{X^{\prime}}\mathord{\parallel_{Y^{\prime}}}}R^{\prime}$, where $Q^{\prime}=Q\mathchar 91\relax\mkern-2.0mu\mathchar 91\relax\{(x,x),(x,a):x\in X\}\mathchar 93\relax\mkern-2.0mu\mathchar 93\relax$, $X^{\prime}=X\cup\{a\}$, and similarly for $R^{\prime}$ and $Y^{\prime}$. Conflicts of $P$ now correspond to revivals $(s,X\cap Y,a)$, where $s$ is a trace not containing $a$.

7 Timed Failures and Timed CSP

Timed CSP is a notation which adds a $WAIT\;t$ construct to CSP and reinterprets how processes behave in a timed context. So not only does it constrain the order that things happen, but also when they happen. Introduced in [26], it has been widely used and studied [28, 27, 4]. $WAIT\>t$ behaves like $SKIP$ except that termination takes place exactly $t$ time units after it starts. It introduced and uses the vital principle of maximal progress, namely that no action that is not waiting for some other party’s agreement is delayed: such actions do not sit waiting while time passes. That principle fundamentally changes the nature of its semantic models.

Consider how the hiding operator is defined. It is perfectly legitimate to have a process $P$ that offers the initial visible events $a$ and $b$ for an indefinite length of time, say $P=a\mathrel{\rightarrow}P1\mathrel{{\Box}}b\mathrel{\rightarrow}P2$. However $P\mathrel{\mathchar 622\relax}\{a\}$ cannot perform the initial $b$ at any time other than the very beginning because the $a$ has become a $\tau$. So $P\mathrel{\mathchar 622\relax}X$ only uses those behaviours of $P$ which refuse $X$ whenever time is passing.

Timed CSP was originally described on the basis of continuous (non-negative real) time values. The basic unit of semantic discourse is a timed failure, the coupling of a timed trace – a sequence of events with non-strictly increasing times – and a timed refusal, which is the union of a suitably finitary products of a half-open time interval $[t_{1},t_{2})$ (containing $t_{1}$ but not $t_{2}$) and a set of events. Thus the refusal set changes only finitely often in a finite time, coinciding with the fact that a process can only perform finitely many actions in this time. This continuous model of time takes it well outside the finitary world that model checking finds comfortable. However it has long been known that restricting the $t$ in $WAIT\;t$ statements to integers makes it susceptible to a much more finitary analysis by region graphs [9]. However the latter represents a technique remote from the core algorithms of FDR so it has never been implemented for CSP, though it has for other notations [10]. In [15, 14], Joel Ouaknine made the following important discoveries:

• •

It makes sense to interpret Timed CSP with integer $WAIT$ over the positive integers as time domain.

• •

The technique of digitisation (effectively a uniform mapping of general times to integers) provides a natural mapping between these two representations.

• •

Properties that are closed under inverse digitisation can be decided over continuous Timed CSP by analysis over Discrete Timed CSP, and these include many practically important specifications.

• •

It is in principle possible to interpret Discrete Timed CSP in a modified (by the addition of two new operators) $tock$-CSP (a dialect developed by Roscoe in the early 1990’s for reasoning about timed systems in FDR) and therefore in principle it is possible to reason about continuous Timed CSP in FDR. The definition of Timed CSP hiding over LTSs involves prioritising $\tau$ and over $tock$.

This was implemented as described in in [2], originally in the context of the last versions of FDR2 and Timed CSP continues to be supported in FDR4. There is an important thing missing from these implementations, however, namely refinement checking in the Timed Failures Model, the details of which we describe below. That means that although it is possible to check properties of complete Timed CSP systems, there is no satisfactory compositional theory for (Discrete) Timed CSP. For example one cannot automate the reasoning that if $C[P,Q]$ (a term in Timed CSP) satisfies $SPEC$, and $P\sqsubseteq P^{\prime}$ and $Q\sqsubseteq Q^{\prime}$ then $C[P^{\prime},Q^{\prime}]$ satisfied $SPEC$, because FDR does not give us a means of checking the necessary refinements.

