The Theory of Interacting Deductions

and its

Application to Operational Semantics

Andrew Wilson

Doctor of Philosophy University of Edinburgh i In memory of my father who died after a courageous struggle with a long illness, and to my mother who struggled with him. You taught me faith, hope, love and

perseverence, thank you. iii Not a single truth has ever been discovered without people first talking utter rot a hundred times or perhaps a hundred thousand times.

— Razumikhin, in Dostoyevsky’s “Crime and Punishment”. v

Abstract

This thesis concerns the problem of complexity in operational semantics definitions. The appeal of modern operational semantics is the simplicity of their metatheories, which can be regarded as theories of deduction about certain shapes of operational judgments. However, when applied to real programming languages they produce bulky definitions that are cumbersome to reason about. The theory of interacting deductions is a richer metatheory which simplifies operational judgments and admits new proof techniques.

An interacting deduction is a pair (F, I), where F is a forest of inference trees and I is a set of interaction links (a symmetric set of pairs of formula occurrences of F), which has been built from interacting inference rules (sequences of standard inference rules, or rule atoms). This setting allows one to decompose operational judgments. For instance, for a simple imperative language, one rule atom might concern a program transition, and another a store transition. Program judgments only interact with store judgments when necessary: so stores do not have to be propagated by every inference rule. A deduction in such a semantics would have two inference trees: one for programs and one for stores.

This introduces a natural notion of modularity in proofs about semantics. The proof fragmentation theorem shows that one need only consider the rule atoms relevant to the property being proved. To illustrate, I give the semantics for a simple process calculus, compare it with standard semantics and prove three simple properties: nondivergence, store correctness and an equivalence between the two semantics.

Typically evaluation semantics provide simpler definitions and proofs than transition semantics. However, it turns out that evaluation semantics cannot be easily expressed using interacting deductions: they require a notion of sequentiality. The sequential deductions contain this extra structure. I compare the utility of evaluation and transition semantics in the interacting case by proving a simple translation correctness example. This proof in turn depends on proof-theoretic concerns which can be abstracted using dangling interactions. This gives rise to the techniques of breaking and assembling interaction links. Again I get the proof fragmentation theorem, and also the proof assembly theorem, which allow respectively both the isolation and composition of modules in proofs about semantics. For illustration, I prove a simple type-checking result (in evaluation semantics) and another nondivergence result (in transition semantics).

I apply these results to a bigger language, CSP, to show how the results scale up. Introducing a special scoping side-condition permits a number of linguistic extensions including nested parallelism, mutual exclusion, dynamic process creation and recursive procedures. Then, as an experiment I apply the theory of interacting deductions to present and prove sound a compositional proof system for the partial correctness of CSP programs.

Finally, I show that a deduction corresponds to CCS-like process evaluation, justifying philosophically my use of the theory to give operational semantics. A simple corollary is the undecidability of interacting-deducibility. Practically, the result also indicates how one can build prototype interpreters for definitions.

Acknowledgments

First and foremost, a big thank you to my supervisor Kevin Mitchell for his painstaking help and advice. Thanks are also due to Gordon Plotkin, Bob Tennant, Robin Milner and Colin Stirling who have variously belonged to my supervision committee, and given helpful suggestions.

Thanks are also due to my officemates Pietro Cenciarelli and Alex Simpson, and to my flatmate Julyan Elbro for their friendship and their comments on early drafts. Thanks also to Saif, Pietro and Alex for making my office days very pleasant, and similarly to Dave Aspinall and all my friends in the LFCS.

Thanks to the Science and Engineering Research Council (now EPSRC) for funding the first three years of my thesis. Thanks also to my mum and the Department of Computer Science which allowed me to scrape a living teaching after the three years had expired.

Finally, I could not have survived a project of this magnitude without the support and care of my family and my friends, of which I have too many to acknowledge by name individually. You know who you are. But especial thanks to my closest friends, Andrew, Douglas and David, and to my flatmates Dave, Julyan, Doug and Dan who put up with the bad times. Thanks also to the members of Mayfield-Salisbury church, and especially the three families who over the years all but adopted me: the Jamiesons, the Simpsons and the Vandersteens. Thanks also to Lt. Heather Chambers and the boys of the 3rd Edinburgh Company, The Boys’ Brigade who boosted my flagging spirits during those long depressing months. Finally, thanks to my TEAM co-leader Helen Hopwood who made running TEAM much less stressful than it should have been. ix

Declaration

This thesis was composed by myself. The work reported herein, unless otherwise stated, is my own.

Andrew Wilson xi

Table of Contents

1. Defining Programming Languages 1

2. Interacting Deductions 13 2.1 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 2.2 Interacting deductions . . . . . . . . . . . . . . . . . . . . . . . . . 16

2.2.1 Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 2.2.2 I-deductions have no dependency loops . . . . . . . . . . . . 18 2.2.3 DLF helps characterize the I-deductions . . . . . . . . . . . 19

2.3 An Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 2.3.1 Comparative Semantics . . . . . . . . . . . . . . . . . . . . . 23 2.3.2 Extending the semantics . . . . . . . . . . . . . . . . . . . . 25 2.3.3 Reasoning about semantics . . . . . . . . . . . . . . . . . . . 27

2.4 Fragments of deductions . . . . . . . . . . . . . . . . . . . . . . . . 28 2.5 Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

2.5.1 Extending a nondivergence proof . . . . . . . . . . . . . . . 30 2.5.2 A modular proof about stores . . . . . . . . . . . . . . . . . 32 2.5.3 An equivalence theorem . . . . . . . . . . . . . . . . . . . . 34

2.6 Chapter summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

3. Evaluation Semantics and Sequential Deductions 39

3.1 Sequential composition in evaluation semantics . . . . . . . . . . . . 41 3.1.1 Cutting intermediate states . . . . . . . . . . . . . . . . . . 41 3.1.2 Control stacks (or continuations) . . . . . . . . . . . . . . . 43 3.1.3 Coding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 3.1.4 Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 3.1.5 Solution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

3.2 Sequential deductions . . . . . . . . . . . . . . . . . . . . . . . . . . 48 3.2.1 Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Table of Contents xiii

3.2.2 QI-deductions have no sequencing loops . . . . . . . . . . . 51 3.2.3 SLF helps characterize the QI-deductions . . . . . . . . . . . 52 3.2.4 Coding QI-deduction into I-deduction . . . . . . . . . . . . . 54

3.3 An evaluation QI-semantics for P(;) . . . . . . . . . . . . . . . . . 55 3.4 An example: translation correctness . . . . . . . . . . . . . . . . . . 57

3.4.1 The translation . . . . . . . . . . . . . . . . . . . . . . . . . 58 3.4.2 The transition semantics proof of correctness . . . . . . . . . 58 3.4.3 Tree Pruning and partial deductions . . . . . . . . . . . . . 60 3.4.4 The evaluation semantics proof of correctness . . . . . . . . 62 3.4.5 Appraisal (equivalence, nondeterminism, nontermination) . . 65

3.5 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

4. The content of interaction 69

4.1 DQI-deduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 4.1.1 Structures, Histories and Binary Assemblies . . . . . . . . . 72 4.1.2 Deduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 4.1.3 Coding QI-deduction into DQI-deduction . . . . . . . . . . . 79

4.2 Proof Fragmentation . . . . . . . . . . . . . . . . . . . . . . . . . . 81 4.2.1 The interaction reflection theorem . . . . . . . . . . . . . . . 82 4.2.2 The Proof Fragmentation Theorem . . . . . . . . . . . . . . 83 4.2.3 An example: Type checked processes do not fail . . . . . . . 84 4.2.4 Proof fragmentation is not always enough . . . . . . . . . . 86

4.3 Proof Assembly . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 4.3.1 Example: Terminating processes type-check . . . . . . . . . 90 4.3.2 Example: Another nondivergence proof . . . . . . . . . . . . 91

4.4 Chapter summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

5. A Semantics and Logic for CSP 95

5.1 A Definition of CSP . . . . . . . . . . . . . . . . . . . . . . . . . . 95 5.1.1 Syntax and informal semantics . . . . . . . . . . . . . . . . . 95 5.1.2 Static Semantics . . . . . . . . . . . . . . . . . . . . . . . . 97 5.1.3 Auxiliary Definitions: Stores . . . . . . . . . . . . . . . . . . 98 5.1.4 Dynamic semantics . . . . . . . . . . . . . . . . . . . . . . . 98

5.2 Some alternative features . . . . . . . . . . . . . . . . . . . . . . . . 103 5.2.1 Nested Parallelism . . . . . . . . . . . . . . . . . . . . . . . 103 5.2.2 Shared Variables . . . . . . . . . . . . . . . . . . . . . . . . 104 Table of Contents xiv

5.2.3 Dynamic process creation . . . . . . . . . . . . . . . . . . . 105 5.2.4 Pre-emption . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 5.2.5 Multicasting . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 5.2.6 Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

5.3 An Application: Program Verification . . . . . . . . . . . . . . . . . 109 5.3.1 A Hoare Logic for the partial correctness of CSP . . . . . . . 112 5.3.2 An example partial correctness proof . . . . . . . . . . . . . 115 5.3.3 Soundness of the Hoare Logic . . . . . . . . . . . . . . . . . 116 5.3.4 Appraisal . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

5.4 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

6. The process calculus interpretation 129

6.1 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 6.1.1 On formula occurrences . . . . . . . . . . . . . . . . . . . . 130 6.1.2 The process calculus . . . . . . . . . . . . . . . . . . . . . . 131 6.1.3 Well-terminating processes . . . . . . . . . . . . . . . . . . . 132 6.1.4 Formalising scoping . . . . . . . . . . . . . . . . . . . . . . . 132

6.2 The interpretation . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 6.2.1 The interpretation is sound . . . . . . . . . . . . . . . . . . 136 6.2.2 The interpretation is complete . . . . . . . . . . . . . . . . . 142 6.2.3 The reverse interpretation . . . . . . . . . . . . . . . . . . . 148

6.3 Some consequences . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 6.3.1 Sequencing is not primitive . . . . . . . . . . . . . . . . . . 148 6.3.2 Deducibility is undecidable . . . . . . . . . . . . . . . . . . . 148 6.3.3 Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

6.4 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

7. Conclusions 151 7.1 The theory of interacting deductions . . . . . . . . . . . . . . . . . 151 7.2 Application to operational semantics . . . . . . . . . . . . . . . . . 153 7.3 Further work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154

7.3.1 Scope Extrusion . . . . . . . . . . . . . . . . . . . . . . . . . 154 7.3.2 Static semantics . . . . . . . . . . . . . . . . . . . . . . . . . 155 7.3.3 More Extensions . . . . . . . . . . . . . . . . . . . . . . . . 155 7.3.4 The relationship to Linear Logic . . . . . . . . . . . . . . . . 157 Table of Contents xv A. Languages of operational judgments 161

A.1 A formal definition of language . . . . . . . . . . . . . . . . . . . . 161 A.2 Algebras and operational semantics . . . . . . . . . . . . . . . . . . 162

B. The correctness of CSP 165

B.1 A Structural Operational Semantics of CSP . . . . . . . . . . . . . 166

B.1.1 The Labelled transition system . . . . . . . . . . . . . . . . 166 B.2 Stage one: from interleaving to true concurrency . . . . . . . . . . . 167 B.3 Stage two: from ordinary to interacting transition rules . . . . . . . 171 B.4 Stage three: from interacting transitions to evaluations . . . . . . . 174

B.4.1 The other direction: from evaluations to transitions . . . . . 179

Glossary of notations

SETS (see, e.g., [End77]) X, Y: arbitrary sets

∩: intersection ∪: union ⊆: subset \: set difference ∈: membership ∅: empty set ℘: powerset

MULTISETS (see figure 2–2 on page 35)

RELATIONS

R: arbitary binary relations, or labelled binary relations (p. 72)

R^{∗}: transitive closure R^{♭}: delabeling (“flattening”) a la-

beled relation R^{∘}: symmetric closure of labeled

relation

NUMBERS m, n: arbitary naturals i, j, k: arbitrary indices

ℕ: the set of natural numbers ℤ: the integers

SEQUENCES (page 30) X^{ω}: set of countable, possibly

empty sequences of elements from X

s: arbitrary sequence ε: empty sequence

s · s′: sequence concatenation

|s|: the length of s dom s: the indices of s s(i): the ith element of s FUNCTIONS f, g: arbitrary functions

0: the empty function 0 : ∅ → ∅ f : X → Y: total function f : X ⇀ Y: partial function f : X ↔ Y: bijection dom f: the domain of f im f: the image of f f ⊕ g: function overwriting: (f ⊕

g)x = g(x) if x ∈ dom g, oth-

erwise f(x)

f ↾ X: restrict domain of f to dom f ∩ X

LOGIC ϕ, χ, ψ: arbitrary formulae

⊃: implication ∧: conjunction ∨: disjunction ¬: negation

∀x.ϕ: universal quantification ∃x.ϕ: existential quantification

LANGUAGE

L: arbitrary language A, B, C, …: arbitrary formulae and

formula occurrences A^{i}: formula occurrence with posi-

tion explicit θA: instantiation of A by substi-

tution θ F V (A): the free variables of A A ≡ B: occurrences A and B match

(i.e., they are occurrences of the same formula).

+A, −A: formula perceptions

(p. 70) X^{±}: set of perceptions of formulae

in X Glossary xvii

INFERENCE RULES a: arbitrary rule atom (p. 15) θa: instance of atom with respect

to θ r: arbitrary rule θr: instance of rule with respect

to θ R: arbitrary rule set

DEDUCTION T : arbitrary deductive system T: formula tree F: formula forest ≲_{F}: the preorder of F (p. 18)

O(F): the set of occurrences in for-

est F (F, I): I-structure (p. 19) (F, I, ⊏): QI-structure (p. 49) (F, I, ⊏, D): DQI-structure (p. 72)

Σ: arbitrary structures or deduc-

tions Π: arbitrary deductions

O(Σ): the set of occurrences in Σ D(Σ): the set of dangling interac-

tions in DQI-structure Σ N(Σ): the set of neighbourhoods of

Σ (p. 20) N_{Σ}(A): the neighbourhood of occur-

rence A in Σ I(T ): the set of deductions of I-

system T QI(T ): the set of deductions of QI-

system T DQI(T ): the set of deductions of

DQI-system T ≲_{Σ}: the preorder of structure Σ <_{Σ}= (≲_{Σ}) \ (≳_{Σ}) ∼_{Σ}= (≲_{Σ}) ∩ (≳_{Σ})

0: empty deduction ⊥: deduction of no information

(p. 61) Σ ⊢ A_{1}, …, A_{n}: Σ concludes for-

mula occurrences A_{1}, …, A_{n} T ⊢ A_{1}, …, A_{n}: some T -deduction

concludes A_{1}, …, A_{n} T ⊩ A_{1}, …, A_{n}: some proper

T -deduction (DQI) concludes A_{1}, …, A_{n} (p. 76)

⨂_{f} X: assembly of a set of struc-

tures (p. 74) Σ ⊗_{f} Π: binary assembly of Σ and Π

(p. 74) Σ ⪯ Π: Π simulates Σ (p. 82) Σ ≃ Π: Σ ⪯ Π and Π ⪯ Σ 𝔹(Σ): result of breaking every inter-

action link in Σ 𝔹(T ): result of breaking every inter-

action link in T 𝔽_{T} (X): set of T -fragments of struc-

tures in X

PROCESSES (page 22) p, q, r : arbitrary processes Nam: set of names a, b, c, …: arbitrary names \overline{Nam}: set of conames of Nam ā, b̄, c̄, …: arbitrary conames Lab: labels

l: arbitrary label τ: silent action Act: action set

α: arbitrary action 0: the null process |: parallel composition

α.p: action prefix

;: sequential composition p \ X: restriction

≈: weak bisimulation Ω: set of terminated processes

STORES

σ: arbitrary store σ(x): value of x in σ σ[v/x]: updating x to have value v

in store σ

Convention

In this thesis, I use the following convention to label lemmas, propositions and theorems. A proposition is either an interesting but not important result about interacting deductions, or an example proof which highlights some point. Propositions are numbered m.n where m is the chapter or appendix number, and n indicates that this is the nth proposition in that chapter or appendix.

A theorem is an interesting result about the theory of interacting deductions, and is numbered using upper case roman numerals.

A lemma is a separate result used in the proof of a proposition or theorem. They are labeled m(n) where m is the label of either the proposition or theorem it helps prove, and n is a lower case roman numeral.

Finally, a corollary is an interesting, but lesser result that is a straightforward consequence of either a proposition or theorem. Corollaries are labeled mn where m is the label of either the theorem or proposition from which the corollary follows, and n is a lower case letter. xix

Chapter 1

Defining Programming Languages

To learn a foreign language, one has to learn the structure of its sentences, what they mean, and how they can be used to express one’s thoughts. Similarly, to learn a programming language, one has to learn the structure of programs, what they mean, and how one can use them to express one’s algorithms. These three aspects of language are called syntax, semantics and pragmatics.

Our interest lies in the formal semantics of programming languages. A formal semantics gives a complete and unambiguous account of the defined language. Ideally, this has a number of uses. First, it aids the language developer. Writing a formal semantics forces the designer to fill every hole and resolve every ambiguity that may have existed in the original conception. It may also improve the design, highlighting its poorly thought out, or overly complex areas.

Second, a formal semantics can help the implementer. A formal semantics is an unambiguous compiler specification. The implementer should be able to extract all the information he needs to implement the language before he starts coding. Moreover, it may also suggest implementation strategies. Along similar lines, a formal semantics can also be used as a basis for developing automatic compiler generators or prototype interpreters, static analyzers and program analysis tools such as debuggers and execution profilers. It also can be useful for developing learning tools such as program animators, tutorials and reference manuals.

Third, a formal semantics can help the programmer. Apart from being a complete and concise reference, and the basis for programming tools, it can be used to develop logics that help him reason about his software, in particular showing that it meets a specification.

Fourth, a formal semantics can help the businessman. A formal semantics can serve as a standard, which can ensure portability of software over platforms. It can also be used to write unambiguous implementation contracts that will guarantee such portability.

Ideally. In reality formal semantics (of real languages) are subtle pieces of mathematics which require substantial effort to write, read and use. They are prone to mistakes and ambiguities (e.g., [Kah93]). Even so, the attempt to give a semantics is worthwhile: even a near-perfect semantics can be useful at least informally, and anyway using a semantics will highlight flaws which can then be remedied, hopefully without too much renovation.

Chapter 1. Defining Programming Languages 2

This raises the question of correctness: how do we know a semantics defines our language? If it is complete and consistent, it certainly defines something, but is it the language we are concerned about? We cannot resolve this problem conclusively: there is always a gap between ideas and their formal expression. The best we can do is to give a series of different semantics and show that they agree. This is the proposal of consistent and complementary semantics argued in [HL74]: the more different (but mutually consistent) semantics we give a language, the more we can be sure that the language reflects no “irregularity” of a description method. [HK81] gives complementary semantics to the “Real-Time” language Tomal.

There are many different ways to give semantics (see [deB69,HL74,MLB76, Sve86,Gun91] for a survey. See also [Weg76] for a historical survey of programming languages), but they tend to fall into three categories: axiomatic, denotational and operational, characterized by their different emphases and hence uses. Axiomatic semantics (e.g., Hoare Logics [Apt81] and Predicate Transformers [DS90]) describe programs in terms of the properties (expressible in some assertion language) which they satisfy. [HW73] gives an example axiomatic semantics for most of Pascal. Their main use is to facilitate reasoning about programs. To justify such reasoning, one has to prove the axiomatic semantics sound with respect to some model of the programming language.

Denotational semantics (e.g., [Sch88]) provide such models: they map programs to denotations, which are abstract mathematical representations of program behaviour. [Mos74] gives a denotational semantics for Algol 60. Every feature of the language is defined without regard to implementation details. As such they are very useful for linguistic analysis, and for providing correctness criteria for other semantics of languages.

