On Algorithmic Verification Methods for Probabilistic Systems
On Algorithmic Verification Methods for Probabilistic Systems
On Algorithmic Verification Methods for Probabilistic Systems
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
<strong>On</strong><strong>Algorithmic</strong><strong>Verification</strong><strong>Methods</strong> <strong>for</strong><strong>Probabilistic</strong><strong>Systems</strong><br />
derFakultatfurMathematikundIn<strong>for</strong>matik zurErlangungdervenialegendi Habilitationsschrift<br />
derUniversitatMannheim<br />
ChristelBaier ausKarlsruhe vorgelegtvon<br />
1998
Tomyparents,GerdaandMausi<br />
1
Acknowledgements<br />
Firstofall,IwouldliketothanktoMilaMajster-Cederbaumwhoisbyfarmorethanjust privateaairs.Withouthersupportandencouragement,Iwouldneverhavestartednor asupervisor.Manythanks<strong>for</strong>introducingmeinthetheoryofparallelsystems,various fruitfuldiscussionsaboutresearchtopicsandcountlesshelpfuladvicesinvocationaland researcherorteacheritisduetoher.ItisimpossibletoexpresssomanythanksthatI owetoher. nishedmyPh.D.Thesisorthishabilitationthesis.IncaseIwillbesometimeagood<br />
WhenIvisitedMartaKwiatkowskainNovember1995,sheconvincedmethatresearchon probabilisticprocessesisanimportantandinteresting(evensointerestingthatIwrote<br />
much. electronicmailIesteemherasasourceofinspirationaswellasafriend.Thankyouso athesiswithmorethan300pagesaboutthem!)task.Mostofthemainresultsinthis thesisweredevelopedincollaborationwithher.Evenourcontactisalmostexclusiveby<br />
ManythankstoHolgerHermanns,JoostKatoenandPedrod'Argenio<strong>for</strong>beingfriends and<strong>for</strong>thevarioushelpfuldiscussionsthatwehadviaelectronicmail,onthephone,at<br />
papersthathaveservedasbasis<strong>for</strong>thiswork.Especially,IwouldliketothankEdClarke conferencesorinamorerelaxedscenariowithbeer,tequilaorchampagne. Ithankallmycoauthors,discussionpartnersandallthosewhohavecommentedonthe<br />
ManythankstoJurgenJaapandMartinTrampler<strong>for</strong>theirpatienceandassistencewhen- whosesupportandsuggestionshelpedmesomuch,notonly<strong>for</strong>thisthesis.<br />
AlexandraSchubert<strong>for</strong>allthetimeshespended<strong>for</strong>copyingpapers<strong>for</strong>me. withoutherhelpIwouldnothavesurvivedinthegermanbureaucracyjungleandto everIhadaproblemwithourcomputersystem,UNIXorLATEX,toRitaSommer<br />
Eventhoughresearchonparallelsystemsisnice,Iamluckythatthereisalifeoutside myoce.SpecialthankstomybestfriendsHansHelm,MarkSchad,PetraGramlich andPetraBullerkotte<strong>for</strong>beingtherewheneverIneedthem,listeningtomyproblems<br />
myfriendsthere;especiallytoThomasSchmidtwhonevergaveupintryingtoteachme beavegetarianandsmokerandbeingaddictedindoingsports.However,inthepast fewyears,the\SquashLagune"turnedouttobemysecondhome.Manythankstoall andbearingmeevenwhenIaminabadmood.Itmightbeastrangecombinationto<br />
playingsquashandHeikeStecherandAnneLuck<strong>for</strong>givingoutstanding\powerhours".<br />
looks<strong>for</strong>wardtoseeme. Thisthesisisdedicatedtomyparentswhosupportedmeinallareasoflife,mysister GerdaandourdogMausi,theonlycreaturewhereIamdenitelysurethatshealways<br />
3
Contents<br />
1Introduction 1.1Vericationmethods..............................12 1.1.1Transitionsystems...........................13 11<br />
1.1.2Specifyingparallelsystemswithprocesscalculi...........14<br />
1.2<strong>Probabilistic</strong>systems..............................17 1.1.3Thetemporallogicalapproach.....................16 1.1.4Stateexplosionproblem........................17 1.2.1Modellingprobabilisticbehaviour...................18<br />
1.3Thetopicsofthisthesis............................26 1.2.2Theprocesscalculusapproach<strong>for</strong>probabilisticsystems.......22 1.2.3<strong>Probabilistic</strong>temporallogic......................24 1.3.1Relatedwork..............................27<br />
2Preliminaries 1.3.2Howtoreadthisthesis.........................27<br />
2.1Sets,relations,partitionsandfunctions....................29 2.2Distributions..................................30 29<br />
3Modellingprobabilisticbehaviour 3.1Fullyprobabilisticsystems...........................34 3.2Concurrentprobabilisticsystems.......................38 33<br />
3.2.1Pathsinconcurrentprobabilisticsystems...............40<br />
3.3Labelledprobabilisticsystems.........................47 3.2.2Adversariesofconcurrentprobabilisticsystems............41 3.2.3Fairnessofnon-deterministicchoice..................45 3.3.1Action-labelledprobabilisticsystems.................47 5
6 3.3.2Proposition-labelledprobabilisticsystems...............52 CONTENTS<br />
3.4Bisimulationandsimulation..........................53<br />
3.5<strong>Probabilistic</strong>processes.............................61 3.4.1Bisimulation...............................54<br />
3.6Relatedmodels.................................62 3.4.2Simulation................................56<br />
3.7Proofs......................................64 3.7.1<strong>Probabilistic</strong>reachabilityanalysis...................64<br />
4<strong>Probabilistic</strong>processcalculi 3.7.2Bisimulationandsimulationinimage-nitesystems.........68<br />
4.1PCCS:anasynchronousprobabilisticcalculus................74 4.2PSCCS:asynchronousprobabilisticcalculus.................79 71<br />
5Denotationalmodels 4.3PLSCCS:alazysynchronouscalculus....................83<br />
5.1Denotationalmodels:concurrentcase.....................91 5.1.1ThedomainIP.............................92 89<br />
5.1.2ThesemanticdomainID........................94 5.1.3ThesemanticdomainIM........................96<br />
5.2Denotationalmodels:fullyprobabilisticcase.................104 5.1.4DenotationalsemanticsonIMandID.................99<br />
5.3Proofs......................................105 5.1.5Afewremarksaboutprobabilisticpowerdomains..........103<br />
5.3.1ThepartialordersimonDistr(D)..................105 5.3.2ThedomainID.............................110 5.3.3Themetricprobabilisticpowerdomainsofevaluations........116 5.3.4ThedomainIM.............................122<br />
6Decidingbisimilarityandsimilarity 5.3.5Fullabstraction.............................125<br />
6.1Computingthebisimulationequivalenceclasses...............130 6.1.1Thefullyprobabilisticcase.......................131 129<br />
6.1.2Theconcurrentcase..........................131
CONTENTS 6.2Computingthesimulationpreorder......................143 7<br />
6.2.1Thetestwhether 6.2.2Theconcurrentcase..........................146 6.2.3Thefullyprobabilisticcase.......................151 R0.......................143<br />
7Weakbisimulation 6.3Proofs......................................153<br />
7.1Weakandbranchingbisimulation.......................161 7.1.1Weakbisimulation...........................161 159<br />
7.2Decidabilityofweakbisimulationequivalence................164 7.1.2Branchingbisimulation.........................162<br />
7.3Connectiontootherequivalences.......................171 7.2.1Thealgorithm..............................165<br />
7.4Compositionality................................174 7.2.2Timecomplexity............................169<br />
7.5Proofs......................................177 7.5.1Weakandbranchingbisimulationequivalence............177<br />
8Fairnessofprobabilisticchoice 7.5.2 andthetestingequivalences=steand0..............186<br />
8.1P-fairness<strong>for</strong>fullyprobabilisticsystems...................194 8.2P-fairness<strong>for</strong>concurrentprobabilisticsystems................199 193<br />
9Verifyingtemporalproperties 9.1ThelogicPCTL................................207 9.1.1Interpretationoverfullyprobabilisticsystems............209 205<br />
9.1.2Interpretationoverconcurrentprobabilisticsystems.........210 9.1.3ThesublogicsPCTLandLTL.....................211<br />
9.2Modelcheckingalgorithms<strong>for</strong>PCTL 9.1.4Relatedlogics..............................213<br />
9.3Modelchecking<strong>for</strong>PCTL...........................216 9.1.5PCTLequivalenceandbisimulationequivalence...........214<br />
9.3.1Nextstep................................218 ....................214<br />
9.3.2Boundeduntil..............................219
8 9.3.3Unboundeduntil............................220 CONTENTS<br />
9.4Modelchecking<strong>for</strong>LTL............................234 9.3.4Theconnectionbetweenj=,j=fair,j=sfairandj=Wfair.........230<br />
9.5Proofs......................................241 9.3.5ComplexityofPCTLmodelchecking.................231<br />
9.5.1Stateandtotalfairness.........................241 9.5.2CorrectnessofthePCTLmodelcheckingalgorithm.........243<br />
10Symbolicmodelchecking 9.5.3CorrectnessoftheLTLmodelcheckingalgorithm..........252<br />
10.1Thealgebraicmu-calculus...........................259 10.1.1Syntaxofthealgebraicmu-calculus..................260 255<br />
10.2Thealgebraicmu-calculusasaspecicationlanguage............275 10.1.2Semanticsofthealgebraicmu-calculus................262 10.1.3Fixedpointoperators..........................270 10.2.1Therelationalmu-calculus.......................275 10.2.2Themodalmu-calculus.........................276<br />
10.3A\compiler"<strong>for</strong>thealgebraicmu-calculus..................285 10.2.3ThelogicPCTL.............................279 10.2.4WordlevelCTL.............................283 10.3.1Themixedcalculus...........................286<br />
10.4Symbolicmodelchecking<strong>for</strong>probabilisticprocesses.............295 10.3.2Inferencefromthealgebraictothemixedcalculus..........287 10.3.3Computingthesemanticsofthemixedcalculus...........290 10.4.1RepresentingprobabilisticsystemsbyMTBDDs...........295 10.4.2Symbolicmodelchecking<strong>for</strong>PCTL..................297<br />
11Concludingremarks 10.4.3Decidingbisimulationequivalence...................300<br />
12Appendix 305<br />
12.1Preliminaries<strong>for</strong>thedenotationalmodels...................307 12.1.1Basicnotionsofdomaintheory....................307 307<br />
12.1.2Metricspaces..............................310
CONTENTS 12.1.3Categoricalmethods<strong>for</strong>solvingdomainequations..........311 9<br />
12.2Orderedbalancedtrees.............................314 12.3Multiterminalbinarydecisiondiagrams....................315<br />
12.1.4Evaluations...............................313
10 CONTENTS
Chapter1<br />
Introduction<br />
Parallelsystems(suchasoperatingsystems,telecommunicationsystems,aircraftcon-<br />
qualityofaparallelsystemdependsonseveralproperties,typicallyclassiedintosafety trollingsystems,bankingsystems,etc.)ariseinmanyindustrialapplications.Forap situationsapreciseanalysisofthepossiblesystembehavioursisanimportanttask.The propertieswhichstatethat\nothingbadhappens"(e.g.mutualexclusion,deadlockfreeplicationswhereerrorsmightbeexpensiveandleadtodangerousorevencatastrophal propertieswhichassertthat\somethinggoodwilleventuallyhappen"(e.g.termination, starvationfreedom)[OwLa82].Inrealisticapplications,notonlythefunctionalityofa parallelsystemisimportant,alsoquantitativeaspects(suchastimeorprobabilities)play domorthecomputationofsucientlyexactnumericalvalues)andlivenessorprogress<br />
acrucialrole.Forinstance,inpractice,itisuselesstoestablishapropertylike\each requestwilleventuallybeanswered"asthereisnoboundonhowmuchtimewillpass thistypecanbeestablishednotonlydependsonthedesignofthesystembutalsoon thereliabilityoftheinterfacewiththeenvironmentortheresourcesthatthesystemuses. betweenarequestandtheresponse.Typically,oneaimsatapropertylike\eachrequest<br />
Forinstance,iftheresponseistransmittedviaanuncertainmediumthatmightloose willeventuallybeansweredwithinthenext5seconds".Whetherornotapropertyof<br />
happensmightberare.Ifthefailureratesareknown(orcanbeestimatedbyexperimentalresults),itmakessensetoreasonaboutthefrequencies<strong>for</strong>certainevents,i.e.todeal withquantitativepropertieslike\thereisa95%chancethattherequestwillbeanswered messagesapropertyasabovecanneverhold.However,thecaseswhereaphysicalerror<br />
withinthenext5seconds".<br />
abstractsfromquantitativeaspectsliketime,per<strong>for</strong>manceorin<strong>for</strong>mationsaboutthefre- Traditionally,themodellingofparallelsystemsfocussesonthefunctionalbehaviourbut<br />
behaviour. i.e.parallelsystemswhereprobabilitiesareusede.g.tomodeluncertaintiesorrandomized quencyofcertainsystembehaviours.Inthisthesis,weshrinkourattentiontoprobabilisticphenomenaandconsidermethods<strong>for</strong>specifyingandvalidatingprobabilisticsystems, 11
12 1.1 Vericationmethods CHAPTER1.INTRODUCTION<br />
Werstgiveabriefsummaryoverthegeneraltechniques<strong>for</strong>analyzingparallelsystems.Thesetechniquesarecommonlyused<strong>for</strong>reasoningaboutthefunctionalbehaviour. Suitableadaptionsofthesemethodscanbeusedtotreatvarioustypesofquantitative behaviour;inparticular,theycanbeappliedtoanalyzeprobabilisticsystems. Awidespreadtechnique<strong>for</strong>analyzingthepropertiesofaprogramistestingwhichmeansto observetheprogramduringtheexecutionwithcertainwell-choseninputsandtocompare thereactionwiththedesiredbehaviour.Sincetestingcoversonlya(small)subsetofthe<br />
eitherbydeductivemethodsorbymodelchecking.Thedeductivemethodsarebasedon whichaimsata<strong>for</strong>malproof<strong>for</strong>thecorrectnessofaprogram.1Thisistypicallyachieved possibleinstancesofsystembehavioursitcanonlydetectthepresenceoferrorsbutnotthe<br />
amanualcompositionofaprogramandacorrectnessproofusingaxiomsandinference absenceoferrors.Inthisthesis,weconsiderthecomplementarytechnique:verication<br />
rules<strong>for</strong>anappropriatespecication<strong>for</strong>malism.Ingeneral,thesemethodsrequireuser<br />
nottheprogrammeetsthespecication[ClEm81,QuSi82,CES83].Thus,themethods specicationasitsinputandreturnstheanswer\yes"or\no"dependingonwhetheror algorithmicvericationmethodthattakes(anabstractdescriptionof)aprogramandits interventiontoalargedegreeandareverytimeconsuming.Modelcheckingmeansan<br />
cases)limitedtonite-statesystems.2Nevertheless,alargeclassofparallelprocessesthat areuserindependenttoalargeextent.Whilethedeductivemethodsareapplicableto systemsofarbitrarysize(eveninnitesystems),themodelcheckingapproachis(inmost basedonmodelcheckingautomatethetaskofvalidatingprograms;andhence,they<br />
appearinrealisticapplicationscanbedescribed{withthehelpofseveralabstraction techniques{byasystemwithanitestatespace.3<br />
therequiredpropertiescanbeidentied: Specication<strong>for</strong>malisms:Anyvericationmethodrequiresaprecisedescriptionofthe desirablesystembehaviourbya<strong>for</strong>malspecication.Twogeneralframeworkstospecify<br />
Therstframeworkisbasedonahomogenoustechniquewheretheprogramandspeci- the<strong>for</strong>malizationofthedesirablepropertiesby<strong>for</strong>mulasofsomelogic. thespecicationbyamodelthattellshowthesystemshouldbehave,<br />
representtheprogramandthespecication.Theprogramisdescribedbyamodel(asin tion,i.e.abinaryrelationontheobjectsofthat<strong>for</strong>malism(the\models").Thelogical frameworkfocussesonaheterogenoustechniquewheredierent<strong>for</strong>malismsareusedto cationaredescribedinthesame<strong>for</strong>malismandcomparedviaanimplementationrela<br />
thehomogenousapproach)whilethespecicationisa<strong>for</strong>mulaofsomeprogramlogic. Branchingtimeversuslineartime:4Boththehomogenousandtheheterogenous withanabstraction(amodel)oftheprogram.Hence,thevericationmethodscanonlyassurethatthe abstractmodelfulllstherequiredproperties;thus,theycanonlybeasgoodastheabstractionis. 1Whiletestingisper<strong>for</strong>medbyexercisingthe(real)implementationthevericationmethodswork trarysizeisundecidable(considere.g.thehaltingproblem);andhence,cannotbesolvedautomatically. tools,seee.g.[CPS90,McMil92,HoPe94,CCM+95,Camp96,HHW97,LPY97,HarG98]. 2Thisobservationisclearfromthefactthatawiderangeofvericationproblems<strong>for</strong>systemsofarbi- 3Thebenetsofthemodelcheckingapproachhavebeendocumentedfromthereportsonimplemented 4Adetaileddiscussionaboutthebranchingtimeandlineartimeviewcanbefoundin[Lamp80,
1.1.VERIFICATIONMETHODS frameworkreasonaboutthe\behaviours"ofparallelsystems.Inthelineartimeview, 13<br />
thebehaviourisdeterminedbythepossibleexecutionsignoringthepossiblebranches possiblesteps)oftheintermediatestatesintoaccountandobservesaprocessbymeans ofa\push-button-experiment".5 intheintermediatestates.Thebranchingtimeviewtakesthebranchingstructure(the<br />
sibletransitionsbetweenthem.<strong>On</strong>eofthestandardmodelsaretransitionsystems 1.1.1 Modelsdescribeanabstractionofasystembyrepresentingthestatesandthepos- Transitionsystems<br />
[Kell76,Plot81]thatdescribethesystembehaviourbyadirectedgraph.Thenodesreptypesoftransitionsystemsareproposed.Forinstance,thestatescanbelabelledbyasresentthestates;edgesstand<strong>for</strong>thepossiblestatechanges(transitions).Thebranches(edges)inastate(node)representthepossiblestepsinthatstate.6Theexecutions(sequencesofstates)aregivenbythepathsthroughthisgraph.Intheliterature,severalsertions(e.g.propositionalorrstorderlogical<strong>for</strong>mulasthatstatesomethingaboutthe<br />
valuesoftheprogramandcontrolvariables),thetransitionscanbeequippedwithaction interleavingandfairness.Theuseofinterleavingcanbemotivatedbytheobservationthat namesorbooleanguards.Intransitionsystems,asynchronousparallelismismodelledby theeectoftheparallelexecutionakboftwo\independent"actionsaandb(eachofthem onitsownprocessor)isthesameasifaandbareexecutedinanyorderononeprocessor. Hence,fromtheinterleavingpointofview,wehavethe\equality"akb=a;b+b;a.7In<br />
s1+QQQQQs a s0QQQQQs<br />
b s3 ab<br />
+ s2<br />
otherwords,interleavingreducesparallelismtothenon-deterministicchoicethatdecides whichsubprocessper<strong>for</strong>msthenextstep.<strong>On</strong>emightthinkofthischoicetoberesolvedby Figure1.1:akb=a;b+b;a<br />
the\environment"(e.g.anotherprogramthatrunsinparallelorauser)whosedecisions are(insomeappropriatesense)fairwithanysubprocess.Thiskindoffairnessisoften varioustypesoffairnessareconsidered.8Allfairnessnotionshaveincommonthatthey calledprocessfairness.Intuitively,processfairnessrulesoutthepathologicalpossibility<br />
EmHa86,dBdRR88]. thatsomesubprocessispermanentlydeniedtoper<strong>for</strong>mthenextstep.Intheliterature,<br />
thesystemexecutesthecorrespondingstepandthe\push-button-experiment"restartsinthenewstate. probabilisticphenomena,thebranchescanalsostand<strong>for</strong>thealternativesofaprobabilisticchoice. 6Intheclassicalapproach,thebranchesstand<strong>for</strong>non-deterministicalternatives.Whendealingwith 5Forthis,thepossiblestepsinastateareviewedasbuttons.Theobserverselectsoneofthesebuttons, 7Here,;denotessequentialcompositionand+non-deterministicchoice. 8Forasurveyoffairnessnotionsseee.g.[LSP81,QuSi83,Fran88,Kwia89].
14 makerestrictionsconcerningthenon-deterministicchoicesintheinniteexecutions(in- CHAPTER1.INTRODUCTION<br />
beessential<strong>for</strong>establishinglivenessproperties. nitepathsinthetransitionsystem).TheycannotaectthesafetypropertiesbutmightHomogenoustechniquesaremostlyusedinthecontextwithcompositionoperatorspro-<br />
1.1.2 videdbysomeprocesscalculus(alsooftencalledprocessalgebra).Processcalculiare Specifyingparallelsystemswithprocesscalculi<br />
specicationlanguagesthatdescribethereactivebehaviourofparallelsystems.The mainingedrientsofsuchprocesscalculiareoperators<strong>for</strong>modellingparallelcomposition<br />
Bergstra&Klop'sACP[BeKl84],wherethecomponentsworktime-independentlyand tinctionmark<strong>for</strong>theprocesscalculiproposedintheliteratureisthetypeofparallelism.k,non-deterministicchoice+,sequentialcomposition;andrecursion.9Themaindis- communicateviacertainchannels.Others,suchasMilner'sSCCS[Miln83]orESTEREL [BeGon92],arebasedonsynchronousparallelismwherethestepsoftheparallelcompo- Someareasynchronouscalculi,suchasMilner'sCCS[Miln80],Hoare'sCSP[Hoar85]or<br />
sitionarecomposedby\one-time-steps"ofitssubprocesses.The\one-time-steps"can eitherbysingleatomicsteps(asinthecaseofSCCS)orsequencesofatomicsteps(asin Implementationrelations:Typically,processalgebrasaresuppliedwithanopera- thecaseofESTEREL).<br />
abinaryrelationontransitionsystemsthat<strong>for</strong>malizeswhatismeant<strong>for</strong>aprogramto tionalsemanticsbasedontransitionsystems10togetherwithanimplementationrelation,correctlyimplementanotherone.Theimplementationrelationmakesitpossibletocom- becorrectwithrespecttothespecicationQiPimplQ<strong>for</strong>thechosenimplementation pareaprogram(theimplementation)withitsspecication.Forthis,theimplementation PandthespecicationQaredescribedbytermsoftheprocessalgebraandPissaidto relationimpl.11Processalgebrasequippedwithacongruence(i.e.animplementationrelationimplthatispreservedbythecompositionoperatorsofthecalculus)playacrucial i=1;:::;n).Moreover,congruencescanserveasbasis<strong>for</strong>modularverication,i.e.the \higher-level"processPby\lower-level"modulesQ1;:::;Qn(providedthatQiimplPi, bystepwiserenementsincetheyallowthereplacementofthemodulesP1;:::;Pnofa role<strong>for</strong>thedesignandanalysisofparallelsystems.Congruencesareuseful<strong>for</strong>thedesign<br />
preorders.12 aboutthemodules.Typically,suchimplementationrelationsareeitherequivalencesor separatevericationoftheprogrammodulesfromwhichthecorrectnessofthecomposed processisderivedusingjustthecorrectnessofthemodulesbutnotanyotherknowledge<br />
22.10Often,thetermsofaprocessalgebraareidentiedwiththeassociatedtransitionsystems.Inpar- e.g.byoperatorsthatspecifytimeoutsordelaysoraprobabilisticchoiceoperator[GJS90,HaJo90, NRS+90,Hans91,Yi91].FurtherreferencestoprobabilisticprocesscalculiaregiveninSection1.2,page 9Toreasonaboutquantitativeproperties(e.g.timeorprobabilities),suchcalculicanbeextended<br />
ticular,thecompositionoperatorsoftheprocessalgebracanalsobeviewedasoperators<strong>for</strong>composing transitionsystems. benaturalconditionsthatarelationwhich<strong>for</strong>malizeswhatismeantby\aprocessimplementsanother one"shouldhave.<br />
11Thus,vericationamountsshowingthatPimplQ. 12Recallthatapreorderisareexiveandtransitiverelation.Bothreexityandtransitivityseemto
1.1.VERIFICATIONMETHODS Theequivalencescanbeinterpretedinsuchawaythatequivalentprogramsexhibit 15<br />
Inmostcases,theuseofpreordersismotivatedbytheassumptionthatthespeci- behaviour)13buttheycanalsoserveasbasistocomparethequantitivebehaviourof thesame\behaviour"withrespecttoanappropriatenotionofbehaviour.<br />
twosystems,e.g.iftheyyieldnotionsof\fasterthan"or\morereliable". cationjusttellswhich\behaviours"areallowed(butdoesnotprescribetheexact<br />
Amongtheimplementationrelationthathaveprovedmostusefularebisimulation[Miln80, Park81,Miln89]andsimulation[Miln89,AbLa88,Jons91,LyVa91]relations,traceequivalence[Hoar85],failureequivalence[BHR84]andtestingpreorders[dNHe83].Bisimulationandsimulationarebasedonthebranchingtimeviewandestablishastep-by-stepcorreordersistodenetheprocessbehaviourbymeansofitsabilitytopasstests.Thetestsspondencebetweentwosystems.Asaclassicalrepresentative<strong>for</strong>thelineartimerelations, traceequivalenceestablishsacorrespondencebetweentheexecutions,butabstractsfrom thepossiblebranchesintheintermediatestates.Thebasicideabehindthetestingpre-<br />
bythecompositionoperatorsoftheunderlyingprocesscalculus(i.e.congruences)are arespecialprograms(describedintermsoftheunderlyingprocesscalculus)thatareex-<br />
byabstraction.Forthis,equivalentstatesareidentiedandreplacedbyasinglestate. ofgreatimportance<strong>for</strong>theanalysissincetheycanbeusedtoreducethestatespace ecutedinparallelwiththegivenprocess.Especiallytheequivalencesthatarepreserved<br />
Theresultingquotientspacemightbemuchsmaller14andmayevenbenite<strong>for</strong>innite systems.<br />
<strong>for</strong>systemsonthesamelevelofabstraction(e.g.twoimplementations)whiletheweak frominternalcomputationswhilethestrongimplementationrelationsdonot.Being sensitivewithrespecttointernalsteps,ingeneral,strongrelationscanonlybeestablished Strongandweakrelations:Weakimplementationrelationsarethosethatabstract<br />
Denotationalsemantics:Becauseofitsdeclarativenature,theabovementionedoper- implementationanditsspecication). relationsareappropriatetocomparesystemsondierentlevelsofabstraction(e.g.an<br />
ationalsemantics(whichassignstoeachtermoftheprocesscalculusatransitionsystem) isoftentheonethatadesignerhasinmind.Whiletheoperationalsemanticsfocusses onthestepwisebehaviourthemainconceptsofdenotationalsemanticsarecompositionalityandtheuseofxedpointequations<strong>for</strong>modellingrecursion.15Inmanycases,the eleganttechniquetodenethemeaningsofrecursive(orrepetitive)programs.Often, useofxedpointtheoryrequiresmethodsofseveralmathematicaldisciplines(e.g.topoldenotationalsemanticsareusedtoobtainacharacterizationoftheimplementationreogy,domaintheory,categorytheory)andleadtoasemanticsthatishardtounderstand<br />
<strong>for</strong>anon-mathematician.However,thedenotationalapproachprovidesamuchmore<br />
allotherdetailsabouttheprogram).Fullabstractionresultscanserveasbasis<strong>for</strong>ver- lationassociatedwiththeoperationalsemanticsbymeansofafullabstractionresult. Fullabstractionmeansthatthedenotationalsemanticsofaprogramcontainsexactlythe in<strong>for</strong>mationthatisrelevant<strong>for</strong>thechosenimplementationrelation(butabstractsfrom<br />
samebehaviour.<br />
15Thexedpointequationsreectourintuitionthatarecursiveprocedureandtheirbodyhavethe 13Inthiscase,theuseofpreorderscanbeviewedasaprooftechnique<strong>for</strong>establishingsafetyproperties. 14Seee.g.[CGT+96]<strong>for</strong>anexpressiveexample.
16 icationmethods16orjusthelp<strong>for</strong>abetterunderstandingoftheoperationalsemantics CHAPTER1.INTRODUCTION<br />
allow<strong>for</strong>proofsbystructuralinductionwhichisoftenausefulconcepttoestablishalink andtheimplementationrelation.Moreover,beingcompositional,denotationalsemantics<br />
1.1.3 betweenseveralspecication<strong>for</strong>malisms(e.g.somekindoflogicoroperationalmodels).17<br />
mulas)andthesystemisdescribedbyamodel(e.g.atransitionsystem)vericationInthelogicalframeworkwherethespecicationisa<strong>for</strong>mula(ortheconjunctionof<strong>for</strong>- Thetemporallogicalapproach<br />
amoutsshowingthatthe<strong>for</strong>mula Intheliterature,severallogicsareproposedtoreasonaboutparallelsystems,suchas dynamic[Prat76],temporal[Pnue77]ormodal[HeMi85,Koze85]logic.Inthisthesis, weconcentrateontheuseofpropositionaltemporallogicwithfuturetemporalmodalities evaluatestotruewheninterpretedoverthesystem.<br />
like\eventually"3or\always"2.Webrieysketchthebasicideaswherewemainly concentrateonthoseaspectsthatarerelevant<strong>for</strong>theresultsofthisthesis.Furtherdetails<br />
executions.Lineartime<strong>for</strong>mulasarebuiltfromatomicpropositions(thatmakeassertions canbefounde.g.in[Emer90,MaPn92,CGL93,Lamp94,MaPn95].<br />
aboutthestates,e.g.aboutthecurrentvaluesoftheprogramorcontrolvariables),the LineartimelogicLTL:Inthelineartimeapproach,<strong>for</strong>mulasdescribepropertiesof usualbooleancombinators_,^,:andtemporaloperators.Forinstance,ifcrit1,crit2<br />
thenextksteps"3kcanbeused,seee.g.[HaJo89,ACD90].18Forexample,the<strong>for</strong>mula Toreasonaboutquantitativeaspects,e.g.time,specialmodalitieslike\sometimeswithin sectionthen2(:crit1^:crit2)stands<strong>for</strong>thesafetypropertystatingmutualexclusion. areatomicpropositionsstatingthatcertainsubprocesseP1andP2areintheircritical<br />
overtheexecutions(i.e.thepathsinatransitionsystem).Foraprocess,alineartime <strong>for</strong>mulaisviewedtobefullledifitholdseveninaworstcase(butrealistic)scenario, 2(request!35response)mightbeinterpretedasthelivenesspropertystatingthatany requestwillansweredwithinthenext5timeunits.Lineartime<strong>for</strong>mulasareinterpreted i.e.ifitholds<strong>for</strong>all\possible"executions.Ingeneral,notallexecutionsareviewedto bepossible,butonlythosethatobeycertainfairnessconditions. BranchingtimelogicCTL:Branchingtimelogicsallowquanticationoverthepossible<br />
tweenstateandpath<strong>for</strong>mulas.Thestate<strong>for</strong>mulassubsumethepropositionalconnectives[ClEm81]istheclassicalrepresentative<strong>for</strong>branchingtimelogics.CTLdistinguishesbe- withacertainproperty.19ComputationtreelogicCTLintroducedbyClarke&Emerson futureswhichleadsto<strong>for</strong>mulasstatinge.g.theexistenceornon-existenceofanexecution<br />
proceduralnatureofdenotationalsemanticscanserveasabasis<strong>for</strong>acompiler.Seee.g.[BCH98]. applications.Especiallyintheeldofsequentialprograms(butalso<strong>for</strong>othertypesofprograms),the 17Forexample,inthisthesis,weapplythedenotationalframework<strong>for</strong>showingthattwoimplementation 16Itshouldbepointedoutthatthedenotationalapproachcanalsobeofimportance<strong>for</strong>otherpractical relationscoincide<strong>for</strong>acertainkindofprocesses. timeor{ifthesystemunderconsiderationarisesfromtheasynchronousparallelcompositionofseveral action. subsystems{onecanthinkofastepasthetimetakenbytheslowestcomponenttoper<strong>for</strong>manatomic 18Theinterpretationofa\step"dependsontheunderlyingsystem.Astepmightbeoneunitof<br />
time<strong>for</strong>mulasmightalsoreasonabouttheprobabilityofcertainevents.SeeSection1.2.3.<br />
19Here,weassumethetraditional(non-probabilistic)approach.Inaprobabilisticscenario,branching
1.2.PROBABILISTICSYSTEMS andbasictemporaloperatorsofthe<strong>for</strong>m\apathquantierfollowedbyasingletemporal 17<br />
andthetemporalmodalitiesareasinlineartimelogic.20ThelogicCTL[EmHa86]extendsCTLbyallowingarbitrarylineartime<strong>for</strong>mulastoserveaspath<strong>for</strong>mulas;thus,it subsumesLTLandCTL. modality"wherethepathquantiersare8or9thatrangeoverallpaths(executions)<br />
time(evenintimelinearinthesizeofthesystemandinthelengthofthe<strong>for</strong>mula[CES83]) modelchecking<strong>for</strong>LTLandCTLisPSPACE-complete[SiCl86]andcanbedoneintime linearandbranchingtimelogic.WhileCTLmodelcheckingcanbedoneinpolynomial Modelchecking:Fornitesystems,modelcheckingalgorithmsaredeveloped<strong>for</strong>both<br />
exponentialinthelengthofthe<strong>for</strong>mulaandlinearinthesizeofthesystem[LiPn85].21 <strong>On</strong>thebasisofdecisionprocedures<strong>for</strong>thesatisabilityproblemof(linearorbranching time)temporallogic,thetask<strong>for</strong>synthezisingparallelsystemsfromagiventemporal<br />
1.1.4 logicalspecicationcanbeautomated,seee.g.[EmCl82,MaWo84,AtEm89,PnRo89].<br />
growsexponentiallyinthenumbernofsubprocesses.Thisexplainswhyanyalgorith- Thesize(numberofstatesinthetransitionsystem)ofaparallelsystemP=P1k:::kPn Stateexplosionproblem<br />
micvericationmethodthatworkswithanexplicitrepresentationoftransitionsystems(e.g.byadjacencylists)fails<strong>for</strong>systemswithverymuchcomponents.Inthederreduction[Pele93,Valm94,Gode94].ThebasisideabehindtheBDD-basedaplem".Somearebasedonasymbolicrepresentationofthesystemusingbinarydecisondiagrams[BCM+90,McMil92],othersarebasedontheconceptofpartialorlastdecade,severalmethodshavebeendevelopedtoattackthe\stateexplosionprobresentingtheirtransitionrelationimplicitlybyanorderedBDD[Brya86].TheBDDapproachhasprovedtobeverysuccessful<strong>for</strong>varioustypesofvericationproblems<strong>for</strong> parallelsystems,includingthevericationagainstbranchingandlineartimetemporal proachgoesbacktoKenMcMillanwhoproposedtohandleverylargesystemsbyrep<br />
logicalspecicationsandestablishingabranchingtimerelationbetweentwosystems [BCM+90,McMil92,EFT93,CGL93,CGH94].Partialorderreductionisbasedonthe<br />
niqueshavebeenimplementedintoolsandsuccessfullyappliedtoverylargesystems,seeobservationthattheinterleavedexecutionofindependentactionsallowsonetoinves- e.g.[McMil92,HoPe94,Camp96,GPS96]. tigateonlyarepresentativefragmentofthestatespace.Itisapplicable<strong>for</strong>provinglineartimetemporalpropertiesand<strong>for</strong>theprocessalgebraicapproach.22Bothtech- Intheliterature,avarietyofextensionsoftheabovementionedvericationmethodsare 1.2 proposedthatareappropriatetoreasonaboutquantitativeaspects,e.g.<strong>for</strong>verifyingreal- <strong>Probabilistic</strong>systems<br />
rangeoverthefairexecutions[EmLei85]. 21See[VaWo86,CGH94,GPV+95]<strong>for</strong>otherLTLmodelcheckingalgorithms. 20TohandlefairnessthesemanticsofCTLhastobemodiedbytaking8and9asquantiersthat [PPH96].<br />
22Moredetailsaboutthepartialorderapproachcanbefoundinseveralpapersintheproceedings
18 timeconditions,<strong>for</strong>per<strong>for</strong>manceanalysisor<strong>for</strong>computingtheprobabilities<strong>for</strong>certain CHAPTER1.INTRODUCTION<br />
systembehaviours.Inthisthesis,weconcentrateonprobabilisticphenomenaandconsider parallelsystemswithprobabilities<strong>for</strong>thestatetransitions(inthesequelcalledprobabilisticsystemsorprobabilisticprocesses).23Thereareseveralsituationswhereprobabilistic aboutaprobabilisticsystemarethefollowingtwo: aspectshavetobetakenintoaccount.Theonesthatwehaveinmindwhenspeaking<br />
ment,onehastotakeintoconsiderationtheinterfaceswiththeenvironment.TheseTogetarealisticmodelofaparallelsystemthatreactsonthestimulioftheenviron- algorithm,i.e.usestheconceptofrandomization(\tossingafaircoin"). Thesystem(oroneormoreofitssubsystems)mightbebasedonarandomized areoftenbasedonphysicalprocessesthatareprobabilisticinnature.<br />
Thebenetsofrandomizationareclearfromtheliterature.24Randomizationhasbeen anunreliablemediumthattransmitsmessages).Inthesecondcase,theprobabilities aredeterminedbythefrequenciesofthepossibleoutcomesofaprobabilisticchoice. Inthe<strong>for</strong>mercase,probabilitiesareusedtomodeluncertainties(e.g.thefailurerateof<br />
showntobeaeleganttechniquethatmightleadtosimplerandmoreecientalgorithms thantheirnon-randomizedcounterparts.Moreover,asobservedbyLehmann&Rabin<br />
<strong>Probabilistic</strong>choice:Thecharacteristicfeatureofprobabilisticsystemsisthatthey [LeRa81],intheeldofparallelalgorithms,theuseofrandomizationmakesitpossible<br />
workwiththeconceptofprobabilisticchoice.Thisreferstoanyactivitythatchooses tosolveproblemsthatarenotsolvablewithdeterministicalgorithms.<br />
betweenseveralalternativebehaviourswherethefrequenciesofthepossibleoutcomesof thatchoicearegivenbyprobabilities(i.e.valuesintheunitinterval[0;1]thatsumup to1).Theinterpretationofthisprobabilisticchoicedependsontheconcreteprocess. Asmentionedabove,theprobabilitiesmightbeobtainedfromfailureratesofcertain unreliableresourcesormightstemfroma\trulyrandomized"actionlike\tossingafair coin".Inanycase,probabilisticchoicecanbespeciedbyatermofthe<strong>for</strong>m<br />
Here,p1;:::;pl2[0;1]suchthatp1+:::+pl=1.Assuminginternalprobabilisticchoice thatweinterpretastheprocessthatchoosesrandomlytobehaveasoneoftheprocessesPi. random(p1:P1;:::;pl:Pl)oftenwrittenas[p1]P1 :::[pl]Pl<br />
thattheprocessPiisselected.Thisstandsincontrasttoexternalprobabilisticchoice (whichisresolvedindependentontheenvironment),thevaluepidenotestheprobability<br />
totheconditionalprobabilities Then,theexternalprobabilisticchoiceselectsoneoftheprocessesP1;:::;Pkaccording enabled.Forthis,letusassumethatP1;:::;PkareavailablewhilePk+1;:::;Plarenot. whichassumesthattheenvironmentdetermineswhichoftheprocessesP1;:::;Plare<br />
1.2.1 Modellingprobabilisticbehaviour p1+:::+pk,i=1;:::;k. pi<br />
Mostofthemodelsthatareused<strong>for</strong>therepresentationofprobabilisticsystemsare<br />
books[MoRa95,Lync95].<br />
extensionsoftransitionsystemsbuttherearealsoothermodelssuchas\trueconcurrency" 24Seee.g.thepapersbyRabin[Rabi76a,Rabi76b,Rabi80],thesurveypapers[Karp91,GSB94]orthe 23Inthischapter,weusethenotions\system"and\process"assynonyms.
1.2.PROBABILISTICSYSTEMS 19<br />
models(e.g.eventstructureswithprobabilities[KLL94,Kato96]).Inthisthesis,we<br />
concentrateontheuseofprobabilistictransitionsystems.Toreasonaboutprobabilities,<br />
severalextensionsoftransitionsystemshavebeenproposed.25Theyallhaveincommon,<br />
thattheyendowthetransitionswithprobabilitiesinanappropriateway.Theresulting<br />
modelscanbeclassiedwithrespecttotheirtreatmentofnon-determinism.<br />
Fullyprobabilisticmodels:SeveralauthorsconsidermodelsbasedonMarkovchains<br />
(MCs)wheretheconceptofnon-determinsmisreplacedbyprobabilisticchoice,e.g.\gen-<br />
erativetransitionsystems"[vGSST90],\sequentialMarkovchains"[LeSh82,HaSh84,<br />
Vard85,CoYa88,CoYa95]or\fullyprobabilisticautomata"[SeLy94,Sega95a].Inthese<br />
models,eachstatesisassociatedwithaprobabilisticchoice;thatis,thetransitionsare<br />
labelledbyprobabilities(valuesintheunitinterval),suchthat,<strong>for</strong>eachstates,the<br />
probabilities<strong>for</strong>theoutgoingtransitionssumupto1.26<br />
Example1.2.1[Simplecommunicationprotocol:thesender]Weconsiderasim-<br />
plecommunicationprotocolsimilartothatin[HaJo94].Thesystemconsistsoftwo<br />
enitities:asenderthatworkswithanunreliablemediumwhichmightloosemessages<br />
andareceiver.Thesender,havingproducedamessage,transmitsthemessagetothe<br />
medium,whichinturntriestodeliverthemessagetothereceiver.Withprobability<br />
1/100,themessagesgetslostandthemediumretriestodeliverthemessage.Withprob-<br />
ability99/100,themessageisdeliveredcorrectly,inwhichcasethesenderwaits<strong>for</strong>the<br />
acknowledgementbythereceiverandthenreturnstotheinitialstate.Forsimplicity,we<br />
assumethattheacknowledgementcannotbecorruptedorlost.Wedescribethebehaviour<br />
ofthesenderbythefollowingMarkovchain.<br />
Weusethefollowingfourstates:<br />
sinit:thestateinwhichthesenderproducesa<br />
messageandpassesthemessagetothemedium<br />
sdel:thestateinwhichthemediumtriestode-<br />
liverthemessage<br />
slost:thestatereachedwhenthemessageislost<br />
swait:thestatereachedwhenthemessageisde-<br />
liveredcorrectlyandinwhichthesystemwaits<br />
<strong>for</strong>theacknowledgementbythereceiver.<br />
sinit<br />
sdel<br />
slost<br />
swait<br />
1<br />
1 0:990:011<br />
?<br />
�<br />
�<br />
�<br />
�<br />
'-<br />
J<br />
J<br />
JJ HHj<br />
JJJJ<br />
H<br />
HY<br />
Forinstance,thetransitionswait!sinitstands<strong>for</strong>thecasewherethesendergetsthe<br />
acknowledgementofthereceiptofthemessage;sdel!slost<strong>for</strong>thecasewherethemedium<br />
loosesthemessages.<br />
<strong>Probabilistic</strong>modelswithnon-determinism:<strong>On</strong>theotherhand,thereisavari-<br />
etyofmodelsbasedonMarkovdecisionprocesses(MDPs)whichallow<strong>for</strong>bothprob-<br />
abilisticandnon-deterministicbranching.FortheMDP-basedmodels,therearedif-<br />
ferentwaysofassociatingprobabilitiestothetransitions.<strong>On</strong>epossibilityistodis-<br />
25The\probabilisticautomaton"alaRabin[Rabi63](thatwereintroducedaslanguageacceptors)can<br />
beviewedasaprecursorofthisapproach.<br />
26Ofcourse,theremightalsobeterminalstateswithoutanyoutgoingtransitions.Moreover,many<br />
authorsallow<strong>for</strong>\substochasticstates"wheretheprobabilitiesoftheoutgoingtransitionssumuptoa<br />
valuep2]0;1[.Inthiscase,theremainingvalue1�pcanbeinterpretedastheprobability<strong>for</strong>deadlock.
20 tinguishbetweenprobabilisticandnon-probabilisticstates.27Representativesofsuch CHAPTER1.INTRODUCTION<br />
deterministicallywhereeachofthenon-deterministicalternativesisassociatedwithamodelsare\concurrentMarkovchains"[Vard85,CoYa88,CoYa95]and\alternatingsysprograms")consideredin[HSP83,Pnue83,PnZu86a,PnZu86b,PnZu93],the\proba- probabilisticchoice.Examples<strong>for</strong>suchsystemsarethemodels(justcalled\probabilistic tems"[HaJo90,Hans91].28AnotherpossibilityistoalloweachstatetobehavenonExample1.2.2[Simplecommunicationprotocol:SenderkReceiver]Wecon-<br />
[BidAl95,dAlf97a,dAlf97b]and\real-timeprobabilisticprograms"of[ACD91a]. bilisticautomaton"of[SeLy94,Sega95a],\probabilisticnon-deterministicsystems"ofsideravariantofthesimplecommunicationprotocolofExample1.2.1(page19)where<br />
wespecifythebehaviouroftheparallelcompositionofthesenderandthereceiverby aprobabilisticsystemwithnon-determinism.29Forsimplicity,weassumethatboththe senderandthereceiverworkwithmailingboxesthatcannotholdmorethanonemessage<br />
theacknowledgement<strong>for</strong>thelastmessageisnotyetarrived). beproducedbe<strong>for</strong>emisdeliveredcorrectly;similarly,themediumcannotbeactiviated aslongasthereisanunreadmessageinthemailingboxofthereceiver(i.e.aslongas atanytime.Thus,ifthesenderhasproducedamessagemthenthenextmessagecannot<br />
Weusethefollowingfourstates: sinit:thestateinwhichthesenderproduces sinit<br />
amessageandpassesthemessagetothe medium<br />
deliveredcorrectly sdel:thestateinwhichthemediumtriesto deliverthemessage sdel<br />
sack:thestateinwhichthereceiver\con- sok:thestatereachedwhenthemessageis sok<br />
themessageandacknowledgesthereceipt). sumes"themessage(i.e.readsandworksup sack 0:99 0:01u ? '-<br />
@@@@@<br />
?<br />
����<br />
$<br />
&�� -<br />
Thestatesackisreachedinthecasewherethesenderhasalreadyproducedthenext messagewhilethereisstillanunreadmessageinthemailingboxofthereceiver.Thus, acknowledgesthereceipt.Instatesok,thesenderandthereceivercanworkinparallel(simultaneously):thesendermayproducethenextmessagewhilethereceivermayconsume theonlypossiblestepinsackistheonewherethereceiver\consumes"themessageand thelastmessage.Theparallelisminstatesokisdescribedbyinterleaving,i.e.thenondeterministicchoicethatdecideswhichprocessper<strong>for</strong>msthenextstep:eitherthesender behavepurelynon-probabilistic,possiblynon-deterministic. producesthenextmessageorthereceiverconsumesthelastmessage.Theinterleaving<br />
inthe\stratiedtransitionsystems"of[vGSST90].Theseareintroducedasoperationalmodel<strong>for</strong>a 27<strong>Probabilistic</strong>statesarethosewhereaprobabilisticchoiceisresolvedwhilenon-probabilisticstates<br />
of[vGSST90],non-determinismisnotpresent.However,non-determinismcouldbeeasilyaddedtothe languagewithprobabilisticchoicebutlacks<strong>for</strong>non-deterministicchoice.Thus,inthestratiedsystems 28Theideaofseparatingtheprobabilisticbranchesfromnon-probabilisticactivitiesisalsorealized languageandthemodel. eachofthesealternativesisrepresentedbyaprobabilisticchoice.<br />
29Weusethemodelwhereanystateisassociatedwithasetofnon-deterministicalternativesandwhere
1.2.PROBABILISTICSYSTEMS sok 21<br />
sack produce QQQQQQs consume QQQQQQs<br />
+ consume sinit<br />
sdel+<br />
produce<br />
oftheactionsproduceandconsumeinstatesokleadstotheclassical\diamond"shown Figure1.2:The\diamond"obtainedbyinterleaving<br />
inFigure1.2statingthattheeectoftheparallelexecutionofproduceandconsumeis<br />
Ofcourse,theclassicationMC-basedversusMDP-basedmodelsistoocoarsetocapture thesameasifproduceandconsumeareexecutedinanyorder:ineithercase,wereach<br />
allmodelsproposedintheliterature.Severalauthorsintroducedmodelsthatcanbe thestatesdel.<br />
classiedbetweenMCsandMDPssuchas\reactivesystems"[LaSk89,vGSST90]or \probabilisticI/Oautomaton"[WSS94].<br />
dierencebetweeninternalandexternalprobabilisticchoicebecomesvisibleinthecontext Internalvsexternalprobabilisticchoice:The<strong>for</strong>maldenitionofthesemodels doesnotdependonwhetherinternalorexternalprobabilisticchoiceisassumed.The speciestheprocessesoractionsthatareenabledinacertainstate)isaectedfromthe chosentypeofprobabilisticchoice. ofcompositionoperatorsofaprocesscalculus.Especiallytherestrictionoperator(that<br />
Specifyingprobabilisticsystems:Whichofthesemodelsshouldbeuseddependson<br />
modelsbasedonMDPscanbeusedtodescribethebehaviourofdistributedrandomized theconcreteapplication.Roughlyspeaking,themodelsbasedonMCsaresuitableto calculiwithsynchronousparallelcompositionorprobabilisticshueoperatorswhilethe algorithmsorprocessesofanasynchronuousprobabilisticcalculus. <strong>for</strong>malizethebehaviourofsequentialrandomizedalgorithmsorprocessesofprobabilistic<br />
Theneedofnon-determinism:Whenmodellingdistributedrandomizedalgorithms orasynchronousprobabilisticsystemsbyMDP-basedmodels,non-determinismisused tomodelinterleaving(cf.Example1.2.2,page20).Asobservedbyseveralotherau-<br />
(cf.[JoYi95]).Thissituationiswell-knowninthedesignof(sequentialordistributed) underspecicationwhichcanbe(totallyorpartly)resolvedinfurtherrenementsteps thors,e.g.[JHY94,JoYi95,Sega95a],therearealsoothersituationswheretheconcept<br />
algorithms.Forexample,inahigh-leveldesignonemightuseastatementlike ofnon-determinismmightbehelpful.Thenon-determinismmightbeusefultorepresent<br />
(e.g.inahigh-leveldescriptionofQuicksortthePivotelementmightbechosenbya statementlikethat)whileintheimplementationoneworkse.g.withtheassignmentx:= \choosesomeindexi2f1;:::;ngandputx:=a[i]"<br />
a[1](orarandomizedassignmentx:=random(a[1];:::;a[n])).Anotherexampleisthat
22 \non-determinismcanbeusedtospecifytheallowedprobabilitiesoffailureofamedium CHAPTER1.INTRODUCTION<br />
wherearenementstepisusedtodecreasethesetofallowedfailurerates[JoLa91]" beusedtorepresentincompletein<strong>for</strong>mationontheparametersofsystembehavioursuch (wherewequotefrom[JoYi95]).Second,alsoobservedin[JoYi95],non-determinismcan asMilner'sweatherconditions[Miln89].<br />
stake.30Whenenteringthecasino,therouletteplayerstartsplayingwiththestake1$. Example1.2.3[Rouletteplayer]Figure1.3(page22)showsthe\one-day-behaviour"<br />
Wheneverheloosesthelastgame,hedoublesthestake<strong>for</strong>thenextgame.<strong>On</strong>theother ofanaddictedrouletteplayer.Forsimplicity,weassumethatheisarbitraryrichand<br />
hand,ifhehaswonthelastgame,hedecidesnon-deterministicallytocontinueplaying(in alwayschoosesthesimplerisk\red"or\black"andthatthereisnolimitontheallowed<br />
leavingthecasinomightbedependentonthewell-beingoftherouletteplayeroronthe risksallhismoney.Here,thenon-deterministicchoiceisusedtodescribetheincomplete whichcaseherestartswiththestake1$)ortoleavethecasinowithonelastgamewherehe<br />
moodofhiswifeoronotherunknownfactors. in<strong>for</strong>mationaboutthe\environment".Thechoiceinstateswonbetweenstayinginor<br />
sinit splay swon shappy<br />
stake:=1$ u1212<br />
-?6 stake:=1$ u12<br />
stake:=2*stake -HHHHHj stake:=all<br />
12*<br />
-HHHHHj*<br />
slost ssad<br />
1.2.2 Theprocesscalculusapproach<strong>for</strong>probabilisticsystems Figure1.3:The\one-day-behaviour"oftherouletteplayer<br />
Intheliterature,avarietyofprobabilisticprocesscalculiareproposed.Theyeitherreplacethenon-deterministicchoiceoperatorbyaprobabilisticchoiceoperatororallowGLN+97,dAHK98]<strong>for</strong>calculiwithprobabilisticshueoperators.31Someofthesecal- Seid95,BaKw97,Norm97]<strong>for</strong>asynchronousprocesscalculiand[BBS92,SCV92,NudF95, <strong>for</strong>bothnon-deterministicandprobabilisticchoice.Seee.g.[GJS90,JoSm90,vGSST90,<br />
culicanbeusedtoreasonaboutpriorities[SmSt90,Toft94,Lowe95].Typically,such Toft90,LaSk92,Toft94]<strong>for</strong>synchronousand[HaJo90,Hans91,YiLa92,Yi94,Lowe93b,<br />
(MC-based)system[GJS90,vGSST90,BBS92,LaSk92];butalsootheroperationalseprocesscalculiaresuppliedwithanoperationalsemanticsbasedon(somekindof)probmantics(e.g.basedonthereactiveorstratiedview)arepossible[vGSST90,Toft94].abilistictransitionsystems.Inabsenceofnon-determinism,thecalculiwithsynchronous parallelismoraprobabilisticshueoperatorcanbedescribedbyafullyprobabilistic<br />
theprobability<strong>for</strong>winningagameis1=2. toaxedschedulerthatdecidesrandomlywhichprocessper<strong>for</strong>msthenextstepwheretheunderlying 30Moreover,weneglectthepossibleoutcome\Zero"(wherethebankgetsallstakes)andsupposethat randomchoicedependsonthelocalstatesoftheprocesses.<br />
31Theprobabilisticshueoperatorsdescribetheinterleavedexecutionoftwoprocesseswithrespect
1.2.PROBABILISTICSYSTEMS Theoperationalsemanticsofprobabilisticcalculithatallow<strong>for</strong>non-deterministicchoice 23<br />
YiLa92,Yi94,BaKw97]. els(probabilistictransitionsystemswithnon-determinism),seee.g.[HaJo90,Hans91,and/ordealwithasynchronousparallelismcanbedenedbymeansofMDP-basedmodImplementationrelations<strong>for</strong>probabilisticprocesses:Severalimplementationrelations<strong>for</strong>probabilisticprocessesareproposed,suchastrace,failureandreadyequivalence[JoSm90],bisimulation[LaSk89,HaJo90,Hans91,SeLy94,BaHe97]32,simulationlikepreorders[JoLa91,Yi94,SeLy94,Sega95a]andvarioustypesoftestingpreorders [Chri90a,Chri90b,CSZ92,YiLa92,Chri93,YCDS94,JHY94,JoYi95,NudF95,Sega96, Vericationmethods:Eventhoughmanyimplementationrelations<strong>for</strong>probabilis- Norm97,KwNo98a,KwNo98b].<br />
mentationrelation)arerelativelyrare.Forfullyprobabilisticsystems(theMC-basedticsystemshavebeenintroduced,correspondingvericationmethods(i.e.methods<strong>for</strong>showingthatoneprocessimplementsanotheronewithrespecttoanappropriateimple- models),bothaxiomatic[GJS90,JoSm90,LaSk92,BBS92]andalgorithmic[Chri90a,<br />
relations<strong>for</strong>non-probabilisticsystemsisPSPACE-complete[KaSm83].Inthecaseof failureequivalence[HuTi92],thisfactisofinterestsincedecidabilityofthecorresponding tionedalgorithmicmethodsruninpolynomialtime.EspeciallyinthecaseoftraceandChCh91,HuTi92,Chri93,BaHe97]methodshavebeendeveloped.Alltheabovemen- (strongorweak)bisimulationorsimulation,thetimecomplexitiesarepolynomialinthe non-probabilistic[KaSm83,PaTa87,BoSm87,GroVa90,HHK95]aswellastheproba-<br />
[Bai96,PSS98]<strong>for</strong>algorithmicvericationmethods)while{asfarastheauthorknows models),vericationmethods<strong>for</strong>thebranchingtimerelations(bisimulationandsimulation)areproposedsofar(see[HaJo90,Hans91,Yi94,Toft94]<strong>for</strong>axiomatizationsandbilistic[HuTi92,BaHe97]case.Forthemodelswithnon-determinism(theMDP-based Denotationalsemantics:TheworkbyKozen[Koze79]ondenotationalsemantics<strong>for</strong> equivalenceala[JoYi95]oranyweaklineartimerelation). {theliteraturelacks<strong>for</strong>methods<strong>for</strong>otherimplementationrelations(suchastesting<br />
ofthedenotationalapproach.Jones&Plotkin[JoPl89,Jone90]introducetheprobabilis- sequentialprogramswithrandomassignmentandwhile-loopscanbeseenasaprecursor ticpowerdomainofevaluationstoprovideadenotationalsemantics<strong>for</strong>aprogramming probabilitiesratherthansinglebehaviours.Theconceptofevaluationsisoftenusedin languagewithwhile-loopsandaprobabilisticconcurrencyoperator.Roughlyspeaking,<strong>for</strong>semanticalpurposes,evaluationsareusedtodecoratesetsofbehaviourswith probabilisticchoiceandin[BaKw97]toobtaindenotationalsemantics<strong>for</strong>aprobabilistic denotationalsemantics<strong>for</strong>randomizedprograms;e.g.<strong>for</strong>probabilisticpredicatetrans<strong>for</strong>mers[Jone90,MMS96,HMS97]butalsointheeldofprobabilisticprocessalgebras. Evaluationsareusedin[MMS+94]togiveafailure/divergencesemantics<strong>for</strong>CSPwith extensionofCCSthatareshowntobefullyabstractwithrespecttobisimulationand<br />
testingpreordersarepresentedbyChristo[Chri90a,Chri90b],Jonsson&Yi[JoYi95] simulation.Otherdenotationalcharacterizations<strong>for</strong>probabilisticvariantsofCSP(that donotuseevaluations)areproposedbyLowe[Lowe93a,Lowe93b,Lowe95]andSeidel [Seid95].Denotationalmodelsandrelatedfullabstractionresults<strong>for</strong>certaintypesof<br />
systemsareintroduced.<br />
32Seealso[dViRu97,BDE+97,DEP98]wherebisimulationequivalence<strong>for</strong>\continuous"probabilistic
24 andKwiatkoswka&Norman[KwNo96,Norm97,KwNo98a,KwNo98b].[Hart98]presents CHAPTER1.INTRODUCTION<br />
view.Adenotational\trueconcurrency"semantics<strong>for</strong>avariantofLOTOSwithtime abovementionedsemantics<strong>for</strong>theasynchronouscalculiareallbasedontheinterleaving severaldenotationalsemantics<strong>for</strong>aCCS-likelanguagewithprobabilisticchoiceanddis-<br />
andprobabilitiesbymeansofeventstructuresisgivenbyKatoen[Kato96]. cussestheuseofinternalorexternalprobabilisticandnon-deterministicchoice.The<br />
1.2.3 Severalauthorsproposedextensionsofprogramlogicstoreasonaboutqualitativeor quantitativetemporalpropertiesofprobabilisticsystems.Inthisintroduction,weonly <strong>Probabilistic</strong>temporallogic<br />
explainthemainideasbehindthetemporallogicalframework.33Qualitativeproperties assertthatacertainevent'holdswithprobability0or1whilequantitiveproperties<br />
usealowerbound1�andstatethatacertainsafetyorlivenessconditionissatised guaranteethattheprobability<strong>for</strong>acertainevent'meetsgivenlowerorupperbounds.34<br />
withsomesucientlylargeprobability(i.e.withaprobabilityintheinterval]1�;1]or Inmostapplications,thequantitivepropertiesdealwithanupperbound<strong>for</strong>somesmall<br />
[1�;1]).35Inthetemporallogicalframework,theevent'describesaproperty<strong>for</strong>the andassertthattheprobability<strong>for</strong>a\badevent"issucientlysmall(i.e.
1.2.PROBABILISTICSYSTEMS (seee.g.[HaJo89,Hans91,HaJo94,SeLy94,ASB+95,BidAl95,dAlf97a])integratethe 25<br />
lower/upperbounds<strong>for</strong>theacceptableprobabilitiesintothesyntaxanduse<strong>for</strong>mulas<br />
itativepropertiesexpressedinthetemporallogicalframeworkamountsshowingthat e.g.ofthe<strong>for</strong>mProbp(')thatstatethattheprobability<strong>for</strong>theevent'isatleastp.<br />
thegivenevent'holdswithprobability0or1.Fornitesystems,ithasbeenrealizedthatthisiscompletelyindependentontheprecisetransitionprobabilitiesandVericationmethods:Provingthecorrectnessofaprobabilisticprocessagainstqual- justdependsonthe\topology"oftheunderlyingdirectedgraph.Thisobservationwas<br />
[Vard85,VaWo86,PnZu86b,CoYa88,ACD91a,ACD91b,PnZu93,CoYa95]<strong>for</strong>algorithity1andlaterusedinseveralvericationmethods<strong>for</strong>establishingqualitativetemporalproperties;seee.g.[LeSh82,Pnue83,HaSh84,PnZu86a]<strong>for</strong>deductivemethodsandrstmadebyHart,Sharir&Pnueli[HSP83]<strong>for</strong>provingterminationwithprobabilmicmethods.Establishingquantitativetemporalpropertiesrequiresthecomputation oftheexactprobabilities<strong>for</strong>thegivenevent';seee.g.[LSS94,PoSe95,Sega95a]<strong>for</strong> fullyprobabilisticsystemsand[CoYa90,Hans91,BidAl95,dAlf97a,dAlf97b]<strong>for</strong>algorith- proofrules,[CoYa88,HaJo94,ASB+95,CoYa95,IyNa96]<strong>for</strong>algorithmicmethods<strong>for</strong> handlingof<strong>for</strong>mulasinvolvingthe\eventuallyoperator"3istheuseoflinearequation systemsinthecaseoffullyprobabilisticsystems[CoYa88,HaJo94]andlinearoptimization problemsinthecaseofprobabilisticsystemswithnon-determinism[CoYa90,BidAl95]. micmethods<strong>for</strong>probabilisticsystemswithnon-determinism.Themainconcepts<strong>for</strong>the<br />
caseofprobabilisticsystemswithnon-determinism[Vard85,CoYa95]. thecaseoffullyprobabilisticsystemsandcomplete<strong>for</strong>doubleexponentialtimeinthe nomial[HaJo94,BidAl95].Forlineartimelogic,modelcheckingisPSPACE-completeinThetimecomplexitiesofthemodelcheckingalgorithms<strong>for</strong>branchingtimelogicsarepolytionsabouttheresolutionsofthenon-deterministicchoicesmightbeessential<strong>for</strong>proving certainlivenessproperties.Clearly,thisobservationcarriesovertoprobabilisticsystems withnon-determinismandconcernsqualitativeaswellasquantitativeproperties.Asan Fairness:Fornon-probabilisticparallelsystems,itiswell-knownthatfairnessassump-<br />
example,considertherandomizeddiningphilosophers[LeRa81]:whentwophilosophers aresimultaneouslyreadytoipafaircoininordertodecidewhich<strong>for</strong>ktopickup,one canthinkofthisastwoprobabilitydistributions,eachrespectivelywithprobability12of obtainingheadsortails,enabledinthesamestate.Iftheschedulerneverselectsagiven philosopher<strong>for</strong>executioneventhoughheisreadytoproceed(e.g.toipthecoin)therun thusproducedwouldbeunfair,andasaresultonecouldnotguaranteethequalitative propertythatassertslackofstarvation.Asanexample<strong>for</strong>asituationwherefairness assumptionsareessential<strong>for</strong>establishingquantitativeproperties,consideracommunicationprotocolwhichattemptstodeliveramessagetotherecipientifoneisreceivedonthe inputchannelfromtheenvironment,andloopsbacktotheinitialstateotherwise.Ina realisticscenario,theoutcomeofthedeliveryisprobabilistic,andwillresultinamessage beingdeliveredcorrectlywithsomesuitablyhighprobability,say0.999,oranerrorstate \themessageiseventuallydeliveredwithprobability0.9"canonlybeestablishedonconditionthattheprotocoldoesnotloopbacktotheinitialstate<strong>for</strong>ever.Hence,alsointhe beingreachedifafaulthasoccurredinthetransmittingmedium.Then,theproperty probabilisticcase,itisdesirabletohavemethods<strong>for</strong>proving(quantitativeorqualitative) temporalpropertiesunderfairnessconstraints.Establishingtemporalpropertiesunder fairnessconstraints(<strong>for</strong>aprobabilisticsystemwithnon-determinism)amountsshowing
26 thatanevent'holdswithsomesucientlysmallorlargeprobability(orwithprobability CHAPTER1.INTRODUCTION<br />
0or1inthecaseofaqualitativeproperty),providedthatthenon-deterministicchoices<br />
understood(seee.g.[HSP83,Vard85,PnZu86b,PnZu93]<strong>for</strong>algorithmicmethods)only areresolvedinafairmanner. Eventhoughthevericationofqualitativepropertiesunderfairnessassumptionsiswell-<br />
rules<strong>for</strong>establishingquantitative(timed)progressproperties<strong>for</strong>randomizeddistributed systemswhichcanbecombinedwithseveralnotionsoffairness.Asfarastheauthor afewresearchhasbeendonesofarintheeldofvericationmethods<strong>for</strong>establishing quantitativepropertiesunderfairnessconstraints.[LSS94,PoSe95,Sega95a]presentproof<br />
takefairnessintoaccount. verifyingquantitativepropertiesofprobabilisticsystemswithnon-determinismwhich knows,[BaKw98,dAlf97a]aretherstattemptsto<strong>for</strong>mulatealgorithmicmethods<strong>for</strong><br />
1.3 Thisthesisinvestigatesseveralaspectsof<strong>for</strong>malreasoningaboutprobabilisticsystems.37 Thetopicsofthisthesis<br />
(I)Theprocessalgebraapproach:Weconsiderasynchronousandsynchronous probabilisticprocesscalculi,operationalanddenotationalsemantics<strong>for</strong>themand homogenousalgorithmicvericationmethods.Themaincontributionsare: denotationalcharacterizationsofbisimulationandsimulation(Chapter5),<br />
acorrespondingvericationalgorithm(Chapter7)andthedenitionofalazy thedenitionofweakbisimulation<strong>for</strong>fullyprobabilisticsystemstogetherwith algorithms<strong>for</strong>establishingabranchingtimerelation(bisimulationorsimula-<br />
synchronousparallelcompositionoperatorthatpreservesweakbisimulation tion)betweenprobabilisticsystemswithnon-determinism(Chapter6),(II)Thetemporallogicapproach:Weconsiderthelinearandbranchingtimeframe-<br />
contributionsare: work<strong>for</strong>establishingqualitativeandquantitativetemporalproperties.Themain equivalence(Section4.3).<br />
atechnique<strong>for</strong>provingqualitativelineartimepropertieswithwell-knownnonprobabilisticmethods(Chapter8),algorithms<strong>for</strong>establishingquantitivetemporalpropertiesofaprobabilisticsys(III)Symbolicverication:Chapter10presentsvericationalgorithms<strong>for</strong>probabilistemwithnon-determinismandfairnessbymeansofamodelcheckingalgorithm<strong>for</strong>aprobabilistictemporallogicPCTLwithasatisfactionrelationthatinideaisthedevelopmentofa\language"<strong>for</strong>manipulatingMTBDDsinwhichsevticsystemsthatusemulti-terminalBDDs(MTBDDs)asdatastructure.Themainvolvesfairnessofnon-deterministicchoice(Chapter9).eralvericationproblems<strong>for</strong>probabilisticsystemscanbeembedded.Thisyieldsductionofeachchapter.37Mostresultsarepublishedwithcoauthors.Thecorrespondingreferencecanbefoundintheintro- symbolicmodelcheckingalgorithms<strong>for</strong>PCTL(interpretedoverfullyprobabilistic
1.3.THETOPICSOFTHISTHESIS systemsorprobabilisticsystemswithnon-determinismandfairness)andMTBDD27<br />
basedmethods<strong>for</strong>checkingstrongandweakbisimulationequivalence<strong>for</strong>fullyprob<br />
1.3.1abilisticsystems. systems;seethereferencesmentionedbe<strong>for</strong>e.38Intheauthorsopinion,itwouldmakelittle Intheliterature,alotofworkhasbeendoneintheeldof<strong>for</strong>malmethods<strong>for</strong>probabilistic Relatedwork<br />
sensetolistallrelatedworkhereandtoexplaininwhichwaythisthesisisrelated.Thisis doneintherespectivechapter.Atthisplace,theauthorjustwantstorefertothethesis' systemsandhencerelatedtothisthesisatalargedegree.39Especiallytheexcellentwork [Chri90a,Jone90,Seid92,Hans91,Chri93,Lowe93a,Sega95a,dAlf97a,Norm97,HarG98] thatareallaboutspecication<strong>for</strong>malismsand/orvericationmethodsofprobabilistic byHansHansson[Hans91],RobertoSegala[Sega95a]andLucadeAlfaro[dAlf97a](and severalpapersthattheywrotewithcoauthors)hadgreatinuenceonthedevelopment ofthisthesis.40 withtheoneof[Sega95a,dAlf97a]andisavariantoftheoneof[Hans91]. TheprocesscalculusPCCSofChapter4isavariantoftheprocesscalculus(also calledPCCS)introducedbyHansson&Jonsson[HaJo90]. Themodel<strong>for</strong>concurrentprobabilisticsystemsthatweusehereessentiallyagrees<br />
ThebisimulationequivalenceandthesimulationpreorderthatweconsiderinChapters5and6wereintroducedbySegala&Lynch[SeLy94]. ThemainconceptsofthelogicPCTLthatweconsiderinChapter9aretakenfrom papersbyeachofthethree,namely[HaJo89,Hans91,HaJo94,SeLy94,BidAl95, dAlf97a,dAlf97b].Moreover,theideaofusing!-automaton<strong>for</strong>ourPCTLmodel checkingalgorithmwassuggestedbyLucadeAlfaro. ThesymbolicPCTLmodelcheckingalgorithmofChapter10takethemethodsof<br />
1.3.2 Hansson&Jonsson[HaJo94]andBianco&deAlfaro[BidAl95]asbasis.<br />
Thereaderisnotsupposedtoreadthischapterbuthe/sheshouldkeepinmindthat Chapter2collectsournotationsconcerningsets,relations,functionsanddistributions. Howtoreadthisthesis<br />
3servesasbasis<strong>for</strong>allotherchaptersbecauseitintroduces(andtriestomotivate)the he/shehasafairchancetondtheexplanations<strong>for</strong>ournotationsinChapter2.Chapter modelsandexplainsthenotationsthatareusedinalmostallpartsofthisthesis.A readernotfamiliarwithprobabilisticsystemsshouldreadthischapterrstwhileareader<br />
andstochasticPetrinets[Moll82,MBC84]belongtothestandardmodels)isclosetotheapproachhere. tothetopicofthatthesis.Inparticular,theeldofper<strong>for</strong>manceanalysis,seee.g.[Herz90,GHR93, GiHi94,Hill94,Pria96,dAKB98,BeGor98,Herm98,HHM98],(wherecontinuoustimeMarkovchains 39Thislistofthesis'mightbefarfrombeingcomplete.Itcontainsonlythosethesis'thattreat<br />
38Clearly,alsoanyworkon<strong>for</strong>malmethodstoreasonaboutotherquantitativeaspectsisrelated<br />
probabilisticsystemsastheirmaintopicandthathadinuencestothisthesis. thesisdoesnot.<br />
40Itshouldbepointedoutthateachofthethreethesis'alsoconsidersreal-timeaspectswhilethis
28 whoisfamiliarwithprobabilisticprocessesmightskipthischapterkeepinginmindthat CHAPTER1.INTRODUCTION<br />
thenotationsspecictothisthesiscanbefoundthere.Tosupportareaderwhoisonly interestedincertainpartsofthisthesistheauthortriedtomaketheremainingchapters asindependentaspossible.Inthosecaseswherearesultofonechapterisusedinanother chapterthereaderwillnda(page)reference.Theappendix(Chapter12)recallssome<br />
Proofs:Forthesakeofreadability,inmostchaptersthemainresultsarepresented denitions/conceptspresentedsomewhereintheliterature;thenotationsintroducedthere arealwaysusedinconnectionwithareferencetotherelevantpartofChapter12. withoutproofs(butwithapagereferencetotheplacewheretheproofcanbefound). Theproofsaregiveninthelastsectionoftherespectivechapter.41Areadernotinterested inthetheoreticaldevelopmentoftheresultsmightskiptheappended\proof-sections". abstractexamples(withoutanyconcretemeaning)orextremelysimpliedexampleswith arealisticbackground.Examplesofthe<strong>for</strong>mertypeshouldjustdemonstrateacertain Examples:Themainconceptsareillustratedbysimpletoyexamples.Theseareeither technique.Althoughunrealistic,examplesofthelattertypeshouldgivesomeinsights<br />
example.Someproofsaredevidedintosubclaims.Thesymbolcdenotestheendofthe Thesymbols howtoapplytheproposedframeworkinrealisticsituations.<br />
proofofsuchasubclaim. andc:Weusethesymboltodenotetheendofaproof,remarkor<br />
Background:Evennotnecessary,somefamiliaritywiththebasicconceptsof<strong>for</strong>mal methods<strong>for</strong>parallelsystemsmightbehelpful.Elementarynotionsofseveralmathematicaldisciplines(suchasnumericalanalysis,linearalgebra,probabilityandmeasuretheory, knowledgewhatalinearequationsystemoroptimizationproblemisshouldbesucient miliarwiththem(butinterestedinthetopicsofthisthesis)shouldnotimmediatelygive uptoreadthisthesis;anintuitiveunderstandingofe.g.thenotion\probability"orthe topologyandgraphtheory)areusedwithoutanyexplanation.However,areadernotfatounderstandthemainideas.Wedonotrecallthebasicnotionsoftheabovementionedmathematicaldisciplineshereandrefertoanystandardbookabouttherespective<br />
discipline.42<br />
Suth77,Enge89]<strong>for</strong>topologyand[Even79,Goul88]<strong>for</strong>graphtheory.Basicknowledgeaboutthetheory isonlydoneinthosecaseswhereasimpleproofcanbederivedfromtheresultsofafurtherchapter. 42Forinstance,see[Halm50,Rudi66,Fell68,GrWe86]<strong>for</strong>measureandprobabilitytheory,[Dugu66, 41Inafewcases,theproofofacertaintheoremisgiveninthe\proof-section"ofanotherchapter.This ofMarkov(decision)processes,seee.g.[Derm70,Ross83,Pute94],mightbehelpfulbutisnotnecessary.
Chapter2<br />
Preliminaries<br />
here. Inthischapter,webrieyexplainsomenotationsthatareusedthroughoutthethesis. Forarstreading,thereadermightskipthischapter,butshouldkeepinmindthatour notationsconcerningsets,relations,partitions,functionsanddistributionsareexplained<br />
functionidX:X!X,idX(x)=x<strong>for</strong>allx2X.Thecharacteristicfunctionofasubset 2.1 Sets:ForXtobeaset,2XisthepowersetofX.idXdenotestheidentityonX,i.e.the Sets,relations,partitionsandfunctions<br />
thenjXjdenotesthenumberofelementsofX.IfXisinnitethenweputjXj=1.] denotesdisjointunion. X0ofXistheboolean-valuedfunctionX!f0;1g,x7!1ix2X0.IfXisnite<br />
Relations:LetR,R1,R2bebinaryrelationsonX.Wealsowritex1Rx2todenote that(x1;x2)2R.WedeneR�1=f(x2;x1)2X thanR1R2.Rdenotesthetransitive,reexiveclosureofR. f(x1;x2)2XX:9x2X((x1;x)2R1^(x;x2)2R2)g.WeoftenwriteR1R2rather X:(x1;x2)2RgandR1R2=<br />
disjointnonemptysubsetsofXsuchthatSB2XB=X.Weoftenrefertotheelements denotesthequotientspace(i.e.thesetofequivalenceclasses)and,<strong>for</strong>x2X,[x]Rthe Equivalencesandpartitions:IfRisanequivalencerelationonasetXthenX=R<br />
ofapartitionasblocks.Clearly,<strong>for</strong>eachequivalencerelationRonX,thequotientspace X=RisapartitionofX.Viceversa,eachpartitionofXinducesanequivalencerelation equivalenceclassofxwithrespecttoR.ApartitionofXisasetXconsistingofpairwise<br />
onX:ForXtobeapartitionofX,RXdenotestheinducedequivalencerelation,i.e.RX consistsofallpairs(x1;x2)2X write[x]X(insteadof[x]RX)todenotetheuniqueblockB2Xthatcontainsx.A inducedequivalencerelationRXisnerthanRX0(i.e.ieachB2Xiscontainedinsome partitionXiscallednerthanapartitionX0(andX0iscalledcoarserthanX)ithe Xwherex1,x22B<strong>for</strong>someB2X.Weoften<br />
B02X0).WesayXisstrictlynerthanX0(orX0strictlycoarserthanX)iXisner Functions:ForXandYtobesets,X!Ydenotesthefunctionspaceofallfunctions thanX0andX6=X0. fromXtoY.Iff:X!YisafunctionandX0 29<br />
XthenfjX0denotestherestrictionoff
onX0,i.e.fjX0denotesthefunctionfjX0:X0!YwhichisgivenbyfjX0(x)=f(x).For 30 CHAPTER2.PRELIMINARIES<br />
Y0 Y0g.Fory2Y,weputf�1(y)=f�1(fyg).Similarly,<strong>for</strong>X0 imageofX0underf,i.e.f(X0)=ff(x):x2X0g.WedeneRange(f)=f(X)todenote Y,f�1(Y0)denotestheinverseimageofY0underf,i.e.f�1(Y0)=fx2X:f(x)2<br />
andf:X!Yarefunctionsthengf:X!Zisgivenby(gf)(x)=g(f(x)).If therange(image)off.gfdenotestheusualfunctioncomposition,i.e.ifg:Y!Z X,f(X0)denotesthe<br />
2.2 f:X!Xisafunctionthenf0=idXand,<strong>for</strong>n=0;1;2;:::,fn+1=ffn.<br />
Distributions:LetXbeaset.AdistributiononXisafunction Distributions<br />
ofelementsx2Xwith(x)>0.For;6=A thatfx2X:(s)>0giscountableandPx2X(x)=1.Ifx2Xthen1xdenotesthe uniquedistributiononXwith1x(x)=1.Supp()denotesthesupportof,i.e.theset S,wewrite[A]todenotePx2A(x). :X![0;1]such<br />
composition Thecomposition Inparticular,[;]=0.Distr(X)denotesthecollectionofalldistributionsonX. isthedistributiononXYwhichisgivenby( :Let, bedistributionsonXandYrespectively.The<br />
respectivelyandR Weightfunctions(cf.[SeLy94,Sega95a]):Let, XY.Aweightfunction<strong>for</strong>(;)withrespecttoRisafunction distributionsbeonXandY )(x;y)=(x)(y).<br />
weight:X 2.Forallx2X,y2Y: 1.weight(x;y)6=0<strong>for</strong>atmostcountablymany(x;y)2X Y![0;1]whichsatises:<br />
Xy2Yweight(x;y)= (x); Xx2Xweight(x;y)=(y) Y.<br />
Wewrite ifR1 3.Ifweight(x;y)>0then(x;y)2R.<br />
respecttoR2.Hence, R2theneachweightfunctionwithrespecttoR1isalsoaweightfunctionwith R ifthereexistsaweightfunction<strong>for</strong>(;)withrespecttoR.1Clearly,<br />
Remark2.2.1LetX,YandZbedistributionsonX,Y,Zrespectively,andlet RX;Y X Y,RY;Z YR1implies ZandweightX;Y:X R2.<br />
(X;Y)withrespecttoRX;Y,weightY;Z:Y withrespecttoRY;Z.Then,weightX;Z:X Z![0;1], Z![0;1]aweightfunction<strong>for</strong>(Y;Z) Y![0;1]aweightfunction<strong>for</strong><br />
isaweightfunction<strong>for</strong>(X;Z)withrespecttoRX;YRY;Z.Thus,ifXRX;YYand weightX;Z(x;z)= y2Supp(Y)weightX;Y(x;y)weightY;Z(y;z) X Y(y) ;<br />
theweight(x;y)=(y)-partofy.Then,thewholeofeachx2Supp()iscombinedwithcertainpartsof therelationRispreserved:if(x),(y)>0thenwe\combine"theweight(x;y)=(x)-partofxwith Y1Intuitively,theweightfunctionweightshowshowtosplittheprobabilities(x)and(y)suchthat RY;ZZthenX RZwhereR=RX;YRY;Z.Inparticular,ifXisasetand<br />
elementsy2Supp()where(x;y)2R.
R2.2.DISTRIBUTIONS X XisatransitiverelationthenRisatransitiverelationonDistr(X).From 31<br />
this,ifRisapreorderonXthenRisapreorderonDistr(X). Remark2.2.2LetR ThefunctionDistr(f):Forf:X!Ytobeafunction,thefunctionDistr(f): Then,0R�1. X Yand 2Distr(X),02Distr(Y)suchthat R0.<br />
Distr(X)!Distr(Y)isgivenbyDistr(f)()(y)=[f�1(y)]. Remark2.2.3Letf:X!Ybeafunction.Then,<br />
isaweightfunction<strong>for</strong>(;Distr(f)())withrespecttoR=f(x;f(x)):x2Xg.Thus, weight:X Y![0;1];weight(x;y)=((x):iff(x)=y<br />
RDistr(f)().<br />
0 :otherwise
32 CHAPTER2.PRELIMINARIES
Chapter3<br />
Modellingprobabilisticbehaviour<br />
modelsthatareextensionsof(non-probabilistic)transitionsystemswhichhavebeenes- relatednotations)thatareusedthroughoutthethesis.Weshrinkourattentiontothose tablishedasoneofthestandardmodels<strong>for</strong>non-probabilisticsystems. Inthischapterweintroducethemodels<strong>for</strong>probabilisticsystems(togetherwithsome<br />
canbeusedtoanalyzethebehaviourofsequentialrandomizedalgorithmsorprocessesof treatmentofnon-determinism.<strong>On</strong>theonehand,therearevariousextensionsofMarkov chains(MCs)thatallow<strong>for</strong>probabilistic(butnot<strong>for</strong>non-deterministic)choice;these Themaindistinctivemark<strong>for</strong>theprobabilisticmodelsproposedintheliteratureisthe<br />
acalculuswithsynchronousparallelcomposition.<strong>On</strong>theotherhand,thereareseveral extensionsofMarkovdecisionprocesses(MDPs)thataresuitabletospecifybothprob- composition. abilisticandnon-deterministicbehaviour;thesearesuitabletodescribethebehaviourofThe<strong>for</strong>maldenitionofamodel<strong>for</strong>probabilisticsystemsdoesnotdependonwhetherin-<br />
distributedrandomizedalgorithmsorprocessesofacalculuswithasynchronousparallel<br />
independentontheenvironmentwhiletheresolutionofanexternalprobabilisticchoice ternalorexternalprobabilisticchoiceisassumed.1Internalprobabilisticchoiceisresolved assumeinternalprobabilisticchoice.ThiswillonlybeimportantinChapter4wherethe dependsontheprocesses/actionsthatareenabledinacertainstate.2Inthisthesis,we<br />
ofthemodelsthatweuseinthatthesis.Westartwiththebasicmodelswithoutany Organizationofthatchapter:Intherstthreesectionswegivethe<strong>for</strong>maldenitions processalgebraapproachisconsidered.<br />
labellingswhereSection3.1dealswiththeMC-basedmodels(calledfullyprobabilistic systems)andSection3.2withtheMDP-basedmodels(calledconcurrentprobabilistic systems).These\stripped"modelsareextendedinSection3.3byactionlabels<strong>for</strong>the transitionsandbypropositionlabels<strong>for</strong>thestates.InSection3.4,werecallthedenition introducedbySegala&Lynch[SeLy94].Intheremainderofthethesis,wedistinguish ofprobabilisticbisimulationalaLarsen&Skou[LaSk89]andprobabilisticsimulationas between\systems"and\processes".Thenotion\system"isusedtodescribeastructure<br />
aprocesscalculus;inparticular,therestrictionoperator.SeeRemark4.2.4(page81). 2Theunderlyingtypeofprobabilisticchoiceinuencesthesemanticsofthecompositionoperatorsof 1Seepage18<strong>for</strong>themotivationbehindinternalandexternalprobabilisticchoice.<br />
33
consistingofastatespaceandatransitionrelation(possiblyextendedbycertainlabels) 34 CHAPTER3.MODELLINGPROBABILISTICBEHAVIOUR<br />
willbeexplainedinSection3.5.InSection3.6,wesketchhowourmodelstintothe whilea\process"denotesa\pointedsystem"(i.e.asystemwithaninitialstate).This hierarchyofmodelsstudiedintheliterature.<br />
Thissectionintroducesthebasicconcepts<strong>for</strong>theMC-basedmodels.Wefollowthe 3.1 notationsofSegala&Lynch[SeLy94,Sega95a]andusetheadjective\fullyprobabilistic". Fullyprobabilisticsystems<br />
Denition3.1.1[Fullyprobabilitisticsystems]AfullyprobabilisticsystemisatupleS=(S;P)whereSisasetofstatesandP:S transitionprobabilityfunction)suchthat,<strong>for</strong>alls2S,P(s;t)>0<strong>for</strong>atmostcountably manyt2SandPt2SP(s;t)2f0;1g. S![0;1]isafunction(calledthe<br />
thesenderinthesimplecommunicationprotocolofExample1.2.1(page19)canbe Example3.1.2[Simplecommunicationprotocol:thesender]Thebehaviourof<br />
andP()=0inallothercases. P(sinit;sdel)=P(slost;sdel)=P(swait;sinit)=1,P(sdel;sinit)=0:01,P(sdel;swait)=0:99 <strong>for</strong>malizedbythefullyprobabilisticsystem(S;P)whereS=fsinit;sdel;slost;swaitgand<br />
LetS=(S;P)beafullyprobabilisticsystem.SissaidtobeniteiSisnite.For thenweputP(s;C)=Pt2CP(s;t).AstatesofSiscalledterminaliP(s;S)=0. AnexecutionfragmentornitepathinSisanonemptynite\sequence"=s0!s1! nitesystems,wealsorefertoPasthetransitionprobabilitymatrix.IfC Sands2S<br />
:::!skwherek jjdenotesthelengthof,i.e.weputjj=k. rst()denotestherststateof,i.e.rst()=s0. 0,s0;s1;:::;sk2SandP(si;si+1)>0,i=0;1;:::;k�1.<br />
last()denotesthelaststateof,i.e.last()=sk.<br />
Ifi>k=jjthenweput(i)=. (i)denotesthei-thprexof,i.e.(i)=s0!s1!:::!si,i=0;1;:::;k. (i)denotesthe(i+1)-ststateof,i.e.(i)=si,i=0;1;:::;k,<br />
Ifk=jj=0thenweputP()=1.Fork P()=P(s0;s1)P(s1;s2):::P(sk�1;sk): 1,wedene<br />
Astatetiscalledreachablefromsifthereexistsanitepath iscalledmaximalilast()isterminal.<br />
Example3.1.3ThesysteminExample1.2.1(page19)hasnonitemaximalexecution last()=t. withrst()=sand<br />
executionfragment(nitepath)withjj=4,rst()=sinit,last()=swait,(2)=slost, fragmentastherearenoterminalstates. (2)=sinit!sdel!slostandP()=10:0110:99=0:0099.<br />
=sinit!sdel!slost!sdel!swaitisan
Anexecutionorfulpathiseitheramaximalexecutionfragmentoraninnite\sequence" 3.1.FULLYPROBABILISTICSYSTEMS 35<br />
tobeaninniteexecution,(i),(i)andrst()aredenedas<strong>for</strong>executionfragments. Forinniteexecutionsweputjj=1anddene =s0!s1!s2!:::wheres0;s1;:::2SandP(si�1;si)>0,i=1;2;:::.For<br />
Ifisanitepaththenweputinf()=;.Apathdenotesanitepathorafulpath. PathSfuldenotesthesetoffulpathsinS, inf()=fs2S:(i)=s<strong>for</strong>innitelymanyindicesi 0g:<br />
PathSnthesetofnitepathsinS, PathSn(s)thesetofnitepathsstartingins, PathSful(s)thesetoffulpathsstartingins,<br />
IftheunderlyingfullyprobabilisticsystemSisclearfromthecontextweabbreviate PathSfultoPathful,PathSful(s)toPathful(s),PathSntoPathn,PathSn(s)toPathn(s)and ReachS(s)denotesthesetofstateswhicharereachablefroms.<br />
ReachS(s)toReach(s).<br />
prexdenotestheprexrelationonpaths,i.e.if1,2are(niteorinnite)pathsthen If isasetofnitepathsthen(s)= isasetoffulpathsinSands2Sthen(s)= \Pathn(s). \Pathful(s).<br />
1prex2i 1isaprexof2(i 1=2or1=(k)<br />
Iflast()=rst()(i.e.sk=t0)thenwedene properprexrelationonpaths,i.e.
Proof: 36 easyverication.Usesthefactthat",2,arepairwisedisjoint. CHAPTER3.MODELLINGPROBABILISTICBEHAVIOUR<br />
Wenowturnourattentionhowtocomputetheprobabilitiestoreachastateofacertain setS2viaapathleadingthroughstatesofacertainsetS1only.Moreprecisely,we considerafullyprobabilisticsystem(S;P)andtwosubsetsS1,S2ofS.Let bethesetofallnitepathssuchthat (i)2S1nS2,i=0;1;:::;jj�1, Pathn<br />
andlet last()2S2.<br />
Foralls2S, Lemma3.1.5Let(S;P)beafullyprobabilisticsystemandletS1,S2, = ".Then,ouraimistocomputetheprobabilitiesProb((s)). X2(s)P()=Prob((s)): and asabove.<br />
Proof: acertainmonotonicoperatoronthefunctionspaceS7![0;1]. ThefollowingresultcharacterizestheprobabilitiesProb((s))astheleastxedpointof followsimmediatelyfromLemma3.1.4(page35).<br />
Theorem3.1.6Let(S;P)beafullyprobabilisticsystemandletS1,S2, above.Then, p:S![0;1],p(s)=Prob((s)), and as<br />
F(f)(s)=1ifs2S2,F(f)(s)=0ifs2Sn(S1[S2)and,ifs2S1nS2, istheleastxedpointoftheoperatorF:(S![0;1])!(S![0;1])whichisgivenby<br />
Proof: seeSection3.7,Corollary3.7.2(page65). F(f)(s)=Xt2SP(s;t)f(t):<br />
=Pathful(s)gandS?=Sn(SNO[SYES).Then,pistheuniquexedpointofthe Proposition3.1.7(cf.[CoYa88,HaJo94,CoYa95])Let(S;P)beanitefullyprob-<br />
operatorF0:(S![0;1])!(S![0;1])whichisgivenby SNO=fs2S: abilisticsystemandletS1,S2, (s)=;g,SYESasubsetofSwithS2 , andpbeasinTheorem3.1.6.Moreover,let SYES fs2S: (s)"<br />
Here,FisasinTheorem3.1.6(page36). F0(f)(s)=8>:F(f)(s):ifs2S? 0 1 :ifs2SNO. :ifs2SYES<br />
HaJo94,CoYa95]andcanbeshowninasimilarway. Proof: Remark3.1.8[Computingtheprobabilitiesp(s)]IfSisnitethenTheorem3.1.6 Theclaimisaslightgeneralizationoftheresultsestablishedin[CoYa88,<br />
(page36)yieldsthattheprobabilitiesp(s)=Prob((s)")canbeobtainedbyiteration:
Wetakepn(s)=1ifs2S2andpn(s)=0ifs2Sn(S1[S2),n=0;1;2;:::.For 3.1.FULLYPROBABILISTICSYSTEMS 37<br />
s2S1nS2,wedenep0(s)=0and,<strong>for</strong>n=0;1;2;:::,<br />
Then,limpn(s)=p(s)<strong>for</strong>alls2S.Thisiterativemethodcanbere<strong>for</strong>mulatedasfollows. Letpnbethevector(pn(s))s2SandletQbethematrix(qs;t)s;t2Swhere pn+1(s)=Xt2SP(s;t)pn(t):<br />
Then,pn=Qpn�1=Q2pn�2=:::=Qnp0:Inparticular,thevectorp=(p(s))s2S qs;t=8>:P(s;t):ifs2S1nS2 0 1 :otherwise. :ifs=t2S2<br />
isgivenby p=lim<br />
<strong>for</strong>computingthefunctionp()isbasedonProposition3.1.7(page36).First,onecom- Q2i+1=Q2iQ2i,i=0;1;2;:::).Anotherpossibility(usedin[CoYa88,HaJo94,CoYa95]) wherethematricesQ2iareobtainedbyiterativesquaring(i.e.bysuccessivelycomputing i!1Q2ip0<br />
bs=P(s;SYES),x=(xs)s2S?,A=(P(s;t))s;t2S?andIthejS?jjS?j-identitymatrix. equationsystemx=Ax+b(orequivalently,(I�A)x=b)whereb=(bs)s2S?with putesthesetsSNOandSYESbyagraphanalysis.Second,onesolvestheregularlinear<br />
computetheprobabilitiesthatthemessageiseventuallydeliveredcorrectlybytaking S1=S,S2=fswaitg=SYES,SNO=;andsolvingthelinearequationsystem Example3.1.9ForthesimplecommunicationprotocolofExample1.2.1(page19)we<br />
whichyieldsxinit=xlost=xdel=1. Inthefollowinglemma,wegiveagraph-theoreticalcriteria<strong>for</strong>Prob((s))=1where xinit=1xdel;xlost=1xdel;xdel=1 100xlost+99 100<br />
weassumethatS1=SandS2=U.Inthatcase,Prob((s))istheprobability<strong>for</strong>the \progressproperty"statingthat,fromstates,thesystemwilleventuallyreachaU-state. Lemma3.1.10Let(S;P)beanitefullyprobabilisticsystemandU flast():2Pathn(s);=2 beasinTheorem3.1.6(page36)whereS1=SandS2=U.Lets2SandT= "ng.Then,wehave: S.Let and<br />
Proof: Lemma3.1.10yieldsthatwhetherornotaqualitativeprogresspropertyofthetype\with seeSection9.5,Corollary9.5.5(page242). (t)6=;<strong>for</strong>allstatest2Ti Prob((s))=1.<br />
probability1,thesystemwilleventuallyreachaU-state"holdsdoesnotdependonthe exactprobabilitiesbutonlythetopologyoftheunderlyingdirectedgraph.3 Example3.1.11InExample3.1.9(page37),wecomputedtheprobabilitiesx=1<strong>for</strong><br />
Sharir&Pnueli[HSP83](seeChapter9,page227).<br />
thestatesofthecommunicationprotocolofExample1.2.1(page19)toreachthestate swaitbysolvingalinearequationsystem.Alternatively,wecouldapplyLemma3.1.10. 3Thisresultisnotsurprisingsinceasimilarresult<strong>for</strong>concurrentsystemswasestablishedbyHart,
Denition3.1.12[Boundedness,cf.[LeSh82,HaSh84,LaSk89]]Afullyprobabilis- 38 CHAPTER3.MODELLINGPROBABILISTICBEHAVIOUR<br />
that,<strong>for</strong>alls,t2S,ifP(s;t)>0thenP(s;t) ticsystem(S;P)iscalledboundedithereexistsarealnumbercwith0
3.2.CONCURRENTPROBABILISTICSYSTEMS s 39<br />
s1 k s2 k ::: skk<br />
k + p1p2QQQQQs s? pk t s k<br />
k1? or t sk k ?<br />
choice.ThepictureontheleftofFigure3.1stands<strong>for</strong>asteps�!whereSupp()= Figure3.1:Pictures<strong>for</strong>thetransitions�!<br />
Example3.2.2Thepictureontherightshowsa asshowninthepicturesontheright. simpleexample<strong>for</strong>aconcurrentprobabilisticsys- fs1;:::;skgand(si)=pi>0,i=1;:::;k.Transitionsofthe<strong>for</strong>ms�!1taredepict<br />
temwherenon-deterministicchoiceispresentonly instates.Thestatestanduare\deterministic" '-s<br />
states(asSteps()consistsofasingledistribution inthesensethattanduhaveuniquesuccessor ofthe<strong>for</strong>m1x<strong>for</strong>somestatex).Thestatevis terminal(asSteps(v)=;). tl12 l<br />
��t@@R ���12� ul@@@Rvl Furtherexamples<strong>for</strong>concurrentprobabilisticsystemsaregivenintheintroduction:the simplecommunicationprotocolSenderkReceiverofExample1.2.2(page20)andthe rouletteplayerofExample1.2.3(page22).5 ingmodel[HaJo89,Hans91]orconcurrentMarkovchains[Vard85,CoYa88])capturetheSomeMDP-basedmodels(suchasstratiedtransitionsystems[vGSST90],thealternatbranchingstructureofthepurelyprobabilisticchoicesanddistinguishbetweenprobabilisticandnon-probabilisticstates.Thebehaviourinaprobabilisticstateis\purely probabilistic"whichisdescribedbyadistributiononthestatespacewhilethebehaviour<br />
thenotationsof[vGSST90]andusetheadjective\stratied"<strong>for</strong>thesemodels.6 ineachotherstatesis\purelynon-probabilistic"inthesensethatnoneofthepossible stepsinsisrandomized,i.e.Steps(s)consistsofdistributions1t,t2S.Formally,these<br />
Denition3.2.3[Stratiedsystem]Astratiedsystemisaconcurrentprobabilistic modelscanbedenedasspecialinstancesofconcurrentprobabilisticsystems.Wefollow<br />
system(S;Steps)suchthat<strong>for</strong>alls2S: Let(S;Steps)beastratiedsystem.AstatesiscalledprobabilisticiSteps(s)=fg <strong>for</strong>somedistribution Steps(s) =2f1t:t2Sg.Otherwise,siscallednon-probabilistic.Note f1t:t2SgorjSteps(s)j=1.<br />
thatthesystembehaviourinanon-probabilisticstatesmightbenon-deterministic(if<br />
successorstate. bedescribedbysingletonsetsconsistingofadistributionthatreturnstheprobability1<strong>for</strong>theunique andsackbehavedeterministically.Formally,the\non-deterministic"alternativesinthesestatescan 6SeeSection3.6(page62)<strong>for</strong>theexactrelationbetweenournotionofastratiedsystemandthe<br />
5NotethatinthesimplecommunicationprotocolofExample1.2.2(page20),thestatessinit,sdel<br />
originalnotionbyvanGlabbeeketal[vGSST90].
jSteps(s)j 40 2)ordeterministic(ifjSteps(s)j=1,inwhichcaseSteps(s)=f1tg<strong>for</strong>some CHAPTER3.MODELLINGPROBABILISTICBEHAVIOUR<br />
statet)orsmightbeterminal(ifSteps(s)=;). Notation3.2.4[Stratiedtransitionprobabilities]Let(S;Steps)beastratiedsystem.Then,thetransitionprobabilityfunctionP:S P(s;t)=8>:(t):ifsisprobabilisticandSteps(s)=fg 1 :ifsisnon-probabilisticands�!t S![0;1]isgivenby<br />
Nevertheless,thestratiedviewisaspowerfulastheconceptofconcurrentprobabilistic Wedenedstratiedsystemsasspecialinstancesofconcurrentprobabilisticsystems. 0 :otherwise.<br />
correspondingtothechosendistribution).Ifwedevidethesetwochoicesintotwo \steps"thenthebehaviourofaconcurrentprobabilisticsystemcanbedescribedbya (thechoice<strong>for</strong>some systemswhereeachstatechangeinvolvestheresolutionofanon-deterministicchoice<br />
stratiedsystem.Intuitively,inthestratiedview,thesmallcircleinthepictureofa 2Steps())andaprobabilisticchoice(therandomizedchoice<br />
Steps0(s)=f1(s;):2Steps(s)gandSteps0(s;)=fg.Ofcourse,theresultingsystem transitions�! withthestratiedsystemS0=(S0;Steps0)whereS0=S[f(s;):s2S;2Steps(s)g, Formally,ifS=(S;Steps)isaconcurrentprobabilisticsystemthenScanbeidentied isviewedasastatewherethesystemper<strong>for</strong>msarandomizedstep.<br />
S0canbesimpliedbyremovingstatesofthe<strong>for</strong>m(s;1t).7<br />
theprobabilisticchoicethatisresolvedwhenin temshownontheright.Thestatewrepresents(page39)canbemodelledbythestratiedsys- Example3.2.5ThesystemofExample3.2.2 '<br />
statesthetransitionisselected;i.e.wstands <strong>for</strong>theauxiliarystate(s;).Thestates(t;1s), (u;1u),(s;1v)and(v;1v)areomitted. t w sm<br />
m��12 �m@@@R<br />
���- 12�<br />
@@@R um vm<br />
Executionsequences(orpaths)arisebyresolvingboththenon-deterministicandprobabilisticchoices.Formally,anexecutionfragmentornitepathinaconcurrentprobabilistic 3.2.1 Pathsinconcurrentprobabilisticsystems<br />
isterminal.Anexecutionorfulpathiseitheramaximalexecutionfragmentoraninnite k\sequence" systemS=(S;Steps)isanonemptynite\sequence" 0andsi2S,i2Steps(si�1),i(si)>0,i=1;2;:::;k.8 =s01 !s12 !s23 !:::wheres0;s1;s2;:::2Sandi2Steps(si�1), =s01 !s12 iscalledmaximalisk !s2:::k !skwhere<br />
page34):If (thei-thprexof),jj(thelengthof),rst()(therststateof)andinf()(the setofstatesthatoccurinnitelyoftenin)aredenedasinthefullyprobabilisticcase. i(si)>0,i=1;2;:::.Weusesimilarnotationsasinthefullyprobabilisticcase(see<br />
7Distributionsofthe<strong>for</strong>m1tdonotreallyrepresentrandomizedstepsastheyyieldauniquenext<br />
isa(niteorinnite)pathinSthen(i)(the(i+1)-ststateof),(i)<br />
state. denotethatisapossiblestepofswhichleads(withnon-zeroprobability)tothestatet.<br />
8Notethatwewrites!todenotethatisapossiblestepins(i.e.2Steps(s))ands!tto
Similarly,<strong>for</strong> 3.2.CONCURRENTPROBABILISTICSYSTEMS tobeanitepath,last()denotesthelaststateof, "thesetofall 41<br />
properprexrelation
Denition3.2.7[Adversary,simpleadversary]LetS=(S;Steps)beaconcurrent 42 CHAPTER3.MODELLINGPROBABILISTICBEHAVIOUR<br />
A()2Steps(last())<strong>for</strong>all everystates2Sthereexistss2Steps(s)withA()= wherelast()=s. probabilisticsystem.AnadversaryofSisafunctionA:Pathn!Distr(S)suchthat 2Pathn.AnadversaryAofSiscalledsimplei<strong>for</strong><br />
AdvSdenotesthesetofalladversariesofSandAdvSsimplethesetofsimpleadversaries. last()<strong>for</strong>all 2Pathn<br />
WhenclearfromthecontextwewriteAdvandAdvsimpleratherthanAdvSandAdvSsimple. Simpleadversariesresolvethenon-determinismbyselecting<strong>for</strong>everystateanextstep whichisexecutedwheneverthestatesisreached{independentofthepasthistory.11 Anadversarychooses<strong>for</strong>everynitepath inSanoutgoingtransitionfromlast().<br />
Example3.2.8ThesystemofFigure3.2.2(page39)hasexactlytwosimpleadversaries<br />
GivenanadversaryA,the\behaviour"ofSunderAcanbedescribedbyaboundedfully non-deterministicallybecausethereisatmostoneoutgoingtransition. A,B.ThesearegivenbyA(s)=,B(s)=1v.Notethattheotherstatesdonotbehave<br />
Notation3.2.9[ThefullyprobabilisticsystemSA]IfA2Advthen probabilisticsystemSA.<br />
isthefullyprobabilisticsystemwherePAisgivenbyPA(; PA()=0inallothercases. SA=PathSn;PA<br />
Notethat,ingeneral,SAisinniteevenifSisnite.IfAasimpleadversarythenSA �!s)=A()(s)and A()<br />
canbeidentiedwiththefullyprobabilisticsystem(S;A)whereA(s;t)=A(s)(t)<strong>for</strong> alls,t2S.ForStobeniteandA2Advsimple,theassociatedfullyprobabilistic systemSA=(S;A)isnite.ForanadversaryAofaconcurrentprobabilisticsystem S=(S;Steps)and PathAfuldenotesthesetofallpaths2Pathfulwithstep(;i)=A((i))<strong>for</strong>alli PathAnisthesetofallnitepaths2Pathnwithstep(;i)=A((i))<strong>for</strong>alli
Weidentifyeach(niteorinnite)path=0!1!:::inSAwhichstartsinastate 3.2.CONCURRENTPROBABILISTICSYSTEMS 43<br />
s02S(i.e.0=s0isapathoflength0)withthepathlast(0)A(0) inS.Viceversa,if (1)!(2)!:::inSA.Thisyieldsaone-to-onecorrespondencebetweenthepaths 2PathAn(s)[PathAful(s)andthepathsinSAthatstartins.Hence,theprobability 2PathAful[PathAnthenweidentify withthepath(0)! �!last(1)A(1) �!:::<br />
measureProbonPathSA probabilityspace.Ifful(s)(denedasinSection3.1onpage35)turnsPathAful(s)intoa Example3.2.10ForthesystemofExample3.2.2(page39)andthenitepath themeasureof withrespecttoA. Pathful(s)andAismeasurablethenwerefertoProb(A)as<br />
Example3.2.6(page41),wehave2PathAn(s)<strong>for</strong>eachadversaryAwith A(s)= andAs!t1s !s=1v. of<br />
Theorem3.2.11Let(S;Steps)beaconcurrentprobabilisticsystem,S1,S2 Moreover,<strong>for</strong>eachsuchadversaryA,theprobabilitymeasureof"Ais1=2.<br />
Fors2SandA2Adv,let bethesetofnitepaths suchthat(i)2S1,i=0;1;:::;jj�1,andlast()2S2. Sandlet<br />
Then,pminandpmaxaretheleastxedpointsoftheoperators pmin(s)=inf A2AdvProb A(s)"A;pmax(s)=sup A2AdvProb A(s)"A:<br />
F(f)(s)=0.Ifs2S1nS2then thataredenedasfollows.Ifs2S2thenF(f)(s)=1.Ifs2Sn(S1[S2)then Fmin,Fmax:(S![0;1])!(S![0;1])<br />
Fmax(f)(s)=max(Xt2S(t)f(t): Fmin(f)(s)=min(Xt2S(t)f(t): 2Steps(s));<br />
Proof: seeSection3.7,Corollary3.7.4(page67). 2Steps(s)):<br />
wedenep0(s)=0and,<strong>for</strong>n=0;1;2;:::, yieldsthatthevaluesp(s)canbeapproximatedwiththefollowingiterativemethod.We putpn(s)=1ifs2S2andpn(s)=0ifs2Sn(S1[S2),n=0;1;2;:::.Fors2S1nS2, Remark3.2.12[Computingtheprobabilitiespmin(s)andpmax(s)]Theorem3.2.11<br />
pmax pmin n+1(s)=max(Xt2S(t)pmin n+1(s)=min(Xt2S(t)pmin n(t):2Steps(s));<br />
benite,thevaluesp(s)canalsobecomputedbysolvinglinearoptimizationproblems<br />
Then,limpn(s)=p(s)<strong>for</strong>alls2S.Asproposedby[CoYa90,BidAl95],<strong>for</strong>Sto n(t):2Steps(s)):
whichcanbesolvedinpolynomialtimewithwell-knownmethodsoflinearprogramming 44 CHAPTER3.MODELLINGPROBABILISTICBEHAVIOUR<br />
[Derm70,Bert87,Schr87].<br />
solutionofthelinearminimizationproblem0 S?=Sn(SNO[S2).Wedeneys=1ifs2S2andys=0ifs2SNO.Foreach states2S?,wechooseavariableys.Then,thevector(pmax(s))s2S?istheunique Computationofpmax(s):LetSn(S1[S2) ysSNO 1andfs2S:<br />
(s)=;gand<br />
wherePs2S?ysisminimal. ys Xt2S(t)yt; 2Steps(s)<br />
solutionofthelinearmaximizationproblem0 Computationofpmin(s):LetSNO=fs2S:(s)=;gandS?=Sn(SNO[S2).We deneys=1ifs2S2andys=0ifs2SNO.Then,thevector(pmin(s))s2S?istheunique ys Xt2S(t)yt; ys2Steps(s) 1and<br />
directedgraph.Notethat<strong>for</strong>thecomputationofthevaluespmin(s)itisessentialthatwe Thesetfs2S:(s)=;gcanbeobtainedbyareachabilityanalysisintheunderlying wherePs2S?ysismaximal.<br />
dealwithSNO=fs2S:(s)=;g(ratherthane.g.SNO=Sn(S1[S2)asitispossible andS1=fsg,S2=;wehave problem0 <strong>for</strong>computingpmax()).Forinstance,<strong>for</strong>thesystem(fsg;Steps)whereSteps(s)=f1sg ys 1and ys Xt2S(t)yt; =;(andhencepmin(s)=0)whiletheoptimization<br />
Pt1s(t)yt=ys). wherePtytismaximalyieldsys=1(becausewejustdealwiththeinequationys 2Steps(s)<br />
therouletteplayerleavesthecasinowinningthelastgame)canbecomputedbytaking player.Themaximal/minimalprobabilitiestoreachthestateshappy(i.e.thestatewhere page22(seeFigure1.3,page22)thatdescribestheone-day-behaviouroftheroulette Example3.2.13WeconsidertheconcurrentprobabilisticsystemofExample1.2.3on<br />
functionS![0;1]thatsatisesp(shappy)=1,p(ssad)=0and S1=;andS2=fshappyg.ByTheorem3.2.11(page43),p:S![0;1]istheleast p(sinit)=p(splay)=p(slost)=12p(swon)+12p(slost);<br />
Notethattheminimalprobabilitiespmin(s)=0areobtainedbythesimpleadversaryA Thus,pmin(s)=0<strong>for</strong>alls2Snfshappygandpmax(s)=1=2<strong>for</strong>alls2Snfshappy;ssadg. pmin(swon)=minnpmin(splay);12o;pmax(swon)=maxnpmax(splay);12o:<br />
<strong>for</strong>cestherouletteplayertostay<strong>for</strong>everinthecasino).ForanyotheradversaryA,the probability<strong>for</strong>sinittoreachshappyisthemaximalprobabilitypmax(sinit)=1=2.<br />
thatalwayschoosesthetransitionswon�!splay(i.e.thepathologicaladversarywhich
3.2.3 3.2.CONCURRENTPROBABILISTICSYSTEMS Fairnessofnon-deterministicchoice 45<br />
Inthevericationofnon-probabilisticconcurrentsystems,itiswell-knownthatcertain livenesspropertiescanonlybeestablishedwhenappropriatefairnessassumptionsabout currentprobabilisticprocessesastheyalsoallow<strong>for</strong>non-deterministicchoice.Thus,asin thenon-probabilisticcase,certain(qualitativeorquantitative)livenesspropertiescannot theresolutionofthenon-deterministicchoicesaremade.Clearly,thisalsoholds<strong>for</strong>con- beestablishedunlessfairnessofnon-deterministicchoiceisimposed.Forinstance,<strong>for</strong> therouletteplayerofExample1.2.3onpage22(seeFigure1.3,page22)thequantitative livenesspropertystatingthatthereisa50%chance<strong>for</strong>therouletteplayertoleavethe establishedwhenfairnessinthestateswonisassumed(seeExample3.2.13,page44). Fairnessofnon-deterministicchoice(i.e.fairnessofadversaries)ofconcurrentprobabilis- casinowhilewinningthelastgame(i.e.eventuallytoreachthestateshappy)canonlybe<br />
byVardi[Vard85]andseveralotherauthors.Fairnessofnon-deterministicchoicerequires that{insomesense{theenvironment(theadversary)resolvesthenon-deterministic choicesinafairmanner.[HSP83]denestwotypesoffairness<strong>for</strong>adversaries:anadticsystemswasrstintroducedbyHart,Sharir&Pnueli[HSP83]andlaterconsideredversaryisstrictlyfairieachofitsfulpathsisfair,anditisfairifalmostallexecution sequencesarefair(i.e.ifthemeasureofitsfairfulpathsis1)wherefairnessofafulpathcan systemswhicharisebytheinterleavingofsequentialprobabilisticprocessesanddenesa bedenedasinthenon-probabilisticcase.[HSP83]dealswithconcurrentprobabilistic<br />
probabilisticstates{anddenesafulpathtobefairifallpossiblesuccessorstatesofa fulpathtobefairieachsequentialprocessisactivatedinnitelyoftenin(i.e.[HSP83] dealswith\processfairness").[Vard85]dealswith\concurrentMarkovchains"(stratied systems,seeDenition3.2.3,page39){whichdistinguishbetweennon-deterministicand non-deterministicstate,inwhichfairnessisrequiredandwhichoccurinnitelyoftenin<br />
versaries.WeadaptVardi'snotionoffairnesstoourmodel<strong>for</strong>concurrentprobabilisticInthissection,wefollowtheapproachsof[HSP83,Vard85]anddenefairnessofad- ,alsooccurinnitelyoften.<br />
processes{whichdoesnotdistinguishbetweennon-deterministicandprobabilisticstates {anddeneanexecutionsequence tivesinastateoccurringinnitelyofteninisrefusedcontinuously.Moreover,wedene W-fairness<strong>for</strong>asetWofstatesinwhichfairnessisrequired.12 tobefairifnoneofthenon-deterministicalternaDenition3.2.14[Fairness<strong>for</strong>fulpaths]LetS=(S;Steps)beaconcurrentproba-<br />
step(;i)=. bilisticsystemand s2inf()andeachafulpathinS. 2Steps(s),thereareinnitelymanyindicesiwith(i)=sand iscalledfairieither isniteor,<strong>for</strong>each<br />
Remark3.2.15[Processfairnessala[HSP83]]Ournotionoffairnessofafulpathis strongerthanfairnessoffulpathsin[HSP83].In[HSP83]\processfairness"isconsidered, inthesensethatallsequentialprocesses(whosecompositionistheconcurrentprobabilistic systemunderconsideration)areactivatedinnitelymanytimesinfairfulpaths.IfS<br />
relationtoournotionispresentedin[dAlf97a].<br />
isaconcurrentprobabilisticsystemwhicharisesthroughtheinterleavingofsequential 12Analternativenotionoffairness<strong>for</strong>concurrentprobabilisticsystemsandadiscussionaboutthe
processeswithoutsharedvariablesthenfairnessinthesenseofDenition3.2.14(page45) 46 CHAPTER3.MODELLINGPROBABILISTICBEHAVIOUR<br />
Steps(s1;:::;sk)=fi(s1;:::;sk):i=1;:::;kgwhere impliesfairnessinthesenseof[HSP83];toseethissupposethatthereareksequential Si=(Si;Pi),i=1;:::;k,andthatS=(S;Steps)whereS=S1 probabilisticprocessesP1;:::;PkwhereeachofthemisdescribedbyaMarkovchain<br />
i(s1;:::;sk)(t1;:::;tk)=(Pi(si;ti):iftj=sj,j=1;:::;k,i6=j ::: Skand<br />
Then,wheneverisafulpathinSthatisfairinthesenseofDenition3.2.14(page45) then isfairinthesenseof[HSP83],whichrequiresthat<strong>for</strong>eachi2f1;:::;kgthere 0 :otherwise.<br />
areinnitelymanyindicesj thesetoffairfulpathsinS. Notation3.2.16[ThesetFairofallfairfulpaths]FairS(orshortlyFair)denotes 0withstep(;j)=i(j).<br />
Asin[HSP83]weconsidertwokindsoffairness<strong>for</strong>adversaries:strictlyfairadversaries,<br />
Denition3.2.17[(Strict)fairnessofadversaries,cf.[HSP83,Vard85]]LetSbe 1,i.e.wherealmostallfulpathsarefair. whereallfulpathsarefair,andfairadversaries,wherethesetoffairpathshasprobability<br />
aconcurrentprobabilisticsystemandFanadversary<strong>for</strong>S.Fiscalled<br />
AdvSsfairdenotesthesetofstrictlyfairadversaries,AdvSfairthesetoffairadversaries. fairiProb(FairF(s))=1<strong>for</strong>allstatessinS. strictlyfairiPathFful Fair,<br />
thereexists Alpern&Schneider[AlSch84]whichstatesthateverynitecomputationcanbeextended toaninnite(fair)computation. Clearly,strictlyfairadversariesarefair.IfFisafairadversarythen<strong>for</strong>each2PathFn 2FairFwhere isaprexof.Thisreects\liveness"inthesenseof<br />
Example3.2.18ForthesystemofExample3.2.2(page39),thefulpath<br />
isnotfairsinces2inf(0)and1v2Steps(s)nfstep(0;i):i 2Pathful(s)isfair(asit\ends"invoru).Thus, 0=s!t1s !s!t1s !s!:::<br />
Fair(s)=Pathful(s)nf0g: 0g.Everyotherfulpath<br />
ThesimpleadversaryBwithB(s)=1visstrictlyfairsince0=2PathBful.Thesimple Then,A(x)=FairA(x)<strong>for</strong>allstatesxandProb(FairA(u))=Prob(FairA(v))=1, adversaryAwithA(s)=isnotstrictlyfairsince02PathAful(s).Nevertheless,Aisfair. Toseethis,considertheset ProbFairA(s) ofallfulpaths2Pathfulwhere(i)2fu;vg<strong>for</strong>somei.<br />
andProbFairA(t)=Probt1s !:2FairA(s)=1.Hence,Aisfair.<br />
=1Xi=012 12i=1
FollowingVardi[Vard85],theabovedenitionoffairfulpathsorfairadversariescan 3.3.LABELLEDPROBABILISTICSYSTEMS 47<br />
beweakenedbyrequiringfairnesswithrespecttothenon-deterministicchoicesonlyin certainstatesratherthaninallstates. Denition3.2.19[W-Fairnessoffulpaths]LetS=(S;Steps)beaconcurrentprob- andall2Steps(s),thereareinnitelymanyindicesj FairnesswithrespecttoW=S(inthesenseofDenition3.2.19)isweakerthanfairness abilisticsystemandW S.Afulpath inSiscalledW-fairi,<strong>for</strong>alls2inf()\W<br />
ofafulpathinthesenseofDenition3.2.14(page45).13Vardi'snotionoffairnessof 0withstep(;j)=.<br />
Denition3.2.20[W-Fairnessofadversaries,cf.[Vard85]]LetSandWbeas be<strong>for</strong>e.AnadversaryFiscalledW-fairi,<strong>for</strong>alls2S,themeasureofthesetoffulpaths adversariesadaptedtoourmodel<strong>for</strong>concurrentprobabilisticsystemsisthefollowing.<br />
Whenclearfromthecontext,wewriteAdvsfair,AdvfairorAdvWfairratherthanAdvSsfair, AdvSfairorAdvSWfair.Clearly,Advsfair 2PathFful(s)whichareW-fairis1.AdvSWfairdenotesthesetofW-fairadversaries. Advfair AdvWfair:<br />
thestatesand/orthetransitions.Intheliteraturetwokindsoflabellingshavebeenes- Formalreasoningaboutthebehaviourofprogramsrequiresadditionalin<strong>for</strong>mationsabout 3.3 Labelledprobabilisticsystems<br />
labels<strong>for</strong>thestates,theotherusesactionlabels<strong>for</strong>thetransitions.Modelsbasedon tablished:oneusesatomicpropositions(or,moregeneral,rstorderlogical<strong>for</strong>mulas)as the<strong>for</strong>mertypeoflabellingsareoftencalledKripkestructuresandusedinthecontextof<br />
proposition-labelledandaction-labelledsystems,seee.g.[JHP89,dNVa90].Eventhough oftencalledlabelledtransitionsystemsandusedinthecontextofprocessalgebrasand implementationrelations.Severalauthorsproposedtrans<strong>for</strong>mationtechniquesbetween temporallogicspecicationswhilethemodelsbasedonthelattertypeoflabellingsare<br />
theyareoriginally<strong>for</strong>mulated<strong>for</strong>non-probabilisticsystemstheycanalsobeappliedin theprobabilisticcase.Wefollowthesestandardapproachsanduseactionlabels<strong>for</strong>the transitionsinChapters4,5,6and7whereweworkwithprocesscalculiandimplementationrelationsandpropositionlabels<strong>for</strong>thestatesinChapter9wherewedealwith 3.3.1 temporallogicspecications.<br />
Intheaction-labelledapproachoneusuallydealswithasetActofabstractactionsymbols. Eachactionsymbolarepresentsanactivityoftheprogramthatisviewedtobe\atomic" Action-labelledprobabilisticsystems<br />
Typicalexamplesarecommunicationactionslikesendingorreceivingamessagealonga inthesensethatitcannotbeinterleavedbyactionsofprogramswhichruninparallel. certainchannel. 13NotethatinDenition3.2.19wedonotrequirethatstep(;j)=and(j)=s.
