Taming Concurrency for Verification Using Multiparty Session Types (Technical Report)

TL;DR

This paper introduces a method to simplify the verification of concurrent distributed systems by transforming them into sequential and independent components, enabling more efficient analysis of properties involving concrete data.

Contribution

It proposes a novel approach to sequentialize well-typed systems guided by global types, facilitating verification of data-dependent properties beyond traditional session types.

Findings

Reduces concurrency to sequential and independent parallel compositions

Enables efficient verification of data-based termination properties

Improves analysis of concrete run properties in distributed systems

Abstract

The additional complexity caused by concurrently communicating processes in distributed systems render the verification of such systems into a very hard problem. Multiparty session types were developed to govern communication and concurrency in distributed systems. As such, they provide an efficient verification method w.r.t. properties about communication and concurrency, like communication safety or progress. However, they do not support the analysis of properties that require the consideration of concrete runs or concrete values of variables. We sequentialise well-typed systems of processes guided by the structure of their global type to obtain interaction-free abstractions thereof. Without interaction, concurrency in the system is reduced to sequential and completely independent parallel compositions. In such abstractions, the verification of properties such as e.g. data-based termination that are not covered by multiparty session types, but rely on concrete runs or values of variables, becomes significantly more efficient.

Equations

$$G$$

$$T$$

$$\begin{array}[]{c}\left(\mathrm{r}_{1}\rightarrow\mathrm{r}_{2}\mathbin{:}\left\{\mathsf{l}_{i}\!\left<\tilde{\mathsf{U}}_{i}\right>\!.G_{i}\right\}_{i\in\mathrm{I}}\right)\restriction\mathrm{p}=\begin{cases}\left[\mathrm{\mathrm{r}_{2}}\right]!\left\{\mathsf{l}_{i}\!\left<\tilde{\mathsf{U}}_{i}\right>\!.\left(G_{i}\restriction\mathrm{p}\right)\right\}_{i\in\mathrm{I}}&\text{if }\mathrm{p}=\mathrm{r}_{1}\neq\mathrm{r}_{2}\\ \left[\mathrm{\mathrm{r}_{1}}\right]?\left\{\mathsf{l}_{i}\!\left<\tilde{\mathsf{U}}_{i}\right>\!.\left(G_{i}\restriction\mathrm{p}\right)\right\}_{i\in\mathrm{I}}&\text{if }\mathrm{p}=\mathrm{r}_{2}\neq\mathrm{r}_{1}\\ \bigsqcup_{\mathrm{p},i\in\mathrm{I}}\left(G_{i}\restriction\mathrm{p}\right)&\text{if }\mathrm{p}\notin\left\{\mathrm{r}_{1},\mathrm{r}_{2}\right\}\end{cases}\\ \left(G_{1},G_{2}\right)\restriction\mathrm{p}=\begin{cases}G_{i}\restriction\mathrm{p}&\text{if }\mathrm{p}\in G_{i}\text{ and }\mathrm{p}\notin G_{j},i\neq j\in\left\{1,2\right\}\\ \textnormal{{end}}&\text{if }\mathrm{p}\notin G_{1}\text{ and }\mathrm{p}\notin G_{2}\end{cases}\\ \left(\left(\mu\mathrm{t}\right)G\right)\restriction\mathrm{p}=\left(\mu\mathrm{t}\right)\left(G\restriction\mathrm{p}\right)\hskip 20.00003pt\mathrm{t}\restriction\mathrm{p}=\mathrm{t}\hskip 20.00003pt\textnormal{{end}}\restriction\mathrm{p}=\textnormal{{end}}\end{array}$$

$$\underset{\mathrm{p},i\in \left\{1,\dots ,n\right\}}{⨆}\left(G_i\upharpoonright \mathrm{p}\right)=\left(G_1\upharpoonright \mathrm{p}\right){\bigsqcup }_{\mathrm{p}}\dots {\bigsqcup }_{\mathrm{p}}\left(G_n\upharpoonright \mathrm{p}\right)$$

$$T{\bigsqcup }_{\mathrm{p}}T$$

$$\left(\left[\mathrm{rmissing}\right]?{\mathrm{I}}_1\right){\bigsqcup }_{\mathrm{p}}\left(\left[\mathrm{rmissing}\right]?{\mathrm{I}}_2\right)$$

$$\mathrm{I}{\bigsqcup }_{\mathrm{p}}\varnothing$$

$$\mathrm{I}{\bigsqcup }_{\mathrm{p}}\left(\left\{\mathsf{l}⟨\tilde{\mathsf{U}}⟩.T\right\}\cup \mathrm{J}\right)$$

$$\{\begin{array}{ll}\left\{\mathsf{l}⟨\tilde{\mathsf{U}}⟩.\left(T^{\prime }{\bigsqcup }_{\mathrm{p}}T\right)\right\}\cup \left(\left(\mathrm{I}\setminus \left\{\mathsf{l}⟨\tilde{\mathsf{U}}⟩.T^{\prime }\right\}\right){\bigsqcup }_{\mathrm{p}}\mathrm{J}\right)& \text{if }\mathsf{l}⟨\tilde{\mathsf{U}}⟩.T^{\prime }\in \mathrm{I}\\ \left\{\mathsf{l}⟨\tilde{\mathsf{U}}⟩.T\right\}\cup \left(\mathrm{I}{\bigsqcup }_{\mathrm{p}}\mathrm{J}\right)& \text{if }\mathsf{l}\notin \mathrm{I}\end{array}$$

$$T_{\mathrm{A}}$$

$$\displaystyle\hskip 20.00003pt\big{(}\left[\mathrm{B2}\right]?\big{\{}\begin{array}[t]{l}\mathsf{bid}\!\left<\mathsf{Int}\right>\!.\left[\mathrm{B1}\right]!\mathsf{l}\!\left<\mathsf{Int}\right>\!.\left[\mathrm{B1}\right]?\{\begin{array}[t]{l}\mathsf{bid}\!\left<\mathsf{Int}\right>\!.\left[\mathrm{B2}\right]!\mathsf{l}\!\left<\mathsf{Int}\right>\!.\mathrm{t},\\ \mathsf{no}\!\left<\right>\!.\left[\mathrm{B2}\right]!\mathsf{s}\!\left<\mathsf{Int}\right>\!.\textnormal{{end}}\},\end{array}\\ \mathsf{no}\!\left<\right>\!.\left[\mathrm{B1}\right]!\mathsf{s}\!\left<\mathsf{Int}\right>\!.\textnormal{{end}}\big{\}}\big{)}\end{array}$$

$$T_{B1}$$

$$T_{B2}$$

$$P$$

$$|\text{if }\mathsf{c}\text{ then }{P}_1\text{ else }{P}_2|P_1\mid P_2|0|\left(\nu \mathsf{s}\right)P|\left(\mu \mathrm{X}\right)P|\mathrm{X}$$

$$\begin{array}[]{c}P\mid\mathbf{0}\equiv P\hskip 20.00003ptP_{1}\mid P_{2}\equiv P_{2}\mid P_{1}\hskip 20.00003ptP_{1}\mid\left(P_{2}\mid P_{3}\right)\equiv\left(P_{1}\mid P_{2}\right)\mid P_{3}\\ \left(\mu\mathrm{X}\right)P\equiv P\left\{\nicefrac{{\left(\mu\mathrm{X}\right)P}}{{\mathrm{X}}}\right\}\hskip 20.00003pt\left(\nu\mathsf{s}\right)\!\left(\nu\mathsf{s}^{\prime}\right)\!P\equiv\left(\nu\mathsf{s}^{\prime}\right)\!\left(\nu\mathsf{s}\right)\!P\hskip 20.00003pt\left(\nu\mathsf{s}\right)\!\mathbf{0}\equiv\mathbf{0}\\ \left(\nu\mathsf{s}\right)\!\left(P_{1}\mid P_{2}\right)\equiv P_{1}\mid\left(\nu\mathsf{s}\right)\!P_{2}\quad\text{if }\mathsf{s}\notin\mathsf{fn}\!\left(P_{1}\right)\end{array}$$

$$\begin{array}[]{c}\left(\textsf{Link}\right)\dfrac{}{\overline{\mathsf{a}}\!\left[\mathrm{\mathrm{2}..\mathrm{n}}\right]\!\left(\mathsf{s}\right)\!.P_{1}\mid\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{2}}\right]\right)\!.P_{2}\mid\ldots\mid\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{n}}\right]\right)\!.P_{n}\longmapsto\left(\nu\mathsf{s}\right)\!\left(P_{1}\mid P_{2}\mid\ldots\mid P_{n}\right)}\vspace{0.75em}\\ \left(\textsf{Com}\right)\dfrac{j\in\mathrm{I}missing}{\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}},\mathrm{\mathrm{r}_{2}}\right]!\mathsf{\mathsf{l}_{j}}\!\left<\tilde{\mathsf{e}}\right>\!.P\mid\mathsf{s}\!\left[\mathrm{\mathrm{r}_{2}},\mathrm{\mathrm{r}_{1}}\right]?\left\{\mathsf{\mathsf{l}_{i}}\!\left(\tilde{x}_{i}\right)\!.P_{i}\right\}_{i\in\mathrm{I}}\longmapsto P\mid\left(P_{j}\left\{\nicefrac{{\tilde{\mathsf{e}}}}{{\tilde{x}_{j}}}\right\}\right)}\vspace{0.75em}\\ \left(\textsf{If-T}\right)\dfrac{\mathsf{c}missing}{\textnormal{{if }}\mathsf{c}\textnormal{{ then }}P_{1}\textnormal{{ else }}P_{2}\longmapsto P_{1}}\hskip 15.00002pt\left(\textsf{If-F}\right)\dfrac{\neg\mathsf{c}missing}{\textnormal{{if }}\mathsf{c}\textnormal{{ then }}P_{1}\textnormal{{ else }}P_{2}\longmapsto P_{2}}\vspace{0.75em}\\ \left(\textsf{Par}\right)\dfrac{P_{1}\longmapsto P_{1}^{\prime}}{P_{1}\mid P_{2}\longmapsto P_{1}^{\prime}\mid P_{2}}\hskip 15.00002pt\left(\textsf{Res}\right)\dfrac{P\longmapsto P^{\prime}}{\left(\nu\mathsf{s}\right)\!P\longmapsto\left(\nu\mathsf{s}\right)\!P^{\prime}}\vspace{0.75em}\\ \left(\textsf{Struc}\right)\dfrac{P_{1}\equiv P_{2}\quad P_{2}\longmapsto P_{2}^{\prime}\quad P_{2}^{\prime}\equiv P_{1}^{\prime}}{P_{1}\longmapsto P_{1}^{\prime}}\end{array}$$

$$\Gamma$$

$$\Delta$$

$$\begin{array}[]{c}\left(\textsf{Req}\right)\dfrac{\mathsf{r}\!\left(G\right)=\left\{1,\ldots,n\right\}\quad\Gamma,\mathsf{a}\mathbin{:}G\!\left<\mathsf{s}\right>\vdash P\triangleright\Delta,\mathsf{s}\!\left[\mathrm{1}\right]\mathbin{:}G\restriction\mathrm{1}missing}{\Gamma,\mathsf{a}\mathbin{:}G\vdash\overline{\mathsf{a}}\!\left[\mathrm{\mathrm{2}..\mathrm{n}}\right]\!\left(\mathsf{s}\right)\!.P\triangleright\Delta,\mathsf{a}\!\left<\mathrm{1}\right>}\vspace{0.75em}\\ \left(\textsf{Acc}\right)\dfrac{\mathrm{r}\in\mathsf{r}\!\left(G\right)\quad\Gamma,\mathsf{a}\mathbin{:}G\!\left<\mathsf{s}\right>\vdash P\triangleright\Delta,\mathsf{s}\!\left[\mathrm{r}\right]\mathbin{:}G\restriction\mathrm{r}missing}{\Gamma,\mathsf{a}\mathbin{:}G\vdash\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{r}missing}\right]\right)\!.P\triangleright\Delta,\mathsf{a}\!\left<\mathrm{r}\right>}\vspace{0.75em}\\ \left(\textsf{Send}\right)\dfrac{j\in\mathrm{I}\quad\Gamma\Vdash\tilde{\mathsf{e}}\mathbin{:}\tilde{\mathsf{U}}_{j}\quad\Gamma\vdash P\triangleright\Delta,\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}}\right]\mathbin{:}T_{j}missing}{\Gamma\vdash\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}},\mathrm{\mathrm{r}_{2}}\right]!\mathsf{\mathsf{l}_{j}}\!\left<\tilde{\mathsf{e}}\right>\!.P\triangleright\Delta,\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}}\right]\mathbin{:}\left[\mathrm{\mathrm{r}_{2}}\right]!\left\{\mathsf{l}_{i}\!\left<\tilde{\mathsf{U}}_{i}\right>\!.T_{i}\right\}_{i\in\mathrm{I}}missing}\vspace{0.75em}\\ \left(\textsf{Get}\right)\dfrac{\mathrm{I}\subseteq\mathrm{J}\quad\forall i\in\mathrm{I}.\;\Gamma,\tilde{x}_{i}\mathbin{:}\tilde{\mathsf{U}}_{i}\vdash P_{i}\triangleright\Delta,\mathsf{s}\!\left[\mathrm{\mathrm{r}_{2}}\right]\mathbin{:}T_{i}missing}{\Gamma\vdash\mathsf{s}\!\left[\mathrm{\mathrm{r}_{2}},\mathrm{\mathrm{r}_{1}}\right]?\left\{\mathsf{\mathsf{l}_{j}}\!\left(\tilde{x}_{j}\right)\!.P_{j}\right\}_{j\in\mathrm{J}}\triangleright\Delta,\mathsf{s}\!\left[\mathrm{\mathrm{r}_{2}}\right]\mathbin{:}\left[\mathrm{\mathrm{r}_{1}}\right]?\left\{\mathsf{l}_{i}\!\left<\tilde{\mathsf{U}}_{i}\right>\!.T_{i}\right\}_{i\in\mathrm{I}}missing}\hskip 20.00003pt\left(\textsf{End}\right)\dfrac{}{\Gamma\vdash\mathbf{0}\triangleright\emptyset}\vspace{0.75em}\\ \left(\textsf{Cond}\right)\dfrac{\Gamma\vdash P_{1}\triangleright\Delta\quad\Gamma\vdash P_{2}\triangleright\Delta}{\Gamma\vdash\textnormal{{if }}\mathsf{c}\textnormal{{ then }}P_{1}\textnormal{{ else }}P_{2}\triangleright\Delta}\hskip 20.00003pt\left(\textsf{Par}\right)\dfrac{\Gamma\vdash P_{1}\triangleright\Delta_{1}\quad\Gamma\vdash P_{2}\triangleright\Delta_{2}}{\Gamma\vdash P_{1}\mid P_{2}\triangleright\Delta_{1}\otimes\Delta_{2}}\vspace{0.75em}\\ \left(\textsf{Res}\right)\dfrac{\Delta,\mathsf{s}\!\left[\mathrm{1}\right]\mathbin{:}G\restriction\mathrm{1},\ldots,\mathsf{s}\!\left[\mathrm{n}\right]\mathbin{:}G\restriction\mathrm{n}\longmapsto^{*}\Delta^{\prime}\quad\mathsf{r}\!\left(G\right)=\left\{\mathrm{1},\ldots,\mathrm{n}\right\}\quad\Gamma,\mathsf{a}\mathbin{:}G\!\left<\mathsf{s}\right>\vdash P\triangleright\Delta^{\prime}}{\Gamma,\mathsf{a}\mathbin{:}G\vdash\left(\nu\mathsf{s}\right)\!P\triangleright\Delta,\mathsf{a}\!\left<\mathrm{1}\right>,\ldots,\mathsf{a}\!\left<\mathrm{n}\right>}\vspace{0.75em}\\ \left(\textsf{Rec}\right)\dfrac{\Gamma,\mathrm{X}\mathbin{:}\Delta\vdash P\triangleright\Delta}{\Gamma\vdash\left(\mu\mathrm{X}\right)P\triangleright\Delta}\hskip 20.00003pt\left(\textsf{Var}\right)\dfrac{}{\Gamma,\mathrm{X}\mathbin{:}\Delta\vdash\mathrm{X}\triangleright\Delta}\end{array}$$

$$\displaystyle\left(\textsf{Com'}\right)\dfrac{j\in\mathrm{I}missing}{\begin{array}[]{l}\Delta,\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}}\right]\mathbin{:}\left[\mathrm{\mathrm{r}_{2}}\right]!\left\{\mathsf{l}_{i}\!\left<\tilde{\mathsf{U}}_{i}\right>\!.T_{i}\right\}_{i\in\mathrm{I}},\mathsf{s}\!\left[\mathrm{\mathrm{r}_{2}}\right]\mathbin{:}\left[\mathrm{\mathrm{r}_{1}}\right]?\left\{\mathsf{l}_{i}\!\left<\tilde{\mathsf{U}}_{i}\right>\!.T_{i}^{\prime}\right\}_{i\in\mathrm{I}}\\ \longmapsto\Delta,\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}}\right]\mathbin{:}T_{j},\mathsf{s}\!\left[\mathrm{\mathrm{r}_{2}}\right]\mathbin{:}T_{j}^{\prime}\end{array}}$$

$$\left(\text{Cut}\right)\frac{\varnothing \subset \mathrm{J}\subseteq \mathrm{I}missing}{\Delta ,\mathsf{s}\left[{\mathrm{r}}_2\right]:\left[{\mathrm{r}}_1\right]?{\left\{{\mathsf{l}}_i⟨{\tilde{\mathsf{U}}}_i⟩.T_i^{\prime }\right\}}_{i\in \mathrm{I}}⟼\Delta ,\mathsf{s}\left[{\mathrm{r}}_2\right]:\left[{\mathrm{r}}_1\right]?{\left\{{\mathsf{l}}_i⟨{\tilde{\mathsf{U}}}_i⟩.T_i^{\prime }\right\}}_{i\in \mathrm{J}}missing}$$

$$P=$$

$$\mid$$

$$\displaystyle G=1\rightarrow 2\mathbin{:}\begin{array}[t]{l}\{\mathsf{y}\!\left<\mathsf{Int}\right>\!.3\rightarrow 4\mathbin{:}\left\{\mathsf{y}\!\left<\mathsf{Int}\right>\!.\textnormal{{end}},\quad\mathsf{n}\!\left<\mathsf{Int}\right>\!.\textnormal{{end}}\right\},\\ \hphantom{\{}\mathsf{n}\!\left<\mathsf{Int}\right>\!.3\rightarrow 4\mathbin{:}\left\{\mathsf{y}\!\left<\mathsf{Int}\right>\!.\textnormal{{end}},\quad\mathsf{n}\!\left<\mathsf{Int}\right>\!.\textnormal{{end}}\right\}\}\end{array}$$

$$\displaystyle\operatorname{SGP}\!\left(P,G\right)=\tau.\mathsf{if}\;x_{1}>5\begin{array}[t]{l}\mathsf{then}\;x_{2}\mathbin{:=}\mathsf{42}.\textnormal{{if }}\mathsf{x_{3}>5}\textnormal{{ then }}x_{4}\mathbin{:=}\mathsf{42}.\mathbf{0}\textnormal{{ else }}x_{4}\mathbin{:=}\mathsf{0}.\mathbf{0}\\ \mathsf{else}\;x_{2}\mathbin{:=}\mathsf{0}.\textnormal{{if }}\mathsf{x_{3}>5}\textnormal{{ then }}x_{4}\mathbin{:=}\mathsf{42}.\mathbf{0}\textnormal{{ else }}x_{4}\mathbin{:=}\mathsf{0}.\mathbf{0}\end{array}$$

$$P\equiv \left(\nu \tilde{\mathsf{s}}\right)\left(\overline{\mathsf{a}}\left[2..n\right]\left(\mathsf{s}\right).P_1\mid \mathsf{a}\left(\mathsf{s}\left[2\right]\right).P_2\mid \dots \mid \mathsf{a}\left(\mathsf{s}\left[\mathrm{n}\right]\right).P_n\mid Q\right),$$

$$P\equiv \left(\nu \tilde{\mathsf{s}}\right)\left({\mathsf{s}}_l\left[{\mathrm{r}}_1,{\mathrm{r}}_2\right]!{\mathsf{l}}_{\mathsf{m}}⟨\tilde{\mathsf{e}}⟩.P_1\mid {\mathsf{s}}_l\left[{\mathrm{r}}_2,{\mathrm{r}}_1\right]?{\left\{{\mathsf{l}}_{\mathsf{j}}\left({\tilde{x}}_j\right).P_{2,j}\right\}}_{j\in \mathrm{J}}\mid Q\right)$$

$$\begin{array}[]{c}\left(\textsf{Com}\right)\dfrac{j\in\mathrm{I}missing}{\mathrm{r}_{1}\rightarrow\mathrm{r}_{2}\mathbin{:}\left\{\mathsf{l}_{i}\!\left<\tilde{\mathsf{U}}_{i}\right>\!.G_{i}\right\}_{i\in\mathrm{I}}\longmapsto G_{j}}\vspace{0.75em}\\ \left(\textsf{Par-L}\right)\dfrac{G_{1}\longmapsto G_{1}^{\prime}}{G_{1},G_{2}\longmapsto G_{1}^{\prime},G_{2}}\hskip 20.00003pt\left(\textsf{Par-R}\right)\dfrac{G_{2}\longmapsto G_{2}^{\prime}}{G_{1},G_{2}\longmapsto G_{1},G_{2}^{\prime}}\end{array}$$

$$P=$$

$$\mid \mathsf{a}\left(\mathsf{s}\left[3\right]\right).\mathsf{s}\left[3,4\right]!\mathsf{l}⟨4⟩.0\mid \mathsf{a}\left(\mathsf{s}\left[4\right]\right).\mathsf{s}\left[3,4\right]?\mathsf{l}\left(x\right).0$$

$$⟨\left(x_2=0,x_4=0\right);S⟩⟼⟨\left(x_2=0,x_4=0\right);x_2:=5.x_4:=4.0⟩$$

$$⟼⟨\left(x_2=5,x_4=0\right);x_4:=4.0⟩⟼⟨\left(x_2=5,x_4=4\right);0⟩$$

$$P$$

$$P^{\prime }$$

$$P$$

Full text

We sequentialise well-typed systems of processes guided by the structure of their global type to obtain interaction-free abstractions thereof. Without interaction, concurrency in the system is reduced to sequential and completely independent parallel compositions. In such abstractions, the verification of properties such as e. g. data-based termination that are not covered by multiparty session types, but rely on concrete runs or values of variables, becomes significantly more efficient.

This technical report provides proofs and additional material for the paper [13].

1 Introduction

Modern society is increasingly dependent on large-scale software systems that are distributed, collaborative, and communication-centred. One of the techniques developed to handle the additional complexity caused by distributed actors are multiparty session types (MPST) [8]. MPST allow to specify the desired behaviour of communication protocols as by-design correct types that are used to verify the communication structure of software products. The properties guaranteed by well-typed processes cover communication safety (all processes conform to globally agreed communication protocols) and liveness properties such as deadlock-freedom. Their main advantage is that their verification method is extremely efficient—in comparison to e. g. standard model checking.

MPST were developed to govern communication and concurrency in distributed systems. However, as it is typical for type systems, standard MPST variants (without dependable types) do not support the analysis of properties that require the consideration of concrete runs or concrete values of variables.

The hardest part about the verification of distributed systems is the state space explosion that results from concurrent communication attempts, i. e., the exponential blow-up that results from computing all possible combinations of potential communication partners. The problem of concurrency mainly lies in the communication structure, which is already completely captured by MPST. We show that the knowledge of a program/system to be well-typed, allows us to sequentialise it following the structure of its global type and thereby to remove all communication. Accordingly, we show how we can benefit from the effort we spend on an MPST analysis of a system also for the verification of its properties that go beyond its communication structure.

We use the global type of a well-typed system to guide its sequentialisation. We refer to the result as sequential global process (SGP), although it might still contain parallel compositions, albeit only on completely independent parts. Since the structure of communication was already verified by the well-typedness proof, we can reduce communication to value updates. More precisely, we map well-typed systems that interact concurrently, to SGP-systems without any interaction mechanisms or name binders. Such SGP-systems consist of a vector of variables with values and a SGP-process that simulates the data flow of the original system. Therefore, we translate the reception of data in communication into updates of the vector in the SGP-system. By removing the communication we remove also the problem of state space explosion. Our translation is valid if the considered process is well-typed w. r. t. a (set of) global type(s). Thereby, we sequentialise communications that may happen concurrently in the original system but are sequential in global types. Note that such communications are always causally independent of each other, thus ordering them does not significantly influence the behaviour of the system, e. g. it does not influence what values are computed. Apart from such sequentialisations the original system and its abstraction into a SGP-system behave similarly.

Contributions. We provide an algorithm to remove communication from well-typed systems and thereby sequentialise them, while preserving the evolution of data of the original system. Deriving this algorithm was technically challenging but the result is a simple rewriting function and easy to automate.

Then we prove that, provided that the original system was well-typed, the algorithm produces a SGP-system that is closely related to the original system: the original system and its abstraction are related by a variant of operational correspondence [5] and are coupled similar [11]. With that, the derived SGP-system is a good abstraction of the original system that can be used instead of the original to verify properties on concrete data. Since the mapping into SGP-systems is usually linear and because SGP-systems do not contain any form of interaction or binders, properties can be checked more efficiently.

Finally, we provide a mapping—that is again a simple rewriting algorithm—from SGP-processes into Promela, the input language of the model checker Spin [7, 6]. With that, the properties that are not already guaranteed by the MPST analysis but require the consideration of concrete runs or concrete data can be checked. Since the main challenge here is the sequentialisation of concurrent systems into interaction-free abstractions, the translation of SGP-systems into Promela is simple and can be used as a role model to obtain similar mappings for other model checkers.

Overview. In Section 2 we extend Section 2 of [13] and introduce multiparty session types (including the things that are missing in [13] such as local types, projection, and typing rules). Section 2.4 proves the basic properties of the introduced type system. Section 3 of [13] introduces SGP-systems and a mapping that translates well-typed systems into SGP-systems. In Section 3 we prove the relations between the original systems and their abstractions into SGP-systems as they are described in Section 4 of [13]. Then, Section 5 of [13] illustrates how the sequentialisation can be used to verify properties of the original system. Section 4 introduces some small examples to illustrate this method.