The purpose of this section is to show how Timed Failures refinement can be reduced to things FDR can do, filling this hole. Given the methods described in this paper to date, it is natural to try model shifting, and we will do this below. There is another option offered to us by late versions of FDR2, namely reduction to the Refusal Testing model which is implemented in that but not (at the time of writing) later versions of FDR. We will discuss these in turn.

7.1 A summary of Discrete Timed Failures

The Discrete Timed Failures model $\cal D$ consists, in one presentation, of sequences of the form

[TABLE]

where each of $s_{i}$ is a member of $\Sigma^{*}$, each of $X_{i}$ is a subset of $\Sigma$, and $tock\not\in\Sigma$. Since $tock$ never happens from an unstable state, there is no need to have the possibility of $\bullet$ as discussed above for other models before $tock$, and it would be misleading to have it. We do however allow $\bullet$ for $X_{n}$.

What this means, of course, is that the trace $s_{0}$ occurs, after which it reaches a stable state where $tock$ occurs, and this is repeated for other $s_{i}$ and $X_{i}$ until, after the last $tock$, the trace $s_{n}$ is performed followed by the refusal $x_{n}$ (not including $tock$) or potentially instability. Recall that we apply the principle of maximal progress, so that $tock$ only happens from a stable state: this means that if, after behaviour $\ldots s_{n}$, stability is not observable, then $tock$ can never happen and we have reached an error state. It is, however, convenient to have this type of error state in our model because misconstrued systems can behave like this.

Like other CSP models, it has healthiness conditions, or in other words properties that the representation of any real process must satisfy. These are analogous to those of related untimed models, such as prefix closure and subset closure on refusal sets, and the certain refusal of impossible events. A property that it inherits from continuous Timed CSP is no instantaneous withdrawal, meaning that if, following behaviour $\beta$, it is impossible for a process to refuse $a$ leading up to the next $tock$, then the process must still have the possibility of performing $a$ after $\beta\langle tock\rangle$. This amounts to the statement that the passage of time as represented by $tock$ is not directly visible to the processes concerned, and is much discussed in the continuous context in [17, 25].

$\cal{D}$ is a rational model, since it can be obtained from the standard representation of $\mathcal{RT}$ by the rational transduction which deletes all refusal sets preceding events other than $tock$ (and replaces non-terminal occurences of $\mathrel{\mathchar 527\relax}$ by $\emptyset$, since $tock$ can only occur in stable states). Hence by Theorem 1 it can be model shifted: there exists a context $\mathcal{C}_{\mathcal{D}}$ such that trace refinement under $\mathcal{C}_{\mathcal{D}}$ is equivalent to refinement in $\cal{D}$.

The operational semantics of Discrete Timed CSP processes, under the transformation described and implemented in [2]. Have the property that $tock$ is available in every stable state and no unstable state.

7.2 Model shifting Timed Failures

We can capture this through model shifting by introducing a primed copy $a^{\prime}$ of each $a\in\Sigma$ and using the following construct involving a regulator which ensures that an ordinary event cannot follow a refusal flag. This means that its traces consist of pairs of traces of $\Sigma$ and traces of $\Sigma^{\prime}$ (which can be empty) interspersed with a $tock$ between consecutive pairs.

[TABLE]

and $a^{\prime}<a$ (as well as the implicit $a^{\prime}<\tau$) for each $a\in\Sigma$.

We have assumed here that any prioritisation needed to ensure maximal progress has already been applied before this, so that the LTS being operated on here has the correct behaviour under a normal interpretation.

Note that this regulator allows only allows refusal events and $tock$ after refusal events $a^{\prime}$, thus forcing the decorated traces (namely combinations of real events and the $a^{\prime}$ ones signifying refusals) to exactly follow the structure set out for timed failures above. Thus aside from the exact structure of the model, we have followed the same procedure as that used for the stable failures model above.

Note that

• •

Events in $\Sigma$ cannot follow refusal (primed events); only other primed events or $tock$.