48 CHAPTER3.MODELLINGPROBABILISTICBEHAVIOUR<br />
sinit<br />
ack?,1 sdel send!,1<br />
swait ,0:99,0:01 slost ,1<br />
'-<br />
���?<br />
� JJJHHY JHHj<br />
JJJJ<br />
In(non-probabilistic)labelledtransitionsystems,thepossiblestepsinthestatesarede- Figure3.2:Thesenderwithactionlabels<br />
scribedbyatransitionrelation�! setofactions),i.e.thestatechangesareassociatedwithactionlabels.Intuitively,sa SActS(whereActstands<strong>for</strong>theunderlying<br />
alternativesinstates.Thiscanbeadapted<strong>for</strong>probabilisticsystemsasfollows:In assertsthat,instates,itispossibletoper<strong>for</strong>mtheactionaandtoreachstatetafterwards.Hence,<strong>for</strong>xedstates,thesetf(a;t):sa �!tgrepresentsthenon-deterministic �!t<br />
theconcurrentcase,thetransitionsareassociatedwithactionlabels(i.e.onedealswith Steps(s)tobeasetofpairs(a;)whereaisanactionlabeland statespace.)Inthefullyprobabilisticcase,theargumentsofthetransitionprobability functionPareextendedbyanaction(i.e.onedealswiththeprobabilitiesP(s;a;t)<strong>for</strong> statestoper<strong>for</strong>mtheactionaandtoreachtafterwards). adistributiononthe<br />
Chapters4and5,weassumethatActcontainsaspecialsymbol.Intuitively,stands<strong>for</strong> ForL by".L+denotesthesetofnitenonemptysequencesoverAct,i.e.L+=Lnf"g.In TheactionsetAct:Throughoutallsections,Actstands<strong>for</strong>anonemptysetofactions.<br />
any\internal"activityofthesystemwhichisinvisible<strong>for</strong>anobserver(ortheenvironment Act,LdenotesthesetofnitesequencesoverL.Theemptysequenceisdenoted<br />
ofthesystem).Werefertoastheinternalaction.Theotheractionsarecalledvisible. Weusegreekletters;;:::todenotevisibleactionsandarabiclettersa;b;:::torange overallactions. Denition3.3.1[Action-labelledfullyprobabilisticsystems]Anaction-labelled fullyprobabilisticsystemisatuple(S;Act;P)consistingofasetSofstates,anonempty Pa;tP(s;a;t)2f0;1g. that,<strong>for</strong>eachs2S,P(s;a;t)>0<strong>for</strong>atmostcountablymanypairs(a;t)2Act setActofactionsandatransitionprobabilityfunctionP:S Act S![0;1]such<br />
Example3.3.2[Thesenderwithactionlabels]Figure3.2(page48)showsanaction- Sand<br />
labelledextensionofthesimplecommunicationprotocolofExample1.2.1(page19).We usethevisibleactionssend!(anoutputactionbywhichthesenderpassesthemessage tothemedium)andack?(aninputactionwhichstands<strong>for</strong>thereceiptoftheacknowl-<br />
Let(S;Act;P)beanaction-labelledfullyprobabilisticsystem.Fors2S,C edgement).Theotherstepsaresupposedtobeinvisibleandthuslabelledbythespecial actionsymbol. S,a2Act
andL 3.3.LABELLEDPROBABILISTICSYSTEMS Act,wedene 49<br />
Anexecutionfragmentornitepathisanite\sequence" P(s;a;C)=Xt2CP(s;a;t);P(s;a)=P(s;a;S);P(s;L)=Xa2LP(s;a):<br />
case(seepage34).If Maximality,(i),(i),rst(),last(),jj,P(), sksuchthats0;s1;:::;sk2S,a1;:::;ak2ActandP(si�1;ai;si)>0,i=1;:::;k. isasabovethenweputtrace()=a1a2:::ak:Anexecution "aredenedasintheunlabelled =s0a1 !s1a2 !s2a2 !:::ak!<br />
i=1;2;:::.Asbe<strong>for</strong>e,apathdenotesanexecutionfragmentorexecution.For aninnitepath,(i),(i),rst()andjjaredenedintheobviousway. orfulpathin(S;Act;P)iseitheramaximalexecutionfragmentoraninnite\sequence" =s0a1!s1a2 !s2a2 !:::wheres0;s1;:::;2S,a1;a2;:::2ActandP(si�1;ai;si)>0,<br />
Example3.3.3ForthesystemofFigure3.2(page48), tobe<br />
P((4))=10:0110:01=0:0001andtrace((4))=send! isanexecution(fulpath)with(2)=sinitsend! =sinitsend! �!sdel�!slost�!sdel�!slost�!:::<br />
TheprobabilitiesProb(s;;C):Thesigma-eldSigmaField(s)andtheprobability �!sdel�!slost,rst()=sinit,(3)=sdel,<br />
measureProbaredenedasintheunlabelledcase(Section3.1,page35).Fors2S, .<br />
viaanexecutionfragmentthatislabelledbysomestringof.The<strong>for</strong>maldenitionof Prob(s;;C)isasfollows.LetPathn(s;;C)bethesetofnitepaths trace()2 ActandC S,wedeneProb(s;;C)tobetheprobability<strong>for</strong>storeachC<br />
=Pathful(s;;S)andPathful(s;;t)=Pathful(s;;ftg).WedeneProb(s;;C)= Prob(Pathful(s;;C)),Prob(s;;t)=Prob(s;;ftg)andProb(s;)=Prob(s;;S). andlast()2C.LetPathful(s;;C)=S2Pathn(s;;C)",Pathful(s;) 2Pathn(s)<br />
Proposition3.3.4Let(S;Act;P)beanaction-labelledfullyprobabilisticsystemand CtheoperatorF:S F(f)(s;)=1ifs2Cand"2.Ifs=2Cor"=2 S.ThefunctionS2Act![0;1],(s;)7!Prob(s;;C),istheleastxedpointof<br />
F(f)(s;)= 2Act![0;1]!S 2Act![0;1]whichisdenedasfollows.<br />
(a;t)2ActSP(s;a;t)f(t;=a;C) X then<br />
where=a=fx:ax2g.14IfSisniteandSNO=fs2S:Pathful(s;;C)=;g, SYES=Cif"2,SYES=;if"=2 (s;)7!Prob(s;;C)istheuniquexedpointoftheoperatorF0:S S 2Act![0;1]whichisdenedby: andS?=Sn(SNO[SYES)thenthefunction 2Act![0;1]!<br />
whereFisdenedasabove. F0(f)(s;)=8>:F(f)(s;):ifs2S? 0 1 :ifs2SNO :ifs2SYES<br />
14Recallthat"denotestheemptywordinAct.
Proof: 50 easyverication.UsesTheorem3.1.6(page36). CHAPTER3.MODELLINGPROBABILISTICBEHAVIOUR<br />
TheprobabilitiesProb(s;;C)andProb(s; aregularexpression(e.g. instance,Prob(s;;t)denotestheprobabilitytoreachtfromsviainternalactions, Prob(s;a1a2:::ak)stands<strong>for</strong>theprobability<strong>for</strong>stoper<strong>for</strong>mthetracea1a2:::ak.Clearly, , or )withthecorrespondingsetoftraces.For ;C):Inwhatfollows,weidentify<br />
(whichyieldsSNOandS?)andsolvingalinearequationsystem. Prob(s;;C)canbecomputedbyareachabilityanalysisintheunderlyingdirectedgraph <strong>for</strong>niteaction-labelledfullyprobabilisticsystemsandregularexpressionsofthe<strong>for</strong>m , and ,thesecondpartofProposition3.3.4yieldsthattheprobabilities<br />
bysolvingthelinearequationsystem: Example3.3.5ConsiderthesimplecommunicationprotocolofExample3.3.2onpage 48(Figure3.2,page48).TheprobabilityProb(sinit; xinit=1ydel send! ;swait)canbecomputed<br />
(Here,y=Prob(s;;swait).)WegetProb(sinit; ylost=1ydel;ywait=1 ydel=0:01ylost+0:99ywait<br />
Nextweextendconcurrentprobabilisticsystemsbyactionlabels.Forthis,eachtransition inthesystemisassociatedwithanactionlabel.I.e.wedealwithafunctionStepsthat send! ;swait)=xinit=1.<br />
assignstoeachstatesasetofpairs(a;)whereaisanactionandadistributiononthe statespace.Thus,action-labelledconcurrentprobabilisticsystemsareassociatedwitha<br />
belledconcurrentprobabilisticsystemisatuple(S;Act;Steps)whereSisasetofstates, transitionrelation�! Denition3.3.6[Action-labelledconcurrentprobabilisticsystem]Anaction-la- S Act Distr(S).<br />
eachstatesasetSteps(s)ofpairs(a;)2Act LetS=(S;Act;Steps)beanaction-labelledconcurrentprobabilisticsystem.Siscalled ActanonemptysetofactionsandSteps:S!2ActDistr(S)afunctionwhichassignsto<br />
niteiS,ActandSs2SSteps(s)arenite.Wewritesa Distr(S).<br />
theelementsofSteps(s)representthenon-deterministicalternativesinthestates.Given (a;)2Steps(s)andrefertosa thenwealsowritesa �!tratherthansa �!asatransitionorastepofs.If �!1t.Asintheunlabelledcase,<strong>for</strong>eachstates, �!is2S,a2Actand<br />
astates,anadversarychoosessomeoutgoingtransitionsa �!.Then,theactionais isofthe<strong>for</strong>m1t<br />
per<strong>for</strong>medandthenextstateischosenrandomlyaccordingtothedistribution.<br />
inFigure3.3onpage51.Here,weassumeAct=fproduce;consume;trygwhereproduce municationprotocolofExample1.2.2(page20)canbeextendedbyactionlabelsasshown stands<strong>for</strong>theactionbywhichthesendergeneratesamessageandpassesthemessageto Example3.3.7[Thecommunicationprotocolwithactionlabels]Thesimplecom-<br />
themedium,consume<strong>for</strong>theactionbywhichthereceiverreadsandworksupthemessage andacknowledgesthereceiptwhiletryrepresentstheactionsbywhichthemediumtries todeliverthemessage. Pathsandadversariesofaction-labelledconcurrentprobabilisticsystemsaredenedas intheunlabelledcase(seeSections3.2.1and3.2.2)wheretheactionlabelsareadded.
3.3.LABELLEDPROBABILISTICSYSTEMS sinit 51<br />
sdel<br />
sok<br />
sack 0:99<br />
'- ? produce consume<br />
consume @@@@@ 0:01u? try<br />
��produce<br />
��<br />
$<br />
&�� -<br />
Forinstance,apathisofthe<strong>for</strong>ms0a1;1 Figure3.3:Thesimplecommunicationprotocolwithactionlabels<br />
A()=(a;)2Steps(last()). takeanitepath astheirinputandreturnastepofthelaststateof,i.e.apair �!s1a2;2 �!:::,adversariesarefunctionsthat<br />
Non-probabilisticlabelledtransitionsystems(wherethetransitionrelation�!isasubset<br />
theprobabilisticsystem(S;Act;Steps)whereSteps(s)=n(a;1t):sa identifyingeach\non-probabilistictransition"sa sa ofSActS)ariseasspecialcasesofaction-labelledconcurrentprobabilitisticsystemsby �!1t.I.e.thenon-probabilisticlabelledtransitionsystem(S;Act;�!)correspondsto �!twiththe\probabilistictransition"<br />
LetS=(S;Act;Steps)beanaction-labelledconcurrentprobabilisticsystem. �!to.<br />
Notation3.3.8[ThesetsStepsa(s)andact(s)]Fors2Sanda2Act,let<br />
Denition3.3.9[Finitelybranching,image-nitesystems]Siscalled Stepsa(s)=f:sa �!g,act(s)=fa2Act:Stepsa(s)6=;g.<br />
Denition3.3.10[Reactivesystems,cf.[LaSk89,vGSST90]]Siscalledreactive image-nitei,<strong>for</strong>eachs2Sanda2Act,Stepsa(s)isnite. nitelybranchingi,<strong>for</strong>eachs2S,Steps(s)isnite,<br />
i,<strong>for</strong>eachs2Sanda2Act,jStepsa(s)j Theuseofreactivesystemsismotivatedbytheassumptionthatthesystem\reacts"on thestimulioftheenvironmentwhichoersthecommunicationoncertainactions.The 1.<br />
choicebetweenseveral(dierent)actionsisnotunderthecontrolofthesystem(hence, noprobabilisticassumptionsare{orcanbe{madeabouttheresolutionofthechoice betweentheactions)whilethechoicebetweentheseveralbranchesofthesameaction isresolvedrandomlyaccordingtoacertaindistribution.Forfurtherdetailsaboutthe reactiveviewsee[LaSk89,vGSST90]. Inwhatfollows,weoftendescribereactivesystemsastuples(S;Act;P)whereP:S Act S![0;1]returnstheprobabilityP(s;a;t)<strong>for</strong>thetransitionsa �!t(ifitexists).
Notation3.3.11[Reactivetransitionprobabilities]IfSisreactivethentheinduced 52 CHAPTER3.MODELLINGPROBABILISTICBEHAVIOUR<br />
transitionprobabilityfunctionPisgivenbyP(s;a;t)=0ifStepsa(s)=;andP(s;a;t)= Fortheextensionofstratiedsystems(Denition3.2.3,page39)byactionlabelswemake therequirementthatthetransitionoftheprobabilisticstatesarelabelledbyaspecial (t)ifStepsa(s)=fg.<br />
(e.g.\tossingafaircoin"). Denition3.3.12[Actionlabelsinstratiedsystems]Anaction-labelledstratied actionsymbolarandomthatstands<strong>for</strong>anyactivitythatresolvesaprobabilisticchoice<br />
containsthespecialactionarandomand,<strong>for</strong>alls2S: systemisanaction-labelledconcurrentprobabilisticsystem(S;Act;Steps)suchthatAct<br />
Thus,<strong>for</strong>anyprobabilisticstatesofanaction-labelledstratiedsystem,Steps(s)= eitherarandom=2act(s)andSteps(s) orfarandomg=act(s)andjSteps(s)j=1. f(a;1t):t2S;a2Actg<br />
f(arandom;)g<strong>for</strong>somedistribution.<br />
Intheproposition-labelledapproach,astateisviewedasafunctionwhichassignsvalues 3.3.2 totheprogramandcontrolvariables.Inmanyapplications,itsucestoabstractfrom Proposition-labelledprobabilisticsystems<br />
ax=vwhichstatesthatthecurrentvalueofvariablexisvorax
3.4.BISIMULATIONANDSIMULATION fromthedraweruntilamatchingpairisobtainedisapproximately4.Nevertheless, 53<br />
socks).ThiscanbeseenbyanalyzingtheinducedMarkovchain:Givenaxedsequence thereisasmallchancethatthealgorithmfails(i.e.doesnotreturnamatchingpairof<br />
thersttwocomponentsstand<strong>for</strong>thecolorsofthetwosockswehaveinhandwhilethe system.WeusethestatespaceS=fred;blueg fromthedrawerthebehaviourofthealgorithmcanbedescribedbyafullyprobabilistic sock1;sock2;:::;sock2nofsocksthatrepresentstheorderinwhichthesocksareextracted<br />
lastcomponentisthenumberofsocksthatarestillinthedrawer.Theterminalstates arethosestateshc1;c2;kiwhereeitherc1=c2(thestateswherewehaveamatchingpair) fred;bluegf0;1;:::;2n�2gwhere<br />
ork=0(thestateswherethedrawerisempty).Ifc16=c2andk transitionprobabilities P(hc1;c2;ki;hc;c2;k�1i)=P(hc1;c2;ki;hc1;c;k�1i)=12 1thenwehavethe<br />
wherec=color(sock2n�k)isthecolorofsock2n�k.Figure3.4(page53)showsthefully probabilisticsystemthatweobtain<strong>for</strong>n=2andthesequencered;blue;red;blue.For red;blue;2<br />
red;blue;1 12 red;red;1 12<br />
red;blue;0 12 �@@@@R<br />
���<br />
@@@@R<br />
����<br />
blue;blue;0 12<br />
successthatcharacterizesthesuccessfulstates(i.e.thestateswhereamatchingpairis analyzingthecorrectnessofthealgorithmonemightuseasingleatomicproposition Figure3.4:Thefullyprobabilisticsystem<strong>for</strong>n=2andthesequencered;blue;red;blue<br />
found).Hence,wedealwiththelabellingfunctionLwheresuccess2L(hc1;c2;ki)i c1=c2.UsingTheorem3.1.6(page36)orProposition3.1.7(page36),itcanbeshown thattheprobabilitytoreachasuccess-labelledstatefromhc1;c2;ki(wherec16=c2)is obtainthattheprobabilitytogetamatchingpairis1�1=22n�2. 1�1=2k.Byconsideringtheinitialstatesinit=hcolor(sock1);color(sock2);2n�2iwe<br />
naturalnotionof\processequality",i.e.anotionof\behaveslike".Whilebisimulation Bisimulationequivalence[Miln80,Park81]isoneofthestandardconceptstoobtaina 3.4 Bisimulationandsimulation<br />
is\bi-directed"andassertsthateachstepofoneprocesscanbesimulatedbyastepof theotherprocess,simulationis\uni-directed"andstatesthat<strong>for</strong>eachstepoftherst process(the\implementation")thereisacorrespondingoneofthesecondprocess(the<br />
Larsen&Skou[LaSk89]<strong>for</strong>reactivesystems(anditsmodications<strong>for</strong>action-labelled<br />
\specication"). Inthissection,werecallthedenitionofbisimulationequivalenceasintroducedby
54 CHAPTER3.MODELLINGPROBABILISTICBEHAVIOUR<br />
concurrentprobabilisticsystems[SeLy94]and<strong>for</strong>action-labelledfullyprobabilisticsys-<br />
tems[vGSST90]).Section3.4.2presentsthenotionofasimulationalaSegala&Lynch<br />
[SeLy94]<strong>for</strong>action-labelledconcurrentprobabilisticsystems.Moreover,weshowhowto<br />
adaptthisnotionofasimulation<strong>for</strong>fullyprobabilisticsystemswithactionlabels.15<br />
3.4.1 Bisimulation<br />
In[LaSk89],Larsen&Skouintroduceprobabilisticbisimulation<strong>for</strong>reactivesystemsas<br />
anelegantextensionofbisimulation<strong>for</strong>non-probabilisticsystems[Miln80,Park81].Van<br />
Glabbeeketal[vGSST90]re<strong>for</strong>mulateprobabilisticbisimulation<strong>for</strong>action-labelledfully<br />
probabilistic;Segala&Lynch[SeLy94]<strong>for</strong>action-labelledconcurrentsystems(which{<br />
whenappliedtoreactivesystems{yieldstheoriginaldenitionbyLarsen&Skou).<br />
Denition3.4.1[Bisimulation(fullyprobabilisticcase),cf.[vGSST90]]Abi-<br />
simulationonanaction-labelledfullyprobabilisticsystem(S;Act;P)isanequivalence<br />
relationRonSsuchthatP(s;a;C)=P(s0;a;C)<strong>for</strong>all(s;s0)2R,alla2Actand<br />
C2S=R.<br />
Denition3.4.2[Bisimulation(concurrentcase),cf.[SeLy94]]Abisimulationon<br />
anaction-labelledconcurrentprobabilisticsystem(S;Act;Steps)isanequivalencerelation<br />
RonSsuchthat<strong>for</strong>all(s;s0)2R:<br />
Ifsa<br />
�!thenthereisatransitions0a<br />
�!0with[C]=0[C]<strong>for</strong>allC2S=R.<br />
Denition3.4.3[Bisimulationequivalence]Twostatess1ands2ofanaction-<br />
labelled(fullyorconcurrent)probabilisticsystemarecalledbisimilar(denotedbys1 s2)<br />
ithereexistsabisimulationwhichcontains(s1;s2).<br />
Clearly,theabovenotionofabisimulationequivalenceappliedtoanon-probabilistic<br />
system(S;Act;�!)(identiedwiththeconcurrentprobabilisticsystem(S;Act;Steps)<br />
whereStepsa(s)=f1t:sa<br />
�!tg)coincideswiththeclassicalbisimulationequivalence<br />
ala[Miln80,Park81].16Jonsson&Larsen[JoLa91]giveanalternativedescriptionof<br />
bisimulation<strong>for</strong>fullyprobabilisticsystemswithpropositionlabelswhichisbasedon<br />
weightfunctions<strong>for</strong>distributions.17Thefollowingpropositionre<strong>for</strong>mulatesthisresult<br />
(Theorem4.6in[JoLa91])<strong>for</strong>concurrentprobabilisticsystemswithactionlabels.A<br />
similarobservationwasmadebydeVink&Rutten[dViRu97]<strong>for</strong>reactivesystems(using<br />
acategoricalcharacterizationofwhatwecallweightfunctions).<br />
Proposition3.4.4Let(S;Act;Steps)beanaction-labelledconcurrentprobabilisticsys-<br />
temands,s02S.Then,sands0arebisimilarithereexistsabinaryrelationRonS<br />
suchthat(s;s0)2Rand,<strong>for</strong>all(t;t0)2R:18<br />
15Bisimulationequivalenceandthesimulationpreordercanalsobedened<strong>for</strong>proposition-labelled<br />
probabilisticsystems(seee.g.[JoLa91,ASB+95]).Thesedenitionsareomittedhere.<br />
16ThissimpleobservationshouldnotbeconfusedwiththemoredelicateresultbyBloom&Meyer<br />
[BlMe89]whohaveshownthatanynitelybranchingnon-probabilisticaction-labelledtransitionsystem<br />
canbedecoratedwithprobabilitiessuchthattheresultingsystemisareactivesystemwiththesame<br />
bisimulationequivalenceclasses.<br />
17SeeSection2.2,page30,<strong>for</strong>thedenitionofweightfunctions.<br />
18Recallthat R0ithereexistsaweightfunction<strong>for</strong>(;0)withrespecttoR(seeSection2.2,<br />
page30).
3.4.BISIMULATIONANDSIMULATION 55<br />
ut sa,<br />
v1 sk<br />
kk k v2 k u0 t0<br />
s0a,0 sk<br />
? b ? kkb v0 k ? �12���@@@@R ? 18 38 12 AAAAU12<br />
Figure3.5:s s0?<br />
Proof: Ift0a Ifta �!thenthereexistst0a �!0thenthereexiststa easyverication.Usessimilarargumentstothosein[JoLa91,dViRu97]. �!0with �!with R0.<br />
sthereisatransitions0a bysands0respectivelyviathattransitions. (;0)withrespectto Proposition3.4.4yieldsthattwostatess,s0arebisimilari<strong>for</strong>eachtransitionsa �!0where showshowtocombinepartsofbisimilarstatesthatarereached 0.Inthatcase,theweightfunctionweight<strong>for</strong> �!of<br />
combinedaswellasv1,v2andv0. Example3.4.5Thestatessands0intheaction-labelledconcurrentprobabilisticsystem to showninFigure3.5onpage55arebisimilar.Aweightfunction<strong>for</strong>(;0)withrespect canbeobtainedasfollows.Clearly,t t t0andv1,v2 v1 v2 v0.Hence,tandt0canbe<br />
weight 0 t0 12 18 v0<br />
Thus,weight(t;t0)=1=2,weight(v1;v0)=1=8,weight(v2;v0)=3=8(andweight(x;y)=0 -- 38 -<br />
Remark3.4.6The\inference"fromconcurrentprobabilisticsystemstostratiedsys- inallothercases)yieldsaweightfunction<strong>for</strong>(;0)withrespectto. temssketchedonpage40canbeextended<strong>for</strong>theactionlabelledcase.Forthis,weassociatewitheachaction-labelledconcurrentsystemS=(S;Act;Steps)theaction-labelled stratiedsystemS0=(S0;Act;Steps0)where<br />
Itiseasytoseethatthisinferencepreservesbisimulationequivalence;i.e.,ifs,s02S S0=S[f(s;):s2S;2Stepsa(s)<strong>for</strong>somea2Actg,<br />
thensands0arebisimilarasstatesofSisands0arebisimilarasstatesofS0. Steps0(s)=f(a;1(s;)):(a;)2Steps(s)gandSteps0(s;)=f(arandom;)g.<br />
TheresultofMilner[Miln89]thatineveryimage-nite(non-probabilistic)labelledtransitionsystembisimulationcanbeapproximatedby\nitarybisimulation"carriesoverto theprobabilisticcase.
Denition3.4.7[Therelationsn]Let(S;Act;Steps)beanaction-labelledconcur- 56 CHAPTER3.MODELLINGPROBABILISTICBEHAVIOUR<br />
rentprobabilisticsystem.WedeneinductivelyequivalencerelationsnonS.Weset 0=S Ifsa �!thenthereisatransitions0a Sand,<strong>for</strong>n=0;1;2;:::,sn+1s0i:<br />
Lemma3.4.8Let(S;Act;Steps)beanimage-niteaction-labelledconcurrentprobabilis- Ifs0a �!0thenthereisatransitionsa �!0with[C]=0[C]<strong>for</strong>allC2S=n.<br />
ticsystemands,s02S.Then,s s0isns0<strong>for</strong>alln �!with[C]=0[C]<strong>for</strong>allC2S=n.<br />
Proof: Lemma3.4.8canbeadapted<strong>for</strong>thefullyprobabilisticcase.Inthatcase,nofurther seeSection3.7,Lemma3.7.5(page68). 0.<br />
a2ActandC2S=n. assumptions(likeimage-niteness)areneeded.Westate(withoutproof)that,whenever alln s,s0arestatesofanaction-labelledfullyprobabilisticsystemthens 0.Here,s0s0<strong>for</strong>allstatess,s0andsn+1s0iP(s;a;C)=P(s0;a;C)<strong>for</strong>all s0isns0<strong>for</strong><br />
3.4.2 Simulationcanbeviewedas\uni-directionalbisimulation"inthesensethataprocessP0 \simulates"anotherprocessPifeachstepofPcanbe\simulated"byastepofP0.In Simulation<br />
bythe\specication"P0.Thedenitionofasimulation<strong>for</strong>concurrentprobabilistic systemswithactionlabelsbySegala&Lynchisbasedonthatidea:thenotionofa simulationisderivedfromthecharacterizationofbisimulationinProposition3.4.4(page thatcase,Pcanbeviewedasan\implementation"ofP0aseachstepofPis\allowed"<br />
asanadaptionofthe\satisfactionrelation"proposedbyJonsson&Larsen[JoLa91]that howthisdenitionofasimulationcanbemodied<strong>for</strong>thefullyprobabilisticcase.The resultingsimulationpreorderonaction-labelledfullyprobabilisticsystemscanbeviewed 54)bydroppingthesymmetry(cf.Denition3.4.9).Attheendofthissection,weshow<br />
workwithfullyprobabilisticsystemsandpropositionlabels. Denition3.4.9[Simulation(concurrentcase),cf.[SeLy94]]Let(S;Act;Steps) beanaction-labelledconcurrentprobabilisticsystem.Asimulation<strong>for</strong>(S;Act;Steps)is asubsetRofSIfsa �!thenthereexistsatransitions0a Ssuchthat<strong>for</strong>all(s;s0)2R:<br />
lationwhichcontains(s;s0).s,s0arecalledsimilar(denotedbys1sims2)isvsims0Wesaysimplementss0ands0simulatess(denotedbysvsims0)ithereexistsasimu- �!0with<br />
ands0vsims. R0.<br />
<strong>for</strong>(1s;1s0)withrespecttovsim.Hence,if(S;Act;�!)isanon-probabilisticlabelled ofasimulation[Miln89].Notethatinthenon-probabilisticcase,svsims0ithefunction weightwithweight(u;u0)=0if(u;u0)6=(s;s0)andweight(s;s0)=1isaweightfunction Inthenon-probabilisticcase,theabovenotionofasimulationagreeswithMilner'snotion<br />
onlyifRisasimulationinthesenseofMilner.<br />
transitionsystem(i.e.Sisasetofstatesand�!asubsetofSActS)andR probabilistictransitionsystem(S;Act;Steps)whereSteps(s)=f(a;1t):sa thenRisasimulationinthesenseofDenition3.4.9(i.e.Risasimulation<strong>for</strong>theinduced �!tg)ifand SS
3.4.BISIMULATIONANDSIMULATION Example3.4.10ConsiderthetransitionsystemofFigure3.6(page57).Clearly,uvsim 57<br />
s<br />
vt u v0 t0<br />
ka,<br />
s0 ka,0<br />
kkb13 s k s<br />
? ����@@@@R ? 23 �?<br />
kk? b12��<br />
�@@@@R12u0<br />
k<br />
u0andu;tvsimt0.Aweightfunction<strong>for</strong>(;0)withrespecttovsimcanbeobtained bycombiningcertainpartsoft(ofu)withcertainpartsoft0(ofu0andt0).The Figure3.6:svsims0<br />
weightfunctionweight<strong>for</strong>(;0)withrespecttovsimisgivenby:weight(t;t0)=1=3, weight(u;t0)=1=6,weight(u;u0)=1=2.<br />
weight 0 tt0 u<br />
13 16 u0<br />
Weobtainsvsims0. - - 12 -<br />
alternativedenitionsofasimulationpreorderthatdonotuseweightfunctions.<strong>On</strong>eposRemark3.4.11[Alternativesimulation-likepreorders]Therearesimplerpossibilitiestodropthesymmetryfromthedenitionofbisimulationequivalencethusyieldingsibilityistoconsiderthedownwardclosuret#Rofallelementst2Sandto(re-)dene therelationRonDistr(S)by: Anotherpossibilityistodealwiththeupwardclosurest"R.Bothpossibilitiesyielda preorderthatisstrictlycoarserthanthesimulationpreorderala[SeLy94].Wearguethat 0R0i [t#R] 0[t#R]<strong>for</strong>allt2S.<br />
preorder. Wedenea#-simulationtobeabinaryrelationRonSsuchthat<strong>for</strong>all(s;s0)2R noneoftheserelationscanbeviewedasaprobabilisticcounterparttoMilner'ssimulation<br />
t"R=fu2S:(t;u)2Rg.Wedenesv#s0(sv"s0)i(s;s0)2R<strong>for</strong>some#-simulation S:(u;t)2Rg.Similarly,a"-simulationisabinaryrelationRonSsuchthat<strong>for</strong>all (s;s0)2Randsa andsa �!thereexistss0a �!thereexistss0a �!0with[t#R] �!0with[t"R] 0[t#R]<strong>for</strong>allt2S.Here,t#R=fu2<br />
("-simulation).UsingtheresultsofChapter5(Lemma5.3.11onpage113)weobtain that,<strong>for</strong>(S;Act;Steps)tobenite,thesimulationpreordervsimisa#-simulationanda 0[t"R]<strong>for</strong>allt2Swhere<br />
"-simulation.Thus, svsims0impliessv#s0andsv"s0.
58 CHAPTER3.MODELLINGPROBABILISTICBEHAVIOUR sa, tm<br />
umtm? s0a,0<br />
vmwm<br />
tm<br />
u0 t0 m m? b AAAUc b?<br />
w0<br />
v0 m m?<br />
c<br />
AAAAU 12 12 12 AAAAU12<br />
InthesystemofFigure3.7(page58)wehavesv#s0buts6vsims0.Fromthebranching Figure3.7:sv#s0ands6vsims0<br />
thesystemofFigure3.8(page58)wehavesv"s0buts6vsims0.Inouropinion,the tobeanimplementionoftheprocessontheright(i.e.theprocesswithinitialstates0) asscanreachastatewherebothactionscandbcanbeper<strong>for</strong>medwhiles0cannot.In timeview,theprocessonleft(i.e.theprocesswithinitialstates)shouldnotbeconsidered<br />
stateafterper<strong>for</strong>mingawithprobability1,whiles0canreachaterminalstate(w0)after oftheprocessontheleft(theprocesswithinitialstates)sincesreachsanon-terminal processontheright(theprocesswithinitialstates0)cannotbeviewedasasimulation<br />
s0a,0 tm<br />
u1 x v1 y<br />
u0 mt0 m<br />
v0 mw0<br />
m<br />
sta,<br />
m m mu2 t v2<br />
m<br />
13 ?<br />
mm ?<br />
? b���� ? @@@@R 13 13 c b AAAU<br />
23 AAAAU cm<br />
b AAAU<br />
13 c<br />
per<strong>for</strong>mingawithnon-zeroprobability.19 Figure3.8:sv"s0ands6vsims0<br />
rentprobabilisticsystem.ByinductiononnwedenerelationsvnDenition3.4.12[Therelationsvn]Let(S;Act;Steps)beanaction-labelledconcur- sv0s0<strong>for</strong>allstatess,s02S svn+1s0iwheneversa �!thenthereexistsatransitions0a �!0andaweight S S:<br />
SimilarlytoLemma3.4.8(page56)weobtainthefollowing. 19Eventherelationv"\v#iscoarserthanvsim.InthesystemofFigure3.8,weaddatransition<br />
functionweight<strong>for</strong>(;0)withrespecttovn(i.e. vn0).<br />
w0a �!1w0andobtains6vsims0while(sv"s0)^(sv#s0).
3.4.BISIMULATIONANDSIMULATION Lemma3.4.13Let(S;Act;Steps)beanimage-niteaction-labelledconcurrentproba- 59<br />
Thefollowinglemmashowsthatvsimisapreorderanditskernelsimiscoarserthan bilisticsystemands,s02S.Then,svsims0isvns0<strong>for</strong>alln Proof: seeSection3.7,Lemma3.7.6(page68). 0.<br />
bisimulationequivalence. Lemma3.4.14Let(S;Act;Steps)beanaction-labelledconcurrentprobabilisticsystem ands;s0;s00;s1;s01;s2;s022S.Then: (a)s (b)svsims0,s0vsims00=)svsims00 (c)s1vsims2,s1 s0=)ssims0<br />
Proof: (page54).(c)followsby(a)and(b).Thetransitivityofvsim(item(b))canbederived (a)followsimmediatelybythedenitionofasimulationandProposition3.4.4 s01,s2 s02=)s01vsims02<br />
Bypart(a)ofLemma3.4.14,bisimulationequivalence lencesim.Asinthenon-probabilisticcase,simulationequivalencesimdoesnotcoincide fromRemark2.2.1(page30).<br />
withbisimulationequivalence.Forinstance,<strong>for</strong>thenon-probabilisticsystemofFigure 3.9(page59)wehavessims0buts6s0.Inthecaseofreactivesystems,simulationand isnerthansimulationequivabisimulationequivalencecoincide.Thisresultcanbeviewedastheprobabilisticcounter-<br />
uk�a��sk@@@Ra vtk<br />
s0<br />
k v0 t0 k<br />
a kka<br />
? ?<br />
Figure3.9:ssims0buts6s0?<br />
a<br />
parttothewell-knownresultthatsimulationequivalenceandbisimulationequivalence arethesame<strong>for</strong>deterministic(non-probabilistic)transitionsystems.20 Theorem3.4.15Let(S;Act;Steps)beareactiveaction-labelledconcurrentprobabilistic<br />
WeadaptthedenitionofthesimulationpreorderalaSegala&Lynch[SeLy94](Deni- systemands,s02S.Then,ssims0is Proof: seeSection5.3.1,Thoerem5.3.6(page110). s0.<br />
\satisfactionrelation"<strong>for</strong>fullyprobabilisticsystemswithpropositionlabelsbyJonsson ofthesimulationpreorderonfullyprobabilisticsystemswithactionlabels(Denition 3.4.17,page60)canbeviewedastheaction-labelledcounterparttothedenitionofthe tion3.4.9,page56)<strong>for</strong>action-labelledfullyprobabilisticsystems.Theresultingdenition<br />
&Larsen(cf.Denition4.3in[JoLa91]).Inthesequel,S=(S;Act;P)denotesan action-labelledfullyprobabilisticsystem. statesandactiona,thereisatmostonetransitionsa 20Recallthatanon-probabilisticaction-labelledtransitionsystemiscalleddeterministici,<strong>for</strong>each �!t.
Denition3.4.16[Weightfunctionsinfullyprobabilisticsystems]Lets,s02S 60 CHAPTER3.MODELLINGPROBABILISTICBEHAVIOUR<br />
isafunctionweight:S andR S S.Ifsisnon-terminalthenaweightfunction<strong>for</strong>(s;s0)withrespecttoR<br />
2. 1.Ifweight(t;a;t0)>0then(t;t0)2R. Xu02Sweight(t;a;u0)=P(s;a;t);<br />
Act S![0;1]suchthat<strong>for</strong>alla2Actandt,t02S:<br />
WewritesvRs0ieithersisterminalorthereexistsaweightfunction<strong>for</strong>(s;s0)with Xu2Sweight(u;a;t0)=P(s0;a;t0):<br />
tobenon-terminalandletand0betheinduceddistributionsonActS,i.e.(a;t)= Inparticular,ifsisnon-terminalandsvRs0thens0isnon-terminal.Supposesands0 respecttoR.<br />
inducesaweightfunctionweight0:(Act P(s;a;t)and0(a;t0)=P(s0;a;t0).IfsvRs0thentheweightfunctionweight<strong>for</strong>(s;s0)<br />
<strong>for</strong>(;0)withR0=f(ha;ti;ha;t0i:a2Act;(t;t0)2Rg.Viceversa,if weight0(ha;ti;ha;t0i)=weight(t;a;t0) S)(Act S)![0;1],<br />
Denition3.4.17[Simulation(fullyprobabilisticcase)]Asimulation<strong>for</strong>Sisa R0isasbe<strong>for</strong>e)thensvRs0. R00(where<br />
Example3.4.18Considertheaction-labelledfullyprobabilisticsystemofFigure3.10 s0simulatess(denotedbysvsims0)ithereexistsasimulationthatcontains(s;s0). binaryrelationRonSsuchthatsvRs0<strong>for</strong>all(s;s0)2R.Wesaysimplementss0and<br />
ase.g.weight(t;a;t0)=weight(v;b;u0)=weight(u;b;u0)=1=3(andweight()=0inall onpage60.TherelationR=f(s;s0);(t;t0);(u;u0);(v;u0);(w;w0)gisasimulation<br />
s<br />
ta,13 ���� s0<br />
v? b;13 @@@@R b,13u<br />
t0a,13 ���� @@@@R b,23u0<br />
w?<br />
c,1 w0 ? c,1<br />
othercases)isaweightfunction<strong>for</strong>(s;s0)withrespecttoR.Hence,svsims0. Figure3.10:svsims0<br />
3.4.13(page59),itcanbeshownthatvcanbeapproximatedbythe\nitary"relation vn.Moreprecisely,ifs,s0arestatesofanaction-labelledfullyprobabilisticsystemthen svsims0isvns0<strong>for</strong>alln AsinLemma3.4.14(page59)itcanbeshownthatvsimistransitive;asinLemma<br />
asinDenition3.4.16,page60).Then,svns0i(s;s0)2Rn.<br />
21Here,therelationsvnaredenedasfollows.LetR0=SSandRn+1=vRn(wherevRnisdened 0.21SimilarlytoTheorem3.4.15(page59)weobtainthat,
3.5.PROBABILISTICPROCESSES <strong>for</strong>action-labelledfullyprobabilisticsystems,bisimulationequivalenceandsimulation 61<br />
equivalencearethesame.Thisresultcanbeviewedastheaction-labelledcounterpart toTheorem4.6of[JoLa91]whichconsidersfullyprobabilisticsystemswithproposition labelsandcharacterizesbisimulationequivalence<strong>for</strong>themintermsofweightfunctions. Theorem3.4.19(cf.Theorem4.6in[JoLa91])Let(S;Act;P)beanaction-labelled fullyprobabilisticsystemands,s02S.Then, Proof: seeSection5.3,Theorem5.3.7(page110). s s0i ssims0.<br />
tems",i.e.aprobabilisticsystemtogetherwithaspeciedstate,theinitialstate.Alter 3.5 Thebehaviourofaprobabilisticprocesscanbedescribedby\pointedprobabilisticsys- <strong>Probabilistic</strong>processes<br />
natively,wecoulddealwithadistribution<strong>for</strong>theinitialstatesinthefullyprobabilistic caseandasetofinitialstatesintheconcurrentcase(asdonee.g.in[CoYa95,JoYi95,<br />
(S;sinit)consistingofa(fullyorconcurrent)probabilisticsystemSwithstatespaceS Sega95a]).<br />
andaninitialstatesinit2S. Denition3.5.1[<strong>Probabilistic</strong>processes]AprobabilisticprocessisatupleP=<br />
Forinstance,afullyprobabilisticprocessisatupleP=(S;P;sinit)consistingofa fullyprobabilisticsystem(S;P)andaninitialstatesinit2S.<strong>Probabilistic</strong>processes areextendedbyactionorpropositionlabelsintheobviousway.E.g.anaction-labelled labelledconcurrentprobabilistictransitionsystem(S;Act;Steps)andaninitialstateconcurrentprobabilisticprocessisatuple(S;Act;Steps;sinit)consistingofanaction- statesinthecomposedsystem.Forinstance,letP=(S;sinit)andP0=(S0;s0init)be thedisjointunionofthetwounderlyingprobabilisticsystemsandcomparetheinitial abilisticprocessesasfollows.Weconsidertheprobabilisticsystemthatarisesbytakingsinit2S.Bisimulationequivalenceandthesimulationpreorderareadapted<strong>for</strong>prob- twoaction-labelledconcurrentprobabilisticprocesseswhereS=(S;Act;Steps),S0= (S0;Act0;Steps0)aretheunderlyingsystems.Then,PandP0aresaidtobebisimilar (writtenP s2S0.22Similarly,wedenebisimulationequivalence(alsodenoted)<strong>for</strong>action-labelled fullyprobabilisticprocesses,thesimulationpreordervsim,simulationequivalencesim (S]S0;Act[Act0;Steps)whereSteps(s)=Steps(s)ifs2SandSteps(s)=Steps0(s)if P0)isinitands0initarebisimilarasstatesofthecomposedsystemS]S0=<br />
probabilisticcase,thecomposedsystemS]S0isdenedasfollows.IfS=(S;Act;P) andtherelationsnandvn<strong>for</strong>action-labelledprobabilisticprocesses.Here,inthefully (s;a;t)2SActS,P(s;a;t)=P0(s;a;t)if(s;a;t)2S0Act0S0andP(s;a;t)=0in allothercases.Clearly,theresultsofSection3.3.1carryovertothepointedcase.Thatis, andS0=(S0;Act0;P0)thenS]S=(S]S0;Act[Act0;P)whereP(s;a;t)=P(s;a;t)if<br />
t2Sand(t)=0ift02S0.Inthesameway,eachdistribution0onS0isviewedasadistributionon S]S0.<br />
22Here,eachdistributiononSisidentiedwiththedistribution:S]S0![0;1],(t)=(t)if
inthefullyandconcurrentcase,vsimisapreorderonthecollectionofallaction-labelled 62 CHAPTER3.MODELLINGPROBABILISTICBEHAVIOUR<br />
(fullyorconcurrent)probabilisticprocesses. Inthefullyprobabilisticcase:P Intheconcurrentcase: (a)IfPandP0areimage-nitethen (i)P P0iPnP0<strong>for</strong>alln isstrictlynerthansim.And: P0iPsimP0.<br />
(b)IfPandP0arereactivethenP (ii)PvsimP0iPvnP0<strong>for</strong>allnP0iPsimP0. 00.<br />
3.6 observethatincontrasttosomeauthorswerequirethat,inthefullyprobabilisticcase, Webrieyexplaintherelationofourmodelstothoseproposedintheliterature.Firstwe Relatedmodels<br />
Pa;tP(s;a;t)2]0;1[<strong>for</strong>action-labelledsystems)thevalue theprobabilitiesoftheoutgoingtransitionsofanon-terminalstatessumuptoone.In thosemodelsthatallow<strong>for</strong>substochasticstates(i.e.statesswherePtP(s;t)2]0;1[or<br />
(or,whendealingwithactionlabels,(s)=1�Pa;tP(s;a;t))canbeviewedasthe probability<strong>for</strong>thesystemto\halt"ins.Dependingonthesystemunderconsideration, (s)=1�XtP(s;t)<br />
this\halting"mightbeinterpretedaswell-termination,deadlockordivergence.Inour<br />
P(s;0)= fullyprobabilisticmodel(whichdoesnotallow<strong>for</strong>substochasticstates),weassumethat \halting"isdescribedbyspecialstatetransitions.Forinstance,inabsenceofaction<br />
P(s;0;0)=(s). labels,onecanuseanauxiliaryterminalstate0andtheprobabilisticstatetransitions anauxiliarystate0andaspecialactionsymbol,e.g.0,andthetransitionprobabilities (s)to<strong>for</strong>malize\halting".Usingactionlabels,onemightdealwithsuch<br />
Wenowbrieysketchhowourmodelsarerelatedtothemodelsconsideredintheliterature whereweignorethedierencesarisingfromtheuseofsetsofinitialstatesordistributions <strong>for</strong>theinitialstates(ratherthandealingwithasingleinitialstateaswedo)and/or allowingsubstochasticstates. generativeprocesses.23TheyalsoagreewiththefullyprobabilisticautomatonofSegala [Sega95a].Intheconcurrentcase,ouraction-labelledprocessescoincidewiththesimple probabilisticautomatonofSegala&Lynch[SeLy94,Sega95a]. Inthenotationsof[vGSST90],fullyprobabilisticprocesseswithactionlabelsarecalled<br />
movingtheactionsymbolarandomfromthestepsoftheprobabilisticstates.Thestratiedmodelof[vGSST90]essentiallyagreeswiththealternatingmodel.Themaindierencebeaction-labelledstratiedprocesses(inthesenseofDenition3.3.12onpage52)byre- ThealternatingmodelofHansson&Jonsson[HaJo90,Hans91]canbeobtainedfrom<br />
tweenstratiedsystemsala[vGSST90]andalternatingsystemsala[HaJo90,Hans91]are probabilisticchoicewhile[vGSST90]dealswithexternalprobabilisticchoice.<br />
generativesystemsintheapproachof[vGSST90]isslightlydierentfromourssinceweassumeinternal 23Itshouldbenoticedthatthisjustholds<strong>for</strong>the<strong>for</strong>maldenitionofthemodel.Theinterpretationof
that[vGSST90]assumeanexternalprobabilisticchoicewhile[HaJo90,Hans91]dealwith 3.6.RELATEDMODELS 63<br />
internalprobabilisticchoiceandthat,intheapproachof[vGSST90],thenon-probabilistic statescannotbehavenon-deterministically.24Ignoringthedierentinterpretationofthe probabilisticchoiceoperatorandallowingnon-determinisminthenon-probabilisticstates hence,byaddingtheactionsymbolarandom,action-labelledstratiedsystemsinoursense. ofastratiedsysteminthesenseof[vGSST90]weobtainthealternatingmodel;and<br />
labelledconcurrentprobabilisticprocessesagreewithprobabilisticnon-deterministicsystemsalaBianco&deAlfaro[BidAl95,dAlf97a,dAlf97b].Inessence,theconcur Aproposition-labelledfullyprobabilisticprocessisasequentialMarkovchaininthesense<br />
rentMarkovchainsof[Vard85,VaWo86,CoYa88,CoYa95]arethesameasstratiedofVardi[Vard85](orCourcoubetis&Yannakakis[CoYa88,CoYa95])whileproposition- ThemodelconsideredbyPnueli&Zuck[Pnue83,PnZu86a,PnZu86b,PnZu93](just proposition-labelledsystems.<br />
signedasetof\commands"(called\transitions"intheapproachofPnueli&Zuck),where calledprobabilisticprograms)canbeviewedasageneralizationofconcurrentprobabilistic systemsinoursense.IntheapproachofPnueli&Zuck,eachprobabilisticprogramisas- eachcommandcommisassociatedwithanenablingpredicate(representedbyasubset Enabled(comm)ofthestatespaceS)andasetModes(comm)=fmode1;:::;modekgof \modes".Eachmodemodeiisassociatedwithanon-zeroprobabilityandasetofpossible nextsuccessorstates.Ifweassumethesetsofthemodestobesingletons(thatprescribe uniquesuccessorstates),eachcommandcommcorrespondstoadistributioncommon thestatespace.Inthatcase,theprobabilisticprogramsalaPnueli&Zuckspecializesto concurrentprobabilisticsystemsinoursensewhereSteps(s)isgivenbythesetofcommandsthatareenabledinstates,i.e.Steps(s)=fcomm:s2Enabled(comm)g:Ifwe assumethatinadditionthecommandsareassociatedwithanactionlabelthenthemodel ofPnueli&Zuckcanalsobeviewedasageneralizationofourconcurrentprobabilistic Remark3.6.1VanGlabbeeketal[vGSST90]presentahierarchy<strong>for</strong>theseveralaction- systemswithactionlabels.<br />
bere<strong>for</strong>mulated<strong>for</strong>ournotations. bisimulationequivalence.Webrieysketchhowtheinferencesbetweenthemodelscan labelledsystems(reactive,generative,stratied)togetherwiththecorrespondingtypeof<br />
transitionprobabilities mayabstractfromtheprobabilities<strong>for</strong>chosingacertainactionanddealwiththereactive Givenagenerative(i.e.action-labelledfullyprobabilistic)systemSG=(S;Act;PG),we<br />
InthecasewherePG(s;a)=0weputPR(s;a;t)=0<strong>for</strong>allstatest.Asshownin PR(s;a;t)=PG(s;a;t)<br />
[vGSST90],thisinferencefromgenerativesystemstoreactivesystemspreservesbisim- PG(s;a)(providedthatPG(s;a)>0):<br />
choiceratherthannon-determinism.Thus,thesystemsin[vGSST90]donotbehavenon-deterministically. ulationequivalence.25Wenowcomparethegenerativeandstratiedview.LetPS=<br />
PGQGimpliesPRQRwhiletheconversedoesnothold.<br />
24Notethat[vGSST90]considersaprocesscalculuswithsynchronousparallelismandprobabilistic 25Formally,ifPGandQGaregenerativeprocessesandPR,QRtheassociatedreactiveprocessesthen
(S;Act;Steps;sinit)beanaction-labelledstratiedprocesswherenoneofthenon-probabilistic 64 CHAPTER3.MODELLINGPROBABILISTICBEHAVIOUR<br />
statesofPSbehavesnon-deterministically(i.e.ifsisnon-probabilisticthensa atmostoneactionaandstatet)asitisthecase<strong>for</strong>thesystemsintheapproachof [vGSST90].PScanidentiedwiththegenerativeprocessPG=(S;Act;PG;sinit)where �!t<strong>for</strong><br />
PG(s;a;t)=8>:(t):ifsa 1 :ifsa �!anda=arandom<br />
Giventwosuchaction-labelledstratiedprocessesPSandQSwherenoneofthenon- 0 :otherwise. �!tanda6=arandom<br />
probabilisticstatesbehavesnon-deterministically,wehavewherePGandQGdenotetheassociatedgenerativeprocesses.26Thisshouldbecontrastedwiththeabstractionresultof[vGSST90]whereadierentinferenceisused.In<br />
(*)PS QSiPG QG<br />
theapproachof[vGSST90],the\if"-partof(*)doesnothold.Theinferencefromthe labelledstratiedsystems)removesthetransitionslabelledbyarandomanddealswiththestratiedtothegenerativemodelusedin[vGSST90](adapted<strong>for</strong>ourtypeofactioncumulativeeectofallprobabilisticchoices.Formally,ifSS=(S;Act;Steps)isanaction- that labelledstratiedsystemasabove(i.e.jSteps(s)j ActG=ActnfarandomgandP0G:S intheapproachof[vGSST90],theassociatedgenerativesystemis(S;ActG;P0G)where ActG (SnSprob)![0;1]theleastfunctionsuch 1<strong>for</strong>allnon-probabilisticstates)then,<br />
P0G(s;a;t)=8>: Pu2S(u)P0G(u;a;t):ifsa 1 :ifsa �!anda=arandom<br />
Here,SprobisthesetofprobabilisticstatesinSS.27 0 :otherwise. �!tanda6=arandom<br />
3.7 3.7.1Proofs acterizestheprobabilitiestoreachcertainstatesasleastxedpoints.Wegivetheproof<strong>for</strong>Theorem3.1.6(page36)andTheorem3.2.11(page43)thatchar- <strong>Probabilistic</strong>reachabilityanalysis<br />
P(last();t)>0then!tdenotestheuniquepath2Pathnwith(i)=,jj=i+1 Infullyprobabilisticsystems,weusethefollowingnotation.If 26Theunderlyingnotionofbisimulationequivalence<strong>for</strong>PSandQSisthatofDenition3.4.2(page 2Pathn,jj=iand<br />
transitionprobabilitiesPG(s;)orP0G(s;)donotsumupto1.Givenanaction-labelledstratiedsystem inthenon-probabilisticstates,because,<strong>for</strong>thosestatessinwhichnon-determinismispresent,the SS(wherenon-determinismispresentinsomenon-probabilisticstates),thegenerative(fullyprobabilistic) 54)while<strong>for</strong>PGandQGwedealwithbisimulationinthesenseofDenition3.4.1(page54). 27Bothtrans<strong>for</strong>mationsfromthestratiedtothegenerativemodelfailwhennon-determinismisallowed<br />
stepjustresolvesthenon-deterministicchoices.<br />
systemassociatedbyanadversarycanbeviewedasarenementofS.Here,theunderlyingrenement
andlast()=t.Similarly,inconcurrentprobabilisticsystems,wewrite!ttodenote 3.7.PROOFS 65<br />
Proposition3.7.1Let(S;P)beafullyprobabilisticsystem, theuniquepath (Here,weassumethat2Pathn,jj=i,2Steps(last())andt2Supp().) 2Pathnwith(i)=,jj=i+1,step(;i)= Pathn.For2,let andlast()=t.<br />
whichisgivenbyF(f)()=1if2 Then,pistheleastxedpointoftheoperatorF:(Pathn![0;1])!(Pathn![0;1]) ()=f02Pathn(last()): 02gandp:Pathn![0;1],p()=Prob(()").<br />
F(f)()= t2Next()P(last();t)f(!t) Xand<br />
leastxedpointofF.28If if Proof: =2.Here,Next()=ft2S:P(last();t)>0g.<br />
to that Clearly,Fismonotoneandpreservesinnimaandsuprema.Letfbethe<br />
02(!t).Then,()canbewrittenasdisjointunionofthesetst(),t2Next(). ().Thus, =2.Fort2Next(),lett()bethesetofnitepathslast()!0where ()"=Pathn(last())andp()=f()=1.Nextweassume 2 thenthepathconsistingofthestatelast()belongs<br />
AsProb(t()")=P(last();t)p(!t)weobtain:<br />
Thus,pisaxedpointofF.Weconcludef() p()= t2Next()Prob(t()")= X t2Next()P(last();t)p(!t)=F(p)(): X<br />
Fork=0;1;2;:::,letk()=f02():j0j 0() 1() 2() :::and()=Sk().Thus,p()=limpk().Itiseasyto kgandpk()=Prob(k()").Then, p()<strong>for</strong>all2Pathn.<br />
p() seethatpk+1=F(pk).Byinductiononkwegetpk() Corollary3.7.2(cf.Theorem3.1.6,page36)Let(S;P)beafullyprobabilisticsys- f().Weconcludethatp=fistheleastxedpointofF. f()<strong>for</strong>all2Pathn.Hence,<br />
tem.LetS1,S2besubsetsofS.Let (i)2S1nS2,i=0;1;:::;jj�1,last()2S2.Let p:S![0;1],p(s)=Prob((s)), Pathnbethesetofallnitepaths = ".Then, suchthat<br />
F(f)(s)=1ifs2S2,F(f)(s)=0ifs2Sn(S1[S2)and,ifs2S1nS2, istheleastxedpointoftheoperatorF:(S![0;1])!(S![0;1])whichisgivenby<br />
Proof: followsimmediatelybyProposition3.7.1(page65).Usesthefactthat()= F(f)(s)=Xt2SP(s;t)f(t):<br />
Proposition3.7.3Let(S;Steps)beaconcurrentprobabilisticsystemand For2 (last())<strong>for</strong>each2Pathn.<br />
pmin()=inf andA2Adv,letA()=f02Pathn(last()): A2AdvProb A()"A;pmax()=sup A2AdvProb 02Agand A()"A: Pathn.<br />
Then,pminandpmaxaretheleastxedpointsoftheoperators e.g.Proposition12.1.1(page309).<br />
28Theexistenceofaleastxedpointcanbeshownusingstandardargumentsofdomaintheory.See
66 Fmin,Fmax:(Pathn![0;1])!(Pathn![0;1]) CHAPTER3.MODELLINGPROBABILISTICBEHAVIOUR<br />
thataredenedasfollows.If2 Fmin(f)()=min8
Foreach>0andt2Supp(),wechoosesomeA;t2Advwith 3.7.PROOFS 67<br />
LetAbeanadversarywithA()= Pathnwithrst(0)=t.Then, pmax !t andA pA;t !t+:<br />
pA !t=pA;t !t !0=A;t pmax !t�: !0<strong>for</strong>each02<br />
Thus,<strong>for</strong>all>0: pmax() X pA()= t2Supp()(t)pA X !t<br />
Thus,pmax Fmax(pmax).ByProposition12.1.1(page309): t2Supp()(t)pmax !t� =Fmax(pmax)()�:<br />
LetAn()=f02A():j0j (2)pmax lfp(Fmax)=fmax.<br />
Moreover,pAn()=1if2.If pA()=lim ngandpAn()=Prob(An()"A).Then,<br />
pAn+1()= =2XthenpA0()=0and n!1pAn():<br />
Byinductiononn,wegetpAn fmax.Thus,pA t2Supp(A())A()(t)pAn fmaxwhichyields �!t: A()<br />
From(2),wegetpmax=fmax.c pmax=sup A2AdvpA fmax:<br />
Corollary3.7.4(cf.Theorem3.2.11,page43)Let(S;Steps)beaconcurrentprob- i=0;1;:::;jj�1,andlast()2S2.Fors2SandA2Adv,let abilisticsystem,S1,S2 pmin(s)=inf A2AdvProb Sandlet A(s)"A;pmax(s)=sup bethesetofnitepaths A2AdvProbsuchthat(i)2S1, Then,pminandpmaxaretheleastxedpointsoftheoperators A(s)"A:<br />
F(f)(s)=0.Ifs2S1nS2then thataredenedasfollows.Ifs2S2thenF(f)(s)=1.Ifs2Sn(S1[S2)then Fmin,Fmax:(S![0;1])!(S![0;1])<br />
Fmax(f)(s)=max(Xt2S(t)f(t): Fmin(f)(s)=min(Xt2S(t)f(t): 2Steps(s));<br />
Proof: followsimmediatelyfromProposition3.7.3(page65).<br />
2Steps(s)):
3.7.2 68 Bisimulationandsimulationinimage-nitesystems CHAPTER3.MODELLINGPROBABILISTICBEHAVIOUR<br />
Wegivetheproofs<strong>for</strong>Lemma3.4.8andLemma3.4.13thatshowthat,inimage-nite systems,(bi-)simulationcanbeapproximatedbythenitaryrelationsnandvn.Let (S;Act;Steps)beaxedimage-niteconcurrentprobabilisticsystemwithactionlabels<br />
Proof: ands,s02S. Lemma3.7.5(cf.Lemma3.4.8,page56)s anequivalencerelation.Byinductiononnitcanbeshownthat0 Let0=Tn0 n.Wehavetoshowthat s0isns0<strong>for</strong>alln =0.Itiseasytoseethat0is 1 2 0.<br />
Foreachn Hence,0 0andeachA2S=0,thereexistsauniqueelementAn2S=nwith .Inordertoshowthat0 weprovethat0isabisimulation. ::: .<br />
AClaim1:Ifsa Proof:SinceA=TAnandAn An.Then,A0=S �!andA2S=0then[A]=infn0[An]. A1 A2 An+1wehave1=[A0] :::andA=TAn.<br />
Foralln r=infn0[An].Clearly,r >0.ThereexistsanitesubsetXofSnAsuchthat[Y]< 0,An=A[(Y\An)[(X\An):ThesetsA,Y\AnandX\Anare [A].Wesupposer>[A].Let [A1] whereY=Sn(A[X).30 ::: =r�[A].Then, [A].Weput<br />
Sincer pairwisedisjoint.Hence,<br />
Contradiction!31c [An]=[A]+[Y\An]+[X\An]1�12k; X s02B0k0(s0)>1�12k: X S,benitesetswith<br />
30ThisisbecausePt=2A(t)isconvergent. 31NotethatbydenitionXisasubsetofSnA.
W.l.o.g.B1 3.7.PROOFSB2 :::,B01 B02 :::.Wedenebyinductiononninnitesets 69<br />
WeputI0=fn:0n=g.Leti <strong>for</strong>all(u;u0)2Bi I0 I1 :::ofnaturalnumberssuchthatthesequence(weightn(u;u0))n2Iiisconvergent B0i,i 1.<br />
thereexistsaninnitesubsetJ(l)ofJsuchthat(weightn(ul;u0l))n2J(l)isconvergent.32 (u1;u01);:::;(uk;u0k)bethesequenceofpairwisedistinctpairs(u;u0)2Bi notbelongtoBi�1B0i�1.ForallinnitesetsJofnaturalnumbersandeachl2f1;:::;kg, 1.WesupposethatIi�1isalreadydened.Let B0iwhichdo<br />
subsetofIi�1and(weightn(u;u0))n2Iiisconvergent<strong>for</strong>all(u;u0)2Bi WedeneJ1=Ii�1(1),Jl=Jl�1(l),l=2;:::;kandIi=Jk.Then,Iiisaninnite weight:S S![0;1];weight(u;u0)=lim n!1 n2Iiweightn(u;u0) B0i.Weput<br />
if(u;u0)2Bi weightisaweightfunction<strong>for</strong>(;0)withrespecttov0. 1.Ifweight(u;u0)>0then(u;u0)iscontainedinthecountablesetSBi B0iandweight(u;u0)=0if(u;u0)=2Bi B0i<strong>for</strong>alli 1.Weshowthat<br />
2.Letu2S.WeshowthatPu0weight(u;u0)=(u).If(u)=0thenweightn(u;u0)= 0<strong>for</strong>allu02Sandn (u)>0.Letibethesmallestnaturalnumberisuchthat1=2i0g u2Bj<strong>for</strong>alljXi.LetA0beanitesubsetofS.Thereexistssomej B0j.Thus, isuchthat<br />
Hence,Pu0weight(u;u0) itissucienttoshowthat<strong>for</strong>all">0thereexistsanitesubsetA0ofSwith u02A0weight(u;u0)=lim (u).InordertoshowthatPu0weight(u;u0) n!1 n2IjX u02A0weightn(u;u0) (u)<br />
u02A0weight(u;u0) X (u)�": (u)<br />
Let">0andj u0=2B0jweightn(u;u0) X iwith1=2j(u)�"<br />
Similarly,itcanbeshownthatPuweight(u;u0)=0(u0). u02B0jweight(u;u0)=lim n!1 n2IjX u02B0jweightn(u;u0) (u)�":<br />
3.Ifweight(u;u0)>0then(u;u0)2Bi manyn,andthere<strong>for</strong>euv0u0. innitelymanyn(moreprecisely,<strong>for</strong>almostalln2Ii).Hence,uvnu0<strong>for</strong>innitely B0i<strong>for</strong>somei 1andweightn(u;u0)>0<strong>for</strong><br />
containsaconvergentsubsequence.<br />
32Thisisbecauseweightn(ul;u0l)2[0;1],andhence,(weightn(ul;u0l))n2Jisbounded.There<strong>for</strong>e,it
70 CHAPTER3.MODELLINGPROBABILISTICBEHAVIOUR
Chapter4<br />
<strong>Probabilistic</strong>processcalculi<br />
ProcesscalculisuchasMilner'sCCSorSCCS[Miln80,Miln83,Miln89],Hoare'sCSP [Hoar85]orBergstra&Klop'sACP[BeKl84]cansuccessfullyserveashigh-levelspecicationlanguages<strong>for</strong>compositionaldesignandanalysisofparallelsystems.Forspecifying variantsofsuchprocesscalculi.Themaingoalofthatchapteristopresentthebasic conceptsofprobabilisticprocesscalculiandhowtosupplythemwithanoperationalse- thequantitativebehaviourofprobabilisticparallelsystems,variousauthorsproposed manticsbasedonaction-labelledprobabilisticprocesses.Wemainlyconcentrateonthe issueofparallelism.Detaileddiscussionsabouttheseveraltypesofnon-deterministic andprobabilisticchoicesandtheirinterplaycanbefounde.g.in[Lowe93b,MMS+94, HMS97,HarG98,HadVi98].Followingthenotationsof[Lowe93b,MMS+94],weusean internalprobabilisticchoiceoperatorwheretheprocesschoosesrandomlywhichsetof events/actionstooertheenvironmentandexternalnon-determinismwheretheenvironmentoersasetofevents/actions.1 ofP1andP2withinonetimestep.Thetransitionprobabilitiesofthecomposedsystem chronousparallelcompositioniscomposedbytheindependentexecutionoftheactivitiesP1andP2,thecomponentsworkinatime-dependentfashion;i.e.,eachstepofthesyn- Synchronousparallelism:Inthesynchronousparallelcompositionoftwoprocesses<br />
synchronizationpoints. P1andP2.ThisreectstheassumptionthatP1andP2workindependentlybetweenthe areobtainedbymultiplyingtheprobabilitiesoftheindividualmovesofthecomponents<br />
eachstepofP1 dealwiththe(synchronous)productP1P2inthestyleofMilner'sSCCS[Miln83]where cessesareproposed.[GJS90,JoSm90,vGSST90,SmSt90,LaSk92,Toft94,KwNo98b]Intheliterature,severaltypesofsynchronousparallelcomposition<strong>for</strong>probabilisticpro- butper<strong>for</strong>msequencesofactionsindependentlybetweenthesesynchronizationpoints. wheretheprocessesP1andP2havetosynchronizeoncertain\synchronizationpoints" e.g.[FHZ93,HarG98],focussontheconceptofalazy(synchronous)productP1 P2iscomposedbyexactlyoneactionofP1andP2.Otherauthors,<br />
<strong>On</strong>eside-eectoftheuseoflazysynchronousparallelism(inanon-probabilisticorprob- P2<br />
abilisticsetting)isthatthetransitionsystemrepresentationofP1P2isingeneralmuchtionoperators.SeeRemark4.2.4,page81.1Itshouldbenoticedthatthedierenttypesofprobabilisticchoiceoperatorsleadtodierentrestric- 71
72 smallerthanthoseofP1 P2.2Inthissense,theuseofthelazyproductcanalsobe CHAPTER4.PROBABILISTICPROCESSCALCULI<br />
viewedasanabstractiontechniquethatattacksthestateexplosionproblem. Inmostcases,intheprobabilisticextensionsofsynchronouscalculi,theconceptof non-deterministicchoiceisreplacedbyprobabilisticchoice.Typically,suchlanguages (withsynchronousparallelismandprobabilisticchoiceratherthannon-determinism)are<br />
guagescanalsobeprovidedwithoperationalsemanticsthatarebasedonthereactiveLaSk92,Toft94]but{ase.g.inthecaseofprobabilisticextensionsofSCCS{suchlan- equippedwithanoperationalsemanticsthatusesamodelbasedonMarkovchains(such<br />
orstratiedview[vGSST90,Toft90,Toft94,KwNo96,Norm97,KwNo98b].Moreover, asfullyprobabilisticprocesseswithactionlabels)[GJS90,JoSm90,vGSST90,Toft90,<br />
someoftheselanguages{togetherwiththeirstratiedsemantics{canbeusedtoreason modelsofthesecalculicanbeviewedasgeneralizationsofthereactivemodel. aboutpriority[SmSt90,Toft90,Toft94].Synchronouscalculiwithnon-deterministicand<br />
Asynchronousparallelism:Thereareseveralprobabilisticextensionsofasynchronous probabilisticchoiceareconsiderede.g.in[FHZ93,Norm97,KwNo98b].Thesemantic<br />
calculiwithnon-deterministicandprobabilisticchoiceoperators.Theunderlying(asynchronous)paralleloperatorsallowcommunicationoncertainactions(e.g.communication non-determinismwheretheindependentevolvementofthecomponentsismodelledby actions)butalsoindependentevolvementofthecomponents.Theoperationalsemanticsofsuchcalculiareusuallygivenintermsofprobabilistictransitionsystemswith intheCCS-styleon\complementary"actionsorCSP-likecommunicationoncommon<br />
interleaving.Forinstance,[HaJo90,Hans91,YiLa92,Yi94]extendMilner'sCCSbya<br />
<strong>Probabilistic</strong>shue:Baeten,Bergstra&Smolka[BBS92]introduceamodication [Lowe93a,Lowe93b,MMS+94,Lowe95,Seid95]. probabilisticchoiceoperator;probabilisticvariantsofHoare'sCSPareconsiderede.g.in<br />
ofACP[BeKl84]whichusesprobabilisticchoiceinsteadofnon-determinismandseveral typesofprobabilisticshueoperators(withpossiblecommunication).Theprobabilisticshueoperatorsareparametrizedbytheprobabilities<strong>for</strong>acommunicationandthe tookuptheideaofusingprobabilityparametersthatassociateweightstothepossible autonomousmovesofthecomponents.Theoperationalsemanticsisbasedonfullyprobabilisticprocesseswithactionlabels.Severalauthors,e.g.[SCV92,NudF95,dAHK98], stepsofthecomposition(communicationoncertainactionsorindependentevolvement ofthecomponents).3[GLN+97]introducetheprocessalgebraPTPA<strong>for</strong>generative(and timed)processesinwhichprobabilisticshueismodelledwiththehelpofanormalization function(ratherthanprobabilityparameters).Intheapproachof[GLN+97],thecomponentsP1andP2oftheprobabilisticshueP1kAP2mustsynchronizeontheactionspossibleactionsofP1kAP2.4Bothtypesofprobabilisticshue(theonethatuseprob- probabilities<strong>for</strong>P1andP2toparticipateinana-stepofP1kAP2wherearangesoverall tiesofP1kAP2aredenedwiththehelpofthenormalizationfunctionthatsumsupthea2Awhiletheactionsa=2Aareper<strong>for</strong>medautonomously.Thetransitionprobabiliabilityparametersandtheonethatuseanormalizationfunction)canbeviewedastheinterleavedexecutionofthetwocomponentsP1andP2(extendedbycertainsynchronizanotionofparallelcompositionPkTofagenerativeprobabilisticprocessPandsomekindof\test"T. 2Thisisbecausethelazyproductabstractsfromcertainlocalstates. 3See[dAHK98]<strong>for</strong>anoverviewoftheseparametrizedshueoperators. 4Similarideasareusedintheapproachsofe.g.[Chri90b,CSZ92,YCDS94,NdFL95]thatdenea
73<br />
tionmechanisms)withrespecttoaxedrandomizedscheduler.Thisschedulerdecides<br />
randomlywhichofthepossiblestepsisexecutednext:eitherasynchronizationactionor<br />
anindividualmoveofP1oranindividualmoveofP2.Theprobabilitiesofthepossible<br />
stepsaregiveneitherbytheparametersoftheprobabilisticshueoperatororbythe<br />
normalizationfunctionthatdependsonthelocalstatesofP1andP2.<br />
Modellingasynchronicitybysynchronicity:Inthenon-probabilisticsynchronous<br />
case(i.e.inthecaseofMilner'sSCCS),adelayoperator@canbedenedwhichmakesit<br />
possiblee.g.to<strong>for</strong>ceaprocesstowait<strong>for</strong>apossiblecommunicationpartnerandtoembed<br />
theasynchronouscalculusCCSintothesynchronouscalculusSCCS[Miln83].Intuitively,<br />
@PbehavesasPbutitmayidle<strong>for</strong>indenitelymanytimestepsbe<strong>for</strong>eper<strong>for</strong>mingthe<br />
rstaction.Formally,@Pisgivenbytheprocessequation@Pdef<br />
=P+1;@Pwhichstates<br />
that@Pdecidesnon-deterministicallytobehaveasPortobeidleinthenextstep.Here,<br />
+denotesnon-deterministicchoice,;sequentialcompositionand1theidleaction.In<br />
absenceofanon-deterministicchoiceoperator,thedelayoperator@cannotbedened;<br />
hence,ifnon-deterministicchoiceisreplacedbyprobabilisticchoice(asitisthecase<strong>for</strong><br />
severalprobabilisticvariantsofsynchronousprocesscalculiproposedintheliterature),<br />
itisnolongertruethatasynchronicitycanbereducedtothesynchronouscase(atleast,<br />
theauthordoesnotseehow).<br />
Organizationofthatchapter:Westudythreecalculi.Thersttwoarestandard<br />
extensionsofMilner'sCCSandSCCS;thethirdavariantofSCCSthatusesalazy<br />
synchronousparallelcomposition.InSection4.1weconsideranasynchronouscalculus<br />
withCCS-likecommunicationandnon-deterministicandprobabilisticchoice(similar<br />
tothecalculiof[HaJo90,Hans91,YiLa92])andgiveanoperationalsemanticsbased<br />
onaction-labelledconcurrentprobabilisticprocesses.InSections4.2and4.3,wework<br />
withsynchronouscalculiwithprobabilisticchoice(butwithoutnon-determinism)which<br />
aresuppliedwithanoperationalsemanticsbasedongenerative(i.e.action-labelledfully<br />
probabilistic)processes.ThecalculusinSection4.2,calledPSCCS,isaprobabilistic<br />
extensionofMilner'sSCCSthatworkswithaparallelcompositionP1 P2wherethe<br />
componentsP1,P2synchronizeonallactions.Basically,itagreeswiththecalculistudied<br />
in[GJS90,JoSm90,vGSST90,Toft94].InSection4.3weproposeaprobabilisticcalculus<br />
whichusesalazysynchronousparallelcompositionP1 P2whereP1andP2haveto<br />
synchronizeonallvisibleactionswhiletheyevolveindependentlyontheirinternalactions.<br />
Modellingrecursionbydeclarationsandprocessequations:Forallthreecalculi,<br />
wemodelrecursionbydeclarations.Weuseprocessvariables(ofsomexedsetProcVar)<br />
inthestatements.Theprocessvariablescanbeinterpretedasprocedurenames.The<br />
bodiesoftheseproceduresaregivenbydeclarations.Formally,adeclarationisafunction<br />
declthatassigntoeachprocessvariableZastatementdecl(Z)(thatalsomightcon-<br />
tainprocessvariables,i.e.recursiveprocedurecalls).AprogramisapairP=hdecl;si<br />
consistingofadeclarationdeclandastatements.Theintendedmeaningofaprogram<br />
P=hdecl;siisthatthebehaviourofPisgivenbythestatementswhereeachoccurrence<br />
ofaprocessvariableZinsisviewedasarecursiveprocedurecall.Thiscorrespondstothe<br />
useofprocessequationsthatweuseinourexamples.LetZ1;:::;Zkbepairwisedistinct<br />
processvariablesands1;:::;skstatements.Then,wewriteZjdef<br />
=sj,j=1;:::;k,to<br />
denotethatZjstands<strong>for</strong>therecursiveprocedurewhosebodyisgivenbysj.Thatis,<br />
wedealwiththedeclarationdeclwheredecl(Zj)=sj,j=1;:::;k,andidentifyZjwith
74 theprogramhdecl;Zji.Ifopisan-aryoperatorsymboloftheunderlyingprocesscal- CHAPTER4.PROBABILISTICPROCESSCALCULI<br />
short<strong>for</strong>theprogramhdecl;op(s1;:::;sn)i. culus(e.g.abinaryparallelcompositionoperatorkorthe1-ary(action-)prexoperator s7!a:s)andPi=hdecl;sii,i=1;:::;n,areprogramsthenwewriteop(P1;:::;Pn)as<br />
InthissectionweconsideraprobabilisticextensionofMilner'sCCS[Miln89]whichis basedonthecalculusof[Hans91](seealso[HaJo90,YiLa92,Yi94]).Thesyntaxofour 4.1 PCCS:anasynchronousprobabilisticcalculus<br />
calculus,calledPCCS,inobtainedfromCCSbyreplacingtheprexoperatora:sbyan action-guardedprobabilisticchoiceoperator<br />
wherepiarerealnumbersbetween0and1denotingtheprobabilitythatafterper<strong>for</strong>ming a: Xi2I[pi]si!<br />
atomicactionswhichcontainsaninternalaction Inwhatfollows,ProcVarisasetofprocessvariablesandActisanitenonemptysetof atheaboveprocessbecomessi(providedthatthestatementssiarepairwisedistinct).<br />
Act!Act,a7!a,where ofaprocess,notvisible<strong>for</strong>theenvironment)andwhichisequippedwithafunction = anda=a<strong>for</strong>alla2Act.IfL (representinginternalcomputations<br />
and.Theresultofasynchronizationissupposedtobeinvisible,i.e.itisdescribedby L=fa:a2Lg.For .Synchronizationofprocessesisonlypossiblebyper<strong>for</strong>mingcomplementaryactions tobeavisibleaction, iscalledthecomplementaryactionof Actthenweput<br />
showninFigure4.1(page74).Here,a2Act,Z2ProcVar,LisasubsetofActnfg theinternalaction. SyntaxofPCCSstatements:PCCSstatementsarebuiltfromtheproductionsystem<br />
s::=nil Z a: Xi2I[pi]si! s1+s2 s1ks2 snL s[`]<br />
withL=L,`:Act!Actisarelabellingfunction(i.e.`()=`()<strong>for</strong>allvisibleactions and`()=),Iisanonemptycountableindexingsetand(pi)i2Iafamilyofreal Figure4.1:SyntaxofPCCSstatements<br />
setofallPCCSprograms,i.e.allpairsP=hdecl;siwheredeclisadeclaration(afunction StmtPCCS(orshortlyStmt)denotesthesetofallPCCSstatements.PCCSdenotesthe writea:([pi1]:si1 numberspi2]0;1]suchthatPi2Ipi=1.ForniteindexingsetI=fi1;:::;ing,wealso<br />
decl:ProcVar!StmtPCCS)andsaPCCSstatement. :::[pin]sin)insteadofa:(Pi2I[pi]si).a:sstandsshort<strong>for</strong>a:([1]s).<br />
Theintendedmeaningofthestatementsisasfollows.nilstands<strong>for</strong>aprocesswhich doesnotper<strong>for</strong>manyaction.Theideabehindaction-guardedprobabilisticchoiceisthat
a:(Pi2I[pi]si)rstper<strong>for</strong>mstheactionaandthenrandomlychoosestobehaveast 4.1.PCCS:ANASYNCHRONOUSPROBABILISTICCALCULUS 75<br />
afterwardsaccordingtothedistributionwhere<br />
+modelsnon-deterministicchoice,thatis,s1+s2eitherbehaveslikes1orlikes2.kde- (t)=Xi2I notestheparallelcompositionwithCCS-stylecommunicationoncomplementaryactions si=tpi:<br />
(i.e.,ins1ks2,s1ands2canevolveindependentlybutmayalsocommunicateviavisible snLbehaveslikesaslongassdoesnotper<strong>for</strong>manaction whereeachaction2Actisreplacedby`(). actions and).Theoperatorss7!snL,s7!s[`]modelrestrictionandrelabelling:<br />
Example4.1.1[Thecontrollersystem]Weconsiderasimplecontrollersystemofa 2L.s[`]behaveslikes<br />
cantestaproduct(viaanactioncalledtest).Weassumethatthereliabilityofthe productionisknown:withprobability1=100theproductfailsthetestinwhichcasethe productisreturnedtotheproductiondepartment(viaanactioncalledreturn);with plantthattestscertainproducts.Therearen\testingmachines"whereeachofthem<br />
probability99=100theproductpassesthetestinwhichcasetheproductistransmitted tothevendingdepartment(viaanactioncalledrelease).Eachofthetestingmachines canbespeciedbythePCCSprogram Thus,thecontrollersystem(withntestingmachines)isgivenby Testdef =test:h1 100ireturn:Test h99<br />
Pndef =Testk:::kTest100irelease:Test.<br />
Here,weuseprocessequationstodescribetheunderlyingdeclarationasexplainedon | {z n } :<br />
page73.<br />
versionin[Yi94]).Incontrasttoourapproach,[HaJo90]allow<strong>for</strong>generalprobabilistic choiceP[pi]si(whileweuseaction-guardedprobabilisticchoicea:(P[pi]si)).Forinstance, tothecalculus(alsocalledPCCS)of[HaJo90](seealso[Hans91,YiLa92]andtheextended Remark4.1.2[PCCSalaHansson&Jonsson]OurlanguagePCCSiscloselyrelated<br />
[HaJo90]allowstatementslikeh13ia:nilh23ib:nilwhichstands<strong>for</strong>aprocessthatoera thecalculusof[HaJo90].Viceversa,usingsimilarideasas<strong>for</strong>the\inference"fromactionlabelledstratiedsystemstoconcurrentprobabilisticsystems(seeRemark3.4.6,page55), respectively.Thus,syntactically,ourlanguagePCCScanbeviewedasasubcalculusof withprobability1=3andbwithprobability2=3andterminatesafterper<strong>for</strong>mingaorb<br />
thecalculusof[HaJo90]canbeembeddedsyntacticallyintooursbyintroducingaspecial actionsymbolarandom(whichrepresentsanyactivitythatresolvestheprobabilisticchoice, e.g.onemightthinkofarandomtostand<strong>for</strong>\tossingafaircoin")and<br />
Itshouldbenoticedthattheabovementioned\embeddings"areonlysyntactictrans- replacingXi2I[pi]sibyarandom: Xi2I[pi]si!: <strong>for</strong>mations.Eventhoughtheintendedmeaningsaresimilarthe<strong>for</strong>malsemanticsdonot
76 CHAPTER4.PROBABILISTICPROCESSCALCULI<br />
a: Za �!decl Xi2I[pi]si!a ifdecl(Z)a �!decl �!decl<br />
s1+s2a �!decl ifs1a �!decl where(s)=Xi2I ors2a �!decl si=spi<br />
s1ks2a (i) �!decl s1a �!decl1and ifoneofthefollowingthreeconditionsissatised: (s)=(1(s01):ifs=s01ks2<br />
(iii)a=andthereexists2Actnfgwith (ii)s2a �!decl2and (s)=(2(s02):ifs=s1ks02 0 :otherwise<br />
suchthat s1�!decl1ands2�!decl2<br />
snLa �!decl ifsa �!decl0,a=2Land(s)=(0(s0):ifs=s0nL (s)=( 0 1(s01) 2(s02):ifs=s01ks02 :otherwise<br />
s[`]a �!decl ifsb �!decl0,`(b)=aand(s)=(0(s0):ifs=s0[`] 0 :otherwise<br />
Figure4.2:OperationalsemanticsofPCCS:otherwise<br />
coincidesincetheinterpretationsof+andkaredierent.Whilewedealwithanoperationalsemanticsbasedonconcurrentprobabilisticprocesses[HaJo90]workwithanop probabilistictransitionsaredistinguished.Incontrasttoourrules<strong>for</strong>non-determinism parallelcompositionandinthestyleofSegala[Sega95a]whodenesaCSP-likeparerationalsemanticsbasedonthestratied(alternating)modelwhereaction-labelledand +orparallelcompositionk(whichareimmediatederivationsofMilner'srules<strong>for</strong>+and allelcomposition<strong>for</strong>concurrentprobabilisticsystems),therulesof[HaJo90]arebased onahigherpriority<strong>for</strong>theprobabilistictransitionsthantheaction-labelledtransitions.<br />
per<strong>for</strong>manaction-labelledtransitionunlessbothcomponentss1,s2haveresolvedtheir s1+s2rsthavetoper<strong>for</strong>mtheirprobabilistictransitionsbe<strong>for</strong>ethenon-determinism isresolved.Similarly,bytherulesof[HaJo90],theparallelcompositions1ks2cannot Intheapproachof[HaJo90],thesummandss1ands2ofthenon-deterministicchoice<br />
probabilisticchoices.
Operationalsemantics<strong>for</strong>PCCS:UsingtheclassicalSOS-stylealaPlotkin[Plot81], 4.1.PCCS:ANASYNCHRONOUSPROBABILISTICCALCULUS 77<br />
wegiveanoperationalsemantics<strong>for</strong>PCCSbasedonconcurrentprobabilisticprocesses withactionlabels.Letdeclbeadeclaration.Wedenethetransitionrelation�!decl StmtActDistr(Stmt)tobethesmallestrelationsatisfyingtherulesofFigure4.2on page76.Here,wewritesa processO[P]=(Stmt;Act;Stepsdecl;s)whereStepsdecl(s)=f(a;):sa assignstoeachPCCSprogramP=hdecl;sitheaction-labelledconcurrentprobabilistic �!declinsteadof(s;a;)2�!decl.Theoperationalsemantics<br />
s �!declg.<br />
nil23 b sa13b:nil<br />
? s0<br />
����@@@R nil23 sa a<br />
b���13�<br />
@@@R ����@@@Rb:nil Z"<br />
Figure4.3: a<br />
Example4.1.3TheoperationalsemanticsofthePCCSprogramhdecl;siwheres=<br />
Figure4.4(page78)showsthesemanticsoftheprogramhdecl;(s1ks2)nLiwhere a:h13ib:nilh23inil(andwheredeclisanarbitrarydeclaration)istheprocessshownon theleftofFigure4.3(page77).Thepictureontherightshowstheoperationalsemantics O[P0]oftherecursiveprogramP0=hs0;decl0iwheres0=s+Zanddecl0(Z)=a:Z.<br />
andL=f;;;g.t1k0t2standsshort<strong>for</strong>(t1kt2)nL.Thea-transitionofs1k0s2 s1=:h14i:nil h34i:nil, s2=:h13i:nil h23i:nil+a:nil<br />
s1k0s2canmakeana-movewheres1doesnotparticipate,i.e.doesnotchangeitslocal state.The-transitionofs1k0s2stands<strong>for</strong>thesynchronizationofand.Forinstance, representsthecasewherethea-transitionofs2ischosennon-deterministically.Thus,<br />
takeplace. withprobability1413=1 statess1k0nil,:nilk0:niland:nilk0:nilnoactionsarepossiblebecauseoftherestriction operatorwhileintheglobalstates:nilk0:niland:nilk0:nilfurthersynchronizations 12,s1movestothelocalstate:nilands2to:nil.Intheglobal<br />
Inwhatfollows,weidentifyeachprogramPwithitsoperationalmeaningO[P]andlift<br />
precisely,ifdeclisadeclarationthenwedenedeclandvdecl bisimulationequivalence beshownthatalloperatorspreservebisimilarityandthesimulationpreorder.More deneP P0iO[P] andthesimulationpreordervsimtoPCCSprograms.We<br />
bys O[P0]andPvsimP0iO[P]vsimO[P0].Itcaneasily<br />
=declor=vdecl decls0ihdecl;si sim.Then: hdecl;s0iandsvdecl sims0ihdecl;sivsimhdecl;s0i.Let simasbinaryrelationonStmt<br />
2.Ifs1s01ands2s02thens1+s2 3.Ifs1s01ands2s02thens1ks2 1.Ifsis0i,i2I,thena:(P[pi]si) a:(P[pi]s0i).<br />
4.Ifss0thens[`] s0[`].<br />
s01ks02. s01+s02.