2 Multiparty Session Types

In the following we extend Section 2 of [13]. In particular, we introduce some additional concepts of multiparty session types such as local types, derive the notion of well-typedness, and show some standard properties.

Multiparty session types describe global behaviours as sessions, i. e., units of conversations. The participants of such sessions are called roles. Global types specify protocols from a global point of view, whereas local types describe the behaviour of individual roles within a protocol. Projection ensures that a global type and its local types are consistent. These types are used to reason about processes formulated in a session calculus. Most of the existing session calculi are extensions of the well-known $\pi$-calculus [10] with specific operators adapted to correlate with local types.

Similar to [1, 14], we assume that roles, i. e., the identifiers for participants, are natural numbers. Assume a countably infinite set of names. Names are used to denote channels and variables that may stand for a channel or some value. In the session calculus we distinguish shared channels that are used outside of sessions (to initialise sessions) and session channels that are used within sessions.

2.1 Global Types, Local Types, and Projection

Global types describe protocols from a global point of view on systems by interactions between roles. They are used to formalise specifications that describe the desired properties of a system. We inherit the definition of global types from [1], but unify the transmission of values and branching into a single construct as done in [4].

Definition 1 (Global Types)

The global types are given by

[TABLE]

where $\mathrm{r}_{1},\mathrm{r}_{2}$ are roles, $\mathsf{l}_{i}$ are labels, $\tilde{\mathsf{U}}_{i}$ are sequences of sorts, $\mathrm{I}$ are non-empty finite index sets, and $\mathrm{t}$ are type variables.

The global type $\mathrm{r}_{1}\rightarrow\mathrm{r}_{2}\mathbin{:}\left\{\mathsf{l}_{i}\!\left<\tilde{\mathsf{U}}\right>\!.G_{i}\right\}_{i\in\mathrm{I}}$ specifies a communication from role $\mathrm{r}_{1}$ to $\mathrm{r}_{2}$, where $\mathrm{r}_{1}$ picks a label $\mathsf{l}_{i}$, i. e., one of the indexed set of options, transmits values of the sorts $\tilde{\mathsf{U}}_{i}$ and then the type proceeds with $G_{i}$. The parallel composition $G_{1},G_{2}$ allows to combine two independent global types $G_{1}$ and $G_{2}$, where independence means that these two global types do not share roles. The operators $\left(\mu\mathrm{t}\right)G$ and $\mathrm{t}$ introduce recursion, whereas successful termination of a global type is specified by end.

Let $\mathsf{r}\!\left(\cdot\right)$ return the roles used in a global type (or a process as introduced later).

Global types describe systems from a global point of view. To link them with the local points of view of processes they are projected onto their roles to obtain local types. Again, we use the local types of [1], where we combine communication and branching into single constructs for the sender and the receiver as done in [4].

Definition 2 (Local Types)

The local types are given by

[TABLE]

where $\mathrm{r}$ are roles, $\mathsf{l}_{i}$ are labels, $\tilde{\mathsf{U}}_{i}$ are sequences of sorts, $\mathrm{I}$ are non-empty finite index sets, and $\mathrm{t}$ are type variables.

The two local end points of communication are the types $\left[\mathrm{\mathrm{r}missing}\right]!\left\{\mathsf{l}_{i}\!\left<\tilde{\mathsf{U}}_{i}\right>\!.T_{i}\right\}_{i\in\mathrm{I}}$ for the sender, where the role $\mathrm{r}$ indicates the receiver, and $\left[\mathrm{\mathrm{r}missing}\right]?\left\{\mathsf{l}_{i}\!\left<\tilde{\mathsf{U}}_{i}\right>\!.T_{i}\right\}_{i\in\mathrm{I}}$ for the receiver, where the role $\mathrm{r}$ indicates the sender. Recursion with the constructs $\left(\mu\mathrm{t}\right)T$ and $\mathrm{t}$ and successful termination represented by end are similar to global types.

The partial mapping from global types onto their roles is called projection. It is undefined for parallel global types that share a role and communications that branch such that roles that are neither the sender nor the receiver have to behave differently. The first case reflects that parallel composition on global types defines independence, i. e., parallel global types specify the behaviour of partitions of distributed systems that do not interact. The latter case ensures that if a process—the sender of this communication—decides to branch then only processes that are informed about this decision can adapt their behaviour accordingly. If for a global type $G$ projection is defined for all its roles then we call this type projectable.

Definition 3 (Projection)

Projection of a global type $G$ onto a role $\mathrm{p}$, written as $G\restriction\mathrm{p}$ is defined as:

[TABLE]

and undefined for all missing cases.

In the last case of the rule for communication—when projecting onto a role that does not participate in this communication—we map to:

[TABLE]

The operation $\sqcup_{\mathrm{p}}$ is (similar to [14]) inductively defined as:

[TABLE]

where $\mathsf{l}\notin\mathrm{I}$ is short hand for $\nexists\tilde{\mathsf{U}}^{\prime},T^{\prime}.\,\mathsf{l}\!\left<\tilde{\mathsf{U}}^{\prime}\right>\!.T^{\prime}\in\mathrm{I}$, and is undefined in all other cases.

The projection of the global type $G_{\mathrm{AS}}$ in Example 3 onto the Roles $\mathrm{A}$, $\mathrm{B1}$, and $\mathrm{B2}$ is given below by the local types $T_{\mathrm{A}}$, $T_{\mathrm{B1}}$, and $T_{\mathrm{B2}}$, respectively.

[TABLE]

2.2 Session Calculus

Global types (and the local types that are derived from them) can be considered as specifications that describe the desired properties of the considered distributed system. To analyse such systems they are implemented in a session calculus. Again we use a version of the session calculus in [1], where we unify communication and branching into a single construct as done in [4]. Moreover, instead of using different session channels, we annotate the session channel that is unique for each session with the roles (as it was done in [4, 3]).

Definition 4 (Processes)

The processes of the session calculus are given by

[TABLE]

where $\mathsf{a}$ are shared channels, $\mathrm{2},\ldots,\mathrm{n},\mathrm{r},\mathrm{r}_{1},\mathrm{r}_{2}$ are roles, $\mathsf{s}$ are session channels, $\mathsf{l},\mathsf{l}_{i}$ are labels, $\tilde{\mathsf{e}}$ are sequences of expressions to calculate values, $\tilde{x}_{i}$ are sequences of variables, $\mathrm{I}$ are non-empty finite index sets, $\mathsf{c}$ are boolean conditions, and $\mathrm{X}$ are process variables.

A process initialises a session with $\overline{\mathsf{a}}\!\left[\mathrm{\mathrm{2}..\mathrm{n}}\right]\!\left(\mathsf{s}\right)\!.P$ inviting via the shared channel $\mathsf{a}$ other processes to play the roles $\mathrm{2},\ldots,\mathrm{n}$ in a session $\mathsf{s}$, i. e., with the session channels $\mathsf{s}$. Then the inviting process itself becomes $\mathrm{1}$ in this session and proceeds after transmitting the invitations as $P$. Processes can accept such an invitation to play role $\mathrm{r}$ in a session $\mathsf{s}$ that they receive on a shared channel $\mathsf{a}$ with $\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{r}missing}\right]\right)\!.P$ and then proceed as $P$. Within session $\mathsf{s}$ role $\mathrm{r}_{1}$ can transmit to role $\mathrm{r}_{2}$ with $\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}},\mathrm{\mathrm{r}_{2}}\right]!\mathsf{\mathsf{l}missing}\!\left<\tilde{\mathsf{e}}\right>\!.P$ a label $\mathsf{l}$ and a sequence of values $\tilde{\mathsf{e}}$ and then proceed as $P$ or $\mathrm{r}_{1}$ can receive from $\mathrm{r}_{2}$ with $\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}},\mathrm{\mathrm{r}_{2}}\right]?\left\{\mathsf{\mathsf{l}_{i}}\!\left(\tilde{x}_{i}\right)\!.P_{i}\right\}_{i\in\mathrm{I}}$ one of the labels $\mathsf{l}_{i}$ from an indexed set of options together with a sequence of values to substitute $\tilde{x}_{i}$ in the continuation $P_{i}$. The conditional $\textnormal{{if }}\mathsf{c}\textnormal{{ then }}P_{1}\textnormal{{ else }}P_{2}$ allows a process to proceed as $P_{1}$ if $\mathsf{c}$ holds or else as $P_{2}$. Since we want to use the model checker Spin later, we restrict expressions $\mathsf{e}$ and conditions $\mathsf{c}$ to functions that are known by Promela, the input language of Spin. Promela captures a wide range of functions such as basic logical and arithmetical operators. With $P_{1}\mid P_{2}$ the processes $P_{1}$ and $P_{2}$ are composed in parallel. Successful termination is denoted by $\mathbf{0}$. With $\left(\nu\mathsf{s}\right)\!P$ we restrict the scope of the session channel $\mathsf{s}$ to $P$. With $\left(\mu\mathrm{X}\right)P$ we define recursion using process variables $\mathrm{X}$.

We usually omit the curly brackets in branching with only one alternative, i. e., abbreviate $\mathrm{r}_{1}\rightarrow\mathrm{r}_{2}\mathbin{:}\left\{\mathsf{l}\!\left<\tilde{\mathsf{U}}\right>\!.G\right\}$ by $\mathrm{r}_{1}\rightarrow\mathrm{r}_{2}\mathbin{:}\mathsf{l}\!\left<\tilde{\mathsf{U}}\right>\!.G$ and $\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}},\mathrm{\mathrm{r}_{2}}\right]?\left\{\mathsf{\mathsf{l}missing}\!\left(\tilde{x}\right)\!.P\right\}$ by $\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}},\mathrm{\mathrm{r}_{2}}\right]?\mathsf{\mathsf{l}missing}\!\left(\tilde{x}\right)\!.P$. We also often omit trailing $\mathbf{0}$. Throughout the paper we use ’.’ to denote sequential composition, where the part before the ’.’ is called prefix and the sub-term(s) in the scope of the ’.’ are guarded by this prefix. Moreover, conditionals guard both of their sub-terms. Similarly, we use round brackets to denote binders, where the variables (for names, types, or processes) within the brackets are bound in the following sub-term. A name is free if it is not bounded. Let $\mathsf{n}\!\left(M\right)$ denote the set of names and $\mathsf{fn}\!\left(M\right)$ denote the set of free names in $M$, where $M$ is a type or a process. We assume that all process variables in processes and type variables in types are bounded and guarded, where process variables have to be guarded by communication prefixes.

A substitution $\left\{\nicefrac{{y_{1}}}{{x_{1}}},\ldots\nicefrac{{y_{n}}}{{x_{n}}}\right\}=\left\{\nicefrac{{\tilde{y}}}{{\tilde{x}}}\right\}$ is a finite mapping from names to names, where the names in $\tilde{x}$ are pairwise distinct. The application of a substitution on a term $P\left\{\nicefrac{{\tilde{y}}}{{\tilde{x}}}\right\}$ is defined as the result of simultaneously replacing all free occurrences of $x_{i}$ by $y_{i}$, possibly applying alpha-conversion to avoid capture or name clashes. For all names $n\notin\tilde{x}$ the substitution behaves as the identity mapping. We naturally extend substitution of names to the substitution of process variables by terms.

We use structural congruence ($\equiv$) to abstract from syntactically different but semantically similar processes, where $\equiv$ is the least congruence that satisfies alpha-conversion ($\equiv_{\alpha}$) and the rules:

[TABLE]

The reduction semantics of the session calculus is given by the rules in Figure 1. The Rule Link initialises a session $\mathsf{s}$ on the roles $\mathrm{1},\ldots,\mathrm{n}$, where $\mathrm{1}$ requested the session on channel $\mathsf{a}$ and each $\mathrm{i}$ participates in the session as $P_{i}$. Communication within a session $\mathsf{s}$ is described by Rule Com, where in the case of matching roles and labels the continuations of sender and receiver are unguarded and the variables $\tilde{x}$ are replaced by the values $\tilde{\mathsf{e}}$ in the receiver. The Rules If-T and If-F reduce conditionals as expected. The remaining rules allow for steps in various contexts and are standard.

In contrast to the standard $\pi$-calculus (as e. g. in [10]) the communication prefixes of the session calculus mention an explicit acting role next to the channel, regardless whether the prefix is used to initialise a session or to transmit a message within a session.

Definition 5 (Actor)

A process $P$ has an actor on $\mathsf{c}\!\left[\mathrm{r_{1}}\right]$ if $P$ has an unguarded subterm of the form $\overline{\mathsf{\mathsf{c}}}\!\left[\mathrm{\mathrm{2}..\mathrm{n}}\right]\!\left(\mathsf{s}\right)\!.P$ with $\mathrm{r}_{1}=\mathrm{1}$ or $\mathsf{\mathsf{c}}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}}\right]\right)\!.P$ (for session invitations) or an unguarded subterm of the form $\mathsf{\mathsf{c}}\!\left[\mathrm{\mathrm{r}_{1}},\mathrm{\mathrm{r}_{2}}\right]!\mathsf{\mathsf{l}missing}\!\left<\tilde{\mathsf{e}}\right>\!.P$ or $\mathsf{\mathsf{c}}\!\left[\mathrm{\mathrm{r}_{1}},\mathrm{\mathrm{r}_{2}}\right]?\left\{\mathsf{\mathsf{l}_{i}}\!\left(\tilde{x}_{i}\right)\!.P_{i}\right\}_{i\in\mathrm{I}}$ (for communication). Let $\mathsf{act}\!\left(P\right)$ be set of actors in $P$.

If unambiguous, i. e., if there is only one session, we omit the session channel and abbreviate actors by their role.

As described in [1, 8, 9], global types are projected onto to their roles into so-called local types (compare to Section 2.1) that are then used to build type environments. Intuitively, a process is well-typed w. r. t. a global type if it behaves as specified in the type. Therefore, the process is compared in a static analysis with type environments that are derived from the global type. Similarly, a system that implements more than a single session is well-typed w. r. t. $\left\{\left(G_{i},\mathsf{s}_{i}\right)\right\}_{i\in\mathrm{I}}$ if each session $\mathsf{s}_{i}$ behaves as specified in the global type $G_{i}$ and if the interleaving of different sessions does not introduce deadlocks (compare to [2]). We formally define well-typed processes for the above variant of MPST in Section 2.3 and show basic properties—in particular subject reduction, linearity, and error-freedom—in Section 2.4. Moreover, we rely on the observation that in well-typed processes different actors of the same session are composed in parallel, whereas all actions of the same actor are composed sequentially.

Lemma 1 (Actors are Sequential)

If $P$ is well-typed then all actions of the same actor are composed sequentially in $P$.

2.3 Well-Typed Processes

Processes are combined with type environments into type judgements. A judgement is of the form $\Gamma\vdash P\triangleright\Delta$, where $\Gamma$ is a global type environment connecting shared channels with their global types and values with their sorts, $P$ is a process, and $\Delta$ is a session environment containing the projections of global types onto their roles and some additional control information. Type environments are sets of assignments, but we usually omit the curly brackets and write $\Gamma,A$ (or $\Delta,A$) for the union of $\Gamma$ (or $\Delta$) and $\left\{A\right\}$.

Definition 6 (Type Environments)

The global type environments and the session environments are given by

[TABLE]

where $\mathsf{a}$ are shared channels, $G$ are global types, $\mathsf{s}$ are session channels, $x$ are names, $\mathsf{U}$ are sorts, $\mathrm{X}$ are process variables, $\mathrm{r}$ are roles, and $T$ are local types.

Assignments $\mathsf{a}\mathbin{:}G$ connect a global type of a session with the shared channel that is used to initialise this session. The type system ensures that shared channels are used exactly once. Therefore, we add the session channel $\mathsf{s}$, i. e., rewrite $\mathsf{a}\mathbin{:}G$ into $\mathsf{a}\mathbin{:}G\!\left<\mathsf{s}\right>$, after the shared channel was used and require that $\Gamma,\mathsf{a}\mathbin{:}G$ implies $\nexists G^{\prime},\mathsf{s}.\;\mathsf{a}\mathbin{:}G^{\prime}\in\Gamma\lor\mathsf{a}\mathbin{:}G^{\prime}\!\left<\mathsf{s}\right>\in\Gamma$. Similarly, we assume that $\Gamma,\mathsf{a}\mathbin{:}G\!\left<\mathsf{s}\right>$ implies $\nexists\mathsf{a}^{\prime},G^{\prime},\mathsf{s}^{\prime}.\;\mathsf{a}\mathbin{:}G^{\prime}\in\Gamma\lor\mathsf{a}\mathbin{:}G^{\prime}\!\left<\mathsf{s^{\prime}}\right>\in\Gamma\lor\mathsf{a^{\prime}}\mathbin{:}G^{\prime}\!\left<\mathsf{s}\right>\in\Gamma$. Assignments $x\mathbin{:}\mathsf{U}$ state that variable $x$ is of sort $\mathsf{U}$, which implies that $x$ is no session channel. We assume that the sort of variables is unique, i. e., that $\Gamma,x\mathbin{:}\mathsf{U}$ implies $\nexists\mathsf{U}^{\prime}.\;x\mathbin{:}\mathsf{U}^{\prime}\in\Gamma$. We write $\Gamma\Vdash\mathsf{e}\mathbin{:}\mathsf{U}$ if for all names $v$ in $\mathsf{e}$ there is some $v\mathbin{:}\mathsf{U}_{v}$ in $\Gamma$ and if with these sorts for its variables $\mathsf{e}$ is of sort $\mathsf{U}$ for all possible evaluations. We abbreviate $\Gamma,\mathsf{e}_{1}\mathbin{:}\mathsf{U}_{1},\ldots,\mathsf{e}_{n}\mathbin{:}\mathsf{U}_{n}$ by $\Gamma,\tilde{\mathsf{e}}\mathbin{:}\tilde{\mathsf{U}}$ and $\Gamma\Vdash\mathsf{e}_{1}\mathbin{:}\mathsf{U}_{1},\ldots,\Gamma\Vdash\mathsf{e}_{n}\mathbin{:}\mathsf{U}_{n}$ by $\Gamma\Vdash\tilde{\mathsf{e}}\mathbin{:}\tilde{\mathsf{U}}$. Assignments $\mathrm{X}\mathbin{:}\Delta$ save the current state of a session environment connected to a process variable $\mathrm{X}$, in order to check recursive processes. We assume that $\Gamma,\mathrm{X}\mathbin{:}\Delta$ implies $\nexists\Delta^{\prime}.\;\mathrm{X}\mathbin{:}\Delta^{\prime}\in\Gamma$.

The obligation $\mathsf{a}\!\left<\mathrm{r}\right>$ tells us that the considered process needs to invite role $\mathrm{r}$ via the shared channel $\mathsf{a}$. We assume that $\Delta,\mathsf{a}\!\left<\mathrm{r}\right>$ implies $\mathsf{a}\!\left<\mathrm{r}\right>\notin\Delta$. Assignments $\mathsf{s}\!\left[\mathrm{r}\right]\mathbin{:}T$ connect the local type $T$ to the role $\mathrm{r}$ in the session $\mathsf{s}$. We assume that $\Delta,\mathsf{s}\!\left[\mathrm{r}\right]\mathbin{:}T$ implies that $\nexists T^{\prime}.\;\mathsf{s}\!\left[\mathrm{r}\right]\mathbin{:}T^{\prime}\in\Delta$. Let $\Delta_{1}\otimes\Delta_{2}=\Delta_{1}\cup\Delta_{2}$ if $\Delta_{1}\cap\Delta_{2}=\emptyset$ and undefined else.

Type judgements are derived from the typing rules in Figure 2, where we equate within type judgements processes modulo alpha conversion, local types modulo the unfolding of their recursion by the rule $\left(\mu\mathrm{t}\right)T=T\left\{\nicefrac{{\left(\mu\mathrm{t}\right)T}}{{\mathrm{t}}}\right\}$, and session environments modulo terminated types by the rule $\Delta,\mathsf{s}\!\left[\mathrm{\mathrm{r}missing}\right]\mathbin{:}\textnormal{{end}}=\Delta$.

For each session invitation $\overline{\mathsf{a}}\!\left[\mathrm{\mathrm{2}..\mathrm{n}}\right]\!\left(\mathsf{s}\right)\!.P$, Rule Req requires $\mathsf{a}\mathbin{:}G$ in the global environment and rewrites it into $\mathsf{a}\mathbin{:}G\!\left<\mathsf{s}\right>$ to mark that $\mathsf{a}$ was used to invite the session $\mathsf{s}$. Then it checks whether the global type has the invited number of roles, consumes the obligation $\mathsf{a}\!\left<\mathrm{1}\right>$ from the session environment and adds $\mathsf{s}\!\left[\mathrm{1}\right]\mathbin{:}G\restriction\mathrm{1}$, i. e., requires that the continuation $P$ behaves as specified by the projection of $G$ to role $\mathrm{1}$ in the session environment. Rule Acc is similar for a process that accepts to participate as role $\mathrm{r}$ in the invited session.

Rule Send checks whether the process sends if its local type requires this, the roles of the process and the local type match, the transmitted label is one of the labels specified in the local type by $j\in\mathrm{I}$, the transmitted expressions are of the required sorts by $\Gamma\Vdash\tilde{\mathsf{e}}\mathbin{:}\tilde{\mathsf{U}}_{j}$, and the continuation $P$ behaves as specified by $T_{j}$. Rule Get checks whether the process receives if its local type requires this, the roles of the process and the local type match, and each branch $P_{i}$ with the variables $\tilde{x}_{i}\mathbin{:}\tilde{\mathsf{U}}_{i}$ behaves as specified by $T_{i}$. Note that in contrast to e. g. [1, 4, 3, 8, 9] we allow that receivers implement unnecessary branches, to allow types to follow the reductions of the system and to deal with branches already ruled out by a former step. However, since the sender is checked as well, the type system ensures that only branches that are specified by the type can happen.

Rule End states that type judgements on successful termination are valid w. r. t. arbitrary global environments but only the empty session environment. Rule Cond checks whether both branches of a conditional behave similarly. Instead, to check a parallel composition in processes, Rule Par requires that it is possible to split the session environment into disjoint parts such that each parallel branch behaves as specified by one part of the session environment.

Rule Res requires that there is an unused shared channel connected to a global type and that the current session environment extended by the projections of this global type can evolve such that $P$ behaves as specified by the remainder of this extended session environment, where the relation $\longmapsto$ on session environments is given by the Rules Com’ and Cut below. It is necessary to analyse systems that already entered a session. To check recursion, the Rules Rec and Var check whether the body of a recursive process reaches the same session environment after one iteration.

Coherence is used to describe the fact that a system implements all roles of the global types that belong the the considered sessions.

Definition 7 (Coherence)

A session environment $\Delta$ is coherent w. r. t. a set of pairs of global types and pairwise distinct names $\left\{\left(G_{i},\mathsf{n}_{i}\right)\right\}_{i\in\mathrm{I}}$, if for all session channels $\mathsf{s}$ in $\Delta$ there exists $j\in\mathrm{I}$ such that $\mathsf{n}_{j}=\mathsf{s}$ and $\Delta\cap\left\{\mathsf{s}\!\left[\mathrm{\mathrm{r}missing}\right]\mathbin{:}T\mid\mathrm{r}\text{ is a role and }T\text{ is a local type}\right\}=\left\{\mathsf{s}\!\left[\mathrm{\mathrm{r}missing}\right]\mathbin{:}G_{j}\restriction\mathrm{r}\mid\mathrm{r}\in\mathsf{r}\!\left(G_{j}\right)\right\}$ and for all its shared channels $\mathsf{a}$ there exists $j\in\mathrm{I}$ such that $\mathsf{n}_{j}=\mathsf{a}$ and $\left\{\mathrm{r}\mid\mathsf{a}\!\left<\mathrm{r}\right>\in\Delta\right\}=\mathsf{r}\!\left(G_{j}\right)$.

Moreover, $\Delta$ is coherent w. r. t. a global type $G$ missing if $\Delta$ is coherent w. r. t. $\left\{\left(G,\mathsf{n}\right)\right\}$ for some name $\mathsf{n}$ and $\Delta$ is coherent if $\Delta$ is coherent w. r. t. some $\left\{\left(G_{i},\mathsf{n}_{i}\right)\right\}_{i\in\mathrm{I}}$.

We map the reduction of communications in Rule Com of Figure 1 on the rule

[TABLE]

and add a rule to remove superfluous branches of receivers

[TABLE]

such that session environments can follow the evolution of processes.

We call a process role-distributed if it composes different actors of the same session in parallel (for all sessions and all actors of a session).

Definition 8 (Well-Typed Processes, Single Session)

Let $P$ be a process, $G$ a global type, $\Gamma$ a global type environment, and $\Delta$ a session environment. For processes with a single session we have:

• •

$P$ is well-typed w. r. t. $\Gamma$ and $\Delta$ if $P$ is role-distributed, $\Delta$ is coherent, and $\Gamma\vdash P\triangleright\Delta$.

• •

$P$ is well-typed if there are $\Gamma,\Delta$ such that $P$ is well-typed w. r. t. $\Gamma,\Delta$.

• •

$P$ is well-typed w. r. t. $G$ missing if there are $\Gamma,\Delta$ such that $P$ is role-distributed, $G$ is the only global type in $\Gamma$, $\Delta$ is coherent w. r. t. $G$, and $\Gamma\vdash P\triangleright\Delta$.