• •

There would have been no harm in using the $stab$ event seen for stable failures (perhaps most elegantly so that it can only happen as the last event), but for Timed CSP processes this would make no difference to the equivalence or refinement relations induced. This is because $stab$ would be possible after a trace if and only if $tock$ is.

• •

Timed Failures refinement between two Timed CSP processes is decided by traces refinement between the decorated and regulated transformed processes as defined above. Thus it does not matter (when using them for this purpose) that the regulator adds in further refusals not possible for the original process (namely, after any $a^{\prime}$ event, the regulated process refuses the whole of $\Sigma$.

7.3 Reducing Timed Failures to refusal testing

In effect the Timed Failures model is the refusal testing model with all refusal sets that precede a non-$tock$ event ignored. If follows that if we can create a context $C[\cdot]$ in CSP such that $C[P]$ contains precisely the behaviours of $P$ that should not be forgotten, then we can state that $C[P]\sqsubseteq_{RT}C[Q]$ if and only if $P\sqsubseteq_{TF}Q$.

This seems difficult, not least because when observing $P$ refusing something, we cannot stop it performing any action other than $tock$ without affecting the refusal itself. We can again solve this by use of a regulator process which allows any $\Sigma$ event to happen at any time from an unstable state and carry on, or from a stable state allow any $\Sigma$ event leading to the divergent process $DIV$, or $tock$ after which the regulator just carries on.

[TABLE]

$REGP$ is thus a three-state process: in the initial state all the $\Sigma$ events can happen as can a $\tau$ taking it to the second and stable state. The third state is $DIV$. Note how unstable states and the fact that $DIV$ is refinement-maximal in the model are crucial in making this construction work. As before, this regulator is synchronised with $P$ to perform the transformation.

So we have defined a projection

[TABLE]

This and $MSTF(P)$ are thus faithful representations of the timed failures semantics of $P$ in two different models. They can be used for comparisons under refinement in these models.

Because $\Pi_{TF}$ simply records behaviours with refusals before members of $\Sigma$ from all processes, we notice that in general

[TABLE]

8 Case study: Timed Sliding Window Protocol

The sliding window protocol has long been used as a case study with FDR: it is well known and reasonably easy to understand, at least in an untimed setting. It is a development of the alternating bit protocol in which the messages in a fixed-length window on the input stream are simultaneously available for transmission and acknowledgement across an erroneous medium which, in our version, can lose and duplicate messages but not re-order them. We have re-interpreted this in Timed CSP with the following features:

• •

There is a parameter $W$ which defines the width of the window. Because the windows held by the sender and receiver processes may be out of step, we need to define $B=2W$ to be the bound on the amount of buffering the system can provide.

• •

In common with other CSP codings of this protocol, we need to make the indexing space of places in the input and output streams finite by replacing the natural non-negative integers by integers modulo some $N$ which must be at least $2W$ (though there is no requirement that $B$ and $N$ are the same). This is sufficient to ensure that acknowledgement tags never get confused as referring to the wrong message.

• •

Round robin sending of message components from unacknowledged items in the current window: this clearly has a bearing on the timing behaviour of the transmission and acknowledgements that the system exhibits.

• •

The occurrence of errors is limited by a parameter which forces them to be spaced: at least $K$ time units must pass between consecutive ones. To achieve this elegantly we have used the controlled error model [18] in which errors are triggered by events that can be restricted by external regulators, and then lazily abstracted. It turns out that lazy abstraction (originally proposed in [18]) needs reformulating in Timed CSP. We will detail this below.

Clearly it would be possible to use different error assumptions.

• •

We have assumed for simplicity that all ordinary actions take one time unit to complete.

• •

Where a message is duplicated, we need to assume that the duplicate is available reasonably quickly, say within 2 time units of the original send. If it can be deferred indefinitely this causes subtle errors in the sense that deferred duplication can prevent the system from settling sufficiently.

We can create a Timed Failures specification in CSP which says, following established models for regular CSP, that the resulting system is a buffer bounded by $B$ (so it never contains more than $B$ items) but is only obliged to input when it has nothing in it. Whenever it is nonempty it is obliged to output, but these two obligations do not kick in before some parameter $D$ time units from the previous external communication.