78 CHAPTER4.PROBABILISTICPROCESSCALCULI<br />
s1k0s2 t :nilk0:nila<br />
s1k0nil<br />
:nilk0:nil 12 1 :nilk0:nil 16HHHHHHHHj 14 HHHHHHj<br />
? -12<br />
:nilk0:nil<br />
Figure4.4:Example<strong>for</strong>theoperationalsemanticsofaparallelPCCSprogram &- nilk0nil %<br />
Similarly,itcanbeshownthattheweakandbranchingbisimulationequivalencesof 5.Ifss0thensnL 6.Zdecl(Z) s0nL.<br />
Segala&Lynch[SeLy94]arepreservedbyalloperatorswiththeexceptionofthenon-<br />
Example4.1.4[Simpliedrepresentationofthecontrollersystem]Weconsider totheparallelcompositionkcanbederivedfromtheresultsof[Sega95a].5 deterministicchoiceoperator+.Thefactthattheserelationsarecongruenceswithrespect<br />
a\simpler"descriptionofthebehaviourofPnwithasmallerstatespace(whosesizeis notexponentialinthenumberoftestingmachines)onecanusecountersctest,creturnand 3nstates(aseachofthencomponentsTestisdescribedbythreestates).Inordertoget thecontrollersystemofExample4.1.1onpage75.ThestatespaceofO[Pn]consistsof<br />
creleasewherethevalueofthecountercagivesriseaboutthenumberoftestingmachines considerthePCCSprogramP0ndef thatareinthelocalstatewheretheactionahastobeper<strong>for</strong>mednext.Thatis,we P(m;k;l)def =Test(m;k;l)+Return(m;k;l)+Release(m;k;l) =P(n;0;0)where<br />
andTest(m;k;l) def =8>:test:h1 100iP(m�1;k+1;l)h99 :ifm100iP(m�1;k;l+1) Return(m;k;l)def =(return:P(m+1;k�1;l):ifk nil :otherwise<br />
11<br />
5Notethatourparallelcompositionissimilartotheoneintroducedin[Sega95a];theonlydierenceis Release(m;k;l)def =(release:P(m+1;k;l�1):ifl nil :otherwise. 1<br />
nizationoncomplementaryactionsthatweuse).commonactionsandindependentevolvementonallotheractions(ratherthantheCCS-stylesynchro-<br />
that[Sega95a]usesanothercommunicationmechanismwhichisbasedonCSP-stylesynchronizationon
Intuitively,therstcomponentmisthevalueofthecounterctest<strong>for</strong>thetestingmachines 4.2.PSCCS:ASYNCHRONOUSPROBABILISTICCALCULUS 79<br />
respectively.ItiseasytoseethatO[Pn] nentkandthethirdcomponentlstand<strong>for</strong>thevaluesofthecounterscreturnandcreleasethatareintheirinitialstate(i.e.thathavetotestaproduct)whilethesecondcompo- theexponential-largesystemO[Pn]tothepolynomial-largesystemO[P0n]. states.Thus,bythecompositionalityofbisimulationequivalence,<strong>for</strong>investigatingthe behaviourofthecontrollersystemPninanenvironment:::kPnk:::onecanswitchfrom O[P0n]andthatO[P0n]has(n+1)(n+2)=2<br />
4.2 ThespecicationlanguagePSCCSwasintroducedbyGiacalone,Jou&Smolka[GJS90] andlaterconsideredbyseveralauthors,e.g.[JoSm90,vGSST90,LaSk92].6PSCCSuses PSCCS:asynchronousprobabilisticcalculus<br />
eachofthecomponentss1ands2per<strong>for</strong>msexactlyonestep.Weassumeacommutative aSCCS-stylesynchronousparallelcompositions1s2wherealltransitionsoftheproduct andassociativefunctionAct ofthesimultaneousexecutionoftheactionsaandb.7IncontrasttoSection4.1(and s1s2arecomposedbyindividualmovesofs1ands2;moreprecisely,ineachstepofs1s2,<br />
thefollowingSection4.3)thespecialactionsymbol itmightbecontainedinActinwhichcaseitdoesnotplayadistinguishedroleandis Act!Act,(a;b)7!abwhereabstands<strong>for</strong>theresult<br />
treatedasanyotheraction. isnotneededhere.Nevertheless,<br />
givenbythegrammarshowninFigure4.5(page79).Here,Z2ProcVar,a2Act, SyntaxofPSCCS:LetProcVarbeasetofprocessvariables.PSCCSstatementsare<br />
s::=nilZ a:s Xi2I[pi]si s1 s2 snL s[`]<br />
and`:Act!Actisarelabellingfunction.StmtPSCCS(orshortlyStmt)denotesthe L Act,Iisacountableindexingset,piarerealnumberspi2]0;1]withPpi=1 Figure4.5:SyntaxofPSCCSstatements<br />
astatementanddecladeclaration(i.e.afunctiondecl:ProcVar!StmtPSCCS). Theintendedmeaningsofinactionnil,prexinga:s,restrictionsnLandrelabellings[`] collectionofallPSCCSstatements.APSCCSprogramisapairP=hdecl;siwheresis<br />
per<strong>for</strong>mtheactionaiandbecomestiafterwardsi=1;2,thens1s2maymovetot1t2 areasinthecaseofCCSorPCCS.Pi2I[pi]simodelsprobabilisticchoice:ifsi,i2I,<br />
viatheactiona1a2.Inthesynchronousparallelcomposition(alsocalledproduct)s1s2, arepairwisedistinctthen,withprobabilitypi,P[pi]sibehavesassi.Forniteindexing setI=fi1;:::;ing,wealsowrite[pi1]:si1 :::[pin]sininsteadofPi2I[pi]si.Ifsimay<br />
sucestoassumethatiscommutativeandassociative.<br />
extensionofSCCSandtoavoidconfusionswiththelanguagePCCSconsideredinSection4.1. 6NotethatseveralauthorsusethenamePCCS<strong>for</strong>thatcalculuswhilewecallitPSCCSsinceitisan 7InSCCS[Miln83],(Act;)issupposedtobeanAbelianmonoidwithaunit1.Forourpurposes,it
80 CHAPTER4.PROBABILISTICPROCESSCALCULI<br />
Pdecl Pdecl(Z;a;t)=Pdecl(decl(Z);a;t);Pdecl(a:s;a;s)=1<br />
Pdecl(s1Xi2I[pi]si;a;t!=Xi2IpiPdecl(si;a;t) Pdecl(snL;a;tnL)=Pdecl(s;a;t)ifa=2L s2;a;t1 t2)= (b;c)2SynaPdecl(s1;b;t1)Pdecl(s2;c;t2) X<br />
Pdecl(s[`];a;t[`])= b2`�1(a)Pdecl(s;b;t) X<br />
theprobabilisticchoicesins1ands2aresupposedtoberesolvedcausallyindependently. Figure4.6:Equations<strong>for</strong>PdeclinthecaseofPSCCS<br />
actionbands2tomovetot2viaanactioncsuchthata=bc. obtainedbysumminguptheproductsoftheprobabilities<strong>for</strong>s1tomovetot1viaan Thus,theprobabilityofthetransitionofs1 s2tothestatet1 t2viatheactionais<br />
withinternalprobabilisticchoice(whichleadstoanotherinterpretationoftherestriction thefactthatwedonotallowsubstochasticstatesinfullyprobabilisticsystemsanddeal operator;cf.Remark4.2.4,page81){weprovidePSCCSwiththeoperationalgenerative OperationalsemanticsofPSCCS:Withslightdierences{thatmainlyarisesfrom<br />
semanticsof[GJS90,JoSm90,vGSST90].Forthis,wexadeclarationdeclanddene thetransitionprobabilityfunctionPdecl:StmtActStmt![0;1]astheleastfunction thatsatisestheequationsofFigure4.6onpage80.8Here,<strong>for</strong>a2Act,<br />
Example4.2.1WeconsidertherecursivePSCCSprogramhdecl;Ziwhere Syna=f(b;c)2Act Act:bc=ag:<br />
WegettheequationPdecl(Z;a;nil)=13Pdecl(Z;a;nil)+23whoseuniquesolutionis decl(Z)=h13iZ h23ia:nil.<br />
Pdecl(Z0;a;t)=Pdecl(Z0;a;t).Clearly,theleastsolutionis0.Hence,Pdecl(Z0;a;t)=0 FortherecursivePSCCSprogramhdecl;Z0iwheredecl(Z0)=Z0wegettheequation Pdecl(Z;a;nil)=1:<br />
<strong>for</strong>alla2Actandt2Stmt. ThesodenedtransitionprobabilityfunctionPdecl:Stmt substochasticwhichmeansthatthesumoftheprobabilities<strong>for</strong>theoutgoingtransitions theoreticarguments;seee.g.Propostion12.1.1onpage309.8TheexistenceofaleastfunctionsatisfyingtheequationsofFigure4.6followswithstandarddomain-<br />
Act Stmt![0;1]is
4.2.PSCCS:ASYNCHRONOUSPROBABILISTICCALCULUS 81<br />
s1<br />
00,23 �����@@@@R 0,1 a,13 s1s2<br />
nil 0 nilnil 0,23 ����ac,14 ab,1<br />
0,1 HHHHHj H HH?<br />
12<br />
ofacertainstatementmightbearealnumberbetween0and1(ratherthan0or1). Figure4.7:Examples<strong>for</strong>theoperationalsemanticsofPSCCSprograms<br />
Pdecl(s1;b;t)=0if(b;t)6=(a;nil).Forthisreason,weintroduceanauxiliarystatement Forinstance,<strong>for</strong>thestatements1=h13ia:nilh23inilwehavePdecl(s1;a;nil)=1=3and 0thatdenotesinactionandaspecialactionsymbol0whichisneeded<strong>for</strong>modelling transitionsfromastates2Stmtto0.WedeneStmt0=Stmt[f0g,Act0=Act[f0g andextendPdecltoafunctionStmt0Act0Stmt0asfollows. Fors2Stmt,weputPdecl(s;0;0)=1�X<br />
<strong>for</strong>alla2Act0andt2Stmt0).TheoperationalsemanticsassignstoeachPSCCS andPdecl()=0inallremainingcases(e.g.Pdecl(s;0;t)=0ift2StmtorPdecl(0;a;t)=0 a2ActX t2StmtPdecl(s;a;t):<br />
Example4.2.2Theoperationalsemanticsofhdecl;s1iwheres1=h13ia:nil programP=hdecl;sithefullyprobabilisticprocessO[P]=(Stmt0;Act0;Pdecl;s). theprocessshownontheleftofFigure4.7onpage81.Thepictureontherightshowsthe operationalsemanticsofhdecl;s1s2iwheres1isasbe<strong>for</strong>eands2=h14ib:nilh34ic:nil. h23inilis Inbothcases,declisanarbitrarydeclaration.<br />
andruleslike probabilityfunctionPdecl.Someauthors,e.g.[vGSST90],useindices<strong>for</strong>thetransitions Remark4.2.3Thereareseveralpossibilities<strong>for</strong>a<strong>for</strong>maldenitionofthetransition<br />
fromwhichthetransitionprobabilityfunctionPdeclcanbederivedby ifsja[p] �!kt<strong>for</strong>somej2IthenXi2I[pi]sia[p] �!j:kt<br />
Otherauthors,e.g.[JoSm90,Toft94],usemultisetsoftransitions.However,theresulting Pdecl(s;a;t)=Xj p:sa[p] �!jt:<br />
semanticsO[P]doesnotdependonthechosenway<strong>for</strong>deningthetransitionprobability functionPdecl. Remark4.2.4[Internal,externalprobabilisticchoiceandrestriction]OurinterpretationofrestrictionsnLdiersfromthosein[GJS90,JoSm90,vGSST90](wherethe syntaxsdAinsteadofsnLwhereL=ActnAisused).Intherule<strong>for</strong>snL,theyuse
82 anormalizationfactor(theprobabilityPdecl(s;ActnL)<strong>for</strong>statestoper<strong>for</strong>manaction CHAPTER4.PROBABILISTICPROCESSCALCULI<br />
a2ActnL).Theirrule<strong>for</strong>therestrictionoperatorleadstotheequation<br />
(providedthatPdecl(s;ActnL)>0).Thus,theydealwiththeconditionalprobabilities Pdecl(snL;a;tnL)= Pdecl(s;ActnL) Pdecl(s;a;t)<br />
<strong>for</strong>the(ActnL)-labelledtransitionsofsundertheassumptionthatsper<strong>for</strong>msanaction fromActnL.Incontrasttothis,inourapproachthevaluePdecl(s;ActnL)representsthe probabilityofdeadlockinsnLthatresultsfromtherestriction(butnotfromadeadlock<br />
wedealwiththetransitionprobabilitiesPdecl(s;b;nilnfag)=Pdecl(s;0;0)=1=2while ins).Forexample,<strong>for</strong>thestatement s=tnfagwheret=h12ia:nil h12ib:nil<br />
anexternalprobabilisticchoiceoperatorwheretheprocessrandomlychoosesoneofthe eventsoeredbyenvironment.Hence,<strong>for</strong>thestatementtofabove,iftheenvironment oersaandbthenaandbarechosenwithequalprobabilitywhile,<strong>for</strong>anenvironmentthat Pdecl(s;b;nilnfag)=1intheapproachsof[GJS90,JoSm90,vGSST90]thatfocuson<br />
justoersb(butnota),theactionbwillbeper<strong>for</strong>med(withprobability1).Incontrastto areresolvedindependentlyontheenvironment.Thus,inourapproach,ifjustbisavailable whiletiswillingtoper<strong>for</strong>maandbwithequalprobabilitytheneitherbwillbeper<strong>for</strong>med this,weassumeaninternalprobabilisticchoiceoperatorwheretheprobabilisticchoices<br />
probability1/2. (iftherandomizedchoiceselectsb)oradeadlockoccurs(ifaisselected),bothwith Besidetheuseofanotherprobabilisticchoiceoperator,severalothervariantsoftheoperationalsemanticsarepossibleandmightbeusefulincertainapplications. nilasawell-terminatedprocessthenonecanuseanauxiliarystatement(e.g.exit), Wedonotdistinguishbetweenwell-terminationanddeadlock.Ifonewantstoconsider insteadofPdecl(nil;0;0)=1.Then,the0-labelledtransitionsto0(thatmightarise anewactionsymbol(e.g.p)andthetransitionprobabilitiesPdecl(nil;p;exit)=1<br />
ins1s2occursifitoccursinoneofthecomponentss1ors2.Alternatively,onecould Anotherpossiblevariantconcernstherule<strong>for</strong>theproduct.Inourapproach,adeadlock transitionstoexitrepresentwell-termination. fromtherestrictionoperatororrecursion)representdeadlockwhilethep-labelled<br />
allowthenon-deadlockedcomponenttoper<strong>for</strong>mfurtheractionsevenifadeadlockhas componentswhiles1 theactionp)andviceversa. canuserulestospecifythatadeadlockins1 occurredintheothercomponent.If0-labelledandp-labelledtransitionsareused,one s2behavesass1ifs2haswell-terminated(i.e.hasper<strong>for</strong>med s2occursiitoccursinoneofthe<br />
asinthecaseofPCCS(seepage77).Then,declandvdecl toalloperatorsofPSCCS.Thisresult<strong>for</strong>bisimulationequivalencedeclwasestablished byJou&Smolka(cf.Lemma4.1in[JoSm90]).Thecongruenceproof<strong>for</strong>vdecl Forxeddeclarationdecl,wedenetherelationsdeclandvdecl simarecongruenceswithrespect sim<strong>for</strong>PSCCSstatements<br />
vericationandomittedhere.<br />
simisaneasy
4.3.PLSCCS:ALAZYSYNCHRONOUSCALCULUS 4.3 PLSCCS:alazysynchronouscalculus 83<br />
onallvisibleactionswhiletheinternalactionsareexecutedindependently. sition.InthelazyproductP1P2,theprocessesP1andP2are<strong>for</strong>cedtosynchronize Inthissectionweproposeanewcalculus,calledPLSCCS,whicharisesfromPSCCSby replacingthesynchronousparallelcomposition byalazysynchronousparallelcompo-<br />
AsinthecaseofPCCS,weassumeaspecialactionthatdenotesanyinternalorinvisible<br />
somevisibleactions.Inotherwords,eachstepofs1s2iscomposedbysequencesofsteps s2mayper<strong>for</strong>marbitrarymanyinternal-stepsindependentlybe<strong>for</strong>etheysynchronizeon (i.e.istreatedasanyotheraction),inthelazyproducts1s2,thecomponentss1and computation.Whiledoesnotplayadistinguishedroleintheproducts1s2ofPSCCS<br />
ofs1ands2,whereeachofthemstartswithanarbitrarynumberofinternalactionsand endsupwithavisibleaction.AsinthecaseofPSCCS,theprobabilisticchoicesofthe componentsaresupposedtobeindependent.Hence,theprobabilities<strong>for</strong>thetransitions ofs1s2aregivenbytheproductoftheindividualprobabilitieswherewedealwiththe<br />
4.8(page83).Here,Z2ProcVar,a2Act,L cumulativeeectofthe-transitions. SyntaxofPLSCCS:PLSCCSstatementsaregivenbythegrammarshowninFigure Actnfg,Iisanonemptycountable<br />
s::=nilZ a:s Xi2I[pi]si s1 s2 snL s[`]<br />
indexingset,piarerealnumberspi2]0;1]withPpi=1and`:Act!Actisa relabellingfunctionwith`()=.StmtPLSCCS(orshortlyStmt)denotesthecollection Figure4.8:SyntaxofPLSCCSstatements<br />
meaningsofnil,theprexoperatora:s,theprobabilisticchoiceoperatorP[pi]si,the ofallPLSCCSstatements.PLSCCSdenotesthesetofallPLSCCSprograms,i.e.pairs P=hdecl;siconsistingofadeclarationdeclandaPLSCCSstatement.Theintended restrictionoperatorsnLandtherelabellingoperators[`]areasinthecaseofPSCCS (seepage79).Forthelazyproducts1 (Actnfg)(Actnfg)!Act;(;)7! s2,weassumeafunction<br />
where,asinthecaseofPSCCS, visibleactions and.Notethat stands<strong>for</strong>theresultofthesynchronizationonthe = ispossible.Eacha-labelledtransitionof :<br />
thatarelabelledbystringsofthe<strong>for</strong>m probabilityofs1 thelazyproducts1 ofthesynchronizedexecutionofthevisibleactions s2iscomposedbysequencesofstepsofthecomponentss1ands2 and respectivelysuchthataistheresult<br />
ofvisibleactionssuchthat probabilitiesProb(s1; s2tomoveviatheactionatot1 ;t1)Prob(s2; =a.9 ;t2)where(;)rangesoverallpairs(,) and t2isgivenbythesumoverall (i.e.a= ).Thus,the<br />
byendingupinthestatet(cf.Section3.3.1,page50).<br />
9RecallthatProbdecl(s; ;t)istheprobability<strong>for</strong>stoper<strong>for</strong>masequenceofinternalactionsfollowed
84 Operationalsemantics<strong>for</strong>PLSCCS:WesupplyPLSCCSwithanoperationalseman- CHAPTER4.PROBABILISTICPROCESSCALCULI<br />
(wheres,t2Stmtanda2Act)withthehelpofahigher-orderoperatoronthefunction spaceStmtActStmt![0;1].Forthedenitionofthesemanticsofthelazyproduct, adeclarationdecl:ProcVar!StmtanddenethetransitionprobabilitiesPdecl(s;a;t) ticsbasedonaction-labelledfullyprobabilisticprocesses.AsinthecaseofPSCCS,wex<br />
wehavetodealwiththeprobabilitiesProbdecl(s; ofstepslabelledbyastringof anddenethepairhPdecl;Qdecliastheleastpairoffunctions .Forthis,wedealwithanoperatoronfunctionpairs ;t)<strong>for</strong>stomovetotviaasequence<br />
and Qdecl:Stmt Pdecl:Stmt(Actnfg)Stmt![0;1] Act Stmt![0;1]<br />
PSCCSandextendthesodenedfunctionPdecl:Stmt:Act functionStmt0 thatsatisestheequationsofFigure4.9onpage85.10Weproceedasinthecaseof Act0 Pdecl(s;0;0)=1�X Stmt0.Fors2Stmt,weput Stmt![0;1]toa<br />
eachPLSCCSprogramP=hdecl;sitheaction-labelledfullyprobabilisticprocessO[P] anddenePdecl()=0inallremainingcases.11Theoperationalsemanticsassignsto a2ActX t2StmtPdecl(s;a;t)<br />
Lemma4.3.1Foralls,t2Stmtand =(Stmt0;Act0;Pdecl;s):LetProbdecldenotetheprobabilitymeasureintheaction-labelled fullyprobabilisticsystem(Stmt0;Act0;Pdecl).<br />
Proof: 3.3.4(page49). easyverication.UsesstructuralinductiononthesyntaxofsandProposition 2Act,Qdecl(s;;t)=Probdecl(s; ;t):12<br />
Corollary4.3.2Foralls1,s2,t1,t22Stmtanda2Act, Pdecl(s1 s2;a;t1 t2)= (;)2SynaProbdecl(s1; X<br />
Proof: followsimmediatelybyLemma4.3.1(page84). ;t1)Probdecl(s2; ;t2):<br />
RecallthatProbdecl(s; sequenceof'sfollowedby Corollary4.3.3Foralls1,s22Stmt, )=PtProbdecl(s; (cf.Section3.3.1,page50). ;t)istheprobability<strong>for</strong>stoper<strong>for</strong>ma<br />
Pdecl(s1 s2;0;0)=1�X12Act 16= X22Act 10AsinthecaseofPSCCS,theexistenceofaleastfunctionpairsatisfyingtheequationsofFigure4.9 26=Probdecl(s1; 1)Probdecl(s2; 2):<br />
canbederivedwithstandardmethodsofdomain-theory;seee.g.Remark12.1.2onpage309.<br />
hdecl;sitobehaveashdecl;tiafterper<strong>for</strong>mingasequenceofstepslabelledbyanelementof statement0areinterpretedasinthecaseofPSCCS.Seetheexplanationsonpage81. 12InthenotationsofSection3.3.1(page50),Probdecl(s; 11Here,Stmt0=Stmt[f0gandAct0=Act[f0gwherethenewactionsymbol0andtheauxiliary ;t)istheprobability<strong>for</strong>theprogram .
4.3.PLSCCS:ALAZYSYNCHRONOUSCALCULUS 85<br />
Pdecl(Z;a;t)=Pdecl(decl(Z);a;t);Pdecl(a:s;a;s)=1 Pdecl Pdecl(s1Xi2I[pi]si;a;t!=Xi2IpiPdecl(si;a;t) Pdecl(snL;a;tnL)=Pdecl(s;a;t)ifa=2L s2;a;t1 t2)= (;)2SynaQdecl(s1;;t1)Qdecl(s2;;t2) X<br />
Qdecl(s;;t)=Pdecl(s;;t)+X Pdecl(s[`];a;t[`])= b2`�1(a)Pdecl(s;b;t) X<br />
Figure4.9:Equations<strong>for</strong>PdeclandQdeclinthecaseofPLSCCS u2StmtPdecl(s;;u)Qdecl(u;;t):<br />
Proof: Example4.3.4WeconsiderthePLSCCSprogramsP1=hdecl;s1i,P2=hdecl;s2i wheredeclisanarbitrarydeclaration, followsimmediatelybyCorollary4.3.2(page84).<br />
<strong>for</strong>somesubsetLofActnfg.TheoperationalsemanticsofP1andP2areshownin s1=h12i:(nilnL) h12i:nilands2=::nil<br />
thenoersthesynchronizationon stepandthesynchronizationon,bothwithprobability1=2.Inthe<strong>for</strong>mercase,s1 Figure4.10(page86).Wenowinvestigatethelazyproducts1 that =.Inthelazyproducts1 whiles1choosesrandomlybetweentheinternal s2,s2rstper<strong>for</strong>msitsinternalstepand s2whereweassume<br />
programhdecl;s1 synchronizationon.Figure4.11(page86)showstheoperationalsemanticsofthe ands2cannotsynchronize,because,afterper<strong>for</strong>mingtheinternaltransition,s2waits <strong>for</strong>ever<strong>for</strong>thesynchronizationon.Inthelattercase,s1isidleuntils2oersthe andProbdecl(s2; 1�X12Act ;nil)=1.Thus,Pdecl(s1s2;;nilnil)=1=2.<strong>On</strong>theotherhand, s2i.Clearly,wehaveProbdecl(s1; ;nil)=Pdecl(s1;;nil)=1=2<br />
16= X22Act =1�Probdecl(s1; 26=Probdecl(s1; )Probdecl(s2; 1)Probdecl(s2; )=1�121=12<br />
2)<br />
whichyieldsPdecl(s1 Example4.3.5WeconsidertheprogramsQ1=hdecl;s1i,Q2=hdecl;s2iwhere s2;0;0)=1=2.<br />
s1=Z,decl(Z)=h13i:Z h13i::w h13i:v,s2=h14i::th34i:u.
86 CHAPTER4.PROBABILISTICPROCESSCALCULI<br />
nilnL ,12 s1 ,12<br />
0,1 nil<br />
0 0,1 0 nil<br />
s2<br />
���� @@@@R :nil,1<br />
? ,1<br />
0,1<br />
? @@@@R ����<br />
Figure4.10:TheoperationalsemanticsofPLSCCSprogramsP1andP2 ?<br />
00,12 ����s1s2 0,1@@@@R<br />
nilnil ,12<br />
Here,t,u,v,warepairwisedierentstatements.TheoperationalsemanticsofQ1and Figure4.11:<br />
Q2areshownininFigure4.12(page87)wheretheoutgoingtransitionsoft,u,vandw areomitted.WeconsiderthelazyproductQ1 Probdecl(s1; ;w)=Probdecl(s1; Q2.Wehave<br />
andProbdecl(s2; ;t)=1=4,Probdecl(s2; ;u)=3=4.Thus, ;v)=1=2<br />
Insomeapplications,itmightbehelpfultoworkwithaspecialvisibleidleaction, Pdecl(s1 s2; ;wu)=Pdecl(s1 ;wt)=Pdecl(s1 s2; ;vu)=38: ;vt)=18,<br />
Formally,werequirethatwaitisavisibleactionsuchthatwait processwait:tdoesnotinuencetherststep,eventhough<strong>for</strong>mally,itparticipatesby e.g.calledwait,bywhichaprocesscanbe<strong>for</strong>cedtobeidleinthenexttimestep.<br />
per<strong>for</strong>mingtheactionwait. 2Actnfg.Forexample,:swait:trstper<strong>for</strong>msandthenbehavesasst.I.e.the = wait=<strong>for</strong>all<br />
waits<strong>for</strong>themessagesbythesender).Thesenderworkswithanuncertainmedium Example4.3.6[ThecommunicationprotocolSender variantofthesimplecommunicationprotocolofExample1.2.2onpage20whichwe specifyasthelazyproductofasender(whotriestosendmessages)andareceiver(who Receiver]Weconsidera<br />
thatmightlosemessage(withprobability0.01).Ifthemessagegetslostthenthesender retriestodeliverthemessage.Incasewherethemessageisdeliveredcorrectly,the senderwaits<strong>for</strong>anacknowledgementofthereceipt.Forsimplicity,weassumethatthe
4.3.PLSCCS:ALAZYSYNCHRONOUSCALCULUS 87<br />
:w,13<br />
s1 ,13,13<br />
v<br />
w,1<br />
� ��� @@@@R<br />
? :t,14<br />
s2 ,34u<br />
t,1<br />
� ��� @@@@R<br />
Figure4.12:TheoperationalsemanticsofPLSCCSprogramsQ1andQ2 ?<br />
acknowledgementistransmittedbyasafemediumthatdoesnotloosemessages.The behaviourofthesendercanbespeciedusingprocessequationsasexplainedonpage73.<br />
Trytosenddef Lostdef Senderdef =produce:Trytosend<br />
Deliverdef =:Trytosend =deliver!:Wait<strong>for</strong>response =[0:01]Lost [0:99]Deliver<br />
Weusethevisibleactionsproduce(whichmeanstheactionbywhichthesendergenerates amessage),deliver!(theoutputactionbywhichthemediumtransmitsthemessage Wait<strong>for</strong>responsedef =wait:ack?:Sender<br />
tothereceiver),ack?(aninputactionthatdenotesthatthesendersenderreadsthe acknowledgement)andtheactionwaitthatisusedto<strong>for</strong>cethesendertobeidleinthe theactivitiesthatareneeded<strong>for</strong>preparingthenextattempttodeliverthemessage.The operationalsemanticsofthesenderisshowninFigure4.13(page87.)Thereceiveris stepwherethereceiverworksupthemessage.Theinvisibleactionisusedtodescribe<br />
Sender<br />
Trytosend produce,1<br />
,0:01' ?<br />
deliver!,0:99ack?:Sender ack?,1<br />
& Wait<strong>for</strong>responsewait,1<br />
6@@@@@R<br />
$<br />
6 6<br />
Figure4.13:Theoperationalsemanticsofthesender
88 speciedasfollows.Receiverdef<br />
CHAPTER4.PROBABILISTICPROCESSCALCULI<br />
Getmessagedef =wait:Getmessage<br />
Weusetheactionsdeliver?(theinputactionthatstands<strong>for</strong>thereceiptofthemessage), Acknowledgedef =ack!:Receiver =deliver?:consume:Acknowledge<br />
consume(anactionbywhichthereceiverworksupthemessageandproducestheacknowledgement),ack!(theoutputactionbywhichthereceiveracknowledgesthereceiptofthe generatesthenextmessage).Wesupposethatdeliver!deliver?=ack?ack!=.The message)andtheactionwait(whichensuresthatthereceiverisidlewhilethesender operationalsemanticsofSender SenderReceiver ReceiverisshowninFigure4.14(page88.)13<br />
TrytosendGetmessage produce,1 $<br />
?<br />
Wait<strong>for</strong>responseconsume:Acknowledge ? ,1 ,1<br />
ack?:SenderAcknowledge ? consume,1<br />
Figure4.14:TheoperationalsemanticsofSender Receiver %<br />
AsinthecasesofPCCSorPSCCS,weadaptbisimulationequivalence seethats1decls01,s2decls02impliess1 ulationpreordervsim<strong>for</strong>PLSCCSprogramsandstatementswhere,<strong>for</strong> wedeneP P0iO[P]O[P0]andsdecls0ihdecl;sideclhdecl;s0i.Itiseasyto andthesimlenceandthesimulationpreorderarecongruences<strong>for</strong>PLSCCS.InChapter7wedene<br />
s2decls01 s02.Thus,bisimulationequiva- 2f;vsimg,<br />
weakbisimulationequivalence<strong>for</strong>action-labelledfullyprobabilisticsystems<strong>for</strong>whichwe showthatitpreservesalloperatorsofPLSCCS(excepttheprobabilisticchoiceoperator). Thisalgebraicpropertyisespeciallyuseful,sinceitallowsonetoreplacecomponentsby equivalentonesthatareminimizedwithrespecttotheirinternalbehaviour.<br />
apathlabelledbyatraceofdeliver!is1.<br />
13Notethattheprobability<strong>for</strong>thesendertoreachthestateWait<strong>for</strong>responsefromTrytosendvia
Chapter5<br />
Denotationalmodels<br />
semanticsfocussesonthestepwisebehaviour,thedenotationalapproachisbasedon Therecenttrendinthesemanticsofprogramminglanguagesistoprovideaprogramminglanguagewithseveral(pairwise\consistent")semanticsthatdescribedierentviews, e.g.anoperational,adenotationalandalogicalbasedsemantics.Whiletheoperational<br />
parallelcompositionk).Anothercharacteristicfeaturesofdenotationalsemantics<strong>for</strong>procompositionality(i.e.theexistenceofsemanticoperators<strong>for</strong>modellingthesyntacticcon- thedenitionofthemeaningofrecursiveorrepetitiveprograms.Typically,thesexed structsofthelanguagesuchasnon-deterministicchoice+,sequentialcomposition;orgramminglanguageswithrecursionorrepetitionisatheuseofxedpointequations<strong>for</strong> orderormetric.Thus,denotationalsemantics,beingcompositional,providethetheory pointequationsaresolvedwiththehelpofTarski'sorBanach'sxedpointtheoremsin<br />
(inthepartialordersetting)orequality(inthemetricsetting)inthemodelprecisely whichcasesthesemanticdomainissupposedtobeequippedwithanappropriatepartial<br />
correspondstotheoperational(pre)orderorequivalence,thedenotationalsemanticscan provideadditionalinsightintothenatureofoperationalnotions,andeventuallyserveas thatunderpinssystemdecomposition;and,iffullyabstract,i.e.,iftheinherentorder<br />
anintermediatelinkbetweentheoperationalsemanticsandanappropriatelogic. Severalauthorsproposeddenotationalsemantics<strong>for</strong>probabilisticprocesscalculi(seeSection1.2.2,page23),butonlyafewoftheminvestigatetheissueoffullabstractionwith respecttoanoperationalnotionof\processequality".Inthecontextofprobabilistic processcalculiwithrecursion,denotationalmodelsandrelatedfullabstractionresults arepresented<strong>for</strong>testing[Chri90a,Chri90b,Norm97,KwNo98a,KwNo98b]andfailure [MMS+94]equivalence.Tohandlerecursiveprocesses,Morganetal[MMS+94]usethe standardpartialorderapproach<strong>for</strong>establishingdenotationalleastxedpointseman-<br />
avariantofthestandardmetricdenotationalapproachanddenethesemanticsasthe ceptancetrees.Kwiatkowska&Norman[KwNo96,Norm97,KwNo98a,KwNo98b]use[Henn88]andmodelsrecursionbyequationsaslabellings<strong>for</strong>thebranchesintheseactics.Christo[Chri90a,Chri90b]dealswithavariantofacceptancetreesalaHennessy limitofaCauchysequenceinacompletemetricspace. BasedonthejointworkwithMartaKwiatkowska[BaKw97],thischapterpresentsa thatarefullyabstractwithrespecttobisimulationandsimulation.Fullabstractionof method<strong>for</strong>providingdenotationalsemantics<strong>for</strong>probabilisticcalculilikePCCSorPSCCS<br />
89
90 adenotationalsemanticsDwithrespecttobisimulationmeansthatDidentiesexactly CHAPTER5.DENOTATIONALMODELS<br />
thoseprogramsthatarebisimilar,i.e.D[P]=D[P0]iP Thepartialorderapproachisusedtoobtainafullyabstractdenotationalsemantics withrespecttosimulationmeansthatthesemanticdomain(therangeofD)isequipped withanordervthatreectsthesimulationpreorder,i.e.D[P]vD[P0]iPvsimP0. P0whilefullabstraction<br />
bisimulation. Asinthenon-probabilisticcase(e.g.[dBaZu82,GoRo83,dBaMe88,Abra91,RuTu93, withrespecttosimulation;themetricsettingtoobtainfullabstractionwithrespectto<br />
cessPwithadistributionspectivelyareobtainedbyapplyingstandardcategoricalmethods<strong>for</strong>solvingrecursivedomainequations.1ThemainideaofthefullyprobabilisticcaseistoidentifyeachproBai97])thesemanticdomainsIDandIMofthepartialorderandmetricsemanticsre- Thisleadstorecursiveequationsofthe<strong>for</strong>m and(a;Q)theprobability<strong>for</strong>Ptoper<strong>for</strong>mtheactionaandtobehaveasQafterwards. onpairs(a;Q)whereaisanactionlabel,Qisaprocess<br />
<strong>for</strong>thesemanticdomainX.2Here,0isaspecialsymboltodenoteinaction(i.e.aprocess likenilthatdoesnotper<strong>for</strong>manyaction).Thecentralideaintheconcurrentcaseisto X=f0g[Distr(Act X)<br />
representaprocessPbyasetofpairs(a;)consistingofanactionaandadistribution alternative.Fromthis,weobtaindomainequationsofthe<strong>for</strong>m onprocesseswhereeachelement(a;)ofthatsetrepresentsanon-deterministic<br />
wherePow()denotesasuitablepowerdomainconstructionandwhereinactionismodellede.g.by;.Un<strong>for</strong>tunately,inbothcasestheequationcannotbesolvedwiththestan X=Pow(Act Distr(X))<br />
dardmethodsof[SmPl82,AbJu94]or[AmRu89,MaZe91,RuTu93]<strong>for</strong>solvingrecursivedomainequationsinthepartialorderormetricapproachrespectivelysincethedistributionoperatorX7!Distr(X)failsthenecessaryconditionofpreservingcompleteness.3 Nevertheless,theequationsX=f0g[Distr(ActX)andX=Pown(ActDistr(X)) havenalsolutionsinSET,thecategoryofsetsandfunctions,whichyieldsnalse-<br />
Inordertoobtainfullyabstractdenotationalmodelsthatcanserveassemanticdomains manticsinthesenseofRutten&Turi[RuTu93]thatarefullyabstractwithrespectto bisimulation.4 <strong>for</strong>providingdenotationalsemanticsinthemetricorpartialorderframeworkweswitch fromDistr()totheprobabilisticpowerdomainEval()ofevaluationsinthesenseofJones<br />
allevaluationson()coversDistr().Wesolvedomainequationsofthe<strong>for</strong>m toelements,theevaluationsdecoratesetswith\probabilities"(valuesin[0,1]).Inour cases,wheretheunderlyingdomainisametricspaceorpartialorder,thesetEval()of &Plotkin[JoPl89](cf.Section12.1.4,page313).Whiledistributionsassignprobabilities<br />
3SeeRemark5.1.13(page95)andRemark5.1.18(page97). 1Therecursivedomainequationsreectthecoinductivenatureofbisimulationandsimulation. 2RecallthatDistr()denotesthesetofdistributionson().SeeSection2.2(page30). X=f0g[Eval(Act X)andX=Pow(Act Eval(X))<br />
4Here,Pown()denotesthecollectionofnitesubsetsof().
5.1.DENOTATIONALMODELS:CONCURRENTCASE whereweapplythemethodofAbramsky&Jung[AbJu94]inthepartialorderapproach 91<br />
andthemethodofRutten&Turi[RuTu93]inthemetricsetting.TheresultingdomainsIDandIMareshowntobeinternallyfullyabstractwithrespectto(bi-)simulation whichmeansthattheinherentorderonIDagreeswiththesimulationpreorderandthat bisimulationequivalencecoincideswiththeequalityonIM.Usingthestandardprocedurestogivedenotationalsemanticsinthepartialorderandmetricapproachweobtain denotationalsemanticsonIDandIMandthedesiredfullabstractionresults.<br />
(seeSection4.1,page74)whereweshrinkourattentiontonitelybranchingsystems.5 Theresults<strong>for</strong>thefullyprobabilisticcaseandPSCCS(seeSection4.2,page79)are complicate)caseofconcurrentprobabilisticprocessesindetailandthelanguagePCCS Organizationofthatchapter:InSection5.1weconsiderthe(moreinterestingand<br />
tional(leastxedpointormetric)semanticsandcategoricalmethods<strong>for</strong>solvingrecursive summarizedinSection5.2.<br />
domainequations.Themathematicalpreliminariesthatareneededinthischaptercan befoundintheappendix(Sections12.1.1,12.1.2,12.1.3and12.1.4;seepage307). Inthischapter,thereaderissupposedtobefamiliarwiththebasicconceptsofdenota-<br />
Moreover,thereadershouldrecallthenotationsthatweuse<strong>for</strong>distributionsandweight functions(Section2.2,page30).<br />
Wetakeasbasisnitelybranchingaction-labelledconcurrentprobabilisticprocessestogetherwiththebisimulationequivalence(Denition3.4.3,page54)andthesimulation 5.1 Denotationalmodels:concurrentcase<br />
withnon-determinism,probabilisticchoiceandrecursion(suchasPCCS).Westartwith theequationX=Pow(Act semanticdomainswhichcanserveasfullyabstractdenotationalmodels<strong>for</strong>languages preorder(Denition3.4.9,page56).First,weturnourattentiontotheconstructionof<br />
semantics"inthesenseof[RuTu93](seeSection5.1.1).Then,takingthedomainequations<strong>for</strong>non-probabilisticprocessesasbasis,wederivedomainequationsinvolvingthe probabilisticpowerdomainofevaluationswhich{whensolvedrespectivelyinappropriate Distr(X))thatwesolveinSETandthatyields\nal<br />
fullyabstractsemanticdomains,weusethestandardprocedures<strong>for</strong>establishingdenota- probabilisticprocessesthatareinternallyfullyabstractwithrespecttosimulationand bisimulationrespectively(seeSections5.1.2and5.1.3).Havingobtainedtheseinternally categoriesofpartiallyorderedsetsormetricspaces{giverisetosemanticdomains<strong>for</strong><br />
tionalsemanticsondcpo'sandcompletemetricspacesandobtaindentationalsemantics <strong>for</strong>PCCSthatareshowntobefullyabstractwithrespecttobisimulationandsimulation respectively(seeSection5.1.4). Simpliednotations:Intheremainderofthissectionwedealwithnitelybranch-<br />
systems/processesofthe<strong>for</strong>m(S;Act;Steps)or(S;Act;Steps;s). ingaction-labelledconcurrentprobabilisticsystemsorprocesseswithactionlabelsofatemsorprobabilisticprocessesratherthannitelybranchingaction-labelledconcurrentxednitenonemptysetAct.Forsimplicicity,webrieyspeakaboutprobabilisticsys- choice)alwaysyieldsanitelybranchingprocess.<br />
5Notethattheoperationalsemantics<strong>for</strong>PCCS(whichdoesnotallow<strong>for</strong>unboundednon-deterministic
92 5.1.1 ThedomainIP CHAPTER5.DENOTATIONALMODELS<br />
SETyieldsacharacterizationof\action-labelledtrees"[Barr93,RuTu93,Bai97].These canbeviewedascanonicalrepresentativesofthebisimulationequivalenceclassesof(nonprobabilistic)nitelybranchinglabelledtransitionsystemswithactionlabelsinAct. Inthenon-probabilisticcase,thenalsolutionoftheequationX=Pown(ActX)in<br />
Here,Pown()denotesthecollectionofnitesubsetsof().Weadaptthisidea<strong>for</strong><br />
Notation5.1.1[ThedomainIP]LetIPbethesetofbisimulationequivalenceclasses theprobabilisticcaseandshowthatthebisimulationequivalenceclassesofprobabilistic processes<strong>for</strong>mthenalsolutionofthedomainequationX=Pown(Act ofprobabilisticprocesses.6 Distr(X)).<br />
bilisticprocess,[P]denotesthebisimulationequivalenceclassofP.Notation5.1.2[Thebisimulationequivalenceclasses[P]]ForPtobeaproba- WeusesymbolslikeT;T0;T1;T2;:::torangeobertheelementsofIP.<br />
Notation5.1.4[TheelementsTA]LetP=(S;Act;Steps;s)beaprobabilisticprocess andt2S.Then,Ptdenotestheprobabilisticprocess(S;Act;Steps;t). Notation5.1.3[TheprocessPt]LetP=(S;Act;Steps;s)beaprobabilisticprocess<br />
andA2S=.LetTAbetheuniqueelementofIPwithTA=[Pt]<strong>for</strong>all(some)t2A. WeassociatewithIPtheprobabilisticsystemS(IP)=(IP;Act;StepsIP)where<br />
wheref:S!IPisgivenbyf(t)=[Pt].Hence,ifTisthebisimulationequivalence classofP=(S;Act;Steps;s)(i.e.T=[P])thenTa StepsIP([P])=f(a;Distr(f)()):(a;)2Steps(s)g:<br />
followinglemmaanditscorollaryshowthat<strong>for</strong>eachprobabilisticprocessP,[P](viewed sa eachelementTofIPisidentiedwiththeprobabilisticprocess(IP;Act;Steps;T).The �!with(TA)=[A]<strong>for</strong>allbisimulationequivalenceclassesA2S=.Inthesequel, �!ithereexistsatransition<br />
asaprobabilisticprocess)istheuniqueelementofIPwhichisbisimilartoP. Lemma5.1.5LetP,P0beprobabilisticprocesses. (a)P (b)P (c)PvsimP0ifandonlyif[P]vsim[P0] P0ifandonlyif[P]=[P0] [P]<br />
().(c)followsby(a)andpart(c)ofLemma3.4.14(page59).Weshow(a).Let Proof: 6InordertoseethatIPisreallyasetconsideraxedsetStatesofcardinality!anddeneIPtobe (b)isclearsince[]isdenedtobethebisimulationequivalenceclassof<br />
representsallbisimulationclassesofprobabilisticprocesses.Notethatthesetofstatesswhichcanbe thesetofbisimulationequivalenceclassesofprobabilisticprocesseswhosestatesbelongtoStates.Then, reachedfromtheinitialstateisalwayscountable.RecallthatweassumeaxednitesetActofactions andthatweonlyconsidernitelybranchingprocesses.<br />
eachprobabilisticprocessisbisimilartosomeprobabilisticprocesswhosestatesbelongtoStates.I.e.IP
5.1.DENOTATIONALMODELS:CONCURRENTCASE P=(S;Act;Steps;s)andR=f(t;[Pt]):t2Sg.WeshowthatRfulllstheconditions 93<br />
toseethat ofProposition3.4.4(page54).7Letf:S!IPbeasbe<strong>for</strong>e(i.e.f(t)=[Pt]).Itiseasy<br />
-If[Pt]a -Ifta �!then[Pt]�!Distr(f)().<br />
f(t)=[Pt]<strong>for</strong>allt2S.Inparticular,witht=s,weobtainP ByRemark2.2.3(page31), �!then=Distr(f)()<strong>for</strong>sometransitionsa RDistr(f)().ByProposition3.4.4(page54),Pt �!.<br />
T,T02IP:T Corollary5.1.6IPisinternallyfullyabstractwithrespecttobisimulation,i.e.<strong>for</strong>all T0iT=T0. [P].<br />
T=[P]=[P0]=T0. Proof: (a)ofLemma5.1.5,T LetP,P0beprobabilisticprocesswithT=[P],T0=[P0].Then,bypart<br />
NextweshowthatIPisanalsolutionoftheequationX=Pown(ActDistr(X))in PandT0 P0.Hence,T T0impliesP P0,andthere<strong>for</strong>e<br />
SET. Theorem5.1.7IPisthenalcoalgebra(andhencethenalxedpoint)ofthefunctor PownFActDistr:SET!SET.8<br />
whereweputSteps(y)=f(y).Hence,ya Proof: i.e.f:Y!F(Y)isafunction.WeassociatewithYaprobabilisticsystem(Y;Act;Steps) f(a;):Ta �!g.Then,(IP;e)isacoalgebraofF.Let(Y;f)beacoalgebraofK, LetF=PownFActDistr.Wedenee:IP!F(IP)bye(T)=<br />
ofFasafunctionY!IPsatisfyingF(F)f=eF.WheneverF0:Y!IPisa functionF:Y!IP,F(y)=[Py]satisesF(F)f=eF.Weshowtheuniqueness functionwithF(F0)f=eF0thenweshowthatR=f(y;F0(y)):y2Ygsatisesthe �!i(a;)2f(y).Itiseasytoseethatthe<br />
conditionsofProposition3.4.4(page54).9Itiseasytoseethat -Ifya -IfF0(y)a �!thenF0(y)a �!thenya �!Distr(F0)().<br />
Lemma5.1.5andCorollary5.1.6,F0(y)=[Py]<strong>for</strong>ally2Y.Hence,F=F0. ByRemark2.2.3(page31), �!<strong>for</strong>some2Distr(Y)where=Distr(F0)().<br />
SinceIPisthenalcoalgebrawegetanalsemanticsinthesenseofRutten&Turi RDistr(F0)().Thus,Py F0(y)<strong>for</strong>ally2Y.By<br />
[RuTu93].Let(S;Act;Steps)beaprobabilisticsystem.Then,(S;f)isacoalgebraof<br />
Lemma5.1.5(page92),thenalsemanticsisfullyabstractinthesensethatitidenties wesawintheproofofTheorem5.1.7,F(s)=[Ps]wherePs=(S;Act;Steps;s).By F=PownFActDistrwheref:S!F(S)isgivenbyf(s)=f(a;):sa nalsemanticsF:S!IPisdenedastheuniquefunctionwithF(F)f=eF.As �!g.The<br />
twostatesitheyarebisimilarandthatitpreservesthesimulationpreordervsim.<br />
SET!SETwhichassignstoeachsetXthesetActX(seepage312)andthefunctorPown:SET! asdescribedonpage61). 8RecallthedenitionsofthedistributionfunctorDistr:SET!SET(page312),thefunctorFAct: 7Here,Risviewedasabinaryrelationonthestatespaceofthecomposedsystem(whichisdened<br />
asdescribedonpage61).<br />
SETwhichassignstoeachsetXthesetPown(X)ofnitesubsetsofX(seepage312). 9Here,Risviewedasabinaryrelationonthestatespaceofthecomposedsystem(whichisdened
94 Example5.1.8WeconsidertheprocessesPandP0ofFigure3.6onpage57.(I.e.P CHAPTER5.DENOTATIONALMODELS<br />
andP0aretheprocesseswithinitialstatesands0respectively.)Thenalsemantics[P] and[P0]ofPandP0(aselementsofIP=Pown(Act where(T)=1=3,(;)=2=3,0(T)=0(;)=1=2andT=f(b;1;)g. [P]=f(a;)gand[P0]=f(a;0)g Distr(IP)))are<br />
5.1.2 Weaimatsolvingarecursivedomainequationofthe<strong>for</strong>mD=Pow(ActEval(D))in anappropriatecategoryofdcpo's.ThereasonnottodealtheequationD=Pow(Act ThesemanticdomainID<br />
Distr(D))isthatthedistributionfunctorDistrdoesnotpreservecompletenessofpartially orderedsets(cf.Remark5.1.13,page95),andhence,fails<strong>for</strong>thestandardmethods powerdomainPow()shouldbeused.Wefollowtheideasofthenon-probabilisticcase <strong>for</strong>solvingrecursivedomainequations<strong>for</strong>dcpo's.Firstweturntothequestionwhich wheretheinitialsolutionofthedomainequation<br />
yieldsasemanticdomainthatisinternallyfullyabstractwithrespecttothesimulation preorder[Bai97].10Notethattheauxiliaryelement?isneededasAct D=PowHoare(f?g[Act D)<br />
dcpo(becauseitdoesnothaveabottomelement).Inaction(nil)isthenmodelledbythe adaptthisideaanddealwiththeequation setf?g,thebottomelementinPowHoare(f?g[Act D).Intheprobabilisticcase,we Dfailstobea<br />
continuousfunctions(seepages308and311)andofthelocallyd-continousfunctorsRecallthedenitionsofthecategoryCONT?ofcontinuousdomainsandstrictandd- D=PowHoare(f?g[Act Eval(D)):<br />
Eval:CONT?!CONT?whichassignstoeachcontinuousdomainDthepowerdomain Eval(D)ofevaluationsonD(seepage314),PowHoare:CONT?!CONT?(seepage 308)andFcont domainf?g[Act CONT?ofcontinuousdomains(alternatively,wecouldworkwiththelargercategory DCPO?ofdcpo'sandstrictandd-continuousfunctions).Forthis,wehavetoshowthe Act:CONT?!CONT?whichassignstoeachcontinuousdomainDthe<br />
locald-continuityoftheassociatedfunctorPowHoareFcont D(seepage312).Wesolvetheaboveequationinthecategory<br />
d-continuous. Lemma5.1.9ThefunctorFcont=PowHoareFcont ActEval:CONT?!CONT?islocally Act Eval.<br />
Notation5.1.10[ThedomainID]IDdenotestheinitialxedpointofFcont.11 Proof: followsfromthelocald-continuityofEval,Fcont ActandPowHoare.<br />
Inwhatfollows,wedealwiththeisomorphismasanequality,i.e.if(ID;j)istheinitial xedpointofFcontthenwesupposeID=Fcont(ID)andj=idID.Notethatthepartial 11Bytheresultsof[AbJu94](seepage311),Fconthasaninitialxedpoint.<br />
10Here,PowHoare()denotestheHoarepowerdomain(cf.Section12.1.1,page308).
5.1.DENOTATIONALMODELS:CONCURRENTCASE orderonIDistheinclusion.Thebottomelement?IDinIDisf?gwhere?denotesthe 95<br />
thentheleastupperboundFxiis(Sxi)cl,theScott-closureofSxiinf?g[ActEval(ID). Acl bottomelementinf?g[Act IfA,Barenitesubsetsoff?g[Act Eval(ID).If(xi)i2IisadirectedfamilyofelementsinID<br />
Thedesiredinternalfullabstractionresult<strong>for</strong>IDstatesthat(insomesense)theinherent BclifandonlyifAvLBwherevLdenotesthelowerpreorder.12 Eval(ID)thentheScott-closureAcl=A#and<br />
orderonID(i.e.theinclusion)\reects"thesimulationpreorder.Forthis,weshowthat IP(togetherwiththepreordervsim)canbeembeddedintoIDviaafunction{ID:IP!ID<br />
Distr(D)andEval(D)thathold<strong>for</strong>anydcpoD:Distr(D)equippedwiththeweight- suchthatTvsimT0i{ID(T) thisfullabstractionresultisTheorem5.1.12whichassertsageneralconnectionbetween simulationequivalenceclassesofprobabilisticprocesses.Thebasiclemma<strong>for</strong>theproofof {ID(T0).Thus,thesubspace{ID(IP)ofIDrepresentsthe<br />
function-basedpreordersim(asdenedinNotation5.1.11)isasubspaceofEval(D);in particular,Theorem5.1.12yieldsthatsimisapartialorderonDistr(D). Notation5.1.11[Thepartialordersim]LetDbeapartiallyorderedset(withpartialorderv)and,02Distr(D).Then, Thefollowingtheoremshowsthat,<strong>for</strong>eachdcpoD,thesetDistr(D)equippedwiththe (;0)withrespecttov.13 sim0ithereexistsaweightfunction<strong>for</strong><br />
functionDistr(D)!Eval(D), ordersimcanbeviewedasasubspaceofEval(D).Moreprecisely,weshowthatthe<br />
Theorem5.1.12IfDisadcpothensimisapartialorderonDistr(D).Moreover,<strong>for</strong> canbeidentiedwiththeevaluationE.14 7!E,isorder-preserving.Thus,eachdistribution<br />
all,02Distr(D), Proof: seeSection5.3,Theorem5.3.2(page105)andCorollary5.3.4(page109). sim 0iEvE0.<br />
equippedwiththeprexordering.Letkbethedistributionwith Remark5.1.13[IncompletenessofDistr(D)]Ingeneral,Distr(D)isnotcomplete. ConsiderthedcpoD=f0;1g1ofall(niteorinnite)wordsbuiltfrom0and1<br />
Itiseasytoseethat(k)k1isamonotonesequenceinDistr(D)whichdoesnothavean upperboundinDistr(D).Inordertoseethatkvsim k(x)=(1=2k:ifxisawordoflengthk 0 :otherwise.<br />
weightonD andweight(x;y)=0inallothercases. Dwithweight(x;x0)=weight(x;x1)=1=2k+1ifxisawordoflengthk k+1considerthedistribution<br />
UsingTheorem5.1.12wecanshowthefollowingconnectionbetweenIPandID. Theorem5.1.14Thereexistsauniquefunction{ID:IP!IDsuchthat<br />
thatxvy.Here,vdenotestheorderonf?g[ActEval(ID). 13Notethatsim=v(withthenotationsofSection2.2,page30). 12RecallthatthatthelowerpreorderisgivenbyAvLBi<strong>for</strong>allx2Athereexistsy2Bsuch {ID(T)=n(a;EDistr({ID)()):Ta �!ocl:<br />
14RecallthatEisgivenbyE(U)=[U],seepage313.
96 Moreover,<strong>for</strong>allT,T02IP,TvsimT0i{ID(T) CHAPTER5.DENOTATIONALMODELS<br />
ThenalsemanticsofSection5.1.1(page93)yieldsasemanticsonIDwhichisfully Proof: seeSection5.3,Theorem5.3.10(page111). {ID(T0).<br />
probabilisticprocessesthenPvsimP0i{ID([P]) abstractwithrespecttothesimulationpreorderinthefollowingsense.IfP,P0are andTheorem5.1.14).Thus,theelement{ID([P])canbeconsideredasthesimulation equivalenceclassofP. {ID([P0])(Lemma5.1.5,page92,<br />
Example5.1.15WeconsidertheprocessesPandP0ofExample5.1.8(cf.Figure3.6, page57).PandP0arerepresentedinIDby {ID([P0])=f(a;E0)gcl=f?g[f(a;E):E2E12g: {ID([P])=f(a;E)gcl=f?g[f(a;E):E2E23g;<br />
Here, andp(f(b;E1?ID)gcl)=1�p.Thepictureontheright showsthe\maximaltransitions"ofxp=f(a;Ep)gcl. pisistheuniquedistributiononIDwithp(?ID)=p =23,0=12,Ep=fEq:p q 1gwhere xp<br />
asa\transition"xa xa Foreachx2ID,eachelement(a;E)2xcanbeviewed �!meansthat,wheneverxa �!.Maximalityofatransition �!then ?IDp sa,p ? HHHj 1�py<br />
sim. ?ID ? b<br />
domain-theoreticpropertiesofthedomainIDandshowthedomain-theoreticdierences betweenIDandthecorrespondingdomain<strong>for</strong>non-probabilisticprocesses. WerefertheinterestedreadertoSection5.3.2(page114)whereweinvestigatesome<br />
Inthenon-probabilisticcase,acompleteultrametricspaceMthatisinternallyfully abstractwithrespecttobisimulationisobtainedbysolvingtherecursivedomainequation 5.1.3 ThesemanticdomainIM<br />
(see[dBaZu82,GoRo83,dBaMe88,RuTu93,Bai97]).Thesubscript1=2denotesthatthe distanceonMismultipliedwiththefactor1=2andPowcomp()denotesthecollectionof M=Powcomp(Act M12)<br />
compactsubsetsof()(seepage311).Weadaptthisideatotheprobabilisticcaseand<br />
Recallthenotations<strong>for</strong>ultrametricspaces(Section12.1.2,page310)andthemethod solvetheequation<br />
byRutten&Turi[RuTu93]<strong>for</strong>solvingrecursivedomainequationsinthecategoryCUM M=Powcomp(Act Eval(M)12):<br />
First,weshowthattheprobabilisticpowerdomainEval()ofevaluationscanbeconsidered asanendofunctoronCUMwhichislocallynon-expansiveinthesenseof[RuTu93].Itis easytoseethat<strong>for</strong>eachdistributiononM: ofcompleteultrametricspacesandnon-expansivefunctions(Section12.1.3,page312).<br />
(x)=inffE(U):x2U2Opens(M)g=inffE(B):x2B2Balls(M)g
5.1.DENOTATIONALMODELS:CONCURRENTCASE whereEisgivenbyE(U)=[U](seepage313).15Bytheabove,whenever,02 97<br />
canbeconsideredasasubspaceofEval(M).WesupposeEval(M)tobeendowedwith Distr(M)withE=E0then thedistanced(E1;E2)=inff>0:E1(B)=E2(B)8B2Balls(M)g:<br />
=0.Hence,thesetDistr(M)ofdistributionsonM<br />
trametricspace.Inthiscase,Eval(M)isthecompletionofDistr(M)(consideredasaTheorem5.1.16IfMisacompleteultrametricspacethenEval(M)isacompleteul- subspaceofEval(M)). Proof: TheultrametricdonEval(M)canbecharacterizedasfollows:d(E1;E2) seeSection5.3Theorem5.3.22(page120)andTheorem5.3.23(page122).<br />
M0andBisanopenballinM0withradiusthenf�1(B)isa-set.Fromthis,whenever Wheneverf:M!M0isanon-expansivefunctionbetweenultrametricspacesMand E2(B)<strong>for</strong>allB2S>rBalls(M)iE1(U)=E2(U)<strong>for</strong>all-setsUwhere riE1(B)=<br />
E1,E2areevaluationsonEval(M)then >r.<br />
i.e.Eval(f)isnon-expansive.Hence,EvalcanbeconsideredasanendofunctorofCUM. d(Eval(f)(E1);Eval(f)(E2)) d(E1;E2);<br />
Lemma5.1.17ThefunctorEval:CUM!CUMislocallynon-expansive.<br />
Remark5.1.18[IncompletenessofDistr(M)]SimilarlytoRemark5.1.13(page95) thesetf0;1g1equippedwiththenaturaldistance Proof: easyverication.<br />
(wherez[n]denotesthen-thprexofz)yieldsanexample<strong>for</strong>acompletemetricspace d(x;y)=inf 12n:x[n]6=y[n] MwhereDistr(M)isnotcomplete(i.e.Distr(M)asasubspaceofEval(M)isnot closed).Considerthesequence(k)whichisdenedasinRemark5.1.13(page95).<br />
RecallthedenitionsofthefunctorsPowcomp:CUM!CUMwhichassignstoeach Then,d(k;i) doesnothavealimitinDistr(M).16 1=2i<strong>for</strong>allk i.Thus,(k)isaCauchysequenceinDistr(M)which<br />
onMismultipliedwiththefactor1=2(seepage312). completeultrametricspaceMthesetPowcomp(M)ofcompactsubsetsofM(seepage 312)andFcum<br />
thesetofallsubsetsUofMsuchthat,<strong>for</strong>eachx2M,thereissomeopenballBwithx2BU(see 15Recallthat<strong>for</strong>eachultrametricspaceM,wedealwiththetopologyofopenballs,i.e.Opens(M)is ActwithFcum Act(M)=ActM12wherethesubscript12meansthatthedistance<br />
page310). E(B)=1=2nifB=B(x;1=2n)<strong>for</strong>somenitewordxofthelengthn,andE(B)=0inallothercases (i.e.thosecaseswhereB=fxg<strong>for</strong>somenitewordx).ThisevaluationEisnotofthe<strong>for</strong>mE<strong>for</strong>some 2Distr(M).<br />
16Thelimitof(k)inEval(M)istheuniqueevaluationEonMsuchthat<strong>for</strong>allopenballsB,
98 Lemma5.1.19ThefunctorFcum=PowcompFcum CHAPTER5.DENOTATIONALMODELS<br />
contracting. Notation5.1.20[ThedomainIM]LetIMdenotetheuniquexedpointofFcum.17 Act Eval:CUM!CUMislocally<br />
AsinthecaseofID,wedealwiththeisomorphismasanequality,i.e.if(IM;j)isthe uniquexedpointofFcumthenwesupposeIM=Fcum(IM))andj=idIM. Theorem5.1.21IPisadensesubspaceofIM.Moreprecisely,thereexistsaunique function{IM:IP!IMsuchthat<strong>for</strong>allT2IP,<br />
Thisfunction{IMisinjectiveand{IM(IP)isadensesubspaceofIM. {IM(T)=f(a;EDistr({IM)()):Ta �!g:<br />
ByLemma5.1.5(page92)andTheorem5.1.21,IMisfullyabstractwithrespectto bisimulationinthefollowingsense.IfP,P0areprobabilisticprocessesthenP Proof: seeSection5.3,Theorem5.3.27(page124).<br />
Example5.1.22WeconsidertheprocessesPandP0ofExample5.1.8(cf.Figure3.6, {IM([P])={IM([P0]). P0i<br />
page57);seealsoExample5.1.15,page96.PandP0arerepresentedinIMby<br />
where(f(b;E1;)g)=1=3,(;)=2=3and0(f(b;E1;)g)=0(;)=1=2. {IM([P])=f(a;E)gand{IM([P0])=f(a;E0)g<br />
Remark5.1.23[The\distance"betweenprocesses]Theorem5.1.21(page98)yields a\distance"<strong>for</strong>probabilisticprocesseswhichgeneralizestheonethatisobtainedfrom theapproachofdeBakker&Zucker[dBaZu82]<strong>for</strong>non-probabilisticprocesses:ForP,P0 tobeprobabilisticprocesses,the\distance"betweenPandP0isgivenby<br />
Roughlyspeaking,thedistancebetweentwoprocessesPandP0is1=2nifnisthemaximal numbersuchthatthen-cutsoftheunwindingsofPandP0arebisimilar.Forinstance, d(P;P0)=dIM({IM([P]);{IM([P0])):<br />
PnshownontheleftofFigure5.2(page99)\converge"totheprocessP(shownonthe isnotbasedonn-cuts.Forinstance,intheapproachof[KwNo96,Norm97]theprocesses theprocessesPandP0onFigure5.1(page99)havethedistance1=2astheir1-cutsare<br />
rightofFigure5.2)whileinoursettingthesequence(Pn)(moreprecisely,theinduced bisimilar.18Kwiatkowska&Norman[KwNo96,Norm97]dealwithadierentmetricwhich<br />
sequence({IM([Pn]))inIM)isnotaCauchysequence.<br />
transitions.<br />
17TheexistenceofauniquexedpointofFcumisensuredbytheresultsof[RuTu93](seepage312). 18Notethatinthe1-cut,thestatest,t0,uandu0areviewedtobebisimilarasweignoretheb-labelled
5.1.DENOTATIONALMODELS:CONCURRENTCASE s 99<br />
vt u v0 t0<br />
ka,<br />
s0 ka,0<br />
kkb13 s k s<br />
? ����@@@@R ? 23 �?<br />
kk? b12��<br />
�@@@@R12u0<br />
k<br />
Figure5.1:Twoprocesseswithdistance1=2 sn<br />
t u<br />
v v ts<br />
na,n<br />
n<br />
n n n<br />
nb<br />
nb<br />
a 1�1 2n �����t@@@@@R ? 2n 1 ?<br />
? ?<br />
5.1.4 DenotationalsemanticsonIMandID Figure5.2:Twoprocesseswithdistance1<br />
(seeSection4.1,page74)onIMandIDandthedesiredfullabstractionresults. Denotationalsemanticsinthemetricandpartialorderapproach:Weassumethe Thissectionshowshowtoestablishdenotationalsemantics<strong>for</strong>theprocessalgebraPCCS<br />
inthemetricapproach[Stoy77,Niva79,dBaZu82].Here,weonlygiveabriefsummary. Wereferto[BMC94,dBdV96]<strong>for</strong>afulltreatment.ThedomainXofadenotational inthepartialorderapproachandthestandardproceduretogivedenotationalsemantics readertobefamiliarwiththeScott-Stracheyapproachtoestablishdenotationalsemantics<br />
semanticsD<strong>for</strong>aprocessalgebraPA(likeCCSoraprobabilisticcalculuslikePCCS) isequippedwithasetSemOpofsemanticoperatorsthatreecttheoperatorsofPAin thefollowingsense.Ifopisann-aryoperatorsymbol(likethebinaryoperatorsymbol+ <strong>for</strong>modellingnon-deterministicchoiceorthe1-ary(action-)prexoperators7!a:s)and opXthecorrespondingsemanticoperatoronXthen<br />
<strong>for</strong>allPAprogramsP1;:::;Pn.Moreover,<strong>for</strong>anydeclarationdecl,themeaningsofa procedurename(processvariable)Zandthebodyoftheproceduredecl(Z)arethesame. D[op(P1;:::;Pn)]=opX(D[P1];:::;D[Pn])<br />
Thatis,<strong>for</strong>anyxeddeclarationdecl,thefunctions7!D[hdecl;si]isahomomorphism fromthewordalgebra(Stmt;Op)to(X;SemOp)suchthatthemeaningofprocessvariable
100 Zisgivenbydecl(Z),i.e.D[hdecl;Zi]=D[hdecl;decl(Z)i].Itisknown(see,<strong>for</strong>instance, CHAPTER5.DENOTATIONALMODELS<br />
[BMC94])thatfunctionDsatisestheseconditionsi,<strong>for</strong>anyxeddeclarationdecl,the functionStmt!X,s7!D[hdecl;si],isaxedpointoftheoperatorFdecl:(Stmt! X)!(Stmt!X),denedby<br />
GiventhisfunctionFdecl,thedenotationalsemanticsofPA{regardlessofwhetherwe <strong>for</strong>eachoperatoropofPAand,<strong>for</strong>eachprocessvariableZ,Fdecl(f)(Z)=f(decl(Z)). Fdecl(f)(op(s1;:::;sn))=opX(Fdecl(f)(s1);:::;Fdecl(f)(sn))<br />
Fdeclisd-continuousonthefunctionspaceStmt!X(whichisthecaseifallsemantic followthepartialorderormetricapproach{isobtainedbyD[hdecl;Pi]=fdecl(P) wherefdecl:Stmt!XisacertainxedpointofFdecl.Inthepartialorderapproachitis guaranteed{byTarski'sxpointtheorem{thatFdeclhasaleastxedpoint,providedthat operatorsared-continuous).Inthemetricapproachitisguaranteed{byBanach's InordertoguaranteethatFdecliscontractingitissucientthatthesemanticoperators arenon-expansiveandcontractingincertainarguments.Forthelatter,onehastoshrink thedomainofDtoguardedprograms,i.e.thoseprogramshdecl;sisuchthat,<strong>for</strong>all xpointtheorem{thatFdeclhasauniquexedpoint,providedthatFdecliscontracting.<br />
preceededbyatleastoneaction. GuardedPCCS:The<strong>for</strong>maldenitionofguardedness<strong>for</strong>theprocessalgebraPCCSis procedures(processvariables)Z,Z0,eachrecursiveprocedurecallofZ0indecl(Z)is<br />
asfollows.GuardedPCCSstatementsarebuiltfromthefollowingproductionsystem.<br />
g::=nil a: Xi2I[pi]si! g1+g2 g1kg2 gnL g[`]<br />
isguarded<strong>for</strong>allZ2ProcVar.GPCCSthesubsetofguardedprograms,i.e.allprograms hdecl;siwheredeclisaguardeddeclaration. wheresiarearbitraryPCCSstatements.Adeclarationdecliscalledguardedidecl(Z)<br />
SemanticoperatorsonIDandIM:Wegiveadenotationalsemantics<strong>for</strong>GPCCSon semantics<strong>for</strong>PCCSonID,whichisfullyabstractwithrespecttothesimulationpreorder. IM,whichisfullyabstractwithrespecttobisimulationequivalence,andadenotational Forthis,weneednon-expansive/contractingsemanticoperatorsonIMandd-continuous semanticoperatorsonID.Inthesequel,X=IMorX=ID.Weusetheclosuenotations AofAand;cl=f?g. <strong>for</strong>subsetsofActEval(IM)andsubsetsoff?g[ActEval(ID)whereweputAcl=Aif<br />
Theprocessnilismodelledby;inIMandby?ID=f?ginID. ActEval(IM)andwhere,<strong>for</strong>;6=A f?g[ActEval(ID),AclistheScott-closure<br />
Action-guardedprobabilisticchoice:Leta2Actand(pi)i2Ibeacountablefamilyof realnumberspi>0withPi2Ipi=1.Let(xi)i2IbeafamilyinX.Weput NondeterministicchoiceonIMandIDismodelledbyset-theoreticunion.<br />
a: Xi2I[pi]xi!=f(a;E)gclwhere2Distr(X)isgivenby (x)=Xi2I xi=xpi:
5.1.DENOTATIONALMODELS:CONCURRENTCASE Wedenesemanticoperators<strong>for</strong>modellingrestriction,relabellingandparallelismasxed 101<br />
pointsofsuitableoperators.Thisreectstherecursivenatureofrestriction,relabelling andparallelism(cf.Milner'sexpansionlaw[Miln89]<strong>for</strong>parallelism). Restriction:LetL FXL(f)(x)=f(a;Eval(f)(E)):(a;E)2x;a=2Lgcl: ActwithL=L.WedeneFXL:(X!X)!(X!X)by:<br />
Relabelling:Let`bearelabellingfunction.FX`:(X!X)!(X!X)isgivenby<br />
Parallelcomposition:Weusethefollowingnotations.Iff:X FX`(f)(x)=f(`(a);Eval(f)(E)):(a;E)2xgcl:<br />
f(;y0)(x)=f(x;y0).WedeneFXk:(X andx0,y02Xthenwedenef(x0;);f(;y0):X!Xbyf(x0;)(y)=f(x0;y)and X!X)!(X X!X)by X!Xisafunction<br />
where FX1(f)(x;y)=f(a;Eval(f(;y))(E)):(a;E)2xg, FXk(f)(x;y)=FX1(f)(x;y)[FX2(f)(x;y)[FXsyn(f)(x;y)cl<br />
InSection5.3,Lemma5.3.12(page113)andLemma5.3.29(page125)weshow:The FX2(f)(x;y)=f(a;Eval(f(x;))(E)):(a;E)2yg,<br />
operatorsFID FX syn(f)(x;y)=f(;Eval(f)(E1E2)):(;E1)2x;(;E2)2y<strong>for</strong>some6=g.<br />
pointsarenon-expansive.Thus,theuniquexedpointsoftheoperatorsFX`,FXLand FXkyieldnon-expansive,resp.d-continuous,semanticoperatorsx7!x[`],x7!xnL, d-continuous.TheoperatorsFIM `,FID LandFID kared-continuousandhaveuniquexedpoints.Theseare<br />
(x;y)7!xkyonIDandIM<strong>for</strong>modellingrelabelling,restrictionandparallelism.Clearly, `,FIM LandFIM karecontractingandtheiruniquexed<br />
theunionisd-continuousasanoperatoronID,andnon-expansivewhenconsideredas anoperatoronIM.TheoperatorPiscontractingonIMandd-continuousonID.More precisely,if(xi)i2I,(x0i)i2IarecountablefamiliesinIMthen<br />
If(xi)i2IisafamilyinIDsuchthatxi=FXiwhereXiisadirectedsubsetofIDthen d a: Xi2I[pi]xi!;a: Xi2I[pi]x0i!! 12maxfd(xi;x0i):i2Ig<br />
a: Xi2I[pi]xi!=G(a: Xi2I[pi]yi!:yi2Xi;i2I): DenotationalsemanticsonIDandIM:Asbe<strong>for</strong>e,weassumethatX=IDorX=IM. Letdeclbeadeclarationwherewesupposethatdeclisguardedwhendealingwith X=IM.WedenetheoperatorFXdecl:(Stmt!X)!(Stmt!X)asfollows: FXdecl(f)(nil)=;; FXdecl(f) a: Xi2I[pi]si!!=a: FXdecl(f)(Z)=f(decl(Z)) Xi2I[pi]FXdecl(f)(si)!
102 CHAPTER5.DENOTATIONALMODELS<br />
FXdecl(f)(s1+s2)=FXdecl(f)(s1)[FXdecl(f)(s2) FXdecl(f)(s1ks2)=FXdecl(f)(s1)kFXdecl(f)(s2)<br />
Bytheresultsof[BMC94],FID FIM FXdecl(f)(snL)=FXdecl(f)(s)nL; declisd-continuous,andhencehasaleastxedpointfID FXdecl(f)(s[`])=FXdecl(f)(s)[`]<br />
semantics<strong>for</strong>PCCSonIDand<strong>for</strong>GPCCSonIM: decliscontractingandhencehasauniquexedpointfIM decl.Weobtainadenotational decl;<br />
Theorem5.1.24ThedenotationalsemanticsDIDandDIMarefullyabstractwithrespect aregivenbyDX[hdecl;si]=fXdecl(s). DID:PCCS!ID;DIM:GPCCS!IM<br />
tosimulationandbisimulationrespectively.Moreprecisely:<br />
Here,IPisconsideredasasubspaceofIM(Theorem5.1.21,page98)and{ID:IP!IDis (a)IfP,P02PCCSthenDID[P]={ID([P])andPvsimP0iDID[P] (b)IfP,P02GPCCSthenDIM[P]=[P]andP P0iDIM[P]=DIM[P0]. DID[P0].<br />
Example5.1.25LetP0=hdecl0;s0ibeasinExample4.1.3onpage77,i.e. asinTheorem5.1.14,page95. Proof: seeSection5.3,Theorem5.3.34(page127)andTheorem5.3.34(page127).<br />
ThedenotationalsemanticsDX[P0]isx[ywherexandyareasfollows. CaseX=ID:y=f(a;E)gclandtheuniquedistributionwith s0=s+Zanddecl0(Z)=a:Zwheres=a:h13ib:nilh23inil.<br />
CaseX=IM:y=f(a;E)gand whilexistheuniqueelementinIDsuchthatx=f(a;E1x)gcl.19 (?ID)=2=3,(yb)=1=3,yb=f(b;E1?ID)gcl<br />
Clearly,IDismore\abstract"thanIMsincesimulationequivalenceiscoarserthanbisim- 1=3,yb=f(b;E1;)gandxtheuniqueelementinIMwithx=f(a;E1x)g.20 theuniquedistributionwith(;)=2=3,(yb)=<br />
ulationequivalence.Weobtainthefollowingconsistencyresult<strong>for</strong>DIDandDIM.21 Theorem5.1.26Thereexistsauniquefunctionf:IM!IDsuchthat <strong>for</strong>allx2IM.ThisfunctionfsatisesfDIM[P] f(x)=f(a;Eval(f)(x)):(a;E)2xgcl<br />
IDandFcont(ID)asanequality.Theprecisedenitionofxisasfollows.Wedenex=Fxnwhere x0=?ID,xn+1=f(a;E1xn)gcl. 19Notethatthenotationx=f(a;E1x)gclonlymakessenseaswetreattheisomorphismbetween =DID[P]<strong>for</strong>allP2GPCCS.<br />
21Forthenotion\consistency"see[BMC97].<br />
20Formally,x=limxnwherex0=;,xn+1=f(a;E1xn)g.
5.1.DENOTATIONALMODELS:CONCURRENTCASE 5.1.5 Afewremarksaboutprobabilisticpowerdomains 103<br />
Toconstructthedenotationalmodelswehavegeneralizedtotheprobabilisticsettingthe establishedcatgoricalmethods<strong>for</strong>solvingdomainequations<strong>for</strong>non-probabilisticprocesses.Thesegeneralizeddomainequationsinvolvedappropriatelyadjustedprobabilistic powerdomainsofevaluations.TheprobabilisticpowerdomainEval(D)ofevaluation<strong>for</strong>a dcpoDissmoothinthesensethat,<strong>for</strong>example,theprobabilisticpowerdomainEval(D) ofatwo-pointspaceDistherealinterval[0;1].Thus,limitscanbeapproximatedby approachingthemarbitrarilyclose.<strong>On</strong>theotherhand,intheultrametriccaseweobtain adiscreteconstruction,inthesensethatthetwo-pointspaceliftedtotheprobabilistic casegivestherealinterval[0;1]withthediscretetopology.Inparticular,itisnotpossible togetarbitrarilyclosetoalimit.22Anotherdierencebetweenthemetricandpartial orderapproachisthedensityof{IM(IP)inIMthatstandsincontrasttoLemma5.3.15 (page116)whichshowsthat{ID(IP)isnotabasisofID.<br />
states(ratherthanadistribution)andgeneralizethedenitionofbisimulationequivalence alaLarsen&Skou[LaSk89]tocontinuousreactivesystems.Moreprecisely,[dViRu97] DeVink&Rutten[dViRu97]consider\continuous"reactivesystemswhereeachstates<br />
solvethedomainequation andpossibleactionainsisassociatedwithaprobabilitymeasure<strong>for</strong>thepossiblenext<br />
inCUM(alsowiththemethodsof[RuTu93])andshowthattheresultingdomainis internallyfullyabstractwithrespecttotheproposednotionofbisimulation.Here, M=Act!f0g[ProbMeascs(M)12<br />
ProbMeascs(M)denotesthecollectionofprobabilitymeasuresontheBorel-eldinontheBorel-eldofMinauniqueway;but,ingeneral,theinducedprobabilitymea-<br />
eachevaluationEonanultrametricspaceMcanbeextendedtoaprobabilitymeasure ducedbytheopensonMwithcompactsupportwhichmeansprobabilitymeasuresthatsuredoesnothaveacompactsupport.Viceversa,aprobabilitymeasurewithcompact<br />
vanishoutsideacompactset.Thespecialsymbol0isneededtomodelinaction.Clearly,<br />
ontheBorel-eldofanultrametricspaceMthen supportmightfailtheaxiomofcontinuity.Moreprecisely,ifEisaprobabilitymeasure<br />
<strong>for</strong>anydirectedcountablefamily(Ui)i2IofopensinMwhile E [i2IUi!=sup i2IE(Ui)<br />
E0@[<br />
ProbMeascs(M)arenon-comparablesubsetsofthespaceProbMeas(M)ofallprobability <strong>for</strong>adirecteduncountablefamilyofopensVjinMispossible.Thus,Eval(M)and j2JVj1A6=sup j2JE(Vj)<br />
consistentwiththeestablishedmethodology(inparticular,themetricsatisestheintuitiveproperty thatanattempttoobtaina\smooth"metricconstructionmightmeanhavingtogobeyondtheknown d(x;y) 22WeshouldemphasisethoughthatthemethodologyweusedtoderivetheultrametricmodelIMis techniques,see[KwNo96,Norm97].<br />
2nixandyagreeuptothen-thstep,andweobtainfullabstraction<strong>for</strong>bisimulation),and 1
104 measuresontheBorel-eldofM.Nevertheless,toobtainadenotationalmodelthatis CHAPTER5.DENOTATIONALMODELS<br />
workwiththepowerdomainProbMeascs()ofprobabilitymeasureswithcompactsupport (ratherthantheprobabilisticpowerdomainEval()ofevaluations).Thatis,alternatively fullyabstractwithrespecttobisimulationwecouldfollowtheapproachof[dViRu97]and wecoulddealwiththeequation<br />
thatcanalsobesolvedinCUMwiththemethodof[RuTu93].Inthatcase,wewould havetoshrinkthesemantics<strong>for</strong>PCCSonthoseprogramsthatonlyusenitebranching M=PowcompAct ProbMeascs(M)12<br />
action-guardedprobabilisticchoicea:(Pi2I[pi]si).23 action-guardedprobabilisticchoicea:([p1]s1:::[pn]sn)ratherthancountablebranching<br />
5.2 Webrieysummarizehowtheresultsoftheprevioussectioncanbemodied<strong>for</strong>the fullyprobabilisticcase,i.e.toobtainfullyabstractdenotationalsemantics<strong>for</strong>theprocess Denotationalmodels:fullyprobabilisticcase<br />
calculusPSCCS(seeSection4.2,page79).Asbe<strong>for</strong>e,weassumeActtobeaxed thecollectionofallbisimulationequivalenceclassesoffullyprobabilisticprocesseswith actionlabelsinAct.Then,IPfisthenalsolutionoftheequation nitenonemptysetofactionsandusethesymbol0todenoteinaction.LetIPfdenote<br />
inSET.Fromthis,weobtainnalsemanticsala[RuTu93].Usingtheevaluationfunctor EvalonthecategoriesCONT?andCUM,internallyfullyabstractsemanticdomainsIDf X=f0g[Distr(Act X)<br />
andIMfcanbederivedasfollows.Applyingthemethodsof[AbJu94,RuTu93]wedene<br />
ThedomainIPfcanbe\embedded"intoIDfandIMfinasimilarwayasIPis\embedded" IDfastheinitialsolutionoftheequationD=Eval(f?g[Act IMfastheuniquesolutionoftheequationM=f0g[EvalActD)inCONT?,24 intoIDandIM.25UsingappropriatesemanticoperatorsonIDfandIMf{thatcanbe M12inCUM.<br />
obtainedinasimilarwayaswedenedthesemanticoperatorsonIDandIM{and thestandardprocedurestogivedenotationalsemanticsinthepartialorderandmetric approachweobtaindenotationalsemantics<br />
PvsimP0iDIDf[P]vIDfDIDf[P0]andP thatarefullyabstractwithrespecttosimulationandbisimulationrespectively.26I.e. DIDf:PSCCS!IDfandDIMf:GPSCCS!IMf<br />
anon-compactsupport. 23Thisisbecausetheassociatedprobabilitymeasureofadistributionwithinnitesupportmighthave 24NotethatinIDf,inactionismodelledbytheevaluationE1?. P0iDIMf[P]=DIMf[P0].<br />
bisimulatonequivalenceclassofthefullyprobabilisticprocessP. Thereisafunction{:IPf!IDfsuchthatTvsimT0i{(T)vIDf{(T0).Inparticular,{([P])can beviewedasacanonicalrepresentative<strong>for</strong>thesimulationequivalenceclassofP.Here,[P]denotesthe 26Here,GPSCCSdenotesthesetofguardedPSCCSprogramswhicharedenedintheobviousway.<br />
25IPfcanbeviewedasadensesubspaceofIMf(whichyieldsadistance<strong>for</strong>fullyprobabilisticprocesses).
5.3.PROOFS 5.3 Proofs 105<br />
5.3.1 Wegivetheproof<strong>for</strong>Theorem5.1.12(page95)thatstatesthatsim(inthesenseof Notation5.1.11,page95)isapartialorderondistributionsofadcpoDandthatthe Thepartialorder simonDistr(D)<br />
functionDistr(D)!Eval(D), 3.4.15(page59)andTheorem3.4.19(page61)statingthatsimulationandbisimulation tiallyorderedsetDistr(D)intothedcpoEval(D).AsacorollaryweobtainTheorem equivalencecoincide<strong>for</strong>reactiveorfullyprobabilisticsystems. 7!Eisanorder-preservingembeddingonthepar-<br />
Lemma5.3.1LetDbeadcpoand,02Distr(D)suchthatEvE0.Then,[U]<br />
dealwithU0i=U1\:::\Ui).Then,Ai=DnUiareclosedsetswithA1 Proof: 0[U]<strong>for</strong>allG-setsU.27<br />
EvE0wehave[Ai] toshowthat[A] LetU=Ti0UiwhereUi2Opens(D).W.l.o.g.U1 U2 :::(otherwisewe<br />
Then, >0.ThereexistsanitesubsetXofAwith0[X]>0[A]�.SinceXis 0[A].Wesuppose[A]
(1)f(x;y)6=0<strong>for</strong>atmostcountablymany(x;y)2D. 106 CHAPTER5.DENOTATIONALMODELS<br />
(3)Iff(x;y)6=0thenxvy. (2)Forallx,y2D,f(x) Weshowthatthereisafunctionf2Fsuchthatf= (x)and0f(y) 0(y).<br />
functionfisaweightfunction<strong>for</strong>(;0)withrespecttov.Hence, f2F,weput (f)=X and0f=0.(Then,this<br />
x;y2Df(x;y) sim0.)For<br />
aimistoshowtheexistenceofafunctionf2Fwith(f)=1.(Then,wemayconclude and<br />
thatfisaweightfunction<strong>for</strong>(;0)andthere<strong>for</strong>e ItiseasytoseethatXf=;i Xf=fx2D:(x)>f(x)g;Yf=fy2D:0(y)>0f(y)g: f= iYf=;i sim0.) 0f=0i (f)=1.Thus,our<br />
thatn Iff2Fthenwedeneaf-pathtobeanitesequence~p=(x0;y0;:::;xn;yn)inDsuch<br />
(ii)xivyi,i=0;1;:::;n (i)f(xi+1;yi)>0,i=0;1;:::;n�1 0and<br />
Wedenerst(~p)=x0,last(~p)=ynand (iii)x0;:::;xnandy0;:::;ynarepairwisedistinct(butxi=yjispossible).<br />
Claim1:Letf2Fandx2Xf.Then,Rf(x)\Yf6=;. (Intuitively,Rf(x)isthesetofally2Dthatcanbereachedfromxviaaf-path.) Rf(x)=flast(~p):~pisaf-pathwithrst(~p)=xg:<br />
Proof:LetA=fz2D:(z)>0_0(z)>0g,Z=AnRf(x)and<br />
AsZiscountableandz#Scott-closed,UisaG-set.Thus,byLemma5.3.1(page105): U=\<br />
(*)0[U] [U] z2ZDnz#:<br />
ItiseasytoseethatA\U=A\Rf(x).28Thus,[U]=[Rf(x)]and0[U]=0[Rf(x)]. Sincex2Rf(x)(as(x;x)isaf-path)andx2Xfwehave<br />
WesupposethatRf(x)\Yf=;.Then,0(y)=0f(y)<strong>for</strong>ally2Rf(x).Hence, (**) [U]= z2Rf(x)(z)> X z2Rf(x)f(z)= X z2Rf(x)Xy2Df(z;y): X<br />
Iff(z;y)>0and(x0;y0;:::;xn;yn)isaf-pathwithz=2fx0;y0;:::;xn;yngx0= (***) 0[U]= y2Rf(x)0(y)= X y2Rf(x)0f(y)= X y2Rf(x)Xz2Df(z;y): X<br />
xandyn=ythen(x0;y0;:::;xn;yn;z;z)isaf-path.Ifz=xi<strong>for</strong>someithen (x0;y0;:::;xi;yi)isaf-pathwithlast(~p)=z.Thus, ~p=(x0;y0;:::;xi;xi)isaf-pathwithlast(~p)=z.Ifz=yi<strong>for</strong>someithen~p= 28FortheinclusionA\Rf(x)A\UweusethefactthatRf(x)isupward-closed.
5.3.PROOFS ify2Rf(x)andf(z;y)>0thenz2Rf(x). 107<br />
Hence,<br />
Weobtainby(***)and(**): f(z;y)2DD:f(z;y)>0;y2Rf(x)g 0[U]= X f(z;y)2D D:f(z;y)>0;z2Rf(x)g:<br />
Thiscontradicts(*).Thus,Rf(x)\Yf6=;.c y2Rf(x)Xz2Df(z;y) z2Rf(x)Xy2Df(z;y)0,f[~p]2Fand<br />
(III)Foreachy2Dthereisatmostonex2Dwithf(x;y)6=f[~p](x;y). (II)Foreachx2Dthereisatmostoney2Dwithf(x;y)6=f[~p](x;y). (I) (f[~p])= (f)+(f;~p).<br />
(II)and(III)followbycondition(iii)off-paths.Byinductiononiwedeneasequence (fi)i0offunctionsfi2Fasfollows. (IV)jf(x;y)�f[~p](x;y)j (f;~p).<br />
{Nowwesupposei {Letf0begivenbyf0(x;y)=0<strong>for</strong>allx,y2D. fi=fi�1.Otherwise,wedene i=supn(fi�1;~p):~pisaf-pathwithrst(~p)2Xfi�1andlast(~p)2Yfi�1o: 1andthatf0;:::;fi�1aredened.If(fi�1)=1thenweset<br />
Wechoosesomefi�1-path~piwith<br />
Claim2:limfiexistsandlimfi2F,(limfi)=1. Wedenefi=fi�1[~pi]. rst(~pi)2Xfi�1,last(~pi)2Yfi�1,(fi�1;~pi)>i�1=2i.<br />
convergent.Let>0andi Proof:By(I)weget1 kXj 1suchthat (fi)=P1ji (fj�1;~pj).Thus,Pj (fj�1;~pj)is<br />
=i (fj�1;~pj)< <strong>for</strong>allk i i.
108 By(IV),<strong>for</strong>allx,y2Dandk i i: CHAPTER5.DENOTATIONALMODELS<br />
jfk(x;y)�fi(x;y)j j=i+1jfj(x;y)�fj�1(x;y)j kX j=i+1(fj�1;~pj)0,i i.<br />
(VII) (VI) j0f(y)�0fi(y)j jf(x)�fi(x)j Xji(fj�1;~pj) Xji(fj�1;~pj) <strong>for</strong>all>0,i i,y2D. i,x2D.<br />
usingthefactthatf(xj+1;yj) Thus,f(x)=limfi(x) showthat(f)=1.Weassumethat(f)1=2j�1.Then,<strong>for</strong>alliiand(fi;~p) (f;~p).<br />
(fi;~p) i, 12 (f;~p)>12j: 1=2 (f;~p).Letj 1suchthat<br />
Hence,i (fi�1;~p)>1=2j<strong>for</strong>alli (fi�1;~pi)> i�12i>12j�12i i.Bydenitionof~pi:<br />
<strong>for</strong>alli maxfi;j+1g.Contradiction(asPi(fi�1;~pi)isconvergent).c 2j+1 1<br />
Py2A0(y)areconvergentthereexistsanitesubsetC0ofAwithx2C0and Proof: Lemma5.3.3LetDbeadcpoand,02Distr(D)suchthatE=E0.Then,=0. 0(x)�(x).Then, Suppose(x)6=0(x)<strong>for</strong>somex2D.W.l.o.g.(x)0.LetA=x#.Then,AisScott-closed.SincePy2A(y)and X =<br />
y2AnC0(y)< ; y2AnC00(y)< X :
5.3.PROOFS LetK=[AnC0],K0=0[AnC0],C=C0nfxgandB=Sfz#:z2Cg.Then, 109<br />
K
110 Theorem5.3.6(cf.Theorem3.4.15,page59)If(S;Act;Steps)isareactiveaction- CHAPTER5.DENOTATIONALMODELS<br />
Proof: onS.WeassumeStobeequippedwiththepreorderR=vsim.Lets,s02S,ssims0 labelledconcurrentprobabilisticsystemands,s02Sthenssims0impliess Weshowthatsimisabisimulation.Clearly,simisanequivalencerelation s0.<br />
andsa (S;Act;Steps)isreactivewehave=00.ByLemma5.3.5(page109),[A]=0[A]<strong>for</strong> allA2S=sim. �!.Thereexisttransitionss0a �!0andsa �!00with R0and0R00.As<br />
Proof: Theorem5.3.7(cf.Theorem3.4.19,page61)Let(S;Act;P)beanaction-labelled fullyprobabilisticsystemands,s02S.Then,ssims0impliess Clearly,ifssims0andsisterminalthens0isterminalands s0<br />
therelationR=fha;ti;ha;t0i:tvsimt0;a2Actg.Then, X=Act 02Distr(X)begivenby(ha;ti)=P(s;a;t)and0(ha;ti)=P(s0;a;t).Weconsider Sandlets,s0benon-terminalstatesinSsuchthats R0and0R.By sims0.Let, s0.Let<br />
Lemma5.3.5(page109):Ifa2ActandC2S=simthen<br />
whereC0=f(a;t):t2Cg.(NotethatC02X=(R\R�1).)Weconcludethatsimisa bisimulation. P(s;a;C)=[C0]=0[C0]=P(s0;a;C)<br />
ThissectionshowstheconnectionbetweenIPandID(Theorem5.1.14,page95)andthed- 5.3.2 continuityofthesemanticoperators<strong>for</strong>modellingrestriction,relabellingandparallelism ThedomainID<br />
andpresentssomedomain-theoreticpropertiesofID.<br />
followingisstandard. RecallthatIDdenotestheinitialxedpointofthefunctorFcont=PowHoareFcont CONT?!CONT?wherewedealwiththeisomorphismasanequality(Notation5.1.10, page94).ThepartialorderonIDistheinclusion,thebottomelementis?ID=f?g.The ActEval:<br />
Notation5.3.8[Then-thprojectionprojIDn]ThefunctionsprojIDn:ID!IDaredenedasfollows.LetprojID0(x)=?ID<strong>for</strong>allx2IDand Then,projIDn+1(x)=f(a;Eval(projIDn)(E)):(a;E)2xgcl.(projIDn)n0isamonotone sequenceofstrictandcontinuousfunctionsonIDsatisfying projIDn+1=FcontprojIDn:<br />
xFn0projIDn=idID projIDnyiprojIDn(x) projIDk=projIDk projIDn(y)<strong>for</strong>alln projIDn=projIDn<strong>for</strong>all0 0. n k<br />
withthepartialorderf1vf2if1(x)vf2(x)<strong>for</strong>allx2X.Then,X!IDisadcpo (seeSection12.1.1,page308).Weoftenusethefollowingfact.<br />
Recallthat,<strong>for</strong>Xtobeaset,wesupposethesetoffunctionsX!IDtobeendowed
5.3.PROOFS Lemma5.3.9LetXbeaset.Eachd-continuousoperatorF:(X!ID)!(X!ID) 111<br />
withF(projIDn Proof: andf0arexedpointsofFthenitcanbeshownbyinductiononnthatprojIDn TheexistenceofaxedpointffollowsbyTarski'sxedpointtheorem.Iff f)=projIDn+1F(f)hasauniquexedpoint.<br />
projIDn f0.Hence, f(x)=Gn0projIDn(f(x))=Gn0projIDn(f0(x))=f0(x) f=<br />
<strong>for</strong>allx2ID. WedenotethepartialordersonEval(ID)andonf?g[ActEval(ID)byv.Recallthat subsetsoff?g[Act thatxvy.Moreover, vLdenotesthelowerpreorderonf?g[Act Eval(ID)thenAvLBi<strong>for</strong>allx2Athereexistsy2Bsuch Eval(ID),i.e.ifA,Barenitenonempty<br />
Theorem5.3.10(cf.Theorem5.1.14,page95)Thereexistsauniquefunction{ID: Acl Acl=A#=fx:x BclifandonlyifAvLB.<br />
IP!IDsuchthat y<strong>for</strong>somey2Ag.<br />
Moreover,<strong>for</strong>allT,T02IP:TvsimT0i{ID(T) {ID(T)=n(a;EDistr({ID)()):Ta {ID(T0). �!ocl:<br />
Proof: ID)!(IP!ID)begivenbyF(f)(T)=Af(T)clwhere Forsimplicity,wewriteprojnand{ratherthanprojIDnand{ID.LetF:(IP!<br />
Notethat{sinceTisnitelybranching{Af(T)isniteandhenceF(f)(T)=Af(T)#. WehavetoshowthatFhasauniquexedpoint{andthatthisfunction{satises: Af(T)=f(a;EDistr(f)()):Ta �!g:<br />
Proof:Iff=Fi2Ifithenweshowthat<strong>for</strong>eachT2IP: {(T) Claim1:TheoperatorFisd-continuous. {(T0)iTvsimT0.<br />
(1)Afi(T)vLAf(T)(whichimpliesF(fi)(T) (2)Whenevery2IDwithAfi(T) y<strong>for</strong>alli2IthenAf(T) F(f)(T))<br />
Then,from(1)and(2), F(f)(T) y<strong>for</strong>eachupperboundyof(F(fi)(T))i2I. Gi2IF(fi)(T)=F(f)(T):<br />
y.Thisimpliesthat<br />
ad(1)If(a;E)2Afi(T)thenTa WehaveEDistr(f)()=Eval(f)()=FEval(fi)()=FEDistr(fi)()byRemark12.1.3 (page313)andLemma12.1.4(page314).Hence: Then,EvEDistr(f)().Hence,(a;E)v(a;EDistr(f)())2Af(T).<br />
�!<strong>for</strong>somedistribution withE=EDistr(fi)().
ad(2)Ify2ID,Afi(T) 112 y<strong>for</strong>alli2Iand(a;E)2Af(T)thenE=EDistr(f)()<strong>for</strong> CHAPTER5.DENOTATIONALMODELS<br />
somedistribution i2I.Since whereTa (a;E)=Gi2I(a;EDistr(fi)()) �!.Then,(a;EDistr(fi)())2Afi(T) y<strong>for</strong>all<br />
Then,{(T)=F({)(T)=A{(T)#.IfT2IPthenweput Denition:Let{:IP!IDbetheleastxedpointofF(Tarski'sxedpointtheorem). inf?g[Act Eval(ID)andyislub-closedweget(a;E)2y.c<br />
Claim2:ForallT,T02IP,{(T) Then,projn({(T))=An(T)#.Thus,projn({(T)) An(T)=f(a;EDistr(projn�1{)()):Ta<br />
{(T0)iTvsimT0. projn({(T0))iAn(T)vLAn(T0). �!g:<br />
Proof:SinceallelementsofIP(viewedasaction-labelledconcurrentprobabilisticprocesses)arenitelybranching(andhenceimage-nite)itissucienttoshowthat nothingtoshow.Intheinductionstepn=)n+1wesupposeprojn({(T)) (Lemma3.4.13,page59).Weprovethisbyinductiononn.Inthecasen=0thereis projn({(T)) projn({(T0))iTvnT0<br />
iTvnT0<strong>for</strong>allT,T02IP. LetT,T02IP,projn+1({(T)) projn+1({(T0))andletTa �!beatransition.Let projn({(T0))<br />
T0a (a;E0)2An+1(T0)withEvE0.BydenitionofAn+1(T0)thereexistsatransition =Distr(projn{)().Then,(a;E)2An+1(T)vLAn+1(T0):Hence,thereexists �!0withE0=E0and0=Distr(projn{)(0).ByTheorem5.3.2(page105),<br />
UsingRemark2.2.1(page30)andRemark2.2.2(page31)weobtain sim0.ByRemark2.2.3, R=f(T1;projn({(T1)):T12IPg: R,0R0where<br />
Byinductionhypothesis,R0 R0=R R�1=f(T1;T0 vn.Hence, 1):projn({(T1)) vn0.Thus,TvnT0. projn({(T0 1))g: R00where<br />
Distr(projn{)().SinceTvn+1T0thereexistsatransitionT0a LetT,T02IP,Tvn+1T0.ItsucestoshowthatAn+1(T)vLAn+1(T0).Let (a;E)2An+1(T).ThereexistsatransitionTa Then,(a;E0)2An+1(T0)where0=Distr(projn{)(0).ByRemark2.2.3(page31), R,0R0whereRisasabove.UsingRemark2.2.1(page30)andRemark �!suchthatE=Ewhere �!0with vn0. =<br />
2.2.2(page31)weobtain R00=R�1vnR=f(projn({(T1));projn({(T0 R000where<br />
Thus,(a;E)=(a;E)v(a;E0)2An+1(T0).c Byinductionhypothesisweobtain sim0.ByTheorem5.3.2(page105),EvE0. 1))):T1vnT0 1g:<br />
Proof:ItiseasytoseethatF(projnf)=projn+1F(f)<strong>for</strong>allfunctionsf:IP!ID. Hence,byLemma5.3.9(page111),Fhasauniquexedpoint.There<strong>for</strong>e,{0={.c<br />
Claim3:If{0:IP!IDisalsoaxedpointofFthen{0={.
5.3.PROOFS Lemma5.3.11(cf.Remark3.4.11,page57)Let(S;Act;Steps)beanaction-labelled 113<br />
f(s;s0)2S concurrentprobabilisticsystemand,02Distr(S)suchthat (a)[t#sim] S:svsims0g.Then,<strong>for</strong>eacht2S: 0[t#sim] R0whereR=<br />
Here,t"sim=fu2S:tvsimugandt#sim=fu2S:uvsimtg. (b)IfSupp()andSupp(0)arenitethen[t"sim] 0[t"sim]. Proof: Theorem5.3.10(page111)andLemma5.1.5(page92): (*)svsims0ixs Fors2S,wedenePs=(S;Act;Steps;s)andxs={ID([Ps]).Then,by<br />
For Ux=fu2S:xu=xg.By(*): tobeadistributiononS,wedeneID2Distr(ID)byID(x)=[Ux]where xs0.<br />
Wexsomet2Sand,02Distr(S)with andE0=E0ID.Then,EvE0(byTheorem5.3.2,page105).Asxt#isScott-closedwe (**)If2Distr(S)then[t#sim]=ID[xt#]; R0.Clearly,IDsim0.LetE=EID [t"sim]=ID[xt"]:<br />
get<br />
B=fv2A:t6vsimvgand NowweassumethatSupp()andSupp(0)arenite.LetA=Supp()[Supp(0), [t#sim]=ID[xt#]=E(xt#) E0(xt#)=0ID[xt#]=0[t#sim]:<br />
Then,AandBarenite.Thus,UistheniteintersectionofScott-opens.Hence,Uis Scott-open.Clearly,xt" U=\<br />
Thus,ID[xt"]=E(U):By(**),[t"sim]=E(U).Similarly,Supp(0)\U UandU\fxv:v2Ag v2B(IDnxv#):<br />
and0[t"sim]=E0(U).AsUisScott-openandEvE0weobtain xt".Hence,Supp(ID)\U xt".<br />
[t"sim]=E(U) E0(U)=0[t"sim]: xt"<br />
RecallthedenitionsoftheoperatorsFID (IDID!ID)!(IDID!ID)thatweregivenonpage101. Lemma5.3.12TheoperatorsFID `,FID LandFID L,FID `:(ID!ID)!(ID!ID)andFID kared-continuousandhaveuniquexed k:<br />
Proof: points.Theseared-continuous. page314)itiseasytoseethatFislocallyd-continuous.Moreover, LetF2fFID `;FID L;FID F(projIDn kg.Usingthelocald-continuityofEval(Lemma12.1.4,<br />
Then,byLemma5.3.9(page111),Fhasauniquexedpointf.fisd-continuoussinceF mapsd-continuousfunctionstod-continuousfunctionsandsincethesetofd-continuous<br />
f)=projIDn+1F(f):
114 functionislub-closed.Notethat{byTarski'sxedpointtheorem{theunique(least) CHAPTER5.DENOTATIONALMODELS<br />
f0(x)=?ID<strong>for</strong>allx2ID.Thus,byinductiononn,allfunctionsFn(f0)ared-continuous. Hence,f=FFn(f0)isd-continuous. xedpointofFcanbewrittenasleastupperboundofthesequence(Fn(f0))n0where<br />
ofelementsthatarenotexplainedinthatthesisbutcanbefounde.g.in[AbJu94].The domainID.WeusesomebasicnotionsofdomaintheorylikeSFPdomainsorcompactness Intheremainderofthissectionweinvestigatesomedomain-theoreticpropertiesofthe<br />
section. Inthenon-probabilisticcasewhereadomain-theoreticmodelIDnonprob<strong>for</strong>thesimulation readernotfamiliarwith(ornotinterestedin)domaintheorymightskiptherestofthat<br />
preordercanbeobtainedfromtheequationD=PowHoare(f?g[Act besolvedinthecategoryofSFPdomains.ThesetTreeofnitelybranchingtrees(the function{:Tree!IDnonprobsimilartothewaywhereIPis\embedded"intoIDvia{ID. nalsolutionofX=Pown(Act X)inSET)canbe\embedded"intoIDnonprobviaa D))whichcan<br />
elementsofIDnonprob.Inparticular,theset{(Tree)isabasisofIDnonprob.Moreover,ifthe Theimagesofnitelybranchingtreesofniteheightwithrespectto{arethecompact<br />
probabilisticcase: detailsaboutthenon-probabilisticcasesee[Bai97]).Thesituationisdierentinthe underlyingalphabetActisnitethen,<strong>for</strong>then-thprojectionprojn:IDnonprob!IDnonprob, theelementsofprojn({(Tree))arecompactandprojn(IDnonprob) {(Tree).(Forfurther<br />
Ifn {ID(IP)isnotabasisofID(cf.Lemma5.3.15,page116). TheelementsofprojIDn({ID(IP))arenotcompact(cf.Lemma5.3.13,page114).<br />
Lemma5.3.13TheelementsofprojIDn({ID(IP))nprojID1({ID(IP)),n 2thenprojIDn(ID)6{ID(IP)(cf.Lemma5.3.16,page116).<br />
Proof: element(a;E)2xwhichismaximalinxandwith(y)>0<strong>for</strong>somey2ID,y6=f?g. Letn 2andx2projIDn({ID(IP))nprojID1({ID(IP)).Then,thereexistsan 2,arenotcompact.<br />
WechooseN 0with1=2N:(z) (f?g)+1=2n:ifz=f?g :ifz6=f?g,z6=y Nweput<br />
butx6vxn<strong>for</strong>alln Then,FEn=E.Hence,x=Fxnwherexn=Acl (y)�1=2n :ifz=y.<br />
Lemma5.3.14Distr(ID)(asasubspaceofEval(ID))isnotabasisofEval(ID). N.Thus,xisnotcompact. n,An=(xnf(a;E)g)[f(a;En)g<br />
Proof: asE=FE.Lety=f(b;E)gclwhere Example5.1.15(page96),i.e.pistheuniquedistributiononIDwithp(y)=pand p(?ID)=1�p.Let Wegiveanexample<strong>for</strong>anevaluationE2Eval(ID)thatcannotbewritten =1?ID.Forp2[0;1],letpbeasin<br />
iq
5.3.PROOFS Claim1:If2Distr(ID),EvEthen(x)=0<strong>for</strong>allx2IDn(f?IDg[fxp:p2[0;1]g). 115<br />
have[U0] WesupposethatE=F2MEwhereM Proof:FirstweobservethatIDnfxp:p2[0;1]g E(U0)=0.Hence,(x)=0<strong>for</strong>allx2U0.c Distr(ID)suchthatfE: IDnx1#=U0.AsisScott-openwe<br />
directed.(I.e.Misdirectedwithrespecttosim.)Then,<strong>for</strong>all2Mandp2[0;1], p=supf[Up]:2Mg: 2Mgis<br />
Claim2:Forall>0thereissome2Msuchthat[Up] Proof:Foreachp2[0;1]wechoosesomepwithp[Up] XpbeanitesubsetofIDsuchthatp[IDnXp]0with p�(axiomofchoice).Let p�<strong>for</strong>allp2[0;1].<br />
p1;:::;pk2[0;1]suchthat p0andn x1�p2UqnUpandUp q n[Uq] n[Up]+n(x1�p) Uq.Hence,<strong>for</strong>allqwithp
116 Lemma5.3.15{ID(IP)isnotabasisofID. CHAPTER5.DENOTATIONALMODELS<br />
X subsetXof{ID(IP).Then,yistheScottclosureofSx2Xxinf?g[ActEval(ID).Since (page114).Wesupposethatycanbewritteninthe<strong>for</strong>my=FX<strong>for</strong>somedirected Proof: {ID(IP)eachelementxofXisofthe<strong>for</strong>mf(a;Ex1);:::;(a;Exrx)gclwherexiare Weconsidertheelementy=f(a;E)gclofIDwhereEisasinLemma5.3.14<br />
MisdirectedandE=FfE: (page114). distributionswithExivE.LetM=fxi:i=1;:::;rx;x2Xg.Itiseasytoseethat<br />
Lemma5.3.16Ifn 2thenprojIDn(ID)6 2MgwhichisimpossibleasshowninLemma5.3.14<br />
Proof: distributiononIDwithn(yb)=1=nandn(yc)=1�1=n. Considerx=AclwhereA=f(a;En):n {ID(IP).<br />
x 1gandnistheunique<br />
yb sa,n<br />
?IDb1n<br />
?<br />
? = ZZZ~ 1�1n<br />
?ID yc ? c<br />
incomparable.Hence,xcannotbewritteninthe<strong>for</strong>mx=Xcl(=X#)whereXisnite. Here,yb=f(b;E1?D)gcl,yc=f(c;E1?D)gcl.Theelements(a;En),n There<strong>for</strong>e,x=2{ID(IP),butx=projID2(x)2projID2(ID). 1arepairwise<br />
NotethatLemma5.3.16doesnothold<strong>for</strong>n=1.Wehave:<br />
where=1?ID. projID1(ID)=f?IDg[f(;E):2Actg {ID(IP)<br />
5.3.3 ThissectionpresentstheproofofTheorem5.1.16(page97)statingthat,<strong>for</strong>anycomplete ultrametricspaceM,theprobabilisticpowerdomainEval(M)ofevaluationsonMisthe Themetricprobabilisticpowerdomainsofevaluations<br />
completionofDistr(M).RecallthatthedistanceonEval(M)isgivenby<br />
canbewrittenasdisjointunionofopenballs.IfUisa-setthenUcanbewrittenas Lemma5.3.17LetMbeanultrametricspace.EverynonemptyopensubsetUofM d(E1;E2)=inff>0:E1(B)=E2(B)8B2Balls(M)g:<br />
disjointunionofopenballswithradius. Proof: LetUbeanonemptyopensubsetofM.Ifx2Uthenweput (x)=supfr>0:B(x;r) Ug:
5.3.PROOFS Let bethefollowingequivalencerelationonU:x yi (x)=(y).LetVbea 117<br />
subsetofUsuchthatV\[x]consistsexactlyofoneelement(axiomofchoice).Then,<br />
Lemma5.3.18LetMbeanultrametricspaceandEanevaluationonM.Then,<strong>for</strong> Uisa-setwedealwiththeequivalencerelationx UcanbewrittenasdisjointunionoftheopenballsB(x;(x)),x2V.Inthecasewhere<br />
eachopensubsetUofM,wheneverU=Si2IBiwhere(Bi)i2Iisafamilyofpairwise yid(x;y)0thereexistsanitesubsetJofIwith E(U)� Xj2JE(Bj)<br />
Let>0.WeshowthatthereexistsanitesubsetJofIwithE(BJ) Proof: Hence,E(U)=supJ2KE(BJ).Inparticular,thereexistsanitesubsetJofIwith bethesetofnitesubsetsofI.Then,thefamily(BJ)J2KisdirectedandSJ2KBJ=U. IfJ IisnitethenweputBJ=Sj2JBj.Then,E(BJ)=Pj2JE(Bj).<br />
E(BJ) E(U)�. E(U)�:LetK<br />
ImmediatelybyLemma5.3.18weget:<br />
Lemma5.3.20LetMbeanultrametricspace,EanevaluationonMand0
118 2.IfB1;:::;Bnarepairwisedisjointopenballswhicharecontainedinsomeopenball CHAPTER5.DENOTATIONALMODELS<br />
Bthen<br />
3.WheneverBisanopenballandB=Si2IBiwhere(Bi)i2Iisafamilyofpairwise nXi=1F(Bi) disjointopenballsthen<strong>for</strong>each>0thereexistsanitesubsetJofIwith F(B):<br />
F(B)� Xj2JF(Bj):<br />
whichextendsF.WedeneEasfollows: Proof: Then,thereexistsauniqueevaluationEonMwithE(B)=F(B)<strong>for</strong>allB2Balls(M). ByCorollary5.3.19(page117)thereexistsatmostoneevaluationEonM<br />
whereI(U)denotesthecollectionofallnitesetsconsistingofpairwisedisjointopenballs E(U)=sup(XB2IF(B):I2I(U))<br />
BE(M)=1sinceI=fMg2I(M)andF(M)=1.ThemonotonicityofEisclearsince I2I(M)weputFI=PB2IF(B).WeshowthatEisanevaluation:wehave wheneverU U.ByLemma5.3.17(page116),I(U)isnonemptywheneverU6=;.Whenever VthenI(U) E(U\V)+E(U[V)=E(U)+E(V): I(V).LetU,V Mbenonemptyopens.Weshowthat<br />
Step1:WeshowthatE(U\V)+E(U[V) thatthereexistsIU2I(U)andIV2I(V)with E(U[V)+E(U\V)� E(U)+E(V).Let>0.Weshow<br />
(Then,wemayconcludethatE(U)+E(V) Hence,E(U)+E(V) E(U[V)+E(U\V).) E(U[V)+E(U\V)�<strong>for</strong>all>0. FIU+FIV:<br />
Then, LetJ2I(U[V),K2I(U\V)withFJ (*) FJ+FK E(U[V)+E(U\V)�12<br />
E(U[V)�14 andFK E(U\V)�14.<br />
Claim:EachballB2JcanbewrittenasdisjointunionofopenballsCsatisfyingC Proof:LetB2J.Foreachx2Bweput: orC V. U<br />
Then,r(x)>0<strong>for</strong>allx2B.WeputBx=B(x;r(x)).Then,eitherBx r(x)=(supfr>0:B(x;r) supfr>0:B(x;r) B\Ug:ifx2B\U,<br />
LetXbethesetofelementsx2B\UwithBx B\Vg:ifx2B\(VnU). By<strong>for</strong>somey2B\(VnU).We<br />
UorBx V.