The definition of well-typed processes is more difficult for several interleaved sessions. As described in [2], we have to ensure that actions of different sessions do not cause deadlocks by cyclic dependencies. Therefore, [2] introduce an interaction type system for global progress in dynamically interleaved multiparty sessions. The interaction type system introduced in [2] considers an asynchronous variant of MPST there senders release their messages onto message queues from which receivers can read in a subsequent step. To check for global progress in dynamically interleaved multiparty sessions, the interaction type system collects dependencies between interactions of different services, i. e., different sessions and their associated shared channels. Since [2] considers asynchronous communication, they collect the dependencies of a receiver to the interactions with other services in its continuation. To obtain an interaction type system for the above synchronous MPST variant, we have to consider dependencies also for senders, i. e., treat senders in the same way as receivers. Moreover, we have to extend the collection of dependencies also to session invitations, i. e., session requests $\overline{\mathsf{a}}\!\left[\mathrm{\mathrm{2}..\mathrm{n}}\right]\!\left(\mathsf{s}\right)\!.P$ and their corresponding receivers $\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{r}missing}\right]\right)\!.P$ have to produce the same kind of dependencies towards interactions of other services as the communication prefixes within the respective session. A process $P$ is globally progressing if it can be typed in the interaction type system.

Definition 9 (Well-Typed Processes, Interleaved Sessions)

Let $P$ be a process without name clashes on session channels, $\left\{\left(G_{i},\mathsf{s}_{i}\right)\right\}_{i\in\mathrm{I}}$ a set of pairs of global types and pairwise distinct session channels, $\Gamma$ a global type environment, and $\Delta$ a session environment. For processes with interleaved sessions we have:

• •

$P$ is well-typed w. r. t. $\Gamma$ and $\Delta$ if $P$ is role-distributed, $\Delta$ is coherent, $\Gamma\vdash P\triangleright\Delta$, and $P$ is globally progressing.

• •

$P$ is well-typed if there are $\Gamma,\Delta$ such that $P$ is well-typed w. r. t. $\Gamma,\Delta$.

• •

$P$ is well-typed w. r. t. $\left\{\left(G_{i},\mathsf{s}_{i}\right)\right\}_{i\in\mathrm{I}}$ if there are $\Gamma,\Delta$ such that $P$ is role-distributed, $\left\{G_{i}\right\}_{i\in\mathrm{I}}$ are the global types in $\Gamma$, $\Delta$ is coherent w. r. t. the types $\left\{\left(G_{i},\mathsf{n}_{i}\right)\right\}_{i\in\mathrm{I}}$ for some $\mathsf{n}_{i}$, $\Gamma\vdash P\triangleright\Delta$, $P$ is globally progressing, and for all $i\in\mathrm{I}$ either $\mathsf{n}_{i}=\mathsf{s}_{i}$ or $\Gamma\vdash P\triangleright\Delta$ connects the shared channel $\mathsf{n}_{i}$ with $\mathsf{s}_{i}$, i. e., $\mathsf{n_{i}}\mathbin{:}G\in\Gamma$ is transferred into $\mathsf{n_{i}}\mathbin{:}G\!\left<\mathsf{s_{i}}\right>$ by one of the Rules Req, Acc, or Res.

2.4 Basic Properties

Type judgements are preserved modulo structural congruence.

Lemma 2 (Structural Congruence)

If $\Gamma\vdash P\triangleright\Delta$ and $P\equiv P^{\prime}$ then $\Gamma\vdash P^{\prime}\triangleright\Delta$.

Proof

The proof is by induction on the rules of structural congruence that are used to obtain $P\equiv P^{\prime}$. In each case we derive from the structure of $P$ and Figure 2 information about the proof of $\Gamma\vdash P\triangleright\Delta$ and use them to show $\Gamma\vdash P^{\prime}\triangleright\Delta$. Thereby, we rely on the commutativity and associativity of $\otimes$, the fact that a judgement for the process $\mathbf{0}$ can be derived if and only if the considered session environment is empty, and that we equate in judgements local types modulo the unfolding of recursion.

Type judgements are preserved modulo the substitution of values by values of the same sort.

Lemma 3 (Substitution)

If $\Gamma,x\mathbin{:}\mathsf{U},y\mathbin{:}\mathsf{U}\vdash P\triangleright\Delta$ then $\Gamma,y\mathbin{:}\mathsf{U}\vdash P\left\{\nicefrac{{y}}{{x}}\right\}\triangleright\Delta$.

Proof

The proof is by induction on the typing rules used to obtain $\Gamma,x\mathbin{:}\mathsf{U},y\mathbin{:}\mathsf{U}\vdash P\triangleright\Delta$. Since local types do not contain names, they are not affected by the substitution. Rule Send is the only typing rule that checks for sorts of names. This case follows from the observation that $\Gamma,x\mathbin{:}\mathsf{U},y\mathbin{:}\mathsf{U}\Vdash\mathsf{e}$ implies $\Gamma,y\mathbin{:}\mathsf{U}\Vdash\mathsf{e}\left\{\nicefrac{{y}}{{x}}\right\}$.

The sorts of fresh names are not relevant for type judgements.

Lemma 4 (Fresh Name)

If $\Gamma,x\mathbin{:}\mathsf{U}\vdash P\triangleright\Delta$ and $x\notin\mathsf{fn}\!\left(P\right)$ then $\Gamma\vdash P\triangleright\Delta$.

Proof

The proof is by induction on the typing rules used to obtain $\Gamma,x\mathbin{:}\mathsf{U}\vdash P\triangleright\Delta$.

Subject reduction is a fundamental property of type systems that allows for static type checking. It shows that if a type judgement for a process can be derived with a coherent session environment then we can also derive type judgements for its derivatives.

Lemma 5 (Subject Reduction)

If $\Gamma\vdash P\triangleright\Delta$, $\Delta$ is coherent, and $P\longmapsto P^{\prime}$ then there is $\Delta^{\prime}$ such that $\Gamma\vdash P^{\prime}\triangleright\Delta^{\prime}$, $\Delta^{\prime}$ is coherent, and $\Delta\longmapsto\Delta^{\prime}$.

Proof

Assume $\Gamma\vdash P\triangleright\Delta$ and that $\Delta$ is coherent. The proof is by induction on the reduction rules of Figure 1 that are used to obtain $P\longmapsto P^{\prime}$.

Case of Rule Link:

In this case $P=\overline{\mathsf{a}}\!\left[\mathrm{\mathrm{2}..\mathrm{n}}\right]\!\left(\mathsf{s}\right)\!.P_{1}\mid\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{2}}\right]\right)\!.P_{2}\mid\ldots\mid\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{n}}\right]\right)\!.P_{n}$ and $P^{\prime}=\left(\nu\mathsf{s}\right)\!\left(P_{1}\mid P_{2}\mid\ldots\mid P_{n}\right)$. By Figure 2, then the proof of $\Gamma\vdash P\triangleright\Delta$ starts with $n-1$ applications of Rule Par that splits the judgement into $\Gamma\vdash\overline{\mathsf{a}}\!\left[\mathrm{\mathrm{2}..\mathrm{n}}\right]\!\left(\mathsf{s}\right)\!.P_{1}\triangleright\Delta_{1}$ and $\Gamma\vdash\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{i}}\right]\right)\!.P_{i}\triangleright\Delta_{i}$ for $2\leq i\leq n$ such that $\Delta=\Delta_{1}\otimes\ldots\otimes\Delta_{n}$. By the Rules Req and Acc, then $\mathsf{r}\!\left(G\right)=\left\{\mathrm{1},\ldots,\mathrm{n}\right\}$, $\Gamma=\Gamma^{\prime},\mathsf{a}\mathbin{:}G$, $\Delta_{i}=\Delta_{i}^{\prime},\mathsf{a}\!\left<\mathrm{i}\right>$, and $\Gamma^{\prime},\mathsf{a}\mathbin{:}G\!\left<\mathsf{s}\right>\vdash P_{i}\triangleright\Delta_{i}^{\prime},\mathsf{s}\!\left[\mathrm{i}\right]\mathbin{:}G\restriction\mathrm{i}$ for all $1\leq i\leq n$. Because of $\Delta_{1}\otimes\ldots\otimes\Delta_{n}$ and $\Delta_{i}=\Delta_{i}^{\prime},\mathsf{a}\!\left<\mathrm{i}\right>$, $\Delta^{\prime}=\Delta_{1}^{\prime}\otimes\ldots\otimes\Delta_{n}^{\prime}$ is defined. By $n-1$ applications of Rule Par and since $\Delta_{i}^{\prime},\mathsf{s}\!\left[\mathrm{i}\right]\mathbin{:}G\restriction\mathrm{i}$ implies that $\Delta_{i}^{\prime}$ does not contain an assignment for $\mathsf{\mathsf{s}missing}\!\left[\mathrm{\mathrm{i}}\right]$, then $\Gamma^{\prime},\mathsf{a}\mathbin{:}G\!\left<\mathsf{s}\right>\vdash P_{1}\mid\ldots\mid P_{n}\triangleright\Delta^{\prime},\mathsf{s}\!\left[\mathrm{1}\right]\mathbin{:}G\restriction\mathrm{1},\ldots,\mathsf{s}\!\left[\mathrm{n}\right]\mathbin{:}G\restriction\mathrm{n}$. By Rule Res and the reflexivity of $\longmapsto^{*}$, then $\Gamma\vdash P^{\prime}\triangleright\Delta$. By the reflexivity of $\longmapsto^{*}$, then $\Delta\longmapsto^{*}\Delta$.

Case of Rule Com:

In this case $P=\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}},\mathrm{\mathrm{r}_{2}}\right]!\mathsf{\mathsf{l}_{j}}\!\left<\tilde{\mathsf{e}}\right>\!.Q\mid\mathsf{s}\!\left[\mathrm{\mathrm{r}_{2}},\mathrm{\mathrm{r}_{1}}\right]?\left\{\mathsf{\mathsf{l}_{i}}\!\left(\tilde{x}_{i}\right)\!.P_{i}\right\}_{i\in\mathrm{I}}$, $j\in\mathrm{I}$, and $P^{\prime}=Q\mid\left(P_{j}\left\{\nicefrac{{\tilde{\mathsf{e}}}}{{\tilde{x}_{j}}}\right\}\right)$. By Figure 2, then the proof of $\Gamma\vdash P\triangleright\Delta$ starts with Rule Par that splits the judgement into $\Gamma\vdash\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}},\mathrm{\mathrm{r}_{2}}\right]!\mathsf{\mathsf{l}_{j}}\!\left<\tilde{\mathsf{e}}\right>\!.Q\triangleright\Delta_{Q}$ and $\Gamma\vdash\mathsf{s}\!\left[\mathrm{\mathrm{r}_{2}},\mathrm{\mathrm{r}_{1}}\right]?\left\{\mathsf{\mathsf{l}_{i}}\!\left(\tilde{x}_{i}\right)\!.P_{i}\right\}_{i\in\mathrm{I}}\triangleright\Delta_{P}$ such that $\Delta=\Delta_{Q}\otimes\Delta_{P}$. By the Rules Send and Get and coherence, then $\Gamma\Vdash\tilde{\mathsf{e}}\mathbin{:}\tilde{\mathsf{U}}_{j}$, $\Delta_{Q}=\Delta_{Q}^{\prime},\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}}\right]\mathbin{:}\left[\mathrm{\mathrm{r}_{2}}\right]!\left\{\mathsf{l}_{i}\!\left<\tilde{\mathsf{U}}_{j}\right>\!.T_{i}\right\}_{i\in\mathrm{I}}$, $\Gamma\vdash Q\triangleright\Delta_{Q}^{\prime},\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}}\right]\mathbin{:}T_{j}$, $\Delta_{P}=\Delta_{P}^{\prime},\mathsf{s}\!\left[\mathrm{\mathrm{r}_{2}}\right]\mathbin{:}\left[\mathrm{\mathrm{r}_{1}}\right]?\left\{\mathsf{l}_{i}\!\left<\tilde{\mathsf{U}}_{j}\right>\!.T_{i}^{\prime}\right\}_{i\in\mathrm{I}}$, and $\Gamma,\tilde{x}_{j}\mathbin{:}\tilde{\mathsf{U}}_{j}\vdash P_{j}\triangleright\Delta_{P}^{\prime},\mathsf{s}\!\left[\mathrm{\mathrm{r}_{2}}\right]\mathbin{:}T_{j}^{\prime}$. By the Lemmata 3 and 4, then $\Gamma\vdash P_{j}\left\{\nicefrac{{\mathsf{e}}}{{\tilde{x}_{j}}}\right\}\triangleright\Delta_{P}^{\prime},\mathsf{s}\!\left[\mathrm{\mathrm{r}_{2}}\right]\mathbin{:}T_{j}^{\prime}$. Because $\Delta_{Q}\otimes\Delta_{P}$ is defined, $\Delta_{Q}=\Delta_{Q}^{\prime},\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}}\right]\mathbin{:}\left[\mathrm{\mathrm{r}_{2}}\right]!\left\{\mathsf{l}_{i}\!\left<\tilde{\mathsf{U}}_{j}\right>\!.T_{i}\right\}_{i\in\mathrm{I}}$, and $\Delta_{P}=\Delta_{P}^{\prime},\mathsf{s}\!\left[\mathrm{\mathrm{r}_{2}}\right]\mathbin{:}\left[\mathrm{\mathrm{r}_{1}}\right]?\left\{\mathsf{l}_{i}\!\left<\tilde{\mathsf{U}}_{j}\right>\!.T_{i}^{\prime}\right\}_{i\in\mathrm{I}}$, $\Delta^{\prime}=\Delta_{Q}^{\prime},\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}}\right]\mathbin{:}T_{j}\otimes\Delta_{P}^{\prime},\mathsf{s}\!\left[\mathrm{\mathrm{r}_{2}}\right]\mathbin{:}T_{j}^{\prime}$ is defined and is coherent. By Rule Par, then $\Gamma\vdash P^{\prime}\triangleright\Delta^{\prime}$. By Rule Com’, then $\Delta\longmapsto^{*}\Delta^{\prime}$.

Case of Rule If-T:

In this case $P=\textnormal{{if }}\mathsf{c}\textnormal{{ then }}P_{1}\textnormal{{ else }}P_{2}$, $P^{\prime}=P_{1}$, and $\mathsf{c}$ is satisfied. By Figure 2, then the proof of $\Gamma\vdash P\triangleright\Delta$ starts with Rule Cond and, thus, $\Gamma\vdash P^{\prime}\triangleright\Delta$. By the reflexivity of $\longmapsto^{*}$, then $\Delta\longmapsto^{*}\Delta$.

Case of Rule If-F:

In this case $P=\textnormal{{if }}\mathsf{c}\textnormal{{ then }}P_{1}\textnormal{{ else }}P_{2}$, $P^{\prime}=P_{2}$, and $\mathsf{c}$ is not satisfied. By Figure 2, then the proof of $\Gamma\vdash P\triangleright\Delta$ starts with Rule Cond and, thus, $\Gamma\vdash P^{\prime}\triangleright\Delta$. By the reflexivity of $\longmapsto^{*}$, then $\Delta\longmapsto^{*}\Delta$.

Case of Rule Par:

In this case $P=P_{1}\mid P_{2}$, $P^{\prime}=P_{1}^{\prime}\mid P_{2}$, and $P_{1}\longmapsto P_{1}^{\prime}$. By Figure 2, then the proof of $\Gamma\vdash P\triangleright\Delta$ starts with Rule Par that splits the judgement into $\Gamma\vdash P_{1}\triangleright\Delta_{1}$ and $\Gamma\vdash P_{2}\triangleright\Delta_{2}$ such that $\Delta=\Delta_{1}\otimes\Delta_{2}$. By the induction hypothesis, $\Gamma\vdash P_{1}\triangleright\Delta_{1}$ and $P_{1}\longmapsto P_{1}^{\prime}$ imply that there is $\Delta_{1}^{\prime}$ such that $\Gamma\vdash P_{1}^{\prime}\triangleright\Delta_{1}^{\prime}$, $\Delta_{1}^{\prime}$ is coherent, and $\Delta_{1}\longmapsto^{*}\Delta_{1}^{\prime}$. Because $\Delta_{1}\otimes\Delta_{2}$ is defined and since Rule Com’ can only reduce local types, then $\Delta^{\prime}=\Delta_{1}^{\prime}\otimes\Delta_{2}$ is defined but not necessarily coherent. If $\Delta^{\prime}$ is not coherent then this is because of superfluous branches in receivers that we remove with Rule Cut, while Rule Get ensures that the validity of the type judgement is not affected by removing superfluous branches in the type. Let $\Delta^{\prime\prime}$ be the result of removing all superfluous branches from $\Delta^{\prime}$ such that $\Delta^{\prime\prime}$ is coherent and, with the Rules Com’ and Cut, $\Delta\longmapsto^{*}\Delta^{\prime\prime}$. By Rule Par, then $\Gamma\vdash P^{\prime}\triangleright\Delta^{\prime\prime}$.

Case of Rule Res:

In this case $P=\left(\nu\mathsf{s}\right)\!Q$, $P^{\prime}=\left(\nu\mathsf{s}\right)\!Q^{\prime}$, and $Q\longmapsto Q^{\prime}$. By Figure 2, then the proof of $\Gamma\vdash P\triangleright\Delta$ starts with Rule Res such that $\Gamma=\Gamma^{\prime},\mathsf{a}\mathbin{:}G$, $\Delta=\Delta_{Q},\mathsf{a}\!\left<\mathrm{1}\right>,\ldots,\mathsf{a}\!\left<\mathrm{n}\right>$, $\Delta_{Q},\mathsf{s}\!\left[\mathrm{1}\right]\mathbin{:}G\restriction\mathrm{1},\ldots,\mathsf{s}\!\left[\mathrm{n}\right]\mathbin{:}G\restriction\mathrm{n}\longmapsto^{*}\Delta_{Q}^{\prime\prime}$, $\mathsf{r}\!\left(G\right)=\left\{\mathrm{1},\ldots,\mathrm{n}\right\}$, and $\Gamma^{\prime},\mathsf{a}\mathbin{:}G\!\left<\mathsf{s}\right>\vdash Q\triangleright\Delta_{Q}^{\prime\prime}$. By the induction hypothesis, $\Gamma^{\prime},\mathsf{a}\mathbin{:}G\!\left<\mathsf{s}\right>\vdash Q\triangleright\Delta_{Q}^{\prime\prime}$ and $Q\longmapsto Q^{\prime}$ imply that there is $\Delta_{Q}^{\prime\prime\prime}$ such that $\Gamma^{\prime},\mathsf{a}\mathbin{:}G\!\left<\mathsf{s}\right>\vdash Q\triangleright\Delta_{Q}^{\prime\prime\prime}$, $\Delta_{Q}^{\prime\prime\prime}$ is coherent, and $\Delta_{Q}^{\prime\prime}\longmapsto^{*}\Delta_{Q}^{\prime\prime\prime}$. By Rule Res, then $\Gamma\vdash P^{\prime}\triangleright\Delta$. By the reflexivity of $\longmapsto^{*}$, then $\Delta\longmapsto^{*}\Delta$.

Case of Rule Struc:

This case follows from Lemma 2.

In the above proof we use the assumption that $\Delta$ is coherent only to prove that then also $\Delta^{\prime}$ is coherent. The proof of subject reduction without coherence in Theorem 1 of [13] is obtained as special case of the above proof by removing the parts about coherence and the step relation on session environments.

Session invitations ensure by definition, that the implementation of a session composes its actors in parallel. If a process is role-distributed then so are all its derivatives.

Lemma 6

If $\Gamma\vdash P\triangleright\Delta$, $P\longmapsto P^{\prime}$, and $P$ is role-distributed then $P^{\prime}$ is role-distributed.

Proof

The proof is by induction on the reduction rules of Figure 1 to obtain $P\longmapsto P^{\prime}$, since no reduction rule unifies parallel branches.

If $P$ is well-typed then all actions of the same actor are composed sequentially in $P$.

Proof (Proof of Lemma 1)

By the Definitions 2 and 3, local types are sequential and projection maps global types for each role on a single sequential local type $T$. By coherence, for each role there is initially either exactly one $\mathsf{a}\!\left<\mathrm{r}\right>$ that is replaced later by the sequential local type $T$ or there is exactly one $\mathsf{s}\!\left[\mathrm{r}\right]\mathbin{:}T$ in the session environment. By Figure 2, then $T$ cannot be split between different parallel branches and communication prefixes require a corresponding assignment of the respective actor. Thus, a single local type $T$ cannot be implemented in different parallel branches.

Well-typedness ensures that there are no conflicts between communication prefixes for both session invitations and communications within sessions.

Lemma 7 (Linearity)

If $P$ is well-typed then $P$ contains, for each shared channel $\mathsf{a}$, at most one invitation $\overline{\mathsf{a}}\!\left[\mathrm{\mathrm{2}..\mathrm{n}}\right]\!\left(\mathsf{s}\right)\!.P^{\prime}$ and no two $\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{r}missing}\right]\right)\!.P^{\prime}$ for the same role $\mathrm{r}$ and, for each pair of a session channel $\mathsf{s}$ and a role $\mathrm{r}$, at most one sender $\mathsf{s}\!\left[\mathrm{\mathrm{r}missing},\mathrm{\mathrm{r}^{\prime}}\right]!\mathsf{\mathsf{l}missing}\!\left<\tilde{\mathsf{e}}\right>\!.P^{\prime}$ and at most one receiver $\mathsf{s}\!\left[\mathrm{\mathrm{r}missing},\mathrm{\mathrm{r}^{\prime}}\right]?\left\{\mathsf{\mathsf{l}_{i}}\!\left(\tilde{x}_{i}\right)\!.P_{i}^{\prime}\right\}_{i\in\mathrm{I}}$ that are guarded only by conditionals.

Proof

Assume that $P$ is well-typed. Assume that $P$ contains an invitation $\overline{\mathsf{a}}\!\left[\mathrm{\mathrm{2}..\mathrm{n}}\right]\!\left(\mathsf{s}\right)\!.P^{\prime}$ that is guarded only by conditionals. By Figure 2 and $\Gamma\vdash P\triangleright\Delta$, then $\mathsf{a}\!\left<\mathrm{1}\right>\in\Delta$. Because $\mathsf{a}\!\left<\mathrm{1}\right>$ is consumed in Rule Req, cannot be introduced by typing rules, and cannot be duplicated for different parallel branches, $P$ can contain at most one such prefix.

The case of $\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{r}missing}\right]\right)\!.P^{\prime}$ is similar.

The cases of $\mathsf{s}\!\left[\mathrm{\mathrm{r}missing},\mathrm{\mathrm{r}^{\prime}}\right]!\mathsf{\mathsf{l}missing}\!\left<\tilde{\mathsf{e}}\right>\!.P^{\prime}$ and $\mathsf{s}\!\left[\mathrm{\mathrm{r}missing},\mathrm{\mathrm{r}^{\prime}}\right]?\left\{\mathsf{\mathsf{l}_{i}}\!\left(\tilde{x}_{i}\right)\!.P_{i}^{\prime}\right\}_{i\in\mathrm{I}}$ follow from Lemma 1.

Moreover, well-typedness ensures that, for all unguarded communication prefixes, the respective communication partner exists in a parallel branch but might be guarded.

Lemma 8 (Error-Freedom)

If $P$ is well-typed and $P$ contains an unguarded

$\overline{\mathsf{a}}\!\left[\mathrm{\mathrm{2}..\mathrm{n}}\right]\!\left(\mathsf{s}\right)\!.P^{\prime}$* then $P$ also contains $\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{i}}\right]\right)\!.P_{i}^{\prime}$ for all $\mathrm{2}\leq\mathrm{i}\leq\mathrm{n}$ that are guarded only by conditionals or prefixes on channels different form $\mathsf{a}$.* 2. 2.

$\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{r}missing}\right]\right)\!.P^{\prime}$* then there is some $\mathrm{n}$ such that $\mathrm{2}\leq\mathrm{r}\leq\mathrm{n}$ and $P$ also contains $\overline{\mathsf{a}}\!\left[\mathrm{\mathrm{2}..\mathrm{n}}\right]\!\left(\mathsf{s}\right)\!.P^{\prime}$ and $\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{i}}\right]\right)\!.P_{i}^{\prime}$ for all $\mathrm{2}\leq\mathrm{i}\leq\mathrm{n}$ with $\mathrm{r}\neq\mathrm{i}$ that are guarded only by conditionals or prefixes on channels different form $\mathsf{a}$.* 3. 3.

$\mathsf{s}\!\left[\mathrm{\mathrm{r}missing},\mathrm{\mathrm{r}^{\prime}}\right]!\mathsf{\mathsf{l}_{j}}\!\left<\tilde{\mathsf{e}}\right>\!.P^{\prime}$* then $P$ also contains $\mathsf{s}\!\left[\mathrm{\mathrm{r}missing},\mathrm{\mathrm{r}^{\prime}}\right]?\left\{\mathsf{\mathsf{l}_{i}}\!\left(\tilde{x}_{i}\right)\!.P_{i}^{\prime}\right\}_{i\in\mathrm{I}}$ with $j\in\mathrm{I}$ in parallel with the sender.* 4. 4.

$\mathsf{s}\!\left[\mathrm{\mathrm{r}missing},\mathrm{\mathrm{r}^{\prime}}\right]?\left\{\mathsf{\mathsf{l}_{i}}\!\left(\tilde{x}_{i}\right)\!.P_{i}^{\prime}\right\}_{i\in\mathrm{I}}$* then $P$ also contains $\mathsf{s}\!\left[\mathrm{\mathrm{r}missing},\mathrm{\mathrm{r}^{\prime}}\right]!\mathsf{\mathsf{l}_{j}}\!\left<\tilde{\mathsf{e}}\right>\!.P^{\prime}$ with $j\in\mathrm{I}$ in parallel with the receiver.*

Proof

Assume that $P$ is well-typed and that $P$ contains an unguarded

invitation $\overline{\mathsf{a}}\!\left[\mathrm{\mathrm{2}..\mathrm{n}}\right]\!\left(\mathsf{s}\right)\!.P^{\prime}$. By Figure 2 and $\Gamma\vdash P\triangleright\Delta$, then $\mathsf{a}\!\left<\mathrm{1}\right>\in\Delta$ and $\mathsf{a}\mathbin{:}G\in\Gamma$ for some $G$ such that $\mathsf{r}\!\left(G\right)=\left\{\mathrm{1},\ldots,\mathrm{n}\right\}$. By coherence, then $\mathsf{a}\!\left<\mathrm{2}\right>,\ldots,\mathsf{a}\!\left<\mathrm{n}\right>\in\Delta$. By Lemma 1 and Figure 2, then $P$ also contains $\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{i}}\right]\right)\!.P_{i}^{\prime}$ for all $\mathrm{2}\leq\mathrm{i}\leq\mathrm{n}$ that are guarded only by conditionals or prefixes on channels different from $\mathsf{a}$. 2. 2.