Operational semantics (e.g., [Hen90]) describe how an ideal, abstract machine would simulate the behaviour of a program. [HMT90] gives an operational semantics for Standard ML. Operational semantics are useful to the language implementer. Since at least the modern kind tend to be mathematically light, and also programmers tend to understand languages in terms of how a “notional machine” would execute programs [DBOM81,Ber91], these semantics tend to be relatively accessible.

The point is that no one semantic formalism does everything well. We need a variety of different formalisms, first, to be sure that the language we have described is the one we intended to describe. Second, to overcome inherent biases of formalisms to particular kinds of language. For example, traditional denotational semantics uses λ-notation. Both Mosses [Mos91, §18.1], or [Mos90, §6.1] and Abramsky et al. [AGN94] argue that this biases denotational semantics towards sequential, functional languages. It is hard to code up and hard to read even conventional imperative or concurrent languages. The third reason is for insurance: we cannot guarantee that every new linguistic feature will be expressible in the current framework of choice.

Therefore there is always a need to develop and evaluate new semantic description methods. This thesis concerns a novel approach to specifying operational semantics. Operational semantics description methods tend to fall into two main

Description Method Defined languages

Indirect  Abstract machines  Facile [GMP89]
SMoLCS  Ada (Draft) [ABNB^{+}86]

[AR87a,AR87b,SMo]

Evolving Algebras

[Gur91,EA] C, C++, Occam, VHDL, Modula-2, Prolog, Parlog, Gödel

Action Semantics

[Mos91,AS] Standard ML, CML, Amber, Occam, Pascal, Joyce

Direct  VDL [Weg72]  PL/I [LW69,AI75]
W-Grammars  Algol 68
[CU73,MLB76]  [vWMPK69,vWMP^{+}75]
SOS [Plo81]  Esterel [BG92],

Facile [GMP90], LCS [Ber93b]

Natural Semantics Standard ML [HMT90,MT90],
[Kah87,CEN]  Eiffel [ACO93],

Sisal [Jab95,ACW95]

Figure 1–1: Some direct and indirect operational semantics of real languages

categories: indirect semantics which translate programs into a better understood language, and direct semantics which do not. Our approach gives direct semantics. We shall compare indirect and direct semantics to see why this is worthwhile.

Operational semantics

Figure 1–1 is the result of a brief survey of operational descriptions of real programming languages. By “real” I mean languages which have actually been implemented and used in the programming community. It is probably incomplete, and therefore possibly misleading, but it does suggest that both kinds of operational semantics can define real programming languages, more or less equally well.

The reason for the success of indirect semantics is, I think, because we can always define a sufficiently high-level intermediate language, or abstract machine, that makes definition easy. The trick is to ensure that the abstract machine is Chapter 1. Defining Programming Languages 4

also simple enough to be readily understood. Now there are two philosophies for building such abstract machines. One aims to find a universal abstract machine. The other tailors abstract machines for each language. Action Semantics follows the first philosophy, while SMoLCS and Evolving Algebras follow the second.

The universalist philosophy has the advantage that we only have to understand one machine, which facilitates a large amount of foundational analysis and tool-building. It has the disadvantage that we have to work hard to ingest the various notations. For instance, there is an overwhelming amount of action notation. While it has been carefully designed to write near-english descriptions, to understand it properly we have to fathom Mosses’s ersatz presentation of structural operational semantics for it [Mos91, App B.6] because near-english descriptions can be misleading. Another disadvantage is that it provides little insurance against unforseen linguistic features.

The individualist philosophy does insure against the future, and does not require prior understanding of an elaborate machine. It does require knowledge of an abstract machine description method, such as Structural Operational Semantics for SMoLCS and a simple rewriting system of first-order algebras for Evolving Algebras. Both are mathematically light and easily understood. Moreover, they both support the construction of tools: for example, both approaches have rapid prototyping (see the relevant webpages for details and more examples [SMo, EA]). Nevertheless, they do require more work per language, and we are less able to compare different languages or build sufficiently high-quality tools. It is more economic to research one machine intensively than many different machines.

Digressing a little, the indirect approach is pandemic in semantics. In denotational semantics, we use metalanguages: the traditional λ-notation [Sch88], the Logic of Computable Functions (LCF) [Sco69], FPC [Plo85] and the computational metalanguage [Mog90,Mog91,Cen96]. In this situation, metalanguages are convenient notations for manipulating the mathematical structures required to describe programs. They can also be used to consider denotational definitions abstractly, for instance the computational metalanguage allows us to plug together modules to make a variety of combinations of metalanguages.

At the other end of the spectrum, compiler theory uses intermediate code representations [TS85, ch. 10] because they are free of machine idiosyncrasies, they facilitate optimizations, they speed up compiler development and improve portability.

Yet no matter how useful intermediate languages are, ultimately we need a direct description of the foundations. We have already commented on how simple the semantic description methods are for foundational abstract machines; the great achievement is that these same methods can give manageable definitions of real programming languages too.

Two early examples of direct semantics were VDL (which subsequently became VDM: see [BJ78] for reasons why) and W-Grammars. The first consisted of two parts, a translator and an interpreter. The translator was used both to check grammar and context-sensitive constraints, and also to convert the concrete syntax of real programs into abstract syntax. The interpreter described how abstract Chapter 1. Defining Programming Languages 5

syntax representations of programs could evolve over time (in a not dissimilar way to evolving algebras). The second method used two levels of grammar: one for context-free aspects and meta-grammars for context-sensitive aspects of the language. The framework lumped syntax, static semantics and dynamic semantics together.

Syntax is that part of grammar that concerns the due arrangement of words or the construction of sentences. It is usually given inductively using EBNF, but there is a school advocating the use of the simply-typed λ-calculus [PE88] to represent syntax. Static semantics ensures that programs make sense: for instance, that everything is correctly typed, or that every identifier is declared. Dynamic semantics describes the behaviour of sensible programs. Modern semantics tend to separate the three.

There are two modern direct description methods: Structural Operational Semantics (SOS) and Natural Semantics. The first describes an automaton that evaluates programs of the defined language directly. That is, it specifies an abstract machine which directly manipulates programs. In the tradition of automata theory [HU79] a SOS is given by a (labelled) transition system:

Definition 1.0 ([Plo81]) A labelled transition system is a quadruple ⟨Γ, Ω, Λ, ⟶⟩ where Γ is a set of configurations; Ω ⊆ Γ is the set of terminal configurations; Λ is a set of labels and ⟶⊆ Γ × Λ × Γ is the transition relation, such that

for all γ ∈ Ω, λ ∈ Λ, γ′ ∈ Γ, not(γ ⟶^{λ} γ′)

where γ ⟶^{λ} γ′ is an abbreviation for ⟨γ, λ, γ′⟩ ∈⟶. A stuck configuration γ is any non-terminal configuration such that γ ⟶^{λ} γ′ for no λ ∈ Λ and γ′ ∈ Γ.

The definition of unlabelled transition systems is even easier: we simply remove every mention of labels from the preceding definition. That is, a transition system is a triple ⟨Γ, Ω, →⟩.

The main innovation is that the transition relation is defined inductively on the structure of programs, thereby permitting the use of structural induction on syntax to prove properties about transitions. An example of a SOS for the call-by-value λ-calculus can be found in figure 1–2.

Overall, the framework is mathematically simple, and permits one to describe the intuitive computation steps of programs easily. A natural semantics is even simpler: it does not involve a transition system; it simply consists of a set of syntax-directed rules that relate programs to their attributes (i.e., values, types or translations). The method is essentially proof-theoretic (see [Kri68,Kri71] for a survey of proof theory), and a natural semantics can be seen as a Post System [Pra71]. The following definition of natural semantics is based on that definition of Post System and the informal description given in [Kah87]:

Abstract syntax

M ::= x | λx.M | MM

where x ranges over V ar, the set of variable identifiers. Let LC be the set of all λ-calculus terms and V al = V ar ∪ {λx.M | x ∈ V ar, M ∈ LC} be the set of values, ranged over by v. SOS Transition system ⟨LC, V al, →⟩ where → is defined inductively by:

(λx.M)v → M[v/x]  {M → M′ \atop MN → M′N}  {N → N′ \atop (λx.M)N → (λx.M)N′}

Natural semantics ⟨∅, LC, V al, L, R⟩, where L = {M ⇒ v | M ∈ LC, v ∈ V al} and R is the set generated by the schemata

v ⇒ v  {M ⇒ λx.M′ N ⇒ v′ M′[v′/x] ⇒ v \atop MN ⇒ v}

Figure 1–2: Direct semantics for call-by-value λ-calculus

Definition 1.1 A Natural Semantics is a quintuple (E, C, A, L, R) where E is a set of environments, C is a set of configurations, A is a set of attributes, L is a language of atomic formulae built over the terms in E, C and A, and R is a set of inference rules determined as the instances of a finite number of schemata of the form

\begin{aligned}A_{1} & ⋯ & A_{n} \\ & B \end{aligned}

where A_{1}, …, A_{n}, B are atomic formulae, and B contains no parameters not occurring in {A_{1}, …, A_{n}}.

Again, it permits proofs about programs via the technique of rule induction. A natural semantics for the call-by-value λ-calculus can also be found in figure 1–2.

Indirect vs. Direct semantics

Having described indirect and direct semantics it now remains to compare them. Foundationally, indirect semantics are more complex, but they aim to simplify definitions using suitably high-level description languages. The proliferation of indirect definitions of real languages indicates that this goal is successful. The key issue is how to balance the complexity of metatheories against the complexity of definitions.

A first indication of the success of a description method is whether or not it has defined a real language. This is the ultimate purpose of description methods. However, as Mosses says, the description of one language in any framework could Chapter 1. Defining Programming Languages 7

merely be testament to the endurance of Man. A better indication is therefore how prolific a method is: the more definitions we have, the better the method must be. Regarding this criterion, figure 1–1 suggests that the modern indirect semantics are better than the direct ones. However, a large number of definitions could in turn merely be testament to the endurance of a small number of research groups trying to promote the method. Further, the small number of real definitions may ultimately be due to the slow uptake of formal methods in industry rather than any demerit of the method. An even better indication therefore is how widespread a method is: the more people that use it, the better the method must be. Regarding this criterion, my experience is that SOS and Natural Semantics are by far the most popular.

We need to look more closely. The only hard evidence we have are the definitions themselves. To say anything meaningful, we must consider specific definitions. [GK93] gives the semantics of C using evolving algebras. However, this definition yields a big surprise: the translation from C syntax to evolving algebra rules is completely informal! This is unsatisfactory because it implies incompleteness. For example, their semantics of the goto statement is simply “move to the next task”, which is given by the NextTask function. This function is never defined: to do so would require a translator from program text to their task-based representation. I suspect that if they had to contain formal translators, evolving algebra definitions would require much more effort and be much less popular.

By contrast, every other approach relates programs to meanings in a completely formal manner. To compare two different semantic description methods, we need to see how each method gives meaning to a particular language (e.g., see [MLB76]).

[Wat87] does just that, he compares an action semantics of the core of Standard ML with its natural semantics [HMT90]. He gives three arguments for why he favours the action semantics:

1. Action semantics are easier to read, even by the layman.

2. Natural semantics use closures to capture static binding and mutual recursion, which is clumsy.

3. Natural semantics have to propagate stores and environments everywhere, which impares legibility.

The first argument is easily countered. If we want a superficial understanding of a language, we can read an informal semantics. This is easier to write (it doesn’t require knowledge of a pseudo-english grammar) and read (action notation scans oddly). To obtain a deep understanding of a language we have to invest a lot of effort anyway, whether to understand action notation or the various techniques used in natural semantics.

This also counters the second argument. Closures are a standard part of the natural semantics arsenal. However, we do not even need to use closures — we can use substitution instead, much like we do in figure 1–2 (see also extended natural semantics [Han93]).

The third argument is more interesting. Certainly, natural semantics rules can be overwhelmed with syntactic notations, e.g., rules (114) and (115) of [HMT90]:

s, E ⊢ exp ⇒ ref, s′ s′, E ⊢ atexp ⇒ v, s′′ a ∉ Dom(mem of s′′)
s, E ⊢ exp atexp ⇒ a, s′′ + {a ↦ v}

\begin{matrix}s, E ⊢ exp ⇒:=, s′ & s′, E ⊢ atexp ⇒ \{1 ↦ a, 2 ↦ v\}, s′′ \\ s, E ⊢ exp atexp ⇒ \{\} in Val, s′′ + \{a ↦ v\} \end{matrix}

It was precisely to reduce the syntactic clutter of rules that they introduced the state convention. It permits us to elide states from the presentation of rules by providing a mechanical way to put them in when needed. Watt claims (p.582) that this “does not entirely solve this problem; besides, the [convention] is clearly ad-hoc, and not generally applicable”. This is wrong. In terms of legibility, it does solve the problem of propagating stores everywhere (except of course where the store is actually used). Furthermore, the convention is not ad-hoc because the same mechanism can be used in any semantics whose judgments have the same structure and where stores behave in the same way (most metatheories of operational semantics tend to concern the structure of judgments: e.g., Typol [Des88] and GSOS [BIM88]).

I would say that the problem of syntactic overload has less to do with store and environment propagation, and more to do with the amount of auxiliary definitions and notations a language definition requires. Once again, this is the same issue as the previous two points.

Ultimately, the question of which method gives the clearest semantics is subjective. [MLB76] (which was written by three people) remarks when comparing four definitions of a simple language, “Each of us found the technique we knew the best to be the clearest” (p.271). Yet they also remark (p.274) that for formal semantics to become widely accepted outside Theoretical Computer Science, great attention must be paid to human engineering, so that the general reader can gain some benefit from perusing a semantics. Action Semantics has been deliberately engineered in this way. However Natural Semantics judgments are also readily understandable, for example, “In environment E, program p evaluates to v” is quite clear.

The state convention is an aid to legibility, but it does not formally alter the rules. The rules do propagate stores, and when we are proving results, we have to consider their unabbreviated forms (or at the very least check to see if the rules match the required shape). Moreover, because rules have to carry around the state of the entire system, it makes alteration and extension harder. If I want to introduce a new component to the configurations, I have to rewrite every rule, and reprove every theorem — even if the extension is orthogonal.

Despite this difficulty, Natural Semantics (and SOS) have virtues too. For one, their metatheories are very simple, and they permit proofs by induction. Furthermore, they have proved useful as bases for program analysis and theories of tool construction. For example, they have been used in theories of static analysis [Tof87], compiler generation [DJ86], debugging [DS92], program animation [Ber91] and programming environments [CEN].

Chapter 1. Defining Programming Languages 9

My thesis is that we can reduce the syntactic clutter of their semantic judgments in a formal way while retaining their virtues: an intuitive metatheory and amenability to simple proofs by induction.

Synopsis

The problem is that semantic rules contain too much information: each judgment must record the entire state of an abstract machine, even those components which are not directly relevant to the rule at hand. For instance, suppose we wished to add stores to the λ-calculus, and wished to modify its SOS. Then the syntax would become:

M ::= x | λx.M | MM | set α M | get α

where α ranges over a distinguished set of memory locations, Loc. The semantic rules would become

⟨(λx.M)v, σ⟩ → ⟨M[v/x], σ⟩  {⟨M, σ⟩ → ⟨M′, σ′⟩ \atop ⟨MN, σ⟩ → ⟨M′N, σ′⟩}

{⟨N, σ⟩ → ⟨N′, σ′⟩ \atop ⟨(λx.M)N, σ⟩ → ⟨(λx.M)N′, σ′⟩}  {⟨M, σ⟩ → ⟨M′, σ′⟩ \atop ⟨set α M, σ⟩ → ⟨set α M′, σ′⟩}

⟨set α v, σ⟩ → ⟨v, σ[v/α]⟩  ⟨get α, σ⟩ → ⟨M, σ⟩ if M = σ(α)

and where σ, ranging over the set Store of functions V ar ⇀ LC, represents the state of the store, such that σ[v/x](y) = if y = x then v else σ(y).

Every rule has to be altered to propagate the store, yet only the last two rules actually interact with it. Every other rule simply passes it around, cluttering up the syntax and obscuring the essential meaning the rule imparts to the connectives. The stores have to be propagated everywhere to capture their serial behaviour.

In this example, the interaction between stores and programs is limited to the set and get connectives. The other connectives do not interfere with the store in any way. If only we could limit the occurrence of stores to where they were really needed. That is, we should like to interpret the old rules “in an ambient store”, and add

set α v → v alter the ambient store  get α → v read the ambient store

The above state convention does this. However, as we have said, it is only a convention, and in proofs we still have to consider every rule, either in its full form, or to check that they have the required shape.

We would like to be more formal. When we prove results not concerning the store, we should like not to mention stores. Similarly, when we prove results solely about the store, we should like not to mention programs. We want to have two kinds of transition, one for programs and one for stores. The essential idea is that when the program wishes to write to the store then it induces a store transition. That is, we should like to apply

set α v → v  and  σ → σ[v/α]

simultaneously. We denote simultaneity of application by drawing a line (an “interaction link”) between the two rules. Therefore we can reuse the old rules which talk about function application and introduce special rules for the store.

To see how this scheme would work, suppose we want to prove that the first transition of (λx.M)(set α v) alters the store. The rules show that we first have to prove that set α v alters the store, and that second, being the argument to λx.M does not alter that fact.

We apply the two interacting rules for set to obtain the two interacting proof trees:

set α v → v − σ → σ[v/α]

We can then apply the third application rule directly to the program transition tree to get

{(set α v) → v \atop (λx.M)(set α v) → (λx.M)v}  σ → σ[v/α]

which again consists of two interacting proof trees, one for the program and one for the store. Hence the first transition of the program does alter the store.

Throughout this thesis, we shall be concerned to evaluate the practical qualities of the various proof metatheories we examine. The idea is to study how easy it is to prove properties about the operational semantics we describe. To avoid confusion, I shall use the term “deduction” to apply to the interacting proof trees, and “proof” to refer to the mathematical arguments establishing results about the deductions.

Chapter 2, “Interacting Deductions”, describes I-deduction, the metatheory of this kind of interacting deduction. It also demonstrates the properties of I-deductions using a simple process calculus called P. We give it a novel transition semantics which does not propagate action information. We compare it to two more standard transition semantics.

We find that the novel semantics is marginally simpler than the standard two. However, when we add stores to P to yield the language P(:=), the gains are increased. Again, we do not have to propagate stores everywhere. Moreover, we also discover that the extension is modular. The new rules for the stores can be added to each of the three semantics without change.

Section 2.5.1 shows how we can extend a simple proof about the nondivergence of P processes to P(:=) processes. It shows how much simpler the extension is in our metatheory than in the standard ones. Section 2.5.2 shows that a simple proof about store transitions remains true regardless of where they are used. In this sense, our metatheory permits modular proofs. Both of these examples make use of the proof fragmentation theorem, which allows us to break proofs about Chapter 1. Defining Programming Languages 11

I-deductions into proofs about the individual proof-trees. Section 2.5.3 shows how it can be used to simplify an equivalence proof between our semantics for P and the most standard one.

Chapter 3, “Evaluation Semantics and Sequential Deductions”, shows that not only can the I-deductions give transition semantics to P, they can also give natural semantics-like definitions (henceforth called “evaluation semantics”). However, P does not have sequential composition. When we add it (to get P(;)) we find that the evaluation I-semantics become much less perspicuous. Therefore we alter the metatheory to introduce a notion of sequencing, obtaining QI-deduction.

This turns out to be quite subtle. Sequencing already exists in I-deduction (otherwise we could not have given P(;) semantics), but not in a convenient form. The subtlety lies in getting the two forms of sequencing to agree. Once this is resolved, we proceed to compare how the evaluation semantics of P(;) fares in a simple translation correctness result with a standard transition semantics.

The results are mixed. We should expect this — in conventional modern operational semantics, SOS fares better than Natural Semantics for concurrent languages. A main problem is that nonterminating behaviour cannot be expressed in an evaluation semantics. Another is that it is hard to define notions of process equivalence in evaluation semantics, making analysis of nondeterminism difficult. These are problems owing to the particular nature of the semantic judgments involved (transition versus complete evaluation), and are not overcome in a QI-system. Thus it is generally not a good idea to use natural semantics-like judgments to capture the meaning of concurrent languages. A notable exception occurs in chapter 5 where we use an evaluation semantics in the soundness proof of a Hoare Logic for the partial correctness of CSP.