5.3.PROOFS candealwiththesetofballsC=Bxwherex2Vorx2UnX.(Notethat<strong>for</strong>allx, 119<br />
consistingofpairwisedisjointopenballsC LetjJjbethecardinalityofJandletB2J.ByassumptionthereexistsanitesetIB y2B\(V[(UnX))eitherBx=ByorBx\By=;.)c<br />
F(B)�1 2jJjUorCFIB: Vwith<br />
LetJ0bethesetofallballsC2IB,B2J.Then,J0isniteand<br />
Weput: FJ�12 =XB2J0F(B)�12 XB2J0X<br />
J0U=fB2J0:B Ug,J0V=J0nJ0U, C2IBF(C):<br />
Then,IU2I(U).WeshowIV2I(V).ItisclearthatallballsB2IVarecontained KU=fC02K:C\B=;8B2J0Ug,<br />
inVandthattheballsofJ0V(andtheballsofKV)arepairwisedisjoint.Supposethere KV=KnKU,IU=J0U[KU,IV=J0V[KV.<br />
areballsB2J0VandC2KVwithB\C6=;.Then,eitherB caseisimpossiblesincethenC\B06=;<strong>for</strong>someB2J0UandhenceeitherB0 orC rstcaseisimpossiblesinceB6U(bydenitionofJ0V)andC U\V.Thesecond CorC B.The<br />
obtainB\B0(whichcontradicttheassumptionthattheballsB,B0aredisjoint).We C B<br />
FIU+FIV=XB2J0X FJ�12 +FKC2IBF(C)+FK Step2:WeshowthatE(U\V)+E(U[V) E(U[V)+E(U\V)�:<br />
IU2I(U),IV2I(V)suchthat FIU E(U)�12;FIV E(V)�12: E(U)+E(V).Let>0andlet<br />
Then,K=fB\C:B2IU;C2IV;B\C6=;gisanitesetofdisjointopenballs whicharecontainedinU\V.LetJbethesetconsistingofthefollowingballs: -B[CwhereB2IU,C2IV,B\C6=;<br />
JisanitesetofpairwisedisjointopenballscontainedinU[V.(Notethatwhenever -B2IUwhereB\C=;<strong>for</strong>allC2IV<br />
B,CareopenballswithB\C6=;theneitherB -B2IVwhereB\C=;<strong>for</strong>allB2IU<br />
FK+FJ=FIU+FIV.Hence, E(U[V)+E(U\V) FK+FJ=FIU+FIV CorCE(U)+E(V)� B.)Itiseasytoseethat
120 <strong>for</strong>all>0.There<strong>for</strong>e,E(U[V)+E(U\V) CHAPTER5.DENOTATIONALMODELS<br />
adirectedfamilyofopensetswithU=SUi.SinceUi Step3:WeshowthatEiscontinuous.LetUbeanonemptyopensetandlet(Ui)i2Ibe E(U)+E(V).<br />
there<strong>for</strong>esupE(Ui) E(U).Foreachx2Uandi2Iweputri(x)=0ifx=2Uiand ri(x)=supfr>0:B(x;r) UwehaveE(Ui) Uig E(U)and<br />
ifx2Ui.Letr(x)=supi2Iri(x).Then,ri(x)>0andBx=B(x;r(x)) Wedeneanequivalencerelation x6 classA,wedeneBA=BxandrA=r(x),wherexisarepresentativeofA.Wechoose yiBx\By=;andthatBxistheequivalenceclassofx.Foreachequivalence onUbyx yiBx=By.Itiseasytoseethat U.<br />
x2CsuchthatA
5.3.PROOFS 1.ItisclearthatF(M)=1. 121<br />
2.LetBbeanopenballandB1;:::;BnbedisjointopenballswithB1[:::[Bn numberNwith1=2N0suchthatB,Bi2Balls(M),i=1;:::;n,andsomenatural B.<br />
F(B)=EN(B) nXi=1EN(Bi)=nXi=1F(Bi): 3.LetB2Balls(M)and(Bi)i2IafamilyofdisjointopenballsBiwithSBi=B.Let n>0.WechooseanaturalnumberNwith1=2N0such Nwith1=2n1=2N.There<strong>for</strong>e,d(E;EN) 7!E,isinjective.Thus,Distr(M)canbeviewedasasubspaceofEval(M).<br />
1=2NandE=limEn.
122 Theorem5.3.23(cf.Theorem5.1.16,page97)LetMbeacompleteultrametric CHAPTER5.DENOTATIONALMODELS<br />
space.Then,Eval(M)isthecompletionofDistr(M).<br />
E(B(x;1=2n))6=0impliesd(x;y)
5.3.PROOFS Lemma5.3.25LetXbeaset.EveryoperatorF:(X!IM)!(X!IM)with 123<br />
iscontractingandhencehasauniquexedpoint. FprojIMn f=projIMn+1F(f)<br />
Lemma5.3.26Foralln (Banach'sxedpointtheorem). Proof: ItiseasytoseethatFiscontractingandhencehasauniquexedpoint<br />
(a;E)wherea2Actand2Distr(IM)suchthatSupp() Proof: Forsimplicity,projn=projIMn. 1andx2IM,projIMn(x)isanitesetconsistingofpairs projIMn�1(IM).<br />
Distr(IM)withSupp() Proof:IMcanbewrittenasdisjointunionoftheopenballsB(x;1=2n�2),x2projn�1(IM). Claim1:IfE2Eval(IM)thenEval(projn�1)(E)=E<strong>for</strong>somedistribution projn�1(IM). 2<br />
E(B(x;1=2n�2))6=0impliesx2N.ForallopensU, ByLemma5.3.20(page117),thereexistsacountablesubsetNofprojn�1(IM)with<br />
where2Distr(IM)isgivenby(x)=0ifx=2N,(x)=E(B(x;1=2n�2))ifx2N.c Eval(projn�1)(E)(U)=E(proj�1 n�1(U))= x2N\UE(B(x;1=2n�2))=[U] X<br />
then Claim2:IfE,E02Eval(IM)andd(Eval(projn�1)(E);Eval(projn�1)(E0)) Eval(projn�1)(E)=Eval(projn�1)(E0): 1=2n�1<br />
projn�1(IM).Then,B(x;1=2n�2)\projn�1(IM)=fxg.Hence, Proof:BecauseofClaim1itsucestoshowthatd(E;E0) 0where,02Distr(IM)suchthatSupp(),Supp(0) projn�1(IM).Letx2 1=2n�1implies =<br />
<strong>for</strong>allx2projn�1(IM).There<strong>for</strong>e,=0.c (x)=[B(x;1=2n�2)]=0[B(x;1=2n�2)]=0(x)<br />
Claim3:projn(x)isanitesetconsistingofpairs(a;E)where Proof:Theelementsofprojn(x)areofthe<strong>for</strong>m(a;E)where Supp() projn�1(IM). 2Distr(IM)suchthat 2Distr(IM)with<br />
Supp() Eval(IM))andsinceprojn(x) projn(x)with projn�1(IM)(seeClaim1).Sinceprojn(x)iscompact(asasubsetofAct projn(x) S2projn(x)B(;1=2n)thereexistsanitesubset [2B(;1=2n): of<br />
where2Distr(IM)withSupp() NotethatB(;)isanopenballinAct Claim2yields=.There<strong>for</strong>e,=(a;E)2.Hence,projn(x)= (a;E)2projn(x).Thereexists2 projn�1(IM).Then,a=bandd(E;E)
124 Theorem5.3.27(cf.Theorem5.1.21,page98)IPisadensesubspaceofIM.More CHAPTER5.DENOTATIONALMODELS<br />
precisely,thereexistsauniquefunction{IM:IP!IMsuchthat<strong>for</strong>allT2IP,<br />
Thisfunction{IMisinjectiveand{IM(IP)isadensesubspaceofIM. {IM(T)=f(a;EDistr({IM)()):Ta �!g:<br />
Proof: (IP!IM)begivenbyF(f)(T)=f(a;EDistr(f)()):Ta auniquexedpoint{andthatthisfunction{isinjectiveand{(IP)adensesubspaceof nitelybranching{F(f)(T)isniteandhencecompact.WehavetoshowthatFhas Weshortlywriteprojnand{insteadofprojIMnand{IM.LetF:(IP!IM)!<br />
IM.ItiseasytoseethatF(projnf)=projn+1F(f)<strong>for</strong>allfunctionsf:IP!IM. �!g.Notethat{sinceTis<br />
Claim1:{isinjective. Denition:Let{betheuniquexedpointofF(Banach'sxedpointtheorem). Hence,Fiscontracting(Lemma5.3.25,page123).<br />
Proof:BecauseofLemma3.4.8(page56)itsucestoshowthat{(T)={(T0)implies TgetT Weshowbyinductiononnthatprojn({(T))=projn({(T0))iT nT0<strong>for</strong>alln T0.Hence,T=T0(Corollary5.1.6,page93). 0.SinceT,T0arenitelybranching(andthere<strong>for</strong>eimage-nite)we<br />
induction(n=0)thereisnothingtoshow.Intheinductionstepn=)n+1wesuppose that,<strong>for</strong>allT1,T0 12IP,projn({(T1))=projn({(T0 1))iT1nT0 1. nT0.Inthebasisof<br />
1.Letprojn+1({(T))=projn+1({(T0))andTa<br />
Byinductionhypothesis,A=fT0 T0a �!0with =Distr(projn{)().Since(a;E)2projn+1({(T0))thereexistsatransition =Distr(projn{)(0).LetA2IP=n,T12Aandx=projn({(T1)). �!.Then,(a;E)2projn+1({(T))where<br />
2.LetT Hence,A={�1(proj�1 n(x)).Thus,[A]=(x)=0[A].Bysymmetry,T 12IP:x=projn({(T0 1))g:<br />
Let(a;E)2projn+1({(T)).ThereisatransitionTa SinceTn+1T0.Bysymmetryitsucestoshowthatprojn+1({(T)) �!withE=EDistr(projn{)(). projn+1({(T0)). n+1T0.<br />
Weshown+1T0thereexistsatransitionT0a Distr(projn{)()=Distr(projn{)(0): �!0with[A]=0[A]<strong>for</strong>allA2IP=n.<br />
Claim2:{(IP)isadensesubspaceofIM. Letx2IMandA={�1(proj�1 Distr(projn{)()(x)=[A]=0[A]=Distr(projn{)(0)(x).c n(x)).Byinductionhypothesis,A2IP=n.Thus,<br />
Proof:Sincex=limprojn(x)<strong>for</strong>allx2IMthesetSprojn(M)isadensesubspaceofIM. Hence,itsucestoshowthatprojn(IM) Since{isinjectivethereexistsauniquefunction|:IM!IPsuchthat|{=idIP.Letx2 Thecasen=0isclear.Intheinductionstepn=)n+1wesupposeprojn(IM) projn+1(IM).ByLemma5.3.26(page123),xisofthe<strong>for</strong>mx=f(ai;Ei):i=1;:::;kg {(IP)<strong>for</strong>alln 0.Weuseinductiononn.<br />
wherei2Distr(IM)suchthatSupp(i) projn(IM).Thus,Supp(i) {(IP)which {(IP).<br />
yields
5.3.PROOFS (*)Distr({|)(i)=i,i=1;:::;k. 125<br />
(Theorem5.1.7,page93).ByRemark12.1.3(page313)and(*): LetX=n(ai;EDistr(|)(i)):i=1;:::;koandT=e�1(X)wheree:IP!Pown(Act Distr(IP))isthebijectionsuchthat(IP;e)isthenalcoalgebraofPownFActDistr<br />
Hence,{(T)=f(a;Eval({)(E)):(a;E)2Xg=f(ai;Ei):i=1;:::;kg=x.Thus, x2{(IP).c Eval({)(EDistr(|)(i))=EDistr({|)(i)=Ei;i=1;:::;k:<br />
projIMn(IM) projIDn(ID)6{ID(IP)(cf.Lemma5.3.16,page116). Remark5.3.28InClaim2intheproofofTheorem5.3.27(page124)wesawthat<br />
RecallthedenitionsoftheoperatorsFIM {IM(IP).Thisshouldbecontrastedwiththedomain-theoreticsettingwhere<br />
Lemma5.3.29TheoperatorsFIM (IM IM!IM)!(IM IM!IM)(seepage101). `,FIM LandFIM L,FIM `:(IM!IM)!(IM!IM)andFIM karecontractingandtheuniquexed k:<br />
pointsarenon-expansive.<br />
-expansiveweobservethatFmapsnon-expansivefunctionstonon-expansivefunctions. Sincethesetofnon-expansivefunctionsIM!IMisaclosedsubspaceofthecomplete Proof: Hence,byLemma5.3.25(page123),Fhasauniquexedpointf.Toseethatfnon- LetF2fFIM `;FIM L;FIM kg.ItiseasytoseethatF(projIMnf)=projIMn+1F(f):<br />
metricspaceofallfunctionsIM!IM,theuniquexedpointfisnon-expansive. Remark5.3.30Inthemetricapproach{whereEval(M)isacompletionofDistr(M) (Theorem5.3.23,page122){theproductofevaluationsE1E2(denedasinSection 12.1.4,page314)canbedenedwithoutusingtheresultofHeckmann[Heck95];namely, asthecanonicalextensionofthenon-expansiveoperator (Forthedenitionof1 product(whichleadstothesameoperator)usesLemma5.3.21(page117):ifE1,E2are Distr(M)Distr(M)!Distr(M 2seeSection2.2,page30.)Analternativedenitionofthe M),(1;2)7!1 evaluationsonMthenE1E2denotestheuniqueevaluationonM Msuchthat,<strong>for</strong> 2.<br />
5.3.5 allopenballsB,B0ofM,(E1E2)(B Fullabstraction B0)=E1(B)E2(B0):31<br />
102)andshowthe\consistency"ofthepartialorderandmetricsemanticsonIDandIM Inthissectionwegivetheproofofthefullabstractionresult(Theorem5.1.24,page (Theorem5.1.26,page102). Notation5.3.31[Theelements[s]decl]IfsisaPCCSstatementanddecladeclarationthen[s]decldenotesthebisimulationequivalenceclassoftheoperationalmeaningof thePCCSprogramhdecl;si,i.e.oftheprobabilisticprocessO[hdecl;si]. ballsofthesameradius.<br />
31NotethattheopenballsoftheproductspaceMMhavethe<strong>for</strong>mBB0whereB,B0areopen
126 Thebasiclemma<strong>for</strong>thefullabstractionresult(Theorem5.1.24,page102)isthefollowing. CHAPTER5.DENOTATIONALMODELS<br />
Recallthat<br />
SeeTheorem5.3.10(page111)andTheorem5.3.27(page124). {ID:IP!IDistheuniquefunctionwith{ID(T)=f(a;EDistr({)()):Ta {IM:IP!IMtheuniquefunctionsuchthat{IM(T)=f(a;EDistr({)()):Ta �!gcl, �!g.<br />
Lemma5.3.32LetX=IMorX=ID.Then,<strong>for</strong>eachdeclarationdecl: 0.{IM([nil]decl)=;,{ID([nil]decl)=?ID. 1.{X([a:(Pi2I[pi]si)]decl)=a:(Pi2I[pi]{X([si]decl)) 2.{X([s1+s2]decl)={X([s1]decl)[{X([s2]decl) 3.{X([s1ks2]decl)={X([s1]decl)k{X([s2]decl) 4.{X([s[`]]decl)={X([s]decl)[`]<br />
Proof: 6.{X([Z]decl))={X([decl(Z)]decl) 5.{X([snL]decl)={X([s]decl)nL<br />
Hence,byLemma5.1.5(page92),[Z]decl=[decl(Z)]decl: Inwhatfollows,weshortlywriteprojn,{ratherthanprojXnand{Xand[s]insteadof 0.,1.and2.areclear.6.isclearsinceO[hdecl;Zi] O[hdecl;decl(Z)i]:<br />
A(ifA6=;)and;cl=?ID,asbe<strong>for</strong>e.WhendealingwithIM,weputAcl=A.Then, subsetsoff?g[Act [s]decl.Asbe<strong>for</strong>e,weusetheclosurenotationAcl<strong>for</strong>subsetsofAct Eval(ID).WhendealingwithID,AcldenotestheScott-closureof Eval(IM)and<strong>for</strong><br />
<strong>for</strong>alls2Stmt.Weshow3.Byinductiononnweshowthat {([s])=n(a;EDistr({[])()):sa �!declocl<br />
<strong>for</strong>alls1,s22Stmt.Then,bythenon-expansitivity/d-continuityofkandthefactthat x=limprojn(x)inIMandx=Fprojn(x)inIDweobtain projn({([s1ks2]))=projn({([s1]))kprojn({([s2]))<br />
Thebasisofinduction(n=0)isclearas;k;=;inIMand?IDk?ID=?IDinID.Inthe inductionstepn=)n+1wesupposethat {([s1ks2])={([s1])k{([s2]):<br />
page313)andE12=E1E2wehave <strong>for</strong>allt1,t22Stmt.Lets1,s22Stmt.SinceEDistr(f)()=Eval(f)(E)(Remark12.1.3, projn({([t1kt2]))=projn({([t1]))kprojn({([t2]))<br />
{([s1ks2])=f(a;EDistr({[])()):s1ks2a =f(;EDistr({[k])(12)):s1�!decl1;s2�!decl2;6=gcl [f(a;EDistr({[ks2])()):s1a �!gcl<br />
[f(a;EDistr({[s1k])()):s2a �!declgcl.<br />
�!declgcl
5.3.PROOFS Wedenefunctionsf,g:Stmt Stmt!Xby 127<br />
Wehave g(t1;t2)=projn({([t1kt2])). f(t1;t2)=projn({([t1]))kprojn({([t2])),<br />
whereM=M1[M2if6=andM=M1[M2[Msyn, projn+1({([s1ks2]))=[<br />
Ma1=fDistr(g(;s2))():s1a a2Actf(a;E):2Magcl<br />
Msyn=fDistr(g)(1 Ma2=fDistr(g(s1;)():s2a 2):s1�!decl1;s2�!decl2;6=g. �!declg, �!declg,<br />
<strong>On</strong>theotherhand,<br />
whereN=N1[N2if6=andN=N1[N2[Nsyn, projn+1({([s1]))kprojn+1({([s2]))=[<br />
Na1=fDistr(f(;s2))():s1a �!declg, a2Actf(;E):2Nagcl<br />
Theinductionhypothesisyieldsf(t1;t2)=g(t1;t2)<strong>for</strong>allt1,t22Stmt.Thus,Ma1=Na1, Nsyn=fDistr(f)(1 Na2=fDistr(f(s1;)():s2a 2):s1�!decl1;s2�!decl2;6=g. �!declg,<br />
Ma2=Na2andMsyn=Nsyn.Weconclude:<br />
Theproofsof4.and5.aresimilartotheproofof3. RecallthatfID projn+1({([s1ks2]))=projn+1({([s1]))kprojn+1({([s2])):<br />
5.1.4,page101).Inthenextlemmaweshowthat{asinthemetriccasewherefIM decldenotestheleastxedpointofthed-continuousoperatorFID decl(seeSection<br />
Lemma5.3.33Letdeclbeadeclaration.Then,fID theuniquexedpointofFIM decl{fID declisuniqueasaxedpointofFID declistheuniquexedpointofFID decl. declis<br />
Proof: iff,f0arexedpointsofFID ItiseasytoseethatprojIDn+1 declthen(byinductiononn)projIDn FID decl(projIDnf)=projIDn+1 f=projIDn FID decl(f).Hence, f0.Hence, decl.<br />
<strong>for</strong>alls2Stmt.There<strong>for</strong>ef=f0. f(s)=Gn0projIDn(f(s))=Gn0projIDn(f0(s))=f0(s)<br />
andDIMarefullyabstractwithrespecttosimulationandbisimulationrespectively.More Theorem5.3.34(cf.Theorem5.1.24,page102)ThedenotationalsemanticsDID precisely: (a)IfP,P02PCCSthenDID[P]={ID([P])andPvsimP0iDID[P] (b)IfP,P02GPCCSthenDIM[P]=[P]andP P0iDIM[P]=DIM[P0].<br />
DID[P0].
128 Here,IPisconsideredasasubspaceofIM(Theorem5.3.27,page124)and{ID:IP!ID CHAPTER5.DENOTATIONALMODELS<br />
isasinTheorem5.3.10,page111. thesyntaxofs2StmtthatFXdecl({X[]decl)(s)={X([s]decl):BytheuniquenessoffXdecl Proof: asaxedpointofFXdecl(Lemma5.3.33,page127),wegetfXdecl={X[]decl.Hence, UsingLemma5.3.32(page126)itcanbeshownbystructuralinductionon<br />
Lemma5.1.5(page92)yieldsPvsimP0iDID[P] DX[hdecl;si]=fXdecl(s)={X([hdecl;si]):<br />
Theorem5.3.35(cf.Theorem5.1.26,page102)Thereexistsauniquefunctionf: DIM[P0]. DID[P0]andP P0iDIM[P]=<br />
IM!IDsuchthatf(x)=f(a;Eval(f)(x)):(a;E)2xgcl<strong>for</strong>allx2IM.Thisfunction fsatisesfDIM[P] Proof: Wedeneafunctionf:IM!IDasfollows.Weconsiderthefunction =DID[P]<strong>for</strong>allP2GPCCS.<br />
ItiseasytoseethatFisd-continuousandF(projIDn satisestheconditionsofLemma5.3.9(page111).Letf:IM!IDbetheuniquexed F:(IM!ID)!(IM!ID);F(f)(x)=f(a;Eval(f)(x)):(a;E)2xgcl:<br />
pointofF.Itiseasytoseethatfisa\homomorphism"withrespecttothesemantic operatorsonIMandID.Usingtheresultsof[BMC97]itcanbeshownthat,<strong>for</strong>xed f)=projIDn�1F(f).Thus,F<br />
fID result"fDIM=DIDjGPCCS.<br />
guardeddeclarationdecl,ffIM declistheuniquexedpointofFID declisaxedpointofFID decl.Hence,ffIM decl=fID decl.ByLemma5.3.33(page127), declwhichyieldsthe\consistency
Chapter6<br />
Decidingbisimilarityandsimilarity<br />
straction.Formechanisedpurposes,thedevelopmentofmethods<strong>for</strong>showingthattwoBisimulationandsimulationrelationshaveprovedveryuseful<strong>for</strong>thedesignandabodsand[HuTi92]<strong>for</strong>adecisionprocedure.Theissueofaxiomatizations<strong>for</strong>bisimulationcrucialaspect.Severaltechniques<strong>for</strong>checkingbisimulationequivalence<strong>for</strong>fullyprobabilisticprocesseshavebeenproposed;see[JoSm90,BBS92,LaSk92]<strong>for</strong>axiomaticmeth processesarebisimilarorrelatedviasimulationandtheeciencyofsuchmethodsisa<br />
andsimulationinprobabilisticsystemswithnon-determinismhasbeenconsideredin bisimulationandsimulation<strong>for</strong>concurrentprobabilisticprocesses.Inthischapterwe presentarevisedversionof[Bai96]wherealgorithms<strong>for</strong>decidingbisimulationequiva- [HaJo90,Hans91,Yi94].1Asfarastheauthorknows,[Bai96]andthe<strong>for</strong>thcomingwork [PSS98,BSV98]aretherstattemptsto<strong>for</strong>mulatealgorithmicmethodsthatdealwith lenceand<strong>for</strong>computingthesimulationpreorderinniteconcurrentprobabilisticsystems areproposed.Moreover,weshowthatavariantofthemethod<strong>for</strong>simulationisapplicable <strong>for</strong>fullyprobabilisticsystemsandthe\satisfactionrelation"of[JoLa91]. Decidingbisimulationequivalence:Huynh&Tian[HuTi92]presentedanO(klogn) algorithm<strong>for</strong>computingthebisimulationequivalenceclassesinnitefullyprobabilistic systemswherenisthenumberofstatesandkthenumberofnon-zeroentriesinthe transitionprobabilitymatrix(P(s;a;t))s;a;t.Themethodof[HuTi92]isamodicationof thethepartitioning/splitter-techniqueala[KaSm83,PaTa87]whichper<strong>for</strong>msasequence ofrenementstepsthatreplaceagivenpartitionXbyanerone,eventuallyresultingin renementoperationRene(X)isbasedonasplitterofthecurrentpartitionX.This thesetofbisimulationequivalenceclasses.Asinthenon-probabilisticcase,theunderlying partition/splitter-techniquealsoworks<strong>for</strong>reactivesystemsbutfails<strong>for</strong>generalconcurrent probabilisticsystems.Ourmethod<strong>for</strong>decidingbisimulationequivalenceworks{asinthe non-probabilisticorfullyprobabilisticcase{withapartitioningtechniquebutavoidsthe useofsplitters.ItrunsintimeO(mn(logm+logn))wheremisthenumberoftransitions andnthenumberofstates.Invariousapplications,e.g.whenthesystemarisesfromthe interleavingofl\sequential"probabilisticsystems,wemaysupposethatthenumbermof transitionsispolynomialinn.InthesecasesweobtainthetimecomplexityO(mnlogn).<br />
simulationisdierentfromtheoneproposedby[SeLy94]. intervalsofprobabilities{ratherthanpreciseprobabilities{areused.Theunderlyingnotionofa 1Itshouldbementionedthat[Yi94]dealswithavariantofaction-labelledstratiedsystemswhere<br />
129
130 Computingthesimulationpreorder:Theschema<strong>for</strong>computingthesimulationpre- CHAPTER6.DECIDINGBISIMILARITYANDSIMILARITY<br />
orderofaniteprobabilisticsystemisthesameasinthenon-probabilisticcase[HHK95].<strong>for</strong>whichthereisastepofsthatcannotbe\simulated"byastepofs0.Intheprobabilis- WestartwiththerelationR=S distributions,0arerelatedviaaweightfunctionwithrespecttothecurrentrelation ticcase,thetestwhetherastep\simulates"anotheroneamountsdecidingwhethertwo Sandsuccessivelyremovethosepairs(s;s0)fromR<br />
R,i.e.whether canbereducedtoamaximumowprobleminasuitablechosennetworkwhichyieldsan O((mn6+m2n3)=logn))algorithm<strong>for</strong>computingthesimulationpreorderwhenapplying themethodof[CHM90]<strong>for</strong>solvingthemaximumowproblem. R0(seepage30).Weshowthatthequestionwhether R0<br />
givesanalgorithm<strong>for</strong>computingthesimulationpreorderwherewerstconsiderconcur- probabilisticsystemsandthendealwithconcurrentprobabilisticsystems.Section6.2 Organizationofthatchapter:Section6.1presentsanalgorithm<strong>for</strong>decidingbisimrentprobabilisticsystems(Section6.2.2)andthenthefullyprobabilisticcase(SectionulationequivalencewherewerstrecalltheresultsbyHuynh&Tian[HuTi92]<strong>for</strong>fully<br />
Inthischapter,weneedthedenitionsofbisimulationandsimulation(seeSection3.4, 6.2.3).Wealsoshowhowourmethod<strong>for</strong>computingthesimulationpreordercanbe<br />
page53)wherethelatterusesthedenitionofweightfunctions<strong>for</strong>distributions(see modied<strong>for</strong>the\satisfactionrelation"introducedbyJonsson&Larsen[JoLa91].<br />
Throughoutthischapter,wedealwithniteandaction-labelledsystems. Section2.2,page30).Moreover,weoftenusethenotations<strong>for</strong>partitionsasexplained inSection2.1(page29).Forthecomputationofcertainequivalenceclasseswepropose theuseo<strong>for</strong>deredbalancedtrees.OurnotationscanbefoundinSection12.2(page314).<br />
6.1 Themainidea<strong>for</strong>computingtheprobabilisticbisimulationequivalenceclassesisthe Computingthebisimulationequivalenceclasses<br />
thetrivialpartitionX=fSgandthensuccessivelyreneXbysplittingtheblocksB useofapartitioningtechniqueasproposedbyKanellakis&Smolka[KaSm83](andits improvementbyPaige&Tarjan[PaTa87])<strong>for</strong>thenon-probabilisticcase.Westartwith ofXintosubblocks,eventuallyresultinginthebisimulationequivalenceclasses.This<br />
X.Intuitively,asplitterdenotesapair(a;C)consistingofanactionaandablockC2X schemaissketchedinFigure6.1onpage131.<br />
thatpreventstheinducedequivalenceRXtofullltheconditionofabisimulation;thatis, Inthenon-probabilisticcase,therenementoperatorRene(X)dependsona\splitter"of<br />
inX(i.e.sands0belongtothesameblockofX)andwheresa asplitterisapair(a;C)2ActXsuchthattherearestatess,s02Sthatareidentied<br />
thepartition eachblockB2XintothesubblocksB(a;C)=fs2B:sa (a;C)tobeasplitterofX,therenementoperatorRene(X)=Rene(X;a;C)devides �!CgandBnB(a;C)andreturns �!Cwhiles0a 6�!C.2For<br />
2Here,wewriteta �!Cita �!u<strong>for</strong>someu2C.<br />
fB(a;C);BnB(a;C):B2Xgnf;g:
6.1.COMPUTINGTHEBISIMULATIONEQUIVALENCECLASSES 131<br />
Output:thesetS= Computingthebisimulationequivalenceclasses<br />
Method: Input:anite(non-probabilisticorprobabilistic)systemwithstatespaceS<br />
X=fSg; ofbisimulationequivalenceclasses<br />
ReturnX. WhileXcanbereneddoX:=Rene(X);<br />
Clearly,ifXiscoarserthanS= Figure6.1:Schema<strong>for</strong>computingthebisimulationequivalenceclasses<br />
Hence,Rene(X;a;C)isagaincoarserthanS=XandstrictnerthanX(providedthat (a;C)isasplitterofX).Thus,afteratmostjSjrenementstepsthecurrentpartition coincideswithS=.ThismethodcanbeimplementedintimeO(mlogn)wherenisthe thens6s0<strong>for</strong>alls2B(a;C)ands02BnB(a;C).<br />
numberofstatesandmthenumberoftransitions(i.e.thesizeof�!)[PaTa87](seealso [Fern89]).<br />
systems,thusyieldinganO(klogn)algorithm<strong>for</strong>decidingbisimilarityinfullyproba- 6.1.1 Thepartitioning/splittermethodisadaptedin[HuTi92]<strong>for</strong>fullyprobabilistictransition Thefullyprobabilisticcase<br />
bilistictransitionsystemswherenisthenumberofstatesandkthenumberoftuples (s;a;t)suchthatP(s;a;t)>0.Intheworstcase,wehavek=jActjn2.Ifwesuppose equivalenceinfullyprobabilisticsystems.Moreover,wesawinTheorem3.4.19(page 61)thatsimulationequivalencesimandbisimulationequivalence probabilisticsystems.Thus: ActtobexedthenweobtainthetimecomplexityO(n2logn)<strong>for</strong>decidingbisimulation<br />
Theorem6.1.1(cf.[HuTi92])Infullyprobabilisticsystems,bisimulationandsimula- coincide<strong>for</strong>fully<br />
ofstates. Thebasicideais<strong>for</strong>thefullyprobabilisticcaseistodeneasplitterofapartitionXto tionequivalencecanbedecidedintimeO(n2logn)andspaceO(n2)wherenisthenumber<br />
eachblockB2XbythesubblocksB='(a;C)wheres'(a;C)s0iP(s;a;C)=P(s0;a;C). identiedinX.Then,therenementoperatoraccordingtothesplitter(a;C)replaces beapair(a;C)2ActXsuchthatP(s;a;C)6=P(s0;a;C)<strong>for</strong>somestatess,s0thatare<br />
Asmentionedin[HuTi92],thepartitioning/splittertechniquecaneasilybemodied<strong>for</strong>re- 6.1.2 activesystems(withthesametimecomplexityO(n2logn)).Inthegeneralcase,i.e.deal Theconcurrentcase<br />
ingwithconcurrentprobabilisticsystems,thesplittertechniquefails(seeExample6.1.4,
132 CHAPTER6.DECIDINGBISIMILARITYANDSIMILARITY<br />
Computingthebisimulationequivalenceclassesinreactivesystems Input:anitereactivesystem(S;Act;Steps) Output:thesetS= Method: X=fSg; ofbisimulationequivalenceclasses<br />
ReturnX. Whilethereexistsasplitter(a;C)ofXdoX:=Rene(X;a;C);<br />
page133).WeproposeamethodthatcanbeimplementedintimeO(mn(logm+logn)) Figure6.2:Partioning/splittertechnique<br />
wherenisthenumberofstatesandmthenumberoftransitions.<br />
Denition6.1.2[Thesplitter-basedrenementoperator]IfXisapartitionofS probabilisticsystem(S;Act;Steps). Inwhatfollows,wexanitesetActofactionsandaniteaction-labelledconcurrent<br />
anda2Act,B,C2XthenRene(B;a;C)=B='(a;C) wheretheequivalencerelation'(a;C)=(a;C)\�1 B Bwhichisgivenby: s(a;C)s0iwheneversa �!thenthereexistss0a (a;C)isthekerneloftherelation(a;C)<br />
ForXtobeapartitionofS,asplitterofXisapair(a;C)2Act �!0with[C]=0[C].<br />
Themethodof[PaTa87](orthemethodof[HuTi92]<strong>for</strong>fullyprobabilisticsystems)mod- Rene(B;a;C)6=fBg<strong>for</strong>someB2X. Xsuchthat<br />
ied<strong>for</strong>reactivesystemsissketchedinFigure6.2onpage132.Fortheimplementation ofthismethodweproposetheuseofaqueueQofpossiblesplitters,initiallycontaining andremove(a;C)fromQ.ForeachB2X,wecomputetheprobabilities thepairs(a;S),a2Act.AslongasQisnonempty,wetaketherstelement(a;C)ofQ<br />
WeconstructanorderedbalancedtreeTree(B;a;C)<strong>for</strong>thevaluesps,s2B,withadditional ps=(0 [C]:ifStepsa(s)=fg;s2B: :ifStepsa(s)=;<br />
labelsv:states<strong>for</strong>eachnodevsuchthatnallyv:states=fs2B:v:key=psg.3The nodesinthenaltreerepresentRene(B;a;C);moreprecisely,<br />
thepairs(b;B0),b2Act,totheendofQ.4Usinganimplementationsimilartotheonein IfRene(B;a;C)6=fBgthen<strong>for</strong>eachB02Rene(B;a;C)butoneofthelargestweadd Rene(B;a;C)=fv:states:visanodeinTree(B;a;C)g:<br />
3SeeSection12.2,page314,<strong>for</strong>thenotationsthatweuse<strong>for</strong>orderedbalancedtrees. 4BythelargestblockswemeanthoseblocksB02Rene(B;a;C)wherejB0jismaximal.
6.1.COMPUTINGTHEBISIMULATIONEQUIVALENCECLASSES s1 133<br />
a,1 m<br />
t1mt����@@@@R a,1 s2 m<br />
u1 m v1 mt a,2 a,2<br />
w1 m t2mt����@@@@R 12 AAAAU12<br />
12 AAAAU12<br />
12 AAAAU12v2<br />
m u2 m12 tAAAAU12<br />
Figure6.3:s16s2,buts1ands2cannotbedistinguishedbysplitters. w2 m<br />
[PaTa87]weobtainthetimecomplexityO(n2logn).Forreactivesystems,bisimulation Hence: Theorem6.1.3Inreactivesystems,bisimulationandsimulationequivalencecanbede- equivalence andsimulationequivalencesimarethesame(Theorem3.4.15,page59).<br />
cidedintimeO(n2logn)andspaceO(n2)wherenisthenumberofstates.Be<strong>for</strong>ewepresentourmethod<strong>for</strong>computingthebisimulationequivalenceclassesinarbitraryniteaction-labelledconcurrentprobabilisticsystemswegiveanexamplewhich explainswhythesplittertechniquefailsinthegeneralcase.<br />
bisimilar.5Then,s16s2.<strong>On</strong>theotherhand,s1,s2cannotbedistinguishedbysplitters.6 Thus,thealgorithm<strong>for</strong>decidingbisimilaritybasedonthesplittertechniquewouldreturn posethatt1Example6.1.4WeconsiderasystemasshowninFigure6.3(page133)wherewesup- thats1ands2arebisimilar. t2,u1 u2,v1 v2,w1 w2andthatt1;u1;v1;w1arepairwisenon-<br />
replaceeachblockBofthegivenpartitionXbytheequivalenceclassesofBwithrespect totheequivalencerelationXwhichidentiesexactlythosestatess,s02Bsuchthat<strong>for</strong> arenementoperatorthatdoesnotdependonasplitter.Ineachrenementstep,we Forthegeneralcase,wemaintaintheschemasketchedinFigure6.1(page131)butuse<br />
S.[X]denotesthevector([B])B2X.XisassociatedwiththeequivalencerelationX eachtransitionsa Notation6.1.5[Thevector[X]andtheequivalenceX]LetXbeapartitionof �!thereexistsatransitions0a �!0with[C]=0[C]<strong>for</strong>allC2X.<br />
Denition6.1.6[Therenementoperator]Wedene<br />
onSthatisgivenby: sXs0i f(a;[X]):sa �!g=f(a;0[X]):s0a �!0g.<br />
Lemma6.1.7LetXbeapartitionofSwhichiscoarserthanS=.Then: Rene(X)= B2XB=X: [<br />
(a)Rene(X)isapartitionwhichiscoarserthanS=. 5Theoutgoingtransitionsofthestatesti,ui,vi,wiareomittedinthepicture. 6I.e.s1'(b;C)s2<strong>for</strong>allactionsbandallblocksCofapartitionXofSthatiscoarserthanS=.
134 (b)IfRene(X)=XthenX=S=. CHAPTER6.DECIDINGBISIMILARITYANDSIMILARITY<br />
Lemma6.1.7ensuresthetotalcorrectnessofourschema<strong>for</strong>decidingbisimilaritysketched Proof: inFigure6.1(page131).Westateourmainresult: easyverication.<br />
mthenumberoftransitions. Theorem6.1.8Inconcurrentprobabilisticsystems,bisimulationequivalencecanbede-<br />
Remark6.1.9Inmanysituations,mispolynomialinn.Forexample,whenthesystem cidedintimeO(mn(logm+logn))andspaceO(mn)wherenisthenumberofstatesand<br />
arisesfromtheinterleavingofl\sequential"probabilisticsystemsthenm cases,thetimecomplexity<strong>for</strong>decidingbisimulationequivalenceisO(mnlogn). Intheremainderofthissectionwedecribehowtoimplementthealgorithmsketched ln.Inthese<br />
andspacecomplexitywhereweusetherenementoperatorRene(X)ofDenition6.1.6 inFigure6.1(page131)<strong>for</strong>concurrentprobabilisticsystemstoobtainthedesiredtime (page133).Themainidea<strong>for</strong>theimplementationoftheoperatorRene(X)isrstto computethesetof\stepclasses"withrespecttoXfromwhichthesetsB=X,B2X, Denition6.1.10[Stepclasses]LetXbeapartition,B2Xanda2Act.Then, canbederived.<br />
Twodistributions,02Stepsa(B)arecalledX-equivalent(denoted Stepsa(B)=[ s2BStepsa(s):<br />
a2Actandafunctionh:B!2Distr(S)withh(s) [X]=0[X].AstepclassofBwithrespecttoXisapair(a;h)consistingofanaction Stepsa(s)<strong>for</strong>alls2Bsuchthat X 0)i<br />
ForB02Rene(X),wedeneastepclassofB0withrespecttoXtobeapair(a;h0) s2Bh(s)2Stepsa(B)=X: [<br />
BdenotestheuniqueblockinXwhichcontainsB0.StepClX()denotesthesetofstep wherea2Actandh0=hjB0<strong>for</strong>somestepclass(a;h)ofBwithrespecttoXwhere<br />
respecttoX,h(s)6=;ih(s0)6=;.LetXbethecurrentpartition<strong>for</strong>whichwewant Clearly,ifB2Xands,s02BthensXs0i,<strong>for</strong>eachstepclass(a;h)ofBwith classesof()withrespecttoX.<br />
eachstepclass(a;h0)ofasubblockB02Rene(X)ofB(withrespecttoX)thereisstep tocomputeRene(X)andletXoldbethepartitioninthepreviousrenementstep.7For<br />
stepclassofBwithrespecttoXold,letC(a;hold)bethesetofalltuples(a;L;h)where class(a;hold)ofBwithrespecttoXoldsuchthath0(s) precisely,thesubblocksB02Rene(X)ofBandtheirstepclasseswithrespecttoXcan bederivedfromthestepclassesofBwithrespecttoXoldasfollows.For(a;hold)tobea hold(s)<strong>for</strong>alls2B0.More<br />
7I.e.weassumethatthecurrentpartitionXisRene(Xold).<br />
;6=L B
6.1.COMPUTINGTHEBISIMULATIONEQUIVALENCECLASSES h:L!2Distr(S)isafunctionwith;6=h(s) hold(s)<strong>for</strong>alls2L 135<br />
thereexistsarealvectorp=(pC)C2Xsuchthat {[X]=p<strong>for</strong>all2h(s),s2L<br />
Fors,s02BwehavesXs0i {Ifs2BnLthenh(s)\f2Distr(S):[X]=pg=;. {Ifs2Land2hold(s)nh(s)then[X]6=p.<br />
Were<strong>for</strong>mulatethisobservationasfollows.Let(a1;L1;h1);:::;(ar;Lr;hr)beanenumerationof 8(a;hold)2StepClXold(B)8(a;L;h)2C(a;hold)[s2Lis02L].<br />
LetL1i=Li,L0i=BnLiandLb=Lb1 (a;hold)2StepClXold(B)C(a;hold): [<br />
B=X=fLb:b2f0;1grgnf;g: 1\Lb2 2\:::\Lbr rifb=(b1;:::;br)2f0;1gr.Then,<br />
Moreover,<strong>for</strong>thenewsubblockL(b1;:::;br)(whereb=(b1;:::;br))wehave<br />
whereh0i:L(b1;:::;br)!2Distr(S)isgivenbyh0i(s)=hi(s).(I.e.h0i=hijL(b1;:::;br)isthe restrictionofhionthestatesofL(b1;:::;br).)Clearly,<strong>for</strong>computingthesetsLbandtheir StepClX(L(b1;:::;br))=f(ai;h0i):i=1;:::;r;bi=1g<br />
stepclasses,thetuples(ai;Li;hi)whereLi=Band(ai;hi)2StepClX(B)arenotof importance.There<strong>for</strong>e,wedividethetuples(ai;Li;hi)intotwoclasses: OldClX(B)denotesthesetoftuples(ai;Li;hi)thatrepresentan\oldstepclass" (i.e.Li=Band(ai;hi)2StepClXold(B)).<br />
Li6=Bor(ai;hi)=2StepClXold(B)). NewClX(B)thesetoftuples(ai;Li;hi)thatrepresenta\newstepclass"(i.e.either OldClX(B)=n(a;B;hold)2C(a;hold):(a;hold)2StepClX(B)o<br />
Forthetestwhether[X]=0[X]weusethefollowingfacts.Let,02Distr(S)such that[Xold]=0[Xold]andB2X,Bold2Xold. NewClX(B)=n(a;L;h)2C(a;hold):(a;hold)2StepClX(B);(L;h)6=(B;hold)o:<br />
(1)IfB2Xold(i.e.Bisablockthathasnotbeenrenedinthelastrenementstep) (2)IfBoldisrenedintothesubblocksB1;:::;Bk+12Xthen then[B]=0[B].<br />
Becauseof(2),<strong>for</strong>computingRene(X),itsucestoconsider<strong>for</strong>eachblockBold2 Becauseof(1),weonlyhavetoconsiderthe\new"blocks,i.e.theblocksB2XnXold. [Bi]=0[Bi],i=1;:::;k+1 i [Bi]=0[Bi],i=1;:::;k.<br />
XoldnXallsubblocksB2XofBoldbutoneofthelargest.Theseobservations(1)and<br />
suchthat:<br />
(2)leadtotheuseofaset New XnXold
136 CHAPTER6.DECIDINGBISIMILARITYANDSIMILARITY<br />
Input:aniteaction-labelledconcurrentprobabilisticsystem(S;Act;Steps) Output:thesetS= Computingthebisimulationequivalenceclassesinconcurrentprobabilisticsystems<br />
Method: (0)computeXinit,NewinitandStepClXtrivial(B)<strong>for</strong>allB2Xinit ofbisimulationequivalenceclasses<br />
(1)X:=Xinit;New:=Newinit; (2)WhileNew6=;dobegin (2.1)New0:=;andX0:=;; (2.2)ForallB2Xdo (2.2.1)computeNewClX(B)andOldClX(B)withthemethodofFigure (2.2.2)computeB=X,NewBandStepClX(C)<strong>for</strong>C2B=Xwiththe methodexplainedonpage139; 6.6(page142);<br />
(3)ReturnX. (2.3)X:=X0;New:=New0; (2.2.3)New0:=New[NewBandX0:=X0[B=X;<br />
(*)IfBold2XoldnX(i.e.therenementoperationRene(Xold)splitstheblockBold Figure6.4:Algorithm<strong>for</strong>decidingbisimulationequivalenceinconcurrentsystems<br />
intotwoormoresubblocks)thenthereexistk {jBoldn(B1[:::[Bk)j {B1;:::;Bk {Boldn(B1[:::[Bk)2XnNew Bold jBij,i=1;:::;k. 1andB1;:::;Bk2Newsuchthat<br />
Then(by(1)and(2)),if,02Distr(S)suchthat[Xold]=0[Xold]then Thealgorithm<strong>for</strong>computingthebisimulationequivalenceclassesisshowninFigure6.4, page136. [X]=0[X]i [C]=0[C]<strong>for</strong>allC2New.<br />
Initialization(step(0)inFigure6.4(page136)):Weskiptherstrenementstep<br />
nodevislabelledby andstartwiththepartitionXinit=S= becomputedwiththefollowingmethod.Wechoosewithaxedenumerationa1;:::;ak ofActandconstructabinarytreeTreebysuccessivelyinsertingnodesandedges.Each wheres s0iact(s)=act(s0).8Xinitcan<br />
itsdepthv:depthinTree,<br />
8I.e.wedealwiththeinitialpartitionXinit=Rene(fSg)ratherthantrivialpartitionfSg.<br />
asubsetv:actionsofAct, thenamesv:leftandv:rightoftheleftandrightsonofvinTree.
6.1.COMPUTINGTHEBISIMULATIONEQUIVALENCECLASSES Inthecasewherevdoesnothavealeft(right)sonv:left(v:right)isundened(?).Each 137<br />
nodevofdepthkisaleafandisadditionallylabelledby asubsetv:statesofS,<br />
v0:right=?.Then,<strong>for</strong>eachstates2S,wetraversethetreestartingintheroot Initially,Treeconsistsofitsrootv0wherev0:depth=0,v0:actions=;,v0:left= anaturalnumberv:counterthatcountsthenumberofelementsinv:states.<br />
v0.Ifwehavereachedanodevwithv:depth=i
138 s1 CHAPTER6.DECIDINGBISIMILARITYANDSIMILARITY<br />
u1<br />
v1 t1 u01 u2 k k s2 s3 t3 s4<br />
kk l v2 t2 u02 u00 2 v3 wv<br />
v4 t4<br />
k k<br />
k k k n n k �a��@@@@R a,1 k k<br />
12 sBBBBBN 12 � ��@@@@R<br />
12a,2 JJJJJJ^<br />
s1838 ab a,4<br />
b b k??<br />
ck13<br />
s?<br />
23<br />
? ? ? BBBBBBN<br />
Figure6.5: ? b?<br />
andStepClXtrivial(B4)=;. Therenementstep(step(2)inFigure6.4(page136)):Asbe<strong>for</strong>e,letX= Rene(Xold)bethecurrentpartitionandXoldthepartitionofthepreviousrenement step.Moreover,NewisapropersubsetofXnXoldthatsatisescondition(*)(seepage<br />
eachB2X,wecomputeNewClX(B)andOldClX(B)withthemethodsketchedinFigure 136).<br />
a2Act,L 6.6(page142).WeuseasetQoftupleshj;b;a;L;hiwhere0 Step(2.2.1)inFigure6.4(page136):LetC1;:::;ClbeanenumerationofNew.For<br />
Ifb=oldthenL=Band(a;h)2StepClXold(B) Bandh:L!2Distr(S)isafunctionwithh(s) Stepsa(s)suchthat: j l,b2fold;newg,<br />
TheelementsofQcanbeviewedasnodesofa<strong>for</strong>est(acollectionoftrees)wherethe rootsarethenodesofthe<strong>for</strong>mh0;old;a;B;holdiwith(a;hold)2StepClXold(B).Therst Foralls,s02Land2h(s),02h(s0),[Ci]=0[Ci],i=1;:::;j.<br />
thenwehave: componentjofanodehj;b;a;L;histands<strong>for</strong>thedepthofthatnode.Thesonsofthe alls2L0.Moreprecisely,ifhj+1;bi;a;Li;hii,i=1;:::;r,arethesonsofhj;b;a;L;hi nodehj;b;a;L;hiareofthe<strong>for</strong>mhj+1;b0;a;L0;h0iwhereL0<br />
b1=:::=br=(new:ifr 2 Landh0(s) h(s)<strong>for</strong><br />
Moreover,ifH=Ss2Lh(s)andHi=Ss2Lihi(s),i=1;:::;r,then b :ifr=1.<br />
(**) fH1;:::;Hrg=H=j+1 Xwhere j+1 X 0i hi;old;a;B;hi,i=0;1;:::;j.Theleavesare Thenodesonthepathfromtheroottoanodeofthe<strong>for</strong>mhj;old;a;B;hiarethenodes [Cj+1]=0[Cj+1].<br />
{allnodesofthe<strong>for</strong>mhl;b;a;L;hi(i.e.allnodesofdepthlwherel=jNewj)<br />
havefoundabisimulationequivalenceclassconsistingofasinglestate.<br />
{allnodeshj;b;a;L;hiwherejLj=1.9 9Forthesenodes,thepossiblesplittingsofthestepclassesofthesetLarenotofinterestsincewe
6.1.COMPUTINGTHEBISIMULATIONEQUIVALENCECLASSES Aleafofthe<strong>for</strong>mhl;old;a;B;hirepresentsanelementofOldClX(B)(because(a;h)2 139<br />
\new"stepclasses. StepClXold(B)).Thiscasecorrespondstostep(1.7)wheretheorderedbalancedtreeT<br />
Step(2.2.2)inFigure6.4(page136):HavingobtainedthesetsNewClX(B)and constructedinstep(1.2)consistsofitsroot.Leavesofthe<strong>for</strong>mhj;new;a;L;histand<strong>for</strong><br />
(a;L;h)2NewClX(B)(ratherthanalltuples(a;L;h)2S(a;hold)C(a;hold)).Wechoosean enumeration(a1;L1;h1);:::;(ar;Lr;hr)ofNewClX(B)andconstructabinarytreeTreeB OldClX(B),wederiveB=Xasdescribedonpage135whereweonlyconsiderthetuples suchthateachleafvofdepthrislabelledbythesetv:states=Lv1\:::\Lvrwhere v0v1:::vr=visthepathfromtherootofTreeBtovand<br />
Theconstructionofthistreeissimilartotheinitializationstep.Westartwiththetree Lvi=(Li BnLi:ifviistherightsonofvi�1. :ifviistheleftsonofvi�1<br />
totherightsonv:rightifs=2Li+1(possiblyinsertingtheleftorrightsonifnecessary). Ifhehavereachedaleaf(anodevofdepthr)thenweinsertsintothesetv:states. Ifwereachedanodevofdepthi
140 Thistreemightbeofthefollowing<strong>for</strong>m. CHAPTER6.DECIDINGBISIMILARITYANDSIMILARITY<br />
v1v0 k v2v3 kAAAUAAAU k v0:key=1=2v0:states=fs1;s2gv0:steps(si)=fig<br />
k v1:key=0 v2:key=2=3v2:states=fs4g v3:key=1 v1:states=fs1;s2gv1:steps(si)=f1uig v3:states=fs3g v2:steps(s4)=f4g<br />
weaddtheelements WegetV1=fv2;v3gandV2=fv0;v1g.Thus,instep(1.4)ofFigure6.6(page142), v3:steps(s3)=f1t3g<br />
toQwhereh1;1(si)=figandh1;2(si)=f1uig,i=1;2.Instep(1.5)ofFigure6.6(page 142),thetuples(a;fs4g;v2:steps)and(a;fs3g;v3:steps)areinsertedintoNewClXinit(B1). h2;new;a;fs1;s2g;h1;1iandh2;new;a;fs1;s2g;h1;2i<br />
andh2;new;a;fs1;s2g;h1;2iofQweconstructorderedbalancedtrees<strong>for</strong>thevalues sultingtreeconsistsofasinglenode;thus,instep(1.6)ofFigure6.6(page142),the Then,againinstep(1.2)ofFigure6.6(page142),<strong>for</strong>theelementsh2;new;a;fs1;s2g;h1;1i<br />
obtainOldClXinit(B1)=;and tuples(a;fs1;s2g;h1;1)and(a;fs1;s2g;h1;2)areinsertedintoNewClXinit(B1).Hence,we 1[B3]=2[B3]=0and1u1[B3]=1u2[B3]=0respectively.Inbothcases,there-<br />
whereh03(s3)=f1t3g,h04(s4)=f4g.Instep(2.2.2)ofthemainalgorithm(Figure6.4, page136),weapplythemethoddescribedonpage139andconstructthetreeTreeB1 NewClXinit(B1)=f(a;fs1;s2g;h1;1);(a;fs1;s2g;h1;2);(a;fs3g;h03);(a;fs4g;h04)g<br />
whichisofthefollowing<strong>for</strong>m.<br />
s�@@R �s<br />
sHHHHjHHHHj<br />
s s<br />
@@Rfs1;s2g<br />
fs3gfs4g s+AAU sQQQss<br />
Thus,weobtainB1=Xinit=ffs1;s2g;fs3g;fs4gg,NewB1=ffs3g;fs4ggand StepClXinit(fsig) StepClXinit(fs1;s2g)=f(a;h1;1);(a;h1;2)g<br />
FortheblocksB2fB2;B3;B4g,weobtainNewClXinit(Bi)=OldClXinit(B4)=;and whereh1;1,h1;2,h03andh04areasabove. =f(a;h0i)g;i=3;4:<br />
Figure6.6(page142)andobtainNewClXinit(Bi)=OldClXinit(B4)=;and Instep(2.2.1)ofthemainalgorithm(Figure6.4,page136),weapplythemethodof OldClXinit(B2)=f(b;B2;StepsbjB2)g;OldClXinit(B3)=f(c;B3;StepscjB3)g:<br />
OldClXinit(B2)=f(b;B2;StepsbjB2)g,OldClXinit(B3)=f(c;B3;StepscjB3)g
6.1.COMPUTINGTHEBISIMULATIONEQUIVALENCECLASSES ForallthreeblocksB2;B3;B4,instep(2.2.2)ofthemainalgorithm(Figure6.4,page 141<br />
136),theconstructionofthetreeTreeBiisskippedbecauseNewClXinit(Bi)=;.Hence, wegetBi=Xinit=fBig,NewBi=;andStepClXinit(Bi)=StepClXtrivial(Bi),i=1;2.In summary,therstrenementstepyieldsthepartition<br />
andNew=fB1;B2;B3g.Inthesecondrenementstep,alltreesconstructedinstep (2.2.1)ofthemainalgorithmofFigure6.4(i.e.instep(1.2)ofmethodofFigure6.6 X=Rene(Xinit)=ffs1;s2g;fs3g;fs4g;B2;B3;B4g<br />
(page142))consistofasinglenode.Thus,B=X=fBg,NewB=;<strong>for</strong>allB2X.In step(3),ouralgorithmreturnsXasthesetofbisimulationequivalenceclasses. Complexity:Letn=jSjbethenumberofstates,mthenumberoftransitions,i.e.m= theinitialization(step(0)ofFigure6.4,page136)takesO(njActj)=O(n)timeas, <strong>for</strong>eachstates2S,wetraverseatreeofdepthjActj.10Inwhatfollows,letNbethe Ps2SjSteps(s)j.ItisclearthatourmethodcanbeimplementedinspaceO(nm).Clearly,<br />
cost<strong>for</strong>theexecutionsofstep(2.2.1)ofthemainalgorithm(Figure6.4,page136)where Figure6.4)andletXibethepartitionwhichweobtaininthe(i+1)-strenementstep, totalnumberofrenementsteps(thenumberofexecutionsoftheloopinstep(2)in<br />
werangeoverallblocksB2Xi,i=0;1;:::;N�1andlet i.e.X0=XinitXi+1=Rene(Xi),i=0;1;:::;N�1,XN=S=.LetCosti(2:2:1)bethe<br />
bethetotalcostcausedbystep(2.2.1).Similarly,wedeneCost(2:2:2)tobethetotal Cost(2:2:1)=N�1 Xi=0Costi(2:2:1)<br />
renementsteps.WeshowinSection6.3(Lemma6.3.4(page155)andLemma6.3.6 costthatarisesfromtheexecutionsofstep(2.2.2)ofFigure6.4wherewerangeoverall (page157)):Cost(2:2:1)=O(mn(logm+logn));Cost(2:2:2)=O(mn): Thus,weobtainthetimecomplexityO(mn(logm+logn))<strong>for</strong>computingthebisimulation equivalenceclasses.<br />
10RecallthatweassumeActtobexed.
142 CHAPTER6.DECIDINGBISIMILARITYANDSIMILARITY<br />
ComputingNewClX(B)andOldClX(B) Input: {apartitionXandB2X {anenumerationC1;:::;ClofNew<br />
(0)WesetNewClX(B):=;,OldClX(B):=;and Method: {StepClXold(B)(thestepclassesofBwithrespecttothepreviouspartition)<br />
(1)WhileQ6=;do (1.1)Choosesomehj;b;a;L;hi2QandsetQ:=Qnfhj;b;a;L;hig; Q:=nh0;old;a;B;holdi:(a;hold)2StepClXold(B)o;<br />
(1.2)ConstructanorderedbalancedtreeT<strong>for</strong>p=[Cj+1],2h(s),s2Lwhere eachnodevislabelledbyarecord(v:key;v:states;v:steps)suchthat {v:stepsisthefunctionthatassignstoeachstates2v:statestheset {v:states=fs2B:v:key=[Cj+1]<strong>for</strong>some2h(s)g,<br />
Wedene: v:steps(s)=f2h(s):v:key=[Cj+1]g;<br />
(1.3)IfTconsistsoftwoormorenodesthenb0:=newelseb0:=b; V2:=fv:vnodeinTwithjv:statesj V1 :=fv:vnodeinTwithjv:statesj=1g; 2g;<br />
(1.4)Ifj
6.2.COMPUTINGTHESIMULATIONPREORDER 6.2 Computingthesimulationpreorder 143<br />
thenon-probabilisticcase[HHK95]:WestartwiththetrivialpreorderR=S thensuccessivelyremovethosepairs(s;s0)fromRwhereshasatransitionthatcannotbe concurrentprobabilisticsystem(S;Act;Steps).Theschemaofouralgorithmisasin Wepresentanalgorithmthatcomputesthesimulationpreorderofaniteaction-labelled<br />
\simulated"byatransitionofs0.ThisschemaissketchedinFigure6.7(page144).Inthe non-probabilisticcase,svRs0i<strong>for</strong>eachtransitionsa �!tthereisatransitions0a �!t0with Sand<br />
(t;t0)2R.For(S;Act;Steps)tobeanaction-labelledconcurrentprobabilisticsystem ands,s02S,therelationvRisgivenby:svRs0i<strong>for</strong>eachtransitionsa transitions0a Denition3.4.16(page60),i.e.svRs0ieithersisterminalorP(s;)R0P(s0;)where R0=fha;ti;ha;t0i):(t;t0)2R;a2Actg. �!0with R0.11Inthefullyprobabilisticcase,svRs0isdenedasin �!thereisa<br />
Fornon-probabilisticsystems,theschemaofFigure6.7canbeimplementedintime O(mn)[HHK95].Itseemstobehardtomodifythemethodof[HHK95]<strong>for</strong>theprobabilis- ofsomestatet(inthesensethatthereisatransitionsa ticcasebecauseitsuccessivelyremovesthosepairs(s;s0)ofRwheresisana-predecessora-successorinft0:(t;t0)2Rg.Theproblemintheprobabilisticcaseisthattheintheprobabilities<strong>for</strong>thea-successors/predecessorsofthestatesdonotcontainthenecesducedpredecessor/successorrelationsonstates12doesnotgiveenoughin<strong>for</strong>mation.Even �!t)ands0doesnothavean<br />
statesthatcannotbedistinguishedwiththesepredecessor/successorrelations(cf.Remark saryin<strong>for</strong>mation<strong>for</strong>computingthesimulationpreordersincetheremightbenon-similar<br />
testwhethersvRs0isdonewiththehelpofamethod<strong>for</strong>decidingwhether Intheprobabilisticcase,weimplementtheschemaofFigure6.7insuchawaythatthe 3.4.11,page57).<br />
chosennetwork. somedistributions,0onanitesetXandabinaryrelationRonX.Weshowthat thequestionwhether R0canbereducedtoamaximumowprobleminasuitable R0<strong>for</strong><br />
viaamaximumowproblem.Then,inSection6.2.2wedescribeouralgorithm<strong>for</strong> Weproceedinthefollowingway.InSection6.2.1,weexplainhowtotestwhether concurrentprobabilisticsystemswhileSection6.2.3dealswithfullyprobabilisticsystems. R0<br />
6.2.1 Weshowthatthequestionwhethertwodistributionsarerelatedviaaweightfunction (i.e.whether Thetestwhether R0)canbereducedtoamaximumowprobleminasuitablechosen R0<br />
network. Networksandtheirmaximumow:Webrieyrecallthebasicdenitionsofnetworks. Forfurtherdetailsaboutnetworksandmaximumowproblemsseee.g.[Even79].A (thesink)andacapacitycap,i.e.afunctioncap:E!IR0whichassignstoeachedge networkisatupleN=(N;E;?;>;c)where(N;E)isanitedirectedgraph(i.e.Nisa setofnodes,E 11Here,Ristheweight-function-basedrelationdenedasinSection2.2,page30. 12E.g.inconcurrentprobabilisticsystems,sisana-predecessorofti(t)>0<strong>for</strong>some2Stepsa(s)<br />
N Nasetofedges)withtwospeciednodes?(thesource)and>
144 CHAPTER6.DECIDINGBISIMILARITYANDSIMILARITY<br />
Computingthesimulationpreorder<br />
Method: Output:thesimulationpreordervsimonS Input:anite(probabilisticornon-probabilistic)systemwithstatespaceS<br />
ReturnR. Whilethereexists(s;s0)2Rwiths6vRs0doR:=Rnf(s;s0)g; R:=S S;<br />
(v;w)2Eanon-negativerealnumbercap(v;w).Aowfunctionf<strong>for</strong>Nisafunction Figure6.7:Generalschema<strong>for</strong>computingthesimulationpreorder<br />
whichassignstoeachedgeearealnumberf(e)suchthat: {0 {Letin(v)bethesetofincomingedgestonodevandout(v)thesetofoutgoingedges fromnodev.Then,<strong>for</strong>eachnodev2Nnf?;>g: f(e) cap(e)<strong>for</strong>alledgese.<br />
e2in(v)f(e)= X e2out(v)f(e) X<br />
TheowFlow(f)offisgivenby<br />
ThemaximumowinNisthesupremum(maximum)overthevaluesFlow(f)wheref Flow(f)= e2out(?)f(e)�X X<br />
rangesoverallowfunctionsinN.Algorithmstocomputethemaximumowaregiven e2in(?)f(e):<br />
Thetestwhether e.g.in[FoFu62,Dini70,MPM78,CHM90].<br />
Wechoosenewelements?and>notcontainedinS[S,?6=>.Weassociatewith (;0)thefollowingnetworkN(;0;R).ThenodesaretheelementsofS[Sand?(the 02Distr(S).LetS=ft:t2Sgwheretarepairwisedistinct\new"states(i.e.t=2S). R0:LetSbeaniteset,RasubsetofS Sandlet,<br />
source)and>(thesink),i.e.N=f?;>g[S[S.Theedgesare<br />
I.e.theunderlyinggraph(N;E)isofthe<strong>for</strong>m E=f(s;t):(s;t)2Rg[f(?;s):s2Sg[f(t;>):t2Sg:<br />
? sn > s2 s1<br />
sn<br />
s2 k k s1 m<br />
HHHHHHHj<br />
*: . ZZZZZZZ~<br />
-<br />
k . XXXXXXXz* HHHHHHHj -* m k : ZZZZZZZ~<br />
XXXXXXz
6.2.COMPUTINGTHESIMULATIONPREORDER whereS=fs1;:::;sngandwherethearrowsbetweenthenodessiandthenodessj 145<br />
Thecapacitiescap(e)2[0;1]aregivenby: describetherelationRinthesensethatthereisanarrowfromsitosji(si;sj)2R.<br />
Asin(?)=;wegetcap(?;s)=(s),cap(t;>)=0(t),cap(s;t)=1. <strong>for</strong>eachowfunctionfinN(;0;R). Flow(f)= s2Supp()f(?;s) X<br />
Lemma6.2.1 Proof: Firstweassumethat R0ithemaximumowinN(;0;R)is1.<br />
Flow(f)=Xs2Sf(?;s) R0.ForeachowfunctionfinN(;0;R):<br />
Letweightbeaweightfunction<strong>for</strong>(;0)withrespecttoR.Wedeneaowfunction Xs2Scap(?;s)=Xs2S(s)=1:<br />
fasfollows:f(?;s)=(s),f(t;>)=0(t)andf(s;t)=weight(s;t).Then,<br />
Hence,themaximumowofN(;0;R)is1. Flow(f)= s2Supp()f(?;s)= X s2Supp()(s)=1: X<br />
Next,weassumethatthemaximumowis1.LetfbeaowfunctionwithFlow(f)=1. Sincef(?;s) cap(?;s)=(s)andsince<br />
wegetf(?;s)=(s)<strong>for</strong>alls2S.Similarly,wegetf(t;>)=0(t)<strong>for</strong>allt2S.Let Xs2Sf(?;s)=Flow(f)=1=Xs2S(s)<br />
weight(s;t)=f(s;t)<strong>for</strong>all(s;t)2Randweight(s;t)=0if(s;t)=2R.Then,<br />
andsimilarly,Ps2Sweight(s;t)=0(t).Hence,weightisaweightfunction<strong>for</strong>(;0) Xt2Sweight(s;t)=Xt2Sf(s;t)=f(?;s)=(s);<br />
withrespecttoR.Thus, Lemma6.2.1(page145)yieldsamethod<strong>for</strong>decidingwhether thenetworkN(;0;R)andcomputethemaximumowwithwell-knownmethods(see Figure6.8,page146). R0. R0.Weconstruct<br />
TheassociatednetworkN(;0;R)isofthefollowing<strong>for</strong>m. Example6.2.2LetS=ft;ug,R=f(t;t);(u;u);(u;t)gand,02Distr(S)with (t)=13; (u)=23; 0(t)=0(u)=12:<br />
? tu u > t k kk m k m HHHj 1323* * - HHHj* 12
146 CHAPTER6.DECIDINGBISIMILARITYANDSIMILARITY<br />
Output:\Yes"if Testwhether Input:anonemptynitesetS,distributions,02Distr(S)andR R0<br />
Method: R0,\No"otherwise. S S<br />
ifF)=f(t;>)=12<br />
networkisthoseof[CHM90]whichhastimeandspacecomplexityO(n3=logn)and R0.<br />
O(n2)respectivelywherenisthenumberofnodesinthenetwork.Hence: Lemma6.2.3Thetestwhether O(n2)wheren=jSj. Remark6.2.4Anotherpossibility<strong>for</strong>testingwhether R0canbedoneintimeO(n3=logn)andspace<br />
inglinearinequalitysystemwiththevariablesxs;t,(s;t)2R: Xt2S<br />
R0istoconsiderthefollow-<br />
(s;t)2Rxs;t=(s)<strong>for</strong>alls2S<br />
(s;t)2Rxs;t=0(s)<strong>for</strong>allt2S Xs2S<br />
TheabovesystemhasjRj=O(n2)variablesandjRj+2jSj=O(n2)equations.Toour andxs;t thatcase,thesolution(xs;t)(s;t)2Ryieldsaweightfunction<strong>for</strong>(;0)withrespecttoR. knowledge,thereisnomethod<strong>for</strong>solvinginequalitysystemsofthistypethatbeatthe 0<strong>for</strong>all(s;t)2R.Then, R0ithesystemabovehasasolution.In<br />
6.2.2 timecomplexityO(n3=logn).<br />
Inthesequel,(S;Act;Steps)isaniteaction-labelledconcurrentprobabilisticsystem.If RisabinaryrelationonSands,s02Sthen Theconcurrentcase<br />
Thealgorithm<strong>for</strong>computingthesimulationpreorderissketchedinFigure6.9(page 148).WerstcomputethesetR=f(s;s0)2S svRs0iwheneversa �!thenthereissomes0a S:act(s) �!0withact(s0);s6=s0g:If R0.
6.2.COMPUTINGTHESIMULATIONPREORDER R=f(s;s0):s6=s0gthenallstatesaresimilarandwearedone.Inwhatfollows,we 147<br />
yieldstherstelementofQ,Remove(Q)whichremovestherstelementofQ(bothunder supposethatRdoesnotcontainallpairs(s;s0),s6=s0.WeorganizeRasaqueueQwhere theorderingintheinitialqueueisarbitrary.WeusetheusualoperatorsFront(Q)which<br />
Initially,wedealwithSim(s;a;)(s0)=Stepsa(s0).Adistribution02Stepsa(s0)isremoved thatarestillcandidatestomatchthetransitionsa theassumptionthatQisnotempty)andAdd(Q;x)whichaddsxattheendofQ.For<br />
fromSim(s;a;)(s0)justinthemomentwhere (s;s0)2Rand(a;)2Steps(s),weuseasetSim(s;a;)(s0)ofdistributions02Stepsa(s0) 6R0isdetected.Then, �!,i.e.6R0isnotyetdetected.<br />
yieldstherstelementof()andNext()whichremovestherstelementof(),i.e.the elementsofStepsa(s0).FortheselistsSim(s;a;)(s0),weusetheoperationsFirst()which followingiterations.WerepresentthesetSim(s;a;)(s0)asalistconsistingof(pointersto) 6R0inall<br />
Inwhatfollows,werefertoRasthesetofpairs(s;s0)thatarecontainedinQ.Byan listpointerisshiftedtothesecondelement. iteration,wemeantheexecutionofsteps(1)and(2)(includingthesubsteps(2.1)-(2.6)). Wesayapair(s;s0)isinvestigatedinsomeiterationifitisthoseelementofQthatis chosenintheelse-branchofstep(1). Initially,wedenelasttobethelastelementofQ.Inalliterations,lastiseitherundened (last=?)ortheleftmostelement(s;s0)ofQsuchthat{afterthelastinvestigation<br />
investigatedthenwesetlast=?(step(2.5))and\wait"<strong>for</strong>thenextpair(t;t0)inQ Risthesimulationpreorder(cf.step(2.3)).Ifs6vRs0<strong>for</strong>theelement(s;s0)whichis of(s;s0){noelement(t;t0)isremovedfromQ.Hence,ifweinvestigate(s;s0)where<br />
whichwedonotremovefromQ(step(2.4.2)).<br />
(s;s0)=lastandobtainsvRs0thenwehavetvRt0<strong>for</strong>allpairs(t;t0)2R.Thus,
148 CHAPTER6.DECIDINGBISIMILARITYANDSIMILARITY<br />
Computingthesimulationpreorder<br />
Method: Output:thesimulationpreordervsim Input:aniteaction-labelledconcurrentprobabilisticsystem(S;Act;Steps)<br />
(0)[Initialization] (0.1)Q:=;; (0.2)Forall(s;s0)2S (0.2.1)Add(Q;(s;s0)); (0.2.2)last:=(s;s0); Swiths6=s0andact(s) act(s0)do<br />
(1)IfQ=;thengoto(3)elsebegin(s;s0):=Front(Q);Remove(Q);end; (2)Forall(a;)2Steps(s)do (0.2.3)Forall(a;)2Steps(s)doSim(s;a;)(s0):=Stepsa(s0);<br />
(2.2)While:simandSim(s;a;)(s0)6=;do (2.1)sim:=false;<br />
(2.2.2)If (2.2.1)0:=First(Sim(s;a;)(s0));<br />
(2.4)Ifsimandlast6=(s;s0)then (2.3)Ifsimandlast=(s;s0)thengoto(3); R0thensim:=trueelseNext(Sim(s;a;)(s0));<br />
(2.4.1)Add(Q;(s;s0));<br />
(2.6)goto(1); (2.5)If:simthenlast:=?; (2.4.2)Iflast=?thenlast:=(s;s0);<br />
(3)ReturnR[f(s;s):s2SgwhereRisthesetofpairsthatarecontainedinQ. Figure6.9:Algorithm<strong>for</strong>computingthesimulationpreorder
6.2.COMPUTINGTHESIMULATIONPREORDER Example6.2.5Weapplyouralgorithm<strong>for</strong>computingthesimulationpreorder(Figure 149<br />
6.9,page148)tothesystemshowninFigure6.10(page149).Intheinitializationstep (step(0))weobtainthequeueQcontainingthepairs {(u;u0),u,u02U,u6=u0 {(t1;t2),(t2;t1) {(si;sj),(si;v),(v;si),(v;v0),i;j=1;2,i6=j,v,v02fv1;v2;wg,v6=v0<br />
Here,U=fuk1;uh2:k=0;:::;4;h=0;1;2gdenotesthesetofterminalstates.Thepairs {(u;t1),(u;si),(u;v),u2U,v2fv1;v2;wg,i=1;2.<br />
u01 s1 ? HHHHHHHj t1 s s2<br />
u21 v1 u31 u41 u1 t2 ?<br />
s����@@@R<br />
+ @@@R<br />
w s����@@@R<br />
u02 u12 v2 AAAU #"<br />
AAAU<br />
? u2 s?<br />
?<br />
?<br />
-<br />
a aa; a a<br />
14 b c 34 b c<br />
a13<br />
23 38 a; a<br />
58<br />
12 12<br />
Forinstance: (s2;s1),(si;w),(w;vj),(si;vj),i,j=1;2,areremovedduringtheirrstinvestigation. Figure6.10:<br />
Forthepair(w;v1)thealgorithmcomputesthemaximumowofthenetwork ? HHj 3858* wu2 : u21 -<br />
whichis5=8.Thus,thereisnotransitionofv1thatcan\simulate"thetransition 1><br />
thetransitions2a wa Forthepair(s2;s1)thealgorithmtriestondatransitionofs1whichcan\simulate" �!.<br />
Therstinvestigationof(s1;s2)yields (s2;s1)isremovedfromR. �!1t2.As 6R1t2<strong>for</strong>all 2Stepsa(s1)=f1u01;1s1;gthepair<br />
Sim(s1;a;1s1)(s2)=f1s2g;Sim(s1;a;)(s2)=f1t2g<br />
Sim(s1;a;1u01)(s2)=f1t2;1s2g
150 as6R1s2and1s16R1t2. CHAPTER6.DECIDINGBISIMILARITYANDSIMILARITY<br />
(x;y)2R.Hence,if(x;y)istheelementofQwhichisinvestigatedimmediatelyafterthe isalreadyremovedfromQ).Aftertheremovementof(t2;t1)wehavexvRy<strong>for</strong>all theinitializationstep).Then,therstinvestigationof(t2;t1)yieldst26vRt1(as(w;v1) Wesupposethatinitiallythepair(t2;t1)isthelastelementofQ(i.e.last=(t2;t1)after<br />
of(x;y).AfterinvestigatingallremainingelementsofQoncemore,wereachagainthe thesimulationpreorderwhichconsistsofthefollowingpairs. removementof(t2;t1)thenthealgorithmsetslast=(x;y)afterthe(second)investigation pair(x;y)=last.Thus,theconditionofstep(2.3)isfullledandthealgorithmreturns {(s1;s2),(t1;t2)<br />
andallpairs(x;x),x2S. {(u;x),u2U,x2fs1;s2;t1;t2;v1;v2;wg {(vi;sj),(w;sj),(vi;w),i,j=1;2<br />
(Then,m=Ps2Sms.) Complexity:Letn=jSjbethenumberofstatesandmthenumberoftransitions,<br />
Wesupposearepresentationof(S;Act;Steps)whichcontains<strong>for</strong>eachstates2Sandeach i.e.m=Ps2SjSteps(s)j.Fors2Sanda2Act,letms=jSteps(s)j,ma;s=jStepsa(s)j.<br />
times.Then,thetimecomplexityofouralgorithmisO(Nn3=logn)ifthetestwhether Then,theinitializationstep(i.e.thecomputationoftheinitialsetR,thesetsSim(s;a;;s0) andlast)takesO(n2jActj)=O(n2)time.Wesupposethatstep(2.2.2)isexecutedN- actiona2Actapointertoalistwhoseelementsrepresentthedistributions2Stepsa(s).<br />
thenwereachstep(3)wherethealgorithmhalts.Hence,atmostaftern2iterations Ifinstep(2.3)theconditionsim^last=(s;s0)isfullled,i.e.tvRt0<strong>for</strong>all(t;t0)2R, [CHM90].WeshowthatN R0isdonebycomputingthemaximumowinN(;0;R)withthealgorithmof mn3+m2.13<br />
atmostma;s0unsuccessfulattemptstond02Stepsa(s0)with isinvestigatedatmostn2-times.Foreachpair(s;s0)and(a;)2Steps(s),thereare eithersomepair(s;s0)isremovedfromRorthealgorithmshalts.Thus,eachpair(s;s0)<br />
N(s;a;;s0)-timeswhereN(s;a;;s0)=n2+ma;s0:Weobtain (s;s0)isinvestigatedand<strong>for</strong>xed(a;)2Steps(s),step(2.2.2)isexecutedatmost as 6R0isdetected0isremovedfromSim(s;a;)).Rangingoveralliterationswhere R0(sinceassoon<br />
ThespacecomplexityisO(mn+n2)astherepresentationofthetransitionrelationtakes N Xs2SX a2Act2Stepsa(s)Xs02SN(s;a;;s0) X Xs2S(a;)2Steps(s)(n3+m)=mn3+m2: X<br />
O(mn)space,therepresentationofR(i.e.thequeueQ)O(n2)space.Foreachofthe listsSim(s;a;)(s0)weneedO(ma;s0)space.Summingupoveralls0,a,s,weneed<br />
space<strong>for</strong>therepresentationofthelistsSim(s;a;)(s0).Weobtain: O0@Xs2SX<br />
13Intuitively,thenumberofunsuccessfultestswhether a2ActXs02Sma;s01A=O(mn)<br />
upperbound<strong>for</strong>thenumberofsuccessfultestswhether R0.<br />
R0isboundedbym2whilemn3isan
6.2.COMPUTINGTHESIMULATIONPREORDER Theorem6.2.6Inconcurrentprobabilisticsystems,thesimulationpreordercanbecom- 151<br />
statesandmthenumberoftransitions. Thefollowingremark(Remark6.2.7)showsthateachalgorithm<strong>for</strong>computingthesimuputedintimeO((mn6+m2n3)=logn)andspaceO(mn+n2)wherenisthenumberof testswhethersvRs0viathecondition lationpreorderwhichisbasedontheschemasketchedinFigure6.7(page144)andwhich<br />
hastotestwhether thenumberofunsuccessfultestswhether R0<strong>for</strong>(m2)pairs(;0).14Thus,<strong>for</strong>theworstcasecomplexity (*) 8sa �!9s0a �!0: R0instep(2.2.2)cannotbereduced. R0<br />
However,itmightbepossibletoimprovethealgorithm,e.g.byreplacing(*)byasimpler conditionorbyreducingthenumberofsuccessfultestsinstep(2.2.2).<br />
Moreover,wesupposethatthereissomeactionasuchthat: whereS=fs0;:::;skg[fs;s0g,sivsimsjii Remark6.2.7Let(S;Act;Steps)beanaction-labelledconcurrentprobabilisticsystem<br />
-Stepsb(s)=Stepsb(s0)=;<strong>for</strong>allb6=a jandjSteps(si)j 1,i=0;:::;k.15<br />
Then,<strong>for</strong>allpairs(;0)2Stepsa(s)Stepsa(s0)wehavetotestwhether -If2Stepsa(s),02Stepsa(s0)thenthereisnoweightfunction<strong>for</strong>(;0)withrespect tothesimulationpreordervsim.<br />
whether m=ms+ms0+kweget<strong>for</strong>xedk:(msms0)=(m2).Thus,thenumberoftests R0is(m2). R0.Since<br />
numberoftestswhether Theorem6.2.8Inreactivesystems,thesimulationpreordercanbecomputedintime Dealingwithareactivsystem,wehaveN(s;a;;s0) R0)Weobtain: n2andN jActjn4(whereNisthe<br />
O(n7=logn)andspaceO(n2)wherenisthenumberofstates. 6.2.3 Inwhatfollows,wexaniteaction-labelledfullyprobabilisticsystem(S;Act;P).Recall thatsvRs0ieithersisterminalorP(s;)R0P(s0;)where Thefullyprobabilisticcase<br />
thenetwork(N;E;cap)where (seeDenition3.4.16,page60).Fors,s02SandR R0=fha;ti;ha;t0i):(t;t0)2R;a2Actg<br />
N=f?;>g[Act (S[S),S=ft:t2Sg S SwedeneN(s;s0;R)tobe<br />
E=f(?;ha;ti);(ha;ti;>):t2S;a2Actg[f(ha;ti;ha;ui):(t;u)2Rg cap(?;ha;ti)=P(s;a;t),cap(ha;ti;>)=P(s0;a;t),cap(ha;ti;ha;ui)=1. 15E.g.Steps(s0)=;andSteps(si)=f(a;i)gwherei(s0)=1=iandi(si)=1�1=i.<br />
14Here,()denotesasymptoticlowerbounds.
152 SimilarlytoLemma6.2.1(page145)itcanbeshownthat CHAPTER6.DECIDINGBISIMILARITYANDSIMILARITY<br />
Thus,thesimulationpreorderofafullyprobabilisticsystemcanbecomputedbythe followingmethod.Westartwiththepreorder svRs0ieithersisterminalorthemaximumowinN(s;s0;R)is1.<br />
Aslongasthereisapair(s;s0)2Rwheres6vRs0weremove(s;s0)fromR.16This methodcanbeimplementedsimilartotheoneproposedinSection6.2(Figure6.9,page R=f(s;s0)2S S0:ifs0isterminalthensisterminalg:<br />
148).Thetimecomplexityisasinthereactivecase.Weobtain: Theorem6.2.9Infullyprobabilisticsystems,thesimulationpreorderofcanbecomputed intimeO(n7=logn)andspaceO(n2)wherenisthenumberofstates. Inmanyapplications,onewantsonlytogivelowerandupperboundsonthepreobabilitiesofanacceptablesystembehaviourratherthantheexactprobabilities.Jonsson &Larsen[JoLa91]deneanotionof\satisfactionrelation"thatrelatesthestatesofa whichprescribesintervalsofallowedprobabilities.Notethatincontrastto[JoLa91]we labelledbyatomicpropositions.Wemodifythedenitionsof[JoLa91]asfollows. givenfullyprobabilisticsystemandthestatesofafullyprobabilisticspecicationsystem<br />
Denition6.2.10[Action-labelledfullyprobabilisticspecicationsystems]An dealwithaction-labelledsystemswhile[JoLa91]dealswithsystemswherethestatesare<br />
action-labelledfullyprobabilisticspecicationsystemisatuple(S;Act;P)whereSisa<br />
Denition6.2.11[Thesatisfactionrelationsat]Let(S;Act;P)beaniteaction- suchthat,<strong>for</strong>alls,t2Sanda2Act,P(s;a;t)isaclosedintervalcontainedin[0;1]. nitesetofstates,ActanitesetofactionsandP:S Act S!2[0;1]isafunction<br />
labelledfullyprobabilisticsystemand(S;Act;P)anaction-labelledfullyprobabilisticspec asfollows:ssatRsieithersisterminalorthereexsitsaweightfunction<strong>for</strong>(s;s)with respecttoR,i.e.afunctionweight:S t2S,t2S: icationsystem.IfR SSands2S,s2SthenwedenetherelationsatR Act S![0;1]suchthat<strong>for</strong>alla2Actand SS<br />
2. 1.Ifweight(t;a;t)>0then(t;t)2R.<br />
Asatisfactionrelation<strong>for</strong>(S;Act;P)and(S;Act;P)isabinaryrelationR Xu2Sweight(t;a;u)=P(s;a;t); Xu2Sweight(u;a;t)2P(s;a;t):<br />
suchthatssatRs<strong>for</strong>all(s;s)2R.Wewritessats0i(s;s)iscontainedinsome satisfactionrelation<strong>for</strong>(S;Act;P)and(S;Act;P). S S<br />
Therelationsat ofnetworkswithlowerandupperbounds,seee.g.[Even79].Westartwiththerelation simulationpreordervsimofafullyprobabilisticsystem;theonlydierencebeingtheuse R=S Sandsuccessivelyremovethosepairs(s;s)fromRwhere:(ssatRs).For S Scanbecomputedsimilartothewayinwhichwecomputethe<br />
16Thetests6vRs0canbedonebycomputingthemaximumowinN(s;s0;R).
6.3.PROOFS thetestwhetherssatRswecomputethemaximumowinthenetworkN(s;s;R)= 153<br />
boundcapl(e)andupperboundcapu(e)ofthepossibleowthrougheandwhere (N;E;capl;capu)wherecapl,capuarefunctionsthatassigntoeachedgee2Ethelower N=f?;>g[Act E=f(?;ha;ti);(ha;ui;>):t2S;a2Act;u2Sg[f(ha;ti;ha;ui):(t;u)2Rg (S]S)<br />
capl(?;ha;ti)=capl(ha;ti;ha;ui)=0;capl(ha;ti;>)=minP(s;a;t)<br />
capu(ha;ti;ha;ui)=1: capu(?;ha;ti)=P(s;a;t);capu(ha;ti;>)=maxP(s;a;t);<br />
SimilarlytoLemma6.2.1(page145),ssatRsieithersisterminalorthemaximum andupperboundscanbereducedtothecomputationofthemaximumowina\usual" networkofthesameasymptoticsize(seee.g.[Even79]).Hence: owinN(s;s;R)is1.Theproblemofndingthemaximumowinanetworkwithlower<br />
wheren=jSjandn=jSj. relationsat aniteaction-labelledfullyprobabilisticspecicationsystem(S;Act;P),thesatisfaction Theorem6.2.12Foraniteaction-labelledfullyprobabilisticsystem(S;Act;P)and SScanbecomputedintimeO((n+n)7=log(n+n))andspaceO((n+n)2)<br />
6.3 ThissectioncompletestheproofofTheorem6.1.8(page134)byshowingthatthetotal costCost(2:2:1)ofstep(2.2.1)andCost(2:2:2)ofstep(2.2.2)inthealgorithm<strong>for</strong>comuting Proofs<br />
areO(mn(logm+logn))andO(mn)respectively. thebisimulationequivalenceclasseswiththemethodsketchedinFigure6.4(page136) Lemma6.3.1LetXbeanonemptynitesetand(X0;:::;Xr)asequenceofpartitions onXsuchthatXiisnerthanXi�1,i=1;:::;r.Then,<br />
whereX0 =0jX0 rXi i=XinXi�1,i=0;:::;r,andX�1=fXg. ij 2(jXj�1)<br />
deneKX=PijX0 thatr Proof: 0andXiisnerthanXi�1,i=0;:::;r.IfX=(X0;:::;Xr)2KXthenwe LetKXbethesetofnitesequencesX=(X0;:::;Xr)ofpartitionsofXsuch ijwhereX0 KX=maxnKX:X2KXo: i=XinXi�1,i=0;:::;r.Weset<br />
jXj WeshowbyinductiononjXjthatKX 2.Byinductionhypothesis,KB 2jBj�2<strong>for</strong>allnonemptypropersubsetsB<br />
2(jXj�1).ThecasejXj=1isclear.Let
154 ofX.Clearly,<strong>for</strong>eachsequenceX=(X0;:::;Xr)2KX:IfX0 CHAPTER6.DECIDINGBISIMILARITYANDSIMILARITY<br />
KX=0.Otherwisewemaysupposew.l.o.g.thatX06=;.Ifr=0then KX=jX0j jXj 2(jXj�1): i=;,i=0;:::;r,then<br />
NowweassumethatX06=;andr (*) B2X0jBj X1.Then,<br />
ForB2X0,letXB=(XB1;:::;XBr)whereXB jXj; i=fC2Xi:C jX0j 2:<br />
andX0 i=SB2X0(XB inXB i�1),i=1;:::;r.Byinductionhypothesis, KXB KB 2jBj�2: Bg.Then,XB2KB<br />
Hence,by(*):KX=jX0j+X 2jXj�jX0jB2X0KXB 2jXj�2: jX0j+2X B2X0jBj�2jX0j<br />
XsuchthatXiisnerthanXi�1,i=1;:::;r.LetX�1=fXg.Foreachi2f0;:::;rg, Thus,KX Lemma6.3.2LetXbeanonemptynitesetand(X0;:::;Xr)asequenceofpartitionson 2(jXj�1).<br />
letYibeapropersubsetofXinXi�1suchthat:<br />
Then, (*)ForeachC2Xi�1nXithereissomeA2XinYiwithA B2YiwithB rXi=0jYijC. C,andjBj jAj<strong>for</strong>all<br />
2(jXj�1) and rXi=0X Proof: ByLemma6.3.1(page153): B2YijBj jXjlogjXj:<br />
WeshowbyinductiononjXjthateachelementx2XiscontainedinSB2YiB<strong>for</strong>at XijYij XijXinXi�1j 2(jXj�1):<br />
mostlogjXjindicesi2f0;:::;rg.Thisyields =0X rXi whereI(x)=f0 iB2YijBj=Xx2XX r:x2B<strong>for</strong>someB2Yig. i2I(x)1 Xx2XlogjXj=jXjlogjXj<br />
WehavetoshowthatjI(x)j jBj <strong>for</strong>alli.LetjXj jXj=2<strong>for</strong>allB2Y0[:::[Yr.IfjXj=1thenthereisnothingtoshowsinceYi=; 2andx2X.WemaysupposethatI(x)6=;,i.e.x2SiSB2YiB.<br />
logjXj<strong>for</strong>allx2X.Firstweobservethat(*)yields
6.3.PROOFS Letibethesmallestindex 0suchthatx2B<strong>for</strong>someB2Yi(i.e.i=minI(x)).By 155<br />
SincejBj inductionhypothesis,<br />
Asbe<strong>for</strong>e,weassume(S;Act;Steps)tobeaniteaction-labelledconcurrentproba- jXj=2wegetjI(x)j jfi+1;:::;rg\I(x)j 1+logjBj=log(2jBj) logjBj:<br />
bilisticsystem.n=jSjdenotesthenumberofstates,mthenumberoftransitions, logjXj.<br />
Ps2SjStepsa(s)j.(Then,m=Pa2Actma.)RecallthatweassumeActtobexed.Hence, i.e.m=Ps2SjSteps(s)j.Fora2Act,maisthenumberofa-transitions,i.e.ma= wetreatjActjasaconstant. LetX0=Xinit;X1;:::;XNbethesequenceofpartitionsthatareobtainedbyouralgorithm (Figure6.4,page136).I.e.<br />
step.I.e.New0=Newinitand whereX�1=Xtrivial=fSg.LetNewidenotethesetNewinthe(i+1)-strenement X0=Xinit,Xi=Rene(Xi�1),i=0;:::;N�1,andXN=S=<br />
Newi= B2Xi�1NewB;i=1;:::;N�1: [<br />
LetCi1;:::;CilibetheenumerationofNewiandletC1;:::;Clbethesequence<br />
Lemma6.3.3Wehavel C01;:::;C0l0;C1;:::;C1l1;C12;:::;C2l2;:::;CN�1 2(n�1)and 1 ;:::;CN�1 lN�1:<br />
=1jCij lXi Proof: WeconsiderthesetX=SandthepartitionsX0=Xinit;X1;:::;XNofX. nlogn:<br />
A2XinNewiwithA (*)onpage136).Lemma6.3.2(page154)yields: Then,NewiisapropersubsetofXinXi�1suchthat<strong>for</strong>eachC2Xi�1nXithereissome CandjBj jAj<strong>for</strong>allB2NewiwhereB C(cf.condition<br />
and l=N�1 Xi=0jNewij lXi=1jCij=N�1 2(n�1)<br />
(wherewedealwithYi=Newi.) Xi=0B2NewijBj X nlogn<br />
6.4onpage136(i.e.thecomputationsofNewCl()andOldCl()withthemethodof Lemma6.3.4Rangingoverallrenementsteps,theexecutionsofstep(2.2.1)inFigure Figure6.6,page142)takeO(mn(logm+logn))time.
156 Proof: Itsucestoshowthat,rangingoverallblocksB2X0[:::[XN�1,the CHAPTER6.DECIDINGBISIMILARITYANDSIMILARITY<br />
constructionoftheorderedbalancedtreesinstep(1.2)ofFigure6.6(page142)takes O(mn(logm+logn))time.<br />
upoverallblocksCiandusingLemma6.3.3(page155),wegetthetimecomplexity tions,<strong>for</strong>xedi,thecomputationofthevalues[Ci]takesO(jCijm)time.Summing Foreachi2f1;:::;lg,wehavetocomputetheprobabilities[Ci],2Sa;sStepsa(s).For<br />
O(mnlogn)<strong>for</strong>thecomputationofthevalues[Ci],i=1;:::;l,2Sa;sStepsa(s). xediand,thecomputationof[Ci]takesO(jCij)time.Summingupoveralldistribu-<br />
Foreachi2f1;:::;lg,weconstructanorderedbalancedtree<strong>for</strong>thevalues[Ci],2H andHisofthe<strong>for</strong>mH=Ss2Lh(s)<strong>for</strong>sometuple(a;L;h).Inthatcase,wespeakabout setsH<strong>for</strong>whichthereexistsan(i;H)-executionofstep(1.2)inFigure6.6.Then: the(i;H)-executionofstep(1.2)inFigure6.6(page142).LetExec(i)bethesetofall<br />
LetT(i;H)betheorderedbalancedtreewhichisconstructedinthe(i;H)-execution.If {IfH1,H22Exec(i)thenH1=H2orH1\H2=;.<br />
jT(i;H)jdenotesthenumberofnodesinT(i;H)thenthe(i;H)-executioncausesthecost {ForxediandH,thereisatmostone(i;H)-execution.<br />
O(K(i;H))where<br />
ofallexecutionsofstep(1.2)inFigure6.6areO(K)where (andwherethecost<strong>for</strong>computingthevalues[Ci],2H,areneglected).Thetotalcost K(i;H)=jHjlogjT(i;H)j+1<br />
K=lXi=1H2Exec(i)K(i;H)=lXi=1 X H2Exec(i)jHjlogjT(i;H)j+1: X<br />
wedene eachofthemcontainedinsomeH2Exec(i)(cf.condition(**)onpage138).Fori
6.3.PROOFS K0(l�i+1;Hj) ijHjjlog(jHjj+1),j=1;:::;r. 157<br />
SincejH1j+:::+jHrj K0(l�i;H) jHjlogjT(l�i;H)j+1 jHjandjT(l�i;H)j jHjweget<br />
jHjlog(jHj+1)+ijHjlog(jHj+1)=(i+1)jHjlog(jHj+1): +irXj=1jHjjlog(jHjj+1)<br />
SinceExec(1)=fSs2SStepsa(s):a2Actgnf;gweget<br />
Hence,by(I)and(II): H2Exec(1)jHj=X X a2ActXs2SjStepsa(s)j=m:<br />
ByLemma6.3.3(page155),wehavel K= H2Exec(1)K0(1;H) X H2Exec(1)ljHjlogjHj 2n.There<strong>for</strong>e, X lmlogm:<br />
(1.2)inFigure6.6(page142)whereweneglectthecost<strong>for</strong>computingthevalues[Ci]. Thus,wegetthetimecomplexityO(mnlogm)<strong>for</strong>theconstructionsofthetreesinstep K lmlogm 2nmlogm:<br />
Addingthecost<strong>for</strong>thecomputationsofthevalues[Ci]weobtainthetimecomplexity O(mn(logm+logn))<strong>for</strong>allexecutionsofstep(2.2.1)inthemainalgorithm. Lemma6.3.5 N�1<br />
Proof: LetMi=PB2XijNewClXi(B)j.Then,Mi=Pa2ActjHa;ijwhere Xi=0X B2XijNewClXij 2(m�1):<br />
WeconsiderthesetXa=Ss2SStepsa(s)ofalla-labelledtransitionsin(S;Act;Steps). Ha;i=([<br />
ThesetsHa;icanbeextendedtopartitionsXa;iofXasuchthatXa;iisnerthanXa;i�1 s2Lh(s):B2Xi;(a;L;h)2NewClXi(B)):<br />
andHa;i Xa;inXa;i�1(cf.condition(**)onpage138).Thus, N�1 Xi=0Mi=X 2(jXj�1) a2ActN�1 Xi=0jHa;ij X a2ActN�1 XXi=0jX0a;ij<br />
byLemma6.3.1(page153).Here,X0a;i=Xa;inXa;i�1. Lemma6.3.6Summingupoverallrenementsteps,theexecutionsofstep(2.2.2)in a2Act2(ma�1)=2(m�1)<br />
Figure6.4onpage136(thecomputationsofB=Xwiththemethoddecsribedonpage 139)takeO(nm)time.