$\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{r}missing}\right]\right)\!.P^{\prime}$. By Figure 2 and $\Gamma\vdash P\triangleright\Delta$, then $\mathsf{a}\!\left<\mathrm{\mathrm{r}missing}\right>\in\Delta$ and $\mathsf{a}\mathbin{:}G\in\Gamma$ for some $G$ such that $\mathsf{r}\!\left(G\right)=\left\{\mathrm{1},\ldots,\mathrm{n}\right\}$ and $\mathrm{1}\leq\mathrm{r}\leq\mathrm{n}$. By coherence, then $\mathsf{a}\!\left<\mathrm{1}\right>,\ldots,\mathsf{a}\!\left<\mathrm{n}\right>\in\Delta$. By Lemma 1 and Figure 2, then $P$ also contains $\overline{\mathsf{a}}\!\left[\mathrm{\mathrm{2}..\mathrm{n}}\right]\!\left(\mathsf{s}\right)\!.P^{\prime}$ and $\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{i}}\right]\right)\!.P_{i}^{\prime}$ for all $\mathrm{2}\leq\mathrm{i}\leq\mathrm{n}$ with $\mathrm{r}\neq\mathrm{i}$ that are guarded only by conditionals or prefixes on channels different from $\mathsf{a}$. 3. 3.

$\mathsf{s}\!\left[\mathrm{\mathrm{r}missing},\mathrm{\mathrm{r}^{\prime}}\right]!\mathsf{\mathsf{l}missing}\!\left<\tilde{\mathsf{e}}\right>\!.P^{\prime}$. By Figure 2 and $\Gamma\vdash P\triangleright\Delta$, then $\mathsf{s}\!\left[\mathrm{\mathrm{r}missing}\right]\mathbin{:}\left[\mathrm{\mathrm{r}^{\prime}}\right]!\left\{\mathsf{l}_{j}\!\left<\tilde{\mathsf{U}}_{j}\right>\!.T_{j}^{\prime}\right\}_{j\in\mathrm{J}}\in\Delta$. By coherence, then there is some $T$ such that $\mathsf{s}\!\left[\mathrm{\mathrm{r}^{\prime}}\right]\mathbin{:}T\in\Delta$ and $T$ has a sub-type $\left[\mathrm{\mathrm{r}missing}\right]?\left\{\mathsf{l}_{j}\!\left<\tilde{\mathsf{U}}_{j}\right>\!.T_{j}^{\prime\prime}\right\}_{j\in\mathrm{J}}$. By Lemma 1 and Figure 2, then $P$ contains also $\mathsf{s}\!\left[\mathrm{\mathrm{r}missing},\mathrm{\mathrm{r}^{\prime}}\right]?\left\{\mathsf{\mathsf{l}_{i}}\!\left(\tilde{x}_{i}\right)\!.P_{i}^{\prime}\right\}_{i\in\mathrm{I}}$ with $j\in\mathrm{I}$ in parallel with the sender. 4. 4.

$\mathsf{s}\!\left[\mathrm{\mathrm{r}missing},\mathrm{\mathrm{r}^{\prime}}\right]?\left\{\mathsf{\mathsf{l}_{i}}\!\left(\tilde{x}_{i}\right)\!.P_{i}^{\prime}\right\}_{i\in\mathrm{I}}$. By Figure 2 and $\Gamma\vdash P\triangleright\Delta$, then there is some $\mathrm{J}\subseteq\mathrm{I}$ such that $\mathsf{s}\!\left[\mathrm{\mathrm{r}missing}\right]\mathbin{:}\left[\mathrm{\mathrm{r}^{\prime}}\right]?\left\{\mathsf{l}_{j}\!\left<\tilde{\mathsf{U}}_{j}\right>\!.T_{j}^{\prime}\right\}_{j\in\mathrm{J}}\in\Delta$. By coherence, then there is some $T$ such that $\mathsf{s}\!\left[\mathrm{\mathrm{r}^{\prime}}\right]\mathbin{:}T\in\Delta$ and $T$ has a sub-type $\left[\mathrm{\mathrm{r}missing}\right]!\left\{\mathsf{l}_{j}\!\left<\tilde{\mathsf{U}}_{j}\right>\!.T_{j}^{\prime}\right\}_{j\in\mathrm{J}}$. By Lemma 1 and Figure 2, then $P$ also contains $\mathsf{s}\!\left[\mathrm{\mathrm{r}missing},\mathrm{\mathrm{r}^{\prime}}\right]!\mathsf{\mathsf{l}_{j}}\!\left<\tilde{\mathsf{e}}\right>\!.P^{\prime}$ with $j\in\mathrm{I}$ in parallel with the receiver.

Progress, i. e., the absence of local deadlocks, is a simple consequence of the above results.

Lemma 9 (Progress)

If $P$ is well-typed and $P\longmapsto^{*}P^{\prime}$ then either $P^{\prime}\equiv\mathbf{0}$ or there is some $P^{\prime\prime}$ such that $P^{\prime}\longmapsto P^{\prime\prime}$.

Proof

Assume $\Gamma\vdash P\triangleright\Delta$, $\Delta$ is coherent, and $P\longmapsto^{*}P^{\prime}$. By Lemma 5, then there is some $\Delta^{\prime}$ such that $\Gamma\vdash P^{\prime}\triangleright\Delta^{\prime}$, $\Delta^{\prime}$ is coherent, and $\Delta\longmapsto^{*}\Delta^{\prime}$. If $\Delta^{\prime}=\emptyset$ then, by Figure 2, $P^{\prime}\equiv\mathbf{0}$. Else $\Delta^{\prime}$ contains an assignment of the form $\mathsf{a}\!\left<\mathrm{r}\right>$ or of the form $\mathsf{s}\!\left[\mathrm{r}\right]\mathbin{:}T$. By Figure 2, then $P$ contains a corresponding $\overline{\mathsf{a}}\!\left[\mathrm{\mathrm{2}..\mathrm{n}}\right]\!\left(\mathsf{s}\right)\!.Q$, $\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{r}missing}\right]\right)\!.Q$, $\mathsf{s}\!\left[\mathrm{\mathrm{r}missing},\mathrm{\mathrm{r}^{\prime}}\right]!\mathsf{\mathsf{l}missing}\!\left<\tilde{\mathsf{e}}\right>\!.Q$, or $\mathsf{s}\!\left[\mathrm{\mathrm{r}missing},\mathrm{\mathrm{r}^{\prime}}\right]?\left\{\mathsf{\mathsf{l}_{i}}\!\left(\tilde{x}_{i}\right)\!.Q_{i}^{\prime}\right\}_{i\in\mathrm{I}}$ that is guarded only by conditionals. Let $P_{1}$ be a process such that the sequence $P^{\prime}\longmapsto^{*}P_{1}$ resolves these conditionals and unguards the respective action prefix. By Lemma 8, then there is a matching communication partner that is guarded only by conditionals. Let $P_{2}$ be a process such that the sequence $P_{1}\longmapsto^{*}P_{2}$ resolves these conditionals and unguards the respective action prefix of the communication partner. Then $P_{2}\longmapsto P^{\prime\prime}$ is the step that reduces the respective communication.

3 Processes versus SGP-Processes

In [13] we introduce two algorithms. The first allows to map systems that are well-formed w. r. t. to a synchronous global type for the case of a single session.

Definition 10

The partial mapping $\operatorname{SGP}\!\left(\left\{P_{i}\right\}_{i\in\mathrm{I}},G\right)$ is defined inductively as:

$\mathbf{0}$, if $G=\textnormal{{end}}$ 2. 2.

$\mathrm{X}_{\mathrm{t}}$, else if $G=\mathrm{t}$ 3. 3.

$\operatorname{SGP}\!\left(\left\{P_{j}^{\prime}\right\}\cup\left\{P_{i}\right\}_{i\in\mathrm{I}\setminus\left\{j\right\}},G\right)$,

h else if there is some $j\in\mathrm{I}$ such that $P_{j}=\left(\nu\mathsf{s}\right)\!P_{j}^{\prime}$ 4. 4.

$\operatorname{SGP}\!\left(\left\{P_{j1},P_{j2}\right\}\cup\left\{P_{i}\right\}_{i\in\mathrm{I}\setminus\left\{j\right\}},G\right)$,

h else if there is some $j\in\mathrm{I}$ such that $P_{j}=P_{j1}\mid P_{j2}$ 5. 5.

$\operatorname{SGP}\!\left(\left\{P_{j}^{\prime}\left\{\nicefrac{{\left(\mu\mathrm{X}\right)P_{j}^{\prime}}}{{\mathrm{X}}}\right\}\right\}\cup\left\{P_{i}\right\}_{i\in\mathrm{I}\setminus\left\{j\right\}},G\right)$,

h else if there is $j\in\mathrm{I}$ such that $P_{j}=\left(\mu\mathrm{X}\right)P_{j}^{\prime}$ 6. 6.

$\tilde{x}_{m}@\mathsf{s}\!\left[\mathrm{r}\right]\mathbin{:=}\mathsf{\tilde{\mathsf{e}}}.\operatorname{SGP}\!\left(\left\{Q_{m}\left\{\nicefrac{{\tilde{x}_{m}@\mathsf{s}\!\left[\mathrm{r}\right]}}{{\tilde{x}_{m}}}\right\},Q\right\}\cup\left\{P_{i}\right\}_{i\in\mathrm{I}\setminus\left\{k,l\right\}},G_{m}\right)$,

h else if there are $k,l\in\mathrm{I}$, $m\in\mathrm{J}\subseteq\mathrm{J}^{\prime}$ such that

h $G=\mathrm{r}_{1}\rightarrow\mathrm{r}_{2}\mathbin{:}\left\{\mathsf{l}_{j}\!\left<\tilde{\mathsf{U}}_{j}\right>\!.G_{j}\right\}_{j\in\mathrm{J}}$, $P_{k}=\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}},\mathrm{\mathrm{r}_{2}}\right]!\mathsf{\mathsf{l}_{m}}\!\left<\tilde{\mathsf{e}}\right>\!.Q$,

h and $P_{l}=\mathsf{s}\!\left[\mathrm{\mathrm{r}_{2}},\mathrm{\mathrm{r}_{1}}\right]?\left\{\mathsf{\mathsf{l}_{j}}\!\left(\tilde{x}_{j}\right)\!.Q_{j}\right\}_{j\in\mathrm{J}^{\prime}}$ 7. 7.

$\operatorname{SGP}\!\left(\left\{P_{i}\right\}_{i\in\mathrm{I}_{1}},G_{1}\right)\parallel\operatorname{SGP}\!\left(\left\{P_{j}\right\}_{j\in\mathrm{I}_{2}},G_{2}\right)$,

h else if there are some $\mathrm{I}_{1}\cup\mathrm{I}_{2}=\mathrm{I}$ such that $G=G_{1},G_{2}$,

h $\bigcup_{i\in\mathrm{I}_{1}}\mathsf{r}\!\left(P_{i}\right)=\mathsf{r}\!\left(G_{1}\right)$, and $\bigcup_{j\in\mathrm{I}_{2}}\mathsf{r}\!\left(P_{j}\right)=\mathsf{r}\!\left(G_{2}\right)$ 8. 8.

$\left(\mu\mathrm{X}_{\mathrm{t}}\right)\operatorname{SGP}\!\left(\left\{P_{i}\right\}_{i\in\mathrm{I}},G^{\prime}\right)$, else if $G=\left(\mu\mathrm{t}\right)G^{\prime}$ 9. 9.

$\tau.\operatorname{SGP}\!\left(\left\{P_{1}^{\prime},\ldots,P_{n}^{\prime}\right\},G\right)$,

h else if $\left\{P_{i}\right\}_{i\in\mathrm{I}}=\left\{\overline{\mathsf{a}}\!\left[\mathrm{\mathrm{2}..\mathrm{n}}\right]\!\left(\mathsf{s}\right)\!.P_{1}^{\prime},\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{2}}\right]\right)\!.P_{2}^{\prime},\ldots,\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{n}}\right]\right)\!.P_{n}^{\prime}\right\}$ 10. 10.

$\textnormal{{if }}\mathsf{\mathsf{c}missing}\textnormal{{ then }}\operatorname{SGP}\!\left(\left\{P_{j1}\right\}\cup\left\{P_{i}\right\}_{i\in\mathrm{I}\setminus\left\{j\right\}},G\right)\textnormal{{ else }}\operatorname{SGP}\!\left(\left\{P_{j2}\right\}\cup\left\{P_{i}\right\}_{i\in\mathrm{I}\setminus\left\{j\right\}},G\right)$,

h else if there is some $j\in\mathrm{I}$ such that $P_{j}=\textnormal{{if }}\mathsf{c}\textnormal{{ then }}P_{j1}\textnormal{{ else }}P_{j2}$

The second mapping extends the first to asynchronous session types and multiple sessions.

Definition 11

$\operatorname{SGP^{\prime}}\!\left(\left\{P_{i}\right\}_{i\in\mathrm{I}},\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)$ is defined inductively as:

2. (a)

$\mathbf{0}$, if $\mathrm{J}=\emptyset$ 2. (b)

$\operatorname{SGP^{\prime}}\!\left(\left\{P_{i}\right\}_{i\in\mathrm{I}},\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}\setminus\left\{k\right\}}\right)$,

h else if there is some $k\in\mathrm{J}$ such that $G_{k}=\textnormal{{end}}$ 2. 2.

$\mathrm{X}_{\mathcal{G}}$, else if $\mathcal{G}=\left\{G_{j}\right\}_{j\in\mathrm{J}}=\left\{\mathrm{t}_{j}\right\}_{j\in\mathrm{J}}$ 3. 3.

$\operatorname{SGP^{\prime}}\!\left(\left\{P_{k}^{\prime}\right\}\cup\left\{P_{i}\right\}_{i\in\mathrm{I}\setminus\left\{k\right\}},\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)$,

h else if there is $k\in\mathrm{I}$ such that $P_{k}=\left(\nu\mathsf{s}\right)\!P_{k}^{\prime}$ 4. 4.

$\operatorname{SGP^{\prime}}\!\left(\left\{P_{k1},P_{k2}\right\}\cup\left\{P_{i}\right\}_{i\in\mathrm{I}\setminus\left\{k\right\}},\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)$,

s else if there is some $k\in\mathrm{I}$ such that $P_{k}=P_{k1}\mid P_{k2}$ 5. 5.

$\operatorname{SGP^{\prime}}\!\left(\left\{P_{k}^{\prime}\left\{\nicefrac{{\left(\mu\mathrm{X}\right)P_{k}^{\prime}}}{{\mathrm{X}}}\right\}\right\}\cup\left\{P_{i}\right\}_{i\in\mathrm{I}\setminus\left\{k\right\}},\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)$,

s else if there is $k\in\mathrm{I}$ such that $P_{k}=\left(\mu\mathrm{X}\right)P_{k}^{\prime}$ 6. 6.

$\tilde{x}_{n}@\mathsf{s}\!\left[\mathrm{r}\right]\mathbin{:=}\mathsf{\tilde{\mathsf{e}}}.\operatorname{SGP^{\prime}}\!\left(\mathcal{P},\mathcal{G}\right)$ with $\mathcal{P}=\left\{Q_{n}\left\{\nicefrac{{\tilde{x}_{n}@\mathsf{s}\!\left[\mathrm{r}\right]}}{{\tilde{x}_{n}}}\right\},Q\right\}\cup\left\{P_{i}\right\}_{i\in\mathrm{I}\setminus\left\{m,o\right\}}$ and $\mathcal{G}=\left\{\left(G_{l,n}\right)\right\}\cup\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{j}\setminus\left\{l\right\}}$,

h else if there are $m,o\in\mathrm{I}$, $l\in\mathrm{J}$, $n\in\mathrm{K}\subseteq\mathrm{K}^{\prime}$ such that

h $G_{l}=\mathrm{r}_{1}\rightarrow\mathrm{r}_{2}\mathbin{:}\left\{\mathsf{l}_{k}\!\left<\tilde{\mathsf{U}}_{k}\right>\!.G_{l,k}\right\}_{k\in\mathrm{K}}$, $P_{m}=\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}},\mathrm{\mathrm{r}_{2}}\right]!\mathsf{\mathsf{l}_{n}}\!\left<\tilde{\mathsf{e}}\right>\!.Q$,

h and $P_{o}=\mathsf{s}\!\left[\mathrm{\mathrm{r}_{2}},\mathrm{\mathrm{r}_{1}}\right]?\left\{\mathsf{\mathsf{l}_{k}}\!\left(\tilde{x}_{k}\right)\!.Q_{k}\right\}_{k\in\mathrm{K}^{\prime}}$ 7. 7.

1. (a)

$\operatorname{SGP^{\prime}}\!\left(\left\{P_{i}\right\}_{i\in\mathrm{I}_{1}},\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}_{1}}\right)\parallel\operatorname{SGP^{\prime}}\!\left(\left\{P_{i}\right\}_{i\in\mathrm{I}_{2}},\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}_{2}}\right)$,

s else if there are some $\mathrm{I}_{1}\cup\mathrm{I}_{2}=\mathrm{I}$, $\mathrm{J}_{1}\cup\mathrm{J}_{2}=\mathrm{J}$ such that $\mathrm{J}_{1}\cap\mathrm{J}_{2}=\emptyset$ and

h $\bigcup_{i\in\mathrm{I}_{k}}\mathsf{act}\!\left(P_{i}\right)=\left\{\mathsf{s_{j}}\!\left[\mathrm{r}\right]\mid j\in\mathrm{J}_{k}\land\mathrm{r}\in\mathsf{r}\!\left(G_{j}\right)\right\}$ for $k\in\left\{1,2\right\}$ 2. (b)

$\operatorname{SGP^{\prime}}\!\left(\left\{P_{i}\right\}_{i\in\mathrm{I}},\left\{\left(G_{k1},\mathsf{s}_{k}\right),\left(G_{k2},\mathsf{s}_{k}\right)\right\}\cup\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)$,

s else if there is $k\in\mathrm{J}$ such that $G_{k}=G_{k1},G_{k2}$ 8. 8.

$\left(\mu\mathrm{X}_{\mathcal{G}}\right)\operatorname{SGP^{\prime}}\!\left(\left\{P_{i}\right\}_{i\in\mathrm{I}},\left\{\left(G_{j}^{\prime},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)$,

s else if $G_{j}=\left(\mu\mathrm{t}_{j}\right)G_{j}^{\prime}$ for all $j\in\mathrm{J}$ and $\mathcal{G}=\left\{\mathrm{t}_{j}\right\}_{j\in\mathrm{J}}$ 9. 9.

$\tau.\operatorname{SGP^{\prime}}\!\left(\left\{P_{1}^{\prime},\ldots,P_{n}^{\prime}\right\}\cup\left\{P_{i}\right\}_{i\in\mathrm{I}\setminus\left\{k1,\ldots,kn\right\}},\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)$,

s else if there are $k1,\ldots,kn\in\mathrm{I}$ such that $P_{k1}=\overline{\mathsf{a}}\!\left[\mathrm{\mathrm{2}..\mathrm{n}}\right]\!\left(\mathsf{s}\right)\!.P_{1}^{\prime}$,

h $P_{k2}=\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{2}}\right]\right)\!.P_{2}^{\prime}$, …, $P_{kn}=\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{n}}\right]\right)\!.P_{n}^{\prime}$ 10. 10.

$\textnormal{{if }}\mathsf{\mathsf{c}missing}\textnormal{{ then }}\operatorname{SGP^{\prime}}\!\left(\left\{P_{k1}\right\}\cup\mathcal{P},\mathcal{G}\right)\textnormal{{ else }}\operatorname{SGP^{\prime}}\!\left(\left\{P_{k2}\right\}\cup\mathcal{P},\mathcal{G}\right)$

with $\mathcal{P}=\left\{P_{i}\right\}_{i\in\mathrm{I}\setminus\left\{k\right\}}$ and $\mathcal{G}=\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$,

s else if there is $k\in\mathrm{I}$ such that $P_{k}=\textnormal{{if }}\mathsf{c}\textnormal{{ then }}P_{k1}\textnormal{{ else }}P_{k2}$

We observe that each of the Cases 1a, 1b, 2–4, 6, 7b, and 8–9 reduces either the set of global types or the considered set of processes. By unfolding recursion, Case 5 blows up one of the considered processes. This is necessary, because the typing system allows that a process and its global type do not loop at the same points but in the same way. Because of that, the global type $\left(\mu\mathrm{t}\right)\left(\mathrm{r}_{1}\rightarrow\mathrm{r}_{2}\mathbin{:}\mathsf{l}\!\left<\mathsf{U}\right>\!.\mathrm{r}_{2}\rightarrow\mathrm{r}_{1}\mathbin{:}\mathsf{l}\!\left<\mathsf{U}\right>\!.\mathrm{t}\right)$ can e. g. be implemented for role $\mathrm{r}_{1}$ by the process $\overline{\mathsf{a}}\!\left[\mathrm{\mathrm{r}_{2}}\right]\!\left(\mathsf{s}\right)\!.\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}},\mathrm{\mathrm{r}_{2}}\right]!\mathsf{\mathsf{l}missing}\!\left<z\right>\!.\left(\mu\mathrm{X}\right)\left(\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}},\mathrm{\mathrm{r}_{2}}\right]?\mathsf{\mathsf{l}missing}\!\left(x\right)\!.\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}},\mathrm{\mathrm{r}_{2}}\right]!\mathsf{\mathsf{l}missing}\!\left<z\right>\!.\mathrm{X}\right)$. Case 5 allows to unfold recursion in processes until the current recursive set of global types is reduced to recursion variables in Case 2. Note that Case 2 drops the remainder of the process as soon as the loops in the global types are reduced. With that, the number of unfoldings of recursion in processes in Case 5 that is necessary to compute $\operatorname{SGP^{\prime}}\!\left(\left\{P\right\},\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)$ is bounded by the size of the loops in the global types.

Case 7a introduces a parallel composition in the SGP-process if the considered sets of processes can be partitioned into two sets that implement the actors of different sessions. This case can be applied if we can split the set of sessions into two disjoint sets such that there are no dependencies between the sessions in different sets. Since the number of sessions is bounded, where session invitations under recursion introduce only a single session w. r. t. well-typedness, also the number of applications of Case 7a that are necessary to compute $\operatorname{SGP^{\prime}}\!\left(\left\{P\right\},\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)$ is bounded.

Case 10 globalizes conditionals and therefore copies all other actors to both cases. Because of that, we apply this case only if it is necessary to unguard a communication partner. In well-typed systems both cases of a conditional need to follow the same type, i. e., need to implement the same communication structure. Conditionals are a local form of branching, i. e., implement alternative behaviours of a single actor. Only by transmitting information about the outcome of a conditional as sender in a communication can a local conditional influence the remaining actors of the system. Accordingly, conditionals are usually used to choose between alternatives directly before sending in process implementations (compare to Example 4) or process implementations can easily be optimized to satisfy this property. By design, the algorithms in Definition 10 and 11 map such a local conditional only if this is necessary to unguard a communication partner. Since we give precedence to conditionals that guard senders, we indeed map only necessary conditionals. Nonetheless, since Case 10 copies the remaining processes and the type(s), we cannot avoid a blow-up of the size of the generated system in this case that is in the worst case exponentially larger than the original system. However, if a conditional guides the choice between different branches of an immediately following send-action, then all of the copied actors that are input guarded in the global type will reduce to different cases for the respective two branches. This explains why the size of our toy example does not grow then we map the conditionals in Example 4 to the SGP-process in Example 5 in Section 4.1. The copies of processes in Case 10 increase the size of the resulting SGP-process—in comparison to the original system—only with respect to conditionals that do not implement a choice between different labels of a sender or with respect to actors that are in their next step not influenced by the outcome of this conditional as in the type.

Example 1

As example consider the process

[TABLE]

that is well-typed with respect to

[TABLE]

Since the actors $\mathsf{\mathsf{s}}\!\left[\mathrm{3}\right]$ and $\mathsf{\mathsf{s}}\!\left[\mathrm{4}\right]$ act independent of the outcome of the conditional of $\mathsf{\mathsf{s}}\!\left[\mathrm{1}\right]$, the algorithm in Definition 10 copies the translation of the actors $\mathsf{\mathsf{s}}\!\left[\mathrm{3}\right]$ and $\mathsf{\mathsf{s}}\!\left[\mathrm{4}\right]$:

[TABLE]

However, we observe that in this case the duplication of the behaviour of the actors $\mathsf{\mathsf{s}}\!\left[\mathrm{3}\right]$ and $\mathsf{\mathsf{s}}\!\left[\mathrm{4}\right]$ is already visible in the type. So, if conditionals are used only to guide the choice between labels of an immediately following send-action, then again the corresponding increase of the size of the system in the algorithm is bounded by the size of the global types.

Finally, we observe that the size of a well-typed process is larger or equal to the sum of the sizes of its global types. We conclude that—except for the conditionals—the algorithm in Definition 11, takes a linear amount of steps and, thus, constructs a SGP-process of a size that is linear w. r. t. the size of the original system.

Corollary 1

Let $P$ be well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$. Assume that $P$ uses conditionals only to branch between alternative labels of a sender. Then the computation of the SGP-process $\operatorname{SGP^{\prime}}\!\left(\left\{P\right\},\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)$ is linear in the size of $P$ combined with the sum of the sizes of the types in $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$ and produces a SGP-process that is linear in this size.

This is very important. We map well-typed systems onto SGP-systems in order to avoid the problem of state space explosion that is caused by the concurrency of communication attempts, i. e., to avoid the in the worst case exponential blow-up of states that need to be considered in verification. MPST are a very efficient method to analyse the communication structure of the original system. Corollary 1 ensures that also the computation of the SGP-system is efficient, i. e., fast, and that the construction does not suffer from the problem of state space explosion, i. e., the generated SGP-system is not considerably larger than the original system. Since the construction sequentialises the original system and thereby removes all forms of interaction and restriction, the verification of the SGP-abstraction is much easier than the verification of the original system.