This is slightly trickier than we might think because of the way in which the implementation process can entirely legitimately change its behaviour over time. So in an interval where it can legitimately accept or refuse an input $left.1$, at one point it can refuse to communicate it, while later accepting it after time has passed.

In hand-coded $tock$-CSP this can be expressed as

TFBUFF(n) = let TFB(s,k) = if k < n then ((#s>0 & right!head(s) -> TFB(tail(s),0) [] #s<B & left?x -> TFB(s^<x>,0)) [> tock -> TFB(s,k+1)) else ((#s>0 & right!head(s) -> TFB(tail(s),0)) [] (#s==0 & left?x -> TFB(<x>,0)) [] ((#s>0 and #s<B) & (left?x -> TFB(s^<x>,0) [> STOP)) [] tock -> TFB(s,k)) within TFB(<>,0)

This says that if we have not yet reached the point where offers must be made (i.e. k < n) then it can perform permitted actions but can (expressed via [> or sliding choice) also refuse them and wait for time to pass.

In Timed CSP a completely equivalent specification can be divided into three separate parts: one to control the buffer behaviour, one to handle what the specification says about when offers must be made as opposed to can be made, and the final one to control nondeterminism by creating the most nondeterministic timed process on a given alphabet. The last of these is notably trickier than in the untimed world because where a process has the choice, over a period, to accept or refuse an event $b$, it is not sufficient for it to make the choice once and for all. So we have

TCHAOS(A) = let onestep = ([] x:A @ x -> onestep) [> WAIT(1) within onestep;TCHAOS(A) Ψ

In Timed CSP lazy abstraction needs to be formulated with this revised $Chaos$ definition

LAbs(A)(P) = (P [|A|] TCHAOS(A))\A

noting that the passage of time ($tock$) is implicitly synchonised here as well as $A$, and priority of $\tau$ over $tock$ will also apply.

In the main part of the buffer specification we do not create this style of nondeterminism, but instead use two variants of the externally visible events: one that will be made nondeterministic by the above and one that will not:

TFB(s) = (#s>0 & right!head(s) -> TFB(tail(s))) [] (#s>0 & rightnd!head(s) -> TFB(tail(s))) [] (#s==0 & left?x -> TFB(<x>)) [] (#s<B & (leftnd?x -> TFB(s^<x>)))

The above always allows the nondeterministic variants of the events, and allows the ”deterministic” ones when they should be offered if sufficient time has passed since the last visible event. Thus left is only offered deterministically when the buffer is empty, no matter how long since the last event.

The choice over whether the offers available must be made, implemented by allowing the deterministic versions of events, is made by the following process

TEnable(E,R,m) = let Rest = diff(R,E) En = [] x:R @ x -> Dis(m) Dis(k) = if k==0 then En else (([] x:Rest @ x -> Dis(m)) [] WAIT(1);Dis(k-1)) within Dis(m)

The three parameters here are the events that are enabled when there has been sufficient delay (here {|left,right|}), the ones that reset the clock (here {|left,right,leftng,rightnd|} and the time by which offers have to be made. The full specifiation is put together by combining the above process, TFB(<>) and TCHAOS({|leftnd,rightnd|}) and renaming leftnd, rightnd to respectively left, right.

Given the subtlety of the above and the fact that it is hard to be sure that TBUFF is right when it is written in $tock$ CSP rather than Timed CSP, it is reassuring that FDR readily proves that the two versions of the specification are equivalent in the Timed Failures model.

The authors have run a number of checks of versions of the Timed CSP version of the protocol against this and other specifications. When compared against FDR’s inbuilt stable failures refinement (a less discerning one than timed failures, so not always producing the same results) the overheads were low, typically about 50% states and time.

8.1 Experiments

Files illustrating this section can be downloaded666http://www.cs.ox.ac.uk/people/publications/personal/Bill.Roscoe.html.