158 Proof: WedeneKi=maxfjNewClXi(B)j:B2Xig.Inthe(i+1)-strenement CHAPTER6.DECIDINGBISIMILARITYANDSIMILARITY<br />
since,<strong>for</strong>eachstates2S,wetraverseabinarytreeofheight (page157): step(i.e.inthecomputationofXi+1=Rene(Xi)),step(2.2.2)causesthecostO(nKi) N�1 Xi=0Ki N�1 Xi=0X Ki.ByLemma6.3.5<br />
Thus,step(2.2.2)causesthecostO(nm).<br />
B2XijNewClXij 2(m�1):
Chapter7<br />
Weakbisimulation<strong>for</strong>fully probabilisticprocesses<br />
andotheroperators{theymakeitpossibletoreplacecomponentsbyequivalentonesthat bisimulationequivalencearefundamental<strong>for</strong>vericationmethodsthatexploitabstraction frominternalcomputationas{beingcompositionalwithrespecttoparallelcomposition Inthenon-probabilisticcase,weak[Miln80,Park81,Miln89]orbranching[vGlWe89]<br />
frominternalcomputationsareproposedbyIvanandLindaChristo[Chri90a,Chri90b, setting,appropriatenotionsofweakequivalencetogetherwithecientdecisionprocedures arehighlydesirable.Testingequivalences<strong>for</strong>fullyprobabilisticsystemsthatabstract areminimizedwithrespecttotheirinternalbehaviour.Clearly,alsointheprobabilistic<br />
etal[CSZ92,YCDS94].Forthelatter,theauthorspresentaprooftechniquebutdo ChCh91,Chri93](whoalsopresentpolynomialtimedecisionprocedures)andCleaveland notinvestigatethedecidability.Segala&Lynch[SeLy94]introducenotionsofweak andbranchingbisimulation<strong>for</strong>concurrentprobabilisticsystemsthatappearasnatural extensionsofweakandbranchingequivalences<strong>for</strong>non-probabilisticsystems.Recentwork showsthatweak[PSS98]andbranching[BSV98]bisimulationequivalencearedecidable<strong>for</strong> inteamworkwithHolgerHermanns[BaHe97])proposesnotionsofweakbisimulation andbranchingbisimulationinthefullyprobabilisticsettingandpresentsapolynomial decisionprocedure. niteconcurrentprobabilisticsystems.Thischapter(whosemainresultsaredeveloped<br />
Weakbisimulationinnon-probabilisticsystems:Theweakbisimulationequivalenceclassesofanite(non-probabilistic)labelledtransitionsystem(S;Act;�!)can becomputedasthe(strong)bisimulationequivalenceclassesoftheinducedsystem (S;(Actnfg)[f"g;=)).Here,the\doublearrowrelation"<br />
isdenedwiththehelpofthetransitive,reexiveclosure(�!)ofinternaltransitions.1 Thus,theproblemofdecidingweakbisimulationequivalenceisreducedtothecompu- =) S ((Actnfg)[f"g)S<br />
reachablefromsviainternalactions)while=)=(�!)�!(�!). tationofthetransitive,reexiveclosure(�!)oftheinternaltransitionsanddeciding 1Fortheemptyword",thetransitionrelation" =)agreeswith(�!)(i.e.s" =)tassertsthattis<br />
159
(strong)bisimulationequivalenceinanitesystem.Usingthetransitiveclosureoperation 160 CHAPTER7.WEAKBISIMULATION<br />
from[CoWi87]andthepartitioning/splittertechniqueby[PaTa87]thetimecomplexity<strong>for</strong> decidingweakbisimulationequivalenceisO(n2:3)wherenisthenumberofstates.Groote &Vaandrager[GroVa90]proposeanalgorithm<strong>for</strong>computingthebranchingbisimulation<br />
(i.e.thesizeof�!). andrunsintimeO(nm)wherenisthenumberofstatesandmthenumberoftransitions tioning/splittertechniqueala[PaTa87]thatusesbothtransitionrelations�!and=)equivalenceclassesofanon-probabilisticsystemwhichworkswithavariantoftheparti- reachstatetfromsviaasequenceoftransitionslabelledbyatraceofthe<strong>for</strong>m Weakbisimulationinfullyprobabilisticsystems:Thischapterintroducesnotions ofweakbisimulationandbranchingbisimulation<strong>for</strong>fullyprobabilisticsystems.The basicideaistoreplaceMilner's\doublearrowrelation"s=)tbytheprobabilitiesto<br />
fullyprobabilisticsystems.Theproposednotionofweak(orbranching)bisimulation Incontrasttothenon-probabilisticcasewherebranchingbisimulationisstrictlyner thanweakbisimulation,weakandbranchingbisimulationequivalencecoincide<strong>for</strong>nite.<br />
equivalenceisdecidable<strong>for</strong>nitesystems.Wepresentanalgorithmtocomputetheweak bisimulationequivalenceclasseswithamodicationofthepartitioning/splittertechnique ala[KaSm83,PaTa87].Thetimecomplexityofourmethodiscubicinthenumberof states;thus,itmeetstheworstcasecomplexity<strong>for</strong>decidingbranchingbisimulationinthe non-probabilisticcase[GroVa90](where,intheworstcase,O(m)=O(n2)).Moreover, weakbisimulationisshowntobeacongruencewithrespecttotheoperatorsofPLSCCS probabilisticsystemsthatworkwiththelazyproductP1 (seeSection4.3,page83)withtheexceptionoftheprobabilisticchoiceoperator.2 There<strong>for</strong>e,weakbisimulationisapplicable<strong>for</strong>mechanisedcompositionalvericationof<br />
tions.InSection7.2wepresentouralgorithm<strong>for</strong>decidingweakbisimulationequivalence.Organizationofthatchapter:Section7.1introducesweakandbranchingbisimula- P2asparallelcomposition.<br />
intheappendix(Section7.5).Theproofsusetheregularityofcertainmatrices(with Section7.3discussestheconnectionbetweenweak(andbranching)bisimulationequiv-<br />
columnsandrows<strong>for</strong>eachstateoftheunderlyingsystem).Thus,themainresultsare establishedinSection7.4.Mostoftheproofs<strong>for</strong>theresultsofthischapteraregiven alenceandotherequivalences<strong>for</strong>fullyprobabilisticsystems.Thecongruenceresultis<br />
Thischaptermakesuseofthenotations<strong>for</strong>partitionsasexplainedinSection2.1(page toarbitraryfullyprobabilisticsystems(withpossiblyinnitelymanystates). onlyestablished<strong>for</strong>nitesystems.Itisanopenquestionwhetherourresultscarryover<br />
29)and<strong>for</strong>orderedbalancedtrees(seeSection12.2,page314).Moreover,weoftenuse (seeSection3.3.1,page49).Throughoutthischapter,wedealwithaction-labelledfully theprobabilitiesProb(s;;t)<strong>for</strong>storeachaC-stateviaapathwhosetracebelongto probabilisticsystems.<br />
isnotsurprisingasalreadyinthenon-probabilisticcase,weakandbranchingbisimulationequivalence failtobecongruenceswithrespecttonon-deterministicchoice.<br />
2Thefactthatweak(andbranching)bisimulationequivalencearenotpreservedbyprobabilisticchoice
7.1.WEAKANDBRANCHINGBISIMULATION 7.1 Weakandbranchingbisimulation 161<br />
Inthissectionwedeneweakandbranchingbisimulation<strong>for</strong>fullyprobabilisticsystems. Whileinthenon-probabilisticcasebranchingbisimulationequivalenceisstrictlynerthan weakbisimulationequivalence,thesetworelationscoincide<strong>for</strong>nitefullyprobabilistic systems(Theorem7.1.10,page163). 7.1.1 Forthedenitionofweakbisimulation,wereplaceMilner's\doublearrow"relation" =(�!)(wheres" Weakbisimulation<br />
dealwiththeprobabilitiesProb(s; Prob(s;;t)toreachstatetfromsviainternalactions.Similarly,<strong>for</strong>2Actnfg,we =)tstatesthatscanmovetotviainternalsteps)bytheprobability ;t)ratherthanMilner'sweaktransitionrelations =)<br />
=)=(�!)�!(�!).3 Denition7.1.1[Weakbisimulation]Aweakbisimulationonanaction-labelledfully probabilisticsystem(S;Act;P)isanequivalencerelationRonSsuchthat<strong>for</strong>all(s;s0)2 RandallequivalenceclassesC2S=R:<br />
Twostatess,s0arecalledweaklybisimilar(denotedbys (1)Prob(s;;C)=Prob(s0;;C) (2)Prob(s; ;C)=Prob(s0; ;C)<strong>for</strong>all2Actnfg.<br />
Remark7.1.2NotethatProb(s;;C)=1ifs2C.Hence,condition(1)isalways weakbisimulationR. s0)i(s;s0)2R<strong>for</strong>some<br />
InSection7.5.1(Lemma7.5.16,page185)weshowthat,<strong>for</strong>nitesystems, bisimulation.TwofullyprobabilisticprocessesP=(S;Act;P;sinit),P0=(S0;Act;P0;s0init) fullled<strong>for</strong>theequivalenceclassCofsands0withrespecttoR.<br />
aresaidtobeweaklybisimilaritheirinitialstatessinitands0initareweaklybisimilarin thecomposedsystemwhichisdenedasexplainedinSection3.5(page61). isaweak<br />
Example7.1.3WeconsiderthesimplecommunicationprotocolofExample3.3.2(page Usingweakbisimulationequivalenceas theunderlyingimplementationrelationthe 48)andthefullyprobabilisticsystem<strong>for</strong>thesendershowninFigure3.2onpage48.<br />
shownontheright. sendercanbeveriedagainstthespecicationgivenbythefullyprobabilisticprocess ack?,1AAA s0init<br />
s0waitsend!,1 A<br />
fCI;CWgwhereCI=fsinit;s0initgistheequivalenceclassoftheinitialstatesandCW= fsdel;swait;slost;s0waitgtheequivalenceclassoftheotherstates.ForsI2CIandsW2CW, LetRbetheequivalenceonS=fsinit;sdel;swait;slost;s0init;s0waitgsuchthatS=R= Forthis,wehavetoshowthattheinitialstatessinitands0initareweaklybisimilar.<br />
3SeeSection3.3.1,page49,<strong>for</strong>thedenitionofProb(s;;t).
wehave:Prob(sI;;CI)=1;<br />
162 CHAPTER7.WEAKBISIMULATION<br />
Prob(sI;;CW)=0; Prob(sI; send! ;CI)=0; Prob(sW;;CI)=0;<br />
Prob(sI; ack? send! ;CI)=0; ;CW)=1; Prob(sW;;CW)=1; Prob(sW; send! ack? send! ;CI)=1; ;CI)=0;<br />
Hence,Risaweakbisimulation.Inparticular,theinitialstatessinitofthesenderand Prob(sI; ack? ;CW)=0; Prob(sW; ack? ;CW)=0: ;CW)=0;<br />
Inthenon-probabilisticcase,itholds<strong>for</strong>weaklybisimilarstatess;s0thatifs1:::k thens01:::k s0initofitsspecicationareweaklybisimilar. =)t0suchthattandt0areweaklybisimilar.Here,1:::k =)denotes(�!) =)t<br />
Theorem7.1.4Let(S;Act;P)beaniteaction-labelledfullyprobabilisticsystemand (�!):::(�!) �!(�!).Thisresultcarriesovertonitefullyprobabilisticsystems. k �! 1<br />
Proof: aregularexpressionofthe<strong>for</strong>m seeSection7.5.1,Theorem7.5.17(page186). Ifs s0thenProb(s;;C)=Prob(s0;;C)<strong>for</strong>allC2S=. 1 2::: kor 1 2::: k.Then:<br />
VanGlabbeek&Weijland[vGlWe89]introducebranchingbisimulationwhichisstrictly 7.1.2 nerthanweakbisimulation.Thebasicideaofbranchingbisimulationisthatinorder Branchingbisimulation<br />
intermediatestatesonthepathfroms0tos00alsofallintheequivalenceclassofsands0) manyinternalactionsleadingtoastates00whichisstillequivalenttosands0(i.e.the andthentoper<strong>for</strong>m tosimulateasteps�!tbyanequivalentstates0,s0isallowedtoper<strong>for</strong>marbitrary<br />
internalactionsinsidetheequivalenceclassofsands0andthentoper<strong>for</strong>mavisible case,werequirethat<strong>for</strong>equivalentstatess,s0,theprobabilities<strong>for</strong>sands0toper<strong>for</strong>m action leadingtostateofacertainequivalenceclassCarethesame. reachingastatet0whichisequivalenttot.Intheprobabilistic<br />
Notation7.1.5[Thesymbolsba,a2Act]Fora2Act,let<br />
Recallthat"denotestheemptywordinAct.Hence, ba=(a:ifa6= ":ifa=.<br />
Notation7.1.6[TheprobabilitiesProbR(s;ba;C)]Let(S;Act;P)beanaction-labelledfullyprobabilisticsystem,RanequivalencerelationonS,s2S,C ba= ifa=.<br />
a2Act.Then,PathRful(s;ba;C)denotesthesetoffulpaths thereissomek 0with 2Pathful(s)suchthat Sand<br />
(s;(i))2R,i=1;:::;k�1, trace((k))2ba,
7.1.WEAKANDBRANCHINGBISIMULATION (k)2C. 163<br />
LetProbR(s;ba;C)=Prob(PathRful(s;ba;C)),ProbR(s;ba;t)=Prob((s;ba;ftg).<br />
Example7.1.8FortherelationRinExample7.1.3,page161,wehave Remark7.1.7Fors2C,Pathful(s)=PathRful(s;;C).Hence,ProbR(s;;C)=1if s2C.<br />
<strong>for</strong>allstatessandC2fCI;CWganda2f;send!;ack?g. ProbR(s;ba;C)=Prob(s;ba;C)<br />
\identityrelation"R(i.e.theequivalencerelationRwith(x;y)2Rix=y)wehave ProbR(s; Forthesystemshownontherightandthe<br />
1=2. ;v)=0whileProb(s; ;v)= vt,12 s ,12<br />
? ,1 u � �� @@@R<br />
RonSsuchthat<strong>for</strong>all(s;s0)2R,C2S=R: Denition7.1.9[Branchingbisimulation]Let(S;Act;P)beanaction-labelledfully probabilisticsystem.Abranchingbisimulationon(S;Act;P)isanequivalencerelation (1)ProbR(s;;C)=ProbR(s;;C)<br />
branchingbisimulationR. Twostatess,s0arecalledbranchingbisimilar(denotedsbrs0)i(s;s0)2R<strong>for</strong>some (2)ProbR(s; ;C)=ProbR(s; ;C)<strong>for</strong>all2Actnfg.<br />
InSection7.5.1,Lemma7.5.15(page185)weshowthat,<strong>for</strong>(S;Act;P)tobenite, branchingbisimulationequivalencebrisabranchingbisimulation.Incontrasttothe<br />
Theorem7.1.10Let(S;Act;P)beaniteaction-labelledfullyprobabilisticsystemand non-probabilisticcase,branchingbisimulationequivalenceandweakbisimulationequivalencecoincide<strong>for</strong>nitesystems. s,s02S.Then,s Theclassicalexample<strong>for</strong>distinguishingweakandbranchingbisimulationequivalenceis Proof: seeSection7.5.1,Corollary7.5.13(page184). s0is brs0.<br />
thesystemshowninFigure7.1onpage164(see[vGlWe89]).Inthenon-probabilistic<br />
1=Prob(s; nolongerweaklybisimilar.Thiscanbeseenasfollows.Weassumes (whichturnthesystemofFigure7.1intoafullyprobabilisticsystem)thensands0are case,sands0areweaklybutnotbranchingbisimilar.Ifweaddnon-zeroprobabilities<br />
equivalenceclassoft.Clearly,v006tastcanper<strong>for</strong>m(sinceP(t;)>0)whilev00cannot (sinceProb(v00; )=0).Hence,v00=2Tandthere<strong>for</strong>eP(s0;;t0)=1,P(s0;;v00)= ;T)=Prob(s0; ;T)whereTdenotestheweakbisimulation s0.Then,<br />
Figure7.1).<br />
0.Contradiction(asweaddednon-zeroprobabilitiestothenon-probabilisticsystemof
164 CHAPTER7.WEAKBISIMULATION<br />
wv ts<br />
u w0 v0 ? t0 s0<br />
AAAU AAAU ���@@@R u0 w00 v00<br />
? ? ?<br />
Figure7.1:Distinguishingweakandbranchingbisimulationinthenon-probabilisticcase 7.2 Inthissectionwedevelopanalgorithmtocomputetheweakbisimulationequivalence classes.Thegeneralideaofouralgorithmistouseapartitioning/splitter-technique Decidabilityofweakbisimulationequivalence<br />
[PaTa87]<strong>for</strong>decidingstrongbisimulationinthenon-probabilisticcase(cf.theschema similartotheonesproposedbyKanellakis&Smolka[KaSm83]resp.Paige&Tarjan<br />
equivalenceclasses.Thecrucialpointisthedenitionofasplitter.Apossiblecandidate sketchedinSection6.1,Figure6.1onpage131).Thealgorithmstartswithsome\simple"<br />
<strong>for</strong>a\splitter"ofapartitionXisapair(a;C)2Act partitionXinitthatiscoarserthan withthehelpofa\splitter"ofX,eventuallyresultinginthesetofweakbisimulation andthensuccessivelyrenesthegivenpartitionX<br />
Xtobeaweakbisimulation,i.e. (*)Prob(s;ba;C)6=Prob(s0;ba;C)<strong>for</strong>someB2Xands,s02B. Xthatviolatesthecondition<strong>for</strong><br />
<strong>On</strong>eidea<strong>for</strong>apartioning/splitter-algorithmwouldbetoreneXaccordingtoasplitter inthesenseof(*),i.e.toreplaceXbyRene0(X;a;C)=fB='(a;C):B2Xgwhere TheprobabilitiesProb(s;ba;C)canbecomputedbysolvingthelinearequationsystem s'(a;C)s0iProb(s;ba;C)=Prob(s0;ba;C).<br />
xs=1 xs=0 xs=Xt2SP(s;;t)xt+P(s;a;C) ifa=ands2C ifPathful(s;ba;C)=;<br />
(cf.Proposition3.3.4,page49).ThetestwhetherPathful(s;ba;C)=;canbedone byareachabilityanalysisoftheunderlyingdirectedgraph,e.g.withadepthrstsearch ifPathful(s;ba;C)6=;anda6=_s=2C.<br />
likemethod.Then,(n3:8)isanasymptoticlowerbound<strong>for</strong>thetimecomplexityof<br />
renementstepwehavetosolvealinearequationsystemwithnvariablesandnequations(whichtakes thismethod.4Here,wepresentanalternativemethodthatrunsintimeO(n3).The (n2:8)timewiththemethodof[AHU74]).<br />
4Here,nisthenumberofstates.Notethatintheworstcaseweneednrenementstepsandineach
7.2.DECIDABILITYOFWEAKBISIMULATIONEQUIVALENCE basicideaistoreplace(*)byaconditionthatassertsthatXviolatestheconditionsofa 165<br />
branchingbisimulation.Forthis,weuseanalternativedenitionofasplitterthatisbased onancharacterizationofbranchingbisimulationswhichusestheconditionalprobabilities conditionthatthesystemdoesnotmakeaninternalmoveinsidetheblockthatcontainss. PX(s;a;C)toreachablockCfromastatesviaanactionawithinonestepunderthe<br />
havetosolvelinearequationsystems. Theseconditionalprobabilitiescanbecomputedbysimplearithmeticoperations.Thus, theuseofthiskindofsplittershastheadvantagethatintherenementstepswedonot<br />
apartitionXofS.WesaythatXisaweak(branching)bisimulationitheinduced Inwhatfollows,wexaniteaction-labelledfullyprobabilisticsystem(S;Act;P)and 7.2.1 Thealgorithm<br />
equivalencerelationRXisaweak(branching)bisimulation.<br />
Notation7.2.2[ThesetSX]WedeneSX=fs2SnSterm:P(s;;[s]X)
166ProbRX(s;;C)=PX(B;;C)<strong>for</strong>allC2XCHAPTER7.WEAKBISIMULATION Here, ProbRX(s; ;C)=PX(B;;C)<strong>for</strong>all2ActnfgandC2X.<br />
Proof: PX(B;a;C)=(PX(t;a;C):if(a;C)6=(;B)andt2B\SX seeSection7.5.1,Lemma7.5.9(page181). 1 :if(a;C)=(;B).<br />
Foralls2B,eithersisterminalorP(s;;B)=1.Ineithercase,ProbRX(s; Remark7.2.5LetXbeabranchingbisimulationandB2XsuchthatB\SX=;. andProbRX(s;;C)=0ifC2XnfBg.Hence,ifweputPX(B;;B)=1and PX(B;a;C)=0if(a;C)6=(;B).thenweget ;C)=0<br />
<strong>for</strong>alls2B,C2Xanda2Act. ProbRX(s;ba;C)=PX(B;a;C)<br />
P(s0;;[s0]X)=1andP(v0;;[v0]X)=1.Thus,SX=fs;s0;t;t0g. Example7.2.6ConsiderthesystemofFigure7.2(page167)andthepartitionX= allblocksofXsatisfytheconditionsofLemma7.2.4.WehaveSterm=fw;w0;vg, fB1;B2;B3gwhereB1=fs0;s;s0g,B2=ft;t0gandB3=fw;w0;v;v0g.Weshowthat<br />
FortheblockB1,werstconsiderthestatessands0.Wehave: andPX(s;a;C)=PX(s0;a;C)=0<strong>for</strong>all(a;C)=2f(;B2);(;B3)g.Hence,B1 satisescondition(1).Secondweshowcondition(2)<strong>for</strong>B1.Forthis,wehaveto considerthestates02B1nSX.Thenitepathleadingfroms0toastateofB1\SX PX(s;;B2)=PX(s0;;B2)=12;PX(s;;B3)=PX(s0;;B3)=12<br />
fulllscondition(2). isgivenbys0!s.<br />
AsB3\SX=;<strong>for</strong>theblockB3thereisnothingtoshow. PX(t0;a;C)=0<strong>for</strong>all(a;C)6=(;B3).Hence,B2satises(1).AsB2\SX=;,B2 FortheblockB2=ft;t0gweget:PX(t;;B3)=PX(t0;;B3)=1andPX(t;a;C)=<br />
Lemma7.2.4yieldsthatXisabranchingbisimulation. Remark7.2.7IfXisabranchingbisimulation,B2Xands,s02B\SXthen<br />
ispossible.Forinstance,<strong>for</strong>thestatessands0inExample7.2.6(Figure7.2onpage167) 1�P(s;;B)6= P(s;;B) 1�P(s0;;B) P(s0;;B)<br />
wehavesbrs0butP(s;;B1)=(1�P(s;;B1))=0whileP(s0;;B1)=(1�P(s0;;B1))=<br />
actiona2ActandsomeC2XsuchthatthereexistssomeB2Xwith(;B)6=(a;C) Denition7.2.8[Splitter]AsplitterofapartitionXisatuple(a;C)consistingofan 1=2(whereB1=fs0;s;s0gisthebranchingbisimulationequivalenceclassofsands0).<br />
andPX(s;a;C)6=PX(s0;a;C)<strong>for</strong>somestatess,s02B\SX.
7.2.DECIDABILITYOFWEAKBISIMULATIONEQUIVALENCE 167<br />
wt,12 ss0,1<br />
,1 ,12 v w0 t0 ,13 s0<br />
,1 ,13,13 v0 ,1 � ? �� @@@R<br />
? ���@@@R ?<br />
Themainidea<strong>for</strong>reningagivenpartitionXviaasplitter(a;C)istoisolateineach Figure7.2:<br />
thatcannotreachanyotherequivalenceclassA0ofB\SXwithoutpassingA. enrichedwithexactlythosestatess2BnSXthatcanreachAviainternalactionsand Bycondition(2)ofLemma7.2.4,eachsuchequivalenceclassAofB\SXhastobe B2Xwith(;B)6=(a;C)thosestatess,s02B\SXwherePX(s;a;C)=PX(s0;a;C).<br />
B2Xsuchthat(;B)6=(a;C).Wedene Notation7.2.9[ThesetSplit(B;a;C)]Let(a;C)beasplitterofapartitionXand<br />
where,<strong>for</strong>s,s02B\SX,sXs0iPX(s;a;C)=PX(s0;a;C). Split(B;a;C)=(B\SX)=X<br />
Notation7.2.10[TheclosureA]Let(a;C)beasplitterofapartitionXandB2X withrespectto(a;C)tobethelargestsetV s2VnA: suchthat(;B)6=(a;C).IfA2Split(B;a;C)thenwedenetheclosureAofAinX<br />
P(s;;V[A)=1 BwhichcontainsAandsuchthat<strong>for</strong>all<br />
Thereexistsanitepath -last()2A. -rst()=s, -(i)2V,i=0;1;:::;jj�1, with<br />
Notation7.2.11[TheresiduumRes(B;a;C)]LetX,a,BandCbeasbe<strong>for</strong>e.The residuumofBwithrespectto(a;C)isgivenby<br />
Remark7.2.12NotethattheresiduumRes(B;a;C)iseitherempty(ifallstatess2 Res(B;a;C)=fB0gnf;gwhereB0=Bn A2Split(B;a;C)A: [<br />
thatdonotbelongtoanyclosureA.IfA2Split(B;a;C)thenAconsistsofAandall statess2BnSXsuchthat SnSXarecontainedinsomeclosureA)orasingletonsetconsistingofallstatess2BnSX<br />
Here,(s)=f2Pathn(s):rst()=s;(i)2BnSX,i=0;1;:::;jj�1g.<br />
last()2A<strong>for</strong>some2(s) Whenever2 andlast()2SXthenlast()2A.
Notation7.2.13[TherenementoperatorRene()]LetXbeapartition,(a;C)a 168 CHAPTER7.WEAKBISIMULATION<br />
splitterofX.ForB2X,wedene: If(a;C)=(;B)thenRene(B;a;C)=fBg.<br />
WedeneRene(X;a;C)=SB2XRene(B;a;C). If(a;C)6=(;B)then<br />
Clearly,<strong>for</strong>eachpartitionXwhichiscoarserthanS=brandeachsplitter(a;C)ofX, Rene(B;a;C)=fA:A2Split(B;a;C)g[Res(B;a;C):<br />
thepartitionRene(X;a;C)iscoarserthanS=brandstrictlynerthanX.<br />
condition(2)ofLemma7.2.4andthatiscoarserthanS=brandthereisnosplitter<strong>for</strong> blocksA2Rene(B;a;C)fulllcondition(2).Moreover,ifXisapartitionthatfullls Ourrenementoperatorpreservescondition(2)ofLemma7.2.4(page165).Morepre-<br />
XthenX=S=br=S=.Theseobservationsleadtothefollowingalgorithm.We cisely,ifB2XsuchthatB\SX=;andcondition(2)ofLemma7.2.4isfullledthenall<br />
<strong>for</strong>X){weapplytherenementoperatortoX,eventuallyresultinginthepartition X=S=. startwitha\simple"partitionXthatsatisescondition(2)ofLemma7.2.4andthatis coarserthan.Then{aslongasXcanberened(i.e.aslongasthereexistsasplitter<br />
Astheinitialpartitionhastofulllcondition(2)ofLemma7.2.4wecannotstartwiththe instance,<strong>for</strong>asystemwithtwostates,aterminalstatetandastateswithP(s;;t)=1, \trivial"partitionX=fSgthatidentiesallstatesasitmightviolatecondition(2).For withXtrivialthenouralgorithmwouldreturnthatsandtareweaklybisimilarwhichis thetrivialpartitionXtrivial=ffs;tggdoesnothaveasplitter.Hence,ifwewouldstart notthecase.Ourinitialpartitionconsiststwoblocks:theweakbisimulationequivalence classoftheterminalstatesanditscomplement.(Ofcourse,ifoneoftheseblocksisempty thenweonlystartwithoneblock.)Tobeprecise,theweakbisimulationequivalenceclass oftheterminalstatesconsistsofall\divergent"states,i.e.allstatesthatcannotreacha<br />
;<strong>for</strong>all2Actnfg.LetDivbethesetofdivergentstates. statewhereavisibleactioncanbeper<strong>for</strong>medwithsomenon-zeroprobability.<br />
NotethatSterm Denition7.2.14[Divergentstates]AstatesiscalleddivergentiPathful(s; Div.Ouralgorithm<strong>for</strong>computingtheweakbisimulationequivalence )=<br />
Example7.2.15PartitioningthesystemfromExample7.2.6(Figure7.2,page167) classesissketchedinFigure7.3onpage169.<br />
splitter(;fw;w0;v;v0g)weobtain SX=fs;s0;t;t0g.(;fw;w0;v;v0g)and(;fs0;s;s0;t;t0g)aresplittersofX.Forthe proceedsasfollows.TheinitialpartitionisX=ffs0;s;s0;t;t0g;fw;w0;v;v0gg.Then,<br />
andPX(t;;fw;w0;v;v0g)=0=PX(t0;;fw;w0;v;v0g).Hence,thesplitoperatorsepa- PX(s;;fw;w0;v;v0g)=12= 1�13=PX(s0;;fw;w0;v;v0g) 13 ratessands0fromtandt0.Moreprecisely,weget: Split(fw;w0;v;v0g;;fw;w0;v;v0g)=ffw;w0;v;v0gg:<br />
Split(fs0;s;s0;t;t0g;;fw;w0;v;v0g)=ffs;s0g;ft;t0gg;
7.2.DECIDABILITYOFWEAKBISIMULATIONEQUIVALENCE 169<br />
Computingtheweakbisimulationequivalenceclasses Output:thesetS= Method: Input:aniteaction-labelledfullyprobabilisticsystem(S;Act;P)<br />
ComputethesetDivofdivergentstates; ofweakbisimulationequivalenceclasses<br />
ReturnX. WhileXcontainsasplitter(a;C)doX:=Rene(X;a;C); X:=fDiv;SnDivgnf;g;<br />
Theclosureoperatoryieldsfs;s0g=fs0;s;s0g.Hence,wegetthepartition Figure7.3:Schema<strong>for</strong>computingtheweakbisimulationequivalenceclasses<br />
setofweakbisimulationequivalenceclasses. <strong>for</strong>whichnosplitterexists.Thus,ouralgorithmreturnsRene(X;;fw;w0;v;v0g)asthe Rene(X;;fw;w0;v;v0g)=ffs0;s;s0g;ft;t0g;fw;w0;v;v0gg<br />
Inwhatfollows,n=jSj.WesupposethatthealphabetActisxed(thus,wetreatthe 7.2.2 sizejActjasaconstant). Timecomplexity<br />
O(n3)andspaceO(n2). Proof: Theorem7.2.16ThealgorithmofFigure7.3(page169)canbeimplementedintime<br />
directedgraph.Wecomputeallstatesthatcanreachastateofft2S:P(t;)> 0<strong>for</strong>some2Actnfgg,e.g.byadepthrstsearch.Thus,thecomputationofthe initialpartitionXneedsO(n2)timeandspace. Clearly,Divcanbecomputedbyareachabilityanalysisintheunderlying<br />
Initializationoftherenestep:LetXbethecurrentpartition.Wecomputethe valuesP(s;a;C)andPX(s;a;C)<strong>for</strong>eachs2S,a2ActandC2X.ThesetSXcan bederivedfromtheprobabilitiesPX(s;;C),s2C.Foreachpair(a;C)(wherea2Act andC2X)andA2Xwecompute<br />
Then,(a;C)isasplitterofXimin(A;a;C)
valuesPX(s;a;C),s2B\SX.(SeeSection12.2,page314<strong>for</strong>thenotationsthatwe 170 CHAPTER7.WEAKBISIMULATION<br />
startingintherootandwesearch<strong>for</strong>thevaluePX(s;a;C). use<strong>for</strong>orderedbalancedtrees.)EachnodevofTree(B)isrepresentedasarecordwith componentsv:keyandv:states.Foreachstates2B\SX,wetraversethetreeTree(B) Ifwereachanodevwithv:key=PX(s;a;C)thenweinsertsintov:states. Otherwise,PX(s;a;C)isnotyetrepresentedinTree(B)andweinsertanodevwith<br />
thenodesofthenaltreeTree(B)representthesetsA2Split(B;a;C).Moreprecisely, Inthenaltree,v:statesisthesetofstatess2B\SXwithPX(s;a;C)=v:key.Thus, v:key=PX(s;a;C)andv:states=fsg.<br />
EBiP(t;;s)>0andt2BnSX.WecomputethesetsA,A2Split(B;a;C),bythe WederiveRene(B;a;C)asfollows.LetGBbethedirectedgraph(B;EB)where(s;t)2 Split(B;a;C)=fv:states:visanodeinTree(B)g:<br />
followingbreadthrstsearchlikemethod.Weusethreekindsoflabels<strong>for</strong>thestates: label(s)=A2Split(B;a;C)isisreachableinGBfromsomestateinAbutthere detected. label(s)=?is2BnSXandsisnotyetvisited.<br />
label(s)=itherearetwosetsA,A02Split(B;a;C)suchthatsisreachablefrom astateinAandfromastateinA0.(Inparticular,,allsuccessorsofa-labelledstate isnootherA02Split(B;a;C)whereapathfromastateofA0tosinGBisalready<br />
Initially,wedenelabel(s)=A<strong>for</strong>alls2AandA2Split(B;a;C)andlabel(s)=? <strong>for</strong>alls2BnSX.WeuseaqueueQwhichinitiallycontainsthestatess2A,A2 inGBarealsolabelledby.)<br />
Split(B;a;C).WhileQisnotemptywetaketherstelementsofQ,removesfromQ and,iflabel(s)6=then,<strong>for</strong>allt2BnSXwith(s;t)2EB,wedo: (1)Iflabel(t)=?thenweaddttoQandsetlabel(t)=label(s). (2)Iflabel(t)2Split(B;a;C),label(t)6=label(s),thenwesetlabel(u)=<strong>for</strong>u=tand<br />
Complexity:Itisclearthatthemethoddescribedabovecanbeimplementedinspace Then,A=fs2B:label(s)=Ag,Res(B;a;C)=ffs2B:label(s)2f?;gggnf;g. allsuccessorsuoftinGB.6<br />
renementsteptakestimeO(n2). thereareatmostniterationsoftherenementstep.Thus,itsucestoshowthateach O(n2).WeshowthatthetimecomplexityofourmethodisO(n3).First,weobservethat<br />
time.7RangingoverallB,theconstructionofthetreesTree(B)(thus,thecomputation ofthesetsSplit(B;A;C))takesO(nlogn)timeifoneusessomekindo<strong>for</strong>deredbalanced trees(seeSection12.2,page314).Weshowthat,rangingoverallB2X,thesetsAand Clearly,<strong>for</strong>eachiteration(i.e.eachrenementstep),theinitializationrequiresO(n2)<br />
alreadylabelledbyareignored. 6Forthis,wemightuseadepthrstsearchstartinginttondallsuccessorsoft.Statesthatare P(s;a;C)canbecomputedintimeO(n2).<br />
overalls2S,C2X,wegetthetimecomplexityO(n2).SincewesupposeActtobexed,thevalues 7Notethat,<strong>for</strong>eachtuple(s;a;C),wehavetocalculatePt2CP(s;a;t).Hence,<strong>for</strong>xedaandranging
7.3.CONNECTIONTOOTHEREQUIVALENCES Res(B;a;C)canbederivedintimeO(n2):ForxedB2X,thedirectedgraphGBcan 171<br />
beconstructedintimeO(jBj2).Eachstates2BisaddedtoQatmostonce.8Eachstate visitedinstep(2)onceagain.Asaconsequence,eachstatecausestimecosts(atmost) twhichisvisitedbyadepthrstsearchinstep(2)islabelledby.Thus,itcanneverbe<br />
weobtainRene(X;a;C)intimeO(n2). label6=thatisvisitedinstep(2).EithercaseinvolvesO(n)computations.Summing upoveralls2B,thecomputationofRene(B;a;C)hastimecomplexityO(jBjn).So, o<strong>for</strong>der2ninthecomputationofRene(B;a;C):asanelementofQandasastatewith<br />
Inthissectionwediscusshowtheproposednotionofweakbisimulationequivalencerelates tootherequivalences<strong>for</strong>fullyprobabilisticsystems. 7.3 Connectiontootherequivalences<br />
Clearly,weakbisimulation Skou[LaSk89](Denition3.4.3,page54)whichdoesnotabstractfrominternalmoves. sands0areweaklybisimilar.Moreover,ifthesystemis-free(i.e.P(t;)=0<strong>for</strong>all Formally,if(S;Act;P)isafullyprobabilisticsystemands,s0arebisimilarstatesthen isstrictlycoarserthan(strong)bisimulationalaLarsen&<br />
readyequivalenceinthesenseofJou&Smolka[JoSm90]as statest)thenweakbisimulationequivalence coincide.9Ofcourse,wecannotexpect stepswhiletheequivalencesof[JoSm90]donottreatthe-stepsinaspecialwayand tobecomparablewithstrongtrace,failureor and(strong)bisimulationequivalence<br />
arestrictlycoarserthanstrong(andweak)bisimulation<strong>for</strong>-freesystems.Forinstance, thestatessands0ofthesystembelowarestronglytraceequivalentbutnot(stronglyor abstractsfromtheinternal<br />
weakly)bisimilar.<br />
v ts<br />
u t01 s0<br />
,1 ? ,1 ,1 �,1 v0,1<br />
��@@@R,1<br />
u0 t02<br />
Viceversa,thestatessands0ofthesystem(fs;s0;tg;f;g;P)whereP(s;;s0)= AAAU ? ? ,1<br />
P(s0;;t)=1andP()=0inallothercasesareweaklybisimilarbutnotstrongtrace,<br />
arecalledweaklytraceequivalenti systems, failureorreadyequivalentinthesenseof[JoSm90].Dealingwiththe\weak"counterparts oftheequivalencesproposedin[JoSm90],Theorem7.1.4(page162)yieldsthat,<strong>for</strong>nite isstrictlynerthanweaktrace,failureorreadyequivalence.Here,e.g.s,s0<br />
<strong>for</strong>allk Christo[Chri90b,Chri90a]andCleavelandetal[CSZ92](seealso[YCDS94])introduce 0and1;:::;k2Actnfg. Prob(s; 1::: k)=Prob(s0; 1::: k)<br />
testingequivalences<strong>for</strong>niteaction-labelledfullyprobabilisticprocessesthatrelatetwo 8Notethatonlystateswithlabel?canbeaddedtoQ. 9Notethat,<strong>for</strong>(S;Act;P)tobe-free,Prob(s; ;C)=P(s;;C).
processesintermsofthereliabilityincertainenvironments.While[Chri90b]dealwith 172 CHAPTER7.WEAKBISIMULATION<br />
frominternalcomputations.Intheremainderofthissectionwediscusstherelation deterministicenvironments[CSZ92]considerprobabilistictestingscenarios.Bothabstract betweenthesetestingpreordersandournotionofweakbisimulation.Forthis,wexa TestingequivalencealaChristo:Weshowthatweakbisimulationisstrongerthan thetestingequivalencesintroducedbyChristo[Chri90b](seealso[Chri90a,ChCh91]). niteaction-labelledfullyprobabilisticsystem(S;Act;P).<br />
[Chri90b]distinguishesfullyprobabilisticprocessesthroughtheconditionalprobabilities ofcertaindeterministictestingscenarios.Theseveraltestingscenariosleadtothedenitionsofprobabilistictraceequivalence=tr,weakprobabilistictestingequivalence=wteand strongprobabilistictestingequivalence=ste.Asshownin[Chri90b],=tr showthatweakbisimulationequivalence equivalence=ste(andthus,itisalsostrongerthan=wteand=tr). isstrongerthanstrongprobabilistictesting =wte =ste.We<br />
Webrieyrecallthedenitionofstrongprobabilistictestingequivalence.Moreprecisely, weuseanequivalentcharacterizationof=stewhichisgivenin[ChCh91]. Notation7.3.1[ThesetOerings]LetOeringsbethesetofnonemptysubsetsof Actnfg(thesetofoerings)andOeringsthesetof(nite)stringsofoerings."O denotestheemptystringofoerings.<br />
ofL1:::Lk.The<strong>for</strong>maldenitionofQ()isasfollows. theprobability<strong>for</strong>per<strong>for</strong>mingthestring ForL1;:::;Lk2Oeringsand1;:::;r2Actnfg,Q(s;L1:::Lk;1:::r;t)denotes<br />
Notation7.3.2[ThevaluesQ(s;~L;~;C)]Thefunction 1::: rendingupintwhenoeredastring<br />
isdenedasfollows.Lets2S,C ~2(Actnfg).Q(s;"O;~;C)=0if~6="<br />
Q:S Oerings S,L2Oerings, (Actnfg) 2S![0;1] 2Actnfg,~L2Oerings,<br />
Q(s;L~L;~;C)=Xu2SQ(s;L;;C)Q(u;~L;~;C) Q(s;~L;";C)=(1:ifs2C<br />
Q(s;L;;C)=0if 0:otherwise<br />
followinglinearequationsystem. If 2LthenthevaluesQ(s;L;;C),s2S,C =2L<br />
1.Q(s;L;;C)=0ifProb(s; ;C)=0. Saretheuniquesolutionofthe<br />
2.IfProb(s; Q(s;L;;C)= ;C)>0then<br />
NotethatProb(s; ;C)>0,2LimpliesP(s;)+P(s;L)>0.<br />
P(s;)+P(s;L)+Xu2S P(s;;C) P(s;)+P(s;L)Q(s;L;;C): P(s;;u)
7.3.CONNECTIONTOOTHEREQUIVALENCES 173<br />
u,34 ���s@@@R,14 t v0 w0 ,12 s0<br />
,12 ,12 ,12<br />
���@@@Ru0 t0 � �� @@@R<br />
Notation7.3.3[ThevaluesQ(s;~L;~)]If~L2Oeringsand~2(Actnfg)then Figure7.4:s=stes0buts6s0<br />
weputQ(s;~L;~)=Q(s;~L;~;S): Denition7.3.4[Thetestingequivalence=ste,cf.[Chri90b,ChCh91]]<br />
Theorem7.3.5 s=stes0iQ(s;~L;~)=Q(s0;~L;~)<strong>for</strong>all~L2Oerings,~2(Actnfg).<br />
Proof: =ste.Toseethat=steand InSection7.5.2,Theorem7.5.19(page188),weshowthat isstrictlynerthan=ste.<br />
Figure7.4(page173).Then,s=stes0as,<strong>for</strong>instance, donotcoincideconsiderthefullyprobabilisticsystemof isnerthan<br />
andQ(s;fg;)=1=Q(s0;fg;).<strong>On</strong>theotherhand, Q(s;f;g;)=34=12+1212=Q(s0;f;g;)<br />
Hence,s06w0.Thus,Prob(s0;;W)=1=2>0=Prob(s;;W)whereWistheweak bisimulationequivalenceclassofw0.Thus,s6s0. Prob(s0; ;S)=3=4>1=2=Prob(w0; ;S):<br />
[ChCh91]presentsalgorithms<strong>for</strong>decidingthethreekindsofequivalenceswhicharebased onsolvinglinearequationsystemsandrunintimeO(n4)wherenisthenumberofstates oftheunderlyingsystem.Incontrasttothis,theuseofweak(orbranching)bisimulation hastheadvantagethatitallowstheuseoftheconditionalprobabilitiesPX()whichcanbe computedbysimplearithmeticoperations(ratherthansolvinglinearequationsystems). TestingequivalencesalaCleavelandetal[CSZ92]:[CSZ92](seealso[YCDS94] presentquantitativeextensionsofthenon-probabilistictestingpreordersbydeNicola& Hennessy[dNHe83,Henn88].GivenatestT{whichisrepresentedbyafullyprobabilisticsystemequippedwithasetofsuccessstates{theprobability<strong>for</strong>afullyprobabilisticprocessPtopassthetestTisdenedastheprobabilitymeasureofthesetof\inter- probabilisticprocessesP,P0aretestingequivalentwithrespecttoacertainclassoftests iPandP0passalltestsTofthatclasswiththesameprobability.[CSZ92]consider twoclassesoftests: actionsequences"leadingtoasuccessstate.Intuitively,givenaclassoftests,twofully<br />
TheclassTests0of-freetestswhichyieldsthetestingequivalencedenotedby0. TheclassTestsofallteststhatdonotcontain\-loops"whichyieldsthetesting equivalencedenotedby.
174 CHAPTER7.WEAKBISIMULATION<br />
wu,12 ts,1<br />
,1 ,12<br />
xv,1<br />
w0 u0 ? t01,12 � s0<br />
,1 ��@@@R,12<br />
t02<br />
,1 x0 v0,1<br />
? ���@@@R ? ? ?<br />
Figure7.5:s s0buts6s0 ? ? ,1<br />
denitionof Section7.5.2(page188)whereweprovethat0iscoarserthan.Fortheprecise Theexactdenition(moreprecisely,analternativecharacterization)of0isgivenin<br />
Theorem7.3.6see[CSZ92]or[YCDS94].<br />
(a) (b) and isstrictlynerthan0.<br />
Proof: InSection7.5.2,Theorem7.5.27(page191),weshowthat arenotcomparable.<br />
to0).<strong>On</strong>theotherhand,sands0arenotweaklybisimilarasProb(s; 174)aretestingequivalentwithrespectto 0.Asshownin[YCDS94],thestatessands0ofthesystemshowninFigure7.5(page (andhence,testingequivalentwithrespect isnerthan<br />
shownbelowareweaklybisimilarwhiles06s0. whileProb(s0; t.(Notethatneithert01nort02isweaklybisimilartot.)Thestatess0ands0ofthesystem ;T)=0whereTdenotestheweakbisimulationequivalenceclassof ;T)=1<br />
s0 ,1 -s0 ,1-u success ,12 ���t@@@R,12 probability<strong>for</strong>s0topassthetestTis3/4whiletheprobability<strong>for</strong>s0topassTis1/2. Forinstance,thetestTshownontherightdistinguishesthestatess0ands0.The u<br />
7.4 Weestablishthecongruenceresult(Theorem7.4.2,page175)statingthecompositionalityofweakbisimulationequivalencewithrespecttotheoperatorsofPLSCCS.10More Compositionality<br />
probabilisticchoice. precisely,weshowthatweakbisimulationequivalence thePLSCCSoperatorsactionprexing,restriction,relabelling,lazyproductandguarded 10RecallthesyntaxandsemanticsofthelazysynchronouscalculusPLSCCSwhichwasintroducedin<br />
isacongruencewithrespectto<br />
Section4.3(page83).
7.4.COMPOSITIONALITY Inwhatfollows,weshrinkourattentiontonitaryPLSCCSprograms,i.e.programsP 175<br />
Notation7.4.1[FinitaryPLSCCSprograms]APLSCCSprogramhdecl;siiscalled wheretheassociatedfullyprobabilisticprocessO[P]isnite(orcanbeidentiedwitha<br />
nitaryithereareonlynitelymanystatementst2Stmt0thatarereachablefromsin niteprocess).<br />
(Stmt0;Act0;Pdecl).Adeclarationdecl:ProcVar!StmtPLSCCSiscallednitaryi,<strong>for</strong><br />
arisesfromO[P]byremovingallstatementst2Stmt0thatarenotreachablefromthe IfPisnitarythenO[P]canbeidentiedwiththenitefullyprobabilisticprocessthat eachZ2ProcVar,hdecl;Ziisnitary.<br />
initialstate.Clearly,ifdeclisnitarythen,<strong>for</strong>eachstatements,hdecl;siisnitary.11For PLSCCSprogramsP,P0,wedeneP wedenetherelationsdecl<strong>for</strong>PLSCCSstatementsbysdecls0ihdecl;si P0iO[P] O[P0].Forxeddeclarationdecl,<br />
actionprexing,restriction,relabellingandlazyproduct.Moreprecisely,ifdeclisa Theorem7.4.2WeakbisimulationequivalenceispreservedbythePLSCCSoperators hdecl;s0i.<br />
(a)Ifsdecls0thena:sdecla:s0,snL (b)Ifsidecls0i,i=1;2,thens1<br />
nitarydeclaration,then<strong>for</strong>allPLSCCSstatementss,s0,si,s0i: s2 decls01 decls0nLands[`] s02;andthus, decls0[`].<br />
(c)Weakbisimulationequivalenceisacongruencewithrespecttoguardedprobabilistic s1 s2 decls01 choice,i.e.ifsidecls0i,i2I,then s02:<br />
Xi2I[pi]ai:si Proof: Part(a)isaneasyverication.Weshow(b)and(c).Moreprecisely,we declXi2I[pi]ai:s0i:<br />
Pdecl(t;a;u)>0thenu2Si).Weshowthat thatareclosedwithrespecttothetransitionrelationinducedbyPdecl(i.e.ift2Siand xanitarydeclarationdecl,somenitesubsetsS1,S2,ofStmt0thatcontain0and<br />
isabisimulation(inthesenseofDenition3.4.3,page54).Here,weputt0=0t=0 andtdecl0iO[hdecl;ti] R=n(s1 s2;s01 (Stmt0;Act0;Pdecl;0).ForsubsetsC1ofS1andC2ofS2, s02):si;s0i2Si;sidecls0i;i=1;2o<br />
Clearly,RisanequivalencerelationonS1 wedene<br />
the<strong>for</strong>mC=C1 C2whereCi2Si=decl,i=1;2.Leta2Act,C=C1 C1 C2=fs1 s2:s12C1;s22C2g: S2.EachequivalenceclassC2S=Risof<br />
that,<strong>for</strong>allprocessvariablesZ,Z02ProcVar,thereisnooccurrenceofZ0indecl(Z)thatiscontained 11Asucientconditionwhichguaranteesthatdeclisnitaryisthe\simplicity"ofdeclinthesense C22S=R<br />
inasubstatementofthe<strong>for</strong>mt[`],tnLort1t2.
and(s;s0)2Rwheres=s1 176 s2,s0=s01 s02,sidecls0i,i=1;2.Then,byTheorem CHAPTER7.WEAKBISIMULATION<br />
7.1.4(page162)andCorollary4.3.2(page84): Pdecl(s;a;C)= = (1;2)2SynaProbdecl(s1; X<br />
(1;2)2SynaProbdecl(s01; X 1;C1)Probdecl(s02; 1;C1)Probdecl(s2; 2;C2)=Pdecl(s0;a;C): 2;C2)<br />
C0=[0]Ristheequivalenceclassof0withrespecttoR.WeconcludePdecl(s;a;C)= Pdecl(s0;a;C)<strong>for</strong>alla2Act0andC2S=R.Hence,Risabisimulation.Inparticular, whenever(s;s0)2Rthensdecls0.Thisyieldstheclaimofpart(b).Part(c)can Similarly,Corollary4.3.3(page84)yieldsthatPdecl(s;0;C0)=Pdecl(s0;0;C0)where<br />
Pi2I[pi]ai:si,Probdecl(s;a;C)=Xi2IpiProbdecl(si;a;C)+Xj2Jpj bederivedfromTheorem7.1.4(page162)andthefactthat,<strong>for</strong>C Stmt0ands=<br />
whereI=fi2I:ai=gandJ=fi2I:ai=a;si2Cg. Example7.4.3WeconsiderthePLSCCSprogramSenderReceiverofExample4.3.6 onpage86whichweverifyagainstthespecication<br />
Clearly,theoperationalsemanticsofSender Specdef =produce:consume:Spec:<br />
congruenceresult(part(b)ofTheorem7.4.2)allowsustouse\modularverication" (i.e.toverifythecomponentsSenderandReceiverseparately)avoidingtheconstruction 88)andtheoperationalsemanticsofSpecareweaklybisimilar.<strong>On</strong>theotherhand,our Receiver(showninFigure4.14onpage<br />
ofO[Sender Receiver]andusing<br />
andO[SenderSpec]areweaklybisimilar.Thus,byTheorem7.4.2(page175): asthespecication<strong>for</strong>thesender.Clearly,O[Sender](showninFigure4.13onpage87) SenderSpecdef =produce:deliver!wait:ack?:SenderSpec<br />
andSpecareweaklybisimilar(bythetransitivityof). ItiseasytoseethatSpec SenderSenderSpecReceiverwhichyieldsthatSenderReceiver Receiver SenderSpec Receiver:<br />
Ofcourse,wecannotexpectweakbisimulationequivalencetobeacongruence<strong>for</strong>the s1 synchronousparallelcompositionofPSCCSasPSCCSdoesnottreattheinternalaction inanydistinguishedway.Forexample,ifs1=:nil,s01=::nilands2=:nilthen<br />
choiceoperatorisalmostthesameasthecounterexampleinthenon-probabilisticcase demonstratesthatweakbisimulationequivalenceisnotacongruence<strong>for</strong>theprobabilistic s1s2ands01s2arenotweaklybisimilarwhiles1ands01are.Thecounterexamplethat s2canmakea -movewhiles01 s2pre<strong>for</strong>ms .Thus,if 6= then<br />
choice.ConsiderthePLSCCSstatementss1=:nil,s01=::nil,s2=:niland<br />
whichshowsthatweakbisimulationequivalenceisnotpreservedbynon-deterministic
7.5.PROOFS s=h12is1 h12is2,s0=h12is01 h12is2. 177<br />
Then,s1decls01buts6decls0assreachsviainternalactionstheweakbisimulation equivalenceclassCofs1=:nilwithprobability1=2whiles0cannotmovetoastate thatisweaklybisimilartos1.Formally,wehave whereCistheweakbisimulationequivalenceclassofs1anddeclanarbitrarydeclaration. Probdecl(s;;C)=12>0=Probdecl(s0;;C)<br />
7.5 Inthissectionwegivetheproofsofthemainresultsofthatchapter.Inwhatfollows, Proofs<br />
wexaniteaction-labelledfullyprobabilisticsystem(S;Act;P).Weusethefollowing notations:IfRisanequivalencerelationonSand Prob(s;;C)=Prob(s0;;C)<strong>for</strong>all(s;s0)2RandC2S=Rthenwedene<strong>for</strong>all A2S=R:Prob(A;;C)=Prob(s;;C)wheres2A.Wesimplywrite[s]todenotethe weakbisimulationequivalenceclassofs(i.e.[s]=[s]). aregularexpressionsuchthat<br />
InthissectionwegivetheproofofTheorem7.1.10(page163)whichstatesthat 7.5.1 Weakandbranchingbisimulationequivalence<br />
Denition7.5.1[Completenessofaweakbisimulation]LetRbeaweakbisimula- andtheproofofTheorem7.1.4(page162). =br<br />
tion.Riscalledcompletei Whenevers2S,C2S=RandProb(s;;C)=1thens2C.<br />
(inparticular,Adoesnotcontainterminalstates)andthereisastates2Awith Notethat,ifRisacompleteweakbisimulationandA2S=R,A6=Div,thenA\Div=; IfDiv6=;thenDiv2S=R.<br />
P(s;;A)
Notation7.5.3[ThematricesARandA0R]ForRtobeacompleteweakbisimula- 178 CHAPTER7.WEAKBISIMULATION<br />
equivalenceclassesAi2S=Rwhichcontainsomestatesi2SnStermwithP(si;;Ai)
7.5.PROOFS Forh,j=1;:::;kandh6=j: 179<br />
NotethatProb(A0;;Aj)=0<strong>for</strong>allj Prob(Ah;;Aj)=Prob(sh;;Aj)=kXi=1P(sh;;Ai)Prob(Ai;;Aj)=dh;j:<br />
matrix.Nextweshowthatej>0,j=1;:::;k. ThisyieldsCAR+E=AR.Thus,E=(I�C)ARwhereIdenotesthekk-identity 1.<br />
IfProb(Ai0;;Aj)6=0<strong>for</strong>somei02f1;:::;kgnfjgwithP(sj;;Ai0)>0then ej i6=i0P(sj;;Ai)+P(sj;;Ai0)Prob(Ai0;;Aj)
There<strong>for</strong>e,itsucestoshowthatL06H.WesupposethatL0 180 CHAPTER7.WEAKBISIMULATION<br />
vectorsa,csuchthatL0=fa+tc:t2IRgwherea=(a0;:::;ak)andc=(c0;:::;ck) withal=cl=0andc6=0.BydenitionofL0wehaveL=fxA0R:x2L0g.Hence, H.Then,therearereal<br />
<strong>for</strong>allj=0;:::;k,j6=landt2IR.Thus, bj=kXi=0aiProb(Ai;;Aj)+tkXi=0ciProb(Ai;;Aj)<br />
=0ciProb(Ai;;Aj)=0ifj6=l. kXi Hence,<br />
(since,otherwisetherowsofA0RwouldbelineardependentincontradictiontotheregularityofA0R).W.l.o.g.c=1.Then,cisthel-throwof(AR0)�1.Inparticular, cdef =kXi=0ciProb(Ai;;Al)6=0<br />
Weshowthat right-branchingbisimulation. 0=cl=al;l.Butthiscontradictstheconstraintal;l>0from(*).<br />
Notation7.5.5[Right-branchingbisimulation]Aright-branchingbisimulationis coincideswithanotherkindofbisimulationequivalencethatwecall<br />
branchingbisimulationR.R,a2ActandallequivalenceclassesC2S=R.srbrs0i(s;s0)2R<strong>for</strong>someright- anequivalencerelationRonSsuchthatProb(s;ba;C)=Prob(s0;ba;C)<strong>for</strong>all(s;s0)2<br />
Proof: lationisaweakbisimulation. Lemma7.5.6s LetRbearight-branchingbisimulation.WeshowthatRisaweakbisimu- rbrs0impliess s0.Moreprecisely:Eachright-branchingbisimulation.Let2Actnfg,s2SandC2S=R.Then,<strong>for</strong>allB2S=Rands2B:<br />
Prob(s; =X A2S=RProb(B; ;C)=Xt2SProb(s; ;A)Prob(A;;C): ;t)Prob(t;;C)<br />
Hence,if(s;s0)2RthenProb(s; Lemma7.5.7s 2Actnfg. s0impliess rbrs0.Moreprecisely:Eachcompleteweakbisimu- ;C)=Prob(s0; ;C)<strong>for</strong>allC2S=Rand<br />
lationisaright-branchingbisimulation.<br />
all,weobtainthatRisaright-branchingbisimulation.Thus, Proof: thatProb(s; LetRbeacompleteweakbisimulation.Wexsome2Actnfgandshow ;A)=Prob(s0; ;A)<strong>for</strong>alls s0andallA2S=R.(Rangingover rbr.)
7.5.PROOFS BytheregularityofA0R(Lemma7.5.4,page178):Wheneverwexarealvectora(of 181<br />
lengthk+1)thenthelinearequationsystemxA0R=ahasauniquesolution.Fors2S andj=0;1;:::;kwehave: Prob(s; ;Aj)=Xt2SProb(s; =kXi=0Prob(s; ;t)Prob(t;;Aj)<br />
Thus,<strong>for</strong>xedl:Forallstatess2Al,thevector(Prob(s; ;Ai)Prob(Ai;;Aj):<br />
thelinearequationsystemxA0R=awherea=(aj)0jkandaj=Prob(Al; BytheregularityofA0R:If(s;s0)2R(i.e.s,s02Al<strong>for</strong>somel)thenProb(s; Prob(s0; ;Ai),i=0;:::;k. ;Ai))0ikisasolutionof ;Ai)= ;Aj).<br />
Proof: Lemma7.5.8s isaweakbisimulation. LetRbeabranchingbisimulation.ItsucestoshowthatRisaright- brs0impliess s0.Moreprecisely:Eachbranchingbisimulation<br />
branchingbisimulation(Lemma7.5.6,page180).Forr �rbethesetoftuples(C0;:::;Cr)suchthat Ci2S=R,i=0;1;:::;r, 1andA,C2S=R,A6=C,let<br />
Then,<strong>for</strong>alls2A: C0=A,Cr=C, Ci6=Ci+1,i=0;:::;r�1.<br />
Hence,Prob(s;;C)=Prob(s0;;C)<strong>for</strong>alls,s02A.Similarly, Prob(s;;C)=1Xr=1(C1;:::;Cr)2�rr�1 X Yi=0ProbR(Ci;;Ci+1)<br />
<strong>for</strong>alls,s02A,2ActnfgandC2S=R. Prob(s; ;C)=Prob(s0; ;C)<br />
R: Lemma7.5.9(cf.Lemma7.2.4,page165)LetRbeanequivalencerelationonS. Then,Risabranchingbisimulationifandonlyif<strong>for</strong>allC2S=R,a2Actand(s;s0)2 (1)IfP(s;;[s]R),P(s0;;[s0]R)
Inthiscase:Ifs2SwithP(s;;[s]R)
7.5.PROOFS Then,xa;C=P(s;;A)xa;C+P(s;a;C)<strong>for</strong>alls2A.Hence,ifs2A\Tthen183<br />
Ifs2A\TandA6Tthenxa;C6=0<strong>for</strong>somepair(a;C)asabove.Thus, xa;C= 1�P(s;;A): P(s;a;C)<br />
Then,thereexistsanitepath0startinginsoflengthr ProbR(s;ba;C)=xa;C>0:<br />
(i)2A,i=1;:::;r�1andP(last();;A)0). 0(i)2A,i=0;1;:::;r�1andlast(0)2C.Letbethe(r�1)-thprexof0.Then, 1withtrace(0)2 a,<br />
Proposition7.5.10s Proof: followsbyLemma7.5.6(page180)andLemma7.5.7(page180). s0i s rbrs0<br />
Notation7.5.11[TheconditionalprobabilitiesPR()]LetRbeanequivalencerelationonS. P(s;;[s]R)
NotethatProb(C;;C)=1.Nowwesupposethats2AjnT.Then, 184 CHAPTER7.WEAKBISIMULATION<br />
1�P(s;;Aj)=kXi=0P(s;;Ai) Prob(s;;C)<br />
= kXi=0 1�P(s;;Aj)Prob(Ai;;C)<br />
i6=j1�P(s;;Aj)Prob(Ai;;C)+ P(s;;Ai) 1�P(s;;Aj)Prob(Aj;;C) P(s;;Aj)<br />
= i6=jPR(s;;Ai)Prob(Ai;;C)+ kXi=0 1�P(s;;Aj)Prob(s;;C) P(s;;Aj)<br />
Here,weusethefactthatProb(s;;C)=Prob(Aj;;C).Weobtain: Prob(s;;C)=Prob(s;;C) 1�P(s;;Aj)�P(s;;Aj) 1<br />
=kXi=0 1�P(s;;Aj)!<br />
Thus,<strong>for</strong>eachs2AjnT,thevector(PR(s;;Ai))0iksolvestheequationsystem i6=jPR(s;;Ai)Prob(Ai;;C)<br />
Lemma7.5.4(page178)yieldsPR(s;;C)=PR(s0;;C)<strong>for</strong>alls;s02AjandC2S=R, xj=0; kXi=0xiProb(Ai;;C)=Prob(Aj;;C):<br />
C6=Aj.Let Forall2Actnfgands2Aj: PR(Aj;;C)=PR(s;;C)wheres2Aj\T.<br />
Asbe<strong>for</strong>e,weobtain<strong>for</strong>s2AjnT: Prob(s; ;C)=kXi=0P(s;;Ai)Prob(Ai; ;C)+P(s;;C)<br />
Then,<strong>for</strong>alls2AjnT,2ActandC2S=R: Prob(s; ;C)=kXi=0 i6=jPR(s;;Ai)Prob(Ai; ;C)+PR(s;;C):<br />
WeobtainPR(s;;C)=PR(s0;;C)<strong>for</strong>alls,s02AjnT. Prob(Aj; ;C)=kXi=0 i6=jPR(Aj;;Ai)Prob(Ai; ;C)+PR(s;;C)<br />
Corollary7.5.13(cf.Theorem7.1.10,page163)s s0is brs0.
7.5.PROOFS Lemma7.5.14LetR1,R2bebranchingbisimulations.Then,R=(R1[R2)isa 185<br />
branchingbisimulation.<br />
C0=C0[:::[CrwhereCi2S=Rj. Proof: Firstweobservethat<strong>for</strong>j2f1;2g,eachequivalenceclassC02S=Rcanbewrittenas WeshowthatRfulllstheconditions(1)and(2)ofLemma7.5.9(page181).<br />
Then: withP(s;;C0),P(s0;;C0)
Proof: 186 Lemma7.5.8(page181),Lemma7.5.15(page185)andCorollary7.5.13(page CHAPTER7.WEAKBISIMULATION<br />
k184)yieldthat Theorem7.5.17(cf.Theorem7.1.4,page162)Ifs =brisaweakbisimulation.<br />
(a)Prob(s; 1and1;:::;k2Actnfg: 1 2::: k;C)=Prob(s0; 1 2::: s0.then,<strong>for</strong>allC2S=,<br />
Proof: (b)Prob(s; 1 2::: k;C)=Prob(s0; 1 2::: k;C)<br />
havetoshowthatProb(s; Weprovepart(a)byinductiononk.Inthebasisofinduction(k=1)we ;C)=Prob(s0; ;C)<strong>for</strong>allvisibleactionsandallweak k;C)<br />
183)andLemma7.5.16(page185).Intheinductionstepk�1=)kweassumethat kbisimulationequivalenceclassesC.ThisfollowsimmediatelybyProposition7.5.10(page Prob(s; Prob(t;;C)=Prob(t0;;C)<strong>for</strong>allt 2,1;:::;k2Actnfgand 1;A)=Prob(s0; 1;A)<strong>for</strong>allA2S= = 2::: t0andC2S= k.Then,<br />
(inductionhypothesis).Thus: Prob(s; = A2S=Prob(s0; X 1;C)=X<br />
1;A)Prob(A;;C)=Prob(s0; A2S=Prob(s; 1;A)Prob(A;;C)<br />
Here,weusethefactthatPathful(u; 1;C)canbewrittenasdisjointunionofthe 1;C):<br />
setsA(u),A2S=,whereAisthesetoffulpathssuchthat trace((k))2 (k)2A, =(k) where2Pathful((k);;C) 1,<br />
<strong>for</strong>somekProb(s;;C)=X 0.Part(b)canbederivedfrom(a):<br />
= A2S=Prob(s0; X A2S=Prob(s; 1::: k;A)Prob(A;;C)=Prob(s0;;C): 1::: k;A)Prob(A;;C)<br />
7.5.2 where = andthetestingequivalences=steand 1::: k.<br />
WecompletetheproofsofTheorem7.3.5(page173)andTheorem7.3.6(page174)by showingthat isnerthanthetestingequivalences=steand0. 0<br />
Lemma7.5.18IfA,C2S=,s,s02A,L Q(s;L;;C)=Q(s0;L;;C):<br />
Actnfgand 2Lthen
7.5.PROOFS Proof: Firstweobservethat,<strong>for</strong>allA,B2S= =S=br,s,s02AwithP(s;;A), 187<br />
P(s0;;A)0then ;C)=0.<br />
qA=1 rA0B@P0(A;;C)+X Theuniquenessoftheequationsystemaboveisaneasyverication.ForallA2S= B2S=<br />
suchthatrA>0andProb(A; ;C)>0ands2AwithP(s;;A)>0wehave: B6=AP0(A;;B)qB1CA:<br />
and P(s;;SnA)+P(s;L)>0<br />
1�P(s;)+P(s;L)!qA=P(s;;SnA)+P(s;L) P(s;;A)<br />
=P(s;;SnA)+P(s;L) P(s;)+P(s;L) qA<br />
P(s;)+P(s;L) rA 10B@P0(A;;C)+X<br />
= B2S=<br />
P(s;)+P(s;L) 1�P(s;;A) B6=AP0(A;;B)qB1CA 0B@P0(A;;C)+X<br />
= B2S=<br />
P(s;)+P(s;L) 1 B6=AP0(A;;B)qB1CA 0B@P(s;;C)+X<br />
= P(s;)+P(s;L)+X P(s;;C) B2S= B2S=<br />
B6=AP(s;)+P(s;L)qB: P(s;;B) B6=AP(A;;B)qB1CA
Thus, 188 CHAPTER7.WEAKBISIMULATION<br />
ForA2S= ands2A,letqs=qAandrs=rA.Then,thevector(qs)s2Ssolvesthe qA= P(s;)+P(s;L)+X P(s;;C) B2S= P(s;)+P(s;L)qB: P(s;;B)<br />
followingregularlinearequationsystem.IfProb(s; Otherwise, qs= P(s;)+P(s;L)+Xu2S P(s;;C) P(s;)+P(s;L)qu: P(s;;u) ;C)=0orrs=0thenqs=0.<br />
Itiseasytoseethat,ifrs=0thenQ(s;L;;C)=0.Thus,thevector(Q(s;L;;C))s2S<br />
Weconclude:Q(s;L;;C)=qA=Q(s0;L;;C)<strong>for</strong>alls,s02A,A2S=. isalsoasolutionoftheequationsystemabove.Hence, qs=Q(s;L;;C)<strong>for</strong>alls2S.<br />
Proof: Theorem7.5.19(cf.Theorem7.3.5,page173) Asobservedin[Chri90b],s=stes0i isnerthan=ste.<br />
Lemma7.5.18(page186)weobtainthat,ifs <strong>for</strong>allL1;:::;Lk2Oeringsand1;:::;k2Actnfg.Byinductiononkandusing Q(s;L1:::Lk;1:::k)=Q(s0;L1:::Lk;1:::k)<br />
Q(s;L1:::Lk;1:::k;C)=Q(s0;L1:::Lk;1:::k;C) s0then<br />
<strong>for</strong>allC2S=.SummingupoverallC2S= Q(s;L1:::Lk;1:::k)=Q(s0;L1:::Lk;1:::k): weobtain<br />
Hence,s=stes0.<br />
x2X. sistingofalldistributionsonXandthefunctionNotation7.5.20[ThesetDistr0(X)]ForXtobeaset,letDistr0(X)bethesetcon- Notation7.5.21[<strong>Probabilistic</strong>traces]Aprobabilistictraceisanitesequence :X![0;1]with(x)=0<strong>for</strong>all<br />
overDistr0(Actnfg)(Actnfg)."PrTrdenotestheemptyprobabilistictrace,ProbTraces thecollectionofallprobabilistictraces. =h1;1ih2;2i:::hk;ki<br />
thenormalizatorofsandisdenedby Notation7.5.22[Thenormalizatornorm(s;)]For2Distr0(Actnfg)ands2S, norm(s;)= 2ActnfgP(s;)()+P(s;):<br />
X
7.5.PROOFS [CSZ92,YCDS94]denetheprobabilitiesN(s;;;C)thatfromstatesthestatetis 189<br />
reachedviaanitepathlabelledby samevalues). accordancewith.Here,weuseaslightlydierentwaytodeneN()(whichyieldsthe giventhattheenvironmentisenablingactions<br />
Notation7.5.23[ThevaluesN(s;;;C)]Let<br />
linearequationsystem: bedenedasfollows.Thevector(N(s;;;C))s2Sistheuniquesolutionofthefollowing N:S (Actnfg)Distr0(Actnfg)2S![0;1]<br />
1.IfProb(s; 2.IfProb(s; ;C)=0ornorm(s;)=0thenN(s;;;C)=0.<br />
N(s;;;C)= ;C)>0andnorm(s;)>0then<br />
Clearly,if()=0<strong>for</strong>allnorm(s;)P(s;;C)+Xt2SP(s;;t) thenN(s;;;C)=0<strong>for</strong>allstatessandC () norm(s;)N(t;;;C):<br />
M(s;"PrTr)=1and Notation7.5.24[ThevaluesM(s;)]LetM:S ProbTraces![0;1]begivenby: S.<br />
Denition7.5.25[Thetestingequivalence0,cf.[CSZ92,YCDS94]] M(s;h;i)=Xt2SN(s;;;t)M(t;)<br />
Lemma7.5.26Ifs s 0s0iM(s;)=M(s0;)<strong>for</strong>all2ProbTraces.<br />
Proof: 2Distr0(ActnfgandC2S=. If()=0<strong>for</strong>all s0thenN(s;;;C)=N(s0;;;C)<strong>for</strong>all thenN(s;;;C)=N(s0;;;C)=0.Nowweassume 2Actnfg,<br />
that P(s;;A)0.<br />
)=0<strong>for</strong>alls2Aand 2Actnfgwith
Letnorm(A;)=0and2Actnfgwith()>0.Then: 190 CHAPTER7.WEAKBISIMULATION<br />
Hence,P(s;)=0andP(s;;SnA)=0<strong>for</strong>alls2A.Inparticular,Prob(s;;SnA)=0 P0(A;;C)=0<strong>for</strong>allC2S=,C6=A. P0(A;;C)=0<strong>for</strong>allC2S=,<br />
<strong>for</strong>alls2A.ThisyieldsProb(s; ForA,C2S=, 2Actnfgand )=0.<br />
system: asfollows.Thevector(N(A;;;C))A2S=istheuniquesolutionofthelinearequation 2Distr0(Actnfg),wedeneN(A;;;C)<br />
1.Ifnorm(A;)=0thenN(A;;;C)=0. 2.Ifnorm(A;)>0then N(A;;;C)= norm(A;)P0(A;;C)+X ()<br />
Inwhatfollows,wesuppose,andCtobexed.Itsucestoshowthat B2S= B6=AP0(A;;t) norm(A;)N(B;;;C):<br />
Foralls2Swedenexs=N([s];;;C).(Recallthat[s]denotestheweakbisimulation equivalenceclassofs.)Clearly,(*)holdsifnorm(A;)=0.NowweassumeA2S= (*)N(s;;;C)=N(A;;;C)<strong>for</strong>alls2AandA2S=.<br />
(2)Ifs2AwithP(s;;A)0.(Inparticular,A6=Div.)Then:<br />
(3)Ifs2AwithP(s;;A)0.Itiseasytoseethat,ifProb(A; )=0<strong>for</strong>alls2A.Thus,by<br />
xs=0=N(A;;;C)<strong>for</strong>alls2A.Inwhatfollows,wesupposeProb(A; By(2)and(3), ;C)=0then<br />
norm(s;)>0<strong>for</strong>alls2A, ;C)>0.<br />
Lets2AwithP(s;;A)P(s;;A)<strong>for</strong>alls2AwithP(s;;A)
7.5.PROOFS + 1�P(s;;A) 191<br />
norm(s;)�P(s;;A)X t2SnA1�P(s;;A)xt P(s;;t)<br />
= + norm(s;)�P(s;;A)P(s;;C) ()<br />
Thus, norm(s;)�P(s;;A)Xt2SP(s;;t)xt� 1 norm(s;)�P(s;;A)xs P(s;;A)<br />
xs = norm(s;)�P(s;;A)=xs norm(s;) 1 1+ norm(s;)�P(s;;A)! P(s;;A)<br />
Hence, norm(s;)�P(s;;A) ()P(s;;C)+Xt2SP(s;;t)xt!:<br />
Thisyieldsxs=N(s;;;C)<strong>for</strong>alls2A. xs= norm(s;)P(s;;C)+ () norm(s;)Xt2SP(s;;t)xt: 1<br />
probabilistictraces.<br />
Proof: Theorem7.5.27(cf.part(a)ofTheorem7.3.6,page174) followsbyLemma7.5.26(page189)andinductiononthelengthofthe isnerthan0.
192 CHAPTER7.WEAKBISIMULATION
Chapter8<br />
Fairnessofprobabilisticchoice<br />
InSection3.2.3(page45)wearguedthat,<strong>for</strong>concurrentprobabilisticsystems,certain livenesspropertiescannotbeestablishedunlessfairnessassumptionsaremadeabout thewayinwhichthenon-deterministicchoicesareresolved.Forprobabilisticsystems, onemightalsoconsiderfairnesswithrespecttotheprobabilisticchoices.Clearly,the probabilities<strong>for</strong>thetransitionscanbeviewedasconditionsonthefrequencieswithwhich acertaintransitionischosen.Thus,fairnessassumptionsabouttheprobabilisticchoices seemtobesuperuousastheyareexpressedimplicitlybythetransitionprobabilities. Nevertheless,theprobabilisticchoicesmightberesolvedunfair,andhence{asinthe non-probabilistic(orconcurrentprobabilistic)case{itispossiblethatcertainliveness probabilitiesareviolatedinsomeexecutionswhiletheyholdinallexecutionsthatare fairwithrespecttotheprobabilisticchoices.Forinstance,ifweipacoininnitely<br />
Thus,fromapurelydescriptivepointofview,fairnesswithrespecttotheprobabilistic unfairbehaviouriszero;i.e.theevent\eventuallyhead"holds<strong>for</strong>almostallexecutions. executionsasitispossiblethatwealwaysobtain\tail".Buttheprobability<strong>for</strong>suchan oftenthenthepropertythateventuallytheoutcomeis\head"doesnothold<strong>for</strong>all<br />
choicesisirrelevantbecausetheprobabilitymeasureofallexecutionsthatsatisfyacertain lineartimepropertydoesnotdependonwhetherornotweshrinktheattentiontothose<br />
systems.[Pnue83,PnZu86a,PnZu93]introducestwokindsoffairnesswithrespecttothe theresultsofPnueli&Zuck[Pnue83,PnZu86a,PnZu93]fairnesswithrespecttothe probabilisticchoicesmightbehelpful<strong>for</strong>verifyingqualitativeproperties<strong>for</strong>probabilistic executionswheretheprobabilisticchoicesareresolvedinafairmanner.However,by<br />
qualitativelineartimepropertiesinthefollowingsense:Wheneveralineartimeproperty 'holds<strong>for</strong>allexecutionsequencesthatareextremelyfair(or-fair)then'holdswith probabilisticchoices(calledextremelyfairnessand-fairness)<strong>for</strong>(avariantof)concurrent<br />
probability1(independentontheadversary). probabilisticsystems.Extremeand-fairnessareshowntobesound<strong>for</strong>thevericationof<br />
Themaingoalofthatchapter(whoseresultsarepublishedin[BaKw98a],ajointwork withMartaKwiatkowska)istopresentageneralnotionoffairnesswithrespecttothe weshowthatinordertodemonstratethevalidityofaqualitativelineartimeproperty' <strong>for</strong>probabilisticprocessesitsucestoshow{<strong>for</strong>someinstanceofourgeneralp-fairness probabilisticchoices(shortlycalledp-fairness)thatsubsumesextremelyand-fairnessa la[Pnue83,PnZu86a,PnZu93]andtheabovementionedsoundnessresult.Moreprecisely,<br />
193
194 notion{that'holds<strong>for</strong>allp-fairexecutionsequences.Thisallowsone,givenaninstance CHAPTER8.FAIRNESSOFPROBABILISTICCHOICE<br />
probabilisticprocessestothenon-probabilisticcase:ratherthancomputetheexactprobabilitiesofthesetofpathsfullling',itissucienttoestablishthat'holds<strong>for</strong>allp-fair ofourp-fairnessnotion,toreducethevericationofqualitativelineartimepropertiesof executionsequencesbymeansofwell-knownnon-probabilisticmethods(deductivemeth-<br />
Givenaset P-fairnessmightalsobeuseful<strong>for</strong>computingtheprobabilitymeasureofcertainevents. odsormodelchecking,seee.g.[LiPn85,MaPn92,CGH94,Lamp94,GPV+95,MaPn95]).<br />
(whichyieldsProb((s))=Prob(0(s))).Thus,themore\complicate"set replacedbythe\simpler"set0.1 a\simpler"set0offulpathsandshowthat,<strong>for</strong>anyp-fairfulpath,2 offulpaths<strong>for</strong>whichwewanttocomputeProb((s)),onemightdene imightbe 20<br />
probabilisticandconcurrentprobabilisticsystems.InSection8.1,weintroducep-fairness <strong>for</strong>fullyprobabilisticsystemsandpresentourmainresultstatingthat,<strong>for</strong>everyinstance ofourgeneralnotionofp-fairness,thesetofp-fairexecutionsequencesinboundedsystems Organizationofthischapter:Thenotionofp-fairnessisintroduced<strong>for</strong>bothfully<br />
probabilisticsystemsandshowsthatextremeand-fairnessandtheabovementioned soundnessresultalaPnueli&Zuckcanbeobtainedfromourgeneralp-fairnessnotion. hasprobability1(Theorem8.1.5,page196).Section8.2dealswithp-fairnessconcurrent<br />
8.1 Weintroduceageneralnotionof(strong)fairnesswithrespecttotheprobabilisticchoices P-fairness<strong>for</strong>fullyprobabilisticsystems<br />
action.Wesayanexecutionsequenceisp-fairifwheneveralabelisenabledinnitely manytimesthenitistakeninnitelymanytimes. choicesareassociatedwith\labels",witheachlabeldenotinge.g.aprocessnameoran infullyprobabilitsicsystems.Forthis,wesupposethatthealternativesoftheprobabilistic<br />
Denition8.1.1[p-fairness<strong>for</strong>fullyprobabilisticsystems]Let(S;P)beafully Let`2L.`iscalled emptycountablesetoflabelsandl:SS!2Lafunctionwithl(s;t)=;ifP(s;t)=0.probabilisticsystem.Ap-fairnesscondition<strong>for</strong>(S;P)isapair(L;l)whereLisanon- Afulpathiscalledp-fairwithrespectto(L;l;`)ieither`isenabledonlynitelymany takeninthei-thstepofafulpath enabledinastatesi`2l(s;t)<strong>for</strong>somet2S,<br />
timesin or`istakeninnitelyoftenin. i`2l((i);(i+1)).<br />
(L;l)-fair)i,<strong>for</strong>eachlabel`2L, Notethatallnitefulpathsare(L;l)-fairsinceeachlabel`isenabledonlynitelymany isp-fairwithrespectto(L;l;`). iscalledp-fairwithrespectto(L;l)(or<br />
times.If(L;l)areunderstoodfromthecontextthenwebrieyspeakaboutp-fairness thistechniqueandintroducestateandtotalfairnessasspecialinstancesofp-fairness(resp.acombination ofp-fairnessandfairnessofnon-deterministicchoiceinthecaseoftotalfairness)thatweusetogivesimple characterizations<strong>for</strong>thewantedprobabilitymeasures.<br />
1Forinstance,inthecorrectnessproofsofthemodelcheckingalgorithmsinChapter9wemakeuseof
8.1.P-FAIRNESSFORFULLYPROBABILISTICSYSTEMS withrespecttoalabel`2L(ratherthanp-fairnesswithrespectto(L;l;`))andp-fairness 195<br />
ThesetLoflabelsshouldbethoughtofasanabstractionwhichallowstoexpressdierent (ratherthan(L;l)-fairness). kindsoffairness.Clearly,whetherornotafairprobabilistictransitionsystemyieldsa reasonablenotionoffairnessdependsonthechoiceofLand`. Example8.1.2[Processfairness]Toseewhyweneedsetsoflabelsweshowhowto deneprocessfairness.Weconsiderafullyprobabilisticsystemwhichisobtainedfrom<br />
aglobalstatesofthecomposedsystem,theschedulerdecides{accordingtoacertain schedulerthatdecidesrandomlywhichoftheprocessesPiper<strong>for</strong>msthenextstep.Given theparallel(interleaved)executionofP1;:::;Pnonasingleprocessorwhereweassumea aprobabilisticmergeofsequentialrandomizesprocessesP1;:::;Pn.Forthis,weconsider<br />
distributions{whichstephastobeper<strong>for</strong>mednext.Thetransitionprobabilitiesofthe composedsystemaregivenbythesedistributionssinthesensethatP(s;t)=s(t).2<br />
s!tarisesfromanautonomousmovebyPiwhiletheotherprocessesareidle)orofa l(s;t)thesetofprocessesthattakepartinthetransitionfromtheglobalstatestothe globalstatet.Thus,l(s;t)mightconsistofasingleprocessPi(iftheglobaltransition Todeneprocessfairness,letLtobethesetofprocessnames(i.e.L=fP1;:::;Png)and<br />
takespartinthetransitions!t.Let=s0!s1!:::beaninnitefulpath.Then, isprocessfairnessinthefollowingsense.Forstobeaglobalstateofthesystem,wesay thatprocessPiisenabledinsithereissomeglobaltwithP(s;t)>0suchthatPi setconsistingoftwoormoreprocesses(ifacommunicationoccurs).Then,(L;l)-fairness<br />
Similarly,wecandeneinteractionfairnesswhichensuresthatwheneverthesynchroniza- manyindicesiwherePiisactivatedinthetransitionsi!si+1. is(L;l)-fairiwheneverPiisenabledininnitelymanystatessithenthereareinnitely<br />
functionlthatassignstoeachtransitions!tthesingletonsetl(s;t)ofallprocesses nizedstep.Forthis,wedealwithLtobethepowersetoffP1;:::;Pngandthelabellingareinnitelymanystepswhere(exactly)theprocessesPi1;:::;Pikper<strong>for</strong>masynchrotionofcertainprocessesPi1;:::;Pikispossibleininnitelymanyglobalstatesthenthere thatareactivatedinthesteps!t.Then,(L;l)-fairnessisinteractionfairness.<br />
Act action-labelledfullyprobabilisticsystems(S;Act;P)weusealabellingfunctionl:S Remark8.1.3[Actionfairness]Todeneaction(event)fairnessinaction-labelled<br />
fairness,wedealwithL=Actanddenel(s;a;t)=fag.Then,(L;l)-fairnessensures probabilisticsystemswehavetodealwithaslightmodicationofp-fairness.Foran<br />
thatwheneveranactiona2Actisenabledinnitelyoftenthenaistakeninnitelyoften. Moreprecisely,if=s0a1 S!2Lthatassignstoeach(action-labelled)stepasetoflabels.Todeneaction<br />
P(si;a)>0<strong>for</strong>innitelymanyithena=ai<strong>for</strong>innitelymanyi. 2ThiscanbeviewedasageneralizationoftheprobabilisticmergeoperatorproposedbyBaeten, !s1a2!:::isaninnitefulpaththenis(L;l)-fairiwhenever<br />
Bergstra&Smolka[BBS92].[BBS92]dealwitha(binary)probabilisticmergeoperatorP1kp;qP2 parametrizedbyprobabilitiesp,q2[0;1](withp+q autonomousmovewhileP2isidle;similarly,(1�p)qistheprobability<strong>for</strong>P2tomakeanautonomous municationbetweenP1andP2occurswithprobability1�q.pqistheprobability<strong>for</strong>P1tomakean movewhileP1isidle.<br />
1)whichareinterpretedasfollows.Acom
196 Notation8.1.4[ThesetspFair`andpFair(L;l)]Let(L;l)beap-fairnesscondition<strong>for</strong> CHAPTER8.FAIRNESSOFPROBABILISTICCHOICE<br />
thatarep-fairwithrespectto`.pFair(L;l)=\`2LpFair(L;l;`) afullyprobabilisticsystem(S;P).For`2L,wedenepFair(L;l;`)tobethesetoffulpaths<br />
denotesthesetofallfulpathsthatare(L;l)-fair.<br />
p-fairnessasalineartime<strong>for</strong>mula,andthenuseawell-knownresult[Vard85,PnZu93] andpFair`ratherthanpFair(L;l;`).ToseethatpFair(s)ismeasurablewerstexpress statingthatthesetofpathsfulllingagivenlineartime<strong>for</strong>mulaismeasurable.The If(L;l)areunderstoodfromthecontextthenwebrieywritepFairratherthanpFair(L;l)<br />
operatorX.Formulasarebuiltfrom:thetruthvaluesttand,theatomicpropositions enabled(`)<strong>for</strong>eachlabel`2L,theusualbooleanconnectives^,_,:,!,andthe underlyinglineartimelogicisaslightmodicationofLTL(seeSection9.1.3,page212)<br />
temporaloperators2(\always"),3(\eventually")andanext-stepoperatorX`<strong>for</strong>each whichuseslabellednextstepoperatorsX`ratherthantheusual(unlabelled)nextstep<br />
label`2L.The<strong>for</strong>mulasareinterpretedoverthefulpathsoffullyprobabilisticsystem Letbeafulpathin(S;P).Then, (S;P)withap-fairnesscondition(L;l).Wedenethesatisfactionrelationj=asfollows.<br />
Theotheroperatorsareinterpretedintheusualway(seee.g.[MaPn92]).Wewritej=' (;j)j=X`'ijj (;j)j=enabled(`)i`isenabledin(j)<br />
i(;0)j='.Asshowne.g.in[Vard85,PnZu93],<strong>for</strong>agiven<strong>for</strong>mula',thesetoffulpaths j+1,`2l((j);(j+1))and(;j+1)j='.<br />
startinginaxedstates2Ssuchthatj='ismeasurable.Wedene<br />
Clearly,j='`i '`=23enabled(`)!23taken(`)wheretaken(`)=X`tt: isp-fairwithrespectto`.Thus,<br />
Ourresultsrelyontheboundednessof(possiblyinnite-state)fullyprobabilisticsystems andpFair(L;l)(s)=T`2LpFair`(s)aremeasurable. pFair`(s)=f2Pathful(s): j='`g<br />
(seeDenition3.1.12,page38).Wenowstateourmainresultwhichshowsthat<strong>for</strong>each instanceofp-fairnessinaboundedsystem,themeasure<strong>for</strong>thep-fairfulpathsis1. Theorem8.1.5Let(L;l)beap-fairnesscondition<strong>for</strong>aboundedfullyprobabilisticsystem (S;P)ands2S.Then, Proof: toshowthatpFair`(s)=1<strong>for</strong>all`2L.3Let`beaxedlabeland Letc>0bearealnumbersuchthatP(s;t)>0impliesP(s;t) Prob(pFair(L;l)(s))=1:<br />
fulpathswhere`isenabledinnitelyoftenandwhichtotallyignore`-steps,i.e. bethesetofall c.Itsuces<br />
3NotethatProb(i)=1impliesProb(Tii)=1whichholdsineachprobabilisticspace.<br />
=f2Pathful:j=23enabled(`)^2:taken(`)g
8.1.P-FAIRNESSFORFULLYPROBABILISTICSYSTEMS If isanitepathwithlast()=sthenwebrieywrite (s)todenotetheset 197<br />
f :2(s)g.LetPathtnbethesetofallnitepathsendingintand<br />
asacountableunionofsetsofthe<strong>for</strong>m Weshowthat,<strong>for</strong>alls2S,Prob((s))=0andthatPathful(s)npFair`(s)canbewritten T=ft2S:tj=enabled(`)g:<br />
Claim1:Prob((s))=0<strong>for</strong>alls2S. Proof:Wedene tobethesetofnitepaths2Pathnsuchthatjj (t)where2Pathtnandt2T.<br />
t2Tands2S, (i)62T,i=1;:::;jj�1,andlast()2T.Fort2T,lett= t(s)=f2 :rst()=s;last()=tg: \Pathtn.Then,<strong>for</strong> 1,`=2l(s;(1)),<br />
(s)iscountableand(s)=St2Tt(s)wheret(s)\t0(s)=;ift6=t0.Thus,<br />
Wehave (1) X2(s)P()=Xt2TX<br />
(s)=[ 2t(s)P():<br />
Prob( As (t)\0 (t0)=;if(;t)6=(0;t0),andas t2T[ 2t(s) (t)<strong>for</strong>alls2S.<br />
(2) (t))=P()Prob((t))weobtain: Prob((s))=Xt2T X (t)isameasurablesetwith<br />
Lett2T.Astj=enabled(`)thereissomest2Swith`2l(t;st).SinceP(t;st) 2t(s)P()Prob((t)) <strong>for</strong>alls2S.<br />
obtain:(3) X2(t)P() Xs6=stP(t;s) 1�P(t;st) 1�c<strong>for</strong>allt2T. cwe<br />
hypothesisweget<strong>for</strong>allt2T: induction(k=0)thereisnothingtoshow.Intheinductionstep(k=)k+1)we supposethatProb((t)) WeshowbyinductiononkthatProb((t)) (1�c)k<strong>for</strong>allt2T.By(1),(2),(3)andtheinduction (1�c)k<strong>for</strong>allt2T.Inthebasisof<br />
Prob((t))=Xu2TX =(1�c)kX2(t)P() 2u(t)P()Prob((u)) (1�c)k+1: (1�c)kXu2TX 2u(t)P()<br />
Claim2:Prob(pFair`(s))=1<strong>for</strong>alls2S. WeconcludeProb((t))=0<strong>for</strong>allt2T.Thus,Prob((s))=0<strong>for</strong>alls2S(by(2)).c Proof:Itisclearthat Pathful(s)npFair`(s)=[ t2T 2Pathtn(s) [ (t):
198 NotethatPathtniscountable.Claim1yields CHAPTER8.FAIRNESSOFPROBABILISTICCHOICE<br />
<strong>for</strong>allt2T.Hence, Prob( (t))=P()Prob((t))=0<br />
andProb(pFair`(s))=1.c Prob(Pathful(s)npFair`(s)) Xt2T2Pathtn(s)Prob( X (t))=0<br />
Remark8.1.6Ifwedroptheassumptionthat(S;P)isboundedthentheprobabilityof 8.1,i.e.thesystem(S;P;L;l)whereS=ftg[fs0;s1;:::g,L=f`gand thefairpathsmightbelessthan1.Asacounter-exampleconsiderthesystemofFigure<br />
P(si;v)=8>:2�ri 1�2�ri:ifv=t 0 :ifv=si+1<br />
andP(t;si)=0,P(t;t)=1,l(t;t)=;.Here,(ri)i0isasequenceofpositiverealswhere :otherwise l(si;v)=(; f`g:ifv=t :ifv=si+1<br />
Pi0riisconvergent. =s0!s1!s2!:::isnotp-fairas`iscontinuouslyenabled<br />
`s0 l2�r0 s1 l2�r1 s2 l2�r2 s3 l :::<br />
tl<br />
`- `- ` - -<br />
? ��) ����<br />
butnevertakenin.Anyotherfulpathisniteandhencep-fair.Hence, Figure8.1:<br />
Prob(pFair(s0))=1�lim =1�lim k!12�(r0+r1+:::+rk�1)=1�2�r
8.2.P-FAIRNESSFORCONCURRENTPROBABILISTICSYSTEMS Ifj='<strong>for</strong>all2pFair(L;l)(s)thensis'-valid. 199<br />
process,itsucestoshowthatallp-fairfulpathssatisfy'<strong>for</strong>someinstanceofourgeneral Hence,inordertoestablisha(qualitative)lineartimeproperty'<strong>for</strong>aprobabilistic Proof: followsimmediatelyfromTheorem8.1.5(page196).<br />
conditionon(S;P),s2Sand Corollary8.1.8Let(S;P)beaboundedfullyprobabilisticsystem,(L;l)ap-fairness p-fairnessnotion(whichcanbeachievedwithwell-knownnon-probabilisticmethods).<br />
Prob (s)\pFair(L;l)=Prob((s)): asubsetofPathfulsuchthat(s)ismeasurable.Then:<br />
Proof: Inparticular,whenever'isalineartime<strong>for</strong>mulathentheprobabilityofthesetof fulpathsfullling'equalstheprobabilityofthesetofp-fairfulpathsfullling'.In followsimmediatelyfromTheorem8.1.5(page196).<br />
otherwords,whetherornota(qualitativeorquantitative)lineartimepropertyholds<strong>for</strong> toprobabilisticchoiceisirrelevant.5 choiceisrequired.Hence,fromapurelydescriptivepointofview,fairnesswithrespect aprobabilisticprocessdoesnotdependonwhetherfairnesswithrespecttoprobabilistic<br />
Inthissection,wedenep-fairness<strong>for</strong>concurrentprobabilisticsystemsandshowthat 8.2 thesoundnessresultofthep-fairnessapproach<strong>for</strong>establishingqualitativelineartime P-fairness<strong>for</strong>concurrentprobabilisticsystems<br />
casesoftheresultspresentedhere.Wecannotexpectageneralcompletenessresult(in fairnessofPnueli&Zuck[Pnue83,PnZu86a,PnZu93]arespecialinstancesofourgeneral p-fairnesnotion.Hence,thesoundnessresultsestablishedin[Pnue83,PnZu93]arespecial propertiescarriesovertotheconcurrentcase.Moreover,weshowthattheextremeand-<br />
incomplete.However,weareabletoshowthat{insomesense{-fairness(showntobe completein[PnZu93])istheonlyp-fairnessnotionthatiscomplete<strong>for</strong>provingvalidity 'holdsonallp-fairexecutionsequences)asin[Pnue83]extremefairnessisshowntobe thesensethat,ifalineartimeproperty'holdswithprobability1inalladversariesthen<br />
ofqualitativelineartimeproperties(Lemma8.2.11,page203).<br />
\enabled"inastatesonlydependsonthechosennon-deterministicalternativesandthe withcertainlabels.P-fairnessinconcurrentsystemsensuresthatwheneveralabel`is enabledinnitelyoftenthen`istakeninnitelyoftenwheretheunderlyingdenitionof Asinfullyprobabilisticcase,weassumethattheprobabilisticalternativesareassociated<br />
associateddistribution2Steps(s)(butnotontheothernon-deterministicalternatives<br />
knowledgethatcertainlivenesspropertiescannotbeestablishedwithoutsuitablefairnessassumptions. Itisworthnotingthat'-validityofastatesinaprobabilistictransitionsystemisweakerthan'-validity 2Steps(s)nfg).<br />
inthecorrespondingnon-probabilistictransitionsystem.Recallthat,inthenon-probabilisticcase,a 5<strong>On</strong>emightwonderwhysucharesultispossible,sinceinthenon-probabilisticcaseitisfolklore statesofatransitionsystemissaidtobe'-validiallfulpathsstartinginssatisfy',whereasinthe probabilisticcase,'-validityrequiresthat'holds<strong>for</strong>almostallfulpathsstartingins.
200 Denition8.2.1[p-fairness<strong>for</strong>concurrentsystems]LetS=(S;Steps)beacon- CHAPTER8.FAIRNESSOFPROBABILISTICCHOICE<br />
nonemptycountablesetLoflabelsandafunction currentprobabilisticsystem.Ap-fairnessconditiononSisapair(L;l)consistingofa<br />
If isafulpathinSand`2Lthenwesay l:f(;;t):2Pathn;2Steps(last());t2Supp()g�!2L:<br />
`isenabledinthei-thstepof`2l((i);step(;i);s) i<br />
If`2Lthen `istakeninthei-thstepof <strong>for</strong>somes2Supp(step(;i)),<br />
manytimesiniscalledp-fairwithrespectto(L;l;`)ieither`isenabledonlynitely or`istakeninnitelymanytimesin. i`2l((i);step(;i);(i+1)).<br />
to(L;l)(or(L;l)-fair)i,<strong>for</strong>eachlabel`2L, If(L;l)areunderstoodfromthecontextthenwebrieyspeakaboutp-fairnesswith isp-fairwithrespectto(L;l;`). iscalledp-fairwithrespect<br />
respecttoalabel`2L(ratherthanp-fairnesswithrespectto(L;l;`))andp-fairness<br />
<strong>for</strong>aconcurrentprobabilisticsystem(S;Steps).pFair(L;l;`)(orbrieypFair`)denotesthe Notation8.2.2[ThesetspFair`andpFair(L;l)]Let(L;l;`)beap-fairnesscondition (ratherthan(L;l)-fairness).<br />
setoffulpaths Theorem8.2.3Let(S;Steps)beaniteconcurrentprobabilisticsystem,(L;l)ap- whichare(L;l)-fair. whichare(L;l)-fairwithrespectto`,andpFair(L;l)thesetoffulpaths<br />
fairnessconditionon(S;Steps)andAanadversaryof(S;Steps).Then,<br />
<strong>for</strong>alls2S.Moreover,if isasubsetofPathAfulwhere(s)ismeasurablethen Prob(pFairA(L;l)(s))=1<br />
Proof: Itiseasytoseethat,<strong>for</strong>Atobeanadversaryof(S;Steps),afulpath Prob((s)\pFair(L;l))=Prob((s)):<br />
systemSA.6As(S;Steps)isnite,<strong>for</strong>eachadversaryA,theassociatedfullyprobabilistic systemSAisbounded.Thus,theclaimfollowsbyTheorem8.1.5(page196)andCorollary 8.1.8(page199). 2PathAis(L;l)-fairifandonlyif is(L;l)-fairasapathinthefullyprobabilistic<br />
Asbe<strong>for</strong>e,wesupposea(lineartime)logicLandasatisfactionrelationj= suchthat,<strong>for</strong>eachs2S,eachadversaryAandeach<strong>for</strong>mula'ofL,thesetf2 PathAful(s):j='gismeasurable.Wethenobtain: PathfulL<br />
SeeChapter3,page42.<br />
6Recallthatweidentifyeachpathin(S;Steps)withthepath=(0)!(1)!(2)!:::inSA.
8.2.P-FAIRNESSFORCONCURRENTPROBABILISTICSYSTEMS Corollary8.2.4If(L;l)isap-fairnesscondition<strong>for</strong>aniteconcurrentprobabilistic 201<br />
system(S;Steps)and'a<strong>for</strong>mulaofLthen<br />
<strong>for</strong>alladversariesA. Probf2pFairA(L;l)(s):j='g=Probf2PathAful(s):j='g<br />
Wecallastates'-validiProbf2PathAful(s): Proof: followsimmediatelyfromTheorem8.2.3(page200).<br />
fairnessfollows.Furthermore,thesoundnessofprovingthevalidityoflineartime<strong>for</strong>mulasunder(L;l)- j='g=1<strong>for</strong>alladversariesA.<br />
Corollary8.2.5Whenever(L;l)isap-fairnesscondition<strong>for</strong>aniteconcurrentprobabilisticsystem(S;Steps),'isa<strong>for</strong>mulaofLands2S.Then: Proof: followsimmediatelyfromCorollary8.2.4(page201). Ifj='<strong>for</strong>allfulpaths2pFair(L;l)(s)thensis'-valid.<br />
Extremeand-fairnessalaPnueli&Zuck:In[Pnue83]and[PnZu93]notionsof systems.Thedenitionofextremefairness[Pnue83]employsacollectionstatepredicates (describedbyrstorder<strong>for</strong>mulas),whereas-fairness[PnZu93]usessomekindoflinear timelogicwithpastoperators.Wenowadaptthenotionsextremeand-fairness<strong>for</strong>our extremefairnessand-fairnessareintroduced<strong>for</strong>(avariantof)concurrentprobabilistic<br />
conditionsasdenedabove.7 <strong>for</strong>ourlessgeneralmodelofconcurrentprobabilisticsystems)areinstancesofp-fairness modelofconcurrentprobabilisticsystemsandshowthatextremeand-fairness(adapted<br />
ForthedenitionofextremefairnesswesupposeasetStatePred Denition8.2.6[Extremefairness,cf.[Pnue83,PnZu86a]]Let 2StatePredrepresentsastatepredicate). 2S(whereeachelement<br />
manyindicesi S. wheneverstep(;i)= iscalledextremelyfairi,<strong>for</strong>each 0with(i)2,step(;i)=and(i+1)=s. <strong>for</strong>innitelymanyi2StatePred,eachs2Sand 0with(i)2 thenthereareinnitely beafulpathin 2Steps(s),<br />
whereweassumethateachelement lineartimelogic[LPZ85].Notethat,<strong>for</strong>tobeapast<strong>for</strong>mula,canbeidentiedwith thesetofallnitepaths Todene-fairnesswesupposePastFormtobeasetconsistingofsubsetsofPathn suchthateachfulpath2"fullls. ofPastFormrepresentsapast<strong>for</strong>mulasofsome<br />
Denition8.2.7[-fairness,cf.[PnZu93]]Afulpath with(i)2 step(;j)=and(j+1)=s. 2PastForm,s2Sand andstep(;i)= 2Steps(s),wheneverthereareinnitelymanyindicesi thenthereareinnitelymanyindicesjwith(j)2, iscalled-fairi,<strong>for</strong>each<br />
inoursense: Thenextlemmashowsthatextremeand-fairnessareinstancesofp-fairnessconditions 7SeeSection3.6,page63<strong>for</strong>thepreciseconnectionbetweenthemodelalaPnueli&Zuckandours.