For the remainder of this section we assume that no alpha conversion is used to rename input binders.

Before we prove Theorem 2 of [13], i. e., that the mapping of Definition 11 returns a SGP-process whenever it is applied on a well-typed process and its global types, we show some properties on the different cases of Definition 11 (and implicitly also Definition 10). In particular we show that most of the cases preserve well-typedness, i. e., if their input is well-typed then so are the inputs of its recursive calls.

The first case replaces the set of considered processes by $\mathbf{0}$ if the global type is terminated and removes empty global types. This is safe, because processes that are well-typed w. r. t. end cannot contain communication prefixes.

Lemma 10 (Case 1a)

If $P$ is well-typed w. r. t. $\emptyset$ then $P$ contains only parallel compositions, conditionals, successful termination, and restriction.

Proof

Assume that $P$ is well-typed w. r. t. $\emptyset$, i. e., there are $\Gamma,\Delta$ such that $P$ is role-distributed, $\Gamma\vdash P\triangleright\Delta$, there are no global types in $\Gamma$, $\Delta$ is coherent w. r. t. $\emptyset$, and $\Gamma\vdash P\triangleright\Delta$ is globally progressing. Since there are no global types in $\Gamma$, the derivation of $\Gamma\vdash P\triangleright\Delta$ cannot use the Rules Req or Acc and, thus, $P$ cannot contain communication on shared channels. Because the other typing rules of Figure 2 can only reduce local types, neither the Rule Send nor Rule Get can be used and, thus, $P$ does not contain prefixes for sending or receiving within sessions. Because of that, $P$ cannot contain process variables and, thus, no recursion.

Lemma 11 (Case 1b)

If $P$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$, $k\in\mathrm{J}$, and $G_{k}=\textnormal{{end}}$ then $P$ contains no communication prefixes on $\mathsf{s}_{k}$ and cannot invite the session $\mathsf{s}_{k}$.

Proof

Assume that $P$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$, $k\in\mathrm{J}$, and $G_{k}=\textnormal{{end}}$, i. e., there are $\Gamma,\Delta$ such that $P$ is role-distributed, $\Gamma\vdash P\triangleright\Delta$, $\left\{G_{j}\right\}_{j\in\mathrm{J}}$ are the global types in $\Gamma$, $\Delta$ is coherent w. r. t. $\left\{\left(G_{j},\mathsf{n}_{j}\right)\right\}_{j\in\mathrm{J}}$, $\Gamma\vdash P\triangleright\Delta$ is globally progressing, and for all $j\in\mathrm{J}$ either $\mathsf{n}_{j}=\mathsf{s}_{j}$ or $\Gamma\vdash P\triangleright\Delta$ connects $\mathsf{n}_{j}$ with $\mathsf{s}_{j}$. Because $\mathsf{r}\!\left(\textnormal{{end}}\right)=\emptyset$ and $\Delta$ is coherent w. r. t. $\left\{\left(G_{j},\mathsf{n}_{j}\right)\right\}_{j\in\mathrm{J}}$, the session environment does not contain the (shared or session) channel $\mathsf{n}_{k}$, i. e., $\mathsf{n}_{k}\notin\Delta$. Then, the derivation of $\Gamma\vdash P\triangleright\Delta$ cannot use the Rules Req or Acc and, thus, $P$ cannot contain communication on $\mathsf{n}_{k}$. Hence, the session $\mathsf{s}_{k}$ cannot be invited. Because the other typing rules of Figure 2 can only reduce local types, neither the Rule Send nor Rule Get can be used and, thus, $P$ does not contain prefixes for sending or receiving within the session $\mathsf{s}_{k}$.

Since $P$ is well-typed w. r. t. end is a special case of the conditions $P$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$, $k\in\mathrm{J}$, and $G_{k}=\textnormal{{end}}$, Lemma 11 holds also for Case 1 of Definition 10.

Note that the restriction of session channels without communication is always useless, i. e., can be removed modulo structural congruence. The Cases 3, 4, 5, and 10 are used to decompose and unfold processes to make them accessible for the other cases. In all of these cases all recursive calls of the mapping are on sets of processes that—combined by parallel composition—are well-typed to the former global types. Thus, none of these cases allows the mapping to reduce the global types or to create any SGP-operators except for conditionals that are not reflected in global types. Instead they can be seen as preparation cases.

Case 3 removes restriction, but preserves well-typedness w. r. t. the same global types in its recursive call.

Lemma 12 (Case 3)

If $\prod_{i\in\mathrm{I}}{P_{i}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$ and there is some $k\in\mathrm{I}$ such that $P_{k}=\left(\nu\mathsf{s}\right)\!P_{k}^{\prime}$ then $\left(P_{k}^{\prime}\mid\left(\prod_{i\in\mathrm{I}\setminus\left\{k\right\}}{P_{i}}\right)\right)$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$.

Proof

Assume that $P=\prod_{i\in\mathrm{I}}{P_{i}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$ and there is some $k\in\mathrm{I}$ such that $P_{k}=\left(\nu\mathsf{s}\right)\!P_{k}^{\prime}$, i. e., there are $\Gamma,\Delta$ such that $P$ is role-distributed, $\left\{G_{j}\right\}_{j\in\mathrm{J}}$ are the global types in $\Gamma$, $\Delta$ is coherent w. r. t. $\left\{\left(G_{j},\mathsf{n}_{j}\right)\right\}_{j\in\mathrm{J}}$, $\Gamma\vdash P\triangleright\Delta$, $P$ is globally progressing, and for all $j\in\mathrm{J}$ either $\mathsf{n}_{j}=\mathsf{s}_{j}$ or $\Gamma\vdash P\triangleright\Delta$ connects $\mathsf{n}_{j}$ with $\mathsf{s}_{j}$. By Figure 2 and coherence, then there is some $l\in\mathrm{J}$ such that $\mathsf{n}_{l}$ is a shared channel, $\left\{\mathsf{a}\!\left<\mathrm{r}\right>\mid\mathrm{r}\in\mathsf{r}\!\left(G\right)\right\}\subseteq\Delta$, and $\mathsf{n}_{l}\mathbin{:}G_{l}\in\Gamma$. Then the derivation of $\Gamma\vdash P\triangleright\Delta$ starts with Rule Par to separate the judgement into $\Gamma\vdash\left(\nu\mathsf{s}\right)\!P_{j}^{\prime}\triangleright\Delta_{j}$ and the judgements for the $\Gamma\vdash P_{i}\triangleright\Delta_{i}$ with $i\neq j$. Let $\Gamma=\Gamma^{\prime},\mathsf{n}_{l}\mathbin{:}G_{l}$. Since $\mathsf{n}_{l}$ is not relevant for the derivations $\Gamma\vdash P_{i}\triangleright\Delta_{i}$ with $i\neq j$, we have $\Gamma^{\prime},\mathsf{n}_{l}\mathbin{:}G_{l}\!\left<\mathsf{s}_{l}\right>\vdash P_{i}\triangleright\Delta_{i}$ with $i\neq j$. From $\Gamma\vdash\left(\nu\mathsf{s}\right)\!P_{j}^{\prime}\triangleright\Delta_{j}$ and the typing rules, we get $\Gamma^{\prime},\mathsf{n}_{l}\mathbin{:}G_{l}\!\left<\mathsf{s}_{l}\right>\vdash P_{j}^{\prime}\triangleright\Delta_{j}^{\prime}$, where $\Delta_{j}^{\prime}=\left\{\mathsf{s}_{l}\!\left[\mathrm{r}\right]\mathbin{:}G_{l}\restriction\mathrm{r}\mid\mathrm{r}\in\mathsf{r}\!\left(G_{l}\right)\right\}$. By Rule Par, then $\Gamma^{\prime},\mathsf{n}_{l}\mathbin{:}G_{l}\!\left<\mathsf{s}_{l}\right>\vdash P_{k}^{\prime}\mid\left(\prod_{i\in\mathrm{I}\setminus\left\{k\right\}}{P_{i}}\right)\triangleright\Delta_{j}^{\prime},\bigcup_{i\neq j}\Delta_{i}$. By coherence, $\Delta_{j}^{\prime},\bigcup_{i\neq j}\Delta_{i}$ is coherent w. r. t. $\left\{\left(G_{j},\mathsf{n}_{j}\right)\right\}_{j\in\mathrm{J},j\neq l}\cup\left\{\left(G_{l},\mathsf{s}_{l}\right)\right\}$. Then, $\left(P_{k}^{\prime}\mid\left(\prod_{i\in\mathrm{I}\setminus\left\{k\right\}}{P_{i}}\right)\right)$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$.

Case 4 splits parallel composition and preserves well-typedness w. r. t. the same global types in its recursive call.

Lemma 13 (Case 4)

If $\prod_{i\in\mathrm{I}}{P_{i}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$ and there is some $k\in\mathrm{I}$ such that $P_{k}=P_{k1}\mid P_{k2}$ then $\left(P_{k1}\mid P_{k2}\mid\left(\prod_{i\in\mathrm{I}\setminus\left\{k\right\}}{P_{i}}\right)\right)$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$.

Proof

Follows from the typing rules in Figure 2 and Rule Par in particular.

Case 5 unfolds recursion in a process and preserves well-typedness w. r. t. the same global type in its recursive call.

Lemma 14 (Case 5)

If $\prod_{i\in\mathrm{I}}{P_{i}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$ and there is some $k\in\mathrm{I}$ such that $P_{k}=\left(\mu\mathrm{X}\right)P_{k}^{\prime}$ then $\left(P_{k}^{\prime}\left\{\nicefrac{{\left(\mu\mathrm{X}\right)P_{k}^{\prime}}}{{\mathrm{X}}}\right\}\mid\left(\prod_{i\in\mathrm{I}\setminus\left\{k\right\}}{P_{i}}\right)\right)$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$.

Proof

Assume that $P=\prod_{i\in\mathrm{I}}{P_{i}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$ and there is some $k\in\mathrm{I}$ such that $P_{k}=\left(\mu\mathrm{X}\right)P_{k}^{\prime}$, i. e., there are $\Gamma,\Delta$ such that $P$ is role-distributed, $\left\{G_{j}\right\}_{j\in\mathrm{J}}$ are the global types in $\Gamma$, $\Delta$ is coherent w. r. t. $\left\{\left(G_{j},\mathsf{n}_{j}\right)\right\}_{j\in\mathrm{J}}$, $\Gamma\vdash P\triangleright\Delta$, $P$ is globally progressing, and for all $j\in\mathrm{J}$ either $\mathsf{n}_{j}=\mathsf{s}_{j}$ or $\Gamma\vdash P\triangleright\Delta$ connects $\mathsf{n}_{j}$ with $\mathsf{s}_{j}$. By Lemma 2, then $\Gamma\vdash P_{j}^{\prime}\left\{\nicefrac{{\left(\mu\mathrm{X}\right)P_{j}^{\prime}}}{{\mathrm{X}}}\right\}\mid\left(\prod_{i\in\mathrm{I}\setminus\left\{j\right\}}{P_{i}}\right)\triangleright\Delta$. Then, $\left(P_{j}^{\prime}\left\{\nicefrac{{\left(\mu\mathrm{X}\right)P_{j}^{\prime}}}{{\mathrm{X}}}\right\}\mid\left(\prod_{i\in\mathrm{I}\setminus\left\{j\right\}}{P_{i}}\right)\right)$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$.

Case 10 maps a conditional of the original system on a SGP-conditional and preserves well-typedness w. r. t. the same global types in both of its recursive calls.

Lemma 15 (Case 10)

If $\prod_{i\in\mathrm{I}}{P_{i}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$ and there is some $k\in\mathrm{I}$ such that $P_{k}=\textnormal{{if }}\mathsf{c}\textnormal{{ then }}P_{k1}\textnormal{{ else }}P_{k2}$ then $\left(P_{k1}\mid\left(\prod_{i\in\mathrm{I}\setminus\left\{k\right\}}{P_{i}}\right)\right)$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$ and $\left(P_{k2}\mid\left(\prod_{i\in\mathrm{I}\setminus\left\{k\right\}}{P_{i}}\right)\right)$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$.

Proof

Assume that $P=\prod_{i\in\mathrm{I}}{P_{i}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$ and there is some $k\in\mathrm{I}$ such that $P_{k}=\textnormal{{if }}\mathsf{c}\textnormal{{ then }}P_{k1}\textnormal{{ else }}P_{k2}$, i. e., there are $\Gamma,\Delta$ such that $P$ is role-distributed, $\left\{G_{j}\right\}_{j\in\mathrm{J}}$ are the global types in $\Gamma$, $\Delta$ is coherent w. r. t. $\left\{\left(G_{j},\mathsf{n}_{j}\right)\right\}_{j\in\mathrm{J}}$, $\Gamma\vdash P\triangleright\Delta$, $P$ is globally progressing, and for all $j\in\mathrm{J}$ either $\mathsf{n}_{j}=\mathsf{s}_{j}$ or $\Gamma\vdash P\triangleright\Delta$ connects $\mathsf{n}_{j}$ with $\mathsf{s}_{j}$. By Figure 2, the derivation of $\Gamma\vdash P\triangleright\Delta$ starts with some applications of Rule Par that split the judgement into $\Gamma\vdash P_{k}\triangleright\Delta_{k}$ and $\Gamma\vdash P_{i}\triangleright\Delta_{i}$ for all $i\neq k$ such that $\Delta$ is the disjoint union of $\Delta_{k}$ and all $\Delta_{i}$. By Rule Cond, then $\Gamma\vdash P_{k1}\triangleright\Delta_{k}$ and $\Gamma\vdash P_{k2}\triangleright\Delta_{k}$. By Rule Par, then $\Gamma\vdash P_{k1}\mid\left(\prod_{i\in\mathrm{I}\setminus\left\{k\right\}}{P_{i}}\right)\triangleright\Delta$ and $\Gamma\vdash P_{k2}\mid\left(\prod_{i\in\mathrm{I}\setminus\left\{k\right\}}{P_{i}}\right)\triangleright\Delta$. Then $\left(P_{k1}\mid\left(\prod_{i\in\mathrm{I}\setminus\left\{k\right\}}{P_{i}}\right)\right)$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$ and $\left(P_{k2}\mid\left(\prod_{i\in\mathrm{I}\setminus\left\{k\right\}}{P_{i}}\right)\right)$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$.

If a process is well-typed w. r. t. a set of types containing a communication guarded global type and that communication guard is according to the interaction type system of [2] not dependent on another session, then it contains a corresponding sender and receiver that are guarded only by conditionals. Case 6 preserves well-typedness but may introduce superfluous input branches that are not matched by the global type $G_{n}$ of the continuation of this communication guard. Because of Rule Get, the type system abstracts from such superfluous branches of receivers.

Lemma 16 (Case 6)

If $\prod_{i\in\mathrm{I}}{P_{i}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$, none of the Cases 3, 4, or 5 can be applied, there is $l\in\mathrm{J}$ such that the session $\mathsf{s}_{l}$ is initialised, $G_{l}=\mathrm{r}_{1}\rightarrow\mathrm{r}_{2}\mathbin{:}\left\{\mathsf{l}_{k}\!\left<\tilde{\mathsf{U}}_{k}\right>\!.G_{l,k}\right\}_{k\in\mathrm{K}^{\prime}}$, and this communication does not depend on another session, then there are $m,o\in\mathrm{I}$, $n\in\mathrm{K}$ and $\mathrm{K}\subseteq\mathrm{K}^{\prime}$ such that every conditional branch of $P_{m}$ is a version of $\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}},\mathrm{\mathrm{r}_{2}}\right]!\mathsf{\mathsf{l}_{n}}\!\left<\tilde{\mathsf{e}}\right>\!.Q$, every conditional branch of $P_{o}$ is a version of $\mathsf{s}\!\left[\mathrm{\mathrm{r}_{2}},\mathrm{\mathrm{r}_{1}}\right]?\left\{\mathsf{\mathsf{l}_{k}}\!\left(\tilde{x}_{k}\right)\!.Q_{k}\right\}_{k\in\mathrm{K}^{\prime}}$, and $\left(Q_{n}\left\{\nicefrac{{\tilde{x}_{n}@\mathsf{s}\!\left[\mathrm{r}\right]}}{{\tilde{x}_{n}}}\right\}\mid Q\mid\left(\prod_{i\in\mathrm{I}\setminus\left\{m,o\right\}}{P_{i}}\right)\right)$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}\setminus\left\{l\right\}}\cup\left\{\left(G_{l,k},\mathsf{s}_{l}\right)\right\}$.

Proof

Assume that $P=\prod_{i\in\mathrm{I}}{P_{i}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$, none of the Cases 3, 4, or 5 can be applied, there is $l\in\mathrm{J}$ such that the session $\mathsf{s}_{l}$ is initialised, $G_{l}=\mathrm{r}_{1}\rightarrow\mathrm{r}_{2}\mathbin{:}\left\{\mathsf{l}_{k}\!\left<\tilde{\mathsf{U}}_{k}\right>\!.G_{l,k}\right\}_{k\in\mathrm{K}^{\prime}}$, and this communication does not depend on another session, i. e., there are $\Gamma,\Delta$ such that $P$ is role-distributed, $\left\{G_{j}\right\}_{j\in\mathrm{J}}$ are the global types in $\Gamma$, $\Delta$ is coherent w. r. t. $\left\{\left(G_{j},\mathsf{n}_{j}\right)\right\}_{j\in\mathrm{J}}$, $\Gamma\vdash P\triangleright\Delta$, $P$ is globally progressing, and for all $j\in\mathrm{J}$ either $\mathsf{n}_{j}=\mathsf{s}_{j}$ or $\Gamma\vdash P\triangleright\Delta$ connects $\mathsf{n}_{j}$ with $\mathsf{s}_{j}$. By Figure 2 and coherence, then there is $\mathsf{a}$ such that $\left\{\mathsf{s}\!\left[\mathrm{r}\right]\mathbin{:}G_{l}\restriction\mathrm{r}\mid\mathrm{r}\in\mathsf{r}\!\left(G_{l}\right)\right\}\subseteq\Delta$ and $\mathsf{a}\mathbin{:}G_{l}\!\left<\mathsf{s}_{l}\right>\in\Gamma$ or $\mathsf{a}\mathbin{:}G_{l}\in\Gamma$, where we have $\mathsf{s}_{l}\!\left[\mathrm{r_{1}}\right]\mathbin{:}\left[\mathrm{\mathrm{r}_{2}}\right]!\left\{\mathsf{l}_{k}\!\left<\tilde{\mathsf{U}}_{k}\right>\!.\left(G_{l,k}\restriction\mathrm{r}_{1}\right)\right\}_{k\in\mathrm{K}}$ for role $\mathrm{r}_{1}$ and $\mathsf{s}_{l}\!\left[\mathrm{r_{2}}\right]\mathbin{:}\left[\mathrm{\mathrm{r}_{1}}\right]?\left\{\mathsf{l}_{k}\!\left<\tilde{\mathsf{U}}_{k}\right>\!.\left(G_{l,k}\restriction\mathrm{r}_{2}\right)\right\}_{k\in\mathrm{K}}$ for role $\mathrm{r}_{2}$. By the Lemmata 1 and 8 and since this communication does not depend on another session, then there are $m,o\in\mathrm{I}$, $n\in\mathrm{K}$, $\mathrm{K}\subseteq\mathrm{K}^{\prime}$ such that every conditional branch of $P_{m}$ is a version of $P_{m}^{\prime}=\mathsf{\mathsf{s}_{\mathnormal{l}}}\!\left[\mathrm{\mathrm{r}_{1}},\mathrm{\mathrm{r}_{2}}\right]!\mathsf{\mathsf{l}_{n}}\!\left<\tilde{\mathsf{e}}\right>\!.Q$ and every conditional branch of $P_{o}$ is a version of $P_{o}^{\prime}=\mathsf{\mathsf{s}_{\mathnormal{l}}}\!\left[\mathrm{\mathrm{r}_{2}},\mathrm{\mathrm{r}_{1}}\right]?\left\{\mathsf{\mathsf{l}_{k}}\!\left(\tilde{x}_{k}\right)\!.Q_{k}\right\}_{k\in\mathrm{K}^{\prime}}$. By Figure 2, the derivation of $\Gamma\vdash P\triangleright\Delta$ starts with some applications of the Rules Par and Cond to split the judgement into $\Gamma\vdash P_{m}^{\prime}\triangleright\mathsf{s}_{l}\!\left[\mathrm{r_{1}}\right]\mathbin{:}\left[\mathrm{\mathrm{r}_{2}}\right]!\left\{\mathsf{l}_{k}\!\left<\tilde{\mathsf{U}}_{k}\right>\!.\left(G_{l,k}\restriction\mathrm{r}_{1}\right)\right\}_{k\in\mathrm{K}}$, $\Gamma\vdash P_{o}^{\prime}\triangleright\mathsf{s}_{l}\!\left[\mathrm{r_{2}}\right]\mathbin{:}\left[\mathrm{\mathrm{r}_{1}}\right]?\left\{\mathsf{l}_{k}\!\left<\tilde{\mathsf{U}}_{k}\right>\!.\left(G_{l,k}\restriction\mathrm{r}_{2}\right)\right\}_{k\in\mathrm{K}}$, and $\Gamma\vdash P_{i}\triangleright\Delta_{i}$ for all $m\neq i\neq o$. By the Rule Send and $n\in\mathrm{K}$, then the judgement for $m$ implies $\Gamma\vdash Q\triangleright\mathsf{s}_{l}\!\left[\mathrm{r_{1}}\right]\mathbin{:}G_{l,n}\restriction\mathrm{r}_{1}$. By Lemma 2, with the Rule Get and $n\in\mathrm{K}$, then $\Gamma\vdash Q_{n}\left\{\nicefrac{{\tilde{x}_{n}@\mathsf{s_{\mathnormal{l}}}\!\left[\mathrm{r_{2}}\right]}}{{\tilde{x}_{n}}}\right\}\triangleright\mathsf{s}\!\left[\mathrm{r_{2}}\right]\mathbin{:}G_{n}\restriction\mathrm{r}_{2}$. By Definition 3, then $G_{l}\restriction\mathrm{r}_{i}$ is similar to $G_{l,n}\restriction\mathrm{r}_{i}$ except for unnecessary branches of receivers for all $m\neq i\neq o$. By Rule Get, then $\Gamma\vdash P_{i}\triangleright\Delta_{i}$ implies $\Gamma\vdash P_{i}\triangleright\Delta_{i}^{\prime}$ for all $m\neq i\neq o$, where $\Delta_{i}^{\prime}=\Delta_{i}$ or $\Delta_{i}=\mathsf{s}_{l}\!\left[\mathrm{r_{i}}\right]\mathbin{:}G_{l}\restriction\mathrm{r}_{i}$ and $\Delta_{i}^{\prime}=\mathsf{s}_{l}\!\left[\mathrm{r_{i}}\right]\mathbin{:}G_{l,n}\restriction\mathrm{r}_{i}$. Since $P$ is role-distributed, so is $\left(Q_{n}\left\{\nicefrac{{\tilde{x}_{n}@\mathsf{s_{\mathnormal{l}}}\!\left[\mathrm{r_{2}}\right]}}{{\tilde{x}_{n}}}\right\}\mid Q\mid\left(\prod_{i\in\mathrm{I}\setminus\left\{m,o\right\}}{P_{i}}\right)\right)$. By the Rules Par and Cond, then $\left(Q_{n}\left\{\nicefrac{{\tilde{x}_{n}@\mathsf{s_{\mathnormal{l}}}\!\left[\mathrm{r_{2}}\right]}}{{\tilde{x}_{n}}}\right\}\mid Q\mid\left(\prod_{i\in\mathrm{I}\setminus\left\{m,o\right\}}{P_{i}}\right)\right)$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}\setminus\left\{l\right\}}\cup\left\{\left(G_{l,k},\mathsf{s}_{l}\right)\right\}$.

Well-typedness w. r. t. a parallel global type implies that the respective system can be separated into two parallel partitions. When considering the interleaving of several sessions, this separation is possible if the two partitions do not share actors.

Lemma 17 (Case 7a)

If $\prod_{i\in\mathrm{I}}{P_{i}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$ and there are some $\mathrm{J}_{1},\mathrm{J}_{2}$ such that $\mathrm{J}_{1}\cup\mathrm{J}_{2}=\mathrm{J}$, $\mathrm{J}_{1}\cap\mathrm{J}_{2}=\emptyset$, and there are no dependencies between the sessions in $\mathrm{J}_{1}$ and the sessions in $\mathrm{J}_{2}$ then there are $\mathrm{I}_{1},\mathrm{I}_{2}$ such that $\mathrm{I}_{1}\cup\mathrm{I}_{2}=\mathrm{I}$, $\bigcup_{i\in\mathrm{I}_{k}}\mathsf{act}\!\left(P_{i}\right)=\left\{\mathsf{s_{j}}\!\left[\mathrm{r}\right]\mid j\in\mathrm{J}_{k}\land\mathrm{r}\in\mathsf{r}\!\left(G_{j}\right)\right\}$, and $\left\{P_{i}\right\}_{i\in\mathrm{I}_{k}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}_{k}}$ for all $k\in\left\{1,2\right\}$.

