Our growing dependence on increasingly complex computer and software systems necessitates the development of formalisms, techniques, and tools for assessing functional properties of these systems. One such technique that has emerged in the last twenty years is model checking, which systematically (and automatically) checks whether a model of a given system satisfies a desired property such as deadlock freedom, invariants, and request-response properties. This automated technique for verification and debugging has developed into a mature and widely used approach with many applications. Principles of Model Checking offers a comprehensive introduction to model checking that is not only a text suitable for classroom use but also a valuable reference for researchers and practitioners in the field. The book begins with the basic principles for modeling concurrent and communicating systems, introduces different classes of properties (including safety and liveness), presents the notion of fairness, and provides automata-based algorithms for these properties. It introduces the temporal logics LTL and CTL, compares them, and covers algorithms for verifying these logics, discussing real-time systems as well as systems subject to random phenomena. Separate chapters treat such efficiency-improving techniques as abstraction and symbolic manipulation. The book includes an extensive set of examples (most of which run through several chapters) and a complete set of basic results accompanied by detailed proofs. Each chapter concludes with a summary, bibliographic notes, and an extensive list of exercises of both practical and theoretical nature.

/pdf/principles-of-model-checking-249iimickz.pdf

Principles of Model Checking

We present the a-calculus, a calculus of communicating systems in which one can naturally express processes which have changing structure. Not only may the component agents of a system be arbitrarily linked, but a communication between neighbours may carry information which changes that linkage. The calculus is an extension of the process algebra CCS, following work by Engberg and Nielsen, who added mobility to CCS while preserving its algebraic properties. The rr-calculus gains simplicity by removing all distinction between variables and constants; communication links are identified by names, and computation is represented purely as the communication of names across links. After an illustrated description of how the n-calculus generalises conventional process algebras in treating mobility, several examples exploiting mobility are given in some detail. The important examples are the encoding into the n-calculus of higher-order functions (the I-calculus and combinatory algebra), the transmission of processes as values, and the representation of data structures as processes. The paper continues by presenting the algebraic theory of strong bisimilarity and strong equivalence, including a new notion of equivalence indexed by distinctions-i.e., assumptions of inequality among names. These theories are based upon a semantics in terms of a labeled transition system and a notion of strong bisimulation, both of which are expounded in detail in a companion paper. We also report briefly on work-in-progress based upon the corresponding notion of weak bisimulation, in which internal actions cannot be observed. 0 1992 Academic Press, Inc.

A calculus of mobile processes, II

Software architectures shift the focus of developers from lines-of-code to coarser-grained architectural elements and their overall interconnection structure. Architecture description languages (ADLs) have been proposed as modeling notations to support architecture-based development. There is, however, little consensus in the research community on what is an ADL, what aspects of an architecture should be modeled in an ADL, and which of several possible ADLs is best suited for a particular problem. Furthermore, the distinction is rarely made between ADLs on one hand and formal specification, module interconnection, simulation and programming languages on the other. This paper attempts to provide an answer to these questions. It motivates and presents a definition and a classification framework for ADLs. The utility of the definition is demonstrated by using it to differentiate ADLs from other modeling notations. The framework is used to classify and compare several existing ADLs, enabling us, in the process, to identify key properties of ADLs. The comparison highlights areas where existing ADLs provide extensive support and those in which they are deficient, suggesting a research agenda for the future.

/pdf/a-classification-and-comparison-framework-for-software-3so7xapmcq.pdf

A classification and comparison framework for software architecture description languages

This is the second of two papers in which we present the rc-calculus, a calculus of mobile processes. The companion paper (Milner, Parrow, and Walker, 1989a) contains an introduction to the calculus through a sequence of examples, together with statements of many results about it. The purpose of the present paper is to provide a detailed presentation of some of the theory of the calculus developed to date, and in particular to establish most of the results stated in the companion paper. Once the motivation and intuition for the n-calculus are understood, with the help of the companion paper, the present paper serves as a self-contained development of the theory. To achieve this we have found it necessary to repeat some material from the companion paper. Section 1 contains a description of the syntax of agents and a discursive presentation of the transitional semantics. In Section 2 we present and motivate the definitions of strong bisimulation and strong bisimilarity, strong equivalence, and a useful family of indexed equivalences. Section 3 contains a series of properties of strong bisimilarity, while properties of

A Calculus of Mobile Processes - Part II

From the Publisher:
Since the introduction of Hoares' Communicating Sequential Processes notation, powerful new tools have transformed CSP into a practical way of describing industrial-sized problems. This book gives you the fundamental grasp of CSP concepts you'll need to take advantage of those tools.Part I provides a detailed foundation for working with CSP, using as little mathematics as possible. It introduces the ideas behind operational, denotational and algebraic models of CSP. Parts II and III go into greater detail about theory and practice. Topics include: parallel operators, hiding and renaming, piping and enslavement, buffers and communication, termination and sequencing, and semantic theory. Three detailed practical case studies are also presented.For anyone interested in modeling sequential processes.

/pdf/the-theory-and-practice-of-concurrency-1kzi2sg7cs.pdf

The Theory and Practice of Concurrency

The Concurrency Workbench is an automated tool for analyzing networks of finite-state processes expressed in Milner's Calculus of Communicating Systems. Its key feature is its breadth: a variety of different verification methods, including equivalence checking, preorder checking, and model checking, are supported for several different process semantics. One experience from our work is that a large number of interesting verification methods can be formulated as combinations of a small number of primitive algorithms. The Workbench has been applied to the verification of communications protocols and mutual exclusion algorithms and has proven a valuable aid in teaching and research.

The concurrency workbench: a semantics-based tool for the verification of concurrent systems

http://www.lix.polytechnique.fr/Labo/Catuscia.Palamidessi/teaching/DEA/General/modmob.pdf

Modal logics for mobile processes

We present the fusion calculus as a significant step towards a canonical calculus of concurrency. It simplifies and extends the /spl pi/-calculus. The fusion calculus contains the polyadic /spl pi/-calculus as a proper subcalculus and thus inherits all its expressive power. The gain is that fusion contains actions akin to updating a shared state, and a scoping construct for bounding their effects. Therefore it is easier to represent computational models such as concurrent constraints formalisms. It is also easy to represent the so called strong reduction strategies in the /spl lambda/-calculus, involving reduction under abstraction. In the /spl lambda/-calculus these tasks require elaborate encodings. Our results on the fusion calculus in this paper are the following. We give a structured operational semantics in the traditional style. The novelty lies in a new kind of action, fusion actions for emulating updates of a shared state. We prove that the calculus contains the /spl pi/-calculus as a subcalculus. We define and motivate the bisimulation equivalence and prove a simple characterization of its induced congruence, which is given two versions of a complete axiomatization for finite terms. The expressive power of the calculus is demonstrated by giving a straight-forward encoding of the strong lazy /spl lambda/-calculus, which admits reduction under /spl lambda/ abstraction.

Joachim Parrow

Papers

A calculus of mobile processes, II

A Calculus of Mobile Processes - Part II

The concurrency workbench: a semantics-based tool for the verification of concurrent systems

Modal logics for mobile processes

The fusion calculus: expressiveness and symmetry in mobile processes