Modal logics for Brane Calculus
Marino Miculan Giorgio Bacci
Dept. of Mathematics and Computer Science
University of Udine, Italy. mm@uniud.it
Abstract. The Brane Calculus is a calculus of mobile processes, in-
tended to model the transport machinery of a cell system. In this paper,
we intro duce the Brane Logic, a modal logic for expressing formally prop-
erties about systems in Brane Calculus. Similarly to previous logics for
mobile ambients, Brane Logic has specific spatial and temporal modali-
ties. Moreover, since in Brane Calculus the activity resides on membrane
surfaces and not inside membranes, we need to add a specific logic (akin
Hennessy-Milner’s) for reasoning about membrane activity.
We present also a proof system for deriving valid sequents in Brane Logic.
Finally, we present a model checker for a decidable fragment of this logic.
1 Introduction
In [4], Cardelli has proposed a schematic model of biological systems as three
different and interacting abstract machines. Following the approach pioneered in
[13], these abstract machines are modelled using methodologies borrowed from
the theory of concurrent systems.
The most abstract of these three machines is the membrane machine, which
focuses on the dynamics of biological membranes. At this leve l of abstraction,
a biological system is seen as a hierarchy of compartments, which can interact
by changing their position. In order to model this machinery, Cardelli has in-
troduced the Brane Calculus [3], a calculus of m obile nested processes where
the computational activity takes place on membranes, not inside them. A pro-
cess of this represents a system of nested membranes; the evolution of a process
corresponds to membrane interactions (phagocytosis, endo/exocytosis, . . . ).
Having such a formal representation of the membrane machine, a natural
question is how to express formally also the biological properties, that is, the
“statements” about a given system. Some examples are the following:
“If a macrophage is exposed to target cells that have been evenly coated
with antib ody, it ingests the coated cells.” [1, Chap.6, p.335]
“The [. . . ] Rous sarcoma virus [. . . ] can transform a cell into a cancer
cell.” [1, Chap.8, p.417]
“The virus escapes from the endosome” [1, Chap.8, p.469]
In our opinion, it is highly desirable to be able to express formally (i.e., in a
well-specified logical formalism) this kind of properties. First, this would avoid
the intrinsic ambiguity of natural language, ruling out any misinterpretation of
the meaning of a statement. Secondly, such a logical formalism can be used for
defining specifications of systems, i.e. requirements that a s ystem must satisfy.
These specifications can be used in (semi)automatic verification of existing sys-
tems (using model-checking or static analysis techniques), or in (semi)automatic
synthesis of new systems (meeting the given specification). Finally, the logical
formalism yields naturally a formal notion of system equivalence: two systems
are equivalent if they satisfy precisely the same properties. Often this equiva-
lence implies observational equivalence (depending on the expressive power of
the logical formalism), so a subsystem can be replaced with a logically equivalent
one (possibly synthetic) without altering the behaviour of the whole system.
The aim of this work is to take a step in this direction. We introduce the
Brane Logic, a modal logic specifically designed for expressing properties about
systems described using the Brane Calculus. Modal logics are com monly used in
concurrency theory for describing behaviour of concurrent systems. In particu-
lar, we take inspiration from Ambient Logic, the logic for Ambient calculus [5].
Like Ambient Logic, our logic features spatial and temporal modalities, which
are sp ecific logical operators for expressing properties about the top ology and
the dynamic behaviour of nested systems. However, differently from Ambient
Logic, we need to define also a specific logic for expressing properties of mem-
branes themselves. Each membrane can be seen as a flat surface where different
agents can interact, but without nestings. Thus membranes are more similar to
CCS than to Ambients; as a consequence, the logic for membranes is similar to
Hennessy-Milner’s logic [8], extended with spatial connectives as in [2].
After having defined Brane Logic and its formal interpretation over the
Brane Calculus (Section 3), in Section 4 we consider sequents, and introduce
a set of valid inference rules (with many derivable corollaries). Several examples
throughout the paper will illustrate the expressive power of the logic. Finally, in
Section 5, we single out a fragment of the calculus and of the logic for which the
satisfiability problem is decidable and for which we give a model checker algo-
rithm. Conclusions, final remarks and directions for future work are in Section 6.
2 Summary of Brane calculus
In this paper we focus on the basic version of Brane Calculus without commu-
nication primitives and molecular complexes. For a description of the intuitive
meaning of the language and the reduction rules, we refer the reader to [3].