Proof

Assume that $\prod_{i\in\mathrm{I}}{P_{i}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$ and there are some $\mathrm{J}_{1},\mathrm{J}_{2}$ such that $\mathrm{J}_{1}\cup\mathrm{J}_{2}=\mathrm{J}$, $\mathrm{J}_{1}\cap\mathrm{J}_{2}=\emptyset$, and there are no dependencies between the sessions in $\mathrm{J}_{1}$ and the sessions in $\mathrm{J}_{2}$, i. e., there are $\Gamma,\Delta$ such that $P$ is role-distributed, $\left\{G_{j}\right\}_{j\in\mathrm{J}}$ are the global types in $\Gamma$, $\Delta$ is coherent w. r. t. $\left\{\left(G_{j},\mathsf{n}_{j}\right)\right\}_{j\in\mathrm{J}}$, $\Gamma\vdash P\triangleright\Delta$, $P$ is globally progressing, and for all $j\in\mathrm{J}$ either $\mathsf{n}_{j}=\mathsf{s}_{j}$ or $\Gamma\vdash P\triangleright\Delta$ connects $\mathsf{n}_{j}$ with $\mathsf{s}_{j}$. By Figure 2, then the derivation of $\Gamma\vdash P\triangleright\Delta$ starts with Rule Par that splits the judgement into parallel components. Then, there are $\mathrm{I}_{1},\mathrm{I}_{2}$ such that $\mathrm{I}_{1}\cup\mathrm{I}_{2}=\mathrm{I}$ and $\bigcup_{i\in\mathrm{I}_{k}}\mathsf{act}\!\left(P_{i}\right)=\left\{\mathsf{s_{j}}\!\left[\mathrm{r}\right]\mid j\in\mathrm{J}_{k}\land\mathrm{r}\in\mathsf{r}\!\left(G_{j}\right)\right\}$ for all $k\in\left\{1,2\right\}$. Then, there are $\Delta_{1},\Delta_{2}$ such that $\Delta=\Delta_{1}\otimes\Delta_{2}$, $\Gamma\vdash\prod_{i\in\mathrm{I}_{1}}{P_{i}}\triangleright\Delta_{1}$, and $\Gamma\vdash\prod_{j\in\mathrm{I}_{2}}{P_{j}}\triangleright\Delta_{2}$. Since $\Delta$ is coherent w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$ and the actors of the partitions are distinct, $\Delta_{k}$ is coherent w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}_{k}}$ for $k\in\left\{1,2\right\}$. Hence, $\left\{P_{i}\right\}_{i\in\mathrm{I}_{1}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}_{1}}$ and $\left\{P_{i}\right\}_{i\in\mathrm{I}_{2}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}_{2}}$.

If a system is well-typed w. r. t. a set of types containing a parallel global type then the actors of these two parallel types are separated such that we can replace the session channel for one side (Case 7b). Accordingly we strengthen Case 7b to:

2. (b)

$\operatorname{SGP^{\prime}}\!\left(\left\{P_{i}^{\prime}\right\}_{i\in\mathrm{I}_{1}}\cup\left\{P_{i}\right\}_{i\in\mathrm{I}_{2}},\left\{\left(G_{k1},\mathsf{s}\right),\left(G_{k2},\mathsf{s}_{k}\right)\right\}\cup\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)$,

else if there are $k\in\mathrm{J}$, $\mathrm{I}_{1},\mathrm{I}_{2}$ such that $G_{k}=G_{k1},G_{k2}$, $\mathrm{I}_{1}\cup\mathrm{I}_{2}=\mathrm{I}$, $\mathrm{I}_{1}\cap\mathrm{I}_{2}=\emptyset$, $\left\{P_{i}\right\}_{i\in\mathrm{I}_{1}}$ implements all actors of $\left(G_{k1},\mathsf{s}_{k}\right)$ but no actor of $\left(G_{k2},\mathsf{s}_{k}\right)$, and $P_{i}^{\prime}$ is obtained from $P_{i}$ by substituting or alpha converting $\mathsf{s}_{k}$ by some fresh $\mathsf{s}$.

Note that the result of the algorithm, i. e., the SGP-process, does not contain session channels. Because of that, the above modification of Case 7b does not change the result of the algorithm. We use it only for the proof.

Lemma 18 (Case 7b)

If $\prod_{i\in\mathrm{I}}{P_{i}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$, none of the Cases 3, 4, or 5 can be applied, and there is $k\in\mathrm{J}$ such that $G_{k}=G_{k1},G_{k2}$ then there are $\mathrm{I}_{1},\mathrm{I}_{2}$ such that $\mathrm{I}_{1}\cup\mathrm{I}_{2}=\mathrm{I}$, $\mathrm{I}_{1}\cap\mathrm{I}_{2}=\emptyset$, $\left\{P_{i}\right\}_{i\in\mathrm{I}_{1}}$ implements all actors of $\left(G_{k1},\mathsf{s}_{k}\right)$ but no actor of $\left(G_{k2},\mathsf{s}_{k}\right)$, and $P_{i}^{\prime}$ is obtained from $P_{i}$ by substituting or alpha converting $\mathsf{s}_{k}$ by some fresh $\mathsf{s}$, and $\left\{P_{i}^{\prime}\right\}_{i\in\mathrm{I}_{1}}\cup\left\{P_{i}\right\}_{i\in\mathrm{I}_{2}}$ is well-typed w. r. t. $\left\{\left(G_{k1},\mathsf{s}\right),\left(G_{k2},\mathsf{s}_{k}\right)\right\}\cup\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$.

Proof

Assume that $P=\prod_{i\in\mathrm{I}}{P_{i}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$, none of the Cases 3, 4, or 5 can be applied, and there is $k\in\mathrm{J}$ such that $G_{k}=G_{k1},G_{k2}$, i. e., there are $\Gamma,\Delta$ such that $P$ is role-distributed, $\left\{G_{j}\right\}_{j\in\mathrm{J}}$ are the global types in $\Gamma$, $\Delta$ is coherent w. r. t. $\left\{\left(G_{j},\mathsf{n}_{j}\right)\right\}_{j\in\mathrm{J}}$, $\Gamma\vdash P\triangleright\Delta$, $P$ is globally progressing, and for all $j\in\mathrm{J}$ either $\mathsf{n}_{j}=\mathsf{s}_{j}$ or $\Gamma\vdash P\triangleright\Delta$ connects $\mathsf{n}_{j}$ with $\mathsf{s}_{j}$. Since $P$ is role-distributed, there are $\mathrm{I}_{1}\cup\mathrm{I}_{2}=\mathrm{I}$ such that $\prod_{i\in\mathrm{I}_{1}}{P_{i}}$ is role-distributed, $\prod_{j\in\mathrm{I}_{2}}{P_{j}}$ is role-distributed, $\bigcup_{i\in\mathrm{I}_{1}}\mathsf{act}\!\left(P_{i}\right)\cap\mathsf{act}\!\left(G_{k}\right)=\mathsf{act}\!\left(G_{k1}\right)$, and $\bigcup_{j\in\mathrm{I}_{2}}\mathsf{act}\!\left(P_{j}\right)\cap\mathsf{act}\!\left(G_{k}\right)=\mathsf{act}\!\left(G_{k2}\right)$. By Figure 2, then the derivation of $\Gamma\vdash P\triangleright\Delta$ starts with Rule Par that splits the judgement into parallel components. Then there are $\Delta_{1},\Delta_{2}$ such that $\Delta=\Delta_{1}\otimes\Delta_{2}$, $\Gamma\vdash\prod_{i\in\mathrm{I}_{1}}{P_{i}}\triangleright\Delta_{1}$, and $\Gamma\vdash\prod_{j\in\mathrm{I}_{2}}{P_{j}}\triangleright\Delta_{2}$. Let $\mathsf{s}$ be fresh. Since we removed already all top-level restrictions with Case 3, $\mathsf{s}_{k}$ is free in $P$. Then, $\Gamma\left\{\nicefrac{{\mathsf{s}}}{{\mathsf{s}_{k}}}\right\}\vdash\prod_{i\in\mathrm{I}_{1}}{P_{i}}\left\{\nicefrac{{\mathsf{s}}}{{\mathsf{s}_{k}}}\right\}\triangleright\Delta_{1}\left\{\nicefrac{{\mathsf{s}}}{{\mathsf{s}_{k}}}\right\}$. By Rule Par, then $\Gamma^{\prime}\vdash P\triangleright\Delta^{\prime}$, where $\Gamma^{\prime}=\Gamma,\mathsf{a}_{1}\mathbin{:}G_{k1}\!\left<\mathsf{s}\right>,\mathsf{a}_{2}\mathbin{:}G_{k2}\!\left<\mathsf{s}_{k}\right>$ for some fresh $\mathsf{a}_{1},\mathsf{a}_{2}$ and $\Delta^{\prime}=\Delta_{1}\left\{\nicefrac{{\mathsf{s}}}{{\mathsf{s}_{k}}}\right\}\otimes\Delta_{2}$. Since $\Delta$ is coherent w. r. t. $\left\{\left(G_{j},\mathsf{n}_{j}\right)\right\}_{j\in\mathrm{J}}$ and the actors of the partitions are distinct, $\Delta^{\prime}$ is coherent w. r. t. $\left\{\left(G_{k1},\mathsf{s}\right),\left(G_{k2},\mathsf{s}_{k}\right)\right\}\cup\left\{\left(G_{j},\mathsf{n}_{j}\right)\right\}_{j\in\mathrm{J}}$. Hence, $\left\{P_{i}^{\prime}\right\}_{i\in\mathrm{I}_{1}}\cup\left\{P_{i}\right\}_{i\in\mathrm{I}_{2}}$ is well-typed w. r. t. $\left\{\left(G_{k1},\mathsf{s}\right),\left(G_{k2},\mathsf{s}_{k}\right)\right\}\cup\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$.

Case 9 maps the communication partners of a session invitation on an empty value update. It preserves well-typedness in its recursive call w. r. t. the same global types. By Lemma 8, if one of the necessary prefixes for a session invitation is unguarded and this invitation is according to the interaction type system of [2] not dependent on another session then all other necessary prefixes are composed in parallel and are guarded by conditionals only.

Lemma 19 (Case 9)

If $\prod_{i\in\mathrm{I}}{P_{i}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$, $l\in\mathrm{J}$, none of the Cases 3, 4, or 5 can be applied, the session $\mathsf{s}_{l}$ is not initialised, and this session initialisation does not depend on another session then there are $k1,\ldots,kn\in\mathrm{I}$ such that every conditional branch of $P_{k1}$ is a version of $\overline{\mathsf{a}}\!\left[\mathrm{\mathrm{2}..\mathrm{n}}\right]\!\left(\mathsf{s}\right)\!.P_{1}^{\prime}$, every conditional branch of $P_{k2}$ is a version of $\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{2}}\right]\right)\!.P_{2}^{\prime}$, …, every conditional branch of $P_{kn}$ is a version of $\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{n}}\right]\right)\!.P_{n}^{\prime}$, and $\left\{P_{1}^{\prime},\ldots,P_{n}^{\prime}\right\}\cup\left\{P_{i}\right\}_{i\in\mathrm{I}\setminus\left\{k1,\ldots,kn\right\}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$.

Proof

Assume $\prod_{i\in\mathrm{I}}{P_{i}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$, $l\in\mathrm{J}$, none of the Cases 3, 4, or 5 can be applied, the session $\mathsf{s}_{l}$ is not initialised, and this session initialisation does not depend on another session, i. e., there are $\Gamma,\Delta$ such that $P$ is role-distributed, $\left\{G_{j}\right\}_{j\in\mathrm{J}}$ are the global types in $\Gamma$, $\Delta$ is coherent w. r. t. $\left\{\left(G_{j},\mathsf{n}_{j}\right)\right\}_{j\in\mathrm{J}}$, $\Gamma\vdash P\triangleright\Delta$, $P$ is globally progressing, and for all $j\in\mathrm{J}$ either $\mathsf{n}_{j}=\mathsf{s}_{j}$ or $\Gamma\vdash P\triangleright\Delta$ connects $\mathsf{n}_{j}$ with $\mathsf{s}_{j}$. By coherence and since there is no dependency to other sessions, there are $k1,\ldots,kn\in\mathrm{I}$ such that every conditional branch of $P_{k1}$ is a variant of $\overline{\mathsf{a}}\!\left[\mathrm{\mathrm{2}..\mathrm{n}}\right]\!\left(\mathsf{s}\right)\!.P_{1}^{\prime}$, every conditional branch of $P_{k2}$ is a variant of $\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{2}}\right]\right)\!.P_{2}^{\prime}$, …, every conditional branch of $P_{kn}$ is a variant of $\mathsf{a}\!\left(\mathsf{s}\!\left[\mathrm{\mathrm{n}}\right]\right)\!.P_{n}^{\prime}$. By the Rules If-T, If-F, and Link of Figure 1, $P\longmapsto^{*}\left(\nu\mathsf{s}_{l}\right)\!\left(\prod_{i\in\left\{k1,\ldots,kn\right\}}{P_{i}^{\prime}}\mid\prod_{i\in\mathrm{I}\setminus\left\{k1,\ldots,kn\right\}}{P_{i}}\right)$. By Lemma 5, Lemma 6, and since only conditionals and a session initialisation is performed in these steps, then $\left(\nu\mathsf{s}_{l}\right)\!\left(\prod_{i\in\left\{k1,\ldots,kn\right\}}{P_{i}^{\prime}}\mid\prod_{i\in\mathrm{I}\setminus\left\{k1,\ldots,kn\right\}}{P_{i}}\right)$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$. By Lemma 12, then $\left\{P_{1}^{\prime},\ldots,P_{n}^{\prime}\right\}\cup\left\{P_{i}\right\}_{i\in\mathrm{I}\setminus\left\{k1,\ldots,kn\right\}}$ is well-typed w. r. t. the types $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$.

Finally, we prove Theorem 2 of [13]:

If $P$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$ then the abstraction $\operatorname{SGP^{\prime}}\!\left(\left\{P\right\},\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)$ is defined and returns a SGP-process.

Proof (Proof of Theorem 2 of [13])

Assume $P$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$. We proceed with an induction over the set $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$ and the structure of the types in this set (Definition 1).

Case of ${\mathrm{J}}=\emptyset$:

By Case 1a, then $\operatorname{SGP^{\prime}}\!\left(\left\{P_{i}\right\}_{i\in\mathrm{I}},\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)$ is defined and returns $\mathbf{0}$.

Case of ${\mathrm{J}=\mathrm{J}_{1}\cup\mathrm{J}_{2}}$, ${\mathrm{J}_{1}\cap\mathrm{J}_{2}=\emptyset}$, and ${\mathrm{J}_{1}},{\mathrm{J}_{2}}$ are independent:

By Lemma 17, then there are $\mathrm{I}_{1},\mathrm{I}_{2},k\in\left\{1,2\right\}$ such that $\mathrm{I}_{1}\cup\mathrm{I}_{2}=\mathrm{I}$, $\bigcup_{i\in\mathrm{I}_{k}}\mathsf{act}\!\left(P_{i}\right)=\left\{\mathsf{s_{j}}\!\left[\mathrm{r}\right]\mid j\in\mathrm{J}_{k}\land\mathrm{r}\in\mathsf{r}\!\left(G_{j}\right)\right\}$, and the composition $\left\{P_{i}\right\}_{i\in\mathrm{I}_{k}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}_{k}}$. Since the two parts do not share actors and we indicate input variables with actors, $S_{1}$ and $S_{2}$ are independent. By the induction hypothesis, then both $\operatorname{SGP^{\prime}}\!\left(\left\{P_{i}\right\}_{i\in\mathrm{I}_{k}},\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}_{k}}\right)$ for $k\in\left\{1,2\right\}$ are defined and return the SGP-processes $S_{1}$ and $S_{2}$. By Case 7a, then $\operatorname{SGP^{\prime}}\!\left(\left\{P_{i}\right\}_{i\in\mathrm{I}},\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)$ is defined and returns $S_{1}\parallel S_{2}$.

Case of $G_{l}=\mathrm{r}_{1}\rightarrow\mathrm{r}_{2}\mathbin{:}\left\{\mathsf{l}_{i}\!\left<\tilde{\mathsf{U}}_{i}\right>\!.G_{i}\right\}_{i\in\mathrm{I}}$ with $l\in{\mathrm{J}}$ and $G_{l}$ is independent:

By the Lemmata 12, 13, 14, and 19, the mapping can remove restrictions, split parallel compositions, unfold recursions, and initialise the session $\mathsf{s}_{l}$ of $G_{l}$ of the process without altering the global types or violating well-typedness. Let $\prod_{i\in\mathrm{I}}{P_{i}}$ be the result of these cases such that $\prod_{i\in\mathrm{I}}{P_{i}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$. By Lemma 16, there are $m,o\in\mathrm{I}$, $n\in\mathrm{K}$ and $\mathrm{K}\subseteq\mathrm{K}^{\prime}$ such that in every conditional branch of $P_{m}$ there is a version of $P_{m}^{\prime}=\mathsf{\mathsf{s}_{\mathnormal{l}}}\!\left[\mathrm{\mathrm{r}_{1}},\mathrm{\mathrm{r}_{2}}\right]!\mathsf{\mathsf{l}_{n}}\!\left<\tilde{\mathsf{e}}\right>\!.Q$ and in every conditional branch of $P_{o}$ there is a version of $P_{o}^{\prime}=\mathsf{\mathsf{s}_{\mathnormal{l}}}\!\left[\mathrm{\mathrm{r}_{2}},\mathrm{\mathrm{r}_{1}}\right]?\left\{\mathsf{\mathsf{l}_{k}}\!\left(\tilde{x}_{k}\right)\!.Q_{k}\right\}_{k\in\mathrm{K}^{\prime}}$. By Lemma 15, all conditionals that guard either $P_{m}^{\prime}$ or $P_{o}^{\prime}$ can be mapped on SGP-conditionals without violating well-typedness, where we possibly have to apply the Lemmata 12, 13, and 14 in between and the order of cases in Definition 11 allows to resolve exactly these conditionals before resolving the communication in $G_{l}$. This is because the structure of $G_{l}$ rules out the Cases 1a, 2, 7b, and 8, the fact that the communication that guards $G_{l}$ is not dependent on another session rules out Case 9, and Case 6 becomes applicable as soon as all of these conditionals are resolved. By Lemma 16, then $\left(Q_{n}\left\{\nicefrac{{\tilde{x}_{n}@\mathsf{s_{\mathnormal{l}}}\!\left[\mathrm{r_{2}}\right]}}{{\tilde{x}_{n}}}\right\}\mid Q\mid\left(\prod_{i\in\mathrm{I}\setminus\left\{m,o\right\}}{P_{i}}\right)\right)$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}\setminus\left\{l\right\}}\cup\left\{\left(G_{l,k},\mathsf{s}_{l}\right)\right\}$. By Figure 2, all branches of the conditionals are well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}\setminus\left\{l\right\}}\cup\left\{\left(G_{l,k},\mathsf{s}_{l}\right)\right\}$, i. e., we unguard versions of $P_{m}^{\prime}$ and $P_{o}^{\prime}$—that may differ in their labels but only implement labels that are specified in the type—in all branches. By the induction hypothesis, then $\operatorname{SGP^{\prime}}\!\left(\mathcal{P},\mathcal{G}\right)$ with $\mathcal{P}=\left\{Q_{m}\left\{\nicefrac{{\tilde{x}_{m}@\mathsf{s_{\mathnormal{l}}}\!\left[\mathrm{r_{2}}\right]}}{{\tilde{x}_{m}}}\right\},Q\right\}\cup\left\{P_{i}\right\}_{i\in\mathrm{I}\setminus\left\{m,o\right\}}$ and $\mathcal{G}=\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}\setminus\left\{l\right\}}\cup\left\{\left(G_{l,k},\mathsf{s}_{l}\right)\right\}$ is defined and returns a SGP-process $S^{\prime}$ for each of these branches. Let $S$ be the result of putting the respective version of $\tilde{x}_{m}@\mathsf{s_{\mathnormal{l}}}\!\left[\mathrm{r_{2}}\right]\mathbin{:=}\mathsf{\tilde{\mathsf{e}}}.S^{\prime}$ in the respective branch of the generated SGP-conditionals. By the Cases 6 and 10, then $\operatorname{SGP^{\prime}}\!\left(\left\{P_{i}\right\}_{i\in\mathrm{I}},\mathcal{G}\right)$ is defined and returns $S$.

Case of $G_{l}=G_{1},G_{2}$ with $l\in{\mathrm{J}}$:

By the Lemmata 12, 13, and 14, the mapping can remove restrictions, split parallel compositions, and unfold recursions of the process without altering the global type or violating well-typedness. Let $\prod_{i\in\mathrm{I}}{P_{i}}$ be the result of these cases such that $\prod_{i\in\mathrm{I}}{P_{i}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$. By Lemma 18, then there are $\mathrm{I}_{1},\mathrm{I}_{2}$ such that $\mathrm{I}_{1}\cup\mathrm{I}_{2}=\mathrm{I}$, $\mathrm{I}_{1}\cap\mathrm{I}_{2}=\emptyset$, $\left\{P_{i}\right\}_{i\in\mathrm{I}_{1}}$ implements all actors of $\left(G_{k1},\mathsf{s}_{k}\right)$ but no actor of $\left(G_{k2},\mathsf{s}_{k}\right)$, and $P_{i}^{\prime}$ is obtained from $P_{i}$ by substituting or alpha converting $\mathsf{s}_{k}$ by some fresh $\mathsf{s}$, and $\left\{P_{i}^{\prime}\right\}_{i\in\mathrm{I}_{1}}\cup\left\{P_{i}\right\}_{i\in\mathrm{I}_{2}}$ is well-typed w. r. t. $\left\{\left(G_{k1},\mathsf{s}\right),\left(G_{k2},\mathsf{s}_{k}\right)\right\}\cup\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$. By the induction hypothesis, then $\operatorname{SGP^{\prime}}\!\left(\mathcal{P},\mathcal{G}\right)$ with $\mathcal{P}=\left\{P_{i}^{\prime}\right\}_{i\in\mathrm{I}_{1}}\cup\left\{P_{i}\right\}_{i\in\mathrm{I}_{2}}$ and $\mathcal{G}=\left\{\left(G_{k1},\mathsf{s}\right),\left(G_{k2},\mathsf{s}_{k}\right)\right\}\cup\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$ is defined and returns a SGP-process $S$. By Case 7b, then $\operatorname{SGP^{\prime}}\!\left(\left\{P_{i}\right\}_{i\in\mathrm{I}},\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)$ is defined and returns $S$.

Case of $G_{l}=\left(\mu\mathrm{t}_{l}\right)G_{l}^{\prime}$ with $l\in{\mathrm{J}}$:

By the dependency relation, the loops of different interleaved session are unified, i. e., by performing the other cases we can reduce the types such that $G_{j}=\left(\mu\mathrm{t}_{j}\right)G_{j}^{\prime}$ for all $j\in\mathrm{J}$. By the Lemmata 12, 13, 14, and 19 the mapping can remove restrictions, split parallel compositions, unfold recursions, and initialise sessions of the process without altering the global type or violating well-typedness. Let $\prod_{i\in\mathrm{I}}{P_{i}}$ be the result of these cases such that $\prod_{i\in\mathrm{I}}{P_{i}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$. Since type variables are bound and guarded in global types, $G_{l}$ can reduce to a type variable only after Case 8 has introduced a SGP-recursion. Note that neither Case 8 nor Case 2 introduce requirements on the considered process. Unfortunately, the arguments of the recursive call of Case 8 do not preserve well-typedness, i. e., $\left\{P_{i}\right\}_{i\in\mathrm{I}}$ is not well-typed w. r. t. $\left\{\left(G_{j}^{\prime},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$, because we removed the recursion binder from the type but not the system. By Figure 2, $\left\{P_{i}\right\}_{i\in\mathrm{I}}$ will behave as required by $\left\{\left(G_{j}^{\prime},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$ until $\left\{\left(G_{j}^{\prime},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$ is reduced to $\mathcal{G}=\left\{\mathrm{t}_{j}\right\}_{j\in\mathrm{J}}$ and, thus, there are $P_{i}^{\prime}$ such that $\left\{P_{i}^{\prime}\right\}_{i\in\mathrm{I}}$ is well-typed w. r. t. $\left\{\left(G_{j}^{\prime},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$. By the induction hypothesis, then $\operatorname{SGP^{\prime}}\!\left(\left\{P_{i}^{\prime}\right\}_{i\in\mathrm{I}},\left\{\left(G_{j}^{\prime},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)$ is defined and returns a SGP-process $S$. By Definition 11, the mapping will follow the structure of $\left\{\left(G_{j}^{\prime},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$ to reduce the system until $\left\{\left(G_{j}^{\prime},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$ is reduced to $\mathcal{G}$ and then Case 2 will ignore the remainder of the system. Thus, the mapping considers only the parts of $\left\{P_{i}\right\}_{i\in\mathrm{I}}$ that are already captured in $\left\{P_{i}^{\prime}\right\}_{i\in\mathrm{I}}$, i. e., we have $\operatorname{SGP^{\prime}}\!\left(\left\{P_{i}\right\}_{i\in\mathrm{I}},\left\{\left(G_{j}^{\prime},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)=\operatorname{SGP^{\prime}}\!\left(\left\{P_{i}^{\prime}\right\}_{i\in\mathrm{I}},\left\{\left(G_{j}^{\prime},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)=S$. By Case 8, then $\operatorname{SGP^{\prime}}\!\left(\left\{P_{i}\right\}_{i\in\mathrm{I}},\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)$ is defined and returns $\left(\mu\mathrm{X}_{\mathcal{G}}\right)S$.

Case of $G_{l}=\mathrm{t}$ with $j\in{\mathrm{J}}$:

By the dependency relation, the loops of different interleaved session are unified, i. e., by performing the other cases we can reduce the types such that $G_{j}=\mathrm{t}_{j}$ for all $j\in\mathrm{J}$. By Case 2, then $\operatorname{SGP}\!\left(\left\{P_{i}\right\}_{i\in\mathrm{I}},\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)$ is defined and returns $\mathrm{X}_{\mathcal{G}}$ with $\mathcal{G}=\left\{\mathrm{t}_{j}\right\}_{j\in\mathrm{J}}$.

Case of $G_{l}=\textnormal{{end}}$ with $l\in{\mathrm{J}}$:

By Lemma 11, then $P$ contains no communication prefixes on $\mathsf{s}_{k}$ and cannot invite the session $\mathsf{s}_{k}$. Then, $\left\{P_{i}\right\}_{i\in\mathrm{I}}$ is well-typed w. r. t. $\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}\setminus\left\{l\right\}}$. By the induction hypothesis, then we know that $\operatorname{SGP^{\prime}}\!\left(\left\{P_{i}\right\}_{i\in\mathrm{I}},\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}\setminus\left\{l\right\}}\right)$ is defined and returns a SGP-process $S$. By Case 1b, then $\operatorname{SGP^{\prime}}\!\left(\left\{P_{i}\right\}_{i\in\mathrm{I}},\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)$ is defined and returns $S$.