Nevertheless, the translation correctness proof is structurally simpler in that we do not have to perform any subinductions on the length of transition sequences. Thus we may still be able to use it profitably for proving results about sequential and deterministic languages.

Both I-deduction and QI-deduction concern systems of inference rules which do not consider the information shared via particular interactions. Chapter 4, “The Content of Interaction”, describes a metatheory (DQI-deduction) which allows formulae to be assigned to particular interactions, denoting the information which is shared during the interaction.

The definition of DQI-deduction is more naturally inductive than the definitions of I-deduction and QI-deduction. This allows some proofs to proceed directly by induction on the structure of deductions rather than via the proof fragmentation theorem. Moreover it introduces another proof technique called proof assembly. For motivation, we use a simple type-checking example. Proof fragmentation is enough to show that no type-checked process fails. This technique is insufficient to show the other direction: that every successful process type-checks. For this we need proof assembly, which allows us to assemble proofs from proofs about fragments.

The family of processes based around P are too simple. We need a larger example to test whether that our semantic method scales up. Chapter 5, “A Chapter 1. Defining Programming Languages 12

Semantics and Logic for CSP”, gives an evaluation semantics to CSP quite easily. However, just to be sure that CSP is not pathological, we also examine various extensions: nested parallelism, communication via shared variables, dynamic process creation, pre-emption, multicasting and recursive procedures. It turns out that only pre-emptive primitives cannot be given an evaluation semantics.

To show that the semantics is useful, we introduce a novel one-level compositional Hoare Logic for CSP and prove it sound. Usually one-level compositional Hoare Logics need to trace communicative histories carefully. Our method does not. Moreover, the technique is quite general, and should be applicable to other concurrent languages with little alteration. The soundness proof is also very simple, using the evaluation semantics for CSP.

Finally, we finish by confirming that our semantic method really is an operational semantics. The reason that natural semantics are operational is because the deduction of semantic judgments describes how the program evaluated. It is well-known that natural semantics can be seen as Prolog [CM84] clauses, and that in this light yields a prototype interpreter for the defined language [Des84] (For refinements of the idea, see [And91,DS92].) I believe it is precisely because the inference rules make an interpreter that a natural semantics is an operational semantics. (See [Sun84a] for a discussion on meaning via proof theory.) In chapter 6, “The Process Calculus Interpretation”, we show how our interacting rules can be seen as CCS process definitions to yield prototype interpreters. The interpretation is quite straightforward, and also allows us to reinterpret processcalculus results in terms of our proof-theory. For instance, we show that there is no procedure to decide whether a set of formulae is deducible in an arbitrary DQI-system.

Interacting Deductions

In Natural Deduction, an inference tree traces the proof of a theorem. A leaf is a basic axiom and an internal node an intermediate step. One can imagine a mathematician reasoning from some basic axioms step by step till he deduces his result.

We can think of an interacting deduction as the work of a community of mathematicians, each trying to deduce his or her own theorem. Again, a leaf is a basic axiom and an internal node an intermediate step. However, mathematicians also collaborate, discussing ideas which may be mutually stimulating. Therefore an interacting deduction also records the fact of collaboration: an interaction link records the mutual dependency of two simultaneous inference steps.

This chapter is concerned with the basic theory of interacting deductions, and does not consider the content of interactions (this is considered in chapter 4). In fact we can still do a lot with this basic theory, where interaction is really synchronization. We use it to give transition semantics to a simple concurrent language P, which we compare with more standard approaches. We find that both semantic definitions and proofs about them become simpler, easier to extend and more modular.

The key idea is that we do not always have to reason about the entire community of mathematicians to understand the work of a particular individual or group of individuals. Sometimes it is better to think about a fragment of the community in isolation. It is from this independence that our improved extensibility and modularity arise.

The structure of this chapter is as follows. Section 2.1 gives preliminary definitions and notations. Section 2.2 inductively defines ordinary interacting deductions, the I-deductions, from sets of I-rules. It also characterizes them axiomatically: in future proofs the axiomatic characterization is more convenient. Section 2.3 presents an application: a transition semantics for P using the theory of I-deductions. It shows how one can elide semantic objects from judgments. Thus judgments become syntactically simpler than their Structured Operational Semantics counterparts. Another consequence is that semantic definitions become more extensible, as illustrated by the extension of P to P(:=), a language with stores.

Chapter 2. Interacting Deductions 14

Section 2.4 introduces the technique of proof fragmentation: naïve reasoning about I-deductions may lead to clumsy proofs of even simple results. Fragmentation is simply a technique to allow reasoning about parts of deductions. For instance, in the semantics for P(:=), a deduction consists of two interacting trees: one for process transitions and the other for store transitions. Each tree is a fragment of the overall deduction. To reason about the behaviour of stores, it makes sense to prove the property using only the fragments of the rules that mention store transitions. The technique is justified formally by the proof fragmentation theorem, which can be (very) loosely phrased as

To prove a universal property about fragments of I-deductions, it is sound to reason over the rule fragments that build them.

Section 2.5 gives three examples of proof fragmentation. The first example shows how a proof about the termination of P can be extended to a proof about the termination of P(:=). Thus not only are semantic definitions easier to extend, proofs about them are easier to extend too. The second example is a proof about the stores used in the semantics of P(:=). This is simpler than a corresponding proof in a structured operational semantics because only the rules that mention stores are considered. It is also modular for the same reason. The last example uses fragmentation to simplify the proof of equivalence between the I-semantics and the structured operational semantics.

Many of my foundational definitions are modeled on Prawitz’s work on Natural Deduction [Pra65,Pra71]. I do not assume that the reader is familiar with it. However, I hope that those who are will see this work as a natural extension.

2.1 Preliminaries

Languages At the moment I do not want to commit myself to any particular notion of language — I believe that any meaningful notion will suffice. I am not here concerned with the properties of any particular language; I wish to concentrate on the structure of deduction. I assume the reader is familiar with the notions of formula, term, free variables and substitution. Appendix A gives a more formal account.

I use L to range over languages, A, B, C, … to range over formulae and t to range over terms. I write A ∈ L if A is a formula in language L, and M ∈ L if t is a term of the language L. I use x to range over variables, F V for the function that returns the set of free variables of a term or formula and θ for substitutions. I write θA for the instance of A obtained by applying θ to the free variables of A (and similarly for terms).

Intuitively, a deduction will be a forest of interacting inference trees where the interactions are represented as pairs of formula occurrences. The simplest way I have found to maintain such structures (particularly when defining rule application) is to introduce an artificial notion of formula occurrence (i.e., a new datatype) and then build inference trees out of these objects rather than formulae.

Chapter 2. Interacting Deductions 15

To avoid confusion, I shall always use the noun “occurrence” to refer to an artificial occurrence, and the verb “to appear” to mean “to occur within a structure”. Of course, no artificial occurrence should actually appear more than once in a deduction. This trick allows me to avoid defining forests as either multisets or sequences of inference trees, both of which are problematic.

I use Girard’s device [Gir87, p.29] to represent occurrences. Formally, a formula occurrence of L will be a pair (A, n) of a formula A ∈ L and a distinguishing tag n ∈ ℕ. If θA = B I write θ(A, n) = (B, n). If X is a set of formula occurrences, I shall write θX = {θ(A, n) | (A, n) ∈ X}. Similarly, I write F V (A, m) = F V (A). I write (A, n) ≡ (B, m) if A = B, in which case I say the two occurrences match or have the same shape. I say two sets of occurrences X and Y match (written X ≡ Y) if there exists a bijection f : X ↔ Y such that for all (A, n) ∈ X, f(A, n) ≡ (A, n).

It is very cumbersome to continually write (A, n) for an occurrence of A. Therefore, following Prawitz [Pra65, p25], I shall use the letters A, B, C, … to range over formula occurrences as well as formulae. I write A ∈ L if A is an occurrence of a formula in L. This will afford no confusion most of the time. When I want to distinguish two different occurrences of the same formula A, I shall not write pairs explicitly, but use Prawitz’s less intrusive superscript notation: A^{1} and A^{2}, and so on. This is not to be confused with my use of subscripts, where A_{1} and A_{2} may be occurrences of different formulae. Thus A_{1}^{1} and A_{1}^{2} are different occurrences of A_{1}, and A_{1}^{1} and A_{2}^{1} are occurrences of different formulae.

Throughout this section I shall assume a fixed L.

Formula Trees A formula tree is either a formula occurrence A or the pair (X, A) when X is a finite set of formula trees that share no formula occurrences, and A is a formula occurrence not already appearing in X. While formula trees are usually built from formulae, I use formula occurrences here because it simplifies the treatment of interaction later.

A tree T = (X, A) is written graphically in the following way:

{X \atop A} or \begin{aligned}T_{1} & ⋯ & T_{n} \\ & A \end{aligned}

if X = {T_{1}, …, T_{n}}. I call T_{1}, …, T_{n} the children of T, and say that A is the root of T (written A = root(T)). The subtree of relation is easily defined as the reflexive and transitive closure of the “child of” relation.

Formula Forests A formula forest F is a set of formula trees such that no occurrence appears more than once. I write O(F) for the set of formula occurrences in F. I write root(F) = {root(T) | T ∈ F }.

Rule atoms Rule atoms are used to build interacting rules. They are just the ordinary notion of rule (except that I use occurrences in place of formulae to avoid multisets of premises): a pair (P rem, C) where P rem ∪ {C} is a finite set of Chapter 2. Interacting Deductions 16

formula occurrences, and each occurrence appears only once. P rem is the set of premises of the atom, and C is the conclusion. I write θ(P rem, C) for the instance (θP rem, θC). I write (P rem_{1}, C_{1}) ≡ (P rem_{2}, C_{2}) when I say they also match if P rem_{1} ≡ P rem_{2} and C_{1} ≡ C_{2}. I use a to range over atoms.

2.2 Interacting deductions

A rule atom establishes how someone can draw a new inference from a set of previously established facts. An interacting rule establishes how a set of people can draw new inferences in their work after exchanging ideas with each other. For now I am not interested in what ideas are shared, or in who shares them (I shall consider this in chapter 4), so the definition of interacting rule is simply as follows.

I-rules An I-rule is a finite, non-empty set of rule atoms, such that no occurrence appears more than once. I drop the I- prefix whenever it is clear from the context. I use r to range over rules.

I write θr for the rule instance obtained by applying θ to its elements. Conventionally, rule instances will also be rules: uninstantiated rules will be rule schemata or rule templates that generate their instantiations. Two rules match (written r ≡ r′) if there exists a bijection f : r ↔ r′ such that for all a ∈ r, f(a) ≡ a. I write a rule with three atoms graphically in the following way:

{P rem_{1} \atop C_{1}} − {P rem_{2} \atop C_{2}} − {P rem_{3} \atop C_{3}}

where I have arbitrarily ordered the rule atoms. (Note that again I could have used sequences of atoms instead of sets, but to do so makes life harder.) When I enumerate the premise set of an atom I shall omit the set brackets. I write other interacting rules similarly.

I-systems An I-system T is a pair (L, R) where L is a language and R is a set of I-rules over formulae in L (typically, these will be generated from a finite set of rule schemata). In the rest of this chapter, I shall sometimes drop the “I” prefix when convenient.

I-deductions To motivate the definition of I-deduction, consider how our community of forgetful mathematicians deduce facts. At first, they have nothing until they write down some immediately obvious facts (an observation about the world, or an axiom of the formal system they are studying). From then on, at each stage in the community’s life, there will exist a body of knowledge represented by a forest F: the current facts are to be thought of as the roots of F. This is advanced whenever a group of (one or more) mathematicians (interested in disjoint sets of facts deduced by F_{1}, …, F_{n} ⊆ F) inspire each other by exchanging ideas, after which each mathematician is able to draw a new conclusion, C_{1}, …, C_{n}, respectively. (Thus each mathematician uses a rule atom matching (root(F_{i}), C_{i})). At Chapter 2. Interacting Deductions 17

this point, the premises of the rules have been forgotten: so if a result is required twice, it will have to be deduced twice. Note that it is possible for some current facts given by F_{0} ⊆ F not to be used at a particular step, so these remain available for the next step.

Definition 2.0 (I-Deduction) The set I(T ) of I-deductions of an I-system T is the least set such that

1. (∅, ∅) ∈ I(T )

2. if (a) (F, I) ∈ I(T ) where F = F_{0} ∪ F_{1} ∪ … ∪ F_{n} and F_{0}, …, F_{n} are all disjoint, and (b) {root(F_{1}) \atop C_{1}} − … − {root(F_{n}) \atop C_{n}} matches a rule of T such that C_{1}, …, C_{n} are distinct occurrences not in F, and (c) I′ = I ∪ \{(C_{i}, C_{j}) | 1 ≤ i, j ≤ n\}

then (F_{0} ∪ \{{F_{1} \atop C_{1}}, …, {F_{n} \atop C_{n}}\}, I′) ∈ I(T )

Note that this definition records an interaction by putting interaction links between every pair of new conclusions. Note also that every new conclusion interacts with itself. This is done purely for technical convenience: it ensures that I is a reflexive, symmetric and transitive relation (i.e., an equivalence relation).

For an alternative logical treatment due to Gordon Plotkin, see section 7.3.4.

2.2.1 Examples

Let L be the language consisting of two formulae, A and B. Let R be the following set of rules:

A  B  \begin{aligned}A & & A \\ & A \end{aligned} − \begin{aligned}B & & B \\ & B \end{aligned}

Then we have an I-system T = (L, R), and the following is (the graphical representation of) a simple T -deduction:

\begin{aligned}A & \begin{aligned}A & & A \\ & A \end{aligned} \\ & A \end{aligned}  \begin{matrix}\begin{aligned}B & & B \\ & B \end{aligned} & B \\ B \end{matrix}

(Technically, I should overline the leaves of this tree to indicate that they are axiom instances. However, doing this here makes the tree look ugly.) Note that interaction lines in rules are drawn between the rule atoms, but in a forest, they are drawn between the conclusions of rule instances in the forest.

The following is not an element of I(T ):

[figure: ^{\begin{aligned}A & \begin{aligned}A & & A \\ & A \end{aligned} \\ & A \end{aligned}  \begin{matrix}\begin{aligned}B & & B \\ & B \end{aligned} & B \\ B \end{matrix}}; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .]

Chapter 2. Interacting Deductions 18

One cannot apply the rules of T systematically to create this structure, even though it looks as if it were built from the rules. For instance, the dotted region (called in (non-topological) future terminology a neighbourhood) looks like an instance of the third rule.

The problem with this structure is that it contains a dependency loop. The structure contains two instances of the third rule, but each instance depends on conclusions of the other.

The next two subsections prove two important results about I-deductions. The first is that they have no dependency loops. The second result shows that in fact the absence of dependency-loops is a characterizing feature of I-deductions. This fact both gives us a clearer understanding of what deductions are, and allows us to reason about deductions more simply than the inductive definition.

2.2.2 I-deductions have no dependency loops

To show that the definition of I-deduction guarantees the avoidance of dependency loops, I characterize the dependencies between formula occurrences using preorders.

Preorders A preorder over a set X is a reflexive and transitive binary relation over the elements of X. I use the ≲ symbol to range over preorders. If a ≲ b then I also write b ≳ a. If a, b ∈ X, I write a < b for a ≲ b and b ≴ a, and a ∼ b for a ≲ b and b ≲ a.

Preorders of deductions Let F be an occurrence forest. I say A is below B in F (written A ≲_{F} B) if there exists a tree T ∈ F such that A is the root of a subtree of T containing B. I say ≲_{F} is the preorder of F. Actually, ≲_{F} is also a partial order, but the preorder of a deduction will not be so in general.

The preorder of a deduction (F, I) is given by

≲_{(F,I)}= (≲_{F} ∪I)^{∗}

The rationale is that formula occurrences are deduced from both those above them and those they interact with. I take the transitive closure of ≲_{F} ∪I to obtain a preorder, because (for example) A ≲_{F} B and BIC do not imply A(≲_{F} ∪I)C.

Dependency Loop Freeness I say a pair (F, I) is dependency-loop free if the following condition holds:

For all A, B ∈ O(F), if A <_{F} B then A <_{(F,I)} B. (DLF)

For motivation, again consider the community of mathematicians. If A <_{F} B then A must have been deduced after B. Given the definition of ≲_{(F,I)}, this obviously implies A ≲_{(F,I)} B. However, if A was deduced after B, then it could not also have been deduced simultaneously with B — therefore A ≁_{(F,I)} B. This means A <_{(F,I)} B. The problem with the non-example on page 17 is that it suggests that two occurrences were deduced both before and after each other.

Proposition 2.1 Let T be an I-system, and let (F, I) ∈ I(T ). Then (F, I) satisfies DLF.

Proof: By induction on the definition of I(T ). The base case is vacuous. For the induction step, assume that the property holds for (F, I) = (F_{0} ∪ F_{1} ∪ … ∪ F_{n}, I), and suppose r = {a_{1}, …, a_{n}} is a rule instance that can be applied to make (F′, I′) = (F_{0} ∪ \{{F_{1} \atop C_{1}}, …, {F_{n} \atop C_{n}}\}, I′), where C_{1}, …, C_{n} are the new conclusion occurrences. Now, pick A, B ∈ O(F′) such that A <_{F′} B. Then B equals no C_{i} because it exists above at least one occurrence. Hence B ∈ O(F). There are two cases: either A ∈ O(F) or not. If A ∈ O(F) then A <_{(F,I)} B by induction and thus also A <_{(F′,I′)} B since (I′ \ I) ⊆ {C_{1}, …, C_{n}}^{2} cannot relate A and B. If A ∉ O(F) then A ≲_{(F′,I′)} B (since A <_{F′} B and ≲_{F′}⊆≲_{(F′,I′)}). The only way that B ≲_{(F′,I′)} A would be if AI′B, but as we have seen, AI′B only if B is a new occurrence, which it is not. □

Proposition 2.2 DLF implies that if A ∼_{(F,I)} B then A I B.

Proof: Suppose A ∼_{(F,I)} B. Then there exists a sequence of occurrences A_{0}, …, A_{n} in F such that A_{1} = A, A_{n} = B and for all i = 1, …, n − 1 either A_{i} <_{F} A_{i+1} or A_{i}IA_{i+1}. Now, since A ∼_{(F,I)} B, we have for i = 1, …, n − 1, A_{i} ∼_{(F,I)} A_{i+1} because

A ≲_{(F,I)} A_{i} ≲_{(F,I)} A_{i+1} ≲_{(F,I)} B ≲_{(F,I)} A

This in turn means that A_{i} ≮_{F} A_{i+1} by DLF, which means that A_{i}IA_{i+1} for all i = 1, …, n − 1. □

2.2.3 DLF helps characterize the I-deductions

The previous proposition showed that no deduction contains any dependency loops. Dependency loop freeness is an important condition for our intended application (it corresponds to the principle that temporal states are not synchronized with previous states); but it is also important proof-theoretically: DLF helps characterize the set of I-deductions.

Theorem I states this formally. The content of the theorem is that a pair (F, I) is an I-deduction of the I-system T if it is built from instances of rules in T , and the preorder ≲_{(F,I)} satisfies DLF. To show this, I require the notions of I-structure, I-neighbourhood and how to match rules to neighbourhoods.

I-structure An I-structure (over a language L) is a pair (F, I) where F is a finite set of finite occurrence trees (with formulae in L) and I ⊆ O(F) × O(F) is an equivalence relation. Clearly, every I-deduction is an I-structure. Henceforth, I shall assume that every pair written “(F, I)” is an I-structure.

I-neighbourhoods Let C be an occurrence in an I-structure (F, I). The neighbourhood of C is the set

N_{(F,I)}(C) = {atom(C′) | C′ I C}

and atom(C) = (root(F_{0}), C) when (F_{0}, C) is that subtree which concludes C of a tree in F. Thus the neighbourhood of an occurrence returns the putative rule atom that introduces C. Thus the neighbourhood of C in (F, I) is the set of atoms that either conclude C or are connected to the atom that concludes C by a chain of interaction links. (Thus the conclusions of a neighbourhood form an equivalence class of I.) Note that neighbourhoods overlap: the premises of one neighbourhood must be the conclusions of others. I write N(F, I) for the set of neighbourhoods in (F, I).

