Reactive Systems: Modelling, Specification and Verification - Cs.ioc.ee

3.1. CRITERIA FOR A GOOD BEHAVIOURAL EQUIVALENCE 39
C
P
C
C(P ) C(Q)
Q
Figure 3.1: P R Q implies that C[P ] R C[Q]
refinement steps which are known to preserve some behavioural relation R. In this
approach, we might begin from our specification Spec and transform it into our
implementation Imp via a sequence of intermediate stages Spec i (0 ≤ i ≤ n) thus:
Spec = Spec 0 R Spec 1 R Spec 2 R · · · R Spec n = Imp .
Since each of the steps above preserves the relation R, we would like to conclude
that Imp is a correct implementation of Spec with respect to R—that is, that
Spec R Imp
holds. This is guaranteed to be true if the relation R is transitive.
From the above discussion, it follows that a relation supporting implementation
verification should at least be a preorder. The relations considered in the classic
theory of CCS, and in the main body of this book, are also symmetric, and are
therefore equivalence relations.
Another intuitively desirable property that an equivalence relation R that supports
implementation verification should have is that it is a congruence. This means
that process descriptions that are related by R can be used interchangeably as parts
of a larger process description without affecting its overall behaviour. More precisely,
if P R Q and C[ ] is a program fragment with ‘a hole’, then
C[P ] R C[Q] .
This is pictorially represented in Figure 3.1.
Finally, we expect our notion of relation supporting implementation verification
to be based on the observable behaviour of processes, rather than on their structure,
the actual name of their states or the number of transitions they afford. Ideally,
we should like to identify two processes unless there is some sequence of ‘interactions’
that an ‘observer’ may have with them leading to different ‘outcomes’.