Syntax of (Basic) Brane Calculus
Systems Π : P, Q ::= k | σhP i | P m Q |!P
Membranes Σ : σ, τ ::= 0 | σ|τ | a.σ |!σ
Actions Ξ : a, b ::= J
n
| J
I
n
(σ) | K
n
| K
I
n
| G(σ)
where n is taken from a countable set Λ of names. We will write a, hPi and
σhi, instead of a.0, 0hP i and σhki, respectively.
The set of free names of a system P , of a membrane σ and of an action a,
denoted by FN(P ), FN(σ), FN(a) respectively, are defined as usual; notice that
in this syntax there are no binders.
2
As in many process calculi, terms of the Brane Calculus can be rearranged
according to a structural congruence relation (≡). For a formal definition see [3].
The dynamic behaviour of Brane Calculus is specified by means of a reduction
relation (“reaction”) between systems P } Q, whose rules are the following:
Operational Semantics
J
I
n
(ρ).τ|τ
0
hQi m J
n
.σ|σ
0
hP i}τ |τ
0
hρhσ|σ
0
hP ii m Qi (React phago)
K
I
n
.τ|τ
0
hK
n
.σ|σ
0
hP i m Qi}σ|σ
0
|τ|τ
0
hQi m P (React exo)
G(ρ).σ|σ
0
hP i}σ|σ
0
hρhki m P i (React pino)
P } Q
σhP i } σhQi
P } Q
P m R } Q m R
(React loc, React comp)
P ≡ P
0
P
0
} Q
0
Q
0
≡ Q
P } Q
(React equiv)
We denote by }
∗
the usual reflexive and transitive closure of }.
As in [3], the Mate-Bud-Drip calculus is easily encoded, as follows:
Derived membrane constructors and reaction
Mate : mate
n
.σ , J
n
.K
n
0
.σ mate
I
n
.τ , J
I
n
(K
I
n
0
.K
n
00
).K
I
n
00
.τ
mate
n
.σ|σ
0
hP i m mate
I
n
.τ|τ
0
hQi }
∗
σ|σ
0
|τ|τ
0
hP m Qi
Bud : bud
n
.σ , J
n
.σ bud
I
n
(ρ).τ , G(J
I
n
(ρ).K
n
0
).K
I
n
0
.τ
bud
I
n
(ρ).τ|τ
0
hbud
n
.σ|σ
0
hP i m Qi }
∗
ρhσ|σ
0
hP ii m τ|τ
0
hQi
Drip : drip
n
.(ρ).σ , G(G(ρ).K
n
).K
I
n
.σ
drip
n
(ρ).σ|σ
0
hP i }
∗
ρhi m σ|σ
0
hP i
3 The Brane Logic
In this section we introduce a logic for expressing properties of systems of the
Brane Calculus, called Brane Logic. Like similar temp oral-spatial logics, such
as Ambient Logic [5] and Separation Logic [14], Brane Logic features special
modal connectives for expressing spatial properties (i.e., about relative positions)
and behavioural properties. The main difference between its closest ancestor
(Ambient Logic), is that Brane Logic can express properties about the actions
which can take place on membranes, not only in systems. Thus, there are actually
two spatial logics, interacting each other: one for reasoning about membranes
(called membrane logic) and one for reasoning about systems (the system logic).
Syntax The syntax of the Brane Logic is the following:
Syntax of Brane Logic
System formulas Φ
A, B ::= T | ¬A | A ∨ B (classical propositional fragment)
k (void system)
MhAi | A@M (compartment, compartment adjoint)
A m B | A B B (spatial composition, composition adjoint)
NA | mA (eventually m odality, somewhere modality)
∀x.A (quantification over names)
3
Membrane formulas Ω
M, N ::= T | ¬M | M ∨ N (classical propositional fragment)
0 (void membrane)
M|N | M I N (spatial composition, composition adjoint)
)α*M (action modality)
Action formulas Θ
α, β ::= J
η
| J
I
η
(M) (phago, co-phago)
K
η
| K
I
η
(exo, co-exo)
G(M) (pino)
η ::= n | x (terms)
Give n a formula A, its free names FN(A) are easily defined, since there are no
binders for names. Similarly, we can define the set of free variables FV(A), notic-
ing that the only binder for variables is the universal quantifier. As usual, a
formula A is closed if FV(A) = ∅.
For sake of simplicity, we will use the shorthands Mhi and )α* in place of
Mhki and )α*0 respectively.
We give next an intuitive explanation of the most unusual constructors.
- P satisfies MhAi if P ≡ σhQi, where σ and Q satisfy M and A respectively.
- @ e B are very useful for expressing security and safety properties.
A system P satisfies A@M if, when P is enclosed in a membrane satisfying
M, the resulting system satisfies A. Similarly, a system P satisfies A B B if,
when P is put aside a system enjoying B, the whole system satisfies A.
