Specification of Reactive Hardware/Software Systems - Electronic ...

312 Behaviour-Preserving Transformations
NoComChange(BSpec e 1 ¥ BSpece 2 ¥ envs1 ¥ envs2¥ Sys p ¥ Sys¥ f ) states that channel renaming
function f does not cause the introduction of communications between Bspec e 1 and BSpece 2
when 6 is applied from left to right. It further states that f does not cause the loss of
communications between BSpec e 1 and BSpec e 2 when 6 is applied from right to left.
Let BSpec e 1 ¥ envs1 ¥ Sys p ¥ Sys , BSpec e 2 ¥ envs2 ¥ Sys p ¥ Sys ¡ Conf p . Then
NoComChange(BSpec e 1 ¥ BSpece 2 ¥ envs1 ¥ envs2¥ Sys p ¥ Sys¥ f ) if and only if for all l¥ l¡ ¡
(1) BSpece 1 ¥ envs1¥ Sysp ¥ Sys £
l¡
(l¡ f (l) f ) implies l
(2) Reset(BSpece
1)¥ ¥ Sysp ¥ Sys £
l¡ (l¡ f (l) f ) implies l .
Here conf p £
actions ¡ ¥
p a1
a1 an 1, ¡ ¥¡ conf
l
£ and BSpec e 2 ¥ envs2¥ Sys p ¥ Sys £
l
£ and Reset(BSpec e 2)¥
£
l
denotes that for some n 1, some conf p
1
£ conf p
a2
£ ¡ ¡ an ¢ 1
£ conf p
n 1
l ¢
and £
¥ Sys p ¥ Sys £
l ¢
and £
1 ¥¡ ¡ ¡ ¥ conf p ¡ n Conf p , and some
l
conf £ p .
According to 6 a channel renaming function distributes over parallel composition if the
function does not cause the introduction of communications between the constituents
of the composition. Vice versa, a channel renaming function can be factored out if it
does not cause the loss of communications between the constituents of the composition.
In general, it can be very difficult to check whether these transformation conditions are
satisfied. Even worse, one can prove that predicate NoComChange is uncomputable.
This means that in general it is undecidable whether the predicate is satisfied or not.
Of course this is not satisfactory. Therefore we introduce a computable transformation
condition NoComChange¡ by which NoComChange is implied. For a thorough discussion
about conditional axioms (transformations) with uncomputable conditions we refer to
[BBK87].
Let BSpec e 1 , BSpece 2 ¡ BSpecificationse , Sys p ¡ Systems p and let f be a channel renaming
function. Then NoComChange¡ (BSpec e 1 ¥ BSpece 2 ¥ Sysp ¥ f ) if and only if for all l a 1 ¡
AASort(BSpec e 1 ¥ Sysp ) and l a 2 ¡ AASort(BSpece 2 ¥ Sysp ), f (l a 1) = f (l a 2) implies l a 1 = l a 2.
The fact that NoComChange¡ is indeed stronger than NoComChange is stated in Proposition
5.
Proposition 5
Let BSpec e 1 ¥ envs1 ¥ Sys p ¥ Sys , BSpec e 2 ¥ envs2 ¥ Sys p ¥ Sys ¡ Conf p . Then
NoComChange¡ (BSpec e 1 ¥ BSpece 2 ¥ Sysp ¥ f ) implies
NoComChange(BSpec e 1 ¥ BSpece 2 ¥ envs1 ¥ envs2¥ Sys p ¥ Sys¥ f ) ¨
In many cases predicate NoComChange¡ suffices to verify that 6 may be applied. There
exist however practical examples in which Transformation 6 is applicable but in which
predicate NoComChange¡ is not satisfied. This problem typically occurs if instances
communicate in a weakly distributed fashion (see Paragraph 6.4.4.1). Unfortunately,
a complete solution to this problem does not exist (see also Section 10.6). Nevertheless,
one could obtain a partial solution by the introduction of a computable predicate