202 Lemma8.2.8Let(L;l)beap-fairnesscondition<strong>for</strong>aconcurrentprobabilisticsystem CHAPTER8.FAIRNESSOFPROBABILISTICCHOICE<br />
(a) (S;Steps)and isextremelyfairifandonlyif Lefair=f(;;s):2StatePred;s2S;2Steps(s)g, beafulpathin(S;Steps).Then:<br />
lefair(;;s)=f(;;s)2Lefair:last()2g. is(Lefair;lefair)-fairwhere<br />
(b) is-fairifandonlyif lfair(;;s)=f(;;s)2Lfair:2g. Lfair=f(;;s):2PastForm;s2S;2Steps(s)g, is(Lfair;lfair)-fairwhere<br />
Proof: andlinsteadofLefairandlefairrespectively.Letbeafulpathin(S;Steps). \onlyif":Let Weonlyshow(a)as(b)canbeshownsimilarly.Forsimplicity,wewriteL<br />
enabledin.LetIbethesetofindicesi beextremelyfairandlet`=(;;s)2Lsuchthat`isinnitelyoften<br />
j2J,i.e.`istakeninnitelyoftenin. innitesubsetJofIsuchthat(j+1)=s<strong>for</strong>allj2J.Hence,`2l((j);;s)<strong>for</strong>all .Then,(i)2 andstep(;i)=<strong>for</strong>alli2I.As 0suchthat`isenabledinthei-thstateof isextremelyfairthereexistsan<br />
in.Hence,`istakeninnitelyoftenin,i.e.thereareinnitelymanyindicesjwith `2l((j);(j+1)).Foreachsuchindexj,(j)2,=step(;j)and(j+1)=s.Thus, \if":Wesuppose (i)2.Letsbeamodeof tobe(L;l)-fairandstep(;i)= andlet`=(;;s).Then,`isenabledinnitelyoften <strong>for</strong>innitelymanyindicesiwith<br />
page201)isageneralizationoftheresultof[Pnue83]whichstatesthesoundnessofproving Frompart(a)ofLemma8.2.8wecandeducethatoursoundnessresult(Corollary8.2.5, isextremelyfair.<br />
qualitativepropertiesunderextremefairness.In[PnZu93]itisshownthat,<strong>for</strong>eachstate<br />
The\if"-partisaninstanceofCorollary8.2.5(page201),whereasthe\only-if"-part sandeachlineartime<strong>for</strong>mula',<br />
(thecompletenessofthe-fairnessapproach)isnot.Thereason<strong>for</strong>thisisthatageneral sis'-validi j='holds<strong>for</strong>all-fairfulpaths2Pathful(s).<br />
completenessresultcannotbeestablished,asitisshownin[Pnue83]thatextremefairness Intheremainderofthissection,weshowthat-fairnessistheonlyp-fairnessnotion isnotanecessarycondition<strong>for</strong>thevalidityoflineartime<strong>for</strong>mulas. whichiscomplete<strong>for</strong>verifyingqualitativepropertiesexpressedbylineartime<strong>for</strong>mulas thetruthvaluesttand,atomicpropositions,theusualbooleanconnectives,andthe temporaloperatorsU(\until"),U�1(\since"),X�1(\previousstep")andlabellednext- withpastoperators.Wesupposethat<strong>for</strong>mulasofthelineartimelogicLarebuiltfrom<br />
ofpast<strong>for</strong>mulasofL,i.e.<strong>for</strong>mulaswhicharebuiltfromatomicpropositions,theboolean fromthelabellednext-stepoperatorsbyputtingX'=WX'.Lpastdenotestheset connectivesandtheoperatorsU�1andX�1. stepoperatorsX, 2SsSteps(s).Theusualnext-stepoperatorXcanbederived<br />
Wexaconcurrentprobabilisticsystem(S;Steps)togetherwithasatisfactionrelation way(seee.g.[MaPn92]).Thesatisfactionrelationj= j= istep(;j)=and(;j+1)j='.Theremainingoperatorsareinterpretedintheusual Pathful IN L(whereINisthesetofnon-negativeintegers)with(;j)j=X' Pathful L,asusedearlier,is
8.2.P-FAIRNESSFORCONCURRENTPROBABILISTICSYSTEMS givenbyj='i(;0)j='.Let 203<br />
Then,siscalled'-validiProb(A'(s))=1<strong>for</strong>alladversariesA.Forapast<strong>for</strong>mula andanitepathwithjj=j,wedene '=f2Pathful:j='g:<br />
(orequivalently,i(;j)j= j= i(;j)j= <strong>for</strong>somefulpath <strong>for</strong>allfulpathswith(j)=<br />
part(b)ofLemma8.2.8(page202).WewriteFairinsteadofpFair(Lfair;lfair). nitepaths with j= andPastForm=f : with(j)=).Let 2Lpastg.Let(Lfair;lfair)beasin bethesetof<br />
Denition8.2.9[Completenessofp-fairnessconditions]Let(L;l)beap-fairness be<strong>for</strong>e.(L;l)iscalledcomplete(<strong>for</strong>verifyingqualitativepropertiesexpressedas<strong>for</strong>mulas ofL)ithefollowingholds: condition<strong>for</strong>aconcurrentprobabilisticsystem(S;Steps)andLalineartimelogicas<br />
<strong>for</strong>all<strong>for</strong>mulas'ofLandallstatess2S. Itiseasytoseethatthecompletenessresultof[PnZu93](wherelabellednext-stepop- ifsis'-validthenj='<strong>for</strong>all'2pFair(L;l)<br />
eratorsarenotused)carriesovertoL,i.e.ifsis'-validthenFair(s) (Lfair;lfair)iscomplete. Denition8.2.10[ExpressivenessofL<strong>for</strong>ap-fairnesscondition]Let(L;l)bea '(s).Thus,<br />
p-fairnesscondition<strong>for</strong>aconcurrentprobabilisticsystem(S;Steps)andLalineartime logicasbe<strong>for</strong>e.Liscalledexpressive<strong>for</strong>(L;l)i<strong>for</strong>each`2Lthereexistsa<strong>for</strong>mula' ofLwith'=pFair(L;l;`). Wemayassumethat<strong>for</strong>eachstates2Sthereisanatomicpropositionaswith(;j)j=as<br />
whereenabled(`)= i (j)=s.Then,Lisexpressive<strong>for</strong>(Lfair;lfair)as,<strong>for</strong>`=( ^Xtt,wehavethat '`=23enabled(`)!23( ^Xas) ;;s)and<br />
Thenextlemmashowsthat{insomesense{-fairnessistheonlyp-fairnessnotion whichiscomplete<strong>for</strong>verifyingqualitativelineartimeproperties. j='`i is(Lfair;lfair)-fairwithrespectto`.<br />
Proof: Lemma8.2.11Let(S;Steps),Land(L;l)beasbe<strong>for</strong>e.IfLisexpressive<strong>for</strong>(L;l)then (L;l)iscompleteipFair(L;l)=Fair. Lisexpressive<strong>for</strong>(L;l), (L0;l0)iscomplete Itsucestoshowthatif(L;l),(L0;l0)arep-fairnessconditionssuchthat<br />
thereisa<strong>for</strong>mula'with'=pFair(L;l;`)where'=f2Pathful:j='g.Since thenpFair(L0;l0)(s) pFair(L;l;`)(s)<strong>for</strong>alls2Sand`2L.SinceLisexpressive<strong>for</strong>(L;l)<br />
thecompletenessof(L0;l0).Thus,pFair(L0;l0)(s) <strong>for</strong>alladversariesAweobtain'-validityofs.Hence,pFair(L0;l0)(s) Prob(A'(s))=Prob(pFairA(L;l;`)(s))=1 pFair(L;l)(s).<br />
pFair(L;l;`)(s)by
204 CHAPTER8.FAIRNESSOFPROBABILISTICCHOICE
Chapter9<br />
properties Verifyingquantitativetemporal<br />
Themaingoalofthischapteristopresentthebasicconceptsofthealgorithmicmethods <strong>for</strong>verifyingquantitativepropertiesspeciedinthetemporallogicalframework.1We considerbothfullyprobabilisticandconcurrentprobabilisticsystems.Forthehandling offullyprobabilisticsystems,werecalltechniquesproposedintheliterature(mainlythe methodsofHansson&Jonsson[HaJo94]).2Forthelatter(concurrent)case,wemainly concentrateonmethodsthatinvolvefairness.Theunderlyingfairnessnotionsarethose of[HSP83,Vard85](seeSection3.2.3,page45).3Forthis,werstrecalltheapproachof<br />
<strong>Probabilistic</strong>computationtreelogic:Combiningseveralaspectsofthelogicscon- probabilisticsystemswhenfairnessassumptionsabouttheenvironmentaremade. Bianco&deAlfaro[BidAl95,dAlf97a,dAlf97b]andthenshowhowtohandleconcurrent<br />
sideredin[HaJo89,Hans91,HaJo94,SeLy94,BidAl95,IyNa96,dAlf97a,dAlf97b]weviewedastheprobabilisticcounterparttothelogicCTL[EmHa86]thatcombinescom-<br />
willbedeliveredwithininnextthreestepswithprobabilityatleast23".PCTLcanbe introducealogic,calledPCTL,<strong>for</strong>specifyingquantitativeproperties<strong>for</strong>probabilistic<br />
putationtreelogicCTL[ClEm81]and(propositional)lineartimelogicLTL.AsinCTL, systemssuchas\thesystemterminateswithprobabilityatleast0:75"or\themessage<br />
lineartimepropertiesthatmakestatementsabouttheexecutions(fulpaths)whereasthe PCTLdistinguishesbetweenstateandpath<strong>for</strong>mulaswherethepath<strong>for</strong>mulasstand<strong>for</strong><br />
existsanexecution",alsooftendenotedbytheletterE)combinedwithapath<strong>for</strong>mula'.4 thequantiers8(\<strong>for</strong>allexecutions",alsooftendenotedbytheletterA)and9(\there state<strong>for</strong>mulasexpressbranchingtimepropertiesthatassertsomethingaboutthepossible<br />
Inaprobabilisticscenario,wealsowanttoreasonaboutthe\quantity"oftheexecutions behavioursinthestates.Toreasonaboutthepossiblebehavioursinthestates,CTLuses<br />
aresketchedintheintroduction.SeeSection1.1.3(page16)andSection1.2.3,(page24). 1Thebasicideasbehindtheuseoftemporallogicasspecication<strong>for</strong>malism<strong>for</strong>probabilisticsystems<br />
ingvericationmethods.Therelationtoourapproachisalsodiscussedin[dAlf97a]. inouralgorithm.Second,oursymbolicmodelcheckerofChapter10makeuseofthem. 3Inhisthesis,LucadeAlfaro[dAlf97a]proposesadierentnotionoffairnessandpresentscorrespond- 4TheCTL<strong>for</strong>mula8'assertsthatthelineartimeproperty'holds<strong>for</strong>allexecutionswhile9'states<br />
2Thereasonwhywerecalltheresultsherearetwofolds.First,theunderlyingbasicideasarealsoused<br />
theexistenceofacomputationthatfullls'. 205
206 thatsatisfyacertainlineartime<strong>for</strong>mula'.Forthis,PCTLreplacesthequantiers8 CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
theprobabilitythat'holdsisatleastp. speciesanintervalof\acceptable"probabilities.Forexample,Probp(')assertsthat and9byaprobabilisticoperatorandusesstate<strong>for</strong>mulasofthe<strong>for</strong>mProb./p(')rather than8'or9'.Here,thesubscript./p(where./isacomparisonoperator,e.g. or
9.1.THELOGICPCTL 207<br />
'::= ::=tt X' a 1^2 '1U'2: '1Uk'2 Prob./p(')<br />
Figure9.1:SyntaxofPCTL'1^'2<br />
:'<br />
sentedSections9.2,9.3and9.4wherewebrieysketchhowthemethodsoftheliteratureprobabilisticsystems.Modelcheckingalgorithms<strong>for</strong>PCTL,PCTLandLTLarepre- Organizationofthatchapter:Section9.1explainsthesyntaxofPCTL(andthe<br />
workandshowhowtodealwithsatisfactionrelationswherefairnessisinvolved.Thethe- sublogicsPCTLandLTL)andtheinterpretationsoverfullyprobabilisticandconcurrent<br />
oreticalfoundationsofthemodelcheckingalgorithms<strong>for</strong>PCTLandLTLare<strong>for</strong>mulated intheoremswhoseproofsaregiveninSection9.5.<br />
automatonandtheconnectionbetweenthem.Seee.g.thesurveypapers[Thom90, Thom96,Vard96]<strong>for</strong>the!-automatonapproachand[Emer90,MaPn92,MaPn95]<strong>for</strong> [BaKw98].6Inthischapter,weassumesomefamiliaritywithtemporallogicsand!- TheresultsofthischapteraremainlybasedonthejointworkwithMartaKwiatkowska<br />
temporallogics.<br />
Inthissection,weexplainthesyntaxofPCTL(andthesublogicsPCTLandLTL)and 9.1 ThelogicPCTL<br />
presentseveralsemantics<strong>for</strong>PCTL.Theinterpretationoverfullyprobabilisticsystems isinthestyleof[HaJo94,ASB+95,IyNa96].Fortheinterpretationoverconcurrent aclassAofadversaries.Intuitively,thechosentypeAofadversaries<strong>for</strong>malizesthe assumptionsthataremadeaboutthe\environment"(theinstancethatresolvesthenondeterministicchoices).InthecasewhereA=Adv(thecollectionofalladversaries)we probabilisticsystems,weintroducesatisfactionrelationsj=Athatareparametrizedby<br />
obtainthestandardinterpretationof[BidAl95].<br />
letters'; (denotedbycapitalgreekletters;;:::)andPCTLpath<strong>for</strong>mulas(denotedbygreek SyntaxofPCTL:WexanitesetAPofatomicpropositions.PCTLstate<strong>for</strong>mulas<br />
derivedconstantsandbooleanoperators(<strong>for</strong>bothstateandpath<strong>for</strong>mulas)are Here,a2AP,p2[0;1],./2f;gandkisanaturalnumber.Theusual ;:::)overAParegivenbythegrammarshowninFigure9.1(page207).<br />
booleanconnectivesandthestandardtemporaloperatorsX,UandUk.Themeanings ofthetemporaloperatorsX(\nextstep"),U(\until")andUk(\boundeduntil"or 1_2=:(:1^:2),1!'2=:1_2.Thepath<strong>for</strong>mulasarebuiltfromthe =:tt,<br />
\withinthenextksteps")areasinthenon-probabilisticcase.Asusual,operators<strong>for</strong> bere<strong>for</strong>mulatedresultinginasimpleralgorithm.ThissimplicationispresentedinSection9.3.<br />
6WhenwritingdownthisthesistheauthordetectedthatthePCTLmodelcheckerof[BaKw98]can
208 modelling\eventually"3,\sometimeswithinthenextksteps"3k,\always"2and CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
\alwayswithinthenextksteps"2kcanbederived. Forinstance,iferrorisanatomicpropositionthatcharacterizesallstateswhereasystemerrorhashappenedthenProb
9.1.THELOGICPCTL 209<br />
(;j)j='1^'2i(;j)j='i,i=1;2 (;j)j=:'i(;j)6j=' (;j)j= ij jjandj=<br />
(;j)j=X'ij
210 Example9.1.4[Simplecommunicationprotocol]Forthesimplecommmunication CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
protocolofExample1.2.1(page19)equippedwiththeatomicpropositionsinitandwait andthelabellingfunctionLwitha2L(s)ia=wehave<br />
whichassertsthat,withprobabilityatleast0:9999,ifthesenderisinitsinitialstate (whereitproducesamessage),thenthemessagewillbeeventuallydeliveredwithinthe sinitj=Prob0:9999(34wait)<br />
nextfoursteps.Thiscanbeseenasfollows.Letps(')denotetheprobabilitymeasureof allfulpaths2Pathful(s)where'holds.Then,wehave<br />
=99 psinit(34wait)=psdel(33wait) =99 100+1 100pslost(32wait)<br />
Here,weusethefactthatps(3ka)=1ifa2L(s)and,<strong>for</strong>a=2L(s), =99 100+1 100psdel(31wait) 10099 100=9999<br />
ps(3k+1a)=Xt2SP(s;t)pt(3ka) 10000.<br />
andps(30a)=0.(SeeSection9.3,page217). 9.1.2 IfS=(S;Steps;AP;L)osaconcurrentprobabilisticsystemandA Interpretationoverconcurrentprobabilisticsystems<br />
sj=AProb./p(')iProbn2PathAful(s):j=A'o./p<strong>for</strong>allA2A. Advthenwedene<br />
Notation9.1.5[ThesetSatA()]LetSatA()=fs2S:sj=Ag: ForaconcurrentprobabilisticprocessP,wewritePj=A toSatA().Intheremainderofthatthesis,weshrinkourattentiontothefollowingfour classesofadversaries: itheinitialstateofPbelongs<br />
Advfair(thesetoffairadversariesinthesenseofDenition3.2.17,page46), Advsfair(thesetofstrictlyfairadversariesinthesenseofDenition3.2.17,page46), Adv(thesetofalladversaries)<br />
writej=insteadofj=Adv.Forthesatisfactionrelationsj=Advfair,j=Advsfairandj=AdvWfair,we Thesatisfactionrelationj=Advyieldsthestandardinterpretationala[BidAl95].Webriey AdvWfair(thesetofW-fairadversariesinthesenseofDenition3.2.20,page47).<br />
alsowritej=fair,j=sfairandj=Wfair.Similarly,weoftenwriteSat(),Satfair(),Satsfair() andSatWfair()ratherthanSatAdv(),SatAdvfair(),SatAdvsfair()andSatAdvWfair() respectively.<br />
mightbeessential<strong>for</strong>establishingcertain(quantitativeorqualitative)properties.<br />
dependsonthechosenA.Inparticular,thebelowexampleshowsthat{asinthenonprobabilisticcase{fairnessassumptions(withrespecttothenon-deterministicchoices) Thefollowingexampledemonstratesthatthesatisfactionrelationintheconcurrentcase
9.1.THELOGICPCTL Example9.1.6[Rouletteplayer]WeconsidertherouletteplayerofExample1.2.3on 211<br />
page22(seeFigure1.3onpage22).Weusetheatomicpropositionsplay,happyandwon andthelabellingfunctionLwherea2L(s)ia=.First,weregardthe<strong>for</strong>mula<br />
ForeachadversaryA,Probn2PathAful(sinit):j='o=1:Thus,sinitj=Prob1(') withrespecttothestandardsatisfactionrelationj=wherewerangeoveralladversaries. '=2(play!3won):<br />
playerstartsplayingthenhewilleventuallywinagamewithprobability1.Nextweregard thePCTLstate<strong>for</strong>mula=Prob0:5(<br />
whichensuresthat{independentontheenvironment(adversary){whenevertheroulette<br />
Intuitively, thecasinowhilewinningthelastgame.Thetruthvalueofthe<strong>for</strong>mula statesthat,thereisatleasta50%chance<strong>for</strong>therouletteplayertoleave )where =3happy.<br />
pAsinit( theenvironment(thechosenadversarytypeA).LetpAs( ofn2PathAful(s):j= )=0becauseA<strong>for</strong>cestherouletteplayertostay<strong>for</strong>everinthecasino.Thus, o.ForthesimpleadversaryAwithA(swon)=1splaywehave )betheprobabilitymeasure dependson<br />
whenwedealwiththestandardsatisfactionrelationj=thatdoesnotinvolvefairness. Dealingwithasatisfactionrelationwherefairnessinthestateswonisassumed,the<strong>for</strong>mula sinit6j=<br />
eachotheradversaryB,wehavepBsinit( holdsintheinitialstate.ThisisbecauseAbehaveunfairinthestateswonand,<strong>for</strong> sinitj=fair ;sinitj=sfair )=1=2(cf.Example3.2.13onpage44).Hence,<br />
providedthatWcontainsswon.WhenweuseasetWthatdoesnotcontainswon,then theaboveadversaryAisW-fairwhichyieldssinit6j=Wfair ;sinitj=Wfair<br />
property Remark9.1.7[TheCTLquantiers8and9]Asin[Hans91,SeLy94,BaKw98], cannotbeestablishedunlessappropriatefairnessassumptionsaremade. .Thus,thequantitative<br />
<strong>for</strong>'iswpwhichcorrespondstothemeaningofProbwp(').PCTLstate<strong>for</strong>mulaswith [9']wp.9Then,[8']wpstatesthatunderalladversaries(ofthechosentype)theprobability probabilisticoperatorProb./p(')wemightusestate<strong>for</strong>mulasofthe<strong>for</strong>m[8']wpand <strong>for</strong>theuseofPCTLasspecicationlanguage<strong>for</strong>concurrentsystems,insteadofthe<br />
eitherby[8:']w1�p(whichisequivalenttoProbw1�p(:'))orwiththehelpofexistential quantication.Forinstance,Probp(')correspondsto:[9']>p. anupperbound<strong>for</strong>theprobabilities(i.e.<strong>for</strong>mulasofthe<strong>for</strong>mProbvp('))canbeexpressed<br />
PCTLisacombinationofPCTL(probabilisticcomputationtreelogic)andLTL(propo- 9.1.3 sitionallineartimelogic).InPCTL,arbitrarycombinationsofstate<strong>for</strong>mulasarepossible ThesublogicsPCTLandLTL<br />
non-probabilisticcaseandexecutiontreesintheprobabilisticcase.<br />
8and9rangeoverallpossibleresolutionsofthenon-deterministicchoicesyieldingexecutionsinthe 9Here,weusewtodenoteoneofthecomparisonoperators or>.AsinCTL,thequantiers
212 butonlypath<strong>for</strong>mulasofthe<strong>for</strong>mX,1U2and1Uk2(where,1and2 CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
<strong>for</strong>mulasareallowed. ofPCTLwherearbitrarycombinationsofpath<strong>for</strong>mulasbutonlypropositionalstate arestate<strong>for</strong>mulas)areallowed.LineartimelogicLTListheother\extreme"fragment<br />
<strong>Probabilistic</strong>computationtreelogicPCTL:InPCTL,only\simple"path<strong>for</strong>mulas builtfromthetemporaloperatorsX,UkorUandstate<strong>for</strong>mulasareallowed.Formally, PCTListhosesublogicofPCTLwhosestateandpath<strong>for</strong>mulasarebuiltfromthe productionsystemshowninFigure9.3(page212).Inwhatfollows,webrieyspeak<br />
'::=X ::=tt a1U2 1^2 1Uk2 : Prob./p(')<br />
aboutPCTL<strong>for</strong>mulasratherthanPCTLstate<strong>for</strong>mulas.InPCTL,thetemporaloperators \eventually"or\sometimeswithinthenextksteps"areobtainedasinthecaseofPCTL: Figure9.3:SyntaxofPCTL<br />
Formodellingthetemporaloperators\always"and\alwayswithinthenextksteps"in PCTL,weusethefactthat,<strong>for</strong>anyPCTLpath<strong>for</strong>mula',the<strong>for</strong>mulasProb./p(')and Prob./p(3)=Prob./p(ttU), Prob./p(3k)=Prob./p(ttUk).<br />
Prob./1�p(:')areequivalentwhere and\alwayswithinthenextksteps"canbeobtainedinPCTLby: Prob./p(2)=Prob./1�p(3:),Prob./p(2k)=Prob./1�p(3k:) =,, =and>=
9.1.THELOGICPCTL 213<br />
'::=tt a :' Figure9.4:SyntaxofLTL '1^'2 X' '1U'2 '1Uk'2<br />
Notation9.1.8[QuantitativeLTLspecications]AquantitativeLTLspecication isapairh';IiconsistingofaLTL<strong>for</strong>mula'andanintervalIofthe<strong>for</strong>m[0;p],[0;p[, [p;1]or]p;1]<strong>for</strong>somep2[0;1]. Astatesofafullyprobabilisticprobabilisticsystemisviewedtobecorrectwithrespect toaLTLspecicationh';Iiifthe\truthvalue"ofthat<strong>for</strong>mula'liesintheintervalI ofallfulpathsstartinginsandsatisfying'. Notation9.1.9[ThesetSat(h';Ii)(fullyprobabilisticcase)]LetSat(h';Ii)bethe of\acceptable"probabilities.Here,the\truthvalue"isgivenbytheprobabilitymeasure<br />
ment,theprobability<strong>for</strong>'liesintheintervalI.Asbe<strong>for</strong>e,thepossibleenvironmentsare setofstatess2SwhereProbf2Pathful(s):j='g2I:<br />
<strong>for</strong>malizedbyanadversarytypeA Intheconcurrentcase,aLTLspecicationh';Iiassertsthat,<strong>for</strong>anypossibleenviron-<br />
setofstatess2Ssuchthat,<strong>for</strong>allA2A, Notation9.1.10[ThesetsSatA(h';Ii)(concurrentcase)]LetSatA(h';Ii)bethe Adv.<br />
ForA2fAdv;Advfair;Advsfair;AdvWfairg,weoftenwriteSat(h';Ii),Satfair(h';Ii), Probn2PathAful(s):j=A'o2I:<br />
Satsfair(h';Ii)orSatWfair(h';Ii)ratherthanSatA(h';Ii). VaWo86,CoYa95,PnZu93],dealwithLTL(orsimilarlogics)asa<strong>for</strong>malism<strong>for</strong>speci- Remark9.1.11[QualitativeLTLspecications]Variousauthors,<strong>for</strong>example[Vard85, fyingqualitative(lineartime)propertiesthatassertthatacertainLTL<strong>for</strong>mula'holds <strong>for</strong>almostallfulpaths(resp.almostallfulpathsofanadversaryofthechosentypeA).<br />
Clearly,inthefullyprobabilisticandconcurrentcases,wehavetheequivalenceofthe Suchqualitativepropertiescanbe<strong>for</strong>malizedbyquantitiveLTLspecicationsofthe<strong>for</strong>m<br />
quantitativeLTLspecicationh';I./piandthePCTLstate<strong>for</strong>mulaProb./p(')inthe h';[1;1]i.<br />
9.1.4 sensethatSat(Prob./p('))=Sat(h';Ii)whereI./p=fq2[0;1]:q./pg.<br />
Wementionedbe<strong>for</strong>ethatourlogicPCTLisbasedonexistinglogicsproposedinthe literature.Webrieysketchtheconnectionsanddierences.<br />
Relatedlogics
214 Fullyprobabilisticcase:OurlogicPCTLagreeswiththelogic(alsocalledPCTL) CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
introducedbyHansson&Jonsson[HaJo94];thefulllogicPCTLwiththelogicconsidered byAzizetal[ASB+95](andlaterconsiderede.g.byIyer&Narasimha[IyNa96]).11 Concurrentcase:Dealingwiththestandardinterpretationj=ourlogicPCTL(resp.the<br />
[SeLy94])isthatthelatterdealswithactionlabelswhilewelabelthestateswithatomic logic(alsocalledPCTL)ofHansson[Hans91](andlaterconsideredbySegala&Lynch sublogicPCTL)essentiallyagreeswiththelogicsconsideredin[HaJo89,Hans91,SeLy94,<br />
propositions.12ThelogicpCTLofBianco&deAlfaro[BidAl95]agreeswithourlogic BidAl95,dAlf97a,dAlf97b].ThemaindierencebetweenourlogicPCTLandthe<br />
operatortoexpressboundsontheaveragetimebetweeneventswhichdoesnothavea PCTL.LucadeAlfaro[dAlf97a,dAlf97b]usesanextensionofpCTLthatcontainsan counterpartinPCTL.13<br />
equivalence)isthesameasbisimulationequivalence.TheconnectionbetweenPCTL Asshownin[ASB+95],<strong>for</strong>fullyprobabilisticsystems,PCTLequivalence(andalsoPCTL 9.1.5 PCTLequivalenceandbisimulationequivalence<br />
equivalenceandbisimulationequivalence<strong>for</strong>action-labelledconcurrentsystemsisdisnothold.14Toseewhy(intheconcurrentcase)PCTLequivalence(orevenPCTLequiv-<br />
caseandclaimthat,<strong>for</strong>concurrentprobabilisticsystems,bisimulationequivalenceimplies PCTLequivalence(withrespecttothestandardinterpretationj=)whiletheconversedoes cussedin[SeLy94].Weconjecturethattheseresultscarryovertotheproposition-labelledalence)doesnotimplybisimulationequivalenceconsiderthesystemshowninFigure9.5<br />
(page215).Thestatessands0arePCTLequivalentbutnotbisimulationequivalent.15 Notethatthisstandsincontrasttothenon-probabilisticcasewhereCTLequivalence<br />
9.2 andbisimulationequivalencecoincide[BCG88].<br />
Inthissection,weconsidermodelcheckingalgorithms<strong>for</strong>PCTLandthesublogics PCTLandLTL.Amodelcheckingalgorithm<strong>for</strong>PCTLmeansamethodthattakes Modelcheckingalgorithms<strong>for</strong>PCTL<br />
asitsinputaPCTLstate<strong>for</strong>mula asafullyprobabilisticsystemwithintervalsoftransitionprobabilities). [ASB+95]extendstheinterpretationtothestatesofageneralizedMarkovchain(whichcanbeviewed 11Theonlydierenceisthat[ASB+95,IyNa96]donotusetheboundeduntiloperatorUk.Moreover, overacertainsetAPofatomicpropositions<br />
abilisticoperatorProb./anddealwithstate<strong>for</strong>mulasofthe<strong>for</strong>m[8']wpand[9']wpasexplainedin Remark9.1.7(page211).[Hans91]mainlyconcentratesonthespecicationofsoftdeadlines.Forthese, theunboundeduntiloperatorUisnotneeded.However,unboundeduntilUcouldbeaddedaswell. 12Moreover,therearesomeminordierences.[Hans91,SeLy94]avoidthe(explicit)useoftheprob-<br />
XandtheboundeduntiloperatorUk,whereaspCTLdoesnot(buttheseoperatorscouldeasilybe added).Viceversa,pCTLcontainstheusualCTLquantiers8and9(denotedAandEintheapproach byBianco&deAlfaro)thatrangeoverallpaths:8meaning\<strong>for</strong>allfulpaths"and9\thereisafulpath". 13MoreminordierencesbetweenpCTLandPCTLarethatPCTLcontainsthenextstepoperator<br />
proposition-labelledconcurrentcase(inthestyleof[JoLa91,ASB+95]). 14Forthis,weassumeasuitableadaptionofthedenitionofbisimulationequivalence<strong>for</strong>the 15Here,weassumealabellingfunctionLwithL(s)=L(s0).
9.2.MODELCHECKINGALGORITHMSFORPCTL 215<br />
u1u s<br />
v1 u2u v2 u3u fag 12 AAAU; 12 fag 13 ?HHHHHHHj AAAU AAAU ; 23 fag 14 v3 ; 34 u01 u s0<br />
v01 u03 u<br />
fag 12 AAAU ���� ; 12<br />
@@@RAAAU<br />
fag 14 v03 ; 34<br />
andanite(fullyorconcurrent)probabilisticsystemSwithpropositionlabelsinAP Figure9.5:sands0arePCTLequivalentbuts6s0<br />
andcomputesthesetSat()ofstatessinSwhere LTL)modelcheckingmeansaproceduretocomputeSat()(orSat(h';Ii))<strong>for</strong>agiven Clearly,anyPCTLmodelcheckingalgorithmsubsumesPCTLandLTLmodelchecking niteprobabilisticsystemandPCTL<strong>for</strong>mula(orquantitativeLTLspecicationh';Ii). holds.16Similarly,PCTL(or<br />
algorithmsandyieldsanautomaticproceduretoverifyprobabilisticprocessesagainst quantitativetemporallogicalspecications,providedthattheprocesscanbedescribed byanitesystemSwithinitialstatesinitandthatthespecicationcanbeexpressedby andconcurrentprobabilisticsystemswithrespecttothestandardsatisfactionrelationj= aPCTLstate<strong>for</strong>mula.Modelcheckingalgorithms<strong>for</strong>PCTL,LTLandPCTLare presented<strong>for</strong>fullyprobabilisticsystemsin[CoYa88,HaJo94,ASB+95,CoYa95,IyNa96] in[BidAl95,dAlf97a,dAlf97b].Thesemethodsarebasedonthefollowingcommonideas. (1)ThePCTLmodelcheckingalgorithmisbasedonarecursiveprocedurethatsuccessivelycomputesthesetsSat()<strong>for</strong>allstatesub<strong>for</strong>mulas <strong>for</strong>mula.Forthehandlingofsub<strong>for</strong>mulasofthe<strong>for</strong>m path<strong>for</strong>mula'istranslatedintoaLTL<strong>for</strong>mula'0suchthatSat()canbederived fromSat(h'0;I./pi)wherethelatteriscomputedwithamodelcheckingalgorithm =Prob./p('),thePCTL ofthegivenPCTL<br />
(2)Themethod<strong>for</strong>LTLusesthePCTLmodelchecker<strong>for</strong>thehandlingoftheuntil <strong>for</strong>LTL. operator.Forthis,theunderlyingLTL<strong>for</strong>mula'1U'2isreplacedbyaPCTLpath<br />
Thus,PCTLmodelcheckingcanbereducedtoLTLmodelchecking;LTLmodelchecking <strong>for</strong>mulaofthe<strong>for</strong>maUb<strong>for</strong>atomicpropositionsaandb,thesystemSbyamore<br />
toPCTLmodelchecking.Itisworthnotingthatthesereductionscanbeseenasthe complexsystemS0.<br />
&Hamaguchi[CGH94](whereitisshownthatLTLmodelcheckingcanbereducedto probabilisticcounterpartstotheresults(<strong>for</strong>non-probabilisticsystems)byEmerson&Lei<br />
CTLmodelcheckingwithfairnessassumptions). [EmLei85](whereitisshownthatanymodelcheckingalgorithm<strong>for</strong>LTLcanbemodied <strong>for</strong>aCTLmodelcheckingalgorithmwiththesamecomplexity)andClarke,Grumberg<br />
Wenowexplainhowagivenmodelcheckingalgorithm<strong>for</strong>LTLcanbeappliedtoobtain aPCTLmodelcheckingalgorithm.ThismethodgoesbacktoBianco&deAlfaro<br />
axedclassAofadversariesanddealwithSat()=SatA().<br />
[BidAl95]whereconcurrentsystemsandthesatisfactionrelationj=areconsidered.Itis 16Asbe<strong>for</strong>e,Sat()denotesSat()<strong>for</strong>fullyprobabilisticsystems.Intheconcurrentcase,weassume
216 alsoapplicable<strong>for</strong>fullyprobabilisticsystemsorconcurrentsystemswithothersatisfaction CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
Modelchecking<strong>for</strong>PCTL:TheinputisaPCTLstate<strong>for</strong>mula relations,e.g.j=fair,j=sfairorj=Wfair.Similarideasareusedin[ASB+95,IyNa96]that considerPCTLwiththeinterpretationoverfullyprobabilisticsystems.<br />
algorithmisbasedonarecursiveprocedurethatsuccessivelycomputesthesetsSat() <strong>for</strong>allstatesub<strong>for</strong>mulas niteprobabilisticsystemwithstatespaceSandlabellingfunctionL:S!2AP.The of.Thecaseswhere istt,anatomicpropositionorofthe overAPanda<br />
<strong>for</strong>m:0or1^2areclearsincewehave<br />
Theinterestingcaseiswheretheoutermostoperatorof Sat(tt)=S, Sat(a)=fs2S:a2L(s)g, Sat(:0)=SnSat(0),<br />
Prob./p.Forthis,weapplyamodelcheckingalgorithm<strong>for</strong>LTL.Let Sat(1^2)=Sat(1)\Sat(2). istheprobabilisticoperator<br />
sub<strong>for</strong>mulas1;:::;kby\fresh"atomicpropositionsa1;:::;akandextendthelabelling let1;:::;kbethemaximalstatesub<strong>for</strong>mulasof'.Weapplythedescribedmethod recursivelyto1;:::;kandobtainthesetsSat(i),i=:::;k.Then,wereplacethe =Prob./p(')and<br />
LTL<strong>for</strong>mulaoverAP[fa1;:::;akg.Thus,wemayapplythegivenLTLmodelchecking functionLbyinsertingaiintoL(s)is2Sat(i).Thesoobtainedpath<strong>for</strong>mula'0isa algorithmtotheLTLspecicationh'0;I./piandobtainSat()=Sat(h';I./pi)where I./p=fq2[0;1]:q./pg.<br />
caseandtheconcurrentcasewiththestandardinterpretationj=areconsidered)and modelchecker.Webrieyrecalltheresultsoftheliterature(wherethefullyprobabilistic LTL(Section9.4).Asdescribedabove,themethod<strong>for</strong>LTLcanbemodied<strong>for</strong>aPCTL Inthenexttwosection,weconsidermodelcheckingalgorithms<strong>for</strong>PCTL(Section9.3)and<br />
Wewillseethattheresultof[dAlf97b]statingthatPCTLmodelcheckingwithrespect non-deterministicchoices.Moreprecisely,wedealwiththesatisfactionrelationsj=fair, j=sfairandj=Wfairthatrangeoverallfair,strictlyfairandW-fairadversariesrespectively. presentmethodstodealwithaninterpretationthatassumesfairnesswithrespecttothe<br />
inthesizeofthe<strong>for</strong>mulacarriesovertotheabovesatisfactionrelationswherefairnessis involved.Thus(bytheresultsofthefollowingtwosections): toj=canbedoneintimepolynomialinthesizeofthesystemanddoubleexponential<br />
computedintimepolynomialinthesizeofSanddoubleexponentialinthesizeof. Theorem9.2.1Let WasubsetofthestatespaceofS.Then,Satfair(),Satsfair()andSatWfair()canbe aPCTL<strong>for</strong>mula,Saniteconcurrentprobabilisticsystemand<br />
Bytheresultsof[CoYa95],thistimecomplexityisoptimal.Inthefullyprobabilisticcase, theLTLmodelcheckingalgorithmof[CoYa88,CoYa95]yieldsaPCTLmodelchecking thatrunsintimepolynomialinthesizeofthesystemandsingleexponentialinthesize ofthe<strong>for</strong>mula.Analternativealgorithmwiththesametimecomplexity(basedonthe !-automatonapproach)ispresentedin[IyNa96].<br />
systemsandby[BidAl95]<strong>for</strong>concurrentprobabilisticsystemswithrespecttothestan-<br />
Modelcheckingalgorithms<strong>for</strong>PCTLarepresentedby[HaJo94]<strong>for</strong>fullyprobabilistic 9.3 Modelchecking<strong>for</strong>PCTL
dardsatisfactionrelationj=.Bothalgorithmsarebasedonarecursiveprocedurethat 9.3.MODELCHECKINGFORPCTL 217<br />
thehandlingoftheuntiloperator,[HaJo94]useslinearequationsystems,[BidAl95]linear successivelycomputesthesetsSat()<strong>for</strong>allsub<strong>for</strong>mulas cases,thetimecomplexityispolynomialinthesizeofthesystemandlinearinthesize optimizationproblems(cf.Remark3.1.8,page36,andRemark3.2.12,page43).Inboth ofthegiven<strong>for</strong>mula.For<br />
ofthe<strong>for</strong>mula.<br />
caseandSatA()intheconcurrentcase(whereAisthechosentypeofadversaries). j=Wfair.Asbe<strong>for</strong>e,wewriteSat()todenotethesetSat()inthefullyprobabilistic Inthissection,webrieysketchthemethodsof[HaJo94,BidAl95]andpresentmodel checkingalgorithms<strong>for</strong>PCTLwithrespecttothesatisfactionrelationsj=fair,j=sfairand<br />
Themainprocedureisthesame<strong>for</strong>fullyprobabilisticandconcurrentprobabilisticsystems systemSwithstatespaceSandalabellingfunctionL:S!2AP.First,itbuildsthe parsetreeofwhosenodesstand<strong>for</strong>sub<strong>for</strong>mulasof.Therootrepresentsthe<strong>for</strong>mula. andusestheideasofthemodelcheckingalgorithm<strong>for</strong>CTLalaClarke,Emerson&Sistla<br />
Theleavesarelabelledbythebooleanconstantttoranatomicproposition.Theinternal [CES83].ThestartingpointisaPCTL<strong>for</strong>mula overAPandaniteprobabilistic<br />
nodesarelabelledbyoneoftheoperators^,:,Prob./p(X)Prob./p(U)orProb./p(Uk). theargumentofthenegation,resp.nextstepoperator,inthecorrespondingsub<strong>for</strong>mula. Nodeslabelledby^oranuntiloperatorProb./p(U)orProb./p(Uk)haveexactlytwo sons(theirarguments).Ifvisanodethenletvdenotethe<strong>for</strong>mularepresentedbyv. Nodeslabelledby:oranext-stepoperatorProb./p(X)haveexactlyoneson,representing<br />
<strong>for</strong>mulaisttoranatomicproposition)weusethefactthatSat(tt)=SandSat(a)= fs2S:a2L(s)g.Forthecomputationofv<strong>for</strong>aninternalnodev,wemight Inabottom-upmanner,wecalculatethesetsSat(v)ofstateswherethecorresponding<br />
assumethatthesetsSat(w)<strong>for</strong>thesonswofvarealreadycomputed.Thus,wecan sub<strong>for</strong>mulavholds.Forthehandlingoftheleaves(nodeswherethecorresponding<br />
treattheproperstatesub<strong>for</strong>mulasofvasatomicpropositions.Thecaseswherethe outermostoperatorofvisoneofthebooleanconnectives:or^isclearaswehave:<br />
Fullyprobabilisticcase:WebrieyrecalltheresultsofHansson&Jonsson[HaJo94] casewherevisofthe<strong>for</strong>mProb./p('). Sat(:)=SnSat()andSat(1^2)=Sat(1)\Sat(2).Nowweconsiderthe<br />
<strong>for</strong>thefullyprobabilisticcase.Asbe<strong>for</strong>e,letP:S probabilitymatrixinS(i.e.S=(S;P;AP;L)).Wecompute ps(')=Probf2Pathful(s):j='g S![0;1]denotethetransition<br />
canbecomputedasfollows.Thehandlingwiththenextstepoperatorisbasedonthe observationthat <strong>for</strong>allstates2SandthenputSat(v)=fs2S:ps(')./pg.Theprobabilitiesps(')<br />
Forthecomputationofps(1Uk2),[HaJo94]proposestwomethods.<strong>On</strong>eusesiterative ps(X)=P(s;Sat())= t2Sat()P(s;t): X<br />
matrixmultiplication;theotherisbasedonthefactthat ps(1Uk2)=1ifs2Sat(2), ps(1Uk2)=0ifs2Sn(Sat(1)[Sat(2)),
218ps(1U02)=0ifs2Sat(1)nSat(2) CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
and,<strong>for</strong>s2Sat(1)nSat(2)andk ps(1Uk2)=Xt2SP(s;t)pt(1Uk�12): 1,<br />
Fortheuntiloperator,theprobabilitiesps(1U2)canbeobtainedbysolvingaregular<br />
operatoronthefunctionspaceS![0;1]).17SeeRemark3.1.8(page36). ps(1U2)=0g).Alternatively,onecanuseaniterativemethodthatcomputesan approximationofthefunctions7!ps(1U2)(viewedastheleastxedpointofan linearequationsystem(preceededbyagraphanalysiswhichyieldsthesetfs2S:<br />
Concurrentcase:Intheremainderofthatsection,wedealwiththeconcurrentcase andshowhowtocomputethesetSatA(Prob./p('))whereAisoneoftheadversarytypes<br />
tobenite,i.e.thestatespaceSisniteand,<strong>for</strong>anystates,thesetSteps(s)isnite. Asbe<strong>for</strong>e,letS=(S;Steps;AP;L)betheunderlyingsystem.RecallthatweassumeS Adv,Advfair,AdvsfairorAdvWfair.Themethod<strong>for</strong>A=Advisthoseof[BidAl95].<br />
meansofthesetsSatA()orSatA(i),i=1;2.SinceweassumethatthesetsSatA(), SatA(i),i=1;2,arealreadycomputedthesecriteriasyieldamethod<strong>for</strong>computing cases'=X,'=1U2and'=1Uk2andpresentcriterias<strong>for</strong>sj=AProb./p(')by Forthesatisfactionrelationj=Wfair,wedealwithaxedsubsetWofS.Weconsiderthe<br />
SatA(Prob./p(')). Notation9.3.1[Thecomparisonoperatorswandv]Wewritewtodenoteoneof thecomparisonoperators Clearly,<strong>for</strong><strong>for</strong>mulasofthe<strong>for</strong>mProbwp(')weneedthe\minimal"probabilities<strong>for</strong>' underalladversariesA2A,whiletheconstraintvprequirestolook<strong>for</strong>the\maximal" or>.Similarly,vstands<strong>for</strong> or
Proof: 9.3.MODELCHECKINGFORPCTL easyverication. 219<br />
9.3.2 E.g.SatA(Probwp(X))isthesetofstatess2Swheremin2Steps(s) Boundeduntil [SatA()]./p.<br />
recursivelycalculatingtheprobabilities Thebelowcharacterizationinducesthecomputationofe.g.SatA(Probwp(1Uk2))by<br />
wherepAs(1Ul2)istheprobabilitymeasureofallfulpaths A2AdvpAs(1Ul2);l=0;:::;k; min<br />
onpage217. 1Ul2.Thismethodisjustanadaptionofthemethodproposedby[HaJo94]sketched 2PathAful(s)with j=A<br />
Lemma9.3.3Foralls2S:<br />
Here,thevaluesqmax sj=AProbwp(1Uk2)i sj=AProbvp(1Uk2)i qmin qmax s;kwp;<br />
Ifsj=A:1^:2thenqmax s;landqmin s;l,s2S,l=0;1;:::;k,aredenedasfollows. s;l=qmin s;l=0<strong>for</strong>alll 0. s;kvp:<br />
Ifsj=A1thenqmax Ifsj=A2thenqmax<br />
qmax s;l+1= s;0=qmin s;l=qmin<br />
maxs;0=0and<br />
s;l=1<strong>for</strong>alll 0.<br />
Proof: ForA2A,letqAs;l=Probn2PathAful(s):j=A1Ul2o.Byinductionon 2Steps(s)Xt2S(t)qmax t;l;qmin s;l+1= 2Steps(s)Xt2S(t)qmin min t;l:<br />
l,wegetqmax Prob13(aU3b):UsingthenotationsofLemma9.3.3(page219),wehaveqmax Example9.3.4WeconsiderthesystemofFigure9.6(page219)andthePCTL<strong>for</strong>mula s;l =maxA2AqAs;landqmin s;l=minA2AqAs;lwhichyieldstheclaim.<br />
fag vw<br />
v;3=qmax z;3=1,<br />
z s ;<br />
tfag u;<br />
fbg<br />
fbg m mm m t m t m<br />
t 12 1434 12 ����<br />
�12���@@@@R12 ' &- @I @@@@R @ -<br />
@@<br />
-<br />
qmax w;3=qmax u;3=0andtherecursive<strong>for</strong>mulas<br />
Figure9.6:t6j=AProb13(aU3b)andsj=AProb13(aU3b)
220 CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
qmax<br />
s;i+1=maxn12qmax<br />
t;i;14o, qmax<br />
t;i+1=12+12qmax<br />
s;i<br />
whereqmax<br />
s;0=qmax<br />
t;0=0.Weobtainqmax<br />
s;1=1=4,qmax<br />
t;1=1=2,qmax<br />
s;2=1=4,qmax<br />
t;2=5=8,<br />
qmax<br />
s;3=5<br />
16and qmax<br />
t;3=21<br />
32.<br />
Hence,t6j=AProb13(aU3b)andsj=AProb13(aU3b).<br />
9.3.3 Unboundeduntil<br />
Thissectionisconcernedwiththeunboundeduntiloperator,i.e.<strong>for</strong>mulasofthe<strong>for</strong>m<br />
Prob./p(1U2)andthesatisfactionrelationsj=,j=fair,j=sfairandj=Wfair.<br />
Simpliednotations:Fortherestofthissection,wextwoPCTL<strong>for</strong>mulas1,2over<br />
AP.Wesupposethatthesetsofstatess2Swithsj=Aiarealreadycomputed.We<br />
maysupposethat1,2areatomicpropositionswithi2L(si)ifandonlyifsj=Ai,<br />
i=1;2.Thissimplifyingassumptionallowsustousethesamenotation<strong>for</strong>allfour<br />
interpretations(sincesj=Aaisj=a<strong>for</strong>allatomicpropositionsa),andismade<strong>for</strong>this<br />
reasonalone.WesimplywriteSat(i)ratherthanSatA(i),i=1;2.<br />
Notation9.3.5[Theprobabilitiesps(1U2)]ForA2Advands2S,let<br />
pAs(1U2)=Probn2PathAful(s):j= 1U2o,<br />
pmax<br />
s(1U2)=supnpAs(1U2):A2Advo,<br />
pmin<br />
s(1U2)=infnpAs(1U2):A2Advo.<br />
Bytheresultsof[CoYa90,BidAl95](moreprecisely,byCorollary20(part1)of[BidAl95],<br />
whichusestheresultsof[CoYa90]):<br />
pmax<br />
s(1U2)=maxnpAs(1U2):A2Advsimpleo,<br />
pmin<br />
s(1U2)=minnpAs(1U2):A2Advsimpleo.<br />
ObservethatAdvsimpleisnite(thus,minA2AdvsimpleandmaxA2Advsimpleexist).Inpartic-<br />
ular,thisyieldsthatpmax<br />
s(1U2)=maxnpAs(1U2):A2Advoandpmin<br />
s(1U2)=<br />
minnpAs(1U2):A2Advo;thus,alsomaxA2AdvandminA2Advexist.Immediatelyby<br />
thedenitionofpmin<br />
s()andpmax<br />
s()weget:<br />
(i)sj=Probvp(1U2)ipmax<br />
s(1U2)vp.<br />
(ii)sj=Probwp(1U2)ipmin<br />
s(1U2)wp.<br />
ThisfactisusedinthePCTLmodelcheckerof[BidAl95].Havingobtainedthesets<br />
SatAdv(i),i=1;2,onecomputesthevaluespmax<br />
s(1U2)andpmin<br />
s(1U2)whichyield<br />
SatAdv(Probvp(1U2))=fs2S:pmax<br />
s(1U2)vpg;<br />
SatAdv(Probwp(1U2))=ns2S:pmin<br />
s(1U2)wpo:<br />
[BidAl95]proposetocomputethevaluespmax<br />
s(1U2)andpmin<br />
s(1U2)bysolvingcer-<br />
tainlinearoptimizationproblems.Alternatively,onecanusethecharacterizationofthe
functionss7!pmax 9.3.MODELCHECKINGFORPCTL s(1U2)ands7!pmin s(1U2)asleastxedpointsofcertainopera- 221<br />
torsonfunctionspaceS![0;1]andcompute(approximations<strong>for</strong>)themwithiterative Wenowturntothequestionhowtodealwiththesatisfactionrelationthatinvolvefairness methods.19SeeRemark3.2.12(page43). (namely,thesatisfactionrelationsj=fair,j=sfairandj=Wfair).Forthis,wepresentaseries oftechnicalresultsthatcharacterizesthestateswhereProb./p(1U2)holdswithrespect<br />
in<strong>for</strong>malexplanations. tooneoftheabovesatisfactionrelations.Forreaders'conveniencewestatethemain Instead,weincludejustication<strong>for</strong>thetechnicalresultsinthe<strong>for</strong>mofexamplesand theoremsinthissectionwithoutproof(thoseareincludedinSection9.5,page241).<br />
First,weobservethattheresultsbyEmerson&Lei[EmLei85]statingthatCTLmodel checkingunderfairnessassumptionscanbereducedtoCTLmodelcheckingcannot beadapted<strong>for</strong>theprobabilisticcase(<strong>for</strong>thelogicsPCTLandPCTL).Inthenonprobabilisticcase(i.e.whenusingCTL),fairnessoffulpathscanbeexpressedbypath <strong>for</strong>mulasofCTL.Typically,thisisachievedbymeansof<strong>for</strong>mulasofthe<strong>for</strong>m<br />
whereafulpath issaidtobefairif 'fair=_i^j(32'i;j_23 j='fair.Themodelchecking<strong>for</strong>CTLunder i;j)<br />
equivalenceofthe<strong>for</strong>m fairnessassumptions(i.e.withrespecttothesatisfactionrelationj=fairwheretheCTL pathquantiers8and9rangeoverallfairfulpaths)canbereducedtothemodelchecking problem<strong>for</strong>CTLwithrespecttothestandardsatisfactionrelationj=sinceonehasan<br />
Un<strong>for</strong>tunately,thisequivalencedoesnotholdintheprobabilisticcase.Theproblemisthat <strong>for</strong>mulasofthe<strong>for</strong>mProb./p('fair!')interpretedoverj=statethat,inalladversaries sj=fair8'i sj=8('fair!').<br />
(whetherfairorunfair),themeasureofallfairfulpathsthatsatisfy'is./p,i.e.<br />
whereastheinterpretationwithrespecttoj=fairquantiesoverthefairadversaries;thus, Prob./p(')interpretedoverj=fairassertsthat Probn2PathAful(s):isfairandj='o./p<strong>for</strong>allA2Adv<br />
Hence,themodelcheckingalgorithms<strong>for</strong>PCTLcannotbeusedtohandlefairness(at leastnotinastraight<strong>for</strong>wardmanner). Probn2PathFful(s):j='o./p<strong>for</strong>allF2Advfair:<br />
ontheprobabilitiesunderthesimpleadversaries.Nowwewillseethatitem(i)carriesover tothesatisfactionrelationsj=fairandj=Wfair(Theorem9.3.6,page222,andTheorem9.3.7, Recalltheabovementionedresultof[CoYa90,BidAl95]((i)and(ii)onpage220)which assertsthatsatisfactionwithrespecttoj=(thatrangesoveralladversaries)onlydepends<br />
systemswemakeuseoftheiterativemethod.<br />
page222),while(ii)doesnot(cf.Example9.3.20,page226).Inparticular,themaximal 19InChapter10wherewedescribeaMTBDD-basedPCTLmodelcheckingalgorithm<strong>for</strong>stratied
222 probabilitiesunderallfairadversariesaregivenbythemaximalprobabilitiesunderall CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
simpleadversaries.Eventhough(ii)doesnothold<strong>for</strong>j=fairorj=Wfairwewillseethatalso theminimalprobabilitiesunderallfairadversariescanbederivedbyaninvestigationof thesimpleadversaries.Moreprecisely,theminimalprobability<strong>for</strong>aPCTLpath<strong>for</strong>mula<br />
simpleadversaries.Inouropinion,thisisasurprisingresultsincethesimpleadversaries anotherPCTLpath<strong>for</strong>mulaa1Ua2underallsimpleadversaries.Thus,boththeminimal andmaximalprobabilitiesunderallfairadversariescanbeexpressedbymeansofthe 1U2underallfairadversariescanbedescribedintermsofthemaximalprobability<strong>for</strong><br />
are\extremelyunfair".<br />
abilitiesunderallfair(strictlyfairorW-fair)adversaries.First,wedealwiththesatWeconsider<strong>for</strong>mulasofthe<strong>for</strong>mProbvp(1U2)<strong>for</strong>whichweneedthe\maximal"prob- Formulasofthe<strong>for</strong>mProbvp(1U2)<br />
last()j=2(cf.Lemma9.5.15,page243).Thus,ifwetakeAtobeasimpleadversary Viceversa,<strong>for</strong>eachsimpleadversaryA,thereisafairadversaryFAwherePathFAncontainsallnitepathsisfactionrelationj=fair.Clearly,pmax 2PathAnsuchthat(i)j=1^:2,i=0;1;:::;jj�1,and s(1U2) pFs(1U2)<strong>for</strong>allfairadversariesF.<br />
wherepAs(1U2)=pmax wegetpFA s(1U2) s(1U2)(whichexistsbytheresultsof[CoYa90,BidAl95])then<br />
andweobtainthefollowingtheorem. (*)pmax s(1U2)=maxnpFs(1U2):F2Advfairo pAs(1U2)=pmax s(1U2).Thisyields<br />
Proof: Theorem9.3.6Foralls2S:<br />
AseachfairadversaryAisW-fair,(*)yields seeSection9.5.2,Theorem9.5.19(page245). sj=fairProbvp(1U2)i pmax s(1U2)vp.<br />
Thus,Theorem9.3.6carriesovertothesatisfactionrelationj=Wfair: Theorem9.3.7Foralls2S: pmax s(1U2)=maxnpFs(1U2):F2AdvWfairo:<br />
Proof: Itturnsoutthatthesatisfactionrelationj=sfairdiersfromj=fairandj=inthatonlya seeSection9.5.2,Theorem9.5.19(page245). sj=WfairProbvp(1U2)i pmax s(1U2)vp.<br />
Theorem9.3.8Foralls2S: strongerstatement<strong>for</strong><strong>for</strong>mulasofthe<strong>for</strong>mProbp(1U2)canbeshown.<br />
Proof: Thefollowingexampleshowsthattheinequality\ seeSection9.5.2,Theorem9.5.21(page245). sj=sfairProbp(1U2)i pmax s(1U2) p"inTheorem9.3.8cannotbe p.<br />
replacedby\
9.3.MODELCHECKINGFORPCTL 223<br />
s v<br />
tm um<br />
m mt '-fag<br />
;<br />
fag � 12���@@@@R ? -<br />
12 Figure9.7:sj=sfairProb
224 of2Steps(s)suchthatpmax<br />
CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
WedeneasetTmax(1;2)<strong>for</strong>whichweshow(inSection9.5.2,page246)that s(1U2)=Xt2S(t)pmax t(1U2):<br />
Advsfair. Notation9.3.14[ThesetTmax(1;2)]Wedene itcontainsexactlythosestatesssuchthatpmax s(1U2)=pFs(1U2)<strong>for</strong>someF2<br />
whereTmax 0(1;2)=Sat(2)[(SnS+(1;2))and Tmax(1;2)=[i0Tmax i (1;2)<br />
Here, Tmax Tmax<br />
j;1(1;2)consistsofallstatest2SnSi
9.3.MODELCHECKINGFORPCTL 225<br />
s1<br />
s2 s4<br />
s3<br />
s6 t6<br />
u6 u06<br />
fag u1 u3<br />
s5 t5<br />
fag fag u5<br />
fag<br />
fag 18 7 fbg<br />
; ;;<br />
; fbg<br />
fag ;<br />
19 12 ����<br />
@@@@ �������� -<br />
@@@@R 1323 1434 25<br />
13 23 12<br />
����35 12<br />
-<br />
t<br />
t -t<br />
? t - t ' ? 1@@@@R<br />
-<br />
12<br />
2<br />
���� @@@@R ���� @@@@R<br />
@I@@@@@@@R ����<br />
% @@@@R t����<br />
Tmax 3;1=fs1gFigure9.8:s6j=sfairProb
226 andlast()=s1,wehavepFt(aUb)=pmax CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
F2Advsfair.Theseobservationsleadtothefollowingtheorem. nofairfulpathwheres3occursinnitelyoften.Thus,pFs3(aUb)=1=3=pmax t(aUb)<strong>for</strong>allt2Tmax(a;b).Notethatthereis<br />
Theorem9.3.16Foralls2S: s3(aUb)<strong>for</strong>all<br />
sj=sfairProb
Then,pAs(aUb)=0<strong>for</strong>thesimpleadversaryAwithA(s)=1s,whereaspFs(aUb)=1<strong>for</strong> 9.3.MODELCHECKINGFORPCTL 227<br />
eachfairadversaryF.Hence,sj=fairProb1(aUb)butpmin beestablishedunlessfairnessisrequired.The\problem"withthesimpleadversaryA TheabovesimpleexampledemonstratesthattheprogresspropertyProb1(aUb)cannot s(aUb)=0.<br />
innitelyoften(seeLemma9.5.10onpage242andLemma9.5.12onpage243).This 1,allstatesthatarereachablefromastatethatisvisitedinnitelyoftenarealsovisited fromwhicha\successful"state(t)canbereached.Infairadversaries,withprobability whereA(s)=1sisthatit<strong>for</strong>cesthesystemtostay<strong>for</strong>everina\non-successful"state(s)<br />
explainswhypAs(aUb)cannotbe\approximated"byfairadversaries.Moreover,wewill<br />
respecttotheadversaryF)<strong>for</strong>storeachastateinSnS+(1;2)viaanitepaththat thatisnotcontainedinS+(1;2)is1.Thus,1�pFs(1U2)istheprobability(with ofthefulpaths2PathFful(s)whereeither1U2holdsorthateventuallyreachastate see(inCorollary9.5.23,page246)that,<strong>for</strong>eachfairadversaryFandstates,themeasure<br />
onlypassesstatesinS+(1;2)nSat(2).<br />
9.3.5,page231)wemayextendAPby\fresh"atomicpropositionsthatcharacterize HavingcomputedthesetsS+(1;2)andS?(1;2)(whichwillbeexplainedinSection Notation9.3.21[ThesetS?(1;2)]LetS?(1;2)=S+(1;2)nSat(2):<br />
thesetsS+(1;2)andS?(1;2). Notation9.3.22[Theatomicpropositionsa+anda?]Inthesequel,wesupposea+,<br />
respecttoj=fairitsucestocomputethevaluespmax Thefollowingtheoremstatesthattohandle<strong>for</strong>mulasofthetypeProbwp(1U2)with a?2APwitha+2L(s)is2S+(1;2)anda?2L(s)ia?2S?(1;2).<br />
Theorem9.3.23Foralls2S: sj=fairProbwp(1U2)i 1�pmax s(a?U:a+).<br />
Proof: IfReach1^:2(s) seeSection9.5.2,Theorem9.5.25(page246). S+(1;2)ands2Sat(1)thenpmax s(a?U:a+)wp.<br />
any(fair)adversaryFwith2PathFn(s),wehavepFs(1U2) Prob1(1U2).Viceversa,ifReach1^:2(s)6 2Pathn(s)with(i)j=1^:2,i=0;1;:::;jj�1,andlast()=2S+(1;2).For S+(1;2)thenthereisanitepath s(a?U:a+)=0.Hence,sj=fair<br />
s6j=fairProb1(1U2).Thisleadstothefollowingcorollary. Corollary9.3.24Foralls2S: 1�P()
228 CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
s v<br />
tm um<br />
m mt '-fag<br />
fbg<br />
fag � 12���@@@@R ? -<br />
12 Figure9.9:pmax s(a?U:a+)=1butpFs(aUb)>0<strong>for</strong>allF2Advsfair ;<br />
observation<strong>for</strong>fullyprobabilisticsystemsismadeinSection3.1(Lemma3.1.10,page 37). \topology"ofthesystemsuces.Thisresultwasrstestablishedin[HSP83].Asimilar Thus,<strong>for</strong>verifyingqualitativeprogresspropertiesasexplainedabove,ananalysisofthe<br />
Theorem9.3.26Foralls2S: Example9.3.25ForthesystemofExample9.3.20(page226),wehaveReach(s)=fs;tg andSat(b)=ftg.Hence,sj=fairProb1(3b).<br />
Proof: seeSection9.5.2,Theorem9.5.27(page246). sj=sfairProbp(1U2)i 1�pmax s(a?U:a+) p:<br />
AstrongerversionofTheorem9.3.26statingthatsj=sfairProb>p(1U2)i1� pmax ampleagaindemonstratesthedierencebetweenj=sfairandj=fair.) Example9.3.27WeconsiderthesystemshowninFigure9.9(page228).Clearly,uis s(a?U:a+)>pisincorrect,ascanbeseenfromExample9.3.27below.(Thisex-<br />
pAs(a?U:a+)=1.Thisyieldspmax Hence,sj=sfairProb>0(aUb)whilepmax theonlystatethatsatises:a+.Thus,<strong>for</strong>thesimpleadversaryAwithA(s)=wehave<br />
ThenextresultisananalogueofTheorem9.3.16(page226),inwhichweshowhowto s(a?U:a+)=1butpFs(aUb)>0<strong>for</strong>allF2Advsfair.<br />
dealwith<strong>for</strong>mulasProb>p(1U2)withrespecttothesatisfactionrelationj=sfair. s(a?U:a+)=1.<br />
Theorem9.3.28Foralls2S:<br />
Proof: sj=sfairProb>p(1U2)()(1�pmax<br />
seeSection9.5.2,Theorem9.5.36(page250). 1�pmax s(a?U:a+) s(a?U:a+)>p:ifs2Tmax(a?;:a+) p:otherwise.<br />
Example9.3.30InExample9.3.27(page228)wehaveTmax(a?;:a+)=fu;vg.Hence, Corollary9.3.29Ifs=2Tmax(a?;:a+)thensj=sfairProb>0(1U2). sj=sfairProb>0(aUb)sinces=2Tmax(a?;:a+).
Nextweconsider<strong>for</strong>mulasofthe<strong>for</strong>mProbwp(1U2)andthesatisfactionrelationj=Wfair. 9.3.MODELCHECKINGFORPCTL 229<br />
First,weobservethatTheorem9.3.23(page227)doesnotcarryovertoj=Wfairsince<br />
ispossible.Forthis,considerthesimplesystemofFigure9.10andthesimpleadversaryA infnpFt(1U2):F2AdvWfairo
230 Theorem9.3.33Foralls2S: CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
sj=WfairProbwp(1U2)i 1�pmax<br />
Example9.3.34Considerthepath<strong>for</strong>mulaaUbandthesystemofFigure9.11(page Proof: seeSection9.5.2,Theorem9.5.40(page252). s(a?Ua0W)wp.<br />
LetTi;1,Ti;2beasinNotation9.3.31(page229).Then,weget: 230)whereW=fw1;w2g.ThesetS0W(a;b)isobtainedasfollows.WehaveS+(a;b)=S. T0=SnS+(a;b)=;whichyieldsT1;1=; T1;2=fv1g(considerthedistributionv1=1v12Steps(v1))<br />
andTi;1=Ti;2=;<strong>for</strong>alli T2;1=fw1g(considerthedistributionw1=1v12Steps(w1))<br />
Hence, T2;2=fw2;v2g<br />
tj=WfairProb0:2(aUb)whilet6j=WfairProb0:5(aUb). 3.Thus,S0W(a;b)=fv1;v2;w1;w2gandpmax t(a?Ua0W)=45:<br />
<strong>On</strong>theotherhand,t6j=fairProb0:5(aUb)sincepmax<br />
fag t(a?U:a+)=0(asSat(:a+)=;).<br />
t@@@@R<br />
w2<br />
s0<br />
t ' t1323<br />
fbg w1 v2 fag -t1212<br />
15 45fag ? HHHHHHHj<br />
fag<br />
'6 fag v1 -s1fbg<br />
%<br />
*<br />
���<br />
HHHHj<br />
?<br />
� @@@@R %<br />
9.3.4 Theconnectionbetweenj=,j=fair,j=sfairandj=Wfair<br />
Figure9.11:S0W(a;b)=fv1;v2;w1;w2g<strong>for</strong>W=fw1;w2g<br />
Fromtheresultsoftheprevioussectionswegetthatthefoursatisfactionrelationsonly dier<strong>for</strong>PCTL<strong>for</strong>mulaswhoseoutermostoperatoristheuntiloperator(i.e.<strong>for</strong>mulas ofthetypeProb./(1U2)).Thedierencebetweenthestandardsatisfactionrelationj=<br />
cidewhendealingwith<strong>for</strong>mulasofthetypeProbvp(1U2)(providedthat1,2cannotcertainlivenessproperties.However,thesatisfactionrelationsj=,j=fairandj=Wfaircoin- well-knownfactthatappropriatefairnessassumptionsmightbeessential<strong>for</strong>establishing andthesatisfactionrelationswithfairness(seee.g.Example9.1.6,page211)isduetothe<br />
bedistinguishedbyj=,j=fairandj=Wfair).Thus,weget:
Theorem9.3.35Let 9.3.MODELCHECKINGFORPCTL beaPCTL<strong>for</strong>mulathatdoesnotcontainsub<strong>for</strong>mulasofthe 231<br />
<strong>for</strong>mProbwp(1U2)then,<strong>for</strong>allstatess, Proof: Fromtheresultsoftheprevioussection,wegetthatthedierencebetweentheinterpreta- by(i)(page220),Theorem9.3.6(page222),Theorem9.3.7(page222). sj= i sj=fair i sj=Wfair.<br />
in[HSP83]thateachstrictlyfairschedulercanbe\approximated"byfairschedulers. Thepreciseconnectionbetweenj=fairandj=sfairisasfollows. tionsj=fairandj=sfairisonlymarginal.Thisresultisnotsurprisingasitisalreadyshown<br />
<strong>for</strong>mProb
232 Dealingwithj=fair,j=sfairorj=Wfairand<strong>for</strong>mulasofthe<strong>for</strong>mProb./p(1U2)wepro- CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
linearprogramming,themaximalprobabilitiespmax posethefollowingprocedure.Asbe<strong>for</strong>e,weassumethatthesetsSatA(i)arealready known.WerstcomputethesetS+(1;2)fromwhichwederivethesetsSat(:a+)= SnS+(1;2),Sat(a?)=S?(1;2)andS0W(1;2).Usingwell-knownmethodsof computedintimepolynomialinnandm(cf.Remark3.2.12,page43).Here, s(a1Ua2)underalladversariescanbe<br />
(a1;a2)=8>:(1;2) (a?;a0W) (a?;:a+):if./2f;>ganddealingwithj=fairorj=sfair :if./2f;>ganddealingwithj=Wfair. :if./2f;0<strong>for</strong>some ComputationofS+(1;2):LetG+(1;2)bethedirectedgraph(S;E)where(s;t)2<br />
O(nm)<strong>for</strong>thecomputationofS+(1;2).22 canbederivedbyadepth-rstsearchinG+(1;2).Thisyieldsthetimecomplexity stateswhicharereachableinG+(1;2)fromastates2Sat(2).Hence,S+(1;2) 2Steps(t).Then,S+(1;2)isthesetof<br />
ComputationofTmax(a1;a2):Inwhatfollows,wesimplywriteMaxSteps(s)rather thanMaxSteps(s;a1;a2).First,wecomputeMaxSteps(s)<strong>for</strong>alls2Sandthesets<br />
where(s;t)2Ei Wecomputethestronglyconnectedcomponentsinthedirectedgraph(Sn(T0[U);E) T0=Sat(a2)[(SnS+(a1;a2)),U=fv2SnT0:MaxSteps(s)6=Steps(s)g.<br />
anenumerationofthestronglyconnectedcomponentswhichsatises:ifs2Cj,s02Cl with(s;s0)2Ethenl suchthat(w)>0<strong>for</strong>some (t)>0<strong>for</strong>some j.Fori=1;:::;kwecomputethesetSiofstatesw2SnT0 2Steps(s)ands2Ci.LetZbethesetofpairs(v;V) 2MaxSteps(s)=Steps(s).LetC1;:::;Ckbe<br />
z2Z,wedenotetherstcomponentofzbyz:state,thesecondcomponentbyz:next andwedenejzj=jz:nextj.LetS0bethesetofstatess2SnT0withs=z:state<strong>for</strong> somez2Zwithjzj=0.Initially,wedeneT=T0.WesuccessivelymodifyS0,Tand suchthatv2SnT0,;6=V SnT0andV=Supp()nT0<strong>for</strong>some2Steps(v).For<br />
jzjbythefollowingprocedure: Fori=1;2;:::;k+1do: (1)WhileS06=;do: (1.2)S0:=S0nfsg,T:=T[fsg (1.1)choosesomes2S0 (1.3)Forallz2Zdo:<br />
(2)Ifi (1.3.2)Ifjzj=0thenS0:=S0[fz:stateg. (1.3.1)Ifs2z:nextthenjzj:=jzj�1.<br />
Then,Tmax(a1;a2)=T. 22TheconstructionofG+(1;2)needsO(nm)steps.Thetime<strong>for</strong>per<strong>for</strong>mingadepth-rstsearchin kandSi Ci[TthenS0:=S0[CinT.<br />
adirectedgraphGislinearinthenumberofnodesandedges.AsthenumberofedgesinG+(1;2)is boundedbyminfn2;nmgwegetthetimecomplexityO(nm)<strong>for</strong>thecomputationofS+(1;2).
9.3.MODELCHECKINGFORPCTL 233<br />
s1 s2 s4<br />
s3 k-��� k k-s5 k<br />
@@@R Figure9.12: k<br />
componentsofthedirectedgraphshowninFigure9.12(page233)andobtain obtainU=fs6gandT0=Snfs1;:::;s6g.Werstcomputethestronglyconnected dealwitha1=a,a2=b.Then,1,22MaxSteps(s1)andMaxSteps(s6)=f1g.We Example9.3.38WeconsiderthesystemofExample9.3.15(Figure9.8,page225)and<br />
Initially,thesetZconsistsofthepairs C1=fs5g,C2=fs3;s4g,C3=fs2g,C4=fs1g, S1=;,S2=fs3;s4;s5g,S3=fs3;s4g,S4=fs2;s6g.<br />
obtainS0=fs3gands52T0.Then,weremoves3fromS0andobtainS0=;,s32T0. ThisyieldsS0=fs5g.Intherstiterationstep(i=1),werstremoves5fromS0and (s5;;);(s3;fs5g);(s3;fs4g);(s4;fs3;s4g);(s2;fs3;s4g);(s1;fs2g);(s1;fs6g);(s6;fs6g):<br />
step(2)wehaveS2=fs3;s4;s5g Thus,intheseconditerationstep(i=2),step(1)isnotapplicable(sinceS0=;).In<br />
s12T0.Intheiterationstepsi=4;5,onlystep(2)isapplicablethatyieldsS0=;.The S0andobtainS0=fs1g,s22T0.Finally,weremoves1fromS0andgetS0=;and step(i=3)removess4fromS0andyieldsS0=fs2g,s42T0.Then,weremoves2from C2[T0andobtainS0=fs4g.Thethirditeration<br />
algorithmreturnsTmax(a;b)=Snfs6g.<br />
andthateachofthesetsZ,S0;S1;:::;Skisrepresentedasalistconsistingofpointersto z:next<strong>for</strong>z2Ztoberepresentedasbooleanvectors(onebit<strong>for</strong>eachstates2SnT0) Zandthefunctionjj,weneedO(nm)time.23WesupposethesetsT,C1;:::;Ckand ForthecomputationofMaxSteps(),U,thecomponentsC1;:::;Ck,thesetsS1;:::;Sk,<br />
theirelements.Then,thetestin(1)andsteps(1.1),(1.2)canbeper<strong>for</strong>medinconstant<br />
i2f1;2;:::;k+1gandallexecutionsofthewhileloopweneedO(nm)timetoper<strong>for</strong>m time.Step(1.3)canbeper<strong>for</strong>medintimelinearinthesizeofZ.AsjZj timecomplexityO(m)<strong>for</strong>step(1.3).Aseachstates2SnT0canonlybechosenonce instep(1.1)thewhile-loopcanbeper<strong>for</strong>medatmostn-times.Hence,rangingoverall mwegetthe<br />
steps(1.1),(1.2)and(1.3).Rangingoveralli2f1;2;:::;kgweneed<br />
23Notethat<strong>for</strong>thecomputationofMaxSteps(s)wehavetocalculatePt2S(t)pmax =1O(jSij)=O(kjSn(T0[U)j)=O(n2) kXi each2Steps(s).AsGhasatmostminfn2;nmgedgesandasthestronglyconnectedcomponentsofa directedgraphcanalwaysbecomputedintimelinearinthenumberofstatesandedges,thecomputation ofC1;:::;CktakesO(nm)time.<br />
s(a1Ua2)<strong>for</strong>
234 time<strong>for</strong>step(2).WeconcludethatthetimecomplexityofcomputingTmax(a1;a2)by CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
obtainedTmax(a1;a2).Thus,alsothecomputationofS0W(1;2)needsO(nm)time. themethoddescribedaboveisO(nm).(Recallthatweassumem ComputationofS0W(1;2):S0W(1;2)canbecomputedinasimilarwayaswe n.)<br />
thecostfunction<strong>for</strong>thetime<strong>for</strong>computingthevaluespmax a1,a2.Summingupoverallnodesintheparsetreeweobtainthetimecomplexity ComplexityofPCTLmodelchecking:Letp(n;m)beapolynomialthatstands<strong>for</strong><br />
Ojjk nm+p(n;m) s(a1;a2)<strong>for</strong>atomicpropositions<br />
Here,kiseither1(inthecasewhere themaximalvalueksuchthat containsasub<strong>for</strong>mulaofthe<strong>for</strong>mProb./p doesnotcontaintheboundeduntiloperator)or :<br />
I.e.,thetimecomplexityispolynomialinthesizeofthestructureandlinearinthesize ofthe<strong>for</strong>mula.ThespacecomplexityisO(n(jj+m)).Thiscanbeseenasfollows. TherepresentationofthesetassociatedwitheachnodevoftheparsetreerequiresO(n) 1Uk2.<br />
S0W(1;2)needsO(nm)space.(Notethatn thespaceneeded<strong>for</strong>therepresentationofthelabellingfunctionL).Forthecomputation ofpmax space.Forthesystem(S;steps;AP;L)itself,weneedO(nm)space(whereweneglect<br />
Theorem9.3.39LetSaniteconcurrentprobabilisticsystem, s(a1Ua2),weneedO(n2)spacewhilethecomputationofthesetsTmax(a1;a2)or m.)Wesummarize:<br />
typesAdv,Advfair,AdvsfairorAdvWfair. WasubsetofthestatespaceofS.Then,SatA()canbecomputedintimeandspace polynomialinthethesizeofSandlinearinthesizeof whereAisoneoftheadversary aPCTL<strong>for</strong>mulaand<br />
9.4 Intheliterature,severalmethodsareproposedtoverifyaprobabilisticsystemagainst LTL<strong>for</strong>mulasorsimilarspecication<strong>for</strong>malisms.Awiderangeofthesemethodsis Modelchecking<strong>for</strong>LTL<br />
basedonthedeductiveapproachand/ordealwithqualitativepropertiesstatingthata VaWo86,CoYa88,ACD91a]wheremethods<strong>for</strong>fullyprobabilisticsystemsareproposed and[HSP83,Pnue83,Vard85,PnZu86a,PnZu86b,VaWo86,PnZu93,CoYa95]where methods<strong>for</strong>concurrentprobabilisticsystemsarepresented. lineartime<strong>for</strong>mulaholdswithprobability0or1.Seee.g.[LeSh82,HaSh84,Vard85,<br />
Followingthe!-automataapproachproposedbyVardi&Wolper[Vard85,VaWo86]<strong>for</strong> verifyingqualitativelineartimeproperties,algorithmstoestablishquantitativelineartime severalauthors(see[CoYa95,IyNa96]<strong>for</strong>thefullyprobabilisticcaseand[dAlf97b]where concurrentprobabilisticsystemsandthestandardinterpretationj=areconsidered).The properties(andderivedmodelcheckingalgorithms<strong>for</strong>PCTL)havebeendevelopedby<br />
the<strong>for</strong>mula'(i.e.an!-automataoverthealphabet2APthatacceptsexactlythosewords knownmethods[WVS83,SVW85,Safr88,VaWo94],oneconstructsan!-automataA<strong>for</strong> basicideabehindthe!-automatatheoreticapproachcanbesketchedasfollows.The<br />
over2AP<strong>for</strong>whichthe<strong>for</strong>mula'holds).Then,onedenesanewprobabilisticsystem startingpointisaprobabilisticsystemSandaLTL<strong>for</strong>mula'overAP.Usingwell-<br />
S AwhichcanbeviewedastheproductofSandAand,<strong>for</strong>which,thereisanatural
9.4.MODELCHECKINGFORLTL \embedding"s7!sAofthestatessofSintothethestatespaceoftheproductsystem 235<br />
toreachastateinU0.24 Ssuchthatthe\probability"that'holdsinstatesagreeswiththe\probability"<strong>for</strong>sA A.FromtheacceptanceconditionofA,asetU0ofstatesinS Acanbederived<br />
automaton),thetimecomplexityofthe!-automata-basedmethodis(single)exponential inthesizeofthesystemandlinearinthesizeofthesystem,see[CoYa95,IyNa96]. Analternativealgorithm(withthesametimecomplexity)tocomputetheprobabilities Inthefullyprobabilisticcase(whereitispossibletodealwithanon-deterministic!removethetemporaloperatorsfromthegiven<strong>for</strong>mula'(nallyresultinginapropositional<strong>for</strong>mula'0)whereatthesametimethefullyprobabilisticsystemsismodied.As<br />
ps(')=Probf2Pathful(s): Courcoubetis&Yannakakis[CoYa88].Themainideaofthismethodissuccessivelyto j='ginanitefullyprobabilisticsystemisgivenby<br />
Fortheconcurrentcase,theabovementionedrelationbetweentheoriginalsystemS withthesametimecomplexity. describedinSection9.2,bothmethodscanbeused<strong>for</strong>aPCTLmodelcheckingalgorithm<br />
\deterministicinlimit"[VaWo86,CoYa95]).Thetimecomplexityoftheresultingmethod <strong>for</strong>verifyingconcurrentprobabilisticsystemsagainstquantitativeLTLspecications(and andtheproductS thederivedPCTLmodelcheckingalgorithm)withrespecttothestandardsatisfaction Arequiresthatthe!-automatonAisdeterministic(oratleast<br />
relationj=isdoubleexponentialinthesizeofthe<strong>for</strong>mulaandlinearinthesizeofthe system.Bytheresultsof[CoYa95],thismeetsthelowerbound<strong>for</strong>verifyingconcurrent probabilisticsystemsagainstlineartimespecications.<br />
explainthe!-automatonapproachcanbeapplied<strong>for</strong>LTLmodelcheckingwithrespect tothesatisfactionrelationsj=fair,j=sfairandj=Wfair.Themethodwepresenthereis Inthissection,wepresentmethods<strong>for</strong>verifyingconcurrentprobabilisticsystemsagainst quantitativeLTLspecifationswhenfairnessassumptionsaremade.Moreprecisely,we anadaptionoftheonedeveloppedbydeAlfaro[dAlf97b]<strong>for</strong>aPCTLmodelchecking Remark9.4.1[Avoidingterminalstates]Thepresentedmethodassumesanite concurrentprobabilisticsystemwithoutterminalstates.Thisisaharmlessrestriction algorithmwithrespecttothestandardsatisfactionrelationj=.<br />
GivenasystemS=(S;Steps;AP;L)withterminalstates,weinsertaspecialstate0 sinceanysystemcanbetrans<strong>for</strong>medintoan\equivalent"systemwithoutterminalstates. withaself-loopandtransitionsfromanyterminalstateinSto0.25GivenaLTL<strong>for</strong>mula ',wereplaceeachsub<strong>for</strong>mulaX overS0.Hence,wemayassumew.l.o.g.thatthesystemdoesnothaveterminalstates. iseasytoseethattheinterpretationof'overScorrespondstotheinterpretationof'0 sub<strong>for</strong>mula'1U'2by'1U('2^:a0).Let'0betheresultingLTL<strong>for</strong>mulaoverAP0.It byX( ^:a0),'1Uk'2by'1Uk('2^:a0)andeach<br />
theconcurrentcase,\probability"stands<strong>for</strong>theminimalormaximalprobabilityunderacertainkindof adversaries. Verifying!-automatonspecications:AssuggestedbyLucadeAlfaro,weconsider<br />
25Formally,weconsiderthesystemS0=(S0;Steps;AP0;L0)whereS0=S]f0gandAP0=AP]fa0g, 24Here,inthefullyprobabilisticcase,\probability"stands<strong>for</strong>theusualprobabilitymeasure;whilein L0(s)=L(s)ifs2SandL0(0)=fa0g.Ifs2SisnonterminalthenSteps0(s)=Steps(s).Ifs2Sis terminalthenSteps0(s)=f10g.Theself-loopattheauxiliarystate0ismodelledbySteps0(0)=f10g.
236 !-automatonwiththeRabinacceptancecondition.Webrieyrecallthedenition.A CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
deterministicRabinautomatonisatupleA=(Q;q0;Alph;d;AccCond)where q02Qtheinitialstate, Alphanonemptynitealphabet, Qisanitesetofstates,<br />
asetconsistingofsubsetsHj,KjofQ. AccCondthe(Rabin)acceptancecondition,i.e.AccCond=f(Hj;Kj):j=1;:::;rgis d:QAlph!Qthetransitionfunction,<br />
Alph.Eachworda=a0a1:::overAlphiaassociatedwiththerun i=0;1;2;:::.Inwhatfollows,werefertoaninnitesequenceoverAlphasawordover ArunoverAisa\sequence"p0a0!p1a1 !p2a2 !:::suchthatp0=q0andpi+1=d(pi;ai),<br />
sequenceof(automata)states.ThesetAccWords(A)ofacceptedwordsoverAlphisthe wherep0=q0andpi=d(pi�1;ai�1),i=1;2;:::.Letqa=p0p1p2:::betheassociated run(a)=p0a0!p1a1 !p2a2!:::<br />
setofwordsaoverAlphsuchthat,<strong>for</strong>theinducedwordqa=q0q1:::overQ,<br />
follows,wexaconcurrentprobabilisticsystemS=(S;Steps;AP;L)withoutterminal Here,inf(q)denotesthesetofstatesq2Qthatoccurinnitelyofteninq.Inwhat inf(q) Hjandinf(q)\Kj6=;<strong>for</strong>somej2f1;:::;rg.<br />
Alph=2AP.LetAccCond=f(Hj;Kj):j=1;:::;rg. Notation9.4.2[Acceptedfulpaths]If statesandadeterministicRabinautomataA=(Q;q0;2AP;d;AccCond)overthealphabet<br />
word()=L((0))L((1))L((2))::: isafulpathinSthen<br />
denotestheinducedwordoverAlph=2AP.Thesetofacceptedfulpathsisdenedby<br />
ForA2Adv,s2S,weputAccPathA(s)=AccPath\PathAful(s):LetI intervalofthe<strong>for</strong>mI=I./p=fq2[0;1]:q./pg.Asbe<strong>for</strong>e,Adenotesacertaintypeof AccPath=f2Pathful:word()2AccWords(A)g:<br />
adversaries,e.g.A=AdvorA=Advfair.Weaimatamethod<strong>for</strong>computing[0;1]bean<br />
DeAlfaro[dAlf97a,dAlf97b]describesamethod<strong>for</strong>thecaseA=Adv.Wenowpresent amodicationofthismethod<strong>for</strong>thecasesA2fAdvfair;Advsfair;AdvWfairg.Asin SatA(hA;I./pi)=ns2S:Prob(AccPathA(s))./p<strong>for</strong>allA2Ao:<br />
Notation9.4.3[Thedistributionsq]For2Distr(S),q2Q,weput [dAlf97a,dAlf97b],webuilttheproductofSandA,thusobtaininganewpropositionlabelledconcurrentprobabilisticsystemS A.<br />
q(ht;pi)=((t):ifp=d(q;L(t)) 0 :otherwise.
9.4.MODELCHECKINGFORLTL Thestepsintheproductsystemaregivenbythese\lifted"distributionsq2Distr(SQ). 237<br />
Notation9.4.4[TheproductsystemS S A=(SA;StepsA;AP;LA) A]Theproductsystem<br />
isgivenbySA=S Clearly,S systemScanbe\embedded"intotheproductsystembyaddingtoeachstates2S Aisaproposition-labelledconcurrentprobabilisticsystem.Theoriginal Q,LA(hs;qi)=L(s)andStepsA(hs;qi)=fq:2Steps(s)g:<br />
thoseautomatastateqthatisreachedfromtheinitialautomatastateq0bytheL(s)labelledtransition. spaceoftheproductcanbeextendedtoanembeddingofthepaths.Forthis,weliftany Theresultingembeddings7!sAofthestatespaceSoftheoriginalsystemintothestate Notation9.4.5[ThestatesA]Fors2S,letsA=hs;d(q0;L(s))i:<br />
Notation9.4.6[ThepathsA]Let=s01 pathinStoapathAinS S.WedeneAtobethefollowingpathinSA. Aasfollows.<br />
hs0;p0i1!hs1;p1i2 !hs2;p2i3!::: !s12 !:::bea(niteorinnite)pathin<br />
Notation9.4.7[ThesetsA]Let wheresi=(i),p0=d(q0;L(s0)),pi+1=d(pi;L(si+1)andi=pi�1 PathSful.Then,A=fA:2g: i.<br />
PathSA (fair)adversariesofSandS Thefunction andsA.Clearly,2FairSi ful(sA)betweenthenitepathsstartinginsandsAandthefulpathsstartingins 7!AyieldsbijectionsPathSn(s)!PathSA A2FairSA.Thisalsoinducesaconnectionbetweenthe A.AnyadversaryA<strong>for</strong>Sinducesasetofadversariesin n(sA)andPathSful(s)!<br />
Notation9.4.8[TheadversarysetAA]LetA2AdvS.Then,AAdenotesthesetof offsA:s2Sg.26 SA.Theadversariesofthissetonlydierinthosepaths0thatdonotstartinastate<br />
adversariesA02AdvSAsuchthat,<strong>for</strong>anynitepath2PathSn, Clearly,thefunctionA7!AAisinjectiveand,<strong>for</strong>eachA02AdvSA,thereisa(unique) adversaryAwithA02AA.Itiseasytoseethat,<strong>for</strong>anyA2AdvSandA02AA,the ifA()=andlast(A)=hs;qithenA0(A)=q.<br />
functionsPathAn(s)7!PathA0n(sA), arebijections.Moreover,wehaveP()=P(A)<strong>for</strong>anynitepath.Thisyieldsan isomorphismbetweentheinducedprobabilityspacesonPathAful(s)andPathA0 precisely:LetA2AdvS,A02AAand7!A,andPathAful(s)7!PathA0 Pathful.Then, A(s)ismeasurablei ful(sA), ful(sA).More 7!A,<br />
A(sA)ismeasurable;inwhichcase,theprobabilitymeasuresofA(s)andA0 A0<br />
pathsinSAthatdonotstartinastatesAdonothaveacounterpartinS.<br />
thesame.Moreover, 26Ofcourse,wedonothaveaone-to-onecorrespondencebetweentheadversariesofSandSAsince A(sA)are
238Fisa(strictly)fairadversary<strong>for</strong>Sithereisa(strictly)fairadversaryF02FA, CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
Ifwetake Notation9.4.9[ThesetAccPath]LetAccPathbethesetoffulpathsAinSAwhere FisW-fairithereis(W =AccPaththentheseobservationsleadtothefollowinglemma. Q)-fairadversaryF0inFA.<br />
Lemma9.4.10Letp2[0;1]and./2f;>;;
9.4.MODELCHECKINGFORLTL 239<br />
s1 ; -fbg s2 ? -r1212<br />
1fag<br />
s3 s4 ; PPPq1 Figure9.13:ThesystemS PPPPq s5fbg<br />
computingU0,onemightapplygraphtheoreticalmethodstoobtainthesetsU0j.AlternauctSA,computingthesetU0andthenapplyingthePCTLmodelcheckingalgorithmof Section9.3tocomputethesetsSatfair(Prob./p(3aU0))andSatsfair(Prob./p(3aU0)).For Thus,thesetsSatfair(hA;I./pi)andSatsfair(hA;I./pi)canbeobtainedbybuildingtheprodtively,thesetU0jcanbedescribedasgreatestxedpointoftheoperatorFj:2SQ!2SQ,<br />
W-fairness,similarideascanbeapplied.TheonlydierenceisthatthesetU0hastobe andcomputedbytheiterationV0=S Fj(V0)=nv02H0j:ReachSA(v0) Q,V0 V0^ReachSA(v0)\K0j6=;o;<br />
replacedbythefollowingsetU0W.WedeneW0=W i+1=Fj(V0 QandU0=S1jrU0jwhere i),i=0;1;:::.Dealingwith<br />
U0j=[<br />
t02T0nW0,thereissomet02StepsA(t0)wherethefollowingconditionsaresatised: andwhereTjisdenedasfollows.TjconsistsofallsubsetsT0ofH0jsuchthat,<strong>for</strong>each T02TjT0<br />
(3)Eachstatet02T0canreachastatev02K0jinthesystem(T0;Steps0)where (1)Ift02T0\W0and2StepsA(t0),thenSupp() (2)Ift02T0nW0thenSupp(t0) T0. T0.<br />
Westate(withoutproof)that Steps0(t0)=(StepsA(t0):ift02T0\W0, ft0g :ift02T0nW0.<br />
S=(S;Steps;AP;L)withoutterminalstates.Leth';IibeaquantitativeLTLspecica- Modelchecking<strong>for</strong>LTL:Asbe<strong>for</strong>e,wexaniteconcurrentprobabilisticsystem SatWfair(hA;I./pi)=ns2S:sAj=W0fairProb./p3aU0Wo:<br />
tion.Usingwell-knownmethods[WVS83,SVW85,Safr88,VaWo94],wecanconstructa deterministicRabinautomataA'overthealphabetAlph=2APsuchthatAccWords(A') isthesetofinnitewordsover2AP<strong>for</strong>which'holds.27Forthis,weneeddoubleexpo- methodexplainedbe<strong>for</strong>e.ThetimecomplexityispolynomialinthesizeofSanddouble exponentialinthesizeof'.(Thus,themethodisoptimalbytheresultsof[CoYa95]). nentialtimeinthesizeof'.Then,weobtainSatA(h';Ii)=SatA(hA';Ii)withtheisticRabinautomatonA=A3(a^Xb)isshowninFigure9.14(page240)wherewedeal9.13(page239)andthequantitativeLTLspecicationh3(a^Xb);I0:5i.Thedetermin-<br />
Example9.4.12WeapplythemethoddescribedabovetothesystemshowninFigure
240 CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
@R6 q0 ' l fag,fa;bg<br />
;,fbg ; fag q1 $? 6l fbg,fa;bg -q2<br />
6l<br />
withtheacceptanceconditionAccCond=f(Q;fq2g)g.28ThesystemS Figure9.14:RabinautomataA<strong>for</strong>3(a^Xb)<br />
omitted.WegetH0=SQandK0=f(si;q2):i=1;:::;5g.Thus,U0containshs3;q0i, Figure9.15onpage240wherestatesthatarenotreachablefromthestatehs1;q0iare Aisshownin<br />
s1;q0 -s2;q0 ? -s1212 s3;q0 -s5;q1 -s5;q2?<br />
- @@@@R ����<br />
s4;q0 -s5;q0?<br />
hs5;q1iandhs5;q2ibutnoneoftheotherstatesshowninFigure9.15.Clearly, Figure9.15:TheproductsystemS A<br />
<strong>for</strong>eachfairadversaryF0ofS yieldss12Satfair(h3(a^Xb);I0:5i). Probn02PathF0 A.Hence,hs1;q0ij=fairProb0:5(3(a^Xb))which ful(hs1;q0i):0j=3aU0o=12<br />
bilities<strong>for</strong>PCTLpath<strong>for</strong>mulasunderalladversariesagreewiththeminimalormaximal probabilitiesunderallsimpleadversaries(seeitems(i)and(ii)onpage220).Thisresult doesnotlongerholdwhendealingwithgeneralLTL<strong>for</strong>mulasratherthanPCTLpath Remark9.4.13Bytheresultsof[CoYa90,BidAl95],theminimalandmaximalproba-<br />
<strong>for</strong>mulas.WeconsidertheLTL<strong>for</strong>mula'=Xb!2aandthesystemshowninFigure fa;bgtk6 fag sk? -uk;<br />
9.16(page240).Then,pAs(')=Probn2PathAful(s):j='o=1<strong>for</strong>allsimpleadver- Figure9.16:pAs(Xb!2a)=1<strong>for</strong>allA2Advsimple sariesA,whilepFs(')=Probn2PathFful(s):j='o=0<strong>for</strong>thefairadversariesFwith 28This!-automatacanbeviewedasadeterministicBuchiautomatawheretheacceptancesetisfq2g.<br />
27Here,theunderlyingsatisfactionrelationj= 2APINLTLisdenedintheobviousway.
9.5.PROOFS F(s)=1tandF()=1u<strong>for</strong>allpaths withlast()=sandjj 1.Thisexample 241<br />
supnpFs('):F2AdvfairoandsupnpAs('):A2Advocannotbeestablished. alsoshowsthat,unlikeinTheorem9.3.6(page222),aresultstatingthattheequalityof<br />
9.4whichwehaveusedtoderivethemodelcheckingprocedure<strong>for</strong>PCTL. 9.5 ThissectionincludestheproofsofthetheoremsestablishedinSection9.3andSection Proofs<br />
p-fairness(seeChapter8,page193)whichisdenedinthefullyprobabilisticand Inthissectionweintroducestateandtotalfairness.Statefairnessisaninstanceof 9.5.1 Stateandtotalfairness<br />
concurrentcase.Totalfairness<strong>for</strong>concurrentprobabilisticsystemsrequiresbothfairness areintroduced<strong>for</strong>technicalreasonsonly;theyyieldasimpleprooftechnique<strong>for</strong>showing ofadversaries(seeSection3.2.3,page45)andstatefairness.Stateandtotalfairness<br />
graph-theoreticalcriteria<strong>for</strong>establishing\qualitativeprogressproperties". fullyprobabilisticsystemsyieldsasimpleproof<strong>for</strong>Lemma3.1.10(page37)thatgivesa theequalityoftheprobabilitymeasuresofcertainevents.Forinstance,statefairnessin<br />
Denition9.5.1[Statefairness(fullyprobabilisticcase)]LetS=(S;P)beafully probabilisticsystemand P(s;t)>0thenthereareinnitelymanyindicesjwith(j)=sand(j+1)=t. Clearly,statefairnessisaspecialinstanceofp-fairness(cf.Denition8.1.1,page194). 2PathSful. iscalledstatefairi,<strong>for</strong>eachs2inf(),if<br />
(L;l)-fair. Lemma9.5.2LetS=(S;P)beanitefullyprobabilisticsystemand WetakeL=S Sandl(s;t)=f(s;t)g.Then,<strong>for</strong>eachfulpath, isstatefairi astatefair is<br />
fulpathinS.Then,inf()=Reach(s)<strong>for</strong>allstatess2inf(). Proof: bethelengthofashortestpathfromstot.Byinductiononkitiseasytoseethat,if dist(s;t)=kthent2inf(). Lets2inf().Clearly,inf() Reach(s).Fort2Reach(s),letdist(s;t)<br />
Lemma9.5.4Let(S;P)beaboundedfullyprobabilisticsystem.Then,<strong>for</strong>alls2S, ofstatefairfulpathsinS. Notation9.5.3[ThesetStateFair]StateFairS(orshortlyStateFair)denotestheset<br />
Inparticular,whenever Pathfulsuchthat(s)ismeasurablethen Prob(StateFair(s))=1:<br />
Proof: followsimmediatelyfromTheorem8.1.5(page196).<br />
Prob((s))=Prob(StateFair\(s)):
242 Corollary9.5.5(cf.Lemma3.1.10,page37)Let(S;P)beanitefullyprobabilistic CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
system.LetUbeasubsetofSand i=0;1;:::;jj�1,andlast()2U.Let Pathn(s);=2 "ng.Then,wehave: thesetofnitepaths = ".Lets2SandT=flast(): where(i)2SnU,<br />
(t)6=;<strong>for</strong>allstatest2TiProb((s))=1. 2<br />
Proof: statest2T.UsingLemma9.5.2(page241)itiseasytoseethatStateFair(s) The\if"partisclear.Forthe\onlyif"part,weassumethat(t)6=;<strong>for</strong>all<br />
Thedenitionofstatefairnessintheconcurrentcaseisasfollows. Thus,Lemma9.5.4(page241)yieldstheclaim. (s):<br />
Denition9.5.6[Statefairness(concurrentcase)]LetS=(S;Steps)beaconcurrentprobabilisticsystemandafulpathinS. thereareinnitelymanyindicesjwith(j)=s,step(;j)=and(j+1)=t. 2Steps(s)suchthat(i)=s,step(;i)=<strong>for</strong>innitelymanyiandeacht2Supp(), iscalledstatefairi,<strong>for</strong>eachs2Sand<br />
<strong>for</strong>eachfulpath, StateFairS(orshortlyStateFair)denotesthesetofstatefairfulpathsinS. Notethatstatefairnessisaspecialinstanceofp-fairness(cf.Denition8.2.1,page200). LetL=f(s;;t):s2S;2Steps(s);t2Supp()gandl(s;;t)=f(s;;t)g.Then,<br />
Lemma9.5.7LetS=(S;Steps)beaniteconcurrentprobabilisticsystem,Aasimple isstatefairi is(L;l)-fair.Asinthefullyprobabilisticcase,<br />
Proof: probabilisticsystemSAinducedbythesimpleadversaryA. adversary<strong>for</strong>S.Then,<strong>for</strong>each2StateFairA,ReachA(s)=inf()<strong>for</strong>alls2inf().<br />
Lemma9.5.8Let(S;Steps)beaniteconcurrentprobabilisticsystem.Then: followsimmediatelybyLemma9.5.2(page241)appliedtothenitefully<br />
measurablethenProb <strong>for</strong>alladversariesAands2S.Inparticular,whenever ProbStateFairA(s)=1<br />
Proof: followsimmediatelyfromTheorem8.2.3(page200). A(s)=ProbStateFair\A(s): PathfulsuchthatA(s)is<br />
Wedenetotalfairnessasthecombinationofstatefairnessandfairnesswithrespectto thenon-deterministicchoices(inthesenseofDenition3.2.14,page45).<br />
Lemma9.5.10LetS=(S;Steps)beaniteconcurrentprobabilisticsystem.Then,<strong>for</strong> Denition9.5.9[Totalfairness]LetS=(S;Steps)beaconcurrentprobabilisticsys-<br />
eachtotalfairfulpath temand afulpathinS. inS,Reach(s)=inf()<strong>for</strong>alls2inf(). iscalledtotalfairi isfairandstatefair.<br />
Proof: theproofofLemma9.5.2(page241). Notation9.5.11[ThesetTotalFair]TotalFairS(orshortlyTotalFair)denotestheset easyverication.Usesinductiononthe\distance"betweentwostatesasin<br />
oftotalfairfulpaths.
9.5.PROOFS Lemma9.5.12Let(S;Steps)beaniteconcurrentprobabilisticsystem.Then: 243<br />
<strong>for</strong>allfairadversariesFands2S.Inparticular,if measurablethenProb F(s)=ProbTotalFair\F(s): ProbTotalFairF(s)=1 Pathfulsuchthat F(s)is<br />
9.5.2 Proof: CorrectnessofthePCTLmodelcheckingalgorithm followsimmediatelyfromLemma9.5.8(page242).<br />
subsetWofSandtwoPCTL<strong>for</strong>mulas1and2whichwetreatasatomicpropositions (i.e.weassumethat1,22AP).Moreover,weassumeatomicpropositionsa?,a+ Wexaproposition-labelledconcurrentprobabilisticsystemS=(S;Steps;AP;L),a<br />
thefollowinglemmawhichfollowsfromtheresultsof[BidAl95](Corollary20,part1,in anda0WasinNotation9.3.22(page227)andNotation9.3.32(page229).Weoftenuse [BidAl95]),cf.item(i)and(ii)onpage220. Lemma9.5.13(cf.[BidAl95])ThereexistAmax,Amin2Advsimplewith<br />
<strong>for</strong>allstatess2SandalladversariesB.Inparticular, pAmax s (1U2) pBs(1U2) pAmin s (1U2)<br />
Maximalprobabilitiesunderallfairadversaries:WegivetheproofofTheorem 9.3.6(page222)andTheorem9.3.8(page222). pAmax s (1U2)=pmax s(1U2);pAmin s (1U2)=pmin s(1U2):<br />
Lemma9.5.14Let(S;Steps)beaniteconcurrentprobabilisticsystemandS1,S2 LetAbeasimpleadversary<strong>for</strong>Sand (i)2S1nS2,i=0;1;:::;jj�1,andlast()2S2.Then,wehave: PathAnbethesetofallfulpaths suchthat S.<br />
Proof: If2StateFairthenthereareonlynitelymanyindicesisuchthat(i)2 Weassumethatthereisafulpath 2StateFairsuchthat(i)2 #.<br />
ByLemma9.5.7(page242), innitelymanyi.Then,(i)2 #<strong>for</strong>alli.Hence, 2PathAful.Thus, 2StateFairA. #<strong>for</strong><br />
andReachA((i))\S26=;<strong>for</strong>alli.Thiscontradicts(*).Thus,wegettheclaim. Bydenitionof (*)inf()=ReachA(s).<br />
Lemma9.5.15Let(S;Steps)beaniteconcurrentprobabilisticsystemandS1,S2 andsince(i)2 #<strong>for</strong>innitelymany(all)i,wehave(i)2S1nS2<br />
andlast()2S2.Then: Let Pathnbethesetofallfulpaths suchthat(i)2S1nS2,i=0;1;:::;jj�1, S.<br />
ForeachsimpleadversaryA,thereexistsafairadversaryFwithA PathFn.
244 Inparticular,A FandProb<br />
CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
<strong>for</strong>allstatess2S.Moreover,thereisasequence(Fk)k0ofstrictlyfairadversariessuch that A(s)" Prob F(s)"<br />
<strong>for</strong>allstatess2S. Prob A(s)" sup k0Prob Fk(s)"<br />
F�asfollows.Foreachstates2S,wechooseanenumerations0;:::;sms�1ofSteps(s). Proof: If2Pathnisaproperprexofsome2�,i.e.if=(i)<strong>for</strong>some2�andsome LetAbeasimpleadversary.Let�asubsetofA.Wedeneanadversary<br />
s=last(),j=rmodmsandrthenumberofindicesi
9.5.PROOFS 245<br />
s v<br />
tm um<br />
m mt<br />
fag 12 12 fbg ; '-fag � ���@@@@R<br />
? -<br />
showninFigure9.17(page245)andthesimpleadversaryAwithA(s)=.Then,with Figure9.17:<br />
S1=Sat(a)=fs;tg,S2=Sat(b)=fug,wehave:<br />
Then,<strong>for</strong>eachadversaryFwithA A=f2PathAn:last()=u;(i)6=u;i=0;1;:::jj�1g: containstheunfairfulpaths�!ts Lemma9.5.17ForeachA2Advsimplethereexist �!s�!ts PathFn:iflast()=sthenF()=.Hence,F �!:::;i.e.Fcannotbestrictlyfair.<br />
(a)F2AdvfairwithpAs(1U2) (b)asequence(Fk)k1inAdvsfairsuchthat,<strong>for</strong>alls2S, pAs(1U2) pFs(1U2)<strong>for</strong>alls2S<br />
Proof: followsimmediatelybyLemma9.5.15(page243). sup k1pFk s(1U2):<br />
Corollary9.5.18Foralls2S:<br />
Proof: maxnpFs(1U2):F2Advfairo=maxnpFs(1U2):F2AdvWfairo=pmax<br />
(page245)andthefactthatAdvfair followsimmediatelybyLemma9.5.13(page243),part(a)ofLemma9.5.17 AdvWfair. s(1U2):<br />
Proof: Theorem9.5.19(cf.Theorem9.3.6,page222,andTheorem9.3.7,page222) sj=fairProbvp(1U2)i followsimmediatelybyCorollary9.5.18(page245). sj=WfairProbvp(1U2)i pmax s(1U2)vp.<br />
Corollary9.5.20Foralls2S:supnpFs(1U2):F2Advsfairo=pmax Proof: byLemma9.5.13(page243)andpart(b)ofLemma9.5.17(page245). s(1U2):<br />
Theorem9.5.21(cf.Theorem9.3.8,page222)Foralls2S: sj=sfairProbp(1U2)i pmax s(1U2) p.
246 Proof: followsbyCorollary9.5.20(page245). CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
9.3.23(page227)andTheorem9.3.26(page228). Minimalprobabilitiesunderallfairadversaries:WegivetheproofofTheorem<br />
Proof: Lemma9.5.22Let Clearly,ifj=1U2then6j=a?U:a+.Let6j=a?U:a+.Then, beatotalfairfulpath.Then,j=1U2i 6j=a?U:a+.<br />
Hence,inf() inf():BydenitionofS+(1;2)(andsinces2S+(1;2)),Reach(s)\Sat(2)6=;: (*)(i)2S+(1;2) S+(1;2).Lets2inf().ByLemma9.5.10(page242),Reach(s) Sat(1)<strong>for</strong>alli 0.<br />
Thus,Sat(2)\inf()6=;.Fromthisand(*),wegetj=1U2.<br />
Proof: Corollary9.5.23ForallF2Advfair,s2S:pFs(1U2)=1�pFs(a?U:a+):<br />
Corollary9.5.24Foralls2S: followsfromLemma9.5.22(page246)andLemma9.5.12(page243).<br />
minnpFs(1U2):F2Advfairo=1�pmax<br />
(byCorollary9.5.23).ByCorollary9.5.18(page245),pFs(a?U:a+)=pmax Proof: IfF2AdvfairthenpFs(1U2)=1�pFs(a?U:a+) s(a?U:a+):<br />
someF2Advfair.ForthisadversaryF,weget(againbyCorollary9.5.23), 1�pmax s(a?U:a+)<strong>for</strong> s(a?U:a+)<br />
Thisyieldstheclaim. pFs(1U2)=1�pFs(a?U:a+)=1�pmax s(a?U:a+):<br />
Theorem9.5.25(cf.Theorem9.3.23,page227)Foralls2S:<br />
Proof: followsimmediatelybyCorollary9.5.24(page246). sj=fairProbwp(1U2)i 1�pmax s(a?U:a+)wp.<br />
Corollary9.5.26Foralls2S:<br />
Proof: followsbyCorollary9.5.23(page246)andCorollary9.5.18(page245). infnpFs(1U2):F2Advsfairo=1�pmax s(a?U:a+):<br />
Theorem9.5.27(cf.Theorem9.3.26,page228)Foralls2S:<br />
Proof: followsimmediatelybyCorollary9.5.26(page246). sj=sfairProbp(1U2)i 1�pmax s(a?U:a+) p:<br />
givetheproofofTheorem9.3.16(page226)andTheorem9.3.28(page228).<br />
Maximalandminimalprobabilitiesunderallstrictlyfairadversaries:Wenow
9.5.PROOFS Lemma9.5.28LetF2Advfair, =f2PathFful:j=1U2gandk=S2k"F 247<br />
wherek=n(k):2oThen,<strong>for</strong>alls2S: pFs(1U2)=lim<br />
and0(s) Proof: Wehave0 1 ::: .Let0=Tk1k.Then, k!1Prob(k(s))<br />
pFs(1U2)=Prob((s)) (s).Hence, Prob(0(s))=lim 0(s)ismeasurable<br />
Lemma9.5.12(page243): UsingLemma9.5.10(page242)itcanbeshownthatTotalFair\0(s) k!1Prob(k(s)):<br />
Prob(0(s))=Prob(TotalFairF(s)\0(s)) Prob((s))=pFs(1U2): (s).By<br />
Hence,pFs(1U2)=Prob(0(s))=limProb(k(s)). Notation9.5.29[TheprobabilitiespA(1U2)]LetA2Adv,2PathAn.Then,<br />
whereA0isanadversarywithA0()=A( pA(1U2)=pA0(1U2)<br />
Lemma9.5.30LetF2Advsfair,s2Sand 0;1;:::;jjg.Thefollowingareequivalent: )<strong>for</strong>each2Pathn(last()).<br />
(i)F()2MaxSteps(last();1;2)<strong>for</strong>all2. =f2PathAn(s):(i)j= 1^:2;i=<br />
Proof: (iii)pmax (ii)pmax s(1U2)=pFs(1U2): last()(1U2)=pF(1U2)<strong>for</strong>all2.<br />
(ii)=)(iii):WesupposepF0pF0: :jj=kg.Letkthesetofpaths2PathFn(s)with andA(0 )=B()iflast(0)=rst().Then,<br />
jj last()j= (l)j=1^:2,l=0;1;:::;jj�1, k,<br />
Clearly,k,k Since02kweobtainby(*): PathAn(s).Moreover,bydenitionofA,pA=pF<strong>for</strong>all2knf0g. 2.<br />
pFs=X2kP()pF+X2kP()
248 Contradiction. CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
(iii)=)(i):If2,s=last()and=F()then<br />
wheretisthepath!t.Hence,2MaxSteps(s;1;2). pmax s =pF=Xt2S(t)pFt=Xt2S(t)pmax t<br />
(i)=)(iii):Wedene setoffulpaths2Pathful(last())where k()=n(k):2()o; =f2PathFful:j=1U2gandLet2 2Fand ()=[ and()bethe<br />
Lemma9.5.28(page247)appliedtothefairadversaryF0withF0()=F( rst()=last()yieldspF=lim<br />
k0k():<br />
k!1pk wherepk= X )if<br />
Byinductiononkitcanbeshownthatpk <strong>for</strong>all2.Hence,pF=pmax pmax last()<strong>for</strong>all2.ThisyieldspF 2k()P():<br />
Lemma9.5.31ThereexistsF2AdvsfairwithpFs(1U2)=pmax last()<strong>for</strong>all2. s(1U2)<strong>for</strong>alls2 pmax last()<br />
Tmax(1;2). Tmax,Tmax Proof: j WesimplifythenotationsintroducedinNotation9.3.14(page224)andwrite andTmax j;lratherthanTmax(1;2),Tmax T=[ j1Tmax j;1: j(1;2)andTmax j;l(1;2).Let<br />
Foreachj 1,t2Tmax j;1wechoosesomet2MaxSteps(t;1;2)with<br />
WedeneanadversaryFasfollows.Foreachs2S,lets0;:::;sms�1beanenumeration Supp(t) [i
9.5.PROOFS ByLemma9.5.30(page247),wegetpFt(1U2)=pmax t(1U2)<strong>for</strong>allt2Tmax. 249<br />
Corollary9.5.32ThereexistsF2AdvsfairwithpFs(1U2)=1�pmax alls2Tmax(a?U:a+). Proof: followsfromLemma9.5.31(page248)andCorollary9.5.26(page246). s(a?U:a+)<strong>for</strong><br />
ilarly,wesimplywriteTmax,Tmax Proof: Lemma9.5.33IfF2Advsfair,s=2Tmax(1;2)thenpFs(1U2)
250 Proof:Foreach 2 withlast()2SnTmax,wechoosesome CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
Then,theuniquefulpathwithi
9.5.PROOFS Proof: Let =f2PathFful: 6j=1U2gandlet�bethesetoffulpaths 251<br />
W-fairnessofF,Prob(�(s))=1andProb((s))=Prob((s)\�):ByLemma9.5.37 (page250), 2PathFfulthatareW-fairandstatefair.Then,byLemma9.5.8(page242)andthe<br />
Thus,Prob((s)\�) (s)\� pFs(a?Ua0W) n2PathFful(s):j=a?Ua0Wo: 1�pFs(1U2)=Prob((s))=Prob((s)\�) pmax s(a?Ua0W).Weconcludepmax<br />
Lemma9.5.39ThereexistsF2AdvWfairwithpFs(1U2)=1�pmax whichyieldspFs(1U2) 1�pmax s(a?Ua0W). s(a?Ua0W)<br />
s2S. Proof: LetAbeasimpleadversarywithpAs(a?Ua0W)=pmax s(a?Ua0W)(whichexists s(a?Ua0W)<strong>for</strong>all<br />
byLemma9.5.13,page243)and<br />
Let WedeneaW-fairadversaryFsuchthatA bethesetofnitepaths =f2Pathn:(i)j=a?^:a0W;i=0;1;:::;jj�1;last()j=a0Wg: 2PathAnsuchthat FandpFs(1U2)=0<strong>for</strong>alls2S0W.<br />
Then,S0W=Si0Ti,T0=SnS+andTi=Ti;1[Ti;2.Let Ti,Ti;1,Ti;2beasinthedenitionofS0W=S0W(1;2)(seeNotation9.3.31,page229).