Neighbourhood Ordering The deduction preorder of (F, I) can be lifted to a preorder over neighbourhoods. The neighbourhood ordering of (F, I) is the relation ≤_{N(F,I)}⊆ N(F, I) × N(F, I) defined by

N_{1} ≤_{N(F,I)} N_{2} if for all conclusions A ∈ O(N_{1}) there exists a conclusion B ∈ O(N_{2}) such that A ≲_{(F,I)} B

Thus N_{1} is less than N_{2} if some (conclusion occurrence in an) atom in N_{1} occurs below an atom of N_{2} in (F, I). The definition stresses conclusion occurrences because it is the conclusion occurrences that interact.

Proposition 2.3 ≤_{N(F,I)} is a partial order when (F, I) satisfies DLF.

Proof: Reflexivity and transitivity follow from the reflexivity and transitivity of ≲_{(F,I)}. For antisymmetry, let N_{1} ≤_{N(F,I)} N_{2} and N_{2} ≤_{N(F,I)} N_{1}. We show N_{1} = N_{2}. Since N_{1} ≤ N_{2} there exist conclusions A_{1} ∈ O(N_{1}) and A_{2} ∈ O(N_{2}) such that A_{1} ≲_{(F,I)} A_{2}. Symmetrically, there exist conclusions B_{2} ∈ O(N_{2}) and B_{1} ∈ O(N_{1}) such that B_{2} ≲_{(F,I)} B_{1}. Because they are conclusion occurrences, A_{1} ∼_{(F,I)} B_{1} and A_{2} ∼_{(F,I)} B_{2}. But this means

A_{1} ≲_{(F,I)} A_{2} ∼_{(F,I)} B_{2} ≲_{(F,I)} B_{1} ∼_{(F,I)} A_{1}

which means A_{1} ∼_{(F,I)} A_{2} ∼_{(F,I)} B_{2} ∼_{(F,I)} B_{1}. Thus, by proposition 2.2, DLF implies that A_{1}I^{∗}A_{2} and B_{1}I^{∗}B_{2}. Therefore, N_{1} = N_{2} by the definition of neighbourhood. □

Rule matching An I-rule r = {a_{1}, …, a_{n}} matches a neighbourhood N via f : O(r) ↔ O(N) (written r ≡_{f} N) iff

N = {f(a_{1}), …, f(a_{n})}

where f({P_{i1}, …, P_{in_{i}}}, C_{i}) = ({f(P_{i1}), …, f(P_{in_{i}})}, f(C_{i})), f preserves the shape of occurrences and C_{i} is the conclusion of a_{i} (for i = 1, …, n).

Chapter 2. Interacting Deductions 21

Theorem I (F, I) ∈ I(T ) if and only if (F, I) is a I-structure satisfying DLF and every neighbourhood matches a rule of T .

Proof: ⇐: Let (F, I) be a I-structure satisfying DLF and such that every neighbourhood matches a rule of T . Then (F, I) contains a finite number of neighbourhoods. By proposition 2.3, ≤_{N(F,I)} is a partial order. Let ≤ be any total order containing ≤_{N(F,I)}. We use induction on the number n of neighbourhoods to show that (F, I) ∈ I(T ).

When n = 0 the structure must equal (∅, ∅), which is a member of I(T ) by definition. When n = k+1, consider (F′, I′), the I-structure consisting of only the k highest (w.r.t. ≤) neighbourhoods of (F, I), i.e., not including those parts of the least neighbourhood distinct from every other neighbourhood — its conclusions. Clearly, (F′, I′) must satisfy DLF, and every neighbourhood must match a rule because (F′, I′) is contained within (F, I). By induction, (F′, I′) ∈ I(T ).

Now, let N_{k+1} be the least (w.r.t. ≤) neighbourhood of (F, I). Suppose it matches rule r = {a_{1}, …, a_{n}} via f : O(r) ↔ O(N_{k+1}). Then N_{k+1} = {f(a_{1}), …, f(a_{n})}.

Since N_{k+1} is a neighbourhood of (F, I) then its premises must also belong to ≤-higher neighbourhoods of (F, I) — i.e., to neighbourhoods in (F′, I′). Moreover, these premises must occur as conclusions of (F′, I′) since they are premises to conclusions of (F, I) which do not exist in (F′, I′).

Therefore there exist disjoint forests F_{0}, F_{1}, …, F_{n} such that F′ = F_{0} ∪ F_{1} ∪ … ∪ F_{n} and for i = 1, …, n, root(F_{i}) equals the set of premises of f(a_{i}). Thus, since for all A ∈ O(r), f(A) ≡ A, we have a_{i} ≡ f(a_{i}) = (root(F_{i}), C_{i}) for i = 1, …, n. Moreover, from the definition of neighbourhood, f(a_{i}) = atom(C_{i}), which means that (F_{i}, C_{i}) ∈ F. Therefore

F = F_{0} ∪ \{{F_{1} \atop C_{1}}, …, {F_{n} \atop C_{n}}\}

Also, by the definition of I-structure, the interactions of the neighbourhood must form an equivalence relation. Thus I = I′ ∪ {(C_{i}, C_{j}) | 1 ≤ i, j ≤ n}.

⇒: By proposition 2.1, we know that every I-deduction satisfies DLF. We show that every neighbourhood matches a rule by induction on the definition of I(T ). Case (∅, ∅): vacuous. Case (F, I) being the result of applying r = {a_{1}, …, a_{n}} to (F′, I′). By induction, every neighbourhood of (F′, I′) matches a rule of T . From the definition of rule application, we have F = F_{0} ∪ F_{1} ∪ … ∪ F_{n} where a_{i} ≡ (root(F_{i}), C_{i}). The only neighbourhood in (F, I) not in (F′, I′) is N equals

{atom(C_{1}), …, atom(C_{n})}

From the definition of atom, we have atom(C_{i}) = (root(F_{i}), C_{i}) (which we have already seen matches a_{i}) for i = 1, …, n. Thus if we define f : O(r) ↔ O(N) such that f(a_{i}) = atom(C_{i}) we have r ≡_{f} N. □

From the above, we can formulate a simple correctness principle for I-deductions based on their graphical representation. If one can trace a loop by following interaction lines and by going down a chain of dependencies in a tree at least once, then the structure is not an I-deduction. Otherwise, if it is also built out of rules, it is a deduction.

Chapter 2. Interacting Deductions 22

Throughout the rest of the thesis, I shall use Π and Σ (variously decorated) to range over deductions. If the set of conclusions of Π is {C_{1}, …, C_{n}}, I write

Π ⊢ C_{1}, … C_{n}. If further Π ∈ I(T ), I write T ⊢ C_{1}, …, C_{n}. I also write \begin{matrix}Π \\ A \end{matrix} when Π ⊢ A.

2.3 An Example

This section gives an example I-system drawn from Computer Science. It uses I-rules to describe the behaviour of a very simple process calculus based on CCS [Mil89]. The point of this example is both to illustrate the use of I-systems, indicate some of their properties, and also to motivate the technique of fragmentation. I compare this definition with a more traditional structured operational semantics (SOS) [Plo81], and also a semantics given by structured equivalences. I shall refer to the structured operational semantics as “the SOS”, and the I-system as “the I-semantics”.

The process calculus is built over an action set Act. Following Milner [Mil89, p.37], this is built from an infinite set Nam of names. I use a, b, c, … to range over Nam. Names will tend to be english words, but mostly I shall use a, b, c, etc. By \overline{Nam} I denote the set of co-names of Nam, which are just the words of Nam overlined. I use ā, b̄, c̄, … to range over conames. I write Lab = Nam ∪ \overline{Nam}, ranged over by l. I define complementation \overline{·} : Lab → Lab by: l̄ = ā if l = a and l̄ = a if l = ā. The action set Act = Lab ∪ {τ} where τ ∉ Lab is called the silent action. I use α to range over Act.

The simple calculus is called P. It can be thought of as the sum-, restriction-, recursion- and relabelling-free subset of CCS. Sum and recursion can be added without any problems. We shall consider restriction in section 3.4, and relabelling in section 7.3. The syntax of P is given by the following grammar:

p ::= 0 | l.p | p|p

where 0 is the process that does nothing and terminates, l.p is the process that performs an action l from Lab and then behaves as p, and p|q is the parallel composition of processes p and q. I have disallowed processes of form τ.p for simplicity.

Non-silent actions describe the effect a process has on its environment, which will in turn be a collection of parallel processes. I do not describe what each individual action “is”; for our purposes it is just a name. The crucial point is that each name has a distinguished partner, or co-name. A communication is said to occur between a process and its environment if the process performs an action a, and the environment “absorbs its effect” by performing the opposite action, ā, simultaneously. When this happens, the joint system of processes performs the silent action τ.

2.3.1 Comparative Semantics

The following three semantics formalise these ideas in different ways. In the SOS, when a process performs an action, we decorate the transition relation with the name of the action. In the I-semantics, when we deduce that a process performs an action, we must also simultaneously deduce its communicating partner absorbing its effect. In the structured equivalence setting we cannot deduce the transitions of a communicating pair of processes separately; an atomic transition is a transition of a communicating pair of processes.

Structured Operational Semantics of P

It is given by the labelled transition system LT S_{SOS} = ⟨P, Act, →, Ω⟩ where →⊆ P×Act×P is the relation defined by (p, α, q) ∈→ if and only if P_{SOS} ⊢ p →^{α} q where P_{SOS} is the deduction system (L_{SOS}, R_{SOS}) such that L_{SOS} is the language of judgments of form p →^{α} q and the ruleset R_{SOS} is generated by the following rule schemata

l.p →^{l} p  {p →^{α} p′ \atop p|q →^{α} p′|q}  {q →^{α} q′ \atop p|q →^{α} p|q′}  \begin{matrix}p →^{l} p′ & q →^{l̄} q′ \\ p|q →^{τ} p′|q′ \end{matrix}

Thus I have regarded the proof system of a structured operational semantics as the special case of I-system whose rules are singletons. The last component of the labelled transition system, Ω, is the set of terminal states of P processes. That is, it is the least set such that

0 ∈ Ω and p|q ∈ Ω when p, q ∈ Ω

It is not hard to see that the quadruple LT S_{SOS} satisfies the conditions on labelled transition systems given in definition 1.0.

I-semantics of P

The I-semantics of P is given by the transition system T S_{I} = ⟨P, →, Ω⟩ where →⊆ P × P is the relation defined by (p, q) ∈→ if and only if P_{I} ⊢ p → q where P_{I} is the deduction system (L_{I}, R_{I}) such that L_{I} is the language of reduction judgments of form p → q and the ruleset R_{I} is generated by the following rule schemata:

\begin{aligned}& a.p → p − ā.q → q \\ {p → p′ \atop p|q → p′|q} & {q → q′ \atop p|q → p|q′} & \begin{matrix}p → p′ & q → q′ \\ p|q → p′|q′ \end{matrix} \end{aligned}

The set of final states, Ω, is as defined above. Note that if I had allowed processes of form τ.p, I would have required an extra rule τ.p → p.

Structured Equivalences

The reduction (i.e., unlabelled transition) judgment of P_{I} is not uniquely a feature of I-semantics. They can also be derived using the technique of structured equivalences in a structured operational semantics. Such a semantics for P is given by the I-system P_{CONG} = (L_{I}, R_{CONG}) where R_{CONG} is the set of rules:

a.p | ā.q → p|q  {p → p′ \atop p|q → p′|q}  \begin{aligned}p ≅ p′ & p′ → q′ & q′ ≅ q \\ & p → q \end{aligned}

and ≅⊂ P × P (the structured equivalence relation) is defined to be the least relation satisfying

\begin{matrix}p ≅ p  p|q ≅ q|p  p|(q|r) ≅ (p|q)|r \\ {p ≅ q \atop q ≅ p} & {p ≅ q \atop p|r ≅ q|r} & \begin{matrix}p ≅ q & q ≅ r \\ p ≅ r \end{matrix} \end{matrix}

Note that there is no rule for action prefixing: we do not need to use such a rule. It is the lack of this rule which prevents the relation from being a structured congruence.

Note also that this approach does not require a rule for two concurrent transitions, whereas one is required in the I-semantics. Without such a rule there, internal communications could not be modeled in an I-deduction. However, this extra rule makes a significant difference: it permits several communication transitions to occur simultaneously, something not allowed in the other two approaches. Section 2.5.3 shows this formally.

We could avoid multiple transitions simply by adding action information to judgments, or by using the structured equivalence approach. In these cases, the interacting rules would be redundant. Shortly I shall indicate how interacting rules can be mixed usefully with the standard techniques.

Comparison

For example, let us see how the three systems deduce a transition of the process a.p|r|ā.q.

\begin{matrix}P_{SOS} : \begin{matrix}{a.p →^{a} p \atop a.p|r →^{a} p|r} & ā.q →^{ā} q \\ a.p|r|ā.q →^{τ} p|r|q \end{matrix} P_{I} : [figure: \begin{matrix}{a.p → p \atop a.p|r → p|r} & ā.q → q \\ a.p|r|ā.q → p|r|q \end{matrix}] \\ P_{CONG} : \begin{aligned}a.p|r|ā.q ≅ a.p|ā.q|r & {a.p|ā.q → p|q \atop a.p|ā.q|r → p|q|r} & p|q|r ≅ p|r|q \\ & a.p|r|ā.q → p|r|q \end{aligned} \end{matrix}

Chapter 2. Interacting Deductions 25

On Actions The first point of difference between the definitions is that P_{SOS} judgments contain actions, whereas those of the other two do not. In [San93, ch3], Sangiorgi shows that reduction judgments (regardless of how they are deduced) are in general too weak for process algebraic purposes. Reduction bisimulation is “rather weak; in general it is even not preserved by parallel composition” (p.47). Moreover, for CCS, reduction congruence coincides with strong bisimulation only for the divergent-free processes [MS92]. P is too simple to contain divergent processes, but this is accidental. Process calculus transitions should contain actions. P_{I} judgments do not for pedagogic reasons.

On Propagation I could easily add actions to the judgments of P_{I}, however the point is that they are not required to describe the semantics. The judgments of P_{I} are syntactically less complex than those of P_{SOS} because action information does not have to be propagated down inference steps. Nor do we need another mathematical object (an equivalence relation) to achieve this.

The following sections show how one can avoid the propagation of other pieces of information too. Avoiding propagation simplifies the syntactic presentation of judgments, and thus also the statement and proof of theorems about such judgments. It also admits some modularity in definitions and proofs. The rest of this chapter is devoted to illustrating these claims.

2.3.2 Extending the semantics

Sometimes the semantics of an extension to a language can be obtained simply by adding extra rules [FC94]. In some cases, proofs about the language can be extended simply by adding extra cases for the extra rules. However, some extensions (for instance, features that require the addition of an extra component in the transition system configurations) require every rule to be rewritten. In this case, every proof about the base language will have to be rewritten for the extended language.

I shall show how (using I-systems) a simple extension of P that requires an extra component in the configuration translates into a simple extension of a proof about P. The simple extension is to add variable assignment to P, and the extra component of the configuration is a store. It is well known that stores can be implemented in process calculi (see, e.g. [Mil89, ch8]), but I add them explicitly both for pedagogic reasons, and because P is not a real process algebra. The important point will be that the rules of P are included unchanged in those for the new language, despite the extra component.

Another important point is that we can apply this extension almost uniformly to each of P_{I}, P_{SOS} and P_{CONG} without changing any of their rules.

Extending P_{I} with stores Let us call the new language P(:=). Let V ar be a countably infinite set of variables ranged over by x, V al a set of values ranged over by v, and let op range over a set of binary operators Op. The grammar of Chapter 2. Interacting Deductions 26

P(:=) is

\begin{matrix}e ::= v | x | e op e \\ p ::= 0 | l.p | p|p | (x := e).p \end{matrix}

Let Exp be the set of all expressions.

The semantics of P(:=) requires a global store component. The precise algebraic definition of stores σ ∈ Store is given later in figure 5–1. The important operations are σ(x) which returns the value of x in σ, and σ[v/x] which updates the value of x to v.

The I-semantics of P(:=) is given by the transition system T S_{I}^{(:=)} which equals ⟨P(:=) × Store, →, Ω × Store⟩ where ⟨p, σ⟩ → ⟨q, σ′⟩ if and only if either P_{I}^{(:=)} ⊢ p → q, σ ⇝ σ′ or P_{I}^{(:=)} ⊢ p → q and σ = σ′. The deduction system P_{I}^{(:=)} = (L_{I}^{(:=)}, R_{I}^{(:=)}) is defined such that L_{I}^{(:=)} consists of the judgments of the form p → q, e → v and σ ⇝ σ′, and the rules of R_{I}^{(:=)} are those of R_{I} plus the rules generated by the following schemata:

\begin{matrix}v → v & x → v & − & {σ(x) = v \atop σ ⇝ σ} & \begin{matrix}e_{1} → v_{1} & e_{2} → v_{2} \\ e_{1} op e_{2} → app(op, v_{1}, v_{2}) \end{matrix} \\ {e → v \atop (x := e).p → p} & − & σ ⇝ σ[v/x] & \begin{matrix}σ ⇝ σ & σ ⇝ σ′ \\ σ ⇝ σ′ \end{matrix} \end{matrix}

where app : Op × V al × V al ⇀ V al is a partial function that returns the value of applying op to its arguments. Note that the last rule for stores is not a general transitivity rule. As I show later (proposition 2.10), it limits transitions to write to the store at most once.

Thus P(:=) is just P plus an assignment action, which is atomic (avoiding problems of interference). So (x := 0).(p| ⋯ |p) where p = (x := x + 1).0 returns in x the number of copies of p in the program. For example, figure 2–1 gives the first two transitions of the program (x := 0).(p|p).

Extending P_{SOS} and P_{CONG} with stores The I-semantic rules of P(:=) reuse those of P. Here I show how to extend the other two systems, reusing their rulesets. To extend P_{SOS} to P_{SOS}^{(:=)} = (L_{SOS}^{(:=)}, R_{SOS}^{(:=)}), we define the language of judgments L_{SOS}^{(:=)} to be the set of judgments of form p →^{α} q, e → v and σ ⇝ σ′ and the ruleset R_{SOS}^{(:=)} to be R_{SOS} plus the rules above for stores and expressions with one modification. The rule atom for assignment becomes:

{e → v \atop (x := e).p →^{τ} p}

To extend P_{CONG}, we set L_{CONG}^{(:=)} = L_{I}^{(:=)} and R_{CONG}^{(:=)} to be R_{CONG} plus the rules above without modification. The only change that has to be made is to the equivalence relation. Currently ≅⊆ P × P. We want ≅⊆ P(:=) × P(:=). We do not have to change the definition of the equivalence, except insofar as the variables p and q range over P(:=) instead of P.

By contrast, if I had not used interacting rules, the extension of P_{SOS} and P_{CONG} would have rewritten every rule in the respective systems to carry around

[figure: {0 → 0 \atop (x := 0).(p|p) → (p|p)} − σ ⇝ σ[0/x]; \begin{matrix}x → 0 & 1 → 1 \\ x + 1 → 1 \end{matrix} ; (x := x + 1).0 → 0 ; p|p → 0|p \begin{matrix}σ[0/x] ⇝ σ[0/x] & σ[0/x] ⇝ σ[0/x][1/x] \\ σ[0/x] ⇝ σ[0/x][1/x] \end{matrix}]

Figure 2–1: P(:=) process transitions of (x := 0).(p|p) where p = (x := x + 1).0

a store component. (Section 5.2 discusses a similar treatment for environments.) Thus interacting rules can extend semantics in a more modular fashion than standard approaches.