Alpha conversion may influence the outcome of the mapping, i. e., $P\equiv_{\alpha}P^{\prime}$ does not necessarily imply $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)=\operatorname{SGP}^{*}\!\left(\left\{P^{\prime}\right\},\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}\right)$, because the renaming of input bounded variables changes the names in the vector of the generated SGP-system. Because of that, we assume in this section that no sequence of steps will use alpha conversion to rename input binders. Apart from that, structural congruence does not influence this mapping, because of the Cases 3, 4, and 5.

Lemma 20

*Let $\mathcal{G}=\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$.

If $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\mathcal{G}\right)$ is defined and $P\equiv P^{\prime}$, where no alpha conversion is used to rename input binders, then $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\mathcal{G}\right)=\operatorname{SGP}^{*}\!\left(\left\{P^{\prime}\right\},\mathcal{G}\right)$.*

Proof

Assume that $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\mathcal{G}\right)$ is defined. We proceed with an induction over the rules of structural congruence that are used to obtain $P\equiv P^{\prime}$.

Case of Alpha Conversion:

In this case $P\equiv_{\alpha}P^{\prime}$, i. e., $P$ and $P^{\prime}$ differ only by renamings of names used for restriction binders. By Definition 11 and Lemma 12, then $\operatorname{SGP^{\prime}}\!\left(\left\{P\right\},\mathcal{G}\right)=\operatorname{SGP^{\prime}}\!\left(\left\{P^{\prime}\right\},\mathcal{G}\right)$. Hence, $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\mathcal{G}\right)=\operatorname{SGP}^{*}\!\left(\left\{P^{\prime}\right\},\mathcal{G}\right)$.

Case of $Q\mid\mathbf{0}\equiv{Q}$:

In this case $P=Q\mid\mathbf{0}$ and $P^{\prime}=Q$. By Definition 11, $\operatorname{SGP^{\prime}}\!\left(\left\{P\right\},\mathcal{G}\right)=\operatorname{SGP^{\prime}}\!\left(\left\{Q,\mathbf{0}\right\},\mathcal{G}\right)=\operatorname{SGP^{\prime}}\!\left(\left\{Q\right\},\mathcal{G}\right)$. Then $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\mathcal{G}\right)=\operatorname{SGP}^{*}\!\left(\left\{P^{\prime}\right\},\mathcal{G}\right)$.

Case of $Q_{1}\mid Q_{2}\equiv Q_{2}\mid Q_{1}$:

In this case $P=Q_{1}\mid Q_{2}$ and $P^{\prime}=Q_{2}\mid Q_{1}$. By Definition 11, then $\operatorname{SGP^{\prime}}\!\left(\left\{P\right\},\mathcal{G}\right)=\operatorname{SGP^{\prime}}\!\left(\left\{Q_{1},Q_{2}\right\},\mathcal{G}\right)=\operatorname{SGP^{\prime}}\!\left(\left\{P^{\prime}\right\},\mathcal{G}\right)$. Then, we have $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\mathcal{G}\right)=\operatorname{SGP}^{*}\!\left(\left\{P^{\prime}\right\},\mathcal{G}\right)$.

Case of $Q_{1}\mid\left(Q_{2}\mid Q_{3}\right)\equiv\left(Q_{1}\mid Q_{2}\right)\mid Q_{3}$:

In this case $P=Q_{1}\mid\left(Q_{2}\mid Q_{3}\right)$ and $P^{\prime}=\left(Q_{1}\mid Q_{2}\right)\mid Q_{3}$. Then $\operatorname{SGP^{\prime}}\!\left(\left\{P\right\},\mathcal{G}\right)=\operatorname{SGP^{\prime}}\!\left(\left\{Q_{1},Q_{2},Q_{3}\right\},\mathcal{G}\right)=\operatorname{SGP^{\prime}}\!\left(\left\{P^{\prime}\right\},\mathcal{G}\right)$, because of Definition 11. Then, $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\mathcal{G}\right)=\operatorname{SGP}^{*}\!\left(\left\{P^{\prime}\right\},\mathcal{G}\right)$.

Case of $\left(\nu\mathsf{s}\right)\!\left(\nu\mathsf{s}^{\prime}\right)\!Q\equiv\left(\nu\mathsf{s}^{\prime}\right)\!\left(\nu\mathsf{s}\right)\!Q$:

In this case we have $P=\left(\nu\mathsf{s}\right)\!\left(\nu\mathsf{s}^{\prime}\right)\!Q$ and $P^{\prime}=\left(\nu\mathsf{s}^{\prime}\right)\!\left(\nu\mathsf{s}\right)\!Q$. By Definition 11, then $\operatorname{SGP^{\prime}}\!\left(\left\{P\right\},\mathcal{G}\right)=\operatorname{SGP^{\prime}}\!\left(\left\{Q\right\},\mathcal{G}\right)=\operatorname{SGP^{\prime}}\!\left(\left\{P^{\prime}\right\},\mathcal{G}\right)$. Then, we have $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\mathcal{G}\right)=\operatorname{SGP}^{*}\!\left(\left\{P^{\prime}\right\},\mathcal{G}\right)$.

Case of $\left(\nu\mathsf{s}\right)\!\mathbf{0}\equiv\mathbf{0}$:

In this case $P=\left(\nu\mathsf{s}\right)\!\mathbf{0}$ and $P^{\prime}=\mathbf{0}$. By Definition 11, $\operatorname{SGP^{\prime}}\!\left(\left\{P\right\},G\right)=\operatorname{SGP^{\prime}}\!\left(\left\{\mathbf{0}\right\},G\right)$. Then $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\mathcal{G}\right)=\operatorname{SGP}^{*}\!\left(\left\{P^{\prime}\right\},\mathcal{G}\right)$.

Case of $\left(\mu\mathrm{X}\right)Q\equiv{Q}\left\{\nicefrac{{\left(\mu\mathrm{X}\right)Q}}{{\mathrm{X}}}\right\}$:

In this case we have $P=\left(\mu\mathrm{X}\right)Q$ and $P^{\prime}={Q}\left\{\nicefrac{{\left(\mu\mathrm{X}\right)Q}}{{\mathrm{X}}}\right\}$. Then $\operatorname{SGP^{\prime}}\!\left(\left\{P\right\},\mathcal{G}\right)=\operatorname{SGP^{\prime}}\!\left(\left\{\left(\mu\mathrm{X}\right)Q\right\},\mathcal{G}\right)=\operatorname{SGP^{\prime}}\!\left(\left\{{Q}\left\{\nicefrac{{\left(\mu\mathrm{X}\right)Q}}{{\mathrm{X}}}\right\}\right\},\mathcal{G}\right)$, because of Definition 11. Then, we have $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\mathcal{G}\right)=\operatorname{SGP}^{*}\!\left(\left\{P^{\prime}\right\},\mathcal{G}\right)$.

Case of $\left(\nu\mathsf{s}\right)\!\left(Q_{1}\mid Q_{2}\right)\equiv Q_{1}\mid\left(\nu\mathsf{s}\right)\!Q_{2}$ if $\mathsf{s}\notin\mathsf{fn}\!\left(Q_{1}\right)$:

In this case $P=\left(\nu\mathsf{s}\right)\!\left(Q_{1}\mid Q_{2}\right)$ and $P^{\prime}=Q_{1}\mid\left(\nu\mathsf{s}\right)\!Q_{2}$. By Definition 11, then $\operatorname{SGP^{\prime}}\!\left(\left\{P\right\},\mathcal{G}\right)=\operatorname{SGP^{\prime}}\!\left(\left\{Q_{1},Q_{2}\right\},\mathcal{G}\right)=\operatorname{SGP^{\prime}}\!\left(\left\{P^{\prime}\right\},\mathcal{G}\right)$. Finally, we have $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\mathcal{G}\right)=\operatorname{SGP}^{*}\!\left(\left\{P^{\prime}\right\},\mathcal{G}\right)$.

Now we analyse how the original system and its sequentialisation into a SGP-system are related. First we prove that SGP-systems introduce no new behaviour in Theorem 3 of [13]:

Let $\mathcal{G}=\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$. If $P$ is well-typed w. r. t. $\mathcal{G}$ then for all $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\mathcal{G}\right)\longmapsto\mathcal{S}^{\prime}$ there exist $P^{\prime},\mathcal{G}^{\prime}$ such that $P\longmapsto P^{\prime}$, $P^{\prime}$ is well-typed w. r. t. $\mathcal{G}^{\prime}$, and $\operatorname{SGP}^{*}\!\left(\left\{P^{\prime}\right\},\mathcal{G}^{\prime}\right)\equiv_{\mathcal{S}}\mathcal{S}^{\prime}$.

Proof (Proof of Theorem 3 of [13])

Assume that $P$ is well-typed w. r. t. $\mathcal{G}$. We proceed by an induction on the reduction rules that are used to derive the step $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\mathcal{G}\right)\longmapsto\mathcal{S}^{\prime}$.

Case of Rule Ass:

In this case we have $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\mathcal{G}\right)=\left<\mathcal{V};\tilde{v}\mathbin{:=}\mathsf{\tilde{e}}.S\right>$ and $\mathcal{S}^{\prime}=\textsf{eval}\!\left(\left<\mathcal{V}\!\left(\tilde{v}\right)\mathbin{:=}\tilde{\mathsf{e}};S\right>\right)$. By Lemma 16, then either $\tilde{v}\mathbin{:=}\mathsf{\tilde{e}}.S$ is the empty assignment $\tau$ that resulted from mapping a session initialisation (Case 9) or this assignment is not empty and resulted from mapping a communication of an initialised session (Case 6).

Case of $\tilde{v}\mathbin{:=}\mathsf{\tilde{e}}.S=\tau.S$:

Since the value assignment is unguarded,

[TABLE]

where we do not alpha-convert input binders but use alpha conversion to ensure that $\mathsf{s}$ is not contained in $\left(\tilde{\mathsf{s}}\cup\mathsf{bn}\!\left(P_{1}\mid P_{2}\mid\ldots\mid P_{n}\right)\cup\mathsf{n}\!\left(Q\right)\right)$. By Figure 1, then $P\longmapsto P^{\prime}=\left(\nu\tilde{\mathsf{s}}\right)\!\left(\nu\mathsf{s}\right)\!\left(P_{1}\mid P_{2}\mid\ldots\mid P_{n}\mid Q\right)$, where we do again not alpha-convert input bounded names. By the Lemmata 5 and 19, then $P^{\prime}$ is well-typed w. r. t. $\mathcal{G}$. By Definition 11 and Theorem 1 of [13], then $\operatorname{SGP}^{*}\!\left(\left\{P^{\prime}\right\},\mathcal{G}\right)=\mathcal{S}^{\prime}$.

Case of $\tilde{v}\mathbin{:=}\mathsf{\tilde{e}}.S\neq\tau.S$:

By Definition 11, $G_{l}=\mathrm{r}_{1}\rightarrow\mathrm{r}_{2}\mathbin{:}\left\{\mathsf{l}_{i}\!\left<\tilde{\mathsf{U}}_{i}\right>\!.G_{l,i}\right\}_{i\in\mathrm{I}}$ for some $l\in\mathrm{J}$ and $\mathsf{s}_{l}$ is minimal w. r. t. to the dependency relation. Since the value assignment is unguarded,

[TABLE]

with $m\in\mathrm{I}$ and $\mathrm{I}\subseteq\mathrm{J}$, where we do not alpha-convert input bounded names. By Figure 1, then $P\longmapsto P^{\prime}=\left(\nu\tilde{\mathsf{s}}\right)\!\left(P_{2,m}\left\{\nicefrac{{\tilde{\mathsf{e}}}}{{\tilde{x}_{m}}}\right\}\mid P_{1}\mid Q\right)$, where we do again not alpha-convert input bounded names. By the Lemmata 5 and 16, then $\left(\nu\tilde{\mathsf{s}}\right)\!\left(P_{2,m}\mid P_{1}\mid Q\right)$ is well-typed w. r. t. the types $\mathcal{G}^{\prime}=\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}\setminus\left\{l\right\}}\cup\left\{G_{l,m}\right\}$. By Definition 11 and Theorem 1 of [13], then we have $\operatorname{SGP}^{*}\!\left(\left\{P^{\prime}\right\},\mathcal{G}^{\prime}\right)=\mathcal{S}^{\prime}$.

Case of Rule Par:

In this case $\mathcal{S}=\left<\mathcal{V};S_{1}\parallel S_{2}\right>$, $\left<\mathcal{V};S_{1}\right>\longmapsto\left<\mathcal{V}^{\prime};S_{1}^{\prime}\right>$, and $\mathcal{S}^{\prime}=\left<\mathcal{V}^{\prime};S_{1}^{\prime}\parallel S_{2}\right>$. By Definition 11, Lemma 17, and Lemma 18, then there are some $\mathcal{G}_{\text{split}}$, $\mathrm{I}_{1}\cup\mathrm{I}_{2}=\mathrm{I}$, $\mathrm{J}_{1}\cup\mathrm{J}_{2}=\mathrm{J}_{\text{split}}$ such that $\mathcal{G}^{\prime}=\left\{\left(G_{j}^{\prime},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}_{\text{split}}}$ results from $\mathcal{G}$ by applications of Case 7b, $\mathrm{J}_{1}\cap\mathrm{J}_{2}=\emptyset$, $P\equiv\left(\nu\tilde{\mathsf{s}}\right)\!\left(P_{1}\mid P_{2}\right)$, $\mathsf{act}\!\left(P_{k}\right)=\left\{\mathsf{s_{j}}\!\left[\mathrm{r}\right]\mid j\in\mathrm{J}_{k}\land\mathrm{r}\in\mathsf{r}\!\left(G_{j}^{\prime}\right)\right\}$, and $\operatorname{SGP^{\prime}}\!\left(\left\{P_{k}\right\},\left\{\left(G_{j}^{\prime},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}_{k}}\right)=S_{k}$ for $k\in\left\{1,2\right\}$. By the induction hypothesis, $\operatorname{SGP^{\prime}}\!\left(\left\{P_{1}\right\},\left\{\left(G_{j}^{\prime},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}_{1}}\right)=S_{1}$ and $\left<\mathcal{V};S_{1}\right>\longmapsto\left<\mathcal{V}^{\prime};S_{1}^{\prime}\right>$ imply that there are $P_{1}^{\prime},\mathcal{G}_{1}^{\prime}$ such that $P_{1}\longmapsto P_{1}^{\prime}$, $P_{1}^{\prime}$ is well-typed w. r. t. $\mathcal{G}_{1}^{\prime}$, and $\operatorname{SGP}^{*}\!\left(\left\{P_{1}^{\prime}\right\},\mathcal{G}_{1}^{\prime}\right)\equiv_{\mathcal{S}}\left<\mathcal{V}^{\prime};S_{1}^{\prime}\right>$. By Figure 1, then $P\longmapsto P^{\prime}=\left(\nu\tilde{\mathsf{s}}\right)\!\left(P_{1}^{\prime}\mid P_{2}\right)$, where we do not alpha-convert input bounded names. By the Lemmata 5, 12, and 13, then $P^{\prime}$ is well-typed w. r. t. $\mathcal{G}^{\prime}=\mathcal{G}_{1}^{\prime}\cup\left\{\left(G_{j}^{\prime},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}_{2}}$. By Definition 11 and Theorem 1 of [13], then $\operatorname{SGP}^{*}\!\left(\left\{P^{\prime}\right\},\mathcal{G}^{\prime}\right)\equiv_{\mathcal{S}}\mathcal{S}^{\prime}$.

Case of Rule If-T:

In this case we have $\mathcal{S}=\left<\mathcal{V};\textnormal{{if }}\mathsf{\mathsf{c}missing}\textnormal{{ then }}S_{1}\textnormal{{ else }}S_{2}\right>$ and $\mathcal{S}^{\prime}=\left<\mathcal{V};S_{1}\right>$. By Definition 11, then $P\equiv\left(\nu\tilde{\mathsf{s}}\right)\!\left(\textnormal{{if }}\mathsf{c}\textnormal{{ then }}P_{1}\textnormal{{ else }}P_{2}\mid Q\right)$, where substitutions of variables to indicate their actor in Case 6 do not change $\mathsf{c}$ because the conditional is unguarded, i. e., not under an input binder. By Figure 1, then $P\longmapsto P^{\prime}=\left(\nu\tilde{\mathsf{s}}\right)\!\left(P_{1}\mid Q\right)$, where we do not need to apply alpha conversion. By the Lemmata 5 and 15, then $P^{\prime}$ is well-typed w. r. t. $\mathcal{G}$. By Definition 11 and Theorem 1 of [13], then $\operatorname{SGP}^{*}\!\left(\left\{P^{\prime}\right\},\mathcal{G}\right)=\mathcal{S}^{\prime}$.

Case of Rule If-F:

This case is similar to the previous case.

Case of Rule Struc:

In this case $\mathcal{S}\equiv_{\mathcal{S}}\mathcal{S}_{2}$, $\mathcal{S}_{2}\longmapsto\mathcal{S}_{2}^{\prime}$, and $\mathcal{S}^{\prime}\equiv_{\mathcal{S}}\mathcal{S}_{2}^{\prime}$. Let $\mathcal{S}_{2}=\left<\mathcal{V};S_{2}\right>$. By Lemma 2 and since $\equiv_{\textsf{S}}\;\subseteq\;\equiv$, then $S_{2}$ is well-typed w. r. t. $\mathcal{G}$. By the induction hypothesis, then there are $P^{\prime},\mathcal{G}^{\prime}$ such that $P\longmapsto P^{\prime}$, $P^{\prime}$ is well-typed w. r. t. $\mathcal{G}^{\prime}$, and $\operatorname{SGP}^{*}\!\left(\left\{P^{\prime}\right\},\mathcal{G}^{\prime}\right)\equiv_{\mathcal{S}}\mathcal{S}_{2}^{\prime}$. Because of $\mathcal{S}^{\prime}\equiv_{\mathcal{S}}\mathcal{S}_{2}^{\prime}$, then $\operatorname{SGP}^{*}\!\left(\left\{P^{\prime}\right\},\mathcal{G}^{\prime}\right)\equiv_{\mathcal{S}}\mathcal{S}^{\prime}$.

We define a reduction semantics for global types in Figure 3, where we equate global types by the rules: $\left(\textnormal{{end}},G\right)=G=\left(G,\textnormal{{end}}\right)$ and $\left(\mu\mathrm{t}\right)G=G\left\{\nicefrac{{\left(\mu\mathrm{t}\right)G}}{{\mathrm{t}}}\right\}$. We show that well-typed processes can follow the reductions of global types.

Lemma 21

Let $\mathcal{G}=\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$, $l\in\mathrm{J}$, and let $G_{l}$ be guarded by a communication that does not depend on another session. If $P$ is well-typed w. r. t. $\mathcal{G}$ and $G_{l}\longmapsto G_{l}^{\prime}$ then there is some $P^{\prime}$ such that $\mathcal{G^{\prime}}=\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}\setminus\left\{l\right\}}\cup\left\{G_{l}^{\prime}\right\}$, $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\mathcal{G}\right)\longmapsto^{*}\operatorname{SGP}^{*}\!\left(\left\{P^{\prime}\right\},\mathcal{G}^{\prime}\right)$, $P\longmapsto^{*}P^{\prime}$, and $P^{\prime}$ is well-typed w. r. t. $\mathcal{G}^{\prime}$.

Proof

Assume that $P$ is well-typed w. r. t. $\mathcal{G}$ and $G_{l}\longmapsto G_{l}^{\prime}$ for some $l\in\mathrm{J}$ and the communication that is reduced in $G_{l}\longmapsto G_{l}^{\prime}$ does not depend on another session. We proceed by an induction on the reduction rules of Figure 3 that are used to obtain $G_{l}\longmapsto G_{l}^{\prime}$.

Case of Rule Com:

In this case $G_{l}=\mathrm{r}_{1}\rightarrow\mathrm{r}_{2}\mathbin{:}\left\{\mathsf{l}_{i}\!\left<\tilde{\mathsf{U}}_{i}\right>\!.G_{l,i}\right\}_{i\in\mathrm{I}}$, $j\in\mathrm{I}$, and $G_{l}^{\prime}=G_{l,j}$. By the Lemmata 16 and 19, then $P\longmapsto^{*}\equiv\left(\nu\tilde{\mathsf{s}}\right)\!\left(P_{1}\mid P_{2}\mid P_{3}\right)$ such that the steps only initialise sessions, $m\in\mathrm{I}$, $\mathrm{I}\subseteq\mathrm{J}$, every conditional branch of $P_{1}$ is a version of $\mathsf{\mathsf{s}_{\mathnormal{l}}}\!\left[\mathrm{\mathrm{r}_{1}},\mathrm{\mathrm{r}_{2}}\right]!\mathsf{\mathsf{l}_{m}}\!\left<\tilde{\mathsf{e}}\right>\!.Q$, every conditional branch of $P_{2}$ is a version of $\mathsf{\mathsf{s}_{\mathnormal{l}}}\!\left[\mathrm{\mathrm{r}_{2}},\mathrm{\mathrm{r}_{1}}\right]?\left\{\mathsf{\mathsf{l}_{i}}\!\left(\tilde{x}_{i}\right)\!.Q_{i}\right\}_{i\in\mathrm{J}}$, and $\left(Q_{j}\left\{\nicefrac{{\tilde{x}_{m}@\mathsf{s_{\mathnormal{l}}}\!\left[\mathrm{r_{2}}\right]}}{{\tilde{x}_{j}}}\right\}\mid Q\mid Q\right)$ is well-typed w. r. t. $\mathcal{G}^{\prime}=\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}\setminus\left\{l\right\}}\cup\left\{G_{l,j}\right\}$. Since $P$ is well-typed w. r. t. $\mathcal{G}$, then $m=j$. By Definition 11, then $\operatorname{SGP^{\prime}}\!\left(\left\{P\right\},\mathcal{G}\right)$ is such that every of its conditional branches contains a version of $\tilde{v}\mathbin{:=}\mathsf{\tilde{\mathsf{e}}^{\prime}}.\operatorname{SGP^{\prime}}\!\left(\left\{Q\mid Q_{j}\mid P_{3}\right\},\mathcal{G}^{\prime}\right)$. By the reduction semantics, then we can reduce the guarding conditionals and the value assignment in the respective branch such that $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\mathcal{G}\right)\longmapsto^{*}\mathcal{S}^{\prime}=\operatorname{SGP}^{*}\!\left(\left\{Q_{j}\left\{\nicefrac{{\tilde{x}_{m}@\mathsf{s_{\mathnormal{l}}}\!\left[\mathrm{r_{2}}\right]}}{{\tilde{x}_{j}}}\right\},Q,P_{3}\right\},\mathcal{G}^{\prime}\right)$. Then, there is some $P^{\prime}$ such that $P\longmapsto^{*}P^{\prime}$ initialises sessions, reduces the same conditionals, and then performs the communication step, i. e., we have $P^{\prime}\equiv\left(\nu\tilde{\mathsf{s}}\right)\!\left(Q_{j}\left\{\nicefrac{{\tilde{\mathsf{e}}}}{{\tilde{x}_{j}}}\right\}\mid Q\mid P_{3}\right)$. By Figure 2, then $P^{\prime}$ is well-typed w. r. t. $\mathcal{G}^{\prime}$. Since $\mathcal{S}^{\prime}\equiv_{\mathcal{S}}\operatorname{SGP^{\prime}}\!\left(\left\{P^{\prime}\right\},\mathcal{G}^{\prime}\right)$, then $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\mathcal{G}\right)\longmapsto^{*}\operatorname{SGP}^{*}\!\left(\left\{P^{\prime}\right\},\mathcal{G}^{\prime}\right)$.

Case of Rule Par-L:

In this case $G_{l}=G_{l1},G_{l2}$, $G_{l1}\longmapsto G_{l1}^{\prime}$, and $G_{l}^{\prime}=G_{l1}^{\prime},G_{l2}$. By Lemma 18, then $P\equiv\left(\nu\tilde{\mathsf{s}}\right)\!\left(P_{1}\mid P_{2}\right)$ such that $\mathsf{r}\!\left(G_{l1}\right)\subseteq\mathsf{r}\!\left(P_{1}\right)$, $\mathsf{r}\!\left(G_{l2}\right)\subseteq\mathsf{r}\!\left(P_{2}\right)$. By Figure 1, then $P\longmapsto^{*}P^{\prime}=P_{1}^{\prime}\mid P_{2}$. By Theorem 5 and Figure 2, then $P^{\prime}$ is well-typed w. r. t. $\mathcal{G}^{\prime}=\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}\setminus\left\{l\right\}}\cup\left\{G_{l1}^{\prime},G_{l2}\right\}$. By Definition 11 and the reduction semantics, then $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\mathcal{G}\right)\longmapsto^{*}\operatorname{SGP}^{*}\!\left(\left\{P^{\prime}\right\},\mathcal{G}^{\prime}\right)$.

Case of Rule Par-R:

This case is similar to the case above.

The reverse direction of Theorem 3 of [13] does not hold. Intuitively, a well-typed system and its sequentionalisation into a SGP-system have the same steps, but SGP-systems may force an order on steps that are unordered in the original system. This happens for global types such as $\mathrm{1}\rightarrow\mathrm{2}\mathbin{:}\mathsf{l}\!\left<\mathbb{N}\right>\!.\mathrm{3}\rightarrow\mathrm{4}\mathbin{:}\mathsf{l}\!\left<\mathbb{N}\right>\!.\textnormal{{end}}$ that combine causally unrelated communications sequentially.