252whenever2PathFfulwith(i)2S0W<strong>for</strong>someithen(j)2S0W<strong>for</strong>allj CHAPTER9.VERIFYINGTEMPORALPROPERTIES<br />
Inparticular,if2PathFfulandj=a?Ua0Wthen6j=1U2.Fromthis, (4)pmax s(a?Ua0W)=pFs(a?Ua0W) 1�pFs(1U2)<strong>for</strong>alls2S. i.<br />
ByLemma9.5.38(page250)and(4),pFs(1U2)=1�pmax Theorem9.5.40(cf.Theorem9.3.33,page230)Foralls2S: sj=WfairProbwp(1U2)i 1�pmax s(a?Ua0W)wp. s(a?Ua0W)<strong>for</strong>alls2S.<br />
Proof: Theconnectionbetweenj=fairandj=Sfair:WegivetheproofofTheorem9.3.37(page 231)whichstatesthat,whendealingwithW=S,thesatisfactionrelationsj=fairand followsbyLemma9.5.38(page250)andLemma9.5.39(page251).<br />
j=Wfaircoincide. Theorem9.5.41(cf.Theorem9.3.37,page231)IfW=Sthen<strong>for</strong>allstatessand PCTL<strong>for</strong>mulas: Proof: orem9.5.40(page252)itsucestoshowthatpmaxBecauseofTheorem9.5.19(page245),Theorem9.5.25(page246)andThe- sj=fair i sj=Wfair:<br />
soobtainedadversaryFisfair.UsingLemma9.5.10(page242)itiseasytoseethat,<strong>for</strong> bedenedasintheproofofLemma9.5.39(page251).SincewedealwithW=S,the s2S.SinceSnS+(1;2) S0S(1;2)wehavepmax s(a?U:a+)=pmax s(a?U:a+) pmax s(a?Ua0S):LetF s(a?Ua0S)<strong>for</strong>all<br />
ByLemma9.5.12(page243),pFs(a?U:a+)=pFs(a?Ua0S)<strong>for</strong>alls2S.Fromthis,weget each2TotalFairF,<br />
pmax j=a?Ua0Si j=a?U:a+.<br />
<strong>for</strong>alls2S.Hence,pmax s(a?U:a+) s(a?U:a+)=pmax pFs(a?U:a+)=pFs(a?Ua0S)=pmax s(a?U:a0S)<strong>for</strong>alls2S. s(a?Ua0S)<br />
9.5.3 WenowshowthecorrectnessofourLTLmodelcheckingalgorithm(Section9.4,page234 ).Recallthatouralgorithmisbasedonamethod<strong>for</strong>verifyingconcurrentprobabilistic CorrectnessoftheLTLmodelcheckingalgorithm<br />
systemssystemsagainst!-automataspecications.Forthis,weneededthefactthat,<strong>for</strong> anyfairadversaryoftheproductsystemS andadeterministicRabinautomataA),theprobabilityofacceptingpathsagreeswith theprobabilityeventuallytoreachthesetU0(denedasinNotation9.4.11,page238). Thisfactcanbederivedfromthefollowingobservationwhoseproofusestotalfairness A(ofaconcurrentprobabilisticsystemS<br />
bilisticsystemthatdoesnotcontainterminalstates.Leta1,a22APandletUbetheLemma9.5.42Let(S;Steps;AP;L)beaniteproposition-labelledconcurrentproba- (seeSection9.5.1,page241).<br />
largestsubsetofSat(a1)suchthat,<strong>for</strong>allu2U,
9.5.PROOFS Reach(u) UandReach(u)\Sat(a2)6=;. 253<br />
Then,<strong>for</strong>all2TotalFair:j=32(a1^3a2)i whereaU2APsuchthatSat(aU)=U. j=3aU<br />
totalfairandj=3aU.Leti denitionofU,wegetinf() Proof: If j=32(a1^3a2)theninf() U;inparticular, Sat(a1)andinf() j=3aU.Nowweassumethat Sat(a2).By<br />
(1)inf() Reach((i)) 0beanintegerwith(i)2U.Then, U Sat(a1). is<br />
Letu2inf().BydenitionofU,wehaveReach(u)\Sat(a2)6=;.ByLemma9.5.10 (page242),inf()=Reach(u).Hence, (1)and(2)yieldj=32(a1^3a2). (2)inf()\Sat(a2)6=;.<br />
Lemma9.5.43InthenotationsofSection9.4(page236),wehave:<br />
<strong>for</strong>allstatess2SandfairadversariesF0ofS Prob(AccPathF0(sA))=Probn02PathF0 A. ful(sA):0j=3aU0o:<br />
Proof: fairfulpath02PathSA BecauseofLemma9.5.12(page243),itsucestoshowthat,<strong>for</strong>anytotal<br />
Weassumeatomicpropositionsaj;1;aj;2;bj2APsuchthataj;12LA(s0)is02H0j, (*)0j=3aU0i 02AccPath(sA). ful(sA):<br />
aj;22LA(s0)is02K0jandbj2LA(s0)is02U0j.Clearly,<br />
andf0:0j=3aU0g=f0:0j=W1jrbjg.Then,byLemma9.5.42(page252),if0 AccPath(sA)=8
254 CHAPTER9.VERIFYINGTEMPORALPROPERTIES
Chapter10<br />
Symbolicmodelchecking<br />
Asinthenon-probabilisticcase,thevericationmethods<strong>for</strong>probabilisticsystemsthat assumeanexplicitrepresentationofthestatespacesuerfromthestateexplosionproblem andmightfail<strong>for</strong>systemsofindustrialsize.Inthelastdecade,twogeneraltechniques havebeendevelopedtoattackthestateexplosionproblem<strong>for</strong>(non-probabilistic)parallel systems: thesymbolicmethodsthatarebasedonanimplicitrepresentationofthestatespace<br />
tigateonlycertainpartsofthestatespace[Pele93,Valm94,Gode94]andtechniques byorderedbinarydecisiondiagrams[BCM+90,McMil92]<br />
thatworkwithnetunfoldings[McMil92a,Espa94]. thepartialordermethodswhichcanbeclassiedintoreductiontechniquesthatinves-<br />
Bothtechniqueshavebeenimplementedintoolsandsuccessfulappliedtorealistic(very<br />
investigated.Theresearchonsymbolicvericationmethods<strong>for</strong>probabilisticsystemshas large)systems.Intheliterature,onlyafewworkhasbeendoneonhowtoavoidthe<br />
startedsofar.ClarkeproposedanextensionofBryant'sorderedBDDstomultiterminal stateexplosionproblem<strong>for</strong>probabilisticsystems.Tothebestoftheauthor'sknowledge,<br />
BDDs(MTBDDs)[CFM+93]andtheiruse<strong>for</strong>thesymbolicrepresentationofMarkov theadaptionofthepartialorderapproach<strong>for</strong>probabilisticsystemshasnotyetbeen<br />
chains.ThisideahasbeenfurtherdevelopedbyHachteletal[HMP+94]andHartonas- Garmhausen[HarG98].[HMP+94]presentsMTBDD-basedalgorithmstocomputethe results<strong>for</strong>systemswithmorethan1027states.Inherthesis,VickyHartonas-Garmhausen steady-stateprobabilities<strong>for</strong>verylargenitestatemachinesandreportsonexperimental specications[HarG98].1Theprobabilisticsystemsin[HarG98]arisethroughthe(lazy) synchronousparallelcompositionofseveralsequentialcomponents.Theuseofa(lazy) hasimplementedaMTBDD-basedtool<strong>for</strong>verifyingprobabilisticsystemsagainstPCTL synchronousparallelcompositionallows<strong>for</strong>arepresentationbyafullyprobabilisticsystem<br />
InthischapterwepresentMTBDD-basedalgorithms<strong>for</strong>verifyingfullyprobabilistic whosetransitionprobabilityfunctionisdescribedbyMTBDD.Asfarastheauthorknows,<br />
andconcurrentprobabilisticsystemsagainstseveraltypesofspecication<strong>for</strong>malisms. symbolicmethods<strong>for</strong>concurrentprobabilisticsystemsarenotyetinvestigated.<br />
[BCH+97]. 1ThetheoreticalfoundationsoftheunderlyingsymbolicPCTLmodelcheckercanbefoundin<br />
255
256 Moreprecisely,wewilldescribeMTBDD-basedPCTLmodelcheckingalgorithms<strong>for</strong> CHAPTER10.SYMBOLICMODELCHECKING<br />
fullyprobabilisticsystemsandstratiedsystems2andthesatisfactionrelationsj=and j=fair(andbrieysketchhowtodealwithj=sfairandj=Wfair).Moreover,wewillexplain howtheMTBDD-basedapproachcanbeapplied<strong>for</strong>decidingstrongorweakbisimulationequivalence.3TheresultsofthischapterarebasedonthejointworkwithEd Clarke[BaCl98]andusesresultsfromthejointworkwithEdClarke,VickyHartonas- Inwhatfollows,thereaderissupposedtobefamiliarwithorderedbinarydecisiondiagrams(OBDDsorBDDs<strong>for</strong>short)[Brya86]andthemainideasbehindtheBDD-approach Garmhausen,MartaKwiatkowskaandMarkRyan[BCH+97].<br />
relatednotationsaresummarizedintheappendix(Section12.3,page315).InSection <strong>for</strong>verifyingparallelsystems,seee.g.[BCM+90,McMil92,CGL93].Thedenitionof<br />
thelogicPCTLandPCTLmodelchecking(seeSection9.3,page216),strongbisimu- multi-terminalBDDs(MTBDDs<strong>for</strong>short)asintroducedbyClarkeetal[CFM+93]and 10.4(page295)andtheremainderofthisintroduction,weassumefamiliaritywith lation(seeSection3.4.1,page54)andweakbisimulation(seeSection7.1.1,page161).<br />
therepresentationofthesystembya(real-valued)MTBDD.Usinganencodingofthe Throughoutthischapter,weassumenitesystems.<br />
statespaceinf0;1gk<strong>for</strong>somek,thetransitionprobabilitymatrixofafullyprobabilistic orstratiedsystemcanbeviewedasafunctionfrombitvectorsintotheunitinterval ThebasicideabehindtheMTBDD-basedapproach<strong>for</strong>verifyingprobabilisticsystemsis<br />
byoperatorsonMTBDDs.Themainoperatorsthatareusedinalmostallverication andrepresentedbyaMTBDD.ToobtainsymbolicMTBDD-basedvericationmethods theoperatorsusedinthevericationalgorithmsoftheliteraturehavetobereplaced algorithms<strong>for</strong>probabilisticsystemsarethefollowing. (1)Thecomputationoftheprobabilitiesofcertaineventsrequiresarithmeticoperators pointsofcertainself-mappingsofthefunctionspaceS![0;1].Forinstance,<strong>for</strong> PCTLmodelchecking<strong>for</strong>fullyprobabilisticsystems,theprobabilities (likesummation+ormultiplication,minimumandmaximum)andleastxed<br />
Thefunctions7!ps(1U2)canbecharacterizedastheleastxedpointofthe areneededtocomputethesetofstateswherethe<strong>for</strong>mulaProb./p(1U2)holds. ps(1U2)=Probf2Pathful(s):j=1U2g<br />
operatorF:(S![0;1])!(S![0;1]), F(f)(s)=8>:1 0 Pt2SP(s;t)f(t):ifsj=1^:2 :otherwise :ifsj=2<br />
3.1.6,page36,andRemark3.1.8,page36).Dealingwithconcurrentprobabilistic andcomputedeitherbysolvingalinearequationsystemoriteration(seeTheorem<br />
willbeexplainedonpage297. 2Thereasonwhywedealwithstratiedsystemsratherthan(general)concurrentprobabilisticsystems 3Wedealwithfullyprobabilisticorreactivesystemsinthecaseofstrongbisimulationandfully systems,thecorrespondingoperatorFinvolvesminimumormaximumoperations.<br />
probabilisticsystemsinthecaseofweakbisimulation.
E.g.themaximalprobabilities 257<br />
inastratiedsystemaregivenbytheleastxedpointoftheoperatorF:(S! [0;1])!(S![0;1])whichisdenedby:F(f)(s)=1ifsj=2,F(f)(s)=0if pmax s(1U2)=sup A2AdvProbn2PathAful(s):j=1U2o<br />
s6j=1_2and,<strong>for</strong>sj=1^:2,<br />
andcanbecalculatedbysolvingalinearoptimizationproblemoriteration(see F(f)(s)=(Pt2SP(s;t)f(t) maxt2SP(s;t)f(t):ifsisnon-probabilistic :ifsisaprobabilisticstate<br />
(2)Forsomespecication<strong>for</strong>malisms,comparisonoperators(like,
258 Here,./isacomparsionoperatorlike,
10.1.THEALGEBRAICMU-CALCULUS j=fairasintroducedinChapter9)andcanexpressbisimulationequivalencealaLarsen& 259<br />
Skou[LaSk89]orweakbisimulationinthesenseofChapter7.Intheseapplications,the algebraicmu-calculustogetherwithitsMTBDD-based\compiler"specializestoasym-<br />
numericalmethodsinlinearalgebra(suchassolvinglinearequationsystemsorcomputing othertypesof)programs,thealgebraicmu-calculusisapplicableinothercontexts,e.g.<strong>for</strong> solvinggraph-theoreticalproblems(suchasshortestpathproblems)or<strong>for</strong>MTBDD-based bolicmodelchecker<strong>for</strong>probabilisticsystems.Besidethevericationofprobabilistic(or<br />
ispresentedinSection10.1.Section10.2showsthatthealgebraicmu-calculussubsumes eigenvalues). Organizationofthatchapter:Thesyntaxandsemanticsofthealgebraicmu-calculus severaltemporalormodallogics(andhence,canserveitselfasspecicationlanguage<strong>for</strong> severaltypesofparallelsystems).InSection10.3wedescribetheMTBDD-basedalgorithm<strong>for</strong>computingthesemanticsofthealgebraicmu-calculus.Section10.4explainshow thealgebraicmu-calculuscanbeappliedtoobtainsymbolicmodelcheckingalgorithms<br />
10.1<br />
<strong>for</strong>verifyingprobabilisticsystems.<br />
Thissectionpresentsthesyntaxandsemanticsofthealgebraicmu-calculus.Thealgebraic mu-calculuscanbeviewedasanextensionofPark'srelationalmu-calculus[Park74]. Thealgebraicmu-calculus<br />
Whiletherelationalmu-calculuscontains<strong>for</strong>mulas(interpretedbytheusualtruthvalues 0and1)andrelationalterms(interpretedbyrelationsthat{whenidentiedwiththeir characteristicfunction{canbeviewedasboolean-valuedfunctions),thealgebraicmucalculusdealswithalgebraicexpressions(interpretedbyrealnumbers)andalgebraicterms (interpretedbyreal-valuedfunctions).Therelationaltermsaremainlybuiltbypredicate<br />
maintained.Thexedpointoperatorsoftherelationalmu-calculusarepartialoperators thepredicatesymbolsarereplacedbyfunctionsymbols;theconceptof-abstractionis symbols,-abstractionfromthe<strong>for</strong>mulasandaleastorgreatestxedpointoperator.<br />
thatcanonlybeappliedtothoserelationaltermswheretheinducedsemanticoperator Foraninterpretationbyreal-valuedfunctions(ratherthanboolean-valuedfunctions),<br />
isthenensuredbyTarski'sxedpointtheorem.Dealingwithreal-valuedfunctionsrather yieldsamonotonicset-valuedfunction.Theexistenceoftheleastorgreatestxedpoint<br />
thisreason,wereplacetheleast/greatestxedpointoperatorsbyalimitoperator.The exist,onemightbeinterestedinotherxedpointsthantheleastorgreatestones.For point(orevenxedpointsatall)ofmonotonicoperatorsmightnotexist;or,ifthey thanboolean-valuedfunctions(sets)leadstotheproblemthatleastorgreatestxed<br />
intendedmeaningofthislimitoperatoristhelimitoffunctionsequencesofthe<strong>for</strong>m f;F(f);F(F(f));F(F(F(f)));:::<strong>for</strong>somefunctionfandsomehigher-orderoperatorF. InthecasewhereFcanberestricedtoamonotonicoperatoronboolean-valuedfunctions (resp.1),i.e.frepresentstheemptyset(resp.thesetD),theabovesequenceconverges (sets),i.e.anoperator(D!f0;1g)!(D!f0;1g),orequivalently,2D!2D<strong>for</strong>some totheleast(resp.greatest)xedpointofF(asanoperator2D!2Donsets).Thus,our limitoperatorgeneralizestheleastandgreatestxedpointoperatorsoftherelationalmu- nitesetD,andwherefisthebooleanfunctionthatalwaysreturnsthetruthvalue0<br />
calculus.Clearly,<strong>for</strong>arbitraryfandF,theabovefunctionsequencedoesnotconverge.
260 CHAPTER10.SYMBOLICMODELCHECKING<br />
expr::=q minexpr1opexpr2<br />
term(z1;:::;zn) Xz[expr]<br />
term::=fct z[expr] Z z1;:::;zn[expr] max z[expr]<br />
iterateZ[term"kterm0] limZ[term"term0]<br />
Forthisreason,themeaningsofthealgebraictermsarepartialreal-valuedfunctions. Figure10.1:Syntaxofthealgebraicmu-calculus<br />
Thesemanticsofthelimitoperatorreturnsapartialfunctionthatisundened<strong>for</strong>those<br />
10.1.1 argumentsdwherethesequencef(d);F(f)(d);F(F(f))(d);:::doesnotconverge.<br />
Thesyntaxofthealgebraicmu-calculusarisesfromPark'srelationalmu-calculus[Park74] byusingarbitaryarithmeticoperators(e.g.summation+ormultiplication)insteadof Syntaxofthealgebraicmu-calculus<br />
Moreover,weaddaboundediterationoperator(thatcouldbeaddedtotherelational mu-calculusaswell)whoseintendedmeaningisthefunctionfkobtainedbyaniteration thebooleanconnectives_and^,replacingthequantiers9zand8zbyarithmeticones Pz,minzandmaxzandtheleast/greatestxedpointoperatorsbyalimitoperator.<br />
setoftermvariablesandFctasetoffunctionsymbols.Thetermvariablesandfunction Thealgebraicmu-calculus:LetIndVarbeasetofofindividualvariables,TermVara ofthe<strong>for</strong>mf0=ffi+1=F(fi)<strong>for</strong>acertainfunctionfandahigher-orderoperatorF.<br />
symbolsareassociatedwithanarity(anaturalnumber thesetofn-arytermvariablesresp.n-aryfunctionsymbols.LetOpbeasetofbinary arithmeticoperatorsontherealsincludingsummation+,minus�,multiplication,the binaryminimumandmaximumoperatorsopminandopmax(wheree.g.q1opminq2= 1).TermVarnandFctndenote<br />
minfq1;q2g)andthecomparisonoperatorsop./where./2f;;=;6=gand<br />
Opmightalsocontainpartialoperatorssuchasdivision%whichisundenedifthe secondargumentis0.Expressionsandn-arytermsofthealgebraicmu-calculus(called q1op./q2=(1:ifq1./q2 0:otherwise.<br />
variablessuchthatz1;:::;znarepairwisedistinct,fctisann-aryfunctionsymbol,Zis ann-arytermvariableandkanaturalnumber.ForthetermslimZ[term"term0] algebraicexpressionsandalgebraicterms)arebuiltfromtheproductionsystemshownin<br />
anditerateZ[term"kterm0],werequirethatZisatermvariableandtermandterm0 Figure10.1onpage260.Here,qisarealnumber,op2Op,z,z1;:::;znareindividual<br />
arealgebraictermssuchthatZ,termandterm0havethesamearity.Asusual,wedene
10.1.THEALGEBRAICMU-CALCULUS theboundednessofoccurrencesofvariablesinalgebraicexpressionsoralgebraicterms. 261<br />
TheindividualvariablescanbeboundedbytheoperatorsP,min,maxand-abstraction occurrenceofanindividualvariableoratermvariableinanalgebraicexpressionorterm whilethetermvariablescanbeboundedbythelimitorboundediterationoperator.An<br />
term.Inwhatfollows,wewrite itdoesnotcontainfreeoccurrencesoftermandindividualvariables.Fortheexpressions issaidtobefreeifitisnotbounded.Analgebraicexpressionortermiscalledclosedif term(z1;:::;zn),werequirethatnoneoftheindividualvariablesz1;:::;znoccursfreein<br />
maxfexpr1;expr2gratherthanexpr1opmaxexpr2, �exprratherthan0�expr,<br />
jexprjratherthanmaxfexpr;�exprg. minfexpr1;expr2gratherthanexpr1opminexpr2,<br />
Moreover,weoftenwrite<br />
Thenotationsminz1;:::;zn[expr]andmaxz1;:::;zn[expr]areusedwithcorrespondingmean- z1;:::;zn[expr]ratherthanXz1"Xz2":::Xzn[expr]:::##: X<br />
whereterm0;term1;:::aredenedasbe<strong>for</strong>e. syntacticreplacement.TheintendedmeaningofiterateZ[term"kterm0]istermk ings.Intuitively,limZ[term"term0]stands<strong>for</strong>the\limit"ofthesequence(termi)i0 wheretermi+1=termfZ termig,i=0;1;2;:::andwherethebracketsf:::gdenote<br />
Thebooleanmu-calculus:Thebooleanmu-calculusisasubcalculusofthealgebraic mu-calculuswhereonlythoseoperatorsopareallowedthatareclosedundertheboolean values0and1(i.e.thatcanberestrictedtooperatorsf0;1g2!f0;1g).Formally, expressionsandtermsofthebooleanmu-calculusarebuiltfromtheproductionsystem showninFigure10.2(page261).Here,expr1,expr2arearbitraryalgebraicexpressions<br />
bexpr::=0expr1op./expr2 1 bexpr1^bexpr2 bterm(z1;:::;zn) bexpr1_bexpr2 8z[bexpr] :bexpr<br />
bterm::=fct z1;:::;zn[bexpr] Z lfpZ[bterm] gfpZ[bterm] 9z[bexpr]<br />
iterateZ[bterm"kbterm0]<br />
and^=opmin,_=opmax,:bexpr=1�bexprand Figure10.2:Syntaxofthebooleanmu-calculus<br />
8z[bexpr]=min z[bexpr];9z[bexpr]=max z[bexpr]:
262 TheleastandgreatestxedpointoperatorslfpZ[:::]andgfpZ[:::]aregivenby:5 CHAPTER10.SYMBOLICMODELCHECKING<br />
Here,weassumethatnisthearityofZandbterm.Asusual,otherbooleanconnectives, gfpZ[bterm]=limZ[bterm"z1;:::;zn[1]]: lfpZ[bterm]=limZ[bterm"z1;:::;zn[0]],<br />
suchas\implication"!or\equivalence"$,canbederivedfrom^,_and:.Inthe termsandexpressionsofthebooleanmu-calculusasbooleantermsorbooleanexpressions. Therelationalmu-calculusalaParkcanbeviewedasasubcalculusofthebooleanmu- booleansubcalculus,wewriteexpr1./expr2ratherthanexpr1op./expr2.Werefertothe<br />
calculus.Moreprecisely,<strong>for</strong>mulas(resp.terms)oftherelationalmu-calculusarethose expressions(resp.terms)ofthebooleanmu-calculusthatdonotcontainsubexpressions ofthe<strong>for</strong>mexpr1./expr2andtheboundediterationoperator.InSection10.2.1(see page275)weshowthatthestandardsemantics<strong>for</strong>therelationalmu-calculusalaPark coincideswiththeinducedsemanticsoftherelationalmu-calculusasasublanguageof<br />
10.1.2 thealgebraicmu-calculus.<br />
Intuitively,algebraicexpressionsareinterpretedbyrealnumbers,algebraictermsbyrealvaluedfunctions.6Tohandlenon-convergingbehaviourinthecaseofthelimitoperator Semanticsofthealgebraicmu-calculus<br />
limZ[:::],weextendthereallinebyaspecialsymbol?whichcanbeinterpretedas<br />
Denition10.1.1[Extendedreals]LetIRbethesetofrealnumbersand?=2IR. functionsthatareundened<strong>for</strong>thoseargumentswherethevalue?isreturned. \undened"or\divergence".FunctionswithrangeIR[f?gcanbeviewedaspartial<br />
Then,IR=IR[f?giscalledthedomainofextendedreals. Inthesequel,weusesubscriptstodenotecertainsubsetsofrealsorextendedreals.For instance,IR>0denotesthesetofpositiverealsandIR1=fq2IR:q Thelimitoperator<strong>for</strong>convergingsequencesofrealsisextendedtoanoperatorlimon arbitrarysequencesofextendedreals. 1g[f?g.<br />
Notation10.1.2[Theoperatorlim]Letq0;q1;q2;:::beaninnitesequenceinIR. Ifqn2IR<strong>for</strong>almostalln,e.g.qn2IR<strong>for</strong>alln lim(q0;q1;q2;:::)=(? limqn:if(qn)nn0convergesinIR. :if(qn)nn0doesnotconvergeinIR n0,then<br />
distributions.Ofcourse,insteadoftheleastandgreatestxedpointoperators,themoregenerallimit xedpointoperatorsisthat,intheotherchaptersofthatthesis,thegreeklettersandrangeover 5ThereasonnottousethestandardnotationsZ[:::]andZ[:::]todenotetheleastandgreatest Here,limqndenotestheusuallimitof(qn)nn0inIR.<br />
operatorlimZ[bterm"bterm0]couldbeaddedtothebooleanmu-calculus.However,<strong>for</strong>theapplications ofthebooleanmu-calculusthatareconsideredinthatthesis,onlytheleastandgreatestxedpoint booleantermsaninterpretationbyboolean-valuedfunctionsinmind.<br />
operatorsareneeded. 6Forthebooleanexpressions,wehaveaninterpretationbytheusualtruthvalues0or1and<strong>for</strong>the
10.1.THEALGEBRAICMU-CALCULUS Ifqn=?<strong>for</strong>innitelymanynthenlim(q0;q1;q2;:::)=?. 263<br />
denotesthefunctionX!IR,x7!lim(f0(x);f1(x);f2(x);:::). IfXisasetand(fj)j0isasequenceoffunctionsfj:X!IRthenlim(f0;f1;f2;:::)<br />
n-aryfunctionsintotheextendedrealswheretheinterpretation<strong>for</strong>theindividualand termvariablesandthefunctionsymbolsisgivenbyamodel<strong>for</strong>thealgebraicmu-calculus. Algebraicexpressionsareinterpretedbyextendedrealnumbers,n-aryalgebraictermsby<br />
mu-calculusisapairM=(D;I)consistingofanonemptynitesetD(calledthedomain) Denition10.1.3[Models<strong>for</strong>thealgebraicmu-calculus]Amodel<strong>for</strong>thealgebraic i.e.afunctionIwhichassigns andaninterpretationI<strong>for</strong>theindividualandtermvariablesandthefunctionsymbols,<br />
toeachn-arytermvariableZafunctionI(Z):Dn!IR, toeachindividualvariablezanelementI(z)2D,<br />
Remark10.1.4Fromapurelymathemeticalpointofview,theconceptoffunctionsymbolscanberemovedfromthealgebraicmu-calculussincefunctionsymbolscanbecon toeachn-aryfunctionsymbolfctafunctionI(fct):Dn!IR.<br />
limitorboundediterationoperator).However,theuseofbothfunctionsymbolsand termvariablesismotivatedbytheconventionthatfunctionsymbolsrepresentfunctions <strong>for</strong>whichwehaveaxedmeaninginmind(e.g.thetransitionprobabilityfunctionofa sideredasspecialtermvariables(namely,termvariablesthatcannotbeboundedbythe<br />
auxiliarysymbolsthatareneeded<strong>for</strong>technicalreasonsonlywhilethefunctionsymbols fullyprobabilisticsystem)whilethetermvariablesareusedinthescopeofthelimitor boundediterationoperatorlimZ[:::]oriterateZ[:::].Thus,thetermvariablesare stand<strong>for</strong>objectsofthe\realworld".<br />
termvariableswherethearityofZjiskjanddi2D,fj:Dkj!IRthen z1;:::;znarepairwisedistinctindividualvariablesandZ1;:::;Zmarepairwisedistinct Notation10.1.5[ThemodelsM[:::]]LetM=(D;I)beamodel.Ifn,m 0and<br />
denotesthemodel(D;I[z1:=d1;:::;zn:=dn;Z1:=f1;:::;Zm:=fm])where M[z1:=d1;:::;zn:=dn;Z1:=f1;:::;Zm:=fm]<br />
suchthatJ(fct)=I(fct)<strong>for</strong>allfunctionsymbolsfctandJ(zi)=di,i=1;:::;n,J(Zj)= isthoseinterpretationJ<strong>for</strong>theindividualandtermvariablesandthefunctionsymbols I[z1:=d1;:::;zn:=dn;Z1:=f1;:::;Zm:=fm]<br />
fj,j=1;:::;m,andJ(z)=I(z),J(Z)=I(Z)inallothercases. LetM=(D;I)beamodel.Foreachalgebraicexpressionexprandalgebraictermterm, instance,thepartialdivisionoperator%ontherealsisextendedtoatotaloperatoron Here,weassumethatalloperatorsop2OpareextendedtototaloperatorsonIR.For IRbyq1%q2=?ifq2=0or?2fq1;q2g.<br />
[expr]M2IRand[term]M:Dn!IRaredenedasshowninFigure10.3onpage264.
264 CHAPTER10.SYMBOLICMODELCHECKING<br />
[expr1opexpr2]M=[expr1]Mop[expr2]M [q]M=q<br />
[Pz[expr]]M=Pd2D[expr]M[z:=d] [term(z1;:::;zn)]M=[term]M(I(z1);:::;I(zn))<br />
[maxz[expr]]M=maxn[expr]M[z:=d]:d2Do [minz[expr]]M=minn[expr]M[z:=d]:d2Do<br />
[fct]M=I(fct), [z1;:::;zn[expr]]M(d1;:::;dn)=[expr]M[z1:=d1;:::;zn:=dn] [Z]M=I(Z)<br />
[iterateZ[term"kterm0]]M=fk [limZ[term"term0]]M=lim(f0;f1;f2;:::)<br />
Figure10.3:Semanticsofthealgebraicmu-calculus wheref0=[term0]M,fi+1=[term]M[Z:=fi].<br />
costcost(v;w)<strong>for</strong>passingtheedgefromvtow.Letmincost:VV!IRbethefunction Example10.1.6[Computingshortestpaths]LetG=(V;E;cost)beanitedi- setofdirectededgesandcost:E!IR>0afunctionthatassignstoeachedge(v;w)the thatreturns<strong>for</strong>anypair(v;w)ofnodesinGthelengthofashortestpathfromvtow. rectedgraphwithapositivecostfunction,i.e.Visanitesetofvertices,E V Va<br />
(Weputmincost(v;w)=?ifthereisnopathfromvtow.)Itiseasytoseethatthe functionmincostisthelimitofthesequence(fi)i0wherethefunctionsfi:V aregivenby f0(v;w)=(0:ifv=w ?:otherwise V!IR<br />
and wherethelimitistakeninIR(cf.Notation10.1.2,page262).7Weusebinaryfunction symbolscostandidandthemodelM=(V;I)wheretheunderlyingdomainisthevertex fi+1(v;w)=minffi(v;w);minffi(v;u)+cost(u;w):(u;w)2Egg<br />
setVandtheinterpretationIisgivenbyI(id)=f0and<br />
(ThisyieldsminQ=min(Qnf?g)if;6=QIR,Q6=f?g.)Fortheextensionof+toanoperatoron 7Here,weassumethatthenaturalorderonthereallineisextendedbyq
10.1.THEALGEBRAICMU-CALCULUS Then,thesemanticsofthealgebraictermlimZ[term"id]isthefunctionmincost 265<br />
Thiscanbeseenasfollows.Wehavef0=[id]M.Byinductiononi,wegetthat where term= v;w min Z(v;w);min u[Z(v;u)+cost(u;w)] :<br />
term Thus,[limZ[term"id]]M=lim(f0;f1;f2;:::)=mincost.Thesemanticsofthe fi+1=[term]M[Z:=fi],i=0;1;2;:::.<br />
withrespecttoMisthefunctionfk.Thevaluefk(v;w)isthecostofashortestpath v=v0;v1;:::;vl=wwherel iterateZ v;wk. min u[Z(v;u)+cost(u;w)] "kid<br />
ofBinthej-throwandk-thcolumnisdenotedbyB(j;k).Thefollowingalgebraicterms describesthematrixproductAB. Example10.1.7[Matrixmultiplication]LetAbeanm-matrix,Baml-matrix. A(i;j)denotestheelementofAinthei-throwandj-thcolumn;similarly,theelement<br />
whereAandBarebinaryfunctionsymbolsthatrepresentthematricesAandBrespec- term= i;k24Xj[A(i;j)B(j;k)]35<br />
tively.Moreprecisely,ifN=maxfn;m;lgandM=(f1;:::;Ng;I)where<br />
I(B)(j;k)=(B(j;k):if1 I(A)(i;j)=(A(i;j):if1 ? :otherwise ijnand1 mand1jkm then[term]MrepresentsABinthesensethat[term]M(i;k)istheelementofABin ? :otherwise l<br />
thei-throwandk-thcolumn(providedthat1 Example10.1.8[Iterativesquaring]Incertainapplications,onehastocomputeAK <strong>for</strong>aquadraticmatrixAandsomelargeK.9Forsimplicity,weassumethatK=2k. i nand1 k l).8<br />
useiterativesquaringwhichisbasedontheiterationA2i+1=A2iA2i,i=0;1;:::;k�1. Thiscanbedescribedbythealgebraicterm InsteadofcomputingAKbytheiterationAi+1=AiA,i=2;:::;K�1,itisbetterto<br />
whereAisabinaryfunctionsymbolthatrepresentsA. iterateZ24i;k24Xj[Z(i;j)Z(j;k)]35"k�1A35<br />
PCTLmodelcheckingalgorithmof[HaJo94]isbasedonthecomputationofAK<strong>for</strong>somematrixA.<br />
9Forexample,oneofthetwomethods<strong>for</strong>thehandlingoftheboundeduntiloperatorUKinthe 8Here,weassumethat?q=q?=?+q=q+?=0ifq2IRand??=?+?=?.
266 Intheliteratureaboutnumericalanalysis,avarietyofiterativemethods<strong>for</strong>matrixop- CHAPTER10.SYMBOLICMODELCHECKING<br />
canbedescribedastermsofthealgebraicmu-calculus.InExample10.1.9,weconsider erationsareproposed;seee.g.[Varg62,YoGr73].Usingthelimitoperator,mostofthem the\naive"method<strong>for</strong>solvinglinearequationsystemsofthetypez=q+Azthat isbasedontheiterationzk+1=q+Azk.Thismethodcanbeviewedasthebasisof severaliterativemethods,e.g.themethodsbyJacobiorGauss-Seidelortherelaxation methods.Anotherpossibleapplicationofthealgebraicmu-calculusintheeldofmatrix operationsisthecomputationofeigenvaluesbywell-knowniterativemethods,e.g.the methodsbyMisesorWielandt(seeExample10.1.10,page266). Example10.1.9[Solvinglinearequationsystems]LetAbearealn Ithen Then,I�Aisregularand,<strong>for</strong>eachvectorq2IRn,thesequence(zk)k0convergesto theuniquesolutionoftheequationsystem(I�A)z=qwherez0isanarbitraryreal n-identitymatrix.WeassumethatkI�Ak
10.1.THEALGEBRAICMU-CALCULUS Undercertainconditionsaboutz0,thesequence(zk)k0convergestoaneigenvectorof 267<br />
z0(thatrepresentsthestartingvectorz0)thisiterativemethodcanbedescribedinthe algebraicmu-calculusbythetermlimZ[term"z0]where A.UsingabinaryfunctionsymbolA(thatrepresentsA)anda1-aryfunctionsymbol<br />
Theunderlyingvectornormthatweusehereisthemaximumnormkyk1=maxfjyij: term=i24Xj[A(i;j)Z(j)]%max j [jA(i;j)Z(j)j]35:<br />
i=1;:::;ngify=(yi)1in. HavingaxedmodelM=(D;I)inmind,itisoftenusefultoextendthesyntaxof<br />
fz1;:::;zkg=IndVar\f1;:::;ng, Then,term(1;:::;n)standsshort<strong>for</strong>thealgebraicexpressionterm0(z1;:::;zk)where thealgebraicmu-calculusbyexpressionsofthe<strong>for</strong>mterm(1;:::;n)whereiareeither individualvariablesthatdodooccurfreeintermorvaluesoftheunderlyingdomainD.<br />
and term0=z1;:::;zk24X<br />
bexpr=^ 1;:::;n[term(1;:::;n)bexpr]35<br />
d2D^ 1in i=dEd(i)^^ 1jk^ 1in<br />
are1-aryfunctionsymbols(thatstand<strong>for</strong>thesingletonsetfdg).Theintendedmeanings interm.Eisabinaryfunctionsymbol(thatrepresentstheequalitypredicateonD),Ed Here,1;:::;nare\fresh"pairwisedistinctindividualvariablesthatdonotoccurfree i=zjE(i;zj):<br />
ofEandEdare<strong>for</strong>malizedbytherequirementthattheinterpretations<strong>for</strong>EandEdare givenby:<br />
Forexample,term(d;z;z)standsshort<strong>for</strong>term0(z)where I(E)(d1;d2)=(1:ifd1=d2 0:otherwise I(Ed)(d0)=(1:ifd=d0 0:otherwise.<br />
andbexpr=(1=d)^(2=z)^(3=z)wherewewrite1=dratherthanEd(1) term0= z24X<br />
andi=zratherthanE(i;z),i=2;3. 1;2;3[term(1;2;3)bexpr]35<br />
Example10.1.11[ComputingtheprobabilitiesProb(s;;C)]LetS=(S;Act;P)<br />
ThefunctionS describedbyatermofthealgebraicmu-calculus.10Forthis,weusethefollowingfact. S.WeshowhowtheprobabilitiesProb(s;;C)(wheres2SandC2S=R)canbe beaniteaction-labelledfullyprobabilisticsystemandRanequivalencerelationon<br />
page50.<br />
10RecallthatProb(s;;C)denotestheprobability<strong>for</strong>storeachaC-stateviainternalactions,see S![0;1],(s;t)7!Prob(s;;[t]R),istheleastxedpointofthe
268 operatorF:(S S![0;1])!(S CHAPTER10.SYMBOLICMODELCHECKING<br />
(s;t)2Rand,if(s;t)=2R, F(f)(s;t)=P(s;;[t]R)+ S![0;1])thatisgivenbyF(f)(s;t)=1if<br />
(cf.Proposition3.3.4,page49).Here,[t]R=ft02S:(t;t0)2Rg.ByTarski'sxedpoint u2Sn[t]RP(s;;u)f(u;t) X<br />
theorem,theleastxedpointisobtainedaslimitofthefunctionsequence(Fi(f0))i0 wheref0(s;t)=0<strong>for</strong>alls;t2S.Thisiterationcanbedescribedbyanalgebraicterm ofthe<strong>for</strong>mlimZ[:::"s;t[0]]:Forthis,werewritethedenitionofF.LetfRbethe characteristicfunctionofR.Then,<br />
whereG(f)(s;t)=Xt02SP(s;;t0)fR(t;t0)+Xu2SP(s;;u)(1�fR(t;u))f(u;t):<br />
F(f)(s;t)=maxffR(s;t);(1�fR(s;t))G(f)(s;t)g<br />
WeuseaternaryfunctionsymbolP(thatrepresentsP)andabinaryfunctionsymbolR (thatrepresentsR).WeconsiderthemodelM=(D;I)whereD=S]Actand<br />
I(R)(s;t) I(P)(s;a;t)=(P(s;a;t):ifs,t2Sanda2Act =(1:ifs,t2Sand(s;t)2R 0:otherwise. 0 :otherwise<br />
Weuses,t,t0anduasindividualvariablesanddene<br />
whereexpr=Xt0[P(s;;t0)R(t;t0)]+Xu[P(s;;u)(1�R(t;u))Z(u;t)]:<br />
term=limZ[s;t[maxfR(s;t);(1�R(s;t))exprg]"s;t[0]]<br />
D2!IRwhichisgivenby[term]M(s;t)=Prob(s;;[t]R)ifs,t2S. Here,intheexpressionsP(s;;t0)andP(s;;u),weusethenotationterm(1;:::;n) explainedonpage267.11ThemeaningoftermwithrespecttoMisthefunction[term]M:<br />
mightbeusefulincertainapplications. Remark10.1.12Thereareseveralpossibleextensionsofthealgebraicmu-calculusthat<br />
operatorssuchassquarerootpexpr,logarithms(suchaslog2(expr))orexponentiation Thealgebraicmu-calculuscouldbeextendedby(totalorpartial)1-aryarithmetic (suchas2expr)togetherwithanappropriatesemantics,e.g.inthecaseofsquareroot<br />
11NotethatisanelementofthedomainD.<br />
[pexpr]M=(q[expr]M:if[expr]M2IR0 ? :otherwise.
10.1.THEALGEBRAICMU-CALCULUS Anotherpossibleextensionistodealwithtuplesoftermvariablesinthelimitor 269<br />
boundediterationoperator;i.e.todealwithanoperator<br />
where,<strong>for</strong>somenaturalnumberl limjZ[term"term0]<br />
thesame,h=1;:::;l.Thesemanticsofthislimitoperatorwithindexjisgivenby ables,term=(term1;:::;terml)andterm0=(term1;0;:::;terml;0)arel-tuplesof algebraictermsandj2f1;:::;lgsuchthatthearityofZh,termhandtermh;0is 1,Z=(Z1;:::;Zl)isal-tupleoftermvari-<br />
lim(fj;0;fj;1;fj;2;:::)wherefh;0=[termh;0]Mand<br />
Similarly,theboundediterationoperatorcouldbeextended<strong>for</strong>tuplesoftermvariables. Insteadofjustusingthesymbol?{thatweusetohandleallkindsofnon-converging fh;i+1=[termh]M[Z1:=f1;i;:::;Zl:=fl;i];h=1;:::;landi=0;1;2;:::.<br />
+1or�1norconvergetoarealnumber(e.g.�1;1;�1;1;:::). sequencesthatdivergeto+1(e.g.1;2;3;:::)andsequencesthatneitherdivergeto sequences{onemightextendthereallinebythreesymbols�1,+1and?.This allowsthedistinctionbetweensequencesthatdivergeto�1(e.g.�1;�2;�3;:::)and<br />
M=(D;I)amodel.Then, Notation10.1.13[TherangeRangeM(term)]Lettermbeann-aryalgebraictermand<br />
denotestherangeof(thesemanticsof)termwithrespecttoM. RangeM(term)=n[term]M(d):d2Dno<br />
Denition10.1.14[
270 10.1.3 Fixedpointoperators CHAPTER10.SYMBOLICMODELCHECKING<br />
ThissectionshowsthatundercertainconditionsthelimitoperatorlimZ[term"term0]<br />
operatorsthatdescribeuniqueorleastorgreatestxedpoints.13ToapplyBanach's thatwepresentherearebasedonBanach'sorTarski'sxedpointtheoremwhichyield isacertainxedpointofthehigher-orderfunctionf7![term]M[Z:=f].Theconditions specializestoaxedpointoperatorinthesensethatthesemanticsoflimZ[term"term0]<br />
orTarski'sxedpointtheoremwehavetoensurethatthehigher-orderoperatorf7!<br />
compactsubsetofIR,namelyeitherarealinterval[a;b]oranitenonemptysetofreals. cases,wedealwithfunctionspacesofthe<strong>for</strong>mDn!
10.1.THEALGEBRAICMU-CALCULUS notpreservesupremaandinma.Inwhatfollows,weshrinkourattentiontothecompact 271<br />
interval
272 CHAPTER10.SYMBOLICMODELCHECKING<br />
expr::=q ifbfct(z1;:::;zn)thenexpr1elseexpr2 expr1opexpr2 1�expr term(z1;:::;zn)<br />
term::=fctjZ zi1;:::;zik[wfct(z1;:::;zn)expr] X z1;:::;zn[expr] lfpZ[term] min z[expr] max gfpZ[term] z[expr]<br />
iterateZhterm"kterm0i<br />
<strong>for</strong>allwfct2WFctn(i1;:::;ik)anddi2D,i2f1;:::;ngnfi1;:::;ikg, Figure10.4:Syntaxofthealgebraic[0;1]-mu-calculus<br />
Example10.1.18TheterminExample10.1.11(page267)thatdescribesthefunction di1;:::;dik2DI(wfct)(d1;:::;dn) X 1:<br />
whichisatermofthealgebraic[0,1]-mu-calculusprovidedthatP2WFct3(2;3)and S S![0;1],(s;t)7!Prob(s;;[t]R)canberewrittenas<br />
R2BFct2.ThemodelM=(D;I)consideredinExample10.1.11isamodel<strong>for</strong>the lfpZ[s;t[ifR(s;t)then1elseexpr]]:<br />
algebraic[0,1]-mu-calculus.<br />
termisatermofthealgeraic[0;1]-mu-calculusthenRangeM(term) modelM<strong>for</strong>thealgebraic[0;1]-mu-calculus.Wenowpresentconditionsthatensurethat Itiseasytoseethat,<strong>for</strong>anyexpressionexprofthealgebraic[0;1]-mu-calculusand<br />
thesemanticsreturnsvaluesin[0;1]ratherthantheauxiliarysymbol?.Forthis,we anymodelM<strong>for</strong>thealgebraic[0;1]-mu-calculus,[expr]M2[0;1][f?g.Similarly,if<br />
makesomesyntacticrequirementsabouttheoccurrencesofthetermvariableZwithin [0;1][f?g<strong>for</strong>any<br />
subtermslfpZ[term]andgfpZ[term].Therstcondition(\<strong>for</strong>malmonotonicity") istakenfromtherelationalmu-calculuswhere,<strong>for</strong>theleastandgreatestxedpoint operatorslfpZ[bterm]andgfpZ[bterm],themonotonicityoftheinducedoperator fallunderanevennumberofthenegationoperator:bexpr. Denition10.1.19[Formalmonotonicity]Lettermbeanalgebraicterm,expran f7![bterm]M[Z:=f]isensuredbytherequirementthatallfreeoccurrencesofZinbterm<br />
expr)iallfreeoccurrencesofZinterm(resp.expr)fallunderanevennumberofminus operations.15 algebraicexpressionandZann-arytermvariable.Zis<strong>for</strong>mallymonotoneinterm(or<br />
ortermisgivenbythenumberofsubexpressions1�exprofthatexpressionortermwheretheoccurence ofZiscontainedinexpr.<br />
15ThenumberofminusoperationsunderwhichanoccurrenceofatermvariableZfallsinanexpression
10.1.THEALGEBRAICMU-CALCULUS Example10.1.20LetZbea1-arytermvariable,fcta1-aryfunctionsymbolandz,y 273<br />
individualvariables.Zis<strong>for</strong>mallymonotoneintheexpressions13Z(z)(1�fct(y))and<br />
(whichyieldsthatZisnot<strong>for</strong>mallymonotonein(1�Z(z))Z(z))whilethesecond (1�Z(z))Z(z),therstoccurrenceofZfallsunderanoddnumberofminusoperations bothoccurrencesofZfallunderanoddnumberofminusoperations.Intheexpression Z(z)(1�(1�Z(z)))whileitisnotin(1�Z(z))(1�Z(z)).Inthethirdexpression,<br />
occurrencefallsunderanevennumberofminusoperations. Remark10.1.21Formalmonotonicityoftermvariablesintermsorexpressionsofthe relationalmu-calculus(asasubcalculusofthealgebraicmu-calculus)inthesenseof Denition10.1.19isthesameas<strong>for</strong>malmonotonicityalaPark[Park74].<br />
To<strong>for</strong>malizethiscondition,wedenetheoperatorsetsOp[0;1] freeinexprithentheoperatoroppreservessupremaandinmainthei-thargument. servessupremaandinmaisthat,<strong>for</strong>eachsubexpressionexpr1opexpr2,ifZoccursThesecondconditionthatweneedtoensurethatthefunctionf7![term]M[Z:=f]pre- anonemptysubsetof[0;1]withq+=supQandq�=infQandq22[0;1]then (q1;q2)7!q1opq2,preservessupremaandinmainitsrstargument,i.e.wheneverQis Op[0;1] 1 beasetofoperatorsop2Op[0;1]suchthatthefunction[0;1] 1 andOp[0;1] 2 asfollows.Let [0;1]![0;1],<br />
[0;1],(q1;q2)7!q1opq2,preservessupremaandinmainitssecondargument.Clearly, Similarly,Op[0;1] supfq1opq2:q12Qg=q+opq2;inffq1opq2:q12Qg=q�opq2:<br />
anyoperatorop2Op[0;1] 2 denotesasetofoperatorsop2Op[0;1]wherethefunction[0;1][0;1]!<br />
(q1;q2)7!q1=(1+q2)iscontainedinOp[0;1] Thecomparisonoperatorsop./arenotcontainedinOp[0;1] ,minimumopminandmaximumopmaxbelongtoOp[0;1] i ismonotonicinthei-thargument.Forinstance,multiplication 1nOp[0;1] 2 (providedthatitbelongstoOp[0;1]). 11 orOp[0;1] \Op[0;1] 2.16 2 whiletheoperator<br />
freeoccurrenceofZinthattermorexpressionwithinasubexpressionexpr1opexpr2: Denition10.1.22[Formalcontinuity]LetZbeann-arytermvariable.Ziscalled <strong>for</strong>mallycontinuousinatermorexpressionofthealgebraic[0;1]-mu-calculusi,<strong>for</strong>any<br />
Example10.1.23LetZ,Ybe1-arytermvariables.Zis<strong>for</strong>mallycontinuousinthe expressions12(1�Z(z))and IfZoccursfreeinexprithenop2Op[0;1] i.<br />
whileitisnotinZ(z)op
274 laPark(thebooleanmu-calculuswithoutthecomparisonoperatorsop./andthebounded CHAPTER10.SYMBOLICMODELCHECKING<br />
iterationoperator),allexpressionsandtermsare<strong>for</strong>mallycontinuous. braic[0;1]-mu-calculusiscalled<strong>for</strong>mallydivergencefreei,<strong>for</strong>eachsubtermlfpZ[term]Denition10.1.25[Formaldivergencefreedom]Atermorexpressionofthealge- orgfpZ[term],Zis<strong>for</strong>mallymonotoneand<strong>for</strong>mallycontinuousinterm. Example10.1.26TheterminExample10.1.11(page267)thatdescribesthefunction<br />
Theorem10.1.27Lettermbeann-arytermofthealgebraic[0;1]-mu-calculusthatis SP2WFct3(2;3)andR2BFct2. S![0;1],(s;t)7!Prob(s;;[t]R)is<strong>for</strong>mallydivergencefreewhenwedealwith<br />
andZann-arytermvariable.Then,thefunction <strong>for</strong>mallydivergencefree.LetM=(D;I)beamodel<strong>for</strong>thealgebraic[0;1]-mu-calculus<br />
iswell-dened.Moreover,ifZis<strong>for</strong>mallymonotoneand<strong>for</strong>mallycontinuousinterm thenFpreservessupremaandinmaandwehavethefollowing. F:(Dn![0;1])!(Dn![0;1]),F(f)=[term]M[Z:=f],<br />
Proof: (a)[lfpZ[term]]M=lfp(F)istheleastxedpointofF, (b)[gfpZ[term]]M=gfp(F)isthegreatestxedpointofF.<br />
l+m <strong>for</strong>mallymonotonein1�expr.Ziscalled<strong>for</strong>mallyantitoneinak-arytermtermiZ is<strong>for</strong>mallyantitoneintheexpressionterm(z1;:::;zk).Letl,mbenaturalnumberswith 1.Wesaythatafunction Wesaythatann-arytermvariableZis<strong>for</strong>mallyantitoneinexpriZis<br />
is(l;m)-continuousi,<strong>for</strong>allnonemptysubsetsioffunctionsfi:Dni![0;1], Ff+1;:::;f+ l;f� l+1;:::;f� F:(Dn1![0;1]):::(Dnl+m![0;1])![0;1]<br />
Here,f+i=supf2ifandf�i Ff�1;:::;f� l;f+ l+1;:::;f+ l+m =inffF(f1;:::;fl+m):fi2i;i=1;:::;l+mg: =supfF(f1;:::;fl+m):fi2i;i=1;:::;l+mg;<br />
Bystructuralinductionontheexpressionsandtermsofthealgebraic[0;1]-mu-calculus functions F:(Dn1![0;1]):::(Dnl+m![0;1])!(Dn![0;1]): =inff2if.Similarly,wedene(l;m)-continuity<strong>for</strong><br />
analgebraicexpressionortermsuchthatais<strong>for</strong>mallydivergencefreeand wegetthefollowing.WheneverZ1;:::;Zl+marepairwisedistincttermvariablesandais<br />
Z1;:::;Zlare<strong>for</strong>mallymonotoneina, Zl+1;:::;Zl+mare<strong>for</strong>mallyantitoneina Z1;:::;Zl+mare<strong>for</strong>mallycontinuousisa,<br />
Witha=term,l=1,m=0,Z1=ZwegetthattheoperatorF=Fapreservessuprema thenthefunctionFais(l;m)-continuous.Here,Faisgivenby<br />
andinma.Parts(a),(b)canbederivedfromProposition10.1.17(b)(page270).<br />
Fa(f1;:::;fl+m)=[a]M[Z1:=f1;:::;Zl+m:=fl+m]:
10.2.THEALGEBRAICMU-CALCULUSASASPECIFICATIONLANGUAGE275 10.2 guageThealgebraicmu-calculusasaspecicationlan- logicsthatcanserveasspecicationlanguages<strong>for</strong>(severaltypesof)parallelsystems.The Inthissectionweshowthatthealgebraicmu-calculussubsumesseveraltemporalormodal relationalmu-calculuswithitsstandardsemanticsalaPark[Park74]andKozen'smodal mu-calculus[Koze83]canbeviewedassubcalculiofthebooleanmu-calculus(seeSections 10.2.1and10.2.2).Inparticular,thebooleanmu-calculus(andhence,thealgebraicmucalculus)hastheexpressivenessofall<strong>for</strong>malisms{e.g.automataoninnitewordsand severalkindsoftemporallogicssuchasCTLorLTL{thatarecontainedintherelational ormodalmu-calculus;seee.g.[StEm84,EmLei86,Niwi88,BCM+90,EmJu91,Dam94]. Moreover,thealgebraicmu-calculuscontainsseveraltemporalandmodallogics<strong>for</strong>reasoningaboutquantitativepropertiesofconcurrentsystems.Forinstance,thealgebraic mu-calculussubsumestheextensionsofEmerson[Emer92]andSeidl[Seidl96]ofKozen's modalmu-calculus<strong>for</strong>specifying(certainkindof)realtimepropertiesandseverallogics toreasonaboutprobabilisticsystemssuchastheprobabilisticmu-calculusala[HuKw97, HuKw98]orPCTL[HaJo94,BidAl95];seeSections10.2.2and10.2.3.Moreover,thealgebraicmu-calculuscanserveasspecicationlanguage<strong>for</strong>arithmeticcircuitsasitsubsumes \equivalent"algebraictermterm'.Here,\equivalence"isinthefollowingsense:Forany thetemporallogicWordLevelCTL[CCH+96,CKZ96,Zhao96];seeSection10.2.4.In<br />
modelN<strong>for</strong>L,thereisamodelM<strong>for</strong>thealgebraicmu-calculuswith allthesecases,wehaveanembeddingoftherespective(temporalormodal)logicLinto thealgebraicmu-calculusofthefollowing<strong>for</strong>m.Foreach<strong>for</strong>mula'ofL,thereisan<br />
thealgebraicmu-calculus.Moreover,thedenitionofterm'isbystructuralinduction Hence,allpropertiesthatcanbespeciedbya<strong>for</strong>mulaofLcanalsobeexpressedin (*) [term']M=[']N:<br />
modelchecker<strong>for</strong>L. automaticallycomputesthesemanticsofthetermsofthealgebraicmu-calculusyieldsa onthesyntaxof';i.e.thedenitionofterm'isconstructive.Thus,anymethodthat<br />
(seepage261)byremovingtheexpressionsbuiltfromthecomparisonoperatorsop./and 10.2.1 ThesyntaxofPark'srelationalmu-calculusisobtainedfromthebooleanmu-calculus Therelationalmu-calculus<br />
wherethesemanticsoftheleastandgreatestxedpointoperatorsaredenedaslimits oftherelationalmu-calculus(asasubcalculusofthealgebraicorbooleanmu-calculus ofcertainfunctionsequences)agreeswiththestandardsemanticsalaPark[Park74].In theboundediterationoperatoriterateZ[:::"k:::].Wenowshowthatthesemantics<br />
gfpZ[bterm]operatorsisrestrictedtothoserelationaltermsbtermandtermvariablesZ whereZis<strong>for</strong>mallymonotoneinbterm.17ThemeaningsoflfpZ[bterm]andgfpZ[bterm] withrespecttoaf0;1g-modelM=(D;I)(whichcanbeviewedasamodel<strong>for</strong>the theapproachofPark,theuseoftheleastandgreatestxedpointlfpZ[bterm]and<br />
occurrencesofZinbtermfallunderanevennumberofthenegationoperator:bexpr.<br />
17Recallthat<strong>for</strong>malmonotonicityofatermvariableZinarelationaltermbtermmeansthatallfree
276 relationalmu-calculusinthesenseofPark)aredenedastheleastandgreatestxed CHAPTER10.SYMBOLICMODELCHECKING<br />
pointsofthehigher-orderoperatorf7![bterm]M[Z:=f]onthefunctionspaceDn! f0;1g.ToseethattheoperatorslfpZ[bterm]andgfpZ[bterm]ofthebooleanmucalculusareindeedleastandgreatestxedpointoperatorsweapplyTheorem10.1.27 divergencefree.LetZbeann-arytermvariablethatis<strong>for</strong>mallymonotoneand<strong>for</strong>mally (page274).18<br />
continuousinbterm.Then,<strong>for</strong>anyf0;1g-modelM: Theorem10.2.1Letbtermbean-arytermofthebooleanmu-calculusthatis<strong>for</strong>mally<br />
whereF:(Dn!f0;1g)!(Dn!f0;1g)isgivenbyF(f)=[bterm]M[Z:=f]. (a)[lfpZ[bterm]]M=lfp(F)istheleastxedpointofF (b)[gfpZ[bterm]]M=gfp(F)isthegreatestxedpointofF<br />
satised(seeRemark10.1.24,page273),Theorem10.2.1yieldsthatthestandardseman- Since<strong>for</strong>malcontinuityinexpressionsandtermsoftherelationalmu-calculusisalways Proof: followsimmediatelybyTheorem10.1.27(page274).19<br />
tics<strong>for</strong>therelationalmu-calculusalaParkagreeswiththesemanticsoftherelationaltionalmu-calculuscanbeviewedasasubcalculusofthealgebraicmu-calculus.mu-calculuswhenviewedasasublanguageofthealgebraicmu-calculus.Thus,therela- 10.2.2 Themodalmu-calculuswasintroducedbyKozen[Koze83]asalanguage<strong>for</strong>analyzing thebehaviourofpossiblyinnitecomputations.Formulasofthemodalmu-calculusare Themodalmu-calculus<br />
e.g.safetyorlivenessproperties.Themodalnextstepoperatorhicanbeviewedasthe builtfromthebooleanconnectives^,_,:,modalnextstepoperatorshiand[](where interpretedbysetsofstatesofaniteaction-labelledtransitionsystemandmightexpress modalcounterparttothebooleanquantier9xandstatesthat\thereisan-labelled rangesovercertainactions)andleastorgreatestxedpointoperators.Theyare<br />
symbolsR{whereRrepresentsthecharacteristicfunctionofthetransitionrelation transition"while[]isitsdual(\<strong>for</strong>all-labelledtransitions").Using2-aryfunction <strong>for</strong>theactionlabel valuedfunctionwhereI(R)(s;t)istrueis�!t){eachmodalmu-<strong>for</strong>mula'canbe translatedintoan\equivalent"1-arybooleantermbterm'.Forinstance,<strong>for</strong>mu-<strong>for</strong>mulas withmodalnextstephiorleastxedpoints, (i.e.weassumeaninterpretationIsuchthatI(R)isaboolean-<br />
btermhi'=z[9z0[R(z;z0)^bterm'(z0)]];btermlfpZ[']=lfpZ[bterm']:<br />
1�bexpr. NotethatthesummationquantierPzisnotcontainedinthebooleanmu-calculus,onlytheoperators ^=opmin,_=opmaxandop./areallowedandthebooleannegationoperator:bexprismodelledby 19Forthis,weusethefollowingsimplefact.IfF:(Dn![0;1])!(Dn![0;1])isanoperatorthat<br />
18Itshouldbeobservedthatthebooleanmu-calculusisasubcalculusofthealgebraic[0;1]-mu-calculus.<br />
andd1;:::;dn2DthentheleastandgreatestxedpointsofFarefunctionswithrangef0;1g.<br />
preservessupremaandinmaandsuchthatF(f)(d1;:::;dn)2f0;1g<strong>for</strong>anyfunctionf:Dn!f0;1g
10.2.THEALGEBRAICMU-CALCULUSASASPECIFICATIONLANGUAGE277<br />
mu-calculuscanbeviewedasasublanguageofthebooleanmu-calculus. Here,\equivalence"isinthesenseofcondition(*)onpage275.Thus,Kozen'smodal Intheliterature,Kozen'smodalmu-calculushasbeenextendedtoreasonaboutquantitaivepropertiesoftimedsystems[Emer92,Seidl96]orprobabilisticsystems[HuKw97, oversetsofstatesofalabelledtransitionsystemwhile[Seidl96,HuKw97,MoMcI97, HuKw98,McIv98]dealwithaninterpretationbyfunctionsfromthestatesintothereals. Emerson[Emer92]extendsthemodalmu-calculusbyboundediterationoperatorsthat MoMcI97,HuKw98,McIv98].Intheapproachof[Emer92],<strong>for</strong>mulasarestillinterpreted<br />
wherewedescribeEmerson'sboundediterationoperatorwiththehelpofourbounded areusedto<strong>for</strong>mulaterealtimepropertiessuchas\theprocesswillterminatewithinthe nextktimeunits".TheabovementionedembeddingofKozen'smodalmu-calculusinthe booleanmu-calculuscanbeextendedtoanembeddingofEmerson'smodalmu-calculus<br />
(reactive)systemscanbeembeddedintothealgebraicmu-calculus. explainhowthemodalmu-calculuswiththeinterpretationsbySeidl[Seidl96]overdurationaltransitionsystemsandHuth&Kwiatkowska[HuKw97,HuKw98]overprobabilistic iterationoperatoriterateZ[:::"k:::].Intheremainderofthissection,webriey<br />
Thedurationalmu-calculusalaSeidl:[Seidl96]dealswithaninterpretationof<br />
ofthe<strong>for</strong>mulasgivesameasure<strong>for</strong>thetimeofhowlongacertainpropertyholds. adiscretetimedomainTime.Thetransitionsareendowedwithanduration(i.e.the <strong>for</strong>mulasbyfunctionsfromthestatesofaniteaction-labelledtransitionsysteminto<br />
ThetimedomainTimeisasubintervalofthenon-negativeintegersextendedby?that amountoftimethatisneededtoper<strong>for</strong>mthetransitions).Insomesense,thesemantics<br />
wetreatas1.20Moreover,TimeisequippedwithasetOpofbinaryoperatorssuchas maximimopmax,minimumopmin,addition+andasequenceoperator(x;y)7!x;y=y. Formulasaregivenbythefollowinggrammar wherebtaisabasictimeassignment, isaxednitesetofactions.Formulasareinterpretedoverthestatesofadurational '::=btajZ '1op'2 2Act,Zavariableandop2Op.Here,Act []' hi' lfpZ['] gfpZ[']<br />
S=(S;!;dur)andaninterpretationJ<strong>for</strong>thevariablesandbasictimeassignments SActSatransitionrelationanddurafunctionthatassignstoeachtransitions!t itsdurationdur(s;;t).AmodelN=(S;J)consistsofadurationaltransitionsystem transitionsystem,i.e.atupleS=(S;!;dur)whereSisanitesetofstates,!<br />
byfunctionsS!Time.Themeaning[']N:S!TimeisdenedasshowninFigure<br />
transitions(i.e.Rstands<strong>for</strong>aboolean-valuedfunctionS usebinaryfunctionsymbolsRanddur.Intuitively,Rrepresentsthethe-labelled basictimeassignmentbtaisviewedasa1-aryfunctionsymbol.Foreachaction,we 10.5(page278).Weassociatewitheach<strong>for</strong>mula'an1-arytermterm'asfollows.Each<br />
istrueis�!t)whiledurstands<strong>for</strong>thedurationofthe-labelledtransitions(i.e.dur representsthepartialfunctionS variablesZofthedurationalmu-calculusareviewedas1-arytermvariables. S!IRwhere(s;t)7!dur(s;;t)ifs�!t).The S!f0;1gwhere(s;t)7!1<br />
with�1.<br />
thereallinebythethreesymbols1and?ratherthanjustthesinglesymbol?,wecouldalsodeal 20Tobeprecisely,[Seidl96]alsousesthesymbol�1toexpressunaccessibility.Usinganextensionof termZ=Z,termbta=bta,term'1op'2=s[term'1(s)opterm'2(s)],
278 CHAPTER10.SYMBOLICMODELCHECKING<br />
[hi']N(s)=maxndur(s;;t)+[']N(t):s!to [[]']N(s)=minndur(s;;t)+[']N(t):s!to [Z]N=J(Z), [bta]N=J(bta), ['1op'2]N(s)=['1]N(s)op['2]N(s)<br />
[lfpZ[']]N=leastxedpointof(S!Time)!(S!Time),f7![']N[Z:=f] [gfpZ[']]N=greatestxedpointof(S!Time)!(S!Time),f7![']N[Z:=f]<br />
term[]'=s[mint[R(s;t)(dur(s;t)+term'(t))]], Figure10.5:Semanticsofthedurationalmu-calculusala[Seidl96]<br />
termhi'=s[maxt[R(s;t)(dur(s;t)+term'(t))]], termlfpZ[']=limZ[term'"s[timemin]],<br />
N=(S;J)whereSisasbe<strong>for</strong>e,wedeneamodelM=(S;I)<strong>for</strong>thealgebraicmu- Here,timemin=minft:t2Timegandtimemax=maxft:t2Timeg.Givenamodel termgfpZ[']=limZ[term'"s[timemax]].<br />
calculusbyI(bta)=J(bta),<br />
andI(Z)=J(Z)<strong>for</strong>allvariablesZ.Bystructuralinductionon',weget[']N= [term']M. I(R)(s;t)=(1:ifs!t 0:otherwise I(dur)(s;t)=(dur(s;;t):ifs!t ? :otherwise<br />
Theprobabilisticmu-calculusalaHuth&Kwiatkowska:Intheprobabilistic mu-calculusof[HuKw97,HuKw98],<strong>for</strong>mulasaregivenbythegrammar<br />
whereapisanatomicproposition, interpretedwithrespecttoamodelN=(S;J)consistingofareactivesystemS= '::=apjZ '1^'2 :' 2ActanactionandZavariable.Formulasare '1_'2 []' hi' lfpZ['] gfpZ[']<br />
Themeaning[']N:S![0;1]ofa<strong>for</strong>mula'isdenedasshowninFigure10.6(page interpretationJ<strong>for</strong>theatomicpropositionsapandthevariablesZbyfunctionsS![0;1]. 279).Fordisjunction_andconjunction^,severalinterpretationsbybinaryoperators (S;Act;P)(cf.Denition3.3.10onpage51andNotation3.3.11onpage52)andan<br />
alternatingdepth arepossible.Toguaranteetheexistenceofleast/greatestxedpoints<strong>for</strong><strong>for</strong>mulaswith op_isopmaxoroneoftheoperators(q1;q2)7!q1+q2�q1q2,(q1;q2)7!minf1;q1+q2g op^isopmin,ortheoperator(q1;q2)7!maxfq1+q2�1;0g. 1thefollowingoperatorsop_andop^canbeused.21<br />
Similarlytothewayinwhichwedescribeeach<strong>for</strong>mula'ofSeidl'sdurationalmu-calculus<br />
andthattheycanbecomputedbythestandarditerations.SeeProposition1and2in[HuKw98].<br />
occursfreein byan\equivalent"algebraictermterm',weobtainatrans<strong>for</strong>mationfromthepositive 21Alternatingdepth .Thisensurestheexistenceofleastandgreatestxedpointsoftheassociatedoperator 1meansthat,<strong>for</strong>anysub<strong>for</strong>mulalfpZ[ ]orlfpZ[ ],atmostthevariableZ
10.2.THEALGEBRAICMU-CALCULUSASASPECIFICATIONLANGUAGE279<br />
['1_'2]N=['1]Nop_['2]N,['1^'2]N=['1]Nop^['2]N, [Z]N=J(Z), [hi']N(s)=Pt2SP(s;;t)[']N(t), [ap]N=J(ap), [:']N(s)=1�[']N(s),<br />
[lfpZ[']]N=leastxedpointof(S![0;1])!(S![0;1]),f7![']N[Z:=f], [[]']N(s)=1�Pt2SP(s;;t)(1�[']N(t)), [gfpZ[']]N=greatestxedpointof(S![0;1])!(S![0;1]),f7![']N[Z:=f].<br />
modalmu-calculuswiththeFuzzyinterpretationsof[HuKw97,HuKw98]tothealgebraic Figure10.6:Semanticsoftheprobabilisticmu-calculusala[HuKw97]<br />
mu-calculus.Foreach<strong>for</strong>mula',wedenean1-aryalgebraictermterm'bystructural induction.Theatomicpropositionsapareviewedas1-aryfunctionsymbols.Foreach action,weuseabinaryfunctionsymbolsP.Intuitively,P(s;t)stands<strong>for</strong>theprob-<br />
termap=ap,term:'=1�term'and viewedas1-arytermvariables.Wesupposethatop_,op^2OpanddenetermZ=Z, ability<strong>for</strong>stomovetotviaan-labelledtransition,i.e.Prepresentsthefunction S S![0;1],(s;t)7!P(s;;t).ThevariablesZofthepositivemodalmu-calculusare<br />
term'1_'2=s[term'1(s)op_term'2(s)], term'1^'2=s[term'1(s)op^term'2(s)],<br />
termlfpZ[']=limZ[term'"s[0]],termgfpZ[']=limZ[term'"s[1]], term[]'=s[1�Pt[P(s;t)(1�term'(t))]], termhi'=s[Pt[P(s;t)term'(t)]],<br />
wedeneI(P)(s;t)=P(s;;t).Bystructuralinductionon'itcanbeshownthat GivenamodelN=(S;J)whereS=(S;Act;P),wedeneamodelM=(S;I)<strong>for</strong>the I(ap)=J(ap)<strong>for</strong>allatomicpropositionsap.ForthebinaryfunctionsymbolsP, algebraicmu-calculusasfollows.ForeachvariableZ,wedeneI(Z)=J(Z);similarly,<br />
10.2.3 [']N=[term']M.Here,weassumethat'isa<strong>for</strong>mulaofalternatingdepth ThelogicPCTL 1.<br />
theexpressionsandtermsofthealgebraicmu-calculus(presentedinSection10.3,page Thus,themethoddescribedinSection10.4focussesonaxeddatastructure(namely 285)canbeappliedtoobtainsymbolicvericationmethods<strong>for</strong>probabilisticsystems. InSection10.4(page295)wedescribehowtheMTBDD-basedalgorithmtoevaluate<br />
MTBDDs)<strong>for</strong>representingprobabilisticsystems.Here,weexplainhow{fromapurely abilisticandconcurrentprobabilisticsystems)canbere<strong>for</strong>mulatedasbooleanterms.mathematicalpointofview{PCTL<strong>for</strong>mulas(withtheinterpretationsoverfullyprobHence,anymethodthatautomaticallyevaluatestheexpressionsandtermsofthealgebraicmu-calculus,canbeusedasbasis<strong>for</strong>amodelchecker<strong>for</strong>PCTL,independentofthe chosendatastructureofanimplementation.
280 RecallthesyntaxandsemanticsofPCTLthatisexplainedinChapter9(page212). CHAPTER10.SYMBOLICMODELCHECKING<br />
page39)andconsiderthestandardinterpretationj=ala[BidAl95]andthesatisfaction relationj=fairthatinvolvesfairnesswithrespecttothenon-deterministicchoices. Intheconcurrentcase,weshrinkourattentiontostratiedsystems(seeDenition3.2.3,<br />
a2AP,weusean1-arybooleanfunctionsymbolSatathatrepresentsthe(characteristic functionofthe)setSat(a)ofstateswhereaholds.Moreover,weuseabinaryterm termbterm.Forthis,weusethefollowingfunctionsymbols.Foreachatomicproposition WenowexplainhowanyPCTL<strong>for</strong>mulacanbetranslatedintoan\equivalent"boolean<br />
variablePthatstands<strong>for</strong>thetransitionprobabilitymatrixofafullyprobabilisticsystem orastratiedsystem.Inaddition,intheconcurrent(stratied)case,weassumean1-ary booleanfunctionsymbolSprobthatstands<strong>for</strong>the(characteristicfunctionofthe)setof Thebooleantermsbtermaredenedbystructuralinduction.Wedenebtermtt= probabilisticstates.<br />
Thedenitionofthebooleanterms<strong>for</strong><strong>for</strong>mulasbuiltfromtheprobabilisticoperator s[1],bterma=Sataand,<strong>for</strong><strong>for</strong>mulaswhoseoutermostoperatoris:or^,<br />
Prob./pdependsonwhetherweassumeaninterpretationoverfullyprobabilisticorstrat- bterm:=s[:bterm(s)], bterm1^2=s[bterm1(s)^bterm2(s)].<br />
+(1�bexpr)expr2. iedsystems.Inwhatfollows,webrieywritelfpZ[:::]ratherthanlimZ[:::"s[0]]<br />
Fullyprobabilisticcase:For<strong>for</strong>mulaswhoseoutermostoperatoristheprobabilistic anduseexpressionsofthe<strong>for</strong>mifbexprthenexpr1elseexpr2insteadofbexprexpr1 operatorProb./pwedenebtermProb./p(')=s[term'(s)./p]wherethealgebraicterms term'<strong>for</strong>thepath<strong>for</strong>mulasaredenedasfollows. term1Uk2=iterateZhs[expr]"ks[0]i term1U2=lfpZ[s[expr]] termX=s[Pt[P(s;t)bterm(t)]]<br />
withexpr=ifbterm2(s)then1elsebterm1(s) LetS=(S;P;AP;L)beaproposition-labelledfullyprobabilisticsystem.Wedene Xt[P(s;t)Z(t)]!:<br />
Then,[bterm]MisthecharacteristicfunctionofSat()=fs2S:sj=gwhile M=(S;I)whereI(P)=PandI(Sata)(s)=1ifa2L(s),I(Sata)(s)=0otherwise. [term']MagreeswiththefunctionS![0;1],s7!ps(1U2)where<br />
s7!ps(1U2),istheleastxedpointoftheoperatorF:(S![0;1])!(S! Thiscanbeseenasfollows.Theorem3.1.6(page36)yieldsthatthefunctionS![0;1], ps(1U2)=Probf2Pathful(s):j=1U2g:<br />
F(f)(s)=Pt2S1[S2P(s;t)f(t)ifsj=1^:2.Usingstructuralinductionand<br />
[0;1])whichisgivenby:F(f)(s)=1ifsj=2,F(f)(s)=0ifs6j=1_2and
10.2.THEALGEBRAICMU-CALCULUSASASPECIFICATIONLANGUAGE281 Theorem10.1.27(page274)weobtainthat,<strong>for</strong>allstatess,sj= andps(')=[term']M(s).22Thus, term1U2=lfpZ[s[expr]]and[term1U2]M(s)=lfp(F)(s)=ps(1U2): i[bterm]M(s)=1<br />
fair)adversaries.Forbothsatisfactionrelationsj=andj=fair,thebooleanterms<strong>for</strong>the Concurrentcase:Dependingonthecomparisonoperator./anddependingonthe satisfactionrelationweneedtheminimalormaximalprobabilitiesunderall(orunderall <strong>for</strong>mulasinvolvingtheprobabilityoperatorProbvparedenedasfollows.<br />
wherev2f
282 Nextweconsidertheuntiloperator,i.e.<strong>for</strong>mulasofthe<strong>for</strong>mProbwp(1U2).Wedene CHAPTER10.SYMBOLICMODELCHECKING<br />
wherethedenitionoftermmin withthestandardinterpretationj=,wedene btermProbwp(1U2)=shtermmin 1U2dependsonwhetherwedealwithj=orj=fair.Dealing 1U2(s)wpi<br />
whereexprmin factionrelationj=fairweusetheresultofTheorem9.3.23(page227)statingthat1U2isasinthecaseoftheboundeduntiloperator.Dealingwiththesatis- termmin 1U2=lfpZhshexprmin 1U2ii<br />
S?(1;2)=Sat(1)nS+(1;2).RecallthatS+(1;2)isthesetofallstatess2S wherea+anda?arefreshatomicpropositionsrepresentingthesetsS+(1;2)and sj=fairProbwp(1U2)i 1�pmax s(a?U:a+)wp<br />
thatcanreacha2-stateviaapaththrough1-states(Notation9.3.11,page223).Thus, S+(1;2)=lfp(F)wherethemonotonicoperatorF:2S!2Sisgivenby<br />
Thedenitionofthetermtermmin F(Z)=Sat(2)[fs2Sat(1):9t2S[(P(s;t)>0)^t2Z]g:<br />
Thealgebraictermtermmax follows.Weput termmin 1U2=s[1�termmax 1U2withrespecttothesatisfactionrelationj=fairisas<br />
wedealwiththebooleantermsbterm?= a?U:a+isdenedasdescribedabovewiththeonlydierencethat shbterm1(s)^:bterm+(s)iandbterm+ a?U:a+(s)]:<br />
ratherthanthefunctionsymbolsSata?andSata+.Here,bterm+isgivenby<br />
Asinthefullyprobabilisticcase(andusingTheorem10.1.27(page274),Theorem3.2.11 (page43)andtheresultsofSection9.3)weobtainthefollowing.LetS=(S;P;AP;L) lfpZ[s[bterm2(s)_(bterm1(s)^9t[(P(s;t)>0)^Z(t)])]]:<br />
beaniteproposition-labelledstratiedsystem.LetM=(S;I)whereI(Sata)and I(Sprob)aretheboolean-valuedfunctionsS!f0;1gwithI(Sata)(s)=1ia2L(s) andI(Sprob)(s)=1isisaprobabilisticstate.TheinterpretationI(P)<strong>for</strong>thebinary 3.2.4,page40);moreprecisely,wedealwith functionsymbolPisgiventhetransitionprobabilityfunctionP(denedasinNotation<br />
Then,<strong>for</strong>allstatess2S,sj=A I(P)(s;t)=8>:P(s;t):ifs2Sprob<br />
i[bterm]M(s)=1and ? 1 :otherwise. :ifs=2Sprobands�!t<br />
[termmax [termmin ']M(s)=sup ']M(s)=inf A2AProbn2PathAful(s):j=A'o; A2AProbn2PathAful(s):j=A'o
10.2.THEALGEBRAICMU-CALCULUSASASPECIFICATIONLANGUAGE283<br />
asimilarway,wecandealwiththesatisfactionrelationsj=sfair(wherestrictfairnessis supposed)orj=Wfair(wherefairnessintheW-statesissupposed).Forthedenitionofthe booleantermsbtermProb./p(1U2)<strong>for</strong><strong>for</strong>mulasinvolvingtheunboundeduntiloperator,one whereAstands<strong>for</strong>AdvorAdvfair(dependingonwhetherwedealwithj=orj=fair).23In<br />
hastodescribethesetTmax(1;2)(seeNotation9.3.14,page224)resp.thesetS0W(see termisofthe<strong>for</strong>mlfpZ[bterm].Forinstance,<strong>for</strong>thesetTmax(1;2),thedenitionof btermisgivenby Notation9.3.31,page229)byabooleanterm.Inbothcases,thecorrespondingboolean<br />
s[:bterm+(s)_bterm2(s)_(Sprob(s)^8t[(P(s;t)>0)!Z(t)])<br />
10.2.4 _(:Sprob(s)^9t[(P(s;t)>0)^(termmax WordlevelCTL 1U2(s)=termmax 1U2(t))])]:<br />
WordLevelCTL[CCH+96,CKZ96,Zhao96]isanextensionofCTLtoreasonabout propertiesinvolvingtherelationshipsamongdatawords.Suchpropertiesareneeded<strong>for</strong> thevericationofarithmeticcircuits.WordLevelCTLdistinguishesbetweenseveral<br />
bystatic<strong>for</strong>mulas,thebooleanconnectivesandtheCTLpathquantierscombinedwith equationsorinequalities<strong>for</strong>expressions,static<strong>for</strong>mulasSFthatarebuiltfromatomic <strong>for</strong>mulasandthebooleanconnectives^and:andtemporal<strong>for</strong>mulasTFthataregiven typesof<strong>for</strong>mulas:atomic<strong>for</strong>mulasAFthatarebuiltfromatomicpropositionsand<br />
thetemporaloperatorsXandU. AF::=a TF::= SF::= AF SF8(e1./e2) TF 1^TF SF 1^SF 2 9(e1./e2) :SF<br />
wherea2APand./2f=;;g.Thewordsaretuplesofpropositional<strong>for</strong>mulas, i.e.theyareofthe<strong>for</strong>mword=hPF 1;:::;PF :TF<br />
niwherethepropositional<strong>for</strong>mulasPF 8XTF 9(TF 1UTF 2) 92TF<br />
arebuiltfromtheatomicpropositionsa2APandtheboolenconnectives^and:.The expressionsaregivenby:<br />
Formulas,expressionsandwordsareinterpretedoverniteproposition-labelledtransition systems(S;R;AP;L)whereSisasetofstates,R e::=const word next(word) e1ope2SifSFthene1elsee2 L:S!2APthelabellingfunction<strong>for</strong>thestatesbyatomicpropositions.Propositional, atomic,staticandtemporal<strong>for</strong>mulasareinterpretedbysetsofthestates: Sthetransitionrelationand<br />
[9(e1./e2)]=fs2S:9s02S[R(s;s0)./[e2](s;s0)]g, [8(e1./e2)]=fs2S:8s02S[R(s;s0)./[e2](s;s0)]g, [a]=fs2S:a2L(s)g,[1^2]=[1]\[2],[:]=Sn[],<br />
qop./?=?op./q=1,minQ=min(Qnfg),maxQ=max(Qnfg)andminf?g=maxf?g=?.<br />
operatorsop./ontheextendedreals,weassumethat,ifq2IRand;6=QIRthenq?=?q=?, 23Here,<strong>for</strong>theextensionofmultiplication*,theminimum/maximumoperatorsandthecomparison
284[8XTF]=fs2S:8s02S[R(s;s0)!s02[TF]]g CHAPTER10.SYMBOLICMODELCHECKING<br />
[92TF]=fs2S:9s0;s1;s2:::2S[(s0=s) [9(TF 1UTF 2)]=fs2S:9k ^sk2[TF 2]^V0i
10.3.A\COMPILER"FORTHEALGEBRAICMU-CALCULUS bterm8XTF=s[8s0[R(s;s0)!btermTF(s0)]] 285<br />
bterm9(TF =lfpZhshbtermTF 1UTF 2) 2(s)_ btermTF<br />
TheconnectionbetweenthewordlevelCTL<strong>for</strong>mulasandtheassociatedalgebraicterms bterm92TF=lfpZ[s[btermTF(s)^(9s0[R(s;s0)^Z(s0)])]] 1(s)^9s0[R(s;s0)^Z(s0)]ii<br />
isasfollows.LetM=(S;I)whereI(R)=Rand<br />
UsingstructuralinductionandTheorem10.2.1(page276)weobtain:[termWword]M= I(Sata)(s)=(1:ifa2L(s)<br />
[word],[termEe]M=[e]and 0:otherwise.<br />
<strong>for</strong>all<strong>for</strong>mulas,wordswordandexpressionse. [bterm]M(s)=(1:ifs2[] 0:otherwise<br />
Thealgebraicmu-calculuscanbeviewedasalanguage<strong>for</strong>manipulatingreal-valuedfunctions.Anyclosedalgebraictermtermyieldsanoperator 10.3 A\compiler"<strong>for</strong>thealgebraicmu-calculus<br />
interpretationsfi=I(fcti)<strong>for</strong>thefunctionsymbolsasitsinputanddescribeshowto combinethesefunctionsf1;:::;fkviaarithmeticoperatorsanditeration.Thesemantics [term]M(whereM=(D;I))stands<strong>for</strong>thecomposedfunction.Forinstance,inthe (f1;:::;fk)thattakesthe<br />
method(Example10.1.9,page266),theterm example<strong>for</strong>solvinglinearequationsystemsofthetypez=q+Azwiththe\naive"<br />
canbeviewedastheoperatorthattakesasitsargumentsthefunctionsI(A)<strong>for</strong>the term=limZ24i24q(i)+Xj[A(i;j)Z(j)]35"z035<br />
matrixA,I(q)<strong>for</strong>thevectorqandI(z0)<strong>for</strong>thestartingvectorz0and\returns"the Inthissection,weturntothequestionhowtheterms(andexpressions)canbeevaluated functionthatrepresentstheuniquesolutionz.<br />
expression)withrespecttoM.Insomesense,thisalgorithmcanbeviewedasacompiler expression)andamodelM=(D;I)andreturnsthesemantics[:::]Mofthatterm(or <strong>for</strong>thealgebraicmu-calculus.Suchanalgorithmrequiresanadequatedatastructure<strong>for</strong> automaticallyandpresentanalgorithmthattakesasitsinputanalgebraicterm(or<br />
thefunctionsDn!IR.Ofcourse,\adequacy"ofthechosendatastructuredepends structuresinceMTBDDsareknowntobeecient<strong>for</strong>representingprobabilisticsystems<br />
ontheconcreteapplication.Inthatthesiswhereweconcentrateonthevericationof probabilisticsystemsweshrinkourattentiontotheuseofMTBDDsaschosendata
286 [HMP+94,HarG98].24Clearly,inotherapplications,theuseofMTBDDsmightbenot CHAPTER10.SYMBOLICMODELCHECKING<br />
ecient.Forinstance,inSection10.2.4(page283),wesawthatthealgebraicmucalculuscanalsoserveasspecicationlanguage<strong>for</strong>arithmeticcircuits.Inthatcase,it isknownthattheuseofMTBDDsisnotecient(theresultingMTBDDsmighthave exponentialsize)andtheuseofotherdecisiondiagramslikeHDDsispreferable.See [CCH+96,CKZ96,Zhao96]. Inarststep,weintroducethemixedcalculuswhichisavariantofthealgebraicmucalculusthatisbasedonaxedinterpretation<strong>for</strong>thefunctionsymbols.Forthis,we assumethedomainD=f0;1goftheunderlyingmodelM=(D;I)andarepresentation<br />
whosenonterminalverticesarelabelledbyindividualvariables.25Forthemixedcalculus, theindividualvariablesintothereals.ThesefunctionsarerepresentedbyMTBDDs expressionsandtermsofthemixedcalculusareinterpretedbypartialfunctionsfrom ofthefunctionsI(fct):f0;1gn!IR<strong>for</strong>then-aryfunctionsymbolsbyMTBDDs.The<br />
wedescribeanalgorithmthattakesatermorexpressionofthemixedcalculusasits inputandgeneratesthecorrespondingMTBDD.GivenamodelM=(D;I)<strong>for</strong>the algebraicmu-calculus,weuseanencodingofthedomainDinf0;1gkandtrans<strong>for</strong>mthe<br />
algorithmfromthealgebraictothemixedcalculusandthealgorithm<strong>for</strong>computing calculus.TheMTBDD<strong>for</strong>thatexpressionortermofthemixedcalculuscanbeviewedas arepresentation<strong>for</strong>thesemantics[:::]MwithrespecttoM.26Thus,thetrans<strong>for</strong>mation algebraicexpressionsandtermsinto\equivalent"expressionsandtermsofthemixed<br />
terms.<strong>On</strong>theotherhand,themixedcalculusinitsowncanbeviewedasalanguage <strong>for</strong>manipulatingMTBDDswhereouralgorithmactsasacompilerthatautomatically amethodthatautomaticallycomputesthesemanticsofthealgebraicexpressionsand theMTBDDs<strong>for</strong>theexpressionsandtermsofthemixedcalculuscanbecomposedto<br />
10.3.1 generatestheMTBDDdescribedbyanexpressionortermofthemixedcalculus.<br />
Wepresentthesyntaxandsemanticsofthemixedcalculus.Inessential,thesyntaxof themixedcalculusarisesfromthesyntaxofthealgebraicmu-calculuswherethefunction Themixedcalculus<br />
symbolsarereplacedbyMTBDDs.Theexpressionsofthemixedcalculusareinterpreted bypartialfunctionsfromtheindividualvariablesintothereals;thesemanticsofthen-ary<br />
Syntaxofthemixedcalculus:WexsetsIndVarofindividualvariables,TermVarof n-bitvector. termsarepartialfunctionsthattakeastheirargumentstheindividualvariablesandan<br />
termvariableswhereeachtermvariableZisassociatedwithanarity(anaturalnumber binaryoperatorsontheextendedreals.Thesyntaxofmixedexpressionsandn-aryterms isgivenbytheproductionsystemshowninFigure10.7onpage287.Here,q2IRand 24ThereadernotfamiliarwithMTBDDsshouldrecallthedenitionofMTBDDswhichispresented<br />
1)andasetf#1;#2;:::gofdummyvariables.Asbe<strong>for</strong>e,Opdenotesasetoftotal<br />
inSection12.3(page315). containnonterminalverticeslabelledbyothervariables. 25Tobeprecisely,then-arytermsalsotakean-bitvectorasinput.Thus,theMTBDDs<strong>for</strong>themalso f0;1gn!IR.<br />
andconsider[expr]Masafunction(IndVar!D)!IRand[term]Masafunction(IndVar!D) 26Forthis,wesurpresstheinterpretationI(z)<strong>for</strong>theindividualvariablesofthealgebraicmu-calculus
10.3.A\COMPILER"FORTHEALGEBRAICMU-CALCULUS 287<br />
expr::=q Xz[expr] z expr1opexpr2 min z[expr] max term(z1;:::;zn)<br />
term::=Q Zjz1;:::;zn[expr] z[expr]<br />
iterateZ[term"kterm0] limZ[term"term0]<br />
op2Op.QisaMTBDDover(#1;:::;#n).z,z1;:::;zn2IndVarsuchthatz1;:::;znare Figure10.7:Syntaxofthemixedcalculus<br />
pairwisedistinct.Z2TermVarisann-arytermvariable.Freeandboundedoccurrences ofindividualortermvariablesinmixedexpressionsortermsaredenedintheobvious way.Fortheexpressionsterm(z1;:::;zn),werequirethattherearenofreeoccurrences oftheindividualvariablesziinterm.Amixedexpressionortermiscalledclosediit doesnotcontainfreeoccurrencesofindividualortermvariables.Forz=(z1;:::;zn), webrieywritePzorPz1;:::;znratherthanPz1:::Pzn.Similarly,minz,maxzorzhave theobviousmeanings.Themixedbooleancalculusisdenedinanalogytotheboolean mu-calculus(seepage261). Semanticsofthemixedcalculus:Intuitively,themixedexpressionsandtermsare interpretedbyfunctionswithvaluesintheextendedrealsandwhoseargumentsarethe thesemanticsofthemixedcalculusisdenedwithrespecttoaninterpretationJ<strong>for</strong>the n-arytermvariablesbyfunctionsf0;1gn!IR.Thesemantics n-bitvector(thatrepresentsthevaluesofthedummyvariables#1;:::;#n).Formally, individualvariables.Moreover,thefunctions<strong>for</strong>then-arymixedtermsdependonan<br />
ofthemixedexpressionsandtermswithrespecttoJisdenedbystructuralinductionas showninFigure10.8(page288).Here,isafunctionIndVar!f0;1gandhb1;:::;bni2 [expr]J:(IndVar!f0;1g)!IR;[term]J:(IndVar!f0;1g)f0;1gn!IR<br />
f0;1gn.[z1:=c1;:::;zk:=ck]denotesthosefunctionIndVar!f0;1gthatagreeswith onallindividualvariablesz2IndVarnfz1;:::;zkgandreturnsthevalueci<strong>for</strong>thevariable zi.27TheinterpretationJ[Z:=f]isdenedintheobviousway. 10.3.2 Givenanexpressionortermofthealgebraicmu-calculusandamodelM=(D;I)<strong>for</strong> thealgebraicmu-calculus,wedenean\equivalent"mixedexpressionorterm.This Inferencefromthealgebraictothemixedcalculus<br />
calculusarereplacedbyk-tuples(zz1;:::;zzk)ofindividualvariablesofthemixedcalculus.oftheelementsofDbyk-bitvectors.Theindividualvariableszofthealgebraicmu- inferencefromthealgebraicmu-calculustothemixedcalculusisbasedonanencoding 27Here,weassumethatz1;:::;zk2IndVararepairwisedistinctandthatc1;:::;ck2f0;1g.