2.3.3 Reasoning about semantics

We shall see that reasoning about I-semantics can be more modular too. Suppose we have a proof using T S_{I} that every P process is nondivergent, and that it proceeds by induction on the structure of P processes. Then the proof will concern the rules and judgments of P_{I}. To prove an analogous result for P(:=) we should only require an extra case for the new production (x := e).p. The rule for this construct consists of two atoms, one concluding a process reduction judgment, and another a store transition judgment. Yet the property does not concern store transitions (stores do not store processes). Every P_{I}^{(:=)} transition consists of at most two subtransitions: one process transition and one store transition. For a P(:=) process to diverge, there must exist an infinite sequence of process transitions. The proof need only show that no process can be attributed an infinite sequence of transitions. Therefore the proof need only concern itself with the fragment of the rule concerning process reduction.

The key notion is “fragment”. We shall see the respective proofs after the definition of fragment, and the proof of the proof fragmentation theorem (theorem II).

2.4 Fragments of deductions

The idea of fragmentation is quite straightforward. Suppose our community of mathematicians is cosmopolitan, and we wish to study the work of the Russians (which is distinguished by the type of facts they deduce). To study them, we have to screen out the work of everyone else. That is, we must isolate the Russian contribution to a deduction (their trees) and consider only how teams of Russians collaborate.

In this section I define rule and deduction fragments. The main result of this section is the proof fragmentation theorem.

Definition 2.4 (Fragment)

• I-structure (F_{0}, I_{0}) is a fragment of (F, I) if F_{0} ⊆ F and I_{0} ⊆ I.

• Rule r_{0} is a (rule) fragment of rule r if r_{0} ⊆ r.

• Ruleset R_{0} is a (ruleset) fragment of ruleset R if R_{0} contains only fragments of rules in R.

• I-system (L_{0}, R_{0}) is a (system) fragment of I-system (L, R) if L_{0} ⊆ L, and R_{0} is a fragment of R.

Note that if (F_{0}, I_{0}) is a fragment of (F, I) then I_{0} ⊆ I ∩ (O(F_{0}) × O(F_{0})). This follows both from the definition of fragment and also because I_{0} ⊆ O(F_{0}) × O(F_{0}) by the definition of I-structure. Thus a fragment of a structure consists of a subset of its forest and a subset of the interactions between the isolated trees. I define the process of taking fragments of I-structures rather than I-deductions because in general, fragments of deductions in I(T ) will not be deductions in I(T ).

Note also that taking a fragment of a rule does not alter the shape of individual atoms. Further, if R_{0} is a fragment of R then R_{0} need not be a subset of R. Indeed, as I show in section 2.5, it is even possible that R ⊆ R_{0} and R_{0} ≠ R. I write (L, R) ⊆ (L′, R′) if L ⊆ L′ and R ⊆ R′.

Proposition 2.5 The relation “is a fragment of” is a partial order over I-structures, rules, rulesets and systems.

Proof: For I-structures and rules this follows trivially from the fact that ⊆ is a partial order. For rulesets it follows from the fact that fragments of fragments of rules are fragments. For systems, it follows because ⊆ is a partial order and “is a fragment of” is a partial order over rulesets. □

Proposition 2.6 Let (F_{0}, I_{0}) be a fragment of (F, I). Then if (F, I) satisfies DLF, so does (F_{0}, I_{0}).

Proof: This follows from the fact that ≲_{(F_{0},I_{0})}⊆≲_{(F,I)}. □

The proof fragmentation theorem

We can consider system fragments to be modules. The proof fragmentation theorem shows that when we prove universal propositions about the deductions of modules they will remain true when the modules are composed. For example, we may show that every Russian deduction satisfies ϕ. Then the theorem entails that every Russian fragment of a cosmopolitan deduction will also satisfy ϕ. Furthermore, as shown in section 2.5.3, it can also be used to simplify proofs within a module.

To state the theorem, I define the set of T_{0}-fragments of a T -deduction when T_{0} is a fragment of T . I say that 𝔽_{T_{0}}(Π) is the set of fragments of Π such that every neighbourhood matches a rule instance of T_{0}. I extend this to sets of deductions. Thus I write 𝔽_{T_{0}}(X) = ⋃_{Π∈X} 𝔽_{T_{0}}(Π)

Theorem II (Proof fragmentation)

I(T_{0}) ⊇ 𝔽_{T_{0}}(I(T )) when T_{0} is a fragment of T .

Proof: Let Π ∈ 𝔽_{T_{0}}(I(T )). Then by proposition 2.6, Π satisfies DLF. By definition, every neighbourhood of Π matches a rule instance of T_{0}, so by theorem I, Π ∈ I(T_{0}). □

This theorem proves that it is sound to reason universally about fragments of deductions by considering only the rule fragments that build them. Suppose that ϕ is a proposition about all T_{0}-deductions. For example, proposition 2.10 concerns store deductions. Then the proof fragmentation theorem shows that the result remains true for every T_{0}-fragment of a T -deduction. Thus the store proposition is true for every store fragment of a P_{I}^{(:=)}-, P_{SOS}^{(:=)}- and P_{CONG}^{(:=)}-deduction.

The proof technique does not extend to other kinds of sentences, such as existential sentences. Because I(T_{0}) is bigger than 𝔽_{T_{0}}(I(T )) what may be shown to exist in I(T_{0}) may not exist in 𝔽_{T_{0}}(I(T )).

So not every proposition about T_{0}-fragments of T -deductions will be provable in this way. (That is, it is sound to reason about rule fragments, but in general it is not complete.) It is not the case that I(T_{0}) ⊆ 𝔽_{T_{0}}(I(T )). This is because the other rule atoms in T may prevent certain T_{0} rule fragments from being applied. For example, consider the ruleset consisting of the single rule

A − {B \atop C}

and consider the fragment consisting of A. The set of deductions over the original ruleset is empty (we cannot infer B), whereas we do have the deduction A in the ruleset fragment.

It would be natural to try to find a characterization of the rule sets for which the inclusion does hold. However, I have not yet managed to do this. Similarly, Chapter 2. Interacting Deductions 30

one might wish to classify the kinds of propositions one can prove using this proof technique. Intuitively, we can only prove properties about system fragments that do not depend on the way the rest of the system interacts with the fragment. In chapter 4 we see the proof assembly theorem which overcomes this limitation.

2.5 Examples

This section shows how the theory of fragments helps reasoning about P processes. The first result I shall prove is the promised nondivergence proof of P. I shall then extend this to obtain a nondivergence proof of P(:=). In a similar vein, I shall also prove a simple property about stores, which remains true (without modification) irrespective of the different semantics for P. The section finishes with a proof of equivalence between LT S_{SOS} and T S_{I}.

Broken deductions and systems Let 𝔹(F, I) = (F, ∅) be the result of breaking every interaction link in an I-structure. Obviously 𝔹(Π) is a fragment of Π. Similarly, let 𝔹(L, R) = (L, {{r_{0}}| r_{0} ∈ r ∈ R}) be the result of breaking every interaction link in an I-system. Once again, 𝔹(T ) is a fragment of T . For example, P_{B} = 𝔹(P_{I}) consists of the following rules (note that the two halves of the communication rule are just instances of each other)

l.p → p  {p → p′ \atop p|q → p′|q}  {q → q′ \atop p|q → p|q′}  \begin{matrix}p → p′ & q → q′ \\ p|q → p′|q′ \end{matrix}

Proposition 2.7 If Π ∈ I(T ) then 𝔹(Π) ∈ I(𝔹(T )). □

2.5.1 Extending a nondivergence proof

In this section, we prove that no P process diverges, and then consider how to extend the proof to P(:=). The extension is quite straightforward, and requires less effort when using I-systems than ordinary SOS.

To be precise, we actually prove a non-nontermination proof: that is, that no process performs an infinite sequence of transitions. (Equivalently, that every process either terminates or deadlocks.) This is a stronger result than nondivergence, because divergence is that special case of nontermination which exhibits no visible computation. It is quite possible for a nonterminating process to perform work visibly: for instance it may output an infinite stream of approximations to some result. However, I use the term “nondivergence” because it is less of a mouthful than “non-nontermination”.

Sequences I write X^{ω} for the set of countable, possibly empty sequences of elements from set X. I write ε for the empty sequence. I write sequences using an associative concatenation operator · (e.g., u · v · . . . · w). I use s to range over sequences. I regard elements of X as singleton sequences in X^{ω}. I write |s| for Chapter 2. Interacting Deductions 31

the length of s, dom (s) = {1, …, |s|} and s(i) for the ith element of s when i ∈ dom (s).

For the following proofs, I say that a deduction sequence of P_{I} (P_{B}) is a sequence of deductions Π_{1} · . . . · Π_{n} (for n ≥ 1) such that for i = 1, …, n, Π_{i} ⊢ p_{i} → p_{i+1}, for some p_{1}, …, p_{n+1} ∈ P. I say P_{I} (P_{B}) attributes a deduction sequence Π_{1} · . . . · Π_{n} to p if Π_{1} ⊢ p → p′ for some p′ ∈ P.

Proposition 2.8 No process in P diverges.

Proof: If P_{I} attributes a transition sequence to a process p, by definition there must exist a sequence of deductions that conclude the individual transitions. Therefore it suffices to consider deduction sequences.

I show by induction on the structure of p that the rules of P_{B} attribute an at most finite deduction sequence to p. Case p = 0 trivial. Case p = a.q by induction, q has an at most finite deduction sequence s attributed by P_{B} (let n be the length of the maximal sequence). Then a.q has a maximal deduction sequence of length n + 1: a.q → q·s which is finite. Case p = q|q′ by induction, both q and q′ are attributed at most finite deduction sequences, s of length n and s′ of length m respectively. Then q|q′ will have a maximal deduction sequence s · s′ of length n + m.

Now, let p ∈ P. Suppose P_{I} attributes an infinite deduction sequence Σ_{1} ·Σ_{2} · … to p. Let Σ′_{i} = 𝔹(Σ_{i}) for i = 1, 2, … be the fragments obtained after breaking every interaction link. By proposition 2.7 this would be an infinite P_{B}-deduction sequence attributed to p: contradiction. □

Extending the proof to P(:=)

Let P_{P ROC}^{(:=)} be that fragment of P_{I}^{(:=)} containing the process transition and expression evaluation rule fragments (i.e., not containing the store atoms). Then the ruleset of P_{P ROC}^{(:=)} contains the ruleset of P_{I}. Furthermore, P_{BP ROC}^{(:=)} = 𝔹(P_{P ROC}^{(:=)}) is just P_{B} plus formulae and rules for expression evaluation and the assignment rule atom.

To obtain a proof of nondivergence for the processes of P(:=), it suffices to change every occurrence of P_{I} with P_{P ROC}^{(:=)} and P_{B} with P_{BP ROC}^{(:=)}, in both the definition of deduction sequence and the body of the proof, and then add the following case to the induction proof:

Case p = (x := e).q by induction, q has an at most finite sequence s of transitions attributed by P_{BP ROC}^{(:=)} (let n be the length of the maximal sequence). Then (x := e).q has a maximal sequence of transitions of length n + 1: (x := e).q → q·s which is finite.

Proposition 2.9 No process in P(:=) diverges. □

Chapter 2. Interacting Deductions 32

There are two aspects to the work of proving theorems. The first aspect concerns the discovery of proofs, and the second concerns the verification of the discovered proof. When I prove theorems I tend to do both simultaneously: I use my intuitions about what correct proofs are to guide my proof search, and then at each stage I check to see if I have proved what I think I have proved. In a mathematical text the proof has already been discovered — but I still have to check it to believe it (a point of view expounded in [Pol95]). In general, proof discovery is harder and proof checking is easier.

The above extension is not modular in the sense that we have to check that the entire extended proof really is a proof. It is modular in the sense that we do not have to do very much to discover the proof. Because the set of productions in the grammar of P(:=) contains that of P, our first strategy should attempt to reuse the inductive cases of the previous proof. Because the ruleset of P_{BP ROC}^{(:=)} contains that of P_{B}, we should (at least at the first attempt) expect to reuse the inductive cases altering only the names of the I-systems. And in fact, this is what I did. The candidate extended proof consists of a substitution of names and an extra induction case.

By contrast, if I had attempted to extend a nondivergence proof using SOS then I should have had to rewrite the definition of deduction sequence and the proof itself to reason about judgments with state information. Moreover, since every rule mentions stores, we should have to reconsider every case just to see if they are influenced by the store. So in this sense my approach is more modular than the SOS approach: I simply extended the old proof without having to reconsider anything.

To a small extent, my approach will also require less work when the proof for an extended language requires a different proof strategy than the proof for the original language. For instance, suppose we subsequently introduce to the grammar an iterator production It^{n}C.p where n is a natural number and C belongs to a set of process constants, and a production for constants C, with the following semantic rules:

It^{0}C.p → 0 It^{n+1}C.p → p[It^{n}C.p/C]

(For the equivalent SOS rules, add τ superscripts to the arrows.) then this calculus would still be nondivergent, but the induction strategy would have to be altered: p[It^{n}C.p/C] is not in general structurally smaller than p (e.g., when p = C), so one cannot use structural induction. The modified proof would have to alter the induction hypothesis and reprove every case. (See section 4.3.2 for the proof of a similar result.) The idea of the new proof would be the same in both approaches, but the expression of the new proof would be simpler in my approach than in the SOS approach because of the absence of stores in judgments.

2.5.2 A modular proof about stores

The last section proved a result about P(:=) processes independently of the rules for stores. This section proves a result about stores independently of the rules for processes. The proposition is very simple: store transitions update at most Chapter 2. Interacting Deductions 33

one variable. One consequence of the proposition is that stores do not lose any information.

The Commentary on Standard ML [MT90, §2.8] presents some theorems on the evaluation of ML. The first theorem is just “the size of the domain of the store cannot shrink during evaluation”. However, the proof of this theorem considers a very large number of rules, many of which do not directly influence the store but have to carry its state around (although the state and exception conventions hide this). In each case we have to show that the “carrying around” preserves the property. Only seven rules actually have to be considered because they directly concern the store.

One way to simplify the proof would be to formalise the state convention as a family of metarules, as [HMT90, §6.7]:

\begin{matrix}s_{0}, A_{1} ⊢ phrase_{1} ⇒ A′_{1}, s_{1} s_{1}, A_{2} ⊢ phrase_{2} ⇒ A′_{2}, s_{2} ⋯ \\ s_{n−1}, A_{n} ⊢ phrase_{n} ⇒ A′_{n}, s_{n} \end{matrix} ; s_{0}, A ⊢ phrase ⇒ A′, s_{n}

and then have one case that proved the “carrying around” result generally, by a subinduction on n, the number of premises. To check this proof correct, I should have to check that every “carrying around” rule does indeed match one of the metarules in the family.

Although ML and P(:=) are different languages, and although the ML semantics is evaluation-style and the one for P(:=) transition-style, the following proof of the theorem for P(:=) illustrates that I-semantics allow one to cut out irrelevant cases. There are only three rules that concern the store, and the proof contains only three cases.

Let S_{I} be the fragment of P_{I}^{(:=)} consisting of the following rule fragments:

σ ⇝ σ  σ ⇝ σ[v/x]  \begin{matrix}σ ⇝ σ & σ ⇝ σ′ \\ σ ⇝ σ′ \end{matrix}

The proof fragmentation theorem can be applied to the following proof to show that every P_{I}^{(:=)}-, P_{SOS}^{(:=)}-, and P_{CONG}^{(:=)}-transition updates the store at most once.

Proposition 2.10 If S_{I} ⊢ σ ⇝ σ′ then either σ′ = σ or there exists x ∈ V ar and v ∈ V al such that σ′ = σ[v/x].

Proof: by induction on the depth of inference of Σ ∈ I(S_{I}) such that Σ ⊢ σ ⇝ σ′. Base cases: by inspection, the lookup rule gives σ′ = σ. The assignment rule gives σ′ = σ[v/x] for some v and x. Induction step: the case for the propagation rule follows immediately from the inductive hypotheses: the conclusion has the same shape as the right hand premise. □

2.5.3 An equivalence theorem

This section shows that the I-semantics and the SOS of P are equivalent for the non-deadlocking processes. Once again, the proof uses the proof fragmentation theorem, but this time not for extensibility or modularity reasons. Instead it simplifies the proof: without fragments, even the easy half becomes very cumbersome.

This is actually a flaw of the definition of I-deduction. It is neither particularly elegant nor does it support simple inductive reasoning. Instead, (as we shall see) we always have to recover inductive reasoning using a special kind of fragmentation. One feels that this special notion of fragment should be somehow embodied in the definition of deduction; though at the moment it is not obvious how to do it. This problem will be rectified in chapter 4.

The proofs of the two directions of the equivalence each consist of two parts, only one of which is interesting. The uninteresting part concerns the problem of matching the single communication transitions of P_{SOS} to the multiple communication transitions of P_{I}. The interesting part concerns how interactions correspond to communication.

To minimise the uninteresting part, I shall introduce an intermediate structured operational semantics (called P_{MSOS}) which allows multiple communications per transition and simply state the appropriate equivalence results. These proofs are not hard, but are tedious. Then I shall prove P_{MSOS} equivalent to P_{I}. Another advantage of having this intermediate semantics is that it shows very clearly the difference between SOS and I-semantics in general.

An intermediate semantics

The idea is that each transition judgment can be decorated with a multiset of labels (collections of silent actions will be represented by the empty multiset.) Figure 2–2 gives a definition of the multiset operations we shall be using.

Let P_{MSOS} = (L_{MSOS}, R_{MSOS}) where L_{MSOS} is the set of judgments of the form p →^{m} q, and R_{MSOS} is the set of rules generated by:

\begin{matrix}l.p →^{\{| l |\}} p & {p →^{m} p′ \atop p|q →^{m} p′|q} & {q →^{m} q′ \atop p|q →^{m} p|q′} \\ \begin{matrix}p →^{m_{1}} p′ & q →^{m_{2}} q′ \\ p|q →^{m} p′|q′ \end{matrix} & ∃m′ ⊆ (m_{1} ∩ \overline{m_{2}}).m = (m_{1} \ m′) ∪ (m_{2} \ \overline{m′}) \end{matrix}

The side condition on this last rule is quite complex, but as the following proof shows, it accurately captures the nature of communication in the I-semantics. Suppose m_{1} and m_{2} are the multiset of visible actions performed by two parallel transitions. Then there may be some communication between the two, in which case there will exist some submultiset m′ of actions of m_{1} whose complementation will be a submultiset of m_{2}. That is, m′ ⊆ m_{1} ∩ \overline{m_{2}}. The visible actions of the combined transition will be the union of the visible actions of m_{1} and m_{2} which have not been communicated, i.e., (m_{1} \ m′) ∪ (m_{2} \ \overline{m′}).

Chapter 2. Interacting Deductions 35

Here I shall represent multisets m by their characteristic functions: functions from Lab to ℕ, the set of natural numbers. For each action l, m(l) equals the number of occurrences of l in the multiset. Then the following operations can be defined:

Empty multiset  ∅(l) = 0
Singleton  \{| l |\}(l′) = \{ \begin{matrix}1 & if l = l′ \\ 0 & ow \end{matrix}
Multiset union  (m_{1} ∪ m_{2})(l) = m_{1}(l) + m_{2}(l)
Multiset intersection (m_{1} ∩ m_{2})(l) = min(m_{1}(l), m_{2}(l))
Multiset difference (m_{1} \ m_{2})(l) = \{ \begin{matrix}m_{1}(l) − m_{2}(l) & if m_{1}(l) > m_{2}(l) \\ 0 & ow \end{matrix}
Submultiset  m_{1} ⊆ m_{2} iff ∀l.m_{1}(l) ≤ m_{2}(l)
Complementation  ∀l.\overline{m}(l) = m(l̄)

Note that complementation is the extension of label complementation to multisets of labels, and not complementation with respect to some universal multiset. Also, I shall write {| l_{1}, …, l_{n} |} for {| l_{1} |} ∪ … ∪ {| l_{n} |}.