Example 2

Consider the global type $G=1\rightarrow 2\mathbin{:}\mathsf{l}\!\left<\mathbb{N}\right>\!.3\rightarrow 4\mathbin{:}\mathsf{l}\!\left<\mathbb{N}\right>\!.\textnormal{{end}}$ that consists of two causally independent communications. The system

[TABLE]

is a well-typed implementation of this global type. The algorithm of Definition 10 maps this process to the SGP-system $\operatorname{SGP}^{*}\!\left(P,G\right)=\left<\left(x_{2},x_{4}\right);S\right>$, where $S=\tau.x_{2}\mathbin{:=}5.x_{4}\mathbin{:=}4.\mathbf{0}$. The process $P$ has, modulo structural congruence, two maximal runs

P$$P^{\prime}$$\left(\nu\mathsf{s}\right)\!\left(\mathsf{s}\!\left[\mathrm{3},\mathrm{4}\right]!\mathsf{l}\!\left<4\right>\!.\mathbf{0}\mid\mathsf{s}\!\left[\mathrm{3},\mathrm{4}\right]?\mathsf{l}\!\left(x\right)\!.\mathbf{0}\right)$$\left(\nu\mathsf{s}\right)\!\left(\mathsf{s}\!\left[\mathrm{1},\mathrm{2}\right]!\mathsf{l}\!\left<5\right>\!.\mathbf{0}\mid\mathsf{s}\!\left[\mathrm{2},\mathrm{1}\right]?\mathsf{l}\!\left(x\right)\!.\mathbf{0}\right)$$\mathbf{0}

where $P^{\prime}=\left(\nu\mathsf{s}\right)\!\left(\mathsf{s}\!\left[\mathrm{1},\mathrm{2}\right]!\mathsf{l}\!\left<5\right>\!.\mathbf{0}\mid\mathsf{s}\!\left[\mathrm{2},\mathrm{1}\right]?\mathsf{l}\!\left(x\right)\!.\mathbf{0}\mid\mathsf{s}\!\left[\mathrm{3},\mathrm{4}\right]!\mathsf{l}\!\left<4\right>\!.\mathbf{0}\mid\mathsf{s}\!\left[\mathrm{3},\mathrm{4}\right]?\mathsf{l}\!\left(x\right)\!.\mathbf{0}\right)$. But the abstraction $\operatorname{SGP}^{*}\!\left(P,G\right)$ simulates only the sequence of steps at the top

[TABLE]

in that first process $\mathrm{2}$ receives the value $5$—and the SGP-process accordingly updates the variable $x_{\mathrm{2}}$ of $\mathrm{2}$—and then $\mathrm{4}$ receives the value $4$.

Nonetheless, we can show that each step of the original system can be completed into a sequence that can be simulated. Assume a step $P\longmapsto P^{\prime}$ of the original system. We need to find a way to simulate this step in the SGP-system. Well-typedness of $P$ ensures that the step $P\longmapsto P^{\prime}$ respects the specification, i. e., the global types, of this process. Accordingly, either the types are not influenced by the step $P\longmapsto P^{\prime}$ or the step reduces some part of the global types. In the first case, the step $P\longmapsto P^{\prime}$ is a session initialisation or reduces a conditional and is simulated by an empty value update or the corresponding reduction of a SGP-conditional. If the step $P\longmapsto P^{\prime}$ reduces an unguarded part of one of its global types, i. e., performs a communication within a session, then it is simulated by the corresponding value updates in the SGP-system. Otherwise, the situation is as described in Example 2, i. e., we have to find an extension $P^{\prime}\longmapsto^{*}P^{\prime\prime}$ of the step $P\longmapsto P^{\prime}$ such that the sequence $P\longmapsto^{*}P^{\prime\prime}$ can be simulated by the SGP-system. Therefore, we reduce all guards in the global types that are necessary to unguard the part of the global type that is reduced in the step $P\longmapsto P^{\prime}$ or that on that this guard depends. By Lemma 21, $P^{\prime}$ can reduce accordingly in a sequence $P^{\prime}\longmapsto^{*}P^{\prime\prime}$. The SGP-system can simulate steps of the global type by construction. Thus, we can relate $P^{\prime\prime}$ to the corresponding reduction of the SGP-system.

Theorem 4 of [13]:

Let $\mathcal{G}=\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}}$. If $P$ is well-typed w. r. t. $\mathcal{G}$ then for all $P\longmapsto P^{\prime}$ there exist $P^{\prime\prime},\mathcal{G}^{\prime\prime}$ such that $P^{\prime}\longmapsto^{*}P^{\prime\prime}$, $P^{\prime\prime}$ is well-typed w. r. t. $\mathcal{G}^{\prime\prime}$, and $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\mathcal{G}\right)\longmapsto^{*}\operatorname{SGP}^{*}\!\left(\left\{P^{\prime\prime}\right\},\mathcal{G}^{\prime\prime}\right)$.

Proof (Proof of Theorem 4 of [13])

Assume that $P$ is well-typed w. r. t. $\mathcal{G}$ and $P\longmapsto P^{\prime}$. By Figure 1, $P\longmapsto P^{\prime}$ uses exactly one of the axioms:

Case of Rule Link:

In this case:

[TABLE]

By Definition 11, we have $\operatorname{SGP^{\prime}}\!\left(\left\{P\right\},\mathcal{G}\right)=\tau.\operatorname{SGP^{\prime}}\!\left(\left\{P_{1},\ldots,P_{n},Q\right\},\mathcal{G}\right)$ and we have $\operatorname{SGP^{\prime}}\!\left(\left\{P^{\prime}\right\},\mathcal{G}\right)=\operatorname{SGP^{\prime}}\!\left(\left\{P_{1},\ldots,P_{n},Q\right\},\mathcal{G}\right)$. By reflexivity, $P^{\prime}\longmapsto^{*}P^{\prime}$. By Lemma 19, $P^{\prime}$ is well-typed w. r. t. $\mathcal{G}$. By the reduction semantics, $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\mathcal{G}\right)\longmapsto\operatorname{SGP}^{*}\!\left(\left\{P^{\prime}\right\},\mathcal{G}\right)$.

Case of Rule Com:

In this case

[TABLE]

and $j\in\mathrm{I}$. By Definition 11, then $\operatorname{SGP}\!\left(\left\{P\right\},\mathcal{G}\right)$ maps this communication on a SGP-value-assignment but may guard it by other conditionals from $P_{3}$ or value assignments due to communications in $P_{3}$. Note that, therefore, all these conditionals and communication prefixes have to be consecutively unguarded in the remainder of $P_{3}$ and that the communications are captured in $\mathcal{G}$. By Figure 3 and Definition 11, then there exists $G_{l}^{\prime\prime}$ such that $G_{l}\longmapsto^{*}G_{l}^{\prime\prime}$ for some $l\in\mathrm{J}$ reduces the communications in $P_{3}$ that correspond to the value assignments that guard SGP-value-assignment $\tilde{x}_{j}@\mathsf{s}\!\left[\mathrm{r_{2}}\right]\mathbin{:=}\mathsf{\tilde{\mathsf{e}}}.\operatorname{SGP}\!\left(\left\{P_{2,j}\left\{\nicefrac{{\tilde{x}_{j}@\mathsf{s}\!\left[\mathrm{r_{2}}\right]}}{{\tilde{x}_{j}}}\right\},P_{1},P_{3}^{\prime}\right\},\mathcal{G}^{\prime\prime}\right)$. By Lemma 21, then there is some $P^{\prime\prime}$ such that we have $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\mathcal{G}\right)\longmapsto^{*}\operatorname{SGP}^{*}\!\left(\left\{P^{\prime\prime}\right\},\mathcal{G}^{\prime\prime}\right)$ and $P\longmapsto^{*}P^{\prime\prime}$. Since well-typedness ensures that there are no conflicts and since $\mathsf{s}\!\left[\mathrm{\mathrm{r}_{1}},\mathrm{\mathrm{r}_{2}}\right]!\mathsf{\mathsf{l}_{j}}\!\left<\tilde{\mathsf{e}}\right>\!.P_{1}\mid\mathsf{s}\!\left[\mathrm{\mathrm{r}_{2}},\mathrm{\mathrm{r}_{1}}\right]?\left\{\mathsf{\mathsf{l}_{i}}\!\left(\tilde{x}_{i}\right)\!.P_{2,i}\right\}_{i\in\mathrm{I}}$ is reduced in both of the sequences $P\longmapsto P^{\prime}$ and $P\longmapsto^{*}P^{\prime\prime}$, then confluence implies that also $P^{\prime}\longmapsto^{*}P^{\prime\prime}$.

Case of Rule If-T:

In this case $P\equiv\left(\nu\tilde{\mathsf{s}}\right)\!\left(\textnormal{{if }}\mathsf{c}\textnormal{{ then }}P_{1}\textnormal{{ else }}P_{2}\mid P_{3}\right)$ and $P^{\prime}\equiv\left(\nu\tilde{\mathsf{s}}\right)\!\left(P_{1}\mid P_{3}\right)$. By Definition 11, $\operatorname{SGP^{\prime}}\!\left(\left\{P\right\},\mathcal{G}\right)$ maps this conditional on a SGP-conditional but may guard it by other conditionals from $P_{3}$ or value assignments due to communications in $P_{3}$. Note that all these conditionals and communication prefixes have to be consecutively unguarded in the remainder of $P_{3}$ and that the communications are captured in $\mathcal{G}$. By Figure 3 and Definition 11, then there exists $\mathcal{G}^{\prime\prime}$ such that $G_{l}\longmapsto^{*}G_{l}^{\prime\prime}$ reduces the communications in $P_{3}$ that correspond to the value assignments that guard the SGP-conditional $\textnormal{{if }}\mathsf{\mathsf{c}missing}\textnormal{{ then }}\operatorname{SGP^{\prime}}\!\left(\left\{P_{1},P_{3}^{\prime}\right\},\mathcal{G}^{\prime\prime}\right)\textnormal{{ else }}\operatorname{SGP}\!\left(\left\{P_{2},P_{3}^{\prime}\right\},\mathcal{G}^{\prime\prime}\right)$, where $\mathcal{G}^{\prime\prime}=\left\{\left(G_{j},\mathsf{s}_{j}\right)\right\}_{j\in\mathrm{J}\setminus\left\{l\right\}}\cup\left\{G_{l}^{\prime\prime}\right\}$. By Lemma 21, then there is $P^{\prime\prime}$ such that $\operatorname{SGP}^{*}\!\left(\left\{P\right\},\mathcal{G}\right)\longmapsto^{*}\operatorname{SGP}^{*}\!\left(\left\{P^{\prime\prime}\right\},\mathcal{G}^{\prime\prime}\right)$ and $P\longmapsto^{*}P^{\prime\prime}$. Since well-typedness ensures that there are no conflicts and since $\textnormal{{if }}\mathsf{c}\textnormal{{ then }}P_{1}\textnormal{{ else }}P_{2}$ is reduced in both of the sequences $P\longmapsto P^{\prime}$ and $P\longmapsto^{*}P^{\prime\prime}$, then confluence implies that also $P^{\prime}\longmapsto^{*}P^{\prime\prime}$.

Case of Rule If-F:

This case is similar to the case above.

Interestingly, the combination of Theorem 3 and Theorem 4 of [13] is similar to (weak) operational correspondence as it is introduced in [5] as criterion for the quality of encodings. Encodings are mappings from a source language $\mathcal{P}_{\mathrm{S}}$ into a target language $\mathcal{P}_{\mathrm{T}}$.

Definition 12 (Weak Operational Correspondence, [12])

An encoding

$\operatorname{enc}\!\left(\cdot\right):\mathcal{P}_{\mathrm{S}}\to\mathcal{P}_{\mathrm{T}}$ is weakly operationally corresponding w. r. t. $\mathcal{R}_{\mathrm{T}}$ if it is:

Complete:

$\forall S,S^{\prime}.\;S\longmapsto^{*}S^{\prime}$ implies $\left(\exists T.\;\operatorname{enc}\!\left(S\right)\longmapsto^{*}T\wedge\left(\operatorname{enc}\!\left(S^{\prime}\right),T\right)\in\mathcal{R}_{\mathrm{T}}\right)$

Weakly Sound:

$\forall S,T.\;\operatorname{enc}\!\left(S\right)\longmapsto^{*}T$ implies

$\left(\exists S^{\prime},T^{\prime}.\;S\longmapsto^{*}S^{\prime}\wedge T\longmapsto^{*}T^{\prime}\wedge\left(\operatorname{enc}\!\left(S^{\prime}\right),T^{\prime}\right)\in\mathcal{R}_{\mathrm{T}}\right)$

We observe that completeness is similar to Theorem 3 of [13] and weak soundness is similar to Theorem 4 of [13], but with the roles of the languages exchanged. Accordingly, we change the above definition and use a weak variant of completeness.

Definition 13

An encoding $\operatorname{enc}\!\left(\cdot\right):\mathcal{P}_{\mathrm{S}}\to\mathcal{P}_{\mathrm{T}}$ is reversed weakly operationally corresponding w. r. t. $\mathcal{R}_{\mathrm{T}}\subseteq\mathcal{P}_{\mathrm{T}}^{2}$ if it is:

Weakly Complete:

$\forall S,S^{\prime}.\;S\longmapsto^{*}S^{\prime}$ implies

$\left(\exists S^{\prime\prime},T^{\prime\prime}.\;S^{\prime}\longmapsto^{*}S^{\prime\prime}\wedge\operatorname{enc}\!\left(S\right)\longmapsto^{*}T^{\prime\prime}\wedge\left(\operatorname{enc}\!\left(S^{\prime\prime}\right),T^{\prime\prime}\right)\in\mathcal{R}_{\mathrm{T}}\right)$

Sound:

$\forall S,T.\;\operatorname{enc}\!\left(S\right)\longmapsto^{*}T$ implies $\left(\exists S^{\prime}.\;S\longmapsto^{*}S^{\prime}\wedge\left(\operatorname{enc}\!\left(S^{\prime}\right),T\right)\in\mathcal{R}_{\mathrm{T}}\right)$

Then the mapping $\operatorname{SGP}^{*}\!\left(\cdot,\cdot\right)$ from well-typed processes into SGP-systems is reversed weakly operationally corresponding w. r. t. $\equiv_{\mathcal{S}}$. The paper [12] relates weak operational correspondence with so-called correspondence simulation.

Definition 14 (Correspondence Simulation, [12])

A relation $\mathcal{R}$ is a (weak reduction) correspondence simulation if for each $\left(P,Q\right)\in\mathcal{R}$:

• •

$P\longmapsto^{*}P^{\prime}$ implies $\exists Q^{\prime}.\;Q\longmapsto^{*}Q^{\prime}\land\left(P^{\prime},Q^{\prime}\right)\in\mathcal{R}$

• •

$Q\longmapsto^{*}Q^{\prime}$ implies $\exists P^{\prime\prime},Q^{\prime\prime}.\;P\longmapsto^{*}P^{\prime\prime}\land Q^{\prime}\longmapsto^{*}Q^{\prime\prime}\land\left(P^{\prime\prime},Q^{\prime\prime}\right)\in\mathcal{R}$

Two terms $P,Q$ are correspondence similar, denoted as $P\precsim Q$, if a correspondence simulation relates them.

With a similar argumentation as in [12] to show that if $\operatorname{enc}\!\left(\cdot\right)$ is weakly operationally corresponding w. r. t. a correspondence simulation then $S\precsim\operatorname{enc}\!\left(S\right)$, we conclude that if $\operatorname{enc}\!\left(\cdot\right)$ is reversed weakly operationally corresponding w. r. t. a correspondence simulation then $\operatorname{enc}\!\left(S\right)\precsim S$. By the Theorems 3 and 4 of [13], then the sequentialisation of a system is correspondence similar to the system.

4 Examples

4.1 Toy Example

Similar to the two Buyer example of [8], we illustrate our approach by a small example of an auctioneer system consisting of an auctioneer $\mathrm{A}$ and two alternating bidders $\mathrm{B1}$ and $\mathrm{B2}$. The two bidders alternate in offering bids towards the auctioneer and the auctioneer continues to inform the next bidder about the last bid until the current bid exceeds the maximum of one of the bidders. As soon as one bidder refuses to offer another bid, the auctioneer informs the respective other bidder that the item was sold to him. We illustrate the communication structure for the case that $\mathrm{B2}$ wins the auction:

\mathrm{B1}$$\mathrm{A}$$\mathrm{B2}……bidlast bidbidlast bidnosold

Assume a program that implements such an auctioneer system. An analysis of such a program may want to check e. g. whether the bidders indeed alternate in offering bids, i. e., no bidder is allowed or forced to bid twice without the other bidder in between, or whether no bid exceeds the internal maximum of a bidder, i. e., the amount that he or she is willing to pay. The former property is clearly a property of the communication structure and can easily be checked with MPST. The latter property, however, requires to analyse concrete data. Since the maximum a bidder is willing to pay is some data that is specific to the bidder or may even be specific to a concrete run, this property does not fit into the set of static properties MPST were designed for. We show that if one is willing to pay the price of verifying the communication structure of the program with MPST, one gets as a side-effect a massive reduction in checking properties about the state of the program, i. e., properties that require the consideration of concrete runs or concrete values of variables.

An important property that often requires the consideration of concrete runs or concrete values is termination. MPST ensure progress for well-typed systems, i. e., there are no deadlocks and all runs of the system will follow its specification that is provided by the global type(s). Progress immediately implies termination, if the considered system does not contain recursion. But, as in our toy example, many algorithms to compute some value or some decision, rely on a loop that runs until a suitable value was found or a decision was made. The progress property, that we can obtain by MPST for such cases, is a crucial argument for a proof of termination, but does not directly imply termination. The presented method allows us to prove termination, by analysing the evolution of data in concrete runs, automatically and in an efficient way.

To provide a global type for our example of the auctioneer system, we use different labels to convey the intention of actions of the participants: $\mathsf{bid}$ indicates a new bid, $\mathsf{no}$ indicates that the bidder refuses to make another bid, $\mathsf{l}$ precedes the forwarding of the last bid, and $\mathsf{s}$ indicates that the item was sold. Since the only kind of values that are transmitted in this protocol are bids, we use $\mathsf{Int}$ as only sort for integer values. Let $\mathrm{A}=\mathrm{1}$ be the role of the auctioneer, $\mathrm{B1}=\mathrm{2}$ be the role of the first bidder, and $\mathrm{B2}=\mathrm{3}$ be the role of the second bidder. The global type $G_{\mathrm{AS}}$ describes the communication structure of this example from a global point of view.

Example 3 (Global Type of the Auctioneer System)

[TABLE]

An example of a well-typed implementation of the global type $G_{\mathrm{AS}}$ of Example 3 is given below, i. e., $P_{\mathrm{AS}}$ is well-typed w. r. t. $G_{\mathrm{AS}}$. The names $inc$ and $max$ are place-holders for the actual functions and natural constants that are provided by Promela. The functions $inc_{\mathrm{B1}},inc_{\mathrm{B2}}$ are used by the respective bidder to increase the last bid and the constants $max_{\mathrm{B1}},max_{\mathrm{B2}}$ denote the maximum a bidder is willing to pay.

Example 4 (Implementation of the Auctioneer System)

[TABLE]

To sequentialise the given implementation utilising our algorithm, let $P$ be a process that is well-typed w. r. t. a global type $G$ and $S=\operatorname{SGP}\!\left(\left\{P\right\},G\right)$. Then the corresponding SGP-system is $\operatorname{SGP}^{*}\!\left(\left\{P\right\},G\right)=\left<\mathcal{V};S\right>$, where $\mathcal{V}$ is the vector of names in $S$. Accordingly, the auctioneer system $P_{\mathrm{AS}}$ of Example 4 that is well-typed w. r. t. $G_{\mathrm{AS}}$ in Example 3 translates into the SGP-system $\left<\left(b_{\mathrm{A}},b_{\mathrm{B1}},b_{\mathrm{B2}}\right);S_{\mathrm{AS}}\right>$, where $S_{\mathrm{AS}}=\operatorname{SGP}\!\left(\left\{P_{\mathrm{AS}}\right\},G_{\mathrm{AS}}\right)$ is given below.

Example 5 (Sequentialisation of the Auctioneer System)

[TABLE]

Since the causal relation of the communications of $G_{\mathrm{AS}}$ in Example 3 is a total order, all properties that hold for $S_{\mathrm{AS}}$ are also satisfied by $P_{\mathrm{AS}}$.

4.2 Translating SGP-Systems into Promela

To illustrate the verification of system properties, we use the model checker Spin [7, 6] and implement the SGP-system $S_{\mathrm{AS}}$ in Example 5 using Promela, the input language of Spin. Therefore, we provide an algorithm to translate a SGP-process into Promela code.

First we generate a preamble for the Promela program, i. e., declare variables and set their initial values. The variables are obtained from the vector of variables $\mathcal{V}$ in a SGP-system $\left<\mathcal{V};S\right>$. Sometimes the initial values are directly specified by the implementation or are given as parameters of the implementation. Otherwise, the developer has to pick suitable initial values respecting their respective sorts. The preamble for $S_{\mathrm{AS}}$ of Example 5 is given in Figure 4. It introduces the three variables $b_{\mathrm{A}},b_{\mathrm{B1}},b_{\mathrm{B2}}$ of the knowledge vector in our example and initialises them with [math]. Moreover, the preamble introduces five more variables that are used for the implementation and verification of the LTL-Formula that specify the properties we want to check. We provide in [13] an algorithm for the translation of SGP-processes into Promela but expect that the desired properties are already specified as LTL-Formula.

Figure 5 presents the Promela implementation of $S_{\mathrm{AS}}$ from Example 5. Following the translation into Promela of [13], first a proctype with the name Model is introduced.

The $\tau$ at the beginning of $S_{\mathrm{AS}}$ that resulted from the translation of the session initialisation is translated to skip. Then there are two subsequent value updates on $b_{\mathrm{A}}$ and $b_{\mathrm{B2}}$ that precede the loop. The loop is introduced by declaring its recursion variable LX. Then the if-then-else statements with their respective value updates follow. Another instance of the loop is generated by goto LX, whereas goto LEnd terminates the program by jumping to its end.

In addition Figure 5 declares the domains of the variables incB1, incB2, maxB1, and maxB2. Note that these variables were not specified by the implementation in $P_{\mathrm{AS}}$ of Example 4 and thus are not provided by $S_{\mathrm{AS}}$. The variables incB1 and incB2 denote the value by that bidders increment the last bid. The domain $1..10$ tells us, that this value to increment the last bid is chosen non-deterministically between $1$ and $10$. The variables maxB1 and maxB2 specify the internal maximum a bidder is willing to pay. We use arbitrary values between $50$ and $100$. Similar to the initial values of the variables in the knowledge vector of $S_{\mathrm{AS}}$, we expect that the developer provides suitable domains.

4.3 Analysing the Properties of Implementations

Finally, the developer has to add to the Promela program the LTL-formula for the properties that he or she is interested in. We add the following six LTL-formulae, where Figure 6 presents their Promela representation:

[TABLE]

These formulae have following meanings:

there exists one state from which onward all participants always have the same bid value, 2. 2.

the bidder always bid higher than the other one until both have always the same bid, 3. 3.

the auctioneer has always the same bid as one bidder, 4. 4.

only one process can win the auction, 5. 5.

the winner did not bid more than its limit, and 6. 6.

eventually one bidder will win.

As checked by SPIN, only Property P3 is not satisfied. This is because only one variable assignment can happen at any time, thus updating two variables to a new value would take at least two steps. More precisely, Property P3 is violated then the auctioneer receives a new bid. If $\mathrm{A}$ receives a bid from $\mathrm{B2}$ then $b_{\mathrm{A}}$ is updated with the value $\textsf{incB2}+b_{\mathrm{B2}}$. In the next step, the variable $b_{\mathrm{B1}}$ is updated with $b_{\mathrm{A}}$ which restores Property P3. But in between these two value updates the value of $b_{\mathrm{A}}$ is neither equal to $b_{\mathrm{B2}}$ (unless $\textsf{incB2}=0$) nor equal to $b_{\mathrm{B2}}$.

Above we validated some interesting properties of our toy example such as that no bidder exceeds its internal maximum (Property P5) or termination (Property P6). Does that means, that our implementation is a good implementation of the auctioneer algorithm? Unfortunately, this is not so easy.

Consider a malicious bidder $\mathrm{B2}$ that instead of increasing the bid always resubmits the last bid of $\mathrm{B1}$. This way the chances to win the auction, if the internal maxima of the two bidders are close, is significantly increased by $\mathrm{B2}$ in a very unfair way. Moreover, if $\mathrm{B2}$ is willing to pay more, i. e., if he or she is supposed to win the auction, than this strategy ensures that the bid of $\mathrm{B2}$ also stays below the limit of $\mathrm{B1}$, i. e., reduces the amount of money $\mathrm{B2}$ needs to pay. Obviously, this behaviour is malicious and should be rejected by the auctioneer. To implement this malicious behaviour it suffices to instantiate incB2 with [math].

This kind of malicious behaviour is detected by the properties in Figure 6. More precisely, by setting $\textsf{incB2}=0$, the Property P2 is violated. Thus, we can detect that there are implementations of this algorithm, that are not acceptable. We can now use this knowledge to improve the specification. Indeed we observe, that in our specification $G_{\mathrm{AS}}$ in Example 3, the auctioneer does not decide anything, i. e., this specification does not provide the communication structure that the auctioneer need to check the validity of bids and to reject them.

We provide a revised version of this auctioneer system, where the auctioneer checks the validity of the bids and rejects a bid that was not valid.

Example 6 (Global Type of the Revised Auctioneer System)

[TABLE]

Here, the auctioneer can send two kinds of messages, i. e., initiates a branching, after receiving a bid. Either the auctioneer considers the bid as valid and forwards it to the respective other role using a message with label $\mathsf{l}$—as we already encountered in the previous example. Or the auctioneer detects an invalid bid and transmits a message with the label $\mathsf{r}$, signalling the bidder that the bid was rejected and, hence, that the other bidder won the auction.

4.4 Promela

In Example 6 we present $G_{\mathrm{RAS}}$; a revised version of the global type of our toy example. The Promela implementation of this global type is presented below. Note that the differences between the Figure 5 and the code below reflect the additional choice implemented by the auctioneer that allows him to reject invalid bids.

Due to the interleaving of independent actions, the state space of a concurrent system is in the worst case exponentially larger than of its sequentialisation. As an example, we implemented the Needham-Schroeder public key protocol with 10 pairs of processes that interact with the same server.

Next we present the Promela implementation of the implementation of its sequentialisation.