The following reports on the check of the Timed CSP sliding window protocol with two items of $DATA$ and a window of width $4$ against the specification that says it is an $8$-bounded buffer when there is a minimum time between errors of $3$. It is specified to make stable offers by 42 time units. (In general the longer between errors, the faster the system makes settled offers.)

The first check does this by model shifting, but it fails when the check is nearly complete because it can fail to have the offer ready on time. In fact the corresponding check is passed when 42 is replaced by 45 (but not 44).

assert CTFMS(TFBUFF(42)) [T= CTFMS(TLAbs({loss,dup})(ELSYSTEM(3)))

The statistics from this check were as follows:

Visited 49,239,989 states and 166,698,488 transitions in 118.91 seconds (on ply 261

The following is a failures check of the same system without model shifting, which happens to find the same problem.

assert TFBUFF(42) [F= TLAbs({loss,dup})(ELSYSTEM(3))

Visited 41,779,778 states and 107,648,549 transitions in 81.64 seconds (on ply 261)

The following are the statistics from the same check simplified to a no-model shifting traces check, which does not find the problem, and so passes.

Visited 15,413,107 states and 36,428,632 transitions in 19.71 seconds (on ply 186)

The smaller state count here is probably mainly because the normalised specification in this final case is significantly smaller, as the count-down to forcing an offer is irrelevant to traces.

It is noteworthy that the overhead of model shifting (relatively speaking) is here less than reported earlier for the untimed case. We expect this is explained because the unshifted checks in the timed case already contain (timed) prioritisation before it is applied as part of model shifting.

The experiments in this section were performed on a MacBook with a 2.7GHz Intel Core i7 processor.

9 Conclusions

We have seen how the expressive power of CSP, particularly when extended by priority, allows seemingly any finite behaviour model of CSP to be reduced to traces. Indeed this extends to any finitely expressed rules for what can be observed within finite linear behaviours, whether the resulting equivalence is compositional or not.

This considerably extends the range of what can be done with a tool like FDR. The final section shows an alternative approach to this, namely reducing a less discerning model to a more discerning one without priority. This worked well for reducing timed failures to refusal testing, but other reductions (for example ones involving both acceptances and refusal sets) do not always seem to be so efficient. For example reducing a refusal sets process to the acceptances model seems unnecessarily complex as, for example, the process $CHAOS$ needs exponentially many acceptance sets where a single maximal refusal suffices.

We discovered that it is entirely practical to use this technique to reason about large systems. Furthermore the authors have found that the debugging feedback that FDR gives to model shifting checks is very understandable and usable.

In particular the authors were pleased to find that the results of this paper make automated reasoning about Timed CSP practical. They have already found it most informative about the expressive power of the notation. It seems possible that, as with untimed CSP, the availability of automated refinement checking will bring about enrichments in the notations of Timed CSP that help it in expressing practical systems and specifications.

Model shifting means that it is far easier to experiment with automated verification in a variety of semantic models, so it will only very occasionally be necessary for a new one to be directly supperted.

We believe that similar considerations will apply to classes of models that include infinite observations such as divergences, infinite traces, where these can be extended to incorporate refusals and acceptances as part of such observations. In such cases we imagine that model shifting will take care of the aspects of infinite behaviours that are present in their finite prefixes, and that the ways that infinitary aspects are handled will follow one of the three traces models available in CSP. These are

• •

finite traces (used in the present paper),

• •

divergence-strict finite and infinite traces, so as soon as an observation is made that can be followed by immediate divergence, we deem all continuations to be in the process model whether or not the process itself can do them operationally, and finally

• •

with full divergence strictness replaced by the weak divergence strictness discussed in [19] (here an infinite behaviour with infinitely many divergent prefixes is added as above).

Thus it should be possible to handle virtually the entire hierarchy of models described in [21] in terms of variants on traces and model shifting. This will be the subject of future research.

Acknowledgements

The authors are grateful to Tom Gibson-Robinson for helpful discussions and practical assistance with FDR4. This work has been partially sponsored by DARPA under agreement number FA8750-12-2-0247 and by a grant from EPSRC.