Figure 2–2: Multisets

Proposition 2.11 For all p, p′ ∈ P and l ∈ Lab,

if P_{SOS} ⊢ p →^{l} p′ then P_{MSOS} ⊢ p →^{{| l |}} p′

if P_{SOS} ⊢ p →^{τ} p′ then P_{MSOS} ⊢ p →^{∅} p′

□

A trace t is a sequence of labels. t traces m if for all l, m(l) equals the number of occurrences of l in t. Note that t may contain no silent actions. A t-traced deduction sequence of P_{SOS} is a sequence of deductions consisting of |t| + 1 subsequences, the first of which concludes a sequence of transitions p_{0}(→^{τ})^{∗}p_{1}, and the last |t| concludes a sequence of transitions p_{i}(→^{τ})^{∗} →^{t(i)} (→^{τ})^{∗}p_{i+1}, for some p_{0}, …, p_{|t|+1} ∈ P. A t-traced deduction sequence is written P_{SOS} ⊢ p_{0} →^{t} p_{n}.

Proposition 2.12 For all p, p′ ∈ P and m ∈ ℕ^{Lab}, if P_{MSOS} ⊢ p →^{m} p′ then for

all traces t of m, P_{SOS} ⊢ p →^{t} p′. □

The interesting equivalence proofs

The following proofs require a different fragment of P_{I} than the nondivergence proof. Let P_{F} be the fragment of P_{I} generated by:

\begin{matrix}a.p → p − ā.q → q l.p → p \\ {p → p′ \atop p|q → p′|q} & {q → q′ \atop p|q → p|q′} & \begin{matrix}p → p′ & q → q′ \\ p|q → p′|q′ \end{matrix} \end{matrix}

The difference between P_{I} and P_{F} is the inclusion of the rule l.p → p. The point is Chapter 2. Interacting Deductions 36

that P_{F} -deductions can contain both broken and unbroken interaction links. This allows me to either break or put in interaction links as the proof progresses.

For the proofs, I introduce the following notations. Let Π ∈ I(P_{F}). Then it will contain a number of instances of prefix rule instances. I write Π[m] if m is the multiset of labels l that occur as prefixes in prefix rule instances l.p → p of Π. (Thus m records the broken interaction links in Π.) In a straightforward extension of notation, I write Π[m] ⊢ Γ if Γ is the set of conclusion occurrences of Π[m]. I say that an occurrence A of (F, I) is noninteracting if for all (A, B) ∈ I, A = B.

Lemma 2.13(i) For all p, p′ ∈ P and m ∈ ℕ^{lab}, P_{MSOS} ⊢ p →^{m} p′ if and only if there exists a Π ∈ I(P_{F}) such that Π[m] ⊢ p → p′.

Proof: ⇒: by induction on the depth of inference of p →^{m} p′. Case l.p →^{{| l |}} p: when we have the P_{F} -deduction l.p → p[{| l |}].

Case p|q →^{m} p′|q: this follows from the rule with premise p →^{m} p′. By induction we have Π[m] ⊢ p → p′. The result follows by applying the appropriate I-rule to Π to conclude p|q → p′|q. Case p|q →^{m} p|q′: symmetrical to the last case.

Case p|q →^{m} p′|q′: this follows from the rule with the two premises p →^{m_{1}} p′ and q →^{m_{2}} q′. By induction, we have Π_{1}[m_{1}] ⊢ p → p′ and Π_{2}[m_{2}] ⊢ q → q′ in P_{F}. Let m′ ⊆ (m_{1}∩\overline{m_{2}}) be such that m = (m_{1}\m′)∪(m_{2}\\overline{m′}). Then we can build the deduction Π_{3}[m] ⊢ p|q → p′|q′ in two steps. First, we add interaction links corresponding to the communications specified by m. Let f_{1} : Lab → ℘(O(Π_{1})) be such that f_{1}(l) isolates m′(l) noninteracting l-communication occurrences in Π_{1}. Furthermore, let f_{2} : Lab → ℘(O(Π_{2})) be such that f_{2}(l) isolates \overline{m′}(l) noninteracting l̄-communication occurrences in Π_{2}. Then since for all l, m′(l) = \overline{m′}(l̄), there exists a family of bijections g_{l} : f_{1}(l) ↔ f_{2}(l̄). We set I_{m} to be the reflexive, symmetric closure of {(A, B) | ∃l.g_{l}(A) = B}, and then add I_{m} to Π_{1} ∪ Π_{2}. The resulting set of interaction links will still form an equivalence relation because in P_{F} -deductions, each equivalence class consists of at most two conclusions. The second step is simply to apply the parallel composition rule to get the result.

⇐: By induction on the depth of inference of Π[m] ⊢ p → p′. Case l.p → p: we get l.p →^{{| l |}} p. Case p|q → p′|q: case follows easily by induction. Case p|q → p|q′: similar.

Case p|q → p′|q′: suppose Π[m] ⊢ p|q → p′|q′. This is inferred from a P_{F} deduction of p → p′, q → q′. We break all the links between the deductions of these two conclusions, from which we obtain two P_{F} deductions Π_{1} ⊢ p → p′ and Π_{2} ⊢ q → q′. Now suppose the broken links were between pairs of actions (l_{1}, l̄_{1}), …, (l_{n}, l̄_{n}) (for n ≥ 0). Let m′ = {| l_{1}, …, l_{n} |}. Then we get Π_{1}[m_{1} = m′_{1} ∪ m′] and Π_{2}[m_{2} = m′_{2} ∪ \overline{m′}] for some m′_{1} and m′_{2} such that m = m′_{1} ∪ m′_{2}. By induction we get P_{MSOS} ⊢ p →^{m_{1}} p′ and P_{MSOS} ⊢ q →^{m_{2}} q′. We can apply the parallel composition rule to get P_{MSOS} ⊢ p|q →^{m} p′|q′. □

Note that even though there is no case for the I-rule a.p → p—ā.q → q in the above induction, I still make essential use of its existence in P_{F}. It allows me Chapter 2. Interacting Deductions 37

to take P_{I}-deductions, and then strip away interaction links at my convenience. This allows me to identify the interactions between inference trees that have to be communicated together in P_{MSOS}.

Proposition 2.13 For all p, p′ ∈ P, P_{MSOS} ⊢ p →^{∅} p′ if and only if P_{I} ⊢ p → p′.

Proof: Follows by proof fragmentation and the fact that I(P_{I}) ⊆ 𝔽_{P_{F}} (I(P_{I})).

□

From propositions 2.11, 2.12 and 2.13 it follows that

P_{I} ⊢ p →^{+} p′ iff P_{SOS} ⊢ p(→^{τ})^{+}p′

2.6 Chapter summary

The basic theory of interacting deductions introduces the concept of interaction between groups of inference trees (or mathematicians trying to prove individual results). An interaction link between two occurrences denotes a synchronization of ideas. This allowed us to separate the various parts of a semantic judgment to achieve syntactic simplicity and propagation freeness in semantic rules (section 2.3.1). This made it particularly easy to extend semantic definitions (section 2.3.2). To exploit this simplification and extensibility in proofs about these semantic definitions, we needed the proof fragmentation theorem (section 2.4). This simplified the task of proof extension (section 2.5.1) and improved modularity (section 2.5.2). However, its use in the equivalence result (section 2.5.3) stemmed from the fact that it is not a simple matter to reason inductively from the definition of I-deduction. Though easily remedied using fragmentation, it indicates that the definition is not as good as it should be: somehow it ought to include the notion of fragmentation. We see this in chapter 4.

First though, we have seen how to use a theory of interacting deductions to give transition semantics. The next chapter asks if we can also give evaluation semantics.

Chapter 2. Interacting Deductions 38

Evaluation Semantics and Sequential Deductions

Evaluation semantics [Hen90] (elsewhere called Natural Semantics [Kah87], Relational semantics [MT92], Martin Löf-style operational semantics [Abr93] and Big-Step semantics [Ast91]) enjoy a number of advantages over transition semantics. They tend to be more concise, less detailed and easier to reason about [Ber91, ch4]. They can also often give more direct semantics to features such as while loops. Practically, they have been used to give semantics to ML and EML [KST94], as the basis of theories of program animation [Ber91], execution profiling [San94], debugging [DS92] and compiler generation [DJ86].

I-systems can describe transition semantics; can they also describe evaluation semantics? We present an evaluation I-semantics for P which answers this question affirmatively. However, P is a very simple language — can we give evaluation semantics to more complex languages, for example containing sequential composition? In fact we can, in at least two different general ways. However, neither approach is easy to understand. Therefore we introduce a notion of sequentiality into the metatheory of deduction, giving QI-deduction. This is harmless, because every QI-system can be coded into an equivalent (albeit less perspicuous) I-system.

We obtain an evaluation semantics for P extended with sequential composition, which is more concise, and more readily comprehensible than a transition semantics. However, the real test is whether or not the evaluation semantics can simplify proofs too. We give a simple translation correctness result which verifies that at least for some applications, it does.

The structure of this chapter is as follows. In section 3.1 we consider how existing techniques for capturing sequential composition in ordinary evaluation semantics can be appropriated in I-systems. In section 3.2 we define the QIdeductions, which are just the I-deductions extended with a notion of sequencing. We show that QI-systems can be coded into equivalent I-systems. Section 3.3 describes a QI-system for P(;) — P plus sequential composition, and uses it to discuss various aspects of QI-deduction. Last, section 3.4 compares the pragmatic value of our evaluation semantics with that of a transition semantics by testing how easily they can prove a simple translation correctness result.

An evaluation semantics of P

Our language P has a very simple evaluation-style I-semantics P_{I}^{E}:

0√  {p√ \atop l.p√} − {q√ \atop l̄.q√}  \begin{matrix}p√ & q√ \\ p|q√ \end{matrix}

The judgment p√ means “p terminates” — i.e., it is equivalent to the sequence of P_{I}-judgments abbreviated p →^{∗} q for q ∈ Ω. This can be shown formally, but it is not important here.

This example illustrates how evaluation semantics can be more concise than transition semantics. There is just one rule for each combinator. I think it is tidier than the transition semantics. It also highlights two important points. Consider the process a.b.0. We get P_{SOS} ⊢ a.b.0 →^{a·b} 0. That is, the evaluation of a.b.0 will first perform a and then b and then stop. Now consider the deduction fragment Π of P_{QI}:

{0√ \atop b.0√} ; a.b.0√

We have a.b.0√ <_{Π} b.0√ <_{Π} 0√. If we say the action of a judgment l.p√ is l then <_{Π} attributes the following sequence of actions to Π: a · b. We can then say that Π attributes this sequence of actions to the conclusion of Π, a.b.0√. The first point is that the preorder of Π naturally captures the evaluation order of a.b.0. The second point is that this order is opposite to the order in which the judgments were deduced.

Adding sequential composition

When we add a sequential composition operator ‘;’ to P, it becomes more difficult to give an evaluation semantics. Let P(;) be P plus ‘;’. Its grammar is

p ::= 0 | l.p | p|p | p; p

and its SOS transition rules are:

\begin{matrix}l.p →^{l} p & \begin{matrix}p ∈ Ω & q →^{α} q′ \\ p; q →^{α} q′ \end{matrix} & {p →^{α} p′ \atop p; q →^{α} p′; q} \\ {p →^{α} p′ \atop p|q →^{α} p′|q} & {q →^{α} q′ \atop p|q →^{α} p|q′} & \begin{matrix}p →^{l} p′ & q →^{l̄} q′ \\ p|q →^{τ} p′|q′ \end{matrix} \end{matrix}

Note that the set of terminal states of P(;) is just the set of terminal states of P, Ω. I call this system P_{SOS}^{(;)} = (L_{SOS}^{(;)}, R_{SOS}^{(;)}). It is a straightforward extension of P_{SOS}.

Unfortunately I cannot give an evaluation-style I-semantics to P(;) as simply as I could give one to P. In the next section, I survey four methods of capturing sequentiality in standard evaluation semantics. I shall discuss why they are not appropriate, thereby motivating the introduction of extra sequencing technology in the meta-theory.

3.1 Sequential composition in evaluation semantics

This section considers some different ways that sequential composition has been modeled in evaluation semantics. I call them cutting intermediate states, control stacks, coding and convention. Each approach either fails or requires complex judgments. Therefore I argue for a meta-theoretic treatment of sequencing, independently of particular semantics.

3.1.1 Cutting intermediate states

The most common way to model sequential composition in an evaluation semantics is to “cut intermediate states”. If a program phrase exp_{1} is executed before exp_{2}, then the machine state immediately after executing exp_{1} is the state immediately before executing exp_{2}. The intermediate state is produced and then consumed, and is not mentioned in (i.e., it is “cut out of”) the overall evaluation judgment of the composed program exp_{1}; exp_{2}.

This is how sequentiality is captured in The Definition of Standard ML [HMT90]. In ML, sequential composition is a derived form: its semantics is given by the callby-value interpretation of function application (defined by the rules in [HMT90, §6.7]). However, if it did have a rule for sequential composition, it would be something like:

\begin{matrix}s, E ⊢ exp_{1} ⇒ v, s′ & s′, E ⊢ exp_{2} ⇒ v′, s′′ \\ s, E ⊢ exp_{1}; exp_{2} ⇒ v′, s′′ \end{matrix}

where E is an environment associating identifiers with their values and s, s′ and s′′ are store states. A judgment of form s, E ⊢ exp ⇒ v, s′ means that exp is evaluated in environment E and store s to value v, having changed the state to s′. In this rule s is the initial state, s′′ the terminal state, and s′ is the intermediate state that has been cut out of the conclusion.

This technique does not work directly in an I-semantics. P(;) processes do not interact with stores; but even if they did (e.g., in a similar manner to P(:=)), cutting intermediate states would not guarantee that the interaction links above the ‘sequenced’ premises would likewise be sequenced. Suppose our semantic judgments were of form s, p√, s′, and meant that p terminated transforming store s to s′. The proposed rule

\begin{matrix}s, p√, s′ & s′, q√, s′′ \\ s, p; q√, s′′ \end{matrix}

would not stop the inference trees above the premises interacting. Thus we could have Π such that Π ⊢ s, a.0; ā.0√, s — which is wrong. If a.0 is evaluated before ā.0, they cannot interact.

One way round this difficulty is to introduce an artificial notion of ‘state’ that captures the global ordering of interaction links. The following four rules capture this:

\begin{matrix}[κ] 0√ [κ] {[κ_{1}, n] p√ [κ′_{1}] \atop [κ_{1}] l.p√ [κ′_{1}]} − {[κ_{2}, n] q√ [κ′_{2}] \atop [κ_{2}] l̄.q√ [κ′_{2}]} if n > max(κ_{1} ∪ κ_{2}) \\ \begin{matrix}[κ] p√ [κ_{1}] & [κ] q√ [κ_{2}] \\ [κ] p|q√ [κ_{1} ∪ κ_{2}] \end{matrix} & \begin{matrix}[κ] p√ [κ_{1}] & [κ_{1}] q√ [κ_{2}] \\ [κ] p; q√ [κ_{2}] \end{matrix} \end{matrix}

The sets of natural numbers κ (note I have used κ, n to abbreviate κ ∪ {n}) are the artificial states. Each member of an artificial state records the timestamp of an interaction link (a link is timestamped at the communication rule by n). Thus the evaluation judgment [κ] p√ [κ′] is intended to mean that “the evaluation of p commences after the interactions recorded in κ and terminates after the interactions recorded in κ′”. A straightforward proof shows that if [κ] p√ [κ′] is deduced in the above system then κ ⊆ κ′. For example, (where I elide set brackets for legibility)

[figure: \begin{matrix}{[1, 2] 0√ [1, 2] \atop [1] b.0√ [1, 2]} ; [∅] a.b.0√ [1, 2] & \begin{matrix}{[1] 0√ [1] \atop [∅] ā.0√ [1]} & {[1, 2] 0√ [1, 2] \atop [1] b̄.0√ [1, 2]} \\ [∅] ā.0; b̄.0√ [1, 2] \end{matrix} \\ [∅] a.b.0|ā.0; b̄.0√ [1, 2] \end{matrix}]

deduces [∅] a.b.0|ā.0; b̄.0√ [1, 2], which says that when the process a.b.0|ā.0; b̄.0 executes, it performs two interactions. (The actual numbers 1 and 2 have no independent meaning.) Thus the above system can sequence interactions correctly. To show that it enforces sequentiality, consider the following attempted deduction of [∅] a.b.0|b̄.0; ā.0√ [κ].

[figure: \begin{matrix}{[1, 2] 0√ [1, 2] \atop [1] b.0√ [1, 2]} ; [∅] a.b.0√ [1, 2] & \begin{matrix}{[2] 0√ [2] \atop [∅] b̄.0√ [2]} & [1, 2] 0√ [1, 2] ; [2] ā.0√ [1, 2] \\ [∅] b̄.0; ā.0√ [1, 2] \end{matrix} \\ [∅] a.b.0|b̄.0; ā.0√ [1, 2] \end{matrix}]

The problem here occurs at the boxed occurrence: we cannot apply the communication rule here because 1 ≯ 2. Thus the first example suggests that this system can sequence evaluations correctly, and the second suggests that it cannot sequence evaluations wrongly.

A major point is that this approach does not depend in any way on the language P(;). This is both good and bad. It is good because this means the technique can be used for any language, which in turn means that the basic theory of interacting Chapter 3. Evaluation Semantics and Sequential Deductions 43

deductions is powerful enough to give both transition and evaluation semantics to a wide class of languages.

It is bad precisely because the states are artificial: they are not intuitive semantic objects. The stores of P(:=) are intuitive, because stores occur in implementations. But the artificial states would correspond to nothing in an implementation. They are purely declarative. This makes it hard to understand why the technique works: especially since the timestamps correspond to nothing in the language (in the communication rule, where does n come from?). In fact, they relate to the structure of deductions, not to programs.

Moreover, they are bad because they clutter semantic judgments, and have to be propagated everywhere. They cannot be fragmented away like stores because their function is to timestamp the interactions of the trees they occur in. We cannot even appropriate the state convention of [HMT90, §6.7] to aid legibility, because our language also has concurrency (see section 3.1.4).

Since my aim is to simplify both the presentation of and proofs about operational semantics, I need a more intuitive semantics for sequential composition that does not clutter judgments and does not require propagation. Moreover, it seems proper to separate information about the structure of deductions (meta-theoretic information) from semantic judgments (object-theoretic information).

3.1.2 Control stacks (or continuations)

An alternative technique is to use a kind of syntactic continuation mechanism, like the control stacks used in the SECD machine [Lan64]. This is not a widespread technique, so figure 3–1 gives a simple example: an evaluation semantics for a stack-based expression evaluator.

This technique requires much more effort than a normal semantics for expressions:

n ⇒ n  \begin{matrix}e_{1} ⇒ n_{1} & e_{2} ⇒ n_{2} \\ e_{1} op e_{2} ⇒ app(op, n_{1}, n_{2}) \end{matrix}

where the judgments are simpler, more perspicuous, and easier to reason about, because the semantics is more abstract. The “continuation-style” semantics is more like an abstract machine. It does not feel like a true evaluation semantics.

This example also underlines the points I made earlier about preorders of deductions. In the deduction Π of figure 3–1, (1 + 3) was evaluated before 2. Yet the portion of the evaluation concerning the evaluation of 2 is higher up the tree than that evaluating (1 + 3). That is,

[(1 + 3), 2, −], ε ⇒ 2 <_{Π} [2, −], [4] ⇒ 2

So, if we say the action of e · C, S ⇒ n is e (a reasonable thing to do), then <_{Π} sequences the action (1 + 3) before the action 2. Once again, the preorder (which is opposite to the order in which judgments are deduced) corresponds to the evaluation order.

Let us assume a simple language of expressions:

e ::= n | e op e

where n ∈ ℤ, and for some set Op of operators, op ∈ Op. The semantic rules for evaluation are:

ε, n · S ⇒ n  {C, n · S ⇒ n \atop n · C, S ⇒ n}  {e_{1} · e_{2} · op · C, S ⇒ n \atop e_{1} op e_{2} · C, S ⇒ n} ; {C, app(op, n_{1}, n_{2}) · S ⇒ n \atop op · C, n_{2} · n_{1} · S ⇒ n}

where C is the control stack, or syntactic continuation of the values on S, the value stack. app : Op × ℤ × ℤ ⇀ ℤ is a partial function meant to capture the “natural interpretation” of an expression. Thus app(+, 1, 1) means 2, etc. A judgment C, S ⇒ n means that the continuation C of S results in value n. It is not hard to see that in an expression e_{1} op e_{2}, e_{1} is evaluated before e_{2}. A simple example is

{ε, [2] ⇒ 2 \atop [−], [2, 4] ⇒ 2} ; [2, −], [4] ⇒ 2 ; [+, 2, −][3, 1] ⇒ 2 ; [3, +, 2, −], [1] ⇒ 2 ; [1, 3, +, 2, −], ε ⇒ 2 ; [(1 + 3), 2, −], ε ⇒ 2 ; [(1 + 3) − 2], ε ⇒ 2

where I have used [a, b, c] as an abbreviation for a · b · c · ε.