- A membrane σ satisfies )α*M if σ can perform an action satisfying α, yielding
a residual satisfying M.
- M|N and its adjoint M I N are analogous to A ◦ B and A B B respectively.
Satisfaction Formally, the meaning of a formula is defined by means of a family
of satisfaction relations, one for each syntactic sort of logical formulas
1
⊆ Π × Φ ⊆ Σ × Ω ⊆ Ξ × Θ
These relations are defined by induction on the syntax of the formulas. Let us
start with satisfaction of systems. First, we have to introduce the subsystem
relation P ↓ Q (read “Q is an immediate subsystem of P ”), defined as
P ↓ Q , ∃P
0
: Π, σ : Σ.P ≡ σhQi|P
0
We denote by ↓
∗
the reflexive-transitive closure of ↓.
Then, we can define the satisfaction of system formulas.
Satisfaction of System Formulas
∀P : Π P T
∀P : Π, A : Φ P ¬A , P 2 A
∀P : Π, A, B : Φ P A ∨ B , P A ∨ P B
∀P : Π P k , P ≡ k
∀P : Π, A : Φ, M : Ω P MhAi , ∃P
0
: Π, σ : Σ.P ≡ σhP
0
i ∧ P
0
A ∧ σ M
1
We will use the same symbol for the three relations, since they are easily distin-
guishable from the context.
4
∀P : Π, A, B : Φ P A m B , ∃P
0
, P
00
: Π.P ≡ P
0
m P
00
∧ P
0
A ∧ P
00
B
∀P : Π, A : Φ, x : ϑ P ∀x.A , ∀m : Λ.P A{x ← m}
∀P : Π, A : Φ P NA , ∃P
0
: Π.P }
∗
P
0
∧ P
0
A
∀P : Π, A : Φ P mA , ∃P
0
: Π.P ↓
∗
P
0
∧ P
0
A
∀P : Π, A : Φ, M : Ω P A@M , ∀σ : Σ.σ M ⇒ σhP i A
∀P : Π, A, B : Φ P A B B , ∀P
0
: Π.P
0
A ⇒ P m P
0
B
This definition relies on the satisfaction of membrane formulas, which we define
next. To this end, we need to introduce a notion of membrane observation, by
means of a labelled transition system (LTS) σ
l
−→ τ for membranes. A crucial
point is how to define correctly the labels (i.e., the observations) l of this LTS.
The evident similarity between membranes and Milner’s CCS [12] could sug-
gest to define observations simply as actions; e.g., we could take a.σ
a
−→ σ.
However, an important difference between membranes and CCS is that in latter
case, the labels are τ and communications over channels, i.e. names (possibly
together with terms, which are separated from processes in any case). On the
other hand, actions in membranes form a whole language, which incorporates
also the membranes themselves. Thus, observing actions over the membranes
would mean to observe explicitly (also) membranes instead of some abstract
logical property. For instance, in the transition J(σ).τ
J(σ)
−−−→ τ we have a spe-
cific membrane σ in the label. This kind of observation is too “fine-grained” and
inte nsional with respect to the rest of the logic, which never deals with specific
membranes but only with their properties.
Therefore, we choose to take as labels the action formulas, instead of actions.
Thus the LT S is a relation σ
α
−→ τ , which reads as “σ performs an action satisfying
α, and reduces to τ”. This LTS is defined by the following rules:
Labelled Transition System for Membranes
a α
a.σ
α
−→ σ
(prefix)
σ
α
−→ σ
0
σ|τ
α
−→ σ
0
|τ
(par)
σ ≡ σ
0
σ
0
α
−→ τ
0
τ
0
≡ τ
σ
α
−→ τ
(equiv)
Notice that in the (prefix) rule we use the satisfaction relation for actions:
Satisfaction of action formulas
∀a : Γ, n : Λ a J
n
, a = J
n
∀a : Γ, n : Λ, M : Ω a J
I
n
(M) , ∃σ : Σ.a = J
I
n
(σ) ∧ σ M
∀a : Γ, n : Λ a K
n
, a = K
n
∀a : Γ, n : Λ a K
I
n
, a = K
I
n
∀a : Γ, M : Ω a G(M) , ∃σ : Σ.a = G(σ) ∧ σ M
This relation is defined in terms of the satisfaction of membrane formulas:
Satisfaction of membrane formulas
∀σ : Σ σ T
∀σ : Σ, M : Ω σ ¬M , σ 2 M
∀σ : Σ, M, N : Ω σ M ∨ N , σ M ∨ σ M
5