288 CHAPTER10.SYMBOLICMODELCHECKING<br />
[q]J()=q [expr1opexpr2]J()=[expr1]J()op[expr2]J() [z]J()=(z)<br />
[Pz[expr]]J()=[expr]J([z:=0])+[expr]J([z:=1]) [term(z1;:::;zn)]J()=[term]J(;h(z1);:::;(zn)i)<br />
[maxz[expr]]J()=maxn[expr]J([z:=0]);[expr]J([z:=1])o [minz[expr]]J()=minn[expr]J([z:=0]);[expr]J([z:=1])o<br />
[z1;:::;zn[expr]]J(;hb1;:::;bni)=[expr]J([z1:=b1;:::;zn:=bn]) [Q]J(;hb1;:::;bni)=fQ(b1;:::;bn) [Z]J=J(Z)<br />
[iterateZ[term"kterm0]]J=fk [limZ[term"term0]]J=lim(f0;f1;f2;:::)<br />
Figure10.8:Semanticsofthemixedcalculus wheref0=[term0]J,fi+1=[term]J[Z:=fi].<br />
Whiletheindividualvariablezofthealgebraicmu-calculusisinterpretedbyanelement<br />
bythecorrespondingMTBDD.Thus,n-aryalgebraictermsaretranslatedinto(nk)-ary I(z)ofthedomainD,theindividualvariablezziofthemixedcalculusstands<strong>for</strong>thei-th<br />
mixedterms. componentofthebitvectorthatencodesI(z).Moreover,werepresenttheinterpretations I(fct):Dn!IR<strong>for</strong>then-aryfunctionsymbolsbyfunctionsf0;1gnk!IRandreplacefct<br />
functionsymbolfct,weassumearepresentationofthefunctionI(fct):Dn!IRbya functiond inf0;1gk,i.e.aninjectioncode:D!f0;1gk(wherek=dlogjDje).Foreachn-ary WexamodelM=(D;I)<strong>for</strong>thealgebraicmu-calculusandchooseanencodingofD I(fct):f0;1gnk!IR.Forinstance,wemayput<br />
<strong>for</strong>alld1;:::;dn2D.Ifbi2f0;1gk,i=1;:::;n,suchthatatleastonek-bittupebi I(fct)(code(d1);:::;code(dn))=I(fct)(d1;:::;dn) d<br />
ann-aryfunctionsymbolinthealgebraicmu-calculusthenweassociatewithfctthose isnotofthe<strong>for</strong>mcode(d)<strong>for</strong>somed2Dthenweputd MTBDDQfctover(#1;:::;#nk)wheretheinducedfunctionfQfctisd theindividualvariablesusedinthealgebraicmu-calculus.Then,inthemixedcalculus I(fct)(b1;:::;bn)=?.28Iffctis<br />
28NotethatalsootherrepresentationsofI(fct)byafunctionf0;1gnk!IRarepossible.E.g.ifn=2 I(fct).LetIndVarbe<br />
thend hc1;:::;cki=code(d2).<br />
I(fct)mightbedenedbyd I(fct)(b1;c1;:::;bk;ck)=f(d1;d2)wherehb1;:::;bki=code(d1)and
10.3.A\COMPILER"FORTHEALGEBRAICMU-CALCULUS weusetheindividualvariables 289<br />
Eachn-arytermvariableZofthealgebraicmu-calculusisviewedas(nk)-aryterm variableofthemixedcalculus.I.e.,inthemixedcalculus,wedealwithsetTermVar= IndVar=fzzi:z2IndVar;i=1;:::;kg:<br />
calculusismultipliedbythefactork.Foreachalgebraicexpressionexpr(ortermterm), letmixed(expr)(resp.mixed(term))bethosemixedexpression(orterm)thatresultsfrom expr(orterm)byreplacing TermVaroftermvariableswherethearityofeachtermvariableofthealgebraicmu-<br />
Wegetthe\equivalence"ofthealgebraicexpressions/termsandtheresultingmixed eachfunctionsymbolfctbytheMTBDDQfct. eachindividualvariablez2IndVarbytheindividualvariableszz1;:::;zzk,29<br />
expressions/termsinthefollowingsense.Let:IndVar!f0;1gbegivenby<br />
I(Z).Here,as<strong>for</strong>theinterpretationofthefunctionvariables,weassumeasuitable TheinterpretationJ<strong>for</strong>thetermvariablesofthemixedcalculusisgivenbyJ(Z)= d (zzi)=i-thcomponentofcode(I(z)).<br />
representationofthefunctionI(Z):Dn!IRbyafunctiond [expr]M=[mixed(expr)]J() I(Z):f0;1gnk!IR.Then,<br />
<strong>for</strong>anyalgebraicexpressionexpr.Foranyn-aryalgebraictermterm,wehave<br />
ItisknownthattheeciencyoftheMTBDD-basedapproachcruciallydependsonthe chosenvariableordering.HavingobtainedaMTBDDrepresentation<strong>for</strong>f=I(fct): [term]M(d1;:::;dn)=[mixed(term)]J(;hcode(d1);:::;code(dn)i):<br />
Dn!IR(resp.theassociatedfunctionbf:f0;1gnk!IR),well-knowntechniques (e.g.Rudell'ssiftingalgorithm[Rude93])canbeappliedtoimprovetherepresentation. ChangingthevariableorderingintheMTBDDcorrespondstoapermutationofthearExample10.3.1InExample10.1.9(page266)wepresentedanalgebraictermthatdegumentsofthefunctionbf:f0;1gnk!IR.InthenalMTBDD,thevariableshavetobescribesthe\naive"iteration<strong>for</strong>solvinglinearequationsystemsofthe<strong>for</strong>mz=q+Az.<br />
renamedresultinginaMTBDDover(#1;:::;#nk).<br />
There<strong>for</strong>mulationofthatalgebraictermasamixedtermisobtainedasfollows.For<br />
tion.Similarly,thevectorsq,z02IRncanbedescribedbyfunctionsf0;1gk!IRand simplicity,weassumethatAisan theindicesoftherowsandcolumnsofthematrixAbyk-bitvectorsanddescribeA byafunctionf0;1g2k!IR.LetAbetheMTBDDover(#1;:::;#2k)<strong>for</strong>thatfunc- n-matrixwheren=2k.Weuseanencoding<strong>for</strong><br />
representationsofA,qandz0dependsonthewayinwhichwerepresentA,qandz0 byfunctionsfrombitvectorsintothereals.Oftenthestandardencodingofintegers representedbyMTBDDsq,z0over(#1;:::;#k).ThesizeofthesoobtainedMTBDD<br />
Pzz1:::Pzzk.<br />
themixedcalculus,e.g.thesummationquantierPzinthealgebraicmu-calculushastobereplacedby 29Thereplacementofanindividualvariablezinaquantierrequiresmultipleuseofthatquantierin
290 i2f1;:::;ngbyk-bitvectorshb1;:::;bki2f0;1gkorderedmostsignicanttoleastsig- CHAPTER10.SYMBOLICMODELCHECKING<br />
columnsofquadraticmatricesisusedwhichleadstoarepresentationofAbyafunction nicant(i.e.i=1+Pkl=1bl2k�l)andaninterleavingoftheencodings<strong>for</strong>therowsand<br />
thestandardencoding<strong>for</strong>j(theindex<strong>for</strong>thecolumns).30Thevectorsqandz0mightbe wherehb1;:::;bkiisthestandardencodingofi(theindex<strong>for</strong>therows)andhc1;:::;cki f:f0;1g2k!IR;f(b1;c1;:::;bk;ck)=A(i;j)<br />
representedbyfunctionsf0;1gk!IRwherehb1;:::;bkiismappedtothei-thcomponent tationsofA,qandz0,thealgebraictermtermofExample10.1.9(page266)corresponds tothemixedtermlimZ[term"z0]where ofqresp.z0(ifhb1;:::;bkiisthestandardencodingofi).UsingtheseMTBDDrepresen-<br />
NotethatotherrepresentationsofA,q,z0byfunctionsfrombitvectorstotherealslead term= i1;:::;ik24q(i1;:::;ik)+X<br />
todierentMTBDDrepresentations,inwhichcasetheindividualvariablesil,jhinthe j1;:::;jk[A(i1;j1;:::;ik;jk)Z(j1;:::;jk)]35:<br />
abovemixedtermhavetobepermutated.Forinstance,ifwerepresentAbythefunction f0:f0;1g2k!IR,<br />
(wheretherstkargumentsoff0stand<strong>for</strong>therowwhilethelastkargumentsstand<strong>for</strong> f0(b1;:::;bk;c1;:::;ck)=A(i;j)wherei=1+kXl=1bl2k�l;j=1+kXl=1cl2k�l<br />
isthemixedterm thecolumn)thenwehavetodealwiththemixedtermlimZ[term0"z0]whereterm0<br />
i1;:::;ik24q(i1;:::;ik)+X<br />
above. Here,qandz0areasbe<strong>for</strong>e.A0istheMTBDDover(#1;:::;#2k)<strong>for</strong>thefunctionf0of j1;:::;jk[A0(i1;:::;ik;j1;:::;jk)Z(j1;:::;jk)]35:<br />
termswhereweuseMTBDDsasdatastructure<strong>for</strong>thefunctionsassociatedwiththe Wepresentanalgorithmtocomputethesemantics[:::]Jofthemixedexpressionsand 10.3.3 Computingthesemanticsofthemixedcalculus<br />
(i.e.aslabellings<strong>for</strong>thenonterminalnodes)intheMTBDDs. tionalmu-calculus.Theindividualvariablesandthedummyvariablesserveasvariables mixedexpressionsandterms.31Inessential,thealgorithmworkssimilartothealgorithm of[BCM+90]tocomputetheBDDrepresentations<strong>for</strong>the<strong>for</strong>mulasandtermsoftherela-<br />
limitoperator.Animplementationofourmethodmightsuerfromroundingerrors.Thus,theresulting <strong>for</strong>allstandardmatrixoperationsarederived[CFM+93]. 30Thisconventionimposesarecursivestructureonthematrixfromwhichecientrecursivealgorithms MTBDD<strong>for</strong>amixedexpressionortermcanbeviewedasanapproximation<strong>for</strong>thefunction[:::]J.<br />
31Clearly,thecorrectnessofourmethodisuptotheerrorsthatarisefromtheapproximations<strong>for</strong>the
292 CHAPTER10.SYMBOLICMODELCHECKING<br />
MtbddJ[z]denotestheBDD MtbddJ[q]denotestheMTBDDthatconsistsofaterminalvertexlabelledbyq.<br />
00�� �#1@@R<br />
MtbddJ[expr1opexpr2]=ApplyMtbddJ[expr1];MtbddJ[expr2];op 11<br />
MtbddJ[Pz[expr]]=ApplyMtbddJ[expr]jz=0;MtbddJ[expr]jz=1;+ MtbddJ[term(z1;:::;zn)]=MtbddJ[term]f#1 z1;:::;#n zng<br />
MtbddJ[maxz[expr]]=ApplyMtbddJ[expr]jz=0;MtbddJ[expr]jz=1;opmax MtbddJ[minz[expr]]=ApplyMtbddJ[expr]jz=0;MtbddJ[expr]jz=1;opmin<br />
MtbddJ[z1;:::;zn[expr]]=MtbddJ[expr]fz1 MtbddJ[Z]=J(Z)<br />
MtbddJ[limZ[term"term0]]denotestheMTBDDthatisreturnedby #1;:::;zn #ng<br />
MtbddJ[iterateZ[term"kterm0]]denotestheMTBDDthatisreturnedby Iterate(imax;Z;term;term0).<br />
Figure10.9:ComputingtheMTBDDs<strong>for</strong>themixedexpressionsandterms Iterate(k;Z;term;term0).<br />
algebraictermtermwithaMTBDDMtbddJ[term]overhIndVar[f#1;:::;#ng;
10.3.A\COMPILER"FORTHEALGEBRAICMU-CALCULUS 293<br />
i:=0;Q0:=MtbddJ[term0]; Repeat<br />
untili=imaxorB=z[1]; B:=MtbddJ[z[jQi�1(z)�Qi(z)j0andsomenaturalnumberimax(themaximalnumber ofiterations).TheprocedureIterate(imax;Z;term;term0)(showninFigure10.10on<br />
Here,wesupposeanextensionof+and ?q=q?=?<strong>for</strong>allq2IRnf0g,0?=?0=0and?+q=q+?=?<strong>for</strong>all Q0=MtbddJ[term0],Qi=MtbddJ[Z:=Qi�1][term],i=1;2;:::.<br />
q2IR.Theiterationterminatesifthemaximaldierencebetweenthefunctionvalues offQiandfQi�1islessthan,i.e.ifjfQi�1(b)�fQi(b)j< tooperatorsontheextendedrealswhere<br />
conditionisnotsatisedafterimaxiterationsthen, <strong>for</strong>thosebitvectorsbwherejfQi�1(b)�fQi(b)j :convergenceofthesequence <strong>for</strong>allb2f0;1gn.Ifthis<br />
(fQi(b))i0isnot\detected"andweassumethatthelimitoperatorontheextended realsreturns?,<br />
NotethattheBDDBrepresentsthe(characteristicfunctionofthe)set sequence(fQi(b))i0andreturnfQimax(b)asanapproximation<strong>for</strong>limfQi(b). <strong>for</strong>thosebitvectorsbwherejfQi�1(b)�fQi(b)j
294 Thus,thecondition\B=z[1]"isfulllediB=f0;1gnijfQi�1(b)�fQi(b)j
10.4 10.4.SYMBOLICMODELCHECKINGFORPROBABILISTICPROCESSES Symbolicmodelchecking<strong>for</strong>probabilisticpro- 295<br />
Attheendoftheprevioussection,wementionedthatthealgebraicmu-calculus(withthe MTBDD-basedmethod<strong>for</strong>computingthesemantics)yieldsasymbolicmodelchecker cesses<br />
<strong>for</strong>alllogicsthatarecontainedinthealgebraicmu-calculus;inparticular,weobtain asymbolicmodelchecker<strong>for</strong>PCTL.Inthissectionwehaveamoredetailedlookof<br />
beapplied<strong>for</strong>asymbolicmethodtodecidestrongorweakbisimulationequivalence<strong>for</strong> vericationmethods<strong>for</strong>probabilisticprocesses.Section10.4.2isconcernedwithPCTL modelchecking.InSection10.4.3webrieysketchhowtheMTBDD-basedapproachcan howtousethealgebraicmu-calculus(orthemixedcalculus)toobtainMTBDD-based<br />
fullyprobabilisticprocesses. 10.4.1 ThebasicideabehindtheMTBDD-approachistheuseasymbolicrepresentationof aprobabilisticsystembyMTBDDsasin[HarG98](seealso[BCH+97]).Inthefully RepresentingprobabilisticsystemsbyMTBDDs<br />
bybitvectorsoflengthk,thetransitionprobabilityfunctionP:S probabilisticcase,theideasofthenon-probabilisticcase[BCM+90,McMil92,CGL93] wheretransitionsystemsaredescribedintermsofBDDsthatrepresentbooleanfunctions<br />
oftheMTBDDrepresentationofthesystemdependsontheencodingofthestatesand viewedasafunctionf0;1g2k![0;1]anddescribedbyaMTBDD.Ofcourse,thesize (i.e.functionsfrombitvectorsintof0;1g)canbeadapted.Usinganencodingofthestates<br />
thechosenorderingofthevariablesintheMTBDD.Inmostcases,aninterleavingofthe S![0;1]canbe<br />
componentsofthebitvectors<strong>for</strong>thestartingstateandtheendstateofthetransitions yieldsanecientrepresentation.Thiscorrespondstothereplacementofthetransition probabilityfunctionPbythefunctionbP:f0;1g2k![0;1],<br />
wherehb1;:::;bkiistheencodingofstatesandhc1;:::;ckitheencodingofstatet. TheresultingMTBDDrepresentationcanbeimprovedusingwell-knowntechniqueslike bP(b1;c1;:::;bk;ck)=P(s;t)<br />
Rudell'ssiftingalgorithm[Rude93]orotherheuristics,seee.g.[FMK91,MKR92,BMS95].<br />
tothereceiver.Withprobability1 consideravariantofthesimplecommunicationprotocolofExample1.2.1(page19). Thesendersendsamessagetothemedium,whichinturntriestodeliverthemessage Example10.4.1[MTBDDrepresentationofthecommunicationprotocol]We<br />
triesagaintodeliverthemessage.Withprobability1 100,themessagesgetlost,inwhichcasethemedium<br />
simplicity,weassumethattheacknowledgementcannotbecorruptedorlost.Wedescribe orfaulty)messageisdeliveredthereceiveracknowledgesthereceiptofthemessage.For delivered);withprobability98 100,thecorrectmessageisdelivered.Whenthe(correct 100,themessageiscorrupted(but<br />
thesysteminasimpliedwaywhereweomitallirrelevantstates(e.g.thestatewhere states: thereceiveracknowledgesthereceiptofthecorrectmessage).Weusethefollowingfour sinit:thestateinwhichthesenderpassesthemessagetothemedium,
296 '- CHAPTER10.SYMBOLICMODELCHECKING<br />
sinit 00<br />
1 11stry1<br />
0:98<br />
serror 10 0:010:011 ? $<br />
����JHHj<br />
HYJHJJJJ<br />
%<br />
Figure10.12:Thesimplecommunicationprotocol slost 01<br />
serror:thestatereachedwhenthemessageiscorrupted slost:thestatereachedwhenthemessageislost, stry:thestateinwhichthemediumtriestodeliverthemessage,<br />
andtheencodingcode(sinit)=00,code(stry)=11,code(slost)=01,code(serror)=10. Then,theassociatedfunctionbP:f0;1g4![0;1]isgivenby: (b1;c1;b2;c2)7!8>: 1 0 100:ifb1c1b2c22f1011;1110g 100:ifb1c1b2c2=1010 98 1 :ifb1c1b2c22f0101;0111;1000g<br />
ThesystemandtheencodingsareshowninFigure10.12(page296);theMTBDDrepresentationinFigure10.13(page296).Thethicklinesstand<strong>for</strong>the\right"edges,thethin :otherwise.<br />
#2 nJJJJ^<br />
9 #1 nXXXXXXXXz#2 n<br />
#4 n #3 #4 n n= ZZZZZZ~ AAAAAU ? QQQQs#4<br />
n #4 n#3<br />
n<br />
�� �<br />
&-0 &- 1 0:98 @@R % 0:01%<br />
%<br />
� ��<br />
lines<strong>for</strong>the\left"edges. Figure10.13:TheMTBDDrepresentationofthesimplecommunicationprotocol<br />
beaniteaction-labelledfullyprobabilisticsystem.Weuseanencodingoftheactions<br />
Similarly,wecandealwithaction-labelledfullyprobabilisticsystems.Let(S;P;Act)
inf0;1gh(whereh=dlogjActje)andstatesinf0;1gkandreplacePbyafunction 10.4.SYMBOLICMODELCHECKINGFORPROBABILISTICPROCESSES 297<br />
DealingwithaconcurrentprobabilisticsystemS=(S;Steps),thesituationismore complicatesincetheoutgoingtransitionsofastatesaregivenbySteps(s)whichisaset bP:f0;1g2k+h![0;1]thatwerepresentbyaMTBDD.<br />
extendthei-thtransitionofsbyits\identicationnumber"ianddealwithatransition probabilityfunction ofdistributionsonthestatespaceS.<strong>On</strong>epossibilitytogetaMTBDD-representation ofSistoxanenumerations1;s2;:::;smsoftheoutgoingtransitionsofs.Then,we<br />
mmax=maxs2SjSteps(s)j)andsiisthei-thdistributioninSteps(s)accordingtothe whereId#stands<strong>for</strong>thesetofidenticationnumbers(e.g.Id#=f1;:::;mmaxgwhere S Id#S![0;1],(s;i;t)7!si(t)<br />
representedbyaMTBDD.Asfarastheauthorknows,whetherornotsuchaMTBDD- Then,usinganencoding<strong>for</strong>thestatesandidenticationnumbersbybitvectors,theabove functionSId#S![0;1]canbeviewedasafunctionfrombitvectorsintotherealsand xedenumerationofSteps(s).(Here,weputsi(t)=0<strong>for</strong>allt2Sifi>jSteps(s)j.)<br />
(orP:SActS![0;1]intheaction-labelledcase)inamorenaturalway.Thisisthe probabilisticsystemwhosetransitionscanbedescribedbyafunctionP:S isnotyetinvestigated.34However,itseemstobemuchsimplertorequireaconcurrent representationofaconcurrentprobabilisticsystemisecient<strong>for</strong>vericationpurposes<br />
3.3.11,page52).35Inthatcase,wecanusethesameideasas<strong>for</strong>non-probabilisticorfully case<strong>for</strong>stratiedsystems(cf.Notation3.2.4,page40)orreactivesystems(cf.Notation S![0;1]<br />
probabilisticsystemsanddealwithanencodingofthestates(andactions)bybitvectors whichturnstheabovetransitionprobabilityfunctionPintoafunctionfrombitvectors intotherealsandallows<strong>for</strong>anaturalsymbolicrepresentationbyaMTBDD.<br />
an\equivalent"booleantermbterm.Forthistrans<strong>for</strong>mation,weused1-aryfunction 10.4.2 InSection10.2.3(page279)wesawthatanyPCTL<strong>for</strong>mula Symbolicmodelchecking<strong>for</strong>PCTL<br />
symbolsSata(thatrepresentthesetsSat(a)=fs2S:a2L(s)g)andabinaryfunction symbolP(thatrepresentsthetransitionprobabilitymatrixP).Toobtainasymbolic canbetrans<strong>for</strong>medinto<br />
modelcheckingalgorithm<strong>for</strong>PCTL,wetranslatebtermintothemixedcalculusand applythealgorithmtocomputetheBDDrepresentation<strong>for</strong>mixed(bterm).Forthis,we<br />
stratiedsystems,wealsoneedaBDDSprobthatrepresentsthesetSprobofprobabilistic <strong>for</strong>the(characteristicfunctionsof)thesetSat(a)=fs2S:a2L(s)g.Dealingwith above.Moreover,<strong>for</strong>eachatomicpropositiona,weneedaBDDrepresentationSata needtheMTBDDrepresentationP<strong>for</strong>thetransitionprobabilitymatrixPasdescribed<br />
states.Then,themixedtermmixed(bterm)isobtainedfrombtermbyreplacingthe theindividualvariabless,t(thatweusedinthealgebraictermstorangeoverthestates) functionsymbolsSata,SprobandPbythecorresponding(MT)BDDsSata,SprobandP;<br />
seemtobequitecomplicatebecauseoftheauxiliary(meaningless)components<strong>for</strong>theidentication numbers. 34Theauthordoubtswhetheritis.TheoperatorsontheseMTBDDsthatwewouldhavetoper<strong>for</strong>m asconcurrentprobabilisticsystems.<br />
35RecallthatinSection3.2,page40,wearguedthatstratiedsystemshavethesameexpressiveness
298 byk-tuples(s1;:::;sk),(t1;:::;tk)ofindividualvariables(wheree.g.sistands<strong>for</strong>thei-th CHAPTER10.SYMBOLICMODELCHECKING<br />
basedonadescriptionofPbythefunctionbPthatinterleavesthebits<strong>for</strong>thestartingand endstateofthetransitionsthenanysubexpressionP(s;t)ofbtermhastobereplacedby componentoftheencodingofstates).Forexample,iftheMTBDDrepresentationPis P(s1;t1;:::;sk;tk).Weobtainaclosedmixedtermmixed(bterm)wheretheassociated<br />
Example10.4.2WeconsiderthesysteminExample10.4.1(page295).Weusetwo BDD{thatwegetbyapplyingthealgorithm<strong>for</strong>computingthesemanticsofthemixed<br />
atomicpropositionsa1,a2andthelabellingfunction calculus{representsthecharacteristicfunctionofSat()=fs2S:sj=g.36<br />
WeregardthePCTL<strong>for</strong>mula error=a1^:a2(i.e.Sat(error)=fserrorg), L(sinit)=;,L(stry)=fa1;a2g,L(slost)=fa2g,L(serror)=fa1g.<br />
del=:a1^:a2(i.e.Sat(del)=fsinitg). =Prob>0:989898(')where'=:errorUdeland<br />
>0:989898wheninterpretedoverthestatestry.Wedescribehowourmethodworksto gettheBDD<strong>for</strong>thePCTL<strong>for</strong>mula.Forthis,werstconstructtheMTBDD<strong>for</strong>the path<strong>for</strong>mula'.Thealgebraictermterm'is(moreprecisely,canbere<strong>for</strong>mulatedto) Intuitively, statesthatthemessagewilleventuallybedeliveredwithsomeprobability<br />
Hence,wegetthemixedtermlfpZ[s1;s2[expr]]whereexpris lfpZ"s"max(Satdel(s);(1�Saterror(s)) Xt[P(s;t)Z(t)]!)##<br />
Then,ouralgorithmappliedtothatmixedtermusestheprocedureIterate()(see Figure10.10,page293)whichsuccessivelycomputestheMTBDDsQ0;Q1;Q2;:::<strong>for</strong>the max8
10.4.SYMBOLICMODELCHECKINGFORPROBABILISTICPROCESSES #1 299<br />
0#21��1@@@R-0 ? ��<br />
0 1 #20 #1<br />
0 1 1<br />
? � ��� @@@R-<br />
1 0<br />
Figure10.14:TheBDDsCandSatdel<br />
#2 #1<br />
0 �0��<br />
��@@@R<br />
11 1<br />
1��� @@@R ����#2@@@R0<br />
Figure10.15:TheMTBDDQ3<strong>for</strong>themixedtermterm3 0:98 0<br />
todenoteafunctionf:f0;1g2!IR.Notethat whereweusethevectornotation(f(0;0);f(0;1);f(1;0);f(1;1))(writtenasacolumn)<br />
fQi+1(0;0)=1asfSatdel(0;0)=1, fQi+1(1;0)=0asfB(1;0)=0andfSatdel(1;0)=0, fQi+1(0;1)=fQi(1;1)asfB(0;1)=1,fSatdel(0;1)=0and<br />
fQi+1(1;1)=98 fP(0;c1;1;c2)=(1:ifc1c2=11<br />
asfB(1;1)=1,fSatdel(1;1)=0and 100fQi(0;0)+1 100fQi(0;1)+1 0:otherwise 100fQi(1;0)<br />
fP(1;c1;1;c2)=8>:98 0 100:ifc1c2=00 100:ifc1c22f01;10g 1<br />
someMTBDDQiasanapproximation<strong>for</strong>thefunctions7!ps(')whichisgivenby Forinstance,theMTBDDQ3isshowninFigure10.15(page299).Ouralgorithmreturns :ifc1c2=11.<br />
pslost(')=pstry(')=98<br />
plainedabove)andthenevaluatesthemixedterm ForthePCTL<strong>for</strong>mula algorithmcomputestheMTBDDQ<strong>for</strong>'(asex- =Prob>0:989898('),our 99,pserror(')=0andpsinit(')=1. #1<br />
whichyieldstheBDDshownontheright. s1;s2[Q(s)>0:989898] 0@@@R� 1 1<br />
1?<br />
��� #2@@@R00
300 10.4.3 Decidingbisimulationequivalence CHAPTER10.SYMBOLICMODELCHECKING<br />
systemcanbecharacterizedasthegreatestxedpointofamonotonicset-valuedoperator Inthenon-probabilisticcase,thesetofbisimulationequivalenceofalabelledtransition [Miln89].IfSisthestatespacethenthesetofbisimulationequivalenceclassesisthe greatestxedpointofF:2SS!2SSwhereF(Z)isthesetofpairs(s;s0)2Zsuch that,<strong>for</strong>alla2Act:<br />
<strong>On</strong>thebasisofTarski'sxedpointtheorem,thisobservationleadstoaniterativemethod (2)s0a (1)sa �!timpliess0a �!t0impliessa �!t0<strong>for</strong>somet02Swith(t;t0)2Z<br />
<strong>for</strong>computingthebisimulationequivalencerelation: �!t<strong>for</strong>somet2Swith(t;t0)2Z.<br />
Clearly,eachoftherelationsFi(S S,thesetF(Z)consistsofallpairs(s;s0)2Zsuchthat,<strong>for</strong>alla2Actandt2S: =gfp(F)=\i0Fi(S S)isanequivalence.ForZtobeanequivalenceon S):<br />
Burchetal[BCM+90](seealso[EFT93])takeupthischaracterizationof bythefollowingtermoftherelationalmu-calculus sa �!t0<strong>for</strong>somet02Swith(t;t0)2Zis0a �!t0<strong>for</strong>somet02Swith(t;t0)2Z.<br />
bterm=gfpZ[s;s0[8a8t[bexpr]]] anddescribe<br />
yieldsasymbolicmethod<strong>for</strong>computingbisimulationequivalenceclasses. theBDD-basedmethodof[BCM+90]toevaluatethetermsoftherelationalmu-calculus wherebexpris9t0[Z(t;t0)^R(s;a;t0)] $ 9t0[Z(t;t0)^R(s0;a;t0)]:37Thus,<br />
denitionofbisimulationequivalence<strong>for</strong>probabilisticsystems.38Weconsideranite action-labelledfullyprobabilisticorreactivesystemS=(S;Act;P)anduseaternary functionsymbolPtorepresentP.Asinthenon-probabilisticcase,bisimulationequiv- Wenowexplainhowthisideacanbeadapted<strong>for</strong>theprobabilisticcase.Recallthe<br />
<strong>for</strong>alla2Actandt2S:Xt02S<br />
theoperatorF:2SS!2SSwhereF(Z)isthesetofallpairs(s;s0)2Zsuchthat, alencecanbedescribedasthegreatestxedpointofanoperatoron2SS.Weconsider<br />
First,weobservethat{incontrasttothenon-probabilisticcase{thisoperatorisnot monotonic.Forinstance,considerthesystemshowninFigure10.16(page301).LetZbe (t;t0)2ZP(s;a;t0)=Xt02S (t;t0)2ZP(s0;a;t0):<br />
thesmallestequivalencerelationonSthatcontains(s;s0)andthatidentiesthestates andtheset v1,v2,v0andZ0=Z[f(v0;u0)g.Then,wehaveZ instance,(s;s0)2F(Z)nF(Z0).Toseewhy(s;s0)=2F(Z0)considerthestatet=v0 Z0whileF(Z)6F(Z0).For<br />
�!SActS. 38SeeSection3.4.1,Denition3.4.1(page54)andDenition3.4.2(page54).<br />
37Here,Risaternarypredicate(function)symbolthatrepresentstheunderlyingtransitionrelation T=ft02S:(t;t0)2Z0g=ft02S:(v0;t0)2Z0g=fv1;v2;v;u0g:
10.4.SYMBOLICMODELCHECKINGFORPROBABILISTICPROCESSES s 301<br />
v1a,14 s0<br />
������ v2 ? a,14 @@@@@R a,12u v0 a,12 JJJJJ^ a,12<br />
Figure10.16: u0<br />
booleanterm40gfpZ[s;s0[8a8t[bexpr]]]wherebexpris Then,P(s;a;T)=12
302 wecanusethealgebraicmu-calculustodescribe(avariantof)thealgorithmproposed CHAPTER10.SYMBOLICMODELCHECKING<br />
inSection7.2(page164).TheresultingMTBDD-basedmethodjustusesiterationson boolean-valuedfunctionstocomputeleastxedpointsofmonotonicset-basedoperators (ratherthaniterationsonreal-valuedfunctions).42Forthis,weuseavariantoftheresults<br />
deneamonotonicoperatorGontheequivalencerelationsonSasfollows.LetZbean andwhereanalternativecharacterizationofbranchingbisimulationisusedasbasis<strong>for</strong> analgorithmtocomputethebranching(orweak)bisimulationequivalenceclasses.We presentedinChapter7whereweakandbranchingbisimulationareshowntobethesame<br />
equivalencerelationonS.Then,<br />
where(a;C)rangesoverallpairs(a;C)2Act G(Z)=\a;Cf(s;s0):sands0arecontainedinthesameblockofRene(S=Z;a;C)g<br />
relationonSthatidentiesalldivergentstates(statesthatcannotreachastatewherea isdenedasinNotation7.2.13(page168).TheinitialrelationZinitisthoseequivalence visibleactioncanbeper<strong>for</strong>med)andallnon-divergentstates,i.e. S=ZandwheretheoperatorRene()<br />
whereDivisthesetofdivergentstates(seeDenition7.2.14,page168).Then, Zinit G(Zinit) Zinit=Div G(G(Zinit)) Div[(SnDiv)(SnDiv)<br />
Thus,theBDDrepresentation<strong>for</strong> correspondingtothefollowingbooleanterm. canbeobtainedbyevaluatingthemixedterm :::and =Gi(Zinit)<strong>for</strong>somei.<br />
InitandGZarebooleantermsthatrepresentthesetsZinitandG(Z).Forthedenitionof InitandGZweusethenotations(i.e.expressionsofthe<strong>for</strong>mterm(1;:::;n))explained limZ[s;s0[GZ(s;s0)"Init]]<br />
ofInitweusethefollowingfact.SnDivistheleastsetY onpage267.Moreover,weuseexpressionslike\a6="(whereaisanindividualvariable Eisan1-aryfunctionsymbolthatrepresentsthesingletonsetfg.Forthedenition and2Actthesymbol<strong>for</strong>theinternalaction)todenotethebooleanterm:E(a)where<br />
(thesetofstateswhereavisibleactioncanbeper<strong>for</strong>med)and,whenevert2Y,a2Act Vis=fs2S:P(s;)>0<strong>for</strong>some2Actnfgg Sthatcontains<br />
whereVis=s[9a9t[(a6=)^(P(s;a;t)>0)]]and andP(s;a;t)>0thens2Y.WedeneInitby<br />
Vis=lfpY[s[Vis(s)_9a9t[Y(t)^(P(s;a;t)>0)]]: Init=s;s0[Vis(s)$Vis(s0)]<br />
ThedenitionofGZreliesonthefollowingobservation.43LetZbeanequivalencerelation onS.WedenePZ(s;a;t)=P(s;a;[t]Z)andSZ=fs2S:P(s;;[s]Z)
SplitZbethesetofpairs(s;s0)2Zwheres,s02SZand,<strong>for</strong>alla2Actandt2S:if 10.4.SYMBOLICMODELCHECKINGFORPROBABILISTICPROCESSES 303<br />
a6=or(s;t)=2Zthen<br />
AZdenotestherelationconsistingofthosepairs(s;t)2Zwhereeither(s;t)2SplitZor 1�PZ(s;;s)= PZ(s;a;t) 1�PZ(s0;;s0): PZ(s0;a;t)<br />
i=0;:::;k�1and(sk;t)2SplitZ.Alternatively,AZcanbedescribedastheleastxed pointoftheoperatorH:2SS!2SS, thereexistsanitepath =s0!s1!:::!sksuchthatk 1,s0=s,si2SnSZ,<br />
toseethat(s;t)2BZit2SZands,tbelongtothesameblockofRene(S=Z;a;C) BZisthesetofpairs(s;t)2AZsuchthat(s;t0)2AZimplies(t;t0)2SplitZ.Itiseasy H(X)=SplitZ[f(s;t):s=2SZ^9u2S[(P(s;;u)>0)^(u;t)2X]g:<br />
<strong>for</strong>any(a;C)2Act t2Swith(s;t)2BZ,then G(Z)=f(s;s0)2Z:s;s02ResZ_9t[(s;t);(s0;t)2BZ]g: S=Z.Thus,ifResZisthesetofallstatess2Swherethereisno<br />
Fromthis,wederivethedenitionofthealgebraictermGZ.Wedene<br />
whereweusethefollowingauxiliaryalgebraic(orboolean)terms. GZ= s;s0[Z(s;s0)^((ResZ(s)^ResZ(s0))_9t[BZ(s;t)_BZ(s0;t)])]<br />
P0Z=s;a;t[PZ(s;a;t)%(1�PZ(s;;s))], PZ=s;a;t[Pu[Z(t;u)P(s;a;u)]], SZ=s[PZ(s;;s)0)^X(u;t)]]], SplitZ=s;s0[Z(s;s0)^SZ(s)^SZ(s0)^<br />
BZ=s;t[AZ(s;t)^8t0[AZ(s;t0)!SplitZ(t;t0)]], 8a8t[((a6=)_:Z(s;t))!(P0Z(s;a;t)=P0Z(s0;a;t))]],<br />
ResZ=s[:9t[BZ(s;t)]].
304 CHAPTER10.SYMBOLICMODELCHECKING
Chapter11<br />
Concludingremarks<br />
Insummary,whentheauthorstartedtoworkonprobabilisticsystemsintheendof1995, alotofexcellentresearchhadalreadybeendoneinthiseld.Inthisthesis,shetriedto thatarecloselyrelatedtothetopicsofthisthesiswementionjustafew. <strong>On</strong>lyafewresearchhasbeendonesofarinthedevelopmentofalgorithmicmethods<strong>for</strong> llafewgapsbuttherearestillavarietyofinterestingopenquestions.Amongthose<br />
systems(e.g.weakorbranchingbisimulationalaSegala&Lynch[SeLy94]).Thisismost establishinganimplementationrelationbetweentwosystems;inparticular,theliterature (still)lacks<strong>for</strong>algorithmsthatcancheckaweakequivalence<strong>for</strong>concurrentprobabilistic important<strong>for</strong>themechaniseddesignandthesystemanalysissincetheweakrelationsare level"system(theimplementation)andthatplayacrucialroletoreducethestatespacethosethatareneededtocomparea\high-level"system(thespecication)anda\lowanalternativecharacterizationofweakbisimulationequivalencebymeansofthemini- byabstraction.RecentworkbyPhilippou,Sokolsky&Lee[PSS98]andbyStoelinga,<br />
mal/maximalprobabilitiesofcertaineventsunderalladversaries.Stoelinga&Vaandrager Vaandragerandtheauthor[BSV98]arerstattemptsinthisdirection.[PSS98]present<br />
[StVa98]proposetoadapttheconceptofnormedsimulations[GriVa98]<strong>for</strong>theprobabilis- analgorithm<strong>for</strong>decidingweakbisimulationequivalence<strong>for</strong>stratiedsystemswhichuses<br />
ticsettingthusyieldingaquitesimplecharacterizationofbranchingsimulations.Itseems tobethecasethatthischaracterizationcanserveasthebasisofanalgorithm<strong>for</strong>checking whethertwoconcurrentprobabilisticsystemsarebranching(bi-)similar[BSV98]. Anopenproblemthatconcernsthedesignofprobabilisticsystemsisthequestionwhether satisabilityofPCTL(orthefulllogicPCTL)isdecidablewithrespecttoanyofthe<br />
[EmCl82,MaWo84,AtEm89,PnRo89]). satisfactionrelations.Possibly,adecisionprocedure<strong>for</strong>satisabilitymightserveasa basis<strong>for</strong>anautomaticsynthesisofprobabilisticprocessesfulllingagivenspecication<br />
Eventhoughalgorithmicverication<strong>for</strong>establishingqualitativeorquantitiveproperties inthe<strong>for</strong>mofasatisablePCTL<strong>for</strong>mula(asitisthecase<strong>for</strong>non-probabilisticsystems<br />
<strong>for</strong>concurrentsystemsareknown,<strong>for</strong>realisticapplications,thecompleteness<strong>for</strong>double exponentialtime<strong>for</strong>LTLmodelcheckingintheconcurrentprobabilisticcase(shown methodisbasedonaGreedyalgorithmandrunsinsingleexponentialtimeandneeds byCourcoubetis&Yannakakis[CoYa95])seemstobefatal.In[BKN98],weproposea method<strong>for</strong>computinglowerandupperbounds<strong>for</strong>thevaluespmax s(')andpmin s(').This<br />
305
306 polynomialspace.Intheworstcase,theobtainedboundsmightbefarawayfromthe CHAPTER11.CONCLUDINGREMARKS<br />
bedesirabletohaveecientmethods(PTASs)thatapproximatethevaluespmax ofthismethodhasstilltobeworkedoutonthebasisofexperimentalresults.Itwould precisevalues;e.g.itispossibletoobtain0aslowerand1asupperbound.Thequality<br />
explosionproblem<strong>for</strong>probabilisticsystemsconcernstheMTBDDapproach[CFM+93, pmin Mostresearchthathasbeendonesofarintheeldofmethodsthatattackthestate s('). s(')and<br />
HMP+94,BCH+97,HarG98].Itwouldbeinterestingwhetherthepartialorderreduction techniques[Pele93,Valm94,Gode94]canbemodied<strong>for</strong>(concurrent)probabilisticsystems.RecentworkbyBiereetal[BCC+98]showsthat,<strong>for</strong>non-probabilisticsystems, symbolicLTLmodelcheckingisalsopossiblewithoutBDDs,usingareductiontothe satisabilityproblem<strong>for</strong>propositionallogic.Itwouldbeveryinterestingwhethersimilar ideas(e.g.usingarithmeticequationsratherthanpropositional<strong>for</strong>mulas)areapplicable<br />
space.Firstattemptsinthisdirectionaretheinvestigationofprobabilisticlossychannel Anotherinterestingpointistheinvestigationofprobabilisticsystemswithaninnitestate <strong>for</strong>probabilisticsystems.<br />
systems(PLCSs);see[IyNa97]whereanappoximativemethod<strong>for</strong>verifyingquantitative propertiesisproposedand[BaEn98]whereitisshownthatqualitativeLTLmodelcheck- LCS(andissolvablewiththemethodsof[AbJo93]).<br />
ing<strong>for</strong>PLCSscanbereducedtoareachabilityproblemintheunderlyingnon-probabilistic
Chapter12<br />
Appendix<br />
Inthischapterwerecallsomedenitionsandmethodsoftheliterature.Section12.1 summarizesthenecessarybackgroundthatweneed<strong>for</strong>thedenotationalsemanticsin<br />
chapter. Chapter5.Section12.2brieyexplainsournotationsconcerningorderedbalancedtrees, Section12.3recallsthedenitionofMTBDDs.Thenotationsintroducedinoneofthe Sections12.1,12.2or12.3arenotusedwithoutareferencestotherelevantpartsofthis<br />
12.1 models Mathematicalpreliminaries<strong>for</strong>thedenotational<br />
InChapter5weusethestandardproceduretogivedenotationalsemanticsinthemetric<br />
12.1.1,12.1.2and12.1.3.InSection12.1.4,webrieyrecallthenotionofan\evaluation" methods<strong>for</strong>solvingrecursivedomainequations.ThesearebrieysummarizedinSections needsomebasicnotionsofdomaintheory,thetheoryofmetricspacesandcategorical andpartialorderapproachandtheprobabilisticpowerdomainofevaluations.Here,we<br />
12.1.1 onatopologicalspaceasintroducedbyJones&Plotkin[JoPl89,Jone90].<br />
detailscanbefounde.g.in[GHK+80,AbJu94,SLG94]. Webrieyrecallsomebasicnotionsofdomaintheoryandexplainournotations.Further Basicnotionsofdomaintheory<br />
Preordersandpartialorders:ApreorderonasetDisabinaryrelationonDwhich<br />
byvDorshortlyv.ApointedposetisaposetDwhichhasabottomelement(denoted ordervonD(i.e.visanantisymmetricpreorderonD).WeoftenwriteDinsteadof (D;v).IfnothingelseissaidthentheunderlyingpartialorderofaposetDisdenoted isreexiveandtransitive.Aposetisapair(D;v)consistingofasetDandapartial<br />
XisnonemptyandX#=X.Similarly,XiscalledrightclosedorupwardclosediXis putX#=Sx2Xx#andX"=Sx2Xx".Xiscalledleftclosedordownwardclosedi by?Dorshortly?),i.e.?vx<strong>for</strong>allx2D.IfDisaposetandx2Dthenweput x#=fy2D:yvxgandx"=fy2D:xvyg.LetXbeasubsetofaposetD.We<br />
307
308 nonemptyandX"=X.Anelementx02DiscalledanupperboundofXixvx0 CHAPTER12.APPENDIX<br />
<strong>for</strong>allx2X.x0iscalledtheleastupperboundofXix0isanupperboundofXsuch denotedbyFXorlub(X).XiscalleddirectedieverypairofelementsinXhasan thatx0vy<strong>for</strong>eachupperboundyofX.TheleastupperboundofX(ifitexists)is<br />
calledadirected-completepartialorder(shortlydcpo).1A!-chaininadcpoDisan upperbound. Dcpo's:ApointedposetinwhicheachdirectedsubsetXhasaleastupperboundis innitemonotonesequenceinD,i.e.asequence(xn)n0inDsuchthatx0vx1v:::. For(xn)n0tobea!-chain,wewriteFn0xnorbrieyFxntodenotetheleastupper<br />
calledmonotoneixvDyimpliesf(x)vD0f(y).fiscalledd-continuousi,<strong>for</strong>each d-continuityandstrictness:LetD,D0bedcpo'sandf:D!D0afunction.fis boundoffxn:n 0g.<br />
directedsubsetXofD,f(FX)=Ff(X).(Inparticular,iffisd-continuousthenfis monotone.)fiscalledstrictif(?D)=?D0. Tarski'sxedpointtheorem:2WheneverDisadcpoandf:D!Dad-continuous functionthenfhasaleastxedpointlfp(f).Moreover,lfp(f)=Ffn(?).<br />
topologywhoseclosedsetsarethedownward-closedandlub-closedsubsetsofD.ForAtobeanonemptysubsetofD,AcldenotestheScott-closureofA,i.e.thesmallestScott- Scott-Topology:AsubsetAofadcpoDiscalledlub-closedi<strong>for</strong>everydirectedsubset XofAwehaveFX2A.WealwayssupposeadcpoDtobeequippedwiththeScottclosedsubsetcontainingA.Wedene;cl=f?g.Then,<strong>for</strong>Atobeniteandnonempty, Acl=A#.<br />
Continuousdomains:Letx,ybeelementsofadcpoD.Wesayyapproximatesx Scott-closedsubsetsofDorderedbyinclusion. Hoarepowerdomain:IfDisadcpothenPowHoare(D)isthedcpoofnonemptyand<br />
subsetBofDsuchthat<strong>for</strong>eachx2DthesetB\Approx(x)containsadirectedsubset withleastupperboundx.Acontinuousdomainisadcpowhichhasabasis. i<strong>for</strong>alldirectedsubsetsXofD,xvFXimpliesyvz<strong>for</strong>somez2X.Approx(x) denotesthesetofelementsy2Dsuchthatyapproximatesx.AbasisofadcpoDisa<br />
Functionspaces:IfXisasetandDadcpothenthefunctionspaceX!D(ofall functionsf:X!D)issupposedtobeequippedwiththepartialorderf1vf2i thefunctionX!D,x7!?Dandwhere,<strong>for</strong>eachdirectedsetoffunctionsf:X!D, f1(x)vDf2(x)<strong>for</strong>allx2D.NotethatX!Disagainadcpowhosebottomelementis theleastupperboundFisgivenby:(F)(x)=Fff(x):f2g.Inparticular,if (fn)isa!-chaininX!Dthen(Ffn)(x)=Ffn(x).<br />
whichexist<strong>for</strong>allnonemptysubsetsof[a;b]orsequencesin[a;b].Weconsiderthefunction \inf"todenoteleastupperbounds(suprema)orgreatestlowerbounds(inma)in[a;b] ThefunctionspaceX![a;b]:Clearly,anycompactinterval[a;b]ofrealnumbers (wherea
12.1.PRELIMINARIESFORTHEDENOTATIONALMODELS spaceXequippedwiththeinducedorder, 309<br />
supi2Ifiorbrieysupfi)denotesthefunctionX![a;b],x7!supf2f(x).Similarly, inff2f(orinfi2Ifiorbrieyinffi)denotesthefunctionX![a;b],x7!inff2f(x). alsodenotedby,asexplainedbe<strong>for</strong>e,i.e.f =ffi:i2Igisanonemptyfamilyoffunctionsf:X![a;b]thensupf2f(or f0if(x) f0(x)<strong>for</strong>allx2[a;b].If<br />
WesaythatafunctionF:(X![a;b])!(X![a;b])preservessupremai,<strong>for</strong>all nonemptysets offunctionsf:X![a;b],<br />
Similarly,Fpreservesinmai,<strong>for</strong>allnonemptysets F sup f2f!=sup f2F(f):<br />
Proposition12.1.1LetF:(X![a;b])!(X![a;b])beamonotoneoperator.Then, F(inff2f)=inff2F(f). offunctionsf:X![a;b],<br />
Fhasagreatestxedpointgfp(F)andaleastxedpointlfp(F).gfp(F)andlfp(F)are givenby whereF=ff:X![a;b]:f preservesinmathen gfp(F)=sup f2Ff;lfp(F)=inf F(f)g,F=ff:X![a;b]:f f2Ff<br />
gfp(F)=inf n0Fn(fb) F(f)g.IfF<br />
wherefb(x)=b<strong>for</strong>allx2X.Similarly,ifFpreservessupremathenlfp(F)= Proof: supn0Fn(fa)wherefa(x)=a<strong>for</strong>allx2X.<br />
Remark12.1.2Forhigher-orderoperatorswithmorethanone(function)arguments, e.g.operatorswhoseargumentsarepairshf;giwheref:X![a;b]andg:Y![c;d] easyverication.<br />
arefunctions,monotonicityisnotasucientcondition<strong>for</strong>theexistenceofleast/greatest holds.Formally,letk (resp.least)xedpointsexistsandananaloguetothesecondpartofProposition12.1.1 xedpoints.3Nevertheless,iftheoperatorpreservesinma(resp.suprema)thengreatest<br />
isafunction.Thepartialorder numberssuchthatai
310 12.1.2 Metricspaces CHAPTER12.APPENDIX<br />
seee.g.[Dugu66,Suth77,Enge89].Webrieyrecallthedenitionsthatweareusedin Basicnotionsconcerningmetricspacescanbefoundinanystandardbookabouttopology,<br />
suchthat,<strong>for</strong>allx,y,z2M, thatthesisandexplainournotations. Metricandultrametricspaces:AmetriconasetMisafunctiond:MM![0;1]<br />
An(ultra-)metricspaceisapair(M;d)consistingofasetMandan(ultra-)metricdon Ametricdiscalledanultrametrici,<strong>for</strong>allx,y,z2M,d(x;z) d(x;y)=d(y;x),d(x;y)=0ix=y,d(x;z) d(x;y)+d(y;z).<br />
M.WeoftenwriteMratherthan(M;d)andrefertodasthedistanceonM.Wealways supposethattheunderlyingdistanceonametricspaceM{whichwealwaysdenoteby maxfd(x;y);d(y;z)g.<br />
dMorshortlyd{satisesd Non-expansiveandcontractingfunctionsandembeddings:Letf:M!M0 beafunction.fiscallednon-expansiveidM0(f(x);f(y)) 1.Inwhatfollows,letM,M0bemetricspaces.<br />
M.fiscalledcontractingithereexistsarealnumberCwith00thereexistsN N.If(xn)isasequenceinMandx2Mthenxiscalledthelimitof 0withd(xn;xm)<br />
convergingor(xn)convergestox.AsubsetXofMiscalleddenseinMi,<strong>for</strong>each x2X,thereisaconvergingsequence(xn)n0inXsuchthatx=limxn. <strong>for</strong>alln N.Asinstandardanalysis,iflimxnexiststhenwesay(xn)is 0with<br />
andanembeddinge:M!M0suchthate(M)isdenseinM0.Ifeisunderstoodfrom thecontext(ornotofinterest)thenwebrieysaythatM0isacompletionofM. completionofametricspaceMisapair(M0;e)consistingofacompletemetricspaceM0 Completeness:MiscalledcompleteieachCauchysequenceinMhasalimit.A<br />
Banach'sxedpointtheorem:Eachcontractingfunctionf:M!Monacomplete Cauchysequencewithx(f)=limfn(x). Functionspaces:IfXisasetandMcompletethenthefunctionspaceX!M metricspaceMhasauniquexedpointx(f).Moreover,<strong>for</strong>eachx2M,(fn(x))isa<br />
equippedwiththedistanced(f1;f2)=sup x2MdM(f1(x);f2(x))
12.1.PRELIMINARIESFORTHEDENOTATIONALMODELS isalsoacompletemetricspace.ForeachCauchysequence(fn)inX!M,thelimit 311<br />
limfn:X!Misgivenby(limfn)(x)=limfn(x). ThepowerdomainPowcomp(M):AsubsetXofMiscalledcompactieachinnite sequenceinXcontainsaconvergentsubsequencewhoselimitbelongstoX.Powcomp(M) denotesthecollectionofcompactsubsetsofM.IfMiscompletethenPowcomp(M) equippedwiththeHausdormetric<br />
isacompletemetricspace(see[Kura56]). d(X;Y)=max(sup x2Xinf y2Yd(x;y);sup y2Yinf x2Xd(x;y))<br />
12.1.3 WebrieyexplainthemethodsofRutten&Turi[RuTu93]andAbramsky&Jung [AbJu94]<strong>for</strong>solvingrecursivedomainequations<strong>for</strong>metricspacesordcpo's.Werefer Categoricalmethods<strong>for</strong>solvingdomainequations<br />
theinterestedreaderto[SmPl82,MajC88,AmRu89,MajC89,MaZe91,EdSm92,Barr93] <strong>for</strong>morein<strong>for</strong>mationsabouthowtosolverecursivedomainequations.Forthedenitionof categoriesandfunctors(andotherrelatednotions)seee.g.[McLan71,AHS90,BaWe90]. Coalgebrasandxedpointsoffunctors:LetCatbeacategoryandF:Cat!Cata functor.AcoalgebraofFisapair(X;e)consistingofanobjectXofCatandamorphism<br />
(X;e)ofFsuchthateisanisomorphisminCat.Axedpoint(X;e)ofFiscalled e:X!F(X)inCat.Acoalgebra(X;e)ofFiscallednaliitisanalobjectin morphismf:X0!XinCatwithF(f)e0=ef.AxedpointofFisacoalgebra thecategoryofallcoalgebras,i.e.i<strong>for</strong>eachcoalgebra(X0;e0)ofFthereexistsaunique<br />
inCatwithF(f)e0=ef.FinalcoalgebrasofFarealwaysnalxedpoints(see e.g.[RuTu93]).Axedpoint(X;e)ofFiscalledinitiali<strong>for</strong>eachxedpoint(X0;e0) ofFthereexistsauniquemorphismf:X!X0inCatwithF(f)e=e0f.We nali<strong>for</strong>eachxedpoint(X0;e0)ofFthereexistsauniquemorphismf:X0!X<br />
(X0;e0)ofFthereexistsauniqueisomorphismf:X!X0inCatwithF(f)e=e0f. ornotofinterestthenweshortlywriteXinsteadof(X;e). Iftheunderlying(iso-)morphismeofacoalgebraorxedpointisclearfromthecontext say(X;e)istheuniquexedpointofFi(X;e)isaxedofFand<strong>for</strong>eachxedpoint<br />
Categoriesusedinthatthesis:<br />
CONT?thecategoryofcontinuousdomainsandstrict,d-continuousfunctions. CUMthecategoryofcompleteultrametricspacesandnon-expansivefunctions, SETdenotescategoryofsetsandfunctions,<br />
continuous.Here,D�!strict&dcontD0denotesthesetofstrictandd-continuousfunctions CONT?!CONT?iscalledlocallyd-continuousif,<strong>for</strong>allcontinuousdomainsD,D0, Categoricalmethods<strong>for</strong>solvingrecursivedomainequations:AfunctorF:<br />
oflocallyd-continuousfunctorsCONT?!CONT?islocallyd-continuous.Asshownin fromDtoD0(i.e.thesetofCONT?-morphismfromDtoD0).Clearly,thecomposition thefunction(D�!strict&dcontD0)!(F(D)�!strict&dcontF(D0)),f7!F(f),isd-<br />
point.<br />
[AbJu94],eachlocallyd-continuousfunctorF:CONT?!CONT?hasaninitialxed
312 LetF:CUM!CUMbeafunctor.ForM,M0tobecompleteultrametricspaces, CHAPTER12.APPENDIX<br />
completeultrametricspacesM,M0andallnon-expansivefunctionsfi:M!M0, numberCwith0 CUM-morphismfromMtoM0.Fiscalledlocallycontractingithereexistsareal M�!nexpM0denotesthesetofnon-expansivefunctionsM!M0,i.e.thesetof<br />
i=1;2,i.e.ithefunction(M�!nexpM0)!(F(M)�!nexpF(M0)),f7!F(f),is contractingwithcontractingconstantC.Similarly,Fiscalledlocallynon-expansivei C
12.1.PRELIMINARIESFORTHEDENOTATIONALMODELS ItiseasytoseethatthefunctorsPowandFAarewell-denedandthatPowHoareand 313<br />
contracting. Fcont A arelocallyd-continuous,Powcompislocallynon-expansivewhileFcum A islocally<br />
12.1.4 WerecallthedenitionofevaluationsontopologicalspacesasintroducedbyJones& Plotkin[JoPl89,Jone90]. Evaluations<br />
notesthesetofopensetsinX.AfunctionE:Opens(X)![0;1]iscalledanevaluation5Evaluations(cf.[JoPl89,Jone90]):ForXtobeatopologicalspace,Opens(X)de- ithefollowingthreeconditionsaresatised: 1.If(Ui)i2IisadirectedfamilyofopensetsUiinX(i.e.(Ui)i2IisafamilyinOpens(X) suchthat<strong>for</strong>alli,j2Ithereexistsk2IwithUi E [i2IUi!=sup i2IE(Ui): UkandUj Uk)then<br />
2.E(U\U0)+E(U[U0)=E(U)+E(U0)<br />
ofevaluationsonX.Clearly,<strong>for</strong>eachevaluationE2Eval(X),E(;)=0,and,whenever TheprobabilisticpowerdomainofevaluationsEval(X)ofatopologicalspaceXistheset 3.E(X)=1<br />
ThefunctionEval(f):IfX,X0aretopologicalspacesandf:X!X0isacontinuous U,U02Opens(X)withU subsetsofXwhereweputE(A)=1�E(XnA)<strong>for</strong>eachclosedsubsetAofX. U0thenE(U) E(U0).Weextendevaluationstoclosed<br />
functionthenEval(f):Eval(X)!Eval(X0)isdenedbyEval(f)(E)(U)=E(f�1(U)).<br />
TheevaluationE<strong>for</strong>adistribution:If2Distr(X)then Thus,EvalcanbeconsideredasafunctorTOP!SETwhereTOPdenotesthecategory oftopologicalspacesandcontinuousfunctions.<br />
isanevaluationonX.WhetherthefunctionDistr(X)!Eval(X),7!E,isinjective (andhencecanbeconsideredasanembedding)dependsontheunderlyingtopologyon E:Opens(X)![0;1],E(U)=[U].<br />
X.Considerthetopologyf;;XgonasetXwhichcontainsatleasttwopoints;itis easytoseethatthisfunctionisnotinjective.Inourapplications{whereXisequipped withanultrametricoradirected-completepartialorder{Distr(X)canbeconsideredas asubspaceofEval(X)(cf.Theorem5.1.12,page95,andTheorem5.1.16,page97). Remark12.1.3LetevalX:Distr(X)!Eval(X)bethefunctionevalX()=E.Itis easytoseethatevalYDistr(f)=Eval(f)evalX<strong>for</strong>everyfunctionf:X!Y.I.e.<strong>for</strong> eachdistribution2Distr(X),EDistr(f)()=Eval(f)(E): Plotkin[JoPl89].<br />
5AnevaluationinoursenseisaprobabilisticcontinuousevaluationintheterminologyofJones&
314 Hence,evalisanaturaltrans<strong>for</strong>mationDistr!EvalwhereDistrisconsideredasa CHAPTER12.APPENDIX<br />
Compositionofevaluations(cf.[Heck95]):IfXandYaretopologicalspacesand functorSET!TOP(whereDistr(X)issupposedtobeequippedwiththediscrete topology).<br />
V2Opens(Y).Notethat,if spaceX EX2Eval(X),EY2Eval(Y)thenEXEYdenotestheuniqueevaluationontheproduct Ysuchthat(EXEY)(U 2Distr(X), V)=EX(U)EY(V)<strong>for</strong>allU2Opens(X)and<br />
Theprobabilisticpowerdomainofevaluationsondcpo's:Recallthatwesuppose thedenitionof wasgivenonpage30). 2Distr(Y)thenE E=E (where<br />
dcpowherethepartialordervonEval(D)isgivenby adcpoDtobeequippedwiththeScott-topology,i.e.Opens(D)consistsofallsubsetsU ofDwhereUisupward-closedandDnUislub-closed.IfDisadcpothenEval(D)isa<br />
elementofD),i.e.itisgivenby?Eval(D)(U)=0ifU6=Dand?Eval(D)(D)=1.If(Ei)i2I (cf.[JoPl89]).Thebottomelement?Eval(D)ofEval(D)isE1?D(where?Disthebottom E1vE2iE1(U) E2(U)<strong>for</strong>allU2Opens(D)<br />
isd-continuous. D,thecompositionoperator:Eval(D)Eval(D)!Eval(DD),(E1;E2)7!E1E2, isadirectedfamilyofevaluationsthentheleastupperboundE=FEiinEval(D)is givenbyE(U)=supi2IEi(U).ItisshownbyHeckmann[Heck95]that,<strong>for</strong>everydcpo<br />
TheevaluationfunctorEval:CONT?!CONT?:IfD,D0aredcpo'sandf:D!D0 isastrict,d-continuousfunctionthenEval(f)isstrictandd-continuous.Fromtheresults ofJones[Jone90],itcanbederivedthatEval(D)iscontinuousifDiscontinuous.Hence, EvalcanbeconsideredasafunctorCONT?!CONT?. Lemma12.1.4ThefunctorEval:CONT?!CONT?islocallyd-continuous. Proof: 12.2 Orderedbalancedtrees easyverication.<br />
acertainbalancecriteria,suchasAVL,BB[]orRed-Blacktrees)<strong>for</strong>thecomputationof lence(Chapters6and7),weproposetheorderedbalancedtrees(binarysearchtreeswith certainequivalenceclasses.Thedenitionof(theseveraltypesof)orderedbalancedtrees Fortheimplementationofthealgorithms<strong>for</strong>decidingbisimulationandsimulationequiva-<br />
justexplainournotations. LetIbeanonemptyandnitesetandpi,i2I,realnumbers.Byanorderedbalanced canbefoundinanystandardbookaboutdatastructures;seee.g.[Knut73,CLR96].We<br />
[NiRe73])whicharisesbysuccessivelyinsertingtheelementspi,i2I,(inanyorder) tree<strong>for</strong>pi,i2I,wemeanabinarybalancedtree(e.g.anAVL-tree[AVL62]orBB[]-tree andper<strong>for</strong>mingthenecessaryrebalancesteps.Eachnodevislabelledbyakey-value v:key2fpi:i2Igsuchthatvl:key
12.3.MULTITERMINALBINARYDECISIONDIAGRAMS O(jIjlog(r+1))timeandO(jIj)spacewhereristhecardinalityoffpi:i2Ig.Weoften 315<br />
useadditionallabels<strong>for</strong>thenodes,e.g.v:indices=fi2I:pi=v:keyg.Wedescribe theadditionallabelsbytheirnalvalue(i.e.thevalueinthenaltree).Forexample,let I=f1;:::;10gand<br />
theorderinwhichtheelementspiareinserted.Forinstance,itispossibletoobtainthe Thenaltreedependsonthetypeo<strong>for</strong>deredtrees(AVL-,BB[]orwhatever)andon p1=p4=5,p2=p7=p8=7,p3=4,p5=3,p6=2,p9=p10=0.<br />
followingnaltree.<br />
v3 v1 v4<br />
v0<br />
��� @@R ��� @@Rv2@@R<br />
v0:key=4v0:indices=f3g<br />
v5<br />
v1:key=2v1:indices=f6g v2:key=5v2:indices=f1;4g v3:key=0v3:indices=f9;10g v4:key=3v4:indices=f5g<br />
f(x2)=5,f(x3)=6,f(x4)=7andtheadditionallabels Ifwedealwithafunctionf:X!f1;:::;10gwhereX=fx1;x2;x3;x4gandf(x1)= v5:key=7v5:indices=f2;7;8g<br />
thenvi:elements=;,i=0;1;3;4,v4:elements=fx1;x2gandv5:elements=fx4g. v:elements=fx2X:f(x)2v:indicesg<br />
12.3 Chapter10dealswithMTBDD-basedvericationmethods.Inthissection,webriey recallthedenitionofmulti-terminalbinarydecisiondiagrams(MTBDDs),alsocalled Multiterminalbinarydecisiondiagrams<br />
algebraicdecisiondiagrams(ADDs).Forfurtherdetailsandpossibleapplicationssee<br />
matrices.MTBDDsareanextensionofBryant'sorderedbinarydecisondiagrams(OB- e.g.[CFM+93,BFG+93,HMP+94,CFZ96,SaFu96,FMY97].<br />
DDsorBDDs<strong>for</strong>short)[Brya86].WhileBDDsareadatastructure<strong>for</strong>booleanfunctions f:f0;1gn!f0;1g,MTBDDsrepresentfunctionsfrombitvectorsintoacertaindomain MTBDDswereintroducedbyClarkeetal[CFM+93]asanecientdatastructure<strong>for</strong><br />
domain
316 ABDDisaf0;1g-valuedMTBDD,i.e.aMTBDDwhereallterminalverticesarelabelled CHAPTER12.APPENDIX<br />
by0or1.7IfVar=fx1;:::;xngandx1
12.3.MULTITERMINALBINARYDECISIONDIAGRAMS Ifthevariables(x1;:::;xn)overwhichaMTBDDQisconsideredareclearfromthe 317<br />
f:f0;1gn!
318 CHAPTER12.APPENDIX
Bibliography<br />
[AbJo93] [AbLa88] P.Abdulla,B.Jonsson:VerifyingProgramswithUnreliableChannels, Proc.LICS'93.ThefullversionwiththesametitlehasappearedinIn<strong>for</strong>- M.Abadi,L.Lamport:TheExistenceofRenementMappings,Proc.<br />
mationandComputation,Vol.127,No.2,pp91-101,1996. LICS'88,pp165-175,1988.<br />
[Abra91] [AbJu94] S.Abramsky:ADomainEquation<strong>for</strong>Bisimulation,In<strong>for</strong>mationand Computation,Vol.92,pp161-218,1991.<br />
[AHS90] andT.S.E.Maibaum(ed.),HandbookofLogicinComputerScience,Vol.3, ClarendonPress,pp1-168,1994. J.Adamek,H.Herrlich,G.Strecker:AbstractandConcreteCategories: S.Abramsky,A.Jung:DomainTheory,InS.Abramsky,D.M.Gabbay<br />
[AVL62] G.Adel'son-Velshii,Y.Landis:AnAlgorithm<strong>for</strong>theOrganizationof In<strong>for</strong>mation,Soviet.Math.Dokl.,Vol.3,pp1259-1262,1962. TheJoyofCats,JohnWiley&Sons,1990.<br />
[AHU74] [dAlf97a] A.Aho,J.Hopcroft,J.Ullman:TheDesignandAnalysisofofComputer Algorithms,Addison-WesleyPublishingCompany,1974.<br />
[dAlf97b] L.deAlfaro:FormalVericationof<strong>Probabilistic</strong><strong>Systems</strong>,Ph.D.Thesis, Stan<strong>for</strong>dUniversity,1997.<br />
[AlSch84] L.deAlfaro:TemporalLogics<strong>for</strong>theSpecicationofPer<strong>for</strong>manceandReters,Vol.21,1985.<br />
pp165-176,1997. B.Alpern,F.Schneider:DeningLiveness,In<strong>for</strong>mationProcessingLetliability,Proc.STACS'97,LectureNotesinComputerScience,Vol.1200, [ACD91a] [ACD90] R.Alur,C.Courcoubetis,D.Dill:VerifyingAutomataSpecicationsof <strong>Probabilistic</strong>Real-Time<strong>Systems</strong>,Proc.REXWorkshop'91,LectureNotes Proc.LICS'90,pp414-425,1990. R.Alur,C.Courcoubetis,D.Dill:ModelChecking<strong>for</strong>Real-Time<strong>Systems</strong>,<br />
[ACD91b] inComputerScience,Vol.600,pp27-44,1991.<br />
[dAHK98] P.d'Argenio,H.Hermanns,J.Katoen:<strong>On</strong>GenerativeParallelComposi- R.Alur,C.Courcoubetis,D.Dill:Model-Checking<strong>for</strong><strong>Probabilistic</strong>Real- Time<strong>Systems</strong>,Proc.ICALP'91,LectureNotesinComputerScience,<br />
ham,pp105-122,1998. Vol.510,pp115-127,1991. tion,Proc.PROBMIV'98,Techn.ReportCSR-98-4,UniversityBirming<br />
319
320 [dAKB98] P.d'Argenio,J.Katoen,E.Brinksma:AnAlgebraicapproachtotheSpeci- BIBLIOGRAPHY<br />
[AmRu89] ofCompleteMetricSpaces,JournalofComputerandSystemSciences, Chapman&Hall,1998. P.America,J.Rutten:SolvingRecursiveDomainEquationsinaCategory cationofStochastic<strong>Systems</strong>(extendedabstract),Proc.PROCOMET'98,<br />
[AtEm89] Vol.39,No.3,pp343-375,1989.<br />
[ASB+95] P.Attie,E.A.Emerson:SynthesisofConcurrent<strong>Systems</strong>withManySimilarSequentialProcesses,Proc.POPL'89,pp191-201,1989. [BBS92] A.Aziz,V.Singhal,F.Balarin,R.Brayton,A.Sangiovanni-Vincentelli:It<br />
ACPwithGenerativeProbabilities,Proc.CONCUR'92,LectureNotesin J.Baeten,J.Bergstra,S.Smolka:Axiomatizing<strong>Probabilistic</strong>Processes: usuallyworks:TheTemporalLogicofStochastic<strong>Systems</strong>,Proc.CAV'95, LectureNotesinComputerScience,Vol.939,pp155-165,1995.<br />
[BFG+93] sametitlehasappearedinIn<strong>for</strong>mationandComputation,Vol.122,pp 234-255,1995. I.Bahar,E.Frohm,C.Gaona,G.Hachtel,E.Macii,A.Padro,F.Somenzi: ComputerScience,Vol.630,pp472-485,1992.Thefullversionwiththe<br />
[Bai96] AlgebraicDecisionDiagramsandtheirApplications,Proc.ICCAD'93,pp 188-191,1993.ThefullversionwiththesametitlehasappearedinFormal <strong>Methods</strong>in<strong>Systems</strong>Design,Vol.10,No.2/3,pp171-206,1997. C.Baier:PolynomialTimeAlgorithms<strong>for</strong>Testing<strong>Probabilistic</strong>Bisimu-<br />
[Bai97] lationandSimulation,Proc.CAV'96,LectureNotesinComputerScience,Vol.1102,pp38-49,1996.Arevisedversionwiththetitle\DecidingBisimilarityandSimilarity"issubmitted<strong>for</strong>publication. [BaCl98] C.Baier:TreesandSemantics,TheoreticalComputerScience,Vol.179, pp217-250,1997.<br />
[BCH+97] SymbolicModelChecking<strong>for</strong><strong>Probabilistic</strong>Processes,Proc.ICALP'97, C.Baier,E.Clarke,V.Hartonas-Garmhausen,M.Kwiatkowska,M.Ryan: C.Baier,E.Clarke:TheAlgebraicMu-CalculusandMTBDDs,Proc.<br />
LectureNotesinComputerScience,Vol.1256,pp430-440,1997. WoLLIC'98,pp27-38,1998.<br />
[BCH98] [BaEn98] C.Baier,E.Clarke,V.Hartonas-Garmhausen:<strong>On</strong>theSemanticFounda- 98-4,UniversityBirmingham,pp7-32,1998. tionsof<strong>Probabilistic</strong>VERUS,Proc.PROBMIV'98,Techn.ReportCSR-<br />
[BaHe97] tion.C.Baier,H.Hermanns:WeakBisimulation<strong>for</strong>Fully<strong>Probabilistic</strong>ProLossyChannel<strong>Systems</strong>:an<strong>Algorithmic</strong>Approach,submitted<strong>for</strong>publica- C.Baier,B.Engelen:EstablishingQualitativeProperties<strong>for</strong><strong>Probabilistic</strong><br />
[BaKw97] cesses,Proc.CAV'97,LectureNotesinComputerScience,Vol.1254,pp 119-130,1997.<br />
UniversityBirmingham.<br />
Vol.71997.ThefullversionisavailableasTechn.Report,CSR-97-7, C.Baier,M.Kwiatkowska:DomainEquations<strong>for</strong><strong>Probabilistic</strong>Processes, Proc.EXPRESS'97,ElectronicNotesinTheoreticalComputerScience,
BIBLIOGRAPHY [BaKw98] C.Baier,M.Kwiatkowska:ModelChecking<strong>for</strong>a<strong>Probabilistic</strong>Branch- 321<br />
ingTimeLogicwithFairness,DistributedComputing,Vol.11,No.3,<br />
[BaKw98a] 1998.Apreliminaryversionwiththetitle\AutomaticVericationofLive-<br />
<strong>Probabilistic</strong>ProcessesunderFairnessConstraints,In<strong>for</strong>mationProcessing C.Baier,M.Kwiatkowska:<strong>On</strong>theVericationofQualitativePropertiesof nessPropertiesofRandomized<strong>Systems</strong>"hasappearedinProc.PODC'97,<br />
Letters,Vol.66,No.2,pp71-79,1998. ACMPress,1997.<br />
[BKN98] C.Baier,M.Kwiatkowska,G.Norman:ComputingLowerandUpper<br />
[BMC94] 91-104,1998. C.Baier,M.Majster-Cederbaum:DenotationalSemanticsintheCpoand Proc.PROBMIV'98,Techn.ReportCSR-98-4,UniversityBirmingham,pp Bounds<strong>for</strong>LTLFormulaeoverSequentialandConcurrentMarkovChains,<br />
[BMC97] sistencyResults<strong>for</strong>SemanticsofConcurrentProgrammingLanguages, 1994. C.Baier,M.Majster-Cederbaum:HowtoInterpretandEstablishCon- MetricApproach,TheoreticalComputerScience,Vol.135,pp171-220,<br />
[BSV98] C.Baier,M.Stoelinga,F.Vaandrager:privatediscussiononthedecidabil- Draftinpreparation. ityofprobabilisticbranchingbisimulationandsimulation,October1998. FundamentaIn<strong>for</strong>maticae,Vol.29,No.3,pp225-256,1997.<br />
[dBaMe88] [dBdRR88] J.deBakker,J.Meyer:Metricsemantics<strong>for</strong>concurrency,ReportCS- R8803,Centre<strong>for</strong>MathematicsandComputerScience,Amsterdam,1988. J.deBakker,W.deRoever,G.Rozenberg(eds.):LinearTime,Branching TimeandPartialOrderinLogicsandModels<strong>for</strong>Concurrency,Proc.REX<br />
[dBaZu82] [dBdV96] Workshop'88,LectureNotesinComputerScience,Vol.354,1988.<br />
Concurrency,In<strong>for</strong>mationandControl,Vol.54,No.1/2,pp70-120,1982. J.deBakker,J.Zucker:ProcessesandtheDenotationalSemanticsof J.deBakker,E.deVink:ControlFlowSemantics,MITPress,1996.<br />
[Barr93] [BaWe90] M.Barr:Terminalcoalgebrasinwell-foundedsettheory,TheoreticalComputerScience,Vol.114,pp299-315,1993. [BeKl84] M.Barr,C.Wells:CategoryTheory<strong>for</strong>ComputingScience,Prentice-Hall InternationalSeriesinComputerScience,PrenticeHall,1990.<br />
[BMS95] J.Bergstra,J.Klop:ProcessAlgebra<strong>for</strong>SynchronousCommunication, In<strong>for</strong>mationandComputation,Vol.60,pp109-137,1984.<br />
[BeGor98] J.Bern,C.Meinel,A.Slobodova:GlobalRebuildingofOBDDsAvoiding MemoryRequirementMaxima,Proc.CAV'95,LectureNotesinComputer Science,Vol.939,pp4-15,1995.<br />
[BeGon92] G.Berry,G.Gonthier:TheESTERELSynchronousProgrammingLanrentProcesseswithNondeterminism,Priorities,ProbabilitiesandTime. TheoreticalComputerScience,Vol.202,pp1-54,1998. M.Bernardo,R.Gorrieri:ATutorialonEMPA:aTheoryofConcurguage:Design,Semantics,Implementation,ScienceofComputerProgramming,Vol.19,1992.
BIBLIOGRAPHY [Chri90a] I.Christo:TestingEquivalences<strong>for</strong><strong>Probabilistic</strong>Processes,Ph.D.The- 323<br />
[Chri90b] sis,DepartmentofComputerScience,UppsalaUniversity,1990.<br />
[Chri93] I.Christo:TestingEquivalencesandFullyAbstractModels<strong>for</strong><strong>Probabilistic</strong>Processes,Proc.CONCUR'90,LectureNotesinComputerScience,sity,1993.L.Christo:SpecicationandVerication<strong>Methods</strong><strong>for</strong><strong>Probabilistic</strong>Processes,Ph.D.Thesis,DepartmentofComputerScience,UppsalaUniver Vol.458,pp126-140,1990.<br />
[ChCh91] [ChCh92] L.Christo,I.Christo:EcientAlgorithms<strong>for</strong>VericationofEquivalences<strong>for</strong><strong>Probabilistic</strong>Processes,Proc.CAV'91,LectureNotesinComputerScience,Vol.575,pp310-321,1991.ties<strong>for</strong><strong>Probabilistic</strong>Processes,Proc.12thConferenceonFoundationsof SoftwareTechnologyandTheoreticalComputerScience,LectureNotesin L.Christo,I.Christo:ReasoningaboutSafetyandLivenessProper-<br />
[ClEm81] ComputerScience,Vol.652,pp342-355,1992.<br />
[CES83] E.Clarke,E.A.Emerson:DesignandSynthesisofSynchronizationSkele-<br />
StateConcurrent<strong>Systems</strong>UsingTemporalLogicSpecications:APratical tonsfromBranchingTimeTemporalLogic,Proc.WorkshoponLogicsof<br />
Approach,Proc.POPL'83,1983.Thefullversionwiththesametitlehas E.M.Clarke,E.A.Emerson,A.P.Sistla:AutomaticVericationofFinite Programs,LectureNotesinComputerScience,Vol.131,pp52-71,1981.<br />
[CFM+93] appearedinACMTrans.ProgrammingLanguagesand<strong>Systems</strong>,Vol.1(2), 1986. E.Clarke,M.Fujita,P.McGeer,J.Yang,X.Zhao:Multi-TerminalBi-<br />
[CFZ96] naryDecisionDiagrams:AnEcientDataStructure<strong>for</strong>MatrixRepre<br />
andHybridDecisionDiagrams,InRepresentationsofDiscreteFunctions, TahoeCity,1993. E.Clarke,M.Fujita,X.Zhao:Multi-TerminalBinaryDecisionDiagrams sentation,InProc.IWLS'93:InternationalWorkshoponLogicSynthesis,<br />
[CGL93] T.SasaoandM.Fujita(eds.),KluwerAcademicPublishers,pp93-108, 1996.<br />
[CGH94] currentPrograms,Proc.REXWorkshop'93,LectureNotesinComputerE.Clarke,O.Grumberg,D.Long:VercationTools<strong>for</strong>Finite-StateCon- Science,Vol.803,pp124-175,1993.<br />
[CKZ96] Checking,Proc.CAV'94,LectureNotesinComputerScience,Vol.818,pp 415-427,1994. E.Clarke,M.Khaira,X.Zhao:WordLevelSymbolicModelChecking{a E.Clarke,O.Grumberg,K.Hamaguchi:AnotherLookatLTLModel<br />
[CPS90] DesignAutomationConference,IEEEComputerSocietyPress,1996. R.Cleaveland,J.Parrow,B.Steen:ASemanticBasedVericationTool NewApproach<strong>for</strong>VerifyingArithmeticCircuits,Proc.33rdACM/IEEE<br />
[CSZ92] cationIX,ElsevierSciencePublishers,IFIP,pp287-302,1990.R.Cleaveland,S.Smolka,A.Zwarico:TestingPreorders<strong>for</strong><strong>Probabilistic</strong>Processes,Proc.ICALP1992,LectureNotesinComputerScience,<strong>for</strong>FiniteState<strong>Systems</strong>,Proc.ProtocolSpecication,TestingandVeri- Vol.623,pp708-719,1992.
324 [CoWi87] D.Coppersmith,S.Winograd:MatrixMultiplicationviaArithmeticPro- BIBLIOGRAPHY<br />
[CLR96] 1987. T.Cormen,C.Leiserson,R.Rivest:IntroductiontoAlgorithms,McGraw gressions,Proc.19thACMSymposiumonTheoryofComputing,pp1-6,<br />
[CoYa88] Hill,1996.<br />
[CoYa90] C.Courcoubetis,M.Yannakakis:VerifyingTemporalPropertiesofFinite- State<strong>Probabilistic</strong>Programs,Proc.29thAnnualSymp.onFoundationsof ComputerScience,pp338-345,1988.<br />
[CoYa95] Events,Proc.ICALP'90,LectureNotesinComputerScience,Vol.443,pp 336-349,1990. C.Courcoubetis,M.Yannakakis:TheComplexityof<strong>Probabilistic</strong>Veri- C.Courcoubetis,M.Yannakakis:MarkovDecisionProcessesandRegular<br />
[Dam94] M.Dam:CTLandECTLasFragmentsoftheModalMu-Calculus, cation,JournaloftheACM,Vol.42,No.4,pp857-907,1995.<br />
[Derm70] TheoreticalComputerScience,Vol.126,pp77-96,1994.<br />
[DEP98] C.Derman:Finite-StateMarkovianDecisionProcesses,AcademicPress, NewYork,1970.<br />
[Dini70] J.Desharnais,A.Edalat,P.Panangaden:ALogicalCharacterizationof Bisimulation<strong>for</strong>LabeledMarkovProcesses,Proc.LICS'98,1998.<br />
[Dugu66] NetworkwithPowerEstimation,Soviet.Math.Dokl.,Vol.11,pp1277- E.Dinic:Algorithm<strong>for</strong>SolutionofaProblemofMaximalFlowina<br />
[EdSm92] 1280,1970. J.Dugundji:Topology,AllynandBacon,inc.,1966.<br />
[Emer85] A.Edalat,M.Smyth:CompactMetricIn<strong>for</strong>mation<strong>Systems</strong>,Proc.REX Workshop'92,LectureNotesinComputerScience,Vol.666,pp154-173, 1992.<br />
[Emer90] Programs",LectureNotesinComputerScience,Vol.193,pp79-87,1985. E.A.Emerson:Automata,TableauxandTemporalLogics,in\Logicof<br />
[Emer92] pp995-1072,1990. E.A.Emerson:Real-TimeandtheMu-Calculus,Proc.REXWorkshop'92, E.A.Emerson:TemporalandModalLogic,VolumeBofHandbookofTheoreticalComputerScience,ElsevierSciencePublishers(North-Holland), [EmCl82] LectureNotesinComputerScience,Vol.666,pp176-194,1992.<br />
[EmHa85] E.A.Emerson,E.M.Clarke:UsingBranchingTimeLogictoSynthesize SynchronizationSkeletons,Sci.Comput.Programming,Vol.2,pp241-266, 1982.<br />
[EmHa86] E.A.Emerson,J.Halpern:DecisionProceduresandExpressivenessin theTemporalLogicofBranchingTime,JournalofComputerandSystem Science,Vol.30,pp1-24,1985. Vol.33,No.1,pp151-178,1986.<br />
E.A.Emerson,J.Halpern:\Sometimes"and\NotNever"Revisited: onBranchingversusLinearTimeTemporalLogic,JournaloftheACM,
BIBLIOGRAPHY [EmJu88] E.A.Emerson,C.Jutla:TheComplexityofTreeAutomataandLogicsof 325<br />
[EmJu91] Programs,Proc.FOCS'88,pp328-337,1988.<br />
[EJS93] E.A.Emerson,C.Jutla,A.Sistla:<strong>On</strong>Model-Checking<strong>for</strong>Fragments E.A.Emerson,C.Jutla:TreeAutomata,Mu-CalculusandDeterminacy, Proc.FOCS'91,pp368-377,1991.<br />
[EmLei85] StrikesBack,Proc.POPL'85,pp84-96,1985. E.A.Emerson,C.Lei:Modalities<strong>for</strong>ModelChecking:BranchingTime oftheMu-Calculus,Proc.CAV'93,LectureNotesinComputerScience, Vol.697,pp385-396,1993.<br />
[EmLei86] [EFT93] PropositionalMu-Calculus,Proc.LICS'86,pp267-278,1986. E.A.Emerson,C.Lei:EcientModelChecking<strong>for</strong>Fragmentsofthe<br />
[Enge89] checkinginCCS,DistributedComputing,Vol.6,pp155-164,1993. R.Engelking:GeneralTopology,SigmaSeriesinRureMathematics, Vol.6,HeldermannVerlagBerlin,1989. R.Enders,T.Filkorn,D.Taubner:GeneratingBDDs<strong>for</strong>SymbolicModel<br />
[Even79] [Espa94] Programming,Vol.23,pp151-195,1994. J.Esparza:ModelCheckingUsingNetUnfoldings,ScienceofComputer<br />
[FHZ93] S.Even:GraphAlgorithms,ComputerSciencePress,1979.<br />
[Feld83] M.Fang,C.Ho-Stuart,H.Zedan:SpecicationofReal-Time<strong>Probabilistic</strong> Behaviour,Proc.Protocol,Specication,TestingandVerication,IFIP, ElsevierSciencePublishers,pp143-157,1993.<br />
[FeHa84] Y.Feldmann:ADecidablePropositionalDynamicLogic,Proc.15thACM Symp.onTheoryofComputing,pp298-309,1983.<br />
[Fell68] W.Feller:AnIntroductiontoProbabilityTheoryanditsApplications, Y.Feldmann,D.Harel:APropositionalDynamicLogic,JournalofComputerandSystemScience,Vol.28,pp193-215,1984. [Fern89] Wiley,NeyYork,1968.<br />
[FoFu62] 1989. J.C.Fernandez:AnImplementationofanEcientAlgorithm<strong>for</strong>Bisimula-<br />
1962. L.Ford,D.Fulkerson:FlowsinNetworks,PrincetonUniversityPress, tionEquivalence,ScienceofComputerProgramming,Vol.13,pp219-236,<br />
[Fran88] [FMK91] N.Francez:Fairness,Springer-Verlag,NewYork,1988.<br />
[FMY97] M.Fujita,Y.Matsunaga,T.Kakadu:<strong>On</strong>VariableOrderingofBinary DecisionDiagrams<strong>for</strong>theApplicationofMulti-ValuedLogicSynthesis, Proc.EDAC'91,pp50-53,1991.<br />
[GPV+95] M.Fujita,P.McGeer,J.Yang:Multi-TerminalBinaryDecisionDiagrams: inSystemDesign,Vol.10,No.2/3,pp149-170,1997. AnEcientDataStructure<strong>for</strong>MatrixRepresentation,Formal<strong>Methods</strong> ofLinearTimeLogic,Proc.SymposiumonProtocolSpecication,Testing R.Gerth,D.Peled,M.Vardi,P.Wolper:Simple<strong>On</strong>-The-FlyVerication andVerication,pp3-18,1995.
328 [HHW97] T.Henzinger,P.Ho,H.Wang-Toi:HYTECH:aModelChecker<strong>for</strong>Hybrid BIBLIOGRAPHY<br />
[Herm98] <strong>Systems</strong>,Proc.CAV'97,LectureNotesinComputerScience,Vol.1254,pp 460-463,1997.<br />
[HHM98] Erlangen-Nurnberg,1998. H.Hermanns,U.Herzog,V.Mertsiotakis:StochasticProcessAlgebras: betweenLOTOSandMarkovChains,Comp.Netw.andISDNSyst., H.Hermanns:InteractiveMarkovChains,Ph.D.Thesis,Universitat<br />
[Herz90] Framework,in\EntwurfundBetriebverteilterSysteme",In<strong>for</strong>matikFachberichte264,Springer,1990. U.Herzog:FormalDescription,TimeandPer<strong>for</strong>manceAnalysis{a Vol.9/10,pp901-924,1998.<br />
[Hoar85] [Hill94] C.A.R.Hoare:CommunicatingSequentialProcesses,PrenticeHall,1985. J.Hillston:ACompositionalApproachtoPer<strong>for</strong>manecModelling, versityPress(1996).Ph.D.Thesis,UniversityEdinburgh,1994;publishedinCambridgeUni- [HuKw98] [HuKw97] M.Huth,M.Kwiatkowska:ComparingCTLandPCTLonLabelled MarkovChains,Proc.PROCOMET'98,Chapman&Hall,1998. Proc.LICS'97,IEEEComputerSocietyPress,1997. M.Huth,M.Kwiatkowska:QuantitativeAnalysisandModelChecking,<br />
[Heck95] [HuTi92] In<strong>for</strong>matik,UniversitatdesSaarlandes. R.Heckmann:SpacesofValuations,TechnicalReportA09/95,FB14 T.Huynh,L.Tian:<strong>On</strong>someEquivalenceRelations<strong>for</strong><strong>Probabilistic</strong>Processes,FundamentaIn<strong>for</strong>maticae,Vol.17,pp211-234,1992. [HoPe94] [IyNa96] G.Holzmann,D.Peled:AnImprovementinFormalVerication,Proc.7th InternationalConferenceonFormalDescriptionTechniques,pp177-194, 1994.<br />
[IyNa97] P.Iyer,M.Narasimha:\AlmostAlways"and\DenitelySometime"are notenough:<strong>Probabilistic</strong>Quantiersand<strong>Probabilistic</strong>Model-Checking, Techn.Report,TR-96-16,NorthCarolinaStateUniversity,1996.<br />
[Jone90] C.Jones:<strong>Probabilistic</strong>Non-Determinism,Ph.D.Thesis,UniversityofEdinburgh,1990. P.Iyer,M.Narasimha:<strong>Probabilistic</strong>LossyChannel<strong>Systems</strong>,Proc.TAP- SOFT'97,LectureNotesinComputerScience,Vol.1214,pp667-681,1997.<br />
[Jons91] [JoPl89] B.Jonsson:SimulationsbetweenSpecicationsofDistributed<strong>Systems</strong>, Proc.CONCUR'91,LectureNotesinComputerScience,Vol.527,pp346- C.Jones,G.D.Plotkin:A<strong>Probabilistic</strong>PowerdomainonEvaluations, Proc.LICS'89,pp186-195,1989.<br />
[JHP89] ingAlgorithmbyAdaptingExistingAutomatedTools,Proc.Automatic Verication<strong>Methods</strong><strong>for</strong>FiniteState<strong>Systems</strong>,LectureNotesinComputer 360,1991. B.Jonsson,C.HussainKhan,J.Parrow:ImplementingaModelCheck- Science,Vol.407,pp179-188,1989.
BIBLIOGRAPHY [JHY94] B.Jonsson,C.Ho-Stuart,W.Yi:TestingandRenement<strong>for</strong>Nondeter- 329<br />
[JoLa91] ministicand<strong>Probabilistic</strong>Processes,Proc.FTRTFT'94,LectureNotesin ComputerScience,Vol.863,pp418-430,1994.<br />
[JoYi95] B.Jonsson,K.G.Larsen:SpecicationandRenementof<strong>Probabilistic</strong> Processes,Proc.LICS'91,pp266-277,1991.<br />
[JoSm90] B.Jonsson,W.Yi:CompositionalTestingPreorders<strong>for</strong><strong>Probabilistic</strong>Processes,Proc.LICS'95,pp431-443,1995. [KaSm83] zations<strong>for</strong><strong>Probabilistic</strong>Processes,Proc.CONCUR'90,LectureNotesinC.Jou,S.Smolka:Equivalences,CongruencesandCompleteAxiomaticiplesofDistributedComputing,pp228-240,1983.Thefullversionwith ComputerScience,Vol.458,pp367-383,1990.<br />
thesametitlehasappearedinIn<strong>for</strong>mationandComputation,Vol.86,pp 43-68,1990. P.Kannelakis,S.Smolka:CCSExpressions,FiniteStateProcessesand ThreeProblemsofEquivalence,Proc.2ndACMSymposiumonthePrin-<br />
[Karp91] [Kato96] R.Karp:AnIntroductiontoRandomizedAlgorithms,DiscreteApplied Mathematics,Vol.34,pp191-201,1991.<br />
[KLL94] J.Katoen:QuantitativeandQualitativeExtensionsofEventStructures, Ph.D.Thesis,UniversiteitTwente,1996. J.Katoen,R.Langerak,D.Latella:Modelling<strong>Systems</strong>by<strong>Probabilistic</strong><br />
[Kell76] TechniquesVI,Vol.C22ofIFIPTransactions,North-Holland,pp253- ProcessAlgebras:anEventStructureApproach,inFormalDescription 268,1994.<br />
[Koze79] R.Keller:FormalVericationofParallelPrograms,Communicationsof D.Kozen:Semantics<strong>for</strong><strong>Probabilistic</strong>Programs,Proc.20thIEEESym- theACM,Vol.7(19),pp561-572,1976.<br />
[Koze83] thesametitlehasappearedinJournalofComputerandSystemScience, posiumonFoundationsofComputerScience,1979.Thefullversionwith Vol.22,pp328-350,1981.<br />
[Koze85] D.Kozen:ResultsonthePropositionalMu-Calculus,TheoreticalComputerScience,Vol.27,No.3,pp333-354,1983. [Knut73] D.Kozen:A<strong>Probabilistic</strong>PDL,JournalofComputerandSystemSciences,Vol.30,1985. [Kura56] D.Knuth:SortingandSearching,Vol.3of\TheArtofComputerPro- K.Kuratowski:Surunemethodedemetrisationcompletedescertains gramming",Addison-Wesley,1973.<br />
[KwNo96] espacesd'ensemblescompacts,FundamentaeMathematicae43,pp114- 138,1956.<br />
[KwNo98a] M.Kwiatkowska,G.Norman:<strong>Probabilistic</strong>MetricSemantics<strong>for</strong>asimple LanguagewithRecursion,Proc.MFCS'96,LectureNotesinComputer Science,Vol.1113,pp419-430,1996. M.Kwiatkowska,G.Norman:ATestingEquivalence<strong>for</strong>Reactive<strong>Probabilistic</strong>Processes,Proc.EXPRESS'98,ElectronicNotesinTheoretical ComputerScience,Vol.16,1998.
330 [KwNo98b] M.Kwiatkowska,G.Norman:AFullyAbstractMetric-SpaceDenotational BIBLIOGRAPHY<br />
[Kwia89] M.Kwiatkowska:SurveyofFairnessNotions,In<strong>for</strong>mationandSoftware Technology,Vol.31,No.7,pp371-386,1989. Semantics<strong>for</strong>Reactive<strong>Probabilistic</strong>Processes,Proc.COMPROX'98,ElectronicNotesinTheoreticalComputerScience,Vol.13,1998. [LPV94] Y.Lai,M.Pedram,B.Vrudhula:Edge-ValuedBinaryDecisionDiagrams<br />
[Lamp77] <strong>for</strong>IntegerLinearProgramming,SpectralTrans<strong>for</strong>mation,andFunction<br />
TransactionsonSoftwareEngineering,Vol.3,pp125-143,1977. 1994. L.Lamport:ProvingtheCorrectnessofMultiprocessPrograms,IEEE Decomposition,IEEETransactionsonCAD,Vol.13,No.8,pp959-975,<br />
[Lamp80] [Lamp94] L.Lamport:SometimesisSometimes\NotNever"{ontheTemporal LogicofPrograms,Proc.POPL'80,pp174-185,1980.<br />
[LPY97] K.Larsen,P.Pettersson,W.Yi:UPPAAL:Status&Developments, L.Lamport:TheTemporalLogicofActions,ACMTransactionsonProgrammingLanguagesand<strong>Systems</strong>,Vol.16,No.3,pp872-923,1994. [LaSk89] Proc.CAV'97,LectureNotesinComputerScience,Vol.1254,pp456-459, 1997.<br />
[LaSk92] POPL'89,1989.ThefullversionwiththesametitlehasappearedinIn<strong>for</strong>mationandComputation,Vol.94,pp1-28,1991. K.Larsen,A.Skou:CompositionalVericationof<strong>Probabilistic</strong>Processes, K.Larsen,A.Skou:Bisimulationthrough<strong>Probabilistic</strong>Testing,Proc.<br />
[LNS82] Proc.CONCUR'92,LectureNotesinComputerScience,Vol.630,pp456- 471,1992.<br />
[LSP81] J.Lassez,V.Nguyen,E.Sonenberg:FixedPointTheoremsandSemantics: 1982. D.Lehmann,A.Pnueli,J.Stavi:Impartiality,JusticeandFairness:The aFolfTale,In<strong>for</strong>mationProcessingLetters,Vol.14,No.3,pp112-116,<br />
[LeRa81] EthicsofConcurrentTermination,Proc.ICALP'81,LectureNotesinComputerScience,Vol.115,Springer,1981. [LeSh82] D.Lehmann,M.Rabin:<strong>On</strong>theAdvantageofFreeChoice:aSymmetricandFullyDistributedSolutiontotheDiningPhilosophersProblem, Proc.POPL'81,pp133-138,1981.<br />
[LiPn85] D.Lehmann,S.Shelah:ReasoningwithTimeandChance,In<strong>for</strong>mation andControl,Vol.53,pp165-198,1982.<br />
[LPZ85] O.Lichtenstein,A.Pnueli:CheckingthatFiniteStateConcurrentPro- O.Lichtenstein,A.Pnueli,L.Zuck:TheGloryofthePast,in\Logics gramsSatisfyTheirLinearSpecication,Proc.POPL'85,pp97-107,1985.<br />
[Lowe93a] 1985. G.Lowe:A<strong>Probabilistic</strong>ModelofTimedCSP,Ph.D.Thesis,Ox<strong>for</strong>dUniversity,1991. ofPrograms",LectureNotesinComputerScience,Vol.193,pp196-218,
BIBLIOGRAPHY [Lowe93b] G.Lowe:RepresentingNondeterminismand<strong>Probabilistic</strong>Behaviourin 331<br />
[Lowe95] ReactiveProcesses,Techn.ReportPRG-TR-11-93,Ox<strong>for</strong>dUniversity, 1993.<br />
[Lync95] ComputerScience,Vol.138,pp315-352,1995. N.Lynch:DistributedAlgorithms,MorganKaufmannPublishers,inc., 1995. G.Lowe:<strong>Probabilistic</strong>andPrioritizedModelsofTimedCSP,Theoretical<br />
[LyVa91] [LSS94] N.Lynch,I.Saias,R.Segala:ProvingTimeBounds<strong>for</strong>RandomizedDistributedAlgorithms,Proc.PODC'94,pp314-323,1994. [MajC88] N.Lynch,F.Vaandrager:ForwardandBackwardSimulations<strong>for</strong>Timing- Based<strong>Systems</strong>,Proc.REXWorkshop'91,LectureNotesinComputerScience,Vol.600,pp397-446,1991. [MajC89] M.Majster-Cederbaum:TheContractionPropertyisSucienttoGuartorsinaCategoryofCompleteMetricSpaces,In<strong>for</strong>mationProcessing Letters,Vol.29,pp277-281,1988. M.Majster-Cederbaum:<strong>On</strong>theUniquenessofFixedPointsofEndofunc-<br />
[MaZe91] CompleteMetricSpaces,In<strong>for</strong>mationProcessingLetters,Vol.33,pp15- 19,1988. M.Majster-Cederbaum,F.Zetzsche:TowardsaFoundation<strong>for</strong>Semantics anteetheUniquenessofFixedPointsofEndofunctorsinaCategoryof<br />
[MPM78] pp217-243,1991. V.Malhotra,M.PramodhKumar,S.Maheshwari:AnO(jV3j)Algorithm inCompleteMetricSpaces,In<strong>for</strong>mationandComputation,Vol.90,No.2,<br />
[MaPn90] <strong>for</strong>FindingMaximumFlowsinNetworks,ComputerScienceProgram, IndianInstituteofTechnology,Kanpur208016,1978.<br />
[MaPn92] <strong>Systems</strong>:Specication,Springer-Verlag,1992. Z.Manna,A.Pnueli:TheTemporalLogicofReactiveandConcurrent Z.Manna,A.Pnueli: Proc.PODC'90,pp377-408,1990. AHierarchyofTemporalProperties,<br />
[MaPn95] [MaWo84] Z.Manna,A.Pnueli:TemporalVericationofReactive<strong>Systems</strong>:Safety, Springer-Verlag,1995.<br />
[McLan71] Z.Manna,P.Wolper:SynthesisofCommunicationProcessesfromTem- S.MacLane:Categories<strong>for</strong>theWorkingMathematician,GraduateTexts poralLogicSpecications,ACMTrans.ProgrammingLanguagesand<strong>Systems</strong>,Vol.6(1),pp68-93,1984. [MBC84] inMathematics,Springer,1971.<br />
[McMil92] M.AjmoneMarsan,G.Balbo,G.Conte:AClassofGeneralizedStocahstic<br />
University,Pittsburgh,1992;publishedinKluwerAcademicPublishers K.McMillan:SymbolicModelChecking,Ph.D.Thesis,CarnegieMellon PetricNets<strong>for</strong>thePer<strong>for</strong>manceEvaluationofMultiprocessor<strong>Systems</strong>,<br />
(1993).<br />
ACMTransactionsonComputer<strong>Systems</strong>,Vol.2,No.2,pp93-122,1984.
332 [McMil92a] K.McMillan:UsingUnfoldingstoAvoidtheStateExplosionProblemin BIBLIOGRAPHY<br />
[McIv98] theVericationofAsynchronousCircuits,Proc.CAV'92,LectureNotesin ComputerScience,Vol.663,pp164-177,1992.<br />
[MKR92] 45-58,1998. M.Mercer,R.Kapur,D.Ross:FunctionalApproachestoGeneratingOr- A.McIver:ReasoningaboutEciencywithina<strong>Probabilistic</strong>Mu-Calculus,<br />
derings<strong>for</strong>EcientSymbolicRepresentation,Proc.ACM/IEEEDAC'92, Proc.PROBMIV'98,Techn.ReportCSR-98-4,UniversityBirmingham,pp<br />
[Moll82] pp614-619,1992.<br />
[MoMcI97] pectations,Proc.Formal<strong>Methods</strong>Pacic'97;alsoavailableasTechnicalC.Morgan,A.McIver:A<strong>Probabilistic</strong>TemporalCalculusbasedonEx- Trans.onComputers,Vol.C-31(9),pp913-917,1982. K.Molloy:Per<strong>for</strong>manceAnalysisUsingStochasticPetriNets,IEEE<br />
[MMS+94] ReportTR-13-97,UniversityofOx<strong>for</strong>d,1997.<br />
[MMS96] ability<strong>for</strong>CSP,Techn.ReportTR-12-94,Ox<strong>for</strong>dUniversity,toappearinC.Morgan,A.McIver,K.Seidel,J.Sanders:Renement-OrientedProb- FormalAspectsofComputing.<br />
[MoRa95] pp325-353,1996. R.Motwani,P.Raghavan:RandomizedAlgorithms,CambridgeUniversity C.Morgan,A.McIver,K.Seidel:<strong>Probabilistic</strong>PredicateTrans<strong>for</strong>mers,<br />
Press,1995. ACMTransactionsonProgrammingLanguagesand<strong>Systems</strong>,Vol.8,No.3,<br />
[Miln80] [Miln83] R.Milner:ACalculusofCommunicating<strong>Systems</strong>,LectureNotesinComputerScience,Vol.92,1980. R.Milner:Calculi<strong>for</strong>SynchronyandAsynchrony,TheoreticalComputer<br />
[NiRe73] [Miln89] Science,Vol.25,pp269-310,1983. R.Milner:CommunicationandConcurrency,PrenticeHall,1989.<br />
[dNHe83] I.Nievergelt,E.Reinhold:BinarySearchTreesofBoundedBalance, SICOMP2,pp33-43,1973.<br />
[dNVa90] R.deNicola,F.Vaandrager:ThreeLogics<strong>for</strong>BranchingBisimulation, Proc.LICS'90,pp118-129,1990. R.deNicola,M.Hennessy:TestingEquivalences<strong>for</strong>Processes,Theoretical ComputerScience,Vol.34,pp83-133,1983.<br />
[NRS+90] [Niva79] X.Nicollin,J.Richier,J.Sifakis,J.Voiron:ATP:anAlgebraofTimed Processes,Proc.IFIPTC2WorkingConferenceonProgrammingConcepts M.Nivat:InniteWords,InniteTrees,InniteComputations,Founda- and<strong>Methods</strong>,SeaofGallilea,1990. tionsofComputerScienceIII,MathematicalCentreTracts109,pages<br />
[Norm97] [Niwi88] G.Norman:MetricSemantics<strong>for</strong>Reactive<strong>Probabilistic</strong>Processes,Ph.D. 3-52,1979. D.Niwinski:FixedPointsVs.InniteGeneration,Proc.LICS'88,1988. Thesis,UniversityBirmingham,1997.
BIBLIOGRAPHY [NudF95] M.Nu~nez,D.deFrutos:TestingSemantics<strong>for</strong><strong>Probabilistic</strong>LOTOS,in 333<br />
[NdFL95] M.Nu~nez,D.deFrutos,L.Llana:AcceptanceTrees<strong>for</strong><strong>Probabilistic</strong>Processes,Proc.CONCUR'95,LectureNotesinComputerScience,Vol.962, pp249-263,1995. FormalDescriptionTechniquesVIII,pp365-380,Chapman&Hall,1995.<br />
[OwLa82] [OwGr76] grams,ACMTransactionsonProgrammingLanguagesand<strong>Systems</strong>, I,ActaIn<strong>for</strong>matica,Vol.6,pp319-340,1976. S.Owicki,L.Lamport:ProvingLivenessPropertiesofConcurrentPro- S.Owicki,D.Gries:AnAxiomaticProofTechnique<strong>for</strong>ParallelPrograms<br />
[PaTa87] Vol.4(3),pp455-495,1982.<br />
[Park74] R.Paige,R.Tarjan:ThreePartitionRenementAlgorithms,SIAMJournalofComputing,Vol.16,No.6,pp973-989,1987. [Park81] TheUniversityofWarwick,1974.PublishedinTheoreticalComputerScience,Vol.3(2),pp173-181,1976. D.Park:ConcurrencyandAutomataonInniteSequences,Proc.5th D.Park:FinitenessisMu-ineable,TheoryofComputationReportNo.3,<br />
[Pele93] 1981. D.Peled:Allfrom<strong>On</strong>e,<strong>On</strong>efromAll:<strong>On</strong>ModelCheckingUsingRepresentatives,Proc.CAV'93,LectureNotesinComputerScience,Vol.697, GIConference,LectureNotesinComputerScience,Vol.104,pp167-183,<br />
[PPH96] pp409-423,1993. D.Peled,V.Pratt,G.Holzmann(eds):Proc.DIMACSWorkshoponPar-<br />
[PSS98] Society,SeriesinDiscreteMathematicsandTheoreticalComputerScience, Bd.29,1996. A.Philippou,O.Sokolsky,I.Lee:WeakBisimulation<strong>for</strong><strong>Probabilistic</strong> tialOrder<strong>Methods</strong>inVerication(POMIV'96),AmericalMathematical<br />
[Plot81] <strong>Systems</strong>,submitted<strong>for</strong>publication.<br />
[Pnue77] portDAIMIFN-19,ComputerScienceDepartment,AarhusUniversity, 1981. A.Pnueli:TheTemporalLogicofPrograms,Proc.FOCS'77,pp46-57, G.Plotkin:AStructuralApproachtoOperationalSemantics,Techn.Re-<br />
[Pnue83] 1977.<br />
[PnRo89] Proc.15thACMSymposiumonTheoryofComputing,1983. A.Pnueli,R.Rosner: A.Pnueli:<strong>On</strong>theExtremelyFairTreatmentof<strong>Probabilistic</strong>Algorithms,<br />
[PnZu86a] DistributedComputing,Vol.1,No.1,pp53-72,1986. A.Pnueli,L.Zuck:VericationofMultiprocess<strong>Probabilistic</strong>Protocols, Proc.POPL'89,pp191-201,1989. <strong>On</strong>theSynthesisofaReactiveModule,<br />
[PnZu86b] [PnZu93] tion,Vol.103,pp1-29,1993.<br />
A.Pnueli,L.Zuck:<strong>Probabilistic</strong>VericationbyTableaux,Proc.LICS'86, pp322-331,1986. A.Pnueli,L.Zuck:<strong>Probabilistic</strong>Verication,In<strong>for</strong>mationandComputa
334 [PoSe95] A.Pogosyants,R.Segala:FormalVericationofTimedPropertiesofRan- BIBLIOGRAPHY<br />
[Prat76] V.Pratt: domizedDistributedAlgorithms,Proc.PODC'95,1995.<br />
[Prat81] V.Pratt:ADecidableMu-Calculus,Proc.FOCS'81,pp421-427,1981. FOCS'76,pp109-121,1976. SemanticalConsiderationsofFloyd-HoareLogic,Proc.<br />
[Pria96] [PuSu89] C.Priami:Stochastic-calculuswithgeneraldistributions,Proc.4th Int.WorkshoponProcessAlgebraandPer<strong>for</strong>manceModelling,pp41-57. C.L.U.T.Press,1996.<br />
[Pute94] haviourinConcurrent<strong>Systems</strong>,IEEETransactiononSoftwareEngineerS.Purushothaman,P.Subrahmanyam:Reasoningabout<strong>Probabilistic</strong>Be- [QuSi82] M.Puterman:MarkovDecisionProcesses,JohnWileyandSons,1994. ing,SE-13(6),1989.<br />
[QuSi83] J.Queille,J.Sifakis:SpecicationandVericationofConcurrent<strong>Systems</strong><br />
tems{aTemporalLogictodealwithFairness,ActaIn<strong>for</strong>matica,Vol.19,J.Queille,J.Sifakis:FairnessandRelatedPropertiesinTransitionSys- NotesinComputerScience,Vol.137,pp337-351,1982. inCESAR,Proc.5thInternationalSymposiumonProgramming,Lecture<br />
[Rabi63] [Rabi76a] pp195-220,1983. M.Rabin:<strong>Probabilistic</strong>Automata,In<strong>for</strong>mationandControl,Vol.6,1963.<br />
[Rabi76b] 66-75,1976. M.Rabin:<strong>Probabilistic</strong>Algorithms,in\AlgorithmsandComplexity:Re- SharedVariables,JournalofComputerandSystemScience,Vol.25,pp M.Rabin:N-ProcessMutualExclusionwithBoundedWaitingby4logN<br />
[Rabi80] centResultsandNewDirections"(J.Traub,ed.),AcademicPress,New York,pp21-40,1976.<br />
[Ross83] M.Rabin:<strong>Probabilistic</strong>Algorithms<strong>for</strong>TestingPrimality,J.NumberThe- S.Ross:IntroductiontoStochasticDynamicProgramming,Academic Press,NewYork,1983. ory,Vol.12,pp128-138,1980.<br />
[Rude93] [Rudi66] R.Rudell:DynamicVariableOrdering<strong>for</strong>OrderedBinaryDecisionDia-<br />
[RuTu93] grams,Proc.IEEEICCAD'93,pp42-47,1993. W.Rudin:RealComplexAnalysis,McGraw-Hill,1966.<br />
[Safr88] J.J.M.M.Rutten,D.Turi:<strong>On</strong>theFoundationsofFinalSemantics:Non-<br />
1988. StandardSets,MetricSpacesandPartialOrders,Proc.REXWorkshop'92, S.Safra:<strong>On</strong>theComplexityof!-Automata,Proc.FOCS'88,pp319-327, LectureNotesinComputerScience,Vol.666,pp477-530,1993.<br />
[SaFu96] [Schr87] T.Sasao,M.Fujita:RepresentationsofDiscreteFunctions,KluwerAca- 1987.<br />
demicPublishers,1996. A.Schrijver:TheoryofLinearandIntegerProgramming,J.Wiley&Sons,
BIBLIOGRAPHY [Seid92] K.Seidel:<strong>Probabilistic</strong>CommunicatingProcesses,Ph.D.Thesis,Ox<strong>for</strong>d 335<br />
[Seid95] University,1992.<br />
[Seidl96] K.Seidel:<strong>Probabilistic</strong>CommunicatingProcesses,TheoreticalComputer Science,Vol.152,pp219-249,1995.<br />
[Sega95a] R.Segala:ModelingandVericationofRandomizedDistributedReal- Time<strong>Systems</strong>,Ph.D.Thesis,MassachusettsInstituteofTechnology,1995. H.Seidl:AModalMu-Calculus<strong>for</strong>DurationalTransition<strong>Systems</strong>,Proc. LICS'96,pp128-137,1996.<br />
[Sega96] [Sega95b] pp234-248,1995. R.Segala:Testing<strong>Probabilistic</strong>Automata,Proc.CONCUR'96,Lecture R.Segala:ACompositionalTrace-BasedSemantics<strong>for</strong><strong>Probabilistic</strong>Automata,Proc.CONCUR'95,LectureNotesinComputerScience,Vol.962, [SeLy94] R.Segala,N.Lynch:<strong>Probabilistic</strong>Simulations<strong>for</strong><strong>Probabilistic</strong>Processes, NotesinComputerScience,Vol.1119,pp299-314,1996.<br />
[SiCl86] Proc.CONCUR'94,LectureNotesinComputerScience,Vol.836,pp481- 496,1994.ThefullversionwiththesametitlehasappearedinNordic JournalofComputing,Vol.2(2),pp250-273,1995.<br />
[SVW85] A.Sistla,E.Clarke:ComplexityofPropositionalTemporalLogics,Journal oftheACM,Vol.32(3),pp733-749,1986.<br />
[SCV92] A.Sistla,M.Vardi,P.Wolper:TheCompletionProblem<strong>for</strong>BuchiAutomatawithApplicationstoTemporalLogic,Proc.ICALP'85,LecturetributedComputing<strong>Systems</strong>,pp260-268,IEEEComp.Soc.Press,1992.R.Sisto,L.Ciminiera,A.Valenzo:<strong>Probabilistic</strong>CharacterizationofAlgebraicProtocolSpecications,Proc.12thInternationalConferenceonDis NotesinComputerScience,Vol.194,pp465-474,1985.<br />
[SmSt90] S.Smolka,B.Steen:PriorityasExtremalProbability,Proc.CON-<br />
[SmPl82] Computing,Vol.8,pp585-606,1996. CUR'90,LectureNotesinComputerScience,Vol.458,pp456-466,1990. ThefullversionwiththesametitlehasappearedinFormalAspectsof<br />
[StWa91] C.Stirling,D.Walker:LocalModelCheckingintheModalMu-Calculus, TheoreticalComputerScience,Vol.89,pp161-177,1991. M.Smyth,G.Plotkin:TheCategory-TheoreticSolutionofRecursive Equations,SIAMJ.Comput.,Vol.11,pp761-783,1982.<br />
[StVa98] [StEm84] M.Stoelinga,F.Vaandrager:RootContentioninIEEE1394,submitted <strong>for</strong>publication.<br />
[SLG94] R.Street,E.A.Emerson:AnAutomataTheoreticDecisionProcedure<strong>for</strong> PropositionalMu-Calculus,Proc.ICALP'84,LectureNotesinComputer Science,Vol.172,pp465-472,1984.<br />
[Stoy77] grammingLanguageTheory.MITPress,Cambridge,1977.<br />
Domains,CambridgeUniversityPress,1994. J.Stoy:DenotationalSemantics:TheScott-StracheyApproachtoPro- V.Stoltenberg-Hansen,I.Lindstrom,E.Grior:MathematicalTheoryof
336 [Suth77] W.Sutherland:IntroductiontoMetricandTopologicalSpaces,Ox<strong>for</strong>d BIBLIOGRAPHY<br />
[Thom90] UniversityPress,1977.<br />
[Thom96] puterScience,Vol.B,ElsevierSciencePublishers,Amsterdam,pp135-191, 1990. W.Thomas:Languages,Automata,andLogic,Techn.Report9607,ChrisW.Thomas:AutomataonInniteObjects,HandbookofTheoreticalCom- [Toft90] C.Tofts:ASynchronousCalculusofRelativeFrequency,Proc.CON- tianAlbrechtsUniversitatKiel,1996.<br />
[Toft94] C.Tofts:ProcesseswithProbabilities,PriorityandTime,FormalAspects ofComputing,Vol.6,No.5,1994. CUR'90,LectureNotesinComputerScience,Vol.458,pp467-480,1990.<br />
[Vard85] [Valm94] Vol.46,pp6-14,1994. M.Vardi:AutomaticVericationof<strong>Probabilistic</strong>ConcurrentFinite-State Programs,Proc.FOCS'85,pp327-338,1985. A.Valmari:StateoftheArtReport:StubbornSets,PetriNetNewsletters,<br />
[Vard96] M.Vardi:AnAutomata-TheoreticApproachtoLinearTemporalLogic,<br />
[VaWo86] in\Logics<strong>for</strong>Concurrency{StructureversusAutomata"(F.Moller,G. Birtwistle,eds.),LectureNotesinComputerScience,Vol.1043,pp238- 265,1996.<br />
[VaWo94] ProgramVerication,Proc.LICS'86,pp332-344,1986. M.Vardi,P.Wolper:ReasoningaboutInniteComputations,In<strong>for</strong>mation M.Vardi,P.Wolper:AnAutomata-TheoreticApproachtoAutomatic<br />
[Varg62] andComputation,Vol.115(1),pp1-37,1994.<br />
[dVin98] R.Varga:MatrixIterativeAnalysis,Prentice-Hall,Inc.,EnglewoodClis, NewJersey,1962.<br />
[dViRu97] E.deVink:<strong>On</strong>aFunctor<strong>for</strong><strong>Probabilistic</strong>BisimulationandPreservation ofWeakPullbacks,Techn.Report,VrijeUniversiteitAmsterdam,1998.<br />
[Wins84] ACoalgebraicApproach,Proc.ICALP'97,LectureNotesinComputer Science,Vol.1256,pp460-470,1997. G.Winskel:SynchronisationTrees,TheoreticalComputerScience,Vol.34, E.deVink,J.Rutten:Bisimulation<strong>for</strong><strong>Probabilistic</strong>Transition<strong>Systems</strong>:<br />
[WVS83] pp33-82,1984.<br />
[WSS94] P.Wolper,M.Vardi,A.Sistla:ReasoningaboutInniteComputation S.Wu,S.Smolka,E.Stark:CompositionandBehavioursof<strong>Probabilistic</strong> I/O-Automata,Proc.CONCUR'94,LectureNotesinComputerScience, Paths,Proc.FOCS'83,pp185-194,1983.<br />
[YCDS94] Vol.836,1994.ThefullversionwiththesametitlehasappearedinTheoreticalComputerScience,Vol.176,pp1-38,1997. [Yi91] W.Yi:ACalculusofRealTime<strong>Systems</strong>,Ph.D.Thesis,ChalmersUniS.Yuen,R.Cleaveland,Z.Dayar,S.Smolka:FullyAbstractCharacterizationsofTestingPreorders<strong>for</strong>probabilisticProcesses,Proc.CONCUR'94, LectureNotesinComputerScience,Vol.836,pp497-512,1994. versity,1991.
Change language