Figure 3–1: A simple “continuation-style” evaluation semantics Control Stacks and Concurrency

If I tried to use this technique to give semantics to a concurrent language, I would quickly run into complications owing to concurrency. The overheads would be so large I would be better using a transition semantics.

However, the situation is greatly improved when using I-systems: we can elide detail by distributing the control stack across several judgments. The following semantics is based upon an observation of Pietro Cenciarelli. Here judgments concern process occurrences, which we denote by pairs (p, n), where p is a process and n a natural number. The judgments come in two forms: the suspended form (p, n)√(q, m), intended to mean “when activated, process occurrence (p, n) terminates before process occurrence (q, m) commences,” and the active form p√(q.m) which means that this occurrence of p will terminate before occurrence (q, m) begings. Thus (q, m) can be seen as a pointer to the next evaluation judgment in the distributed control stack. The semantic rules are:

0√(0, n)  0√(p, n) − {(p, n)√(q, m) \atop (p, n)√(q, m)}  {p√(q, m) \atop (p, n)√(q, m)}

{p√(q, m) \atop l.p√(q, m)} − {p′√(q′, m′) \atop l̄.p′√(q′, m′)}

\begin{matrix}p√(r, m) & q√(r, m) \\ p|q√(r, m) \end{matrix}  \begin{matrix}p√(q, n) & (q, n)√(r, m) \\ p; q√(r, m) \end{matrix} n fresh

(Note that the sequential composition rule looks like it is cutting intermediate states, but it does not — q is not cut out of the conclusion.) The key rule is the second one. Its function is to ensure that every parallel process sequenced before p terminates before p commences. For instance, consider the process (a.0|b.0); c.0. The I-deduction fragment Π corresponding to its evaluation is:

[figure: \begin{matrix}\begin{matrix}{0√(c.0, 2) \atop a.0√(c.0, 2)} & {0√(c.0, 2) \atop b.0√(c.0, 2)} \\ a.0|b.0√(c.0, 2) \end{matrix} & ⋮ . ; c.0√(0, 1) ; (c.0, 2)√(0, 1) ; (c.0, 2)√(0, 1) ; (c.0, 2)√(0, 1) \\ (a.0|b.0); c.0√(0, 1) \end{matrix}]

The second rule is used twice to deduce the two 0√(c.0, 2) judgments. Without it, the evaluation of a.0 and b.0 could not be deduced. Now, let us say that a judgment is invisible when it occurs as a conclusion of the second rule. Invisible occurrences do not correspond to any kind of computation: they just “mark time”. Let (c.0, 2)√(0, 1)^{3} be the only visible occurrence of (c.0, 2)√(0, 1) in the above fragment (i.e., the highest). Then we see that both (a.0√(c.0, 2)) <_{Π} ((c.0, 2)√(0, 1)^{3}) and (b.0√(c.0, 2)) <_{Π} ((c.0, 2)√(0, 1)^{3}). Once again the preorder of Π captures the evaluation order.

Of course, these rules do not prohibit us from deducing an arbitrary number of conclusions of form 0√p, but since these deductions do not tell us anything interesting about P(;) we can ignore them.

Chapter 3. Evaluation Semantics and Sequential Deductions 46

Once again, it is straightforward to show that the judgment a.b.0|(ā.0; b̄.0)√(0, 1) is deducible, and that a.b.0|(b̄.0; ā.0)√(0, 1) is not. This suggests that the above system can sequence correctly, and does not sequence wrongly.

This semantics is much simpler than a traditional control stack semantics owing to the distribution of the stack. If one identifies control stacks with continuations, one can imagine evaluation semantics for continuation-handling operations such as call/cc [Cli85,FFHD87]. I have not pursued this topic, but it seems possible. Though it is not clear how continuations mix with concurrency, one might use this technique for sequential languages.

This semantics mentions only naturally occurring semantic objects. So in this sense, it is more natural than the previous semantics. Once again the technique will work for any language. However, it is quite awkward to have to talk about process occurrences. (To avoid them we should have to annotate judgments, cluttering syntax.) Further, once again, sequencing information has to be propagated everywhere. Moreover, it is not perspicuous: one has to think quite hard before one believes this technique works. So even though this style of semantics may have certain applications (e.g., evaluation semantics for continuation-handling languages), it is overkill for sequential composition. Everybody understands sequential composition. It is simple and intuitive. We should like a simple and intuitive characterization of it.

3.1.3 Coding

A third technique is to code sequential composition using other primitives. For example, sequential composition is a derived form in ML: it is coded using function application (appendix A of [HMT90]). However, this only postpones the problem of defining sequentiality. We still have to model call-by-value application: first evaluate the function to its primitive form, then its argument, and then evaluate the body of the function after assigning its parameter to the value of the argument.

It is also coded in Concurrent ML [Rep91b], slightly differently than above, but again relying on the call-by-value nature of function application.

Similarly, it can be coded in the CCS. Milner [Mil89, §8.1] defines the Before operator using a special communication protocol of “done” signals. In section 3.4, I show that P(;) can be coded into P in a similar way. I could say that the compiler gives the meaning to “;” [Gar63], but there are two difficulties. First, the compilation is complex, and I should like some way to prove that it is correct. To do this, I require direct semantics for both P and P(;). Second, not every language is able to implement sequential composition — for instance, Basic.

3.1.4 Conventions

A fourth technique is to alter the meaning of inference rules by imposing an order on the premises. An example of this may be found in Berry’s work on program animation [Ber91]. However, this is usually justified by a convention about intermediate states: if there are none, then the order does not matter; otherwise Chapter 3. Evaluation Semantics and Sequential Deductions 47

the convention is that the premises are ordered according to the order implied by the intermediate states. In the definition of Standard ML, the state convention is such an ordering of rule premises. Its function is to simplify the presentation of rules by eliding state information from judgments (except where rules concern state explicitly). The conventional ordering allows one to put state information back in mechanically.

At first sight, this could work: we know how to introduce artificial state information to model sequentiality. Moreover, we can do this almost without knowing anything about the language itself. Our problem is that the premises of a parallel composition rule cannot be ordered — so we cannot appropriate the state convention for P(;) unless we can distinguish premises that are to be ordered from those that are not.

3.1.5 Solution

The previous discussion has led us to conclude that we need an intuitive, but formal and direct way to capture sequentiality without excluding parallelism. The problem is that we must sequence the interactions between inference trees. I introduce a proof-theoretic mechanism to do this.

I introduce some notation first, and formalise its meaning later. The notation indicates that one premise is “sequenced before” another in a rule:

\begin{aligned}p√ & ▶ & q√ \\ & p; q√ \end{aligned}

This rule is intended to say that the evaluation of p must conclude before that of q commences. The view that evaluation order is opposite to deduction order suggests that q√ ought to be deduced before the deduction of p√ commences.

(Note that the black triangle ▶ is not intended to be read as a logical symbol such as consequence. The above rule does not contain one premise that says “q√ is a consequence of p√”. The triangle occurs between judgments.)

However, ▶ is not just a side-condition: it adds information. Once an inference tree has been sequenced before another, the trees that interact with the first must also be sequenced before those that interact with the second. Therefore, asserting that one tree must be sequenced before another constrains the way non-local trees can be sequenced too. The following structure violates this condition:

[figure: \begin{matrix}\begin{matrix}{0√ \atop a.0√} & ▶ & {0√ \atop b.0√} \\ a.0; b.0√ \end{matrix} & \begin{matrix}{0√ \atop b̄.0√} & ▶ & {0√ \atop ā.0√} \\ b̄.0; ā.0√ \end{matrix} \\ (a.0; b.0)|(b̄.0; ā.0)√ \end{matrix}]

Chapter 3. Evaluation Semantics and Sequential Deductions 48

The left-hand sequencing implies that the tree above ā.0√ is sequenced before that above b̄.0√. The right-hand sequencing requires them to be sequenced in the other way.

Therefore, to check that one can apply a sequenced rule to a deduction, one has to check that it sequences inference trees consistently with every other sequencing. Obviously we have to know what these other sequences are, which means that sequencing information ought to be part of the deduction itself.

The next section defines the QI-deductions, or sequential deductions. It begins by defining what the black triangle (pronounced “is sequenced before”) means in terms of formula occurrences. It defines the QI-deductions inductively from QI-rules, and then characterizes them axiomatically.

Q-atoms a Q-atom is a pair (P rem, C) where C is a formula occurrence not appearing in P rem, and P rem is a set of finite, non-empty sequences of formula occurrences, such that no occurrence appears more than once. When they occur as premises of Q-atoms, I write sequences of occurrences A_{1} · . . . · A_{n} graphically as A_{1} ▶ … ▶ A_{n}. If s is a sequence of occurrences, I write θs for the result of applying θ elementwise. Two sequences of occurrences match if they are of the same length and they match elementwise. I lift substitution and matching to Q-atoms in the obvious way.

I write flat(a) for the operation of flattening out the sequencing structure of atom a:

flat(P rem, C) = (⋃{{A_{1}, …, A_{n}} | A_{1} · . . . · A_{n} ∈ P rem}, C)

and I write ⊏_{a} for the relation “is sequenced immediately before” in a:

A ⊏_{(P rem,C)} B iff ∃s, s′.s · A · B · s′ ∈ P rem

3.2 Sequential deductions

As before, a rule atom establishes how someone can draw a new inference from a set of previously established facts, and an interacting rule establishes how a set of people can infer new results after exchanging ideas. Now however, our mathematicians are also interested in when the facts they use were deduced. Specifically, they want to know if the history of one fact (i.e., its inference tree) was completed before the history of another was begun. Before I define the QI-deductions, I define the QI-rules and QI-systems. These are straightforward analogues of I-rules and I-systems.

QI-rules A QI-rule r is a finite, non-empty set of Q-atoms such that no occurrence appears more than once. I write QI-rules graphically in a similar way to I-rules. Rule substitution and rule matching is defined as before. I write flat(r) for the result of flattening all the atoms in r, and ⊏_{r} for the union of the sequencing relations of the atoms in r.

Chapter 3. Evaluation Semantics and Sequential Deductions 49

QI-systems A QI-system T is a pair (L, R) where L is a language and R is a set of QI-rules over formulae in L. In the rest of this chapter, I shall drop the “QI”-prefix wherever it does not lead to confusion.

QI-structures We have seen that QI-deductions ought to record the sequencing constraints imposed by the rules that build them. The simplest way to do this is to include a sequencing relation ⊏ between formula occurrences, where A ⊏ B means “A is sequenced immediately before B”. This relation will simply be the union of the sequencing relations of the rules.

Therefore a QI-structure is a triple (F, I, ⊏) such that (F, I) is an I-structure, and ⊏⊆ O(F)×O(F). Henceforth, I shall assume that all triples of shape (F, I, ⊏) are QI-structures.

Now, suppose (F, I, ⊏) is a QI-structure. The relation ⊏ orders formula occurrences, the intention being to sequence the trees above the formula occurrences. Therefore we define the relation ˆ⊏ ⊆ O(F) × O(F) by lifting ⊏ to trees of occurrences in F. It is defined in the following way

A ˆ⊏ B iff ∃A′, B′ ∈ O(F).A′ ⊏ B′ and A′ ≲_{F} A and B′ ≲_{F} B

The ˆ· symbolism is meant to suggest the operation of extending the effect of ⊏ up the trees whose roots are related by ⊏. Technically, this symbol should be subscripted by the forest that contains the relevant trees; but where the context does not make it clear which forest is intended (e.g., in the proof of theorem III) the result will always be the same whichever forest in the context is chosen.

Histories The last problem is how to verify that a structure satisfies the sequencing constraints imposed by a rule. Specifically, when (F, I, ⊏) is a deduction, we wish to know when it is consistent to assert that one tree is completely deduced before another in (F, I, ⊏). Ultimately, this question concerns the order in which we can apply our rules to build (F, I, ⊏). Therefore, it is natural to use a notion of deductive history to verify sequencing constraints. If there exists some history which satisfies all the sequencing constraints then we know that they are consistent.

A history of (F, I, ⊏) is a function h : O(F) → ℕ such that for all A, B ∈ O(F),

if A <_{F} B then h(A) > h(B)
if A ˆ⊏B then h(A) > h(B)
if A I B then h(B) = h(A)

The idea is that h timestamps each occurrence according to when it was deduced. If h(A) > h(B) then A was deduced after B. The first condition simply states that if A is lower than B then A must have been deduced after B. Similarly, if A is sequenced before B then (under the view that evaluation order is opposite deduction order) A is deduced after B. Last, if A and B interact, then they must have been deduced simultaneously.

Given a history h, it is easy to check if it deduces the tree above A before that above B. If the tree above A in F is meant to be deduced before that of B, then the earliest occurrence above B must be later than A (which is the latest occurrence in the tree above A). In symbols, I write ĥ(B) > h(A), where

ĥ(B) = min{h(C) | C ≳_{F} B}

is the time of the earliest occurrence above B. The ˆ· notation is again meant to symbolise the act of going up the tree above the specified occurrence.

(Using history functions is similar to the idea of using artificial states in the system of section 3.1.1. Here however, I timestamp formula occurrences, not interaction links.)

QI-deductions Now we can define the QI-deductions. The proposal is to add a sense of history to our community of mathematicians. When a mathematician sees a rule with sequenced premises his first task is to check the order in which the trees concluding the premises were deduced. If A is to be deduced before B, he wants to know that the history of B did not begin until A was obtained.

Definition 3.0 The set QI(T ) of QI-deductions of T is the least set of triples (F, I, ⊏) such that

1. 0 = (∅, ∅, ∅) ∈ QI(T )

2. if (a) (F, I, ⊏) and r matches a rule of T such that flat(r) can be applied to (F, I) to get (F′, I′) (b) There exists a history h of (F, I, ⊏) such that for all (A, B) ∈⊏_{r}, ĥ(A) > h(B)

then (F′, I′, ⊏ ∪ ⊏_{r}) ∈ QI(T ).

Proposition 3.1 Every QI-deduction has a history.

Proof: by induction on the definition of QI(T ), for QI-system T . Case 1: 0 has the empty history 0 : ∅ → ℕ. Case 2: by induction, (F, I, ⊏) has a history. Suppose r can be applied to it to make (F′, I′, ⊏′). Then there must exist a history h of (F, I, ⊏) such that for all (A, B) ∈⊏_{r}, ĥ(A) > h(B). We show that h′ : O(F′) → ℕ is a history of (F′, I′, ⊏′) where

h′(A) = \{ \begin{matrix}h(A) & if A ∈ O(F) \\ 1 + max(im h) & ow \end{matrix}

(Where I assume max(∅) = 0.) First, suppose A <_{F′} B. Then either A <_{F} B, in which case h(A) > h(B) and so h′(A) > h′(B) or B ∈ O(F) and A ∉ O(F), in which case h′(A) = 1 + max(im h) > h(B) = h′(B). Second, suppose Aˆ⊏′B.

Chapter 3. Evaluation Semantics and Sequential Deductions 51

Then either A ˆ⊏B or not. If so, then h(A) > h(B), whence h′(A) > h′(B). If not, then A and B must be sequenced by ⊏_{r}: i.e., there exists A′, B′ such that A ≳_{F} A′ and B ≳_{F} B′ and A′ ⊏_{r} B′. But then, ĥ(A′) > h(B′), and so h′(A) = h(A) ≥ ĥ(A′) > h(B′) ≥ h(B) = h′(B). Last, suppose A I B. Then either A, B ∈ O(F) or A, B ∉ O(F). In the first case, h′(A) = h(A) = h(B) = h′(B), and in the second, h′(A) = h′(B) = 1 + max(im h). □

3.2.1 Examples

Section 5.1.4 gives an evaluation-style operational semantics for CSP which is a QI-system. I give some simpler examples here. Let T be the QI-system (L, R) where L = {A, B, C} and R consists of the following rules:

B  C − C  \begin{aligned}B & & B \\ & B \end{aligned} − \begin{aligned}B & & B \\ & B \end{aligned}  \begin{aligned}B & ▶ & C \\ & A \end{aligned}

Then the following diagram is a graphical representation of a simple T -deduction (F, I, ⊏)

[figure: \begin{aligned}\begin{aligned}B & & B \\ & B \end{aligned} & ▶ & C \\ & A \end{aligned}  \begin{aligned}\begin{aligned}B & & B \\ & B \end{aligned} & ▶ & C \\ & A \end{aligned}]

Two examples of triples (F, I, ⊏) which are not QI-deductions are:

\begin{aligned}\begin{aligned}A & & B \\ & C \end{aligned} & ▶ & D \\ & E \end{aligned}  \begin{aligned}F & & G \\ & H \end{aligned} ; I  [figure: \begin{aligned}{A \atop B} & ▶ & C \\ & D \end{aligned}]

In the first diagram, B ought to precede D through sequencing; yet D ought also to precede B through interactions and inferences. It tries to sequence occurrences which are already ordered oppositely. The second diagram tries to strictly order two trees whose leaves interact. I call these errors sequencing loops because they attempt to synchronize occurrences which have been strictly sequenced.

3.2.2 QI-deductions have no sequencing loops

Preorders of QI-structures The preorder of a QI-structure (F, I, ⊏) is

≲_{(F,I,⊏)}= (≲_{(F,I)} ∪ ˆ⊏)^{∗}

Proposition 3.2 Let (F, I, ⊏) have history h. Then for all A, B ∈ O(F), A ≲_{(F,I,⊏)} B implies h(B) ≤ h(A).

Proof: Suppose A ≲_{(F,I,⊏)} B. Then there must exist a sequence of occurrences A_{1}, …, A_{n} such that A = A_{1}, B = A_{n} and for i = 1, …, n−1, either A_{i} <_{F} A_{i+1}, A_{i} I A_{i+1} or A_{i} ˆ⊏A_{i+1}. In each case, h(A_{i+1}) ≥ h(A_{i}). The result follows from the transitivity of ≥ over the naturals. □

Sequencing Loop Freeness I say (F, I, ⊏) is sequencing loop free if the following condition holds

For all A, B ∈ O(F), if A <_{F} B or A ˆ⊏B then A <_{(F,I,⊏)} B  (SLF)

For motivation, again consider the community of mathematicians. If A <_{F} B or A ˆ⊏B then A must have been deduced after B. Given the definition of preorder, this obviously implies A ≲_{(F,I,⊏)} B. However, if A was deduced after B, then it could not also have been deduced simultaneously with B — therefore A ≁_{(F,I,⊏)} B. That is, A <_{(F,I,⊏)} B.

Proposition 3.3 SLF implies DLF.

Proof: Let (F, I, ⊏) be a QI-structure, and let A, B ∈ O(F) be such that A <_{F} B. By definition, A ≲_{(F,I)} B. By SLF, A <_{(F,I,⊏)} B. Since ≲_{(F,I)}⊆≲_{(F,I,⊏)} we get that B ≴_{(F,I)} A because otherwise B ≲_{(F,I,⊏)} A contradicting SLF. □

Proposition 3.4 Let (F, I, ⊏) have history h. Then (F, I, ⊏) satisfies SLF.

Proof: Suppose A <_{F} B. Then A ≲_{(F,I,⊏)} B and h(A) > h(B). Now, suppose in fact B ≳_{(F,I,⊏)} A also. Then A ∼_{(F,I,⊏)} B, from which h(A) = h(B): contradiction. Therefore A <_{(F,I,⊏)} B. Similarly when A ˆ⊏B. □

Proposition 3.5 Every QI-deduction satisfies SLF.

Proof: From propositions 3.1 and 3.4. □

Proposition 3.6 SLF implies that A ∼_{(F,I,⊏)} B implies AI^{∗}B.

Proof: Suppose A ∼_{(F,I,⊏)} B. Then there exists a sequence of occurrences A_{0}, …, A_{n} in F such that A_{1} = A, A_{n} = B and for all i = 1, …, n − 1 either A_{i} <_{F} A_{i+1} or A_{i}IA_{i+1} or A_{i} ˆ⊏A_{i+1}. Now, since A ∼_{(F,I,⊏)} B, we have for i = 1, …, n − 1, A_{i} ∼_{(F,I,⊏)} A_{i+1} because

A ≲_{(F,I,⊏)} A_{i} ≲_{(F,I,⊏)} A_{i+1} ≲_{(F,I,⊏)} B ≲_{(F,I,⊏)} A

This in turn means that both A_{i} ≮_{F} A_{i+1} and A_{i} ˆ⊏̸A_{i+1} by SLF, which means that A_{i}IA_{i+1} for all i = 1, …, n − 1. □

3.2.3 SLF helps characterize the QI-deductions

Proposition 3.5 showed that every QI-deduction satisfies SLF. To show that SLF is a defining feature of QI-deduction, I need to define the notions of QI-neighbourhoods and rule matching.

QI-neighbourhoods Let A be an occurrence in a QI-structure (F, I, ⊏). Then the (QI-)neighbourhood of A is the pair N_{(F,I,⊏)}(A) = (N, ⊏_{A}) where

\begin{matrix}N = N_{(F,I)}(A) \\ ⊏_{A}=⊏ ∩(O(N) × O(N)) \end{matrix}

Let N(F, I, ⊏) be the set of neighbourhoods in (F, I, ⊏).

The dependency preorder of a QI-deduction Π can be lifted to a preorder ≤_{N(Π)}⊏ N(Π)×N(Π) over QI-neighbourhoods in exactly the same way that the dependency preorder for I-structures can be lifted to a preorder of I-neighbourhoods. By the same reasoning as proposition 2.3 we get

Proposition 3.7 ≤_{N(F,I,⊏)} is a partial order when (F, I, ⊏) satisfies SLF. □

Proposition 3.8 Let (F, I, ⊏) satisfy SLF. Then it has a history.

Proof: We construct a history. By proposition 3.7, the QI-neighbourhoods of N(F, I, ⊏) can be partially ordered. Let ≤ be any total order containing this partial order. Then we define h(A) = i if N(A) is the ith neighbourhood of ≥ (i.e., the total order reversed). To show that this satisfies the conditions, let A <_{F} B. Then N(A) < N(B), by definition of the partial order. Then h(B) > h(A). The other two cases are similar. □

Rule matching A rule r matches a neighbourhood (N, ⊏) via f : O(r) ↔ O(N) (written r ≡_{f} (N, ⊏)) iff

\begin{matrix}(a) & flat(r) ≡_{f} N \\ (b) & ⊏= \{ (f(A), f(B)) | (A, B) ∈⊏_{r}\} \end{matrix}

Theorem III (F, I, ⊏) ∈ QI(T ) if and only if (F, I, ⊏) is a QI-structure satisfying SLF and such that every neighbourhood matches a rule of T .

Proof: ⇐: Let (F, I, ⊏) be a QI-structure satisfying SLF and such that every neighbourhood matches a rule of T . Then (F, I, ⊏) contains a finite number of neighbourhoods. By proposition 3.7, ≤_{N(F,I,⊏)} is a partial order. Let ≤ be any total order containing ≤_{N(F,I,⊏)} and N_{n} < N_{n−1} < … < N_{1} be the neighbourhoods of N(F, I, ⊏) ordered by ≤. Thus N_{n} is the lowest neighbourhood, and N_{1} the highest.

I show by induction on the number n of neighbourhoods that (F, I, ⊏) belongs to QI(T ). When n = 0, the case is trivial. When n = k +1, let (F′, I′, ⊏′) be the QI-structure consisting only of the ≤-highest k neighbourhoods (i.e., N_{k}, …, N_{1}). Obviously, it will satisfy SLF and every neighbourhood will be a rule of T . Thus by induction, (F′, I′, ⊏′) ∈ QI(T ).

Chapter 3. Evaluation Semantics and Sequential Deductions 54

Consider the k + 1-the neighbourhood (N, ⊏_{0}). It matches rule r. By a similar argument to that of theorem I, we can show that (F, I) is the result of applying flat(r) to (F′, I′). It remains to show that the sequencing constraints are satisfied. By proposition 3.8, (F, I, ⊏) has history h. So, let A ⊏_{0} B. Then A ⊏ B by the definition of neighbourhood, and so for all C ≳_{F} A, C ˆ⊏B and therefore h(C) > h(B). In particular, min{h(C) | C ≳_{F} A} > h(B), i.e., ĥ(A) > h(B). Therefore, (F, I, ⊏) is a member of QI(T ).

⇒: Let (F, I, ⊏) ∈ QI(T ). By prop 3.5, it satisfies SLF. It remains to show that every neighbourhood matches a rule of T . We show the result by induction on the definition of (F, I, ⊏). The base case is vacuous. For the induction step, suppose every neighbourhood of (F, I, ⊏) matches a rule of T . Suppose r can be applied to it to yield (F′, I′, ⊏′). Now let (N, ⊏_{N}) be the only neighbourhood of (F′, I′, ⊏′) not in (F, I, ⊏). By a similar argument to that of theorem I we can show that flat(r) matches N via some f : O(r) ↔ O(N). It remains to show that ⊏_{N}= {(f(A), f(B)) | (A, B) ∈⊏_{r}}. This follows directly from case 2 of definition 3.0. □

I cannot form a simple correctness principle for QI-deductions based on their graphical representation, like I did for I-deductions. One has to mentally “cut out” sequenced trees and stack them in such a way that if A ⊏ B then the tree above B is stacked above the tree above A. Then one can use the correctness principle for I-deductions.

3.2.4 Coding QI-deduction into I-deduction

In section 3.1 I exhibited two different techniques for capturing sequentiality: cutting intermediate states and using distributed control stacks. Both of these techniques could work independently of the details of the language being defined. This suggests that QI-systems are not more expressive than I-systems — i.e., any language definable in a QI-system is already definable in an I-system.

To prove this result directly, I could either exhibit a coding of the QI-systems which used artificial states, or which used distributed control stacks. In the first case, I would transform a judgment A into judgments of form [κ] A [κ′], and in the second, I would use judgments of form A before B.

One can do this quite straightforwardly — in fact the translation using artificial states is reminiscent of the state convention of the definition of Standard ML. The proof is not very difficult. However, for reasons of space I shall omit such a proof here. Instead, an even simpler proof goes via the computational semantics of chapter 6. The proof of the following theorem can be found in section 6.3.1.

Theorem IV For all QI-systems T = (L, R), there exists an I-system T^{∗} = (L^{∗}, R^{∗}) and a family of injective maps f_{n} : L^{n} → L^{∗} such that T ⊢ A_{1}, …, A_{n} if and only if T^{∗} ⊢ f_{n}(A_{1}, …, A_{n}) □

3.3 An evaluation QI-semantics for P(;)

We use the theory of QI-deductions to give an evaluation-style semantics to P(;). Let P_{QI}^{(;)} be the QI-system consisting of judgments of form p√ (where p ∈P(;)) and the following four QI-rules.

0√  {p√ \atop a.p√} − {q√ \atop ā.q√}  \begin{matrix}p√ & q√ \\ p|q√ \end{matrix}  \begin{aligned}p√ & ▶ & q√ \\ & p; q√ \end{aligned}

Once again, the evaluation semantics is more concise than the transition semantics.

The remainder of this section will be spent confirming that the rule for p; q really does define it to be the sequential composition of p and q. I do this by showing it accords with the sequentiality given by prefixing. The translation of P(;) into P given in section 3.4 will further confirm these rules correct. First I confirm that the semantics does sequence correctly, and second that it does not sequence incorrectly.

The following example suggests that p; q can sequence p before q by giving the deduction of the judgment (a.0; b.0)|(ā.b̄.0)√. Since ā must be communicated before b̄, this will show that the rules allow a.0 to be evaluated before b.0. Let Π be the structure

[figure: \begin{matrix}\begin{matrix}{0√ \atop a.0√} & ▶ & {0√ \atop b.0√} \\ a.0; b.0√ \end{matrix} & {0√ \atop b̄.0√} ; ā.b̄.0√ \\ (a.0; b.0)|(ā.b̄.0)√ \end{matrix}]

It is not hard to check that Π is a deduction. For instance, b.0√ ≴_{Π} a.0√, and a.0√ is sequenced before b.0√. Intuitively, one can cut out the tree above b.0√ and place it above the tree above a.0√ without introducing any sequencing loops.

The next example suggests that the rule for p; q√ only sequences p√ before q√. Consider the process (a.0; b.0)|(b̄.ā.0). The only QI-structure that is composed of P_{QI}^{(;)} rules and which concludes (a.0; b.0)|(b̄.ā.0)√ in isolation is (F, I, ⊏):

[figure: \begin{matrix}\begin{matrix}{0√ \atop a.0√} & ▶ & {0√ \atop b.0√} \\ a.0; b.0√ \end{matrix} & {0√ \atop ā.0√} ; b̄.ā.0√ \\ (a.0; b.0)|(b̄.ā.0)√ \end{matrix}]

But this is not a QI-deduction. We have a.0√ ˆ⊏b.0√ and also a.0√ ∼_{(F,I)} ā.0√ >_{F} b̄.ā.0√ ∼_{(F,I)} b.0√ (i.e., b.0√ <_{(F,I,⊏)} a.0√). This contradicts SLF.

An evaluation semantics for P(:=,;)

Section 2.3 (page 25) showed that transition rules for variable assignment and lookup could be added to those of P in a modular way. They can also be added to the evaluation semantics in a modular way:

\begin{matrix}v ⇝ v & x ⇝ v & − & {σ(x) = v \atop σ ⇝ σ} & \begin{matrix}e_{1} ⇝ v_{1} & e_{2} ⇝ v_{2} \\ e_{1} op e_{2} ⇝ app(op, v_{1}, v_{2}) \end{matrix} \\ \begin{aligned}e ⇝ v & ▶ & set(x, v) & ▶ & p√ \\ & (x := e).p√ \end{aligned} & set(x, v) & − & σ ⇝ σ[v/x] & \begin{aligned}σ ⇝ σ′ & ▶ & σ′ ⇝ σ′′ \\ & σ ⇝ σ′′ \end{aligned} \end{matrix}

Thus in the QI-system for P(:=,;), the rule for sequential composition does not mention stores. We do not need the state convention of [HMT90] to aid legibility. They felt the need to remove stores from rules, but could not — so they used a syntactic convention to abbreviate rule elaboration. When my rules do not concern stores, they do not mention them. There is no need to hide irrelevant details.

Note that the cut rule for stores differs from the one given in S_{I} (page 33). There I wished transitions to write to the store at most once. However, over the course of its entire evaluation, a program will typically write to the store more than once. Therefore we require a different cut rule for stores.

When interactions occur

The auxiliary judgment set(x, v) is used to ensure that the store is updated only after the appropriate value has been obtained. The “obvious” rule

\begin{matrix}e ⇝ v & ▶ & p√ \\ (x := e).p√ \end{matrix} − σ ⇝ σ[v/x]

does not capture the behaviour of assignment. To see why, consider the program (x := x + 1).0, evaluated in the store σ, where σ(x) = 1. We would expect to apply the rule to this program and update the store to become σ′ where σ′(x) = 2. Instead, we get

[figure: σ ⇝ σ  σ ⇝ σ[2/x]  \begin{matrix}x ⇝ 1 & 1 ⇝ 1 \\ x + 1 ⇝ 2 \end{matrix} ; (x := x + 1).0√]

To which we cannot apply the cut rule on stores to yield a two-conclusion deduction of (x := x + 1).0√, σ ⇝ σ[2/x]. The rules of sequencing order the store write before the store read. This is not the behaviour of assignment.

So what is it about the above rule that makes it wrong and my rule right? It is the time during the evaluation of assignment when the store is updated. Intuitively, the store is updated after the expression has been evaluated and before the rest of the program has begun to be evaluated. In my rule, the set judgment ensures this. The “obvious” rule attempts to update the store even before the expression has been evaluated!

This raises the following question: given an interacting rule for an evaluation semantics, at which part of the specified evaluation does the interaction occur? That is, in a hypothetical rule

{p′_{1} ⇒ v′_{1} \atop p_{1} ⇒ v_{1}} − {p′_{2} ⇒ v′_{2} \atop p_{2} ⇒ v_{2}}

Chapter 3. Evaluation Semantics and Sequential Deductions 57

at which point does the interaction occur? There are two natural choices. One choice is to say that the interaction occurs before the evaluation of p_{1} and p_{2}. The other is to say that it occurs after them.

In fact, for I-deduction, the interpretation varies between particular semantics (i.e., it is not important proof-theoretically). The semantics P_{I}^{E} (page 40) only makes sense when the interaction occurs prior to the evaluation specified by the premises. It is also the interpretation of interaction required by the distributed control stack semantics of section 3.1.2 for P(;).

We can also find semantics for P(;) in which the interactions are interpreted to occur after the premises. However, for P(;), these are highly artificial, and are harder to understand than any of the ones previously encountered.

The point is that I-deduction does not commit us to interpret interaction as occurring before or after the evaluations described by the premises. By contrast, QI-deduction commits us to interpret interaction as occurring before the evaluations specified by the premises. This can be seen using the rules of P_{QI}^{(;)}. Consider the deduction of (a.0; b.0)|(ā.b̄.0)√ on page 55. As far as sequencing is concerned, the interaction of a and ā occurs before that of b and b̄. But this means that the interaction of the rule

{0√ \atop a.0√}−{b̄.0√ \atop ā.b̄.0√}

must occur before the interactions of b̄.0√.

We could easily have defined sequencing to fix the other interpretation — it would not have affected the range of languages to which we can give semantics. I chose to fix interaction to occur before premise evaluation both to make the semantics of P(;) simple, and also to make the computational interpretation of deduction in chapter 6 straightforward.

3.4 An example: translation correctness

It is well-known that sequential composition can be coded in CCS. In [Mil89, §8.1], Milner codes sequential composition using restriction and relabelling, of which we have neither. One can work around this lack, but to do so requires more effort: the translation is more complex, and a fancier notion of bisimulation is required which only compares suitably restricted behaviour. Since the aim of this section is to compare the proofs of some result in the evaluation and transition style semantics, and the result we are going to prove is that sequential composition can be coded in P, we might as well save work and add restriction to P(;) and P. We do not include relabelling because first we do not need it (for P(;) simple subsititution sufficies) and because second it is harder to capture in an evaluation semantics (see section 7.3.3).

The structure of this section is as follows. First, we define the translation. Then, in section 3.4.2 we use transition semantics of P(;) plus restriction to define the notion of correctness, and then to prove the translation correct with respect Chapter 3. Evaluation Semantics and Sequential Deductions 58

to it. Section 3.4.4 uses evaluation semantics to define the notion of correctness and proves the translation correct with respect to it. It is clear that the evaluation semantics proof involves less work.

The notion of correctness is that the translated process is (almost) weakly trace equivalent to the original one. By almost, I mean that every trace of the translated process will have an extra terminal action. We do not use bisimulation equivalence because it is hard to define in the evaluation semantics. (See [VG90] for a survey of different process calculus equivalences.) We should not expect to define an equivalence finer than a trace equivalence when our semantics considers only complete evaluations. Nevertheless, bisimulation and trace equivalence coincide for deterministic languages. [Ber89] argues that in practice many (if not most) programs are deterministic, so perhaps this is not such a great problem for practical programming languages.

3.4.1 The translation

Let me define the function Λ(p) : P(;) → Lab inductively over the terms of p:

Λ(p) = \{ \begin{matrix}∅ & if p = 0 \\ \{l\} ∪ Λ(q) & if p = l.q \\ Λ(q) ∪ Λ(q′) & if p = q|q′ or p = q; q′ \end{matrix}

Let done and \overline{done} be new actions to P(;). Then I define the translation using the following inductively defined function

c(0) = \overline{done}.0 c(l.p) = l.c(p)
p′ = c(p)[d_{1}/done] q′ = c(q)[d_{2}/done] d_{1}, d_{2}, \overline{d_{1}}, \overline{d_{2}} ∉ Λ(c(p)|c(q))
c(p|q) = (p′|q′|d_{1}.d_{2}.\overline{done}.0) \ \{d_{1}, d_{2}\}

\begin{matrix}p′ = c(p)[b/done] & q′ = c(q) & b, b̄ ∉ Λ(c(p); c(q)) \\ c(p; q) = (p′|b.q′) \ \{b\} \end{matrix}

where p\L is the restriction combinator. Informally, it means that p may perform no action in the set of actions L. Therefore, if p can perform such an action, the process can only proceed if this action can be absorbed internally.

The idea here is that every process p is translated into a process p′ which “behaves the same as” p, except that it includes a special final action, \overline{done}. Let Done be the process \overline{done}.0.

3.4.2 The transition semantics proof of correctness

Restriction The standard transition semantic rule for restriction is

\begin{matrix}p →^{α} p′ & α ∉ L ∪ L̄ \\ p \ L →^{α} p′ \ L \end{matrix}

These should be added to the rest of the rules on page 40 to obtain the semantics for P(;) plus restriction.

Chapter 3. Evaluation Semantics and Sequential Deductions 59

The equivalence I say p is weakly trace-equivalent to q (written p ≃ q) if for all p′ and traces t such that p →^{t} p′ there exists a q′ such that q →^{t} q′ and vice-versa. Extending notation from page 35, p →^{t} Ω means that there exists a sequence of

transitions p_{i}(→^{τ})^{∗} →^{t(i)} (→^{τ})^{∗}p_{i+1}, for some p_{1}, …, p_{|t|+1} ∈ P(;) and p_{|t|+1} ∈ Ω. The

following are useful properties of trace equivalence:

Proposition 3.9

(i) if p ≃ q then α.p ≃ α.q
(ii) if p_{1} ≃ p_{2} and q_{1} ≃ q_{2} then p_{1}|q_{1} ≃ p_{2}|q_{2}
(iii) l.(p; q) ≃ (l.p); q
(iv) (p_{1}; p_{2}); p_{3} ≃ p_{1}; (p_{2}; p_{3})

Proof: (i): Let α.p →^{t} p′. Then t = α · t′ and so q →^{t′} q′ (as p ≃ q), which means that α.q →^{t} q′. The reverse direction is symmetric. (ii): Let p_{1}|p_{2} →^{t} p′_{1}|p′_{2}. Then there must exist traces t_{1} and t_{2} such that p_{1} →^{t_{1}} p′_{1} and q_{1} →^{t_{2}} q′_{1} which when combined (according to the above deduction sequence of p_{1}|p_{2}) form t. Therefore there exist p′_{2} and q′_{2} such that p_{2} →^{t_{1}} p′_{2} and q_{2} →^{t_{2}} q′_{2}. Then we can zip up t_{1} and t_{2} in the same way as we had before to get p_{2}|q_{2} →^{t} p′_{2}|q′_{2}. A fully formal proof would require induction on the length of the deduction sequence of p_{1}|p_{2}. Again the reverse direction is symmetric. (iii) and (iv): even simpler. □

Well-terminating processes We appropriate from [Mil89] the concept of welltermination. A process p is well-terminating if for every p′ and t, p →^{t} p′ implies that t(i) = done for no i ∈ dom t and t(|t|) = \overline{done} implies that p′ ≃ 0.

Proposition 3.10 For every p ∈P(;), c(p) is well-terminating.

Proof: By induction on the structure of p. Case 0: c(0) = \overline{done}.0 is obviously well-terminating. Case l.q: by induction c(q) is well-terminating. Since l ≠ done (because we added done to the set of actions specifically for the translation) the result is obviously true. Case p|q: by induction, c(p) and c(q) are wellterminating. Suppose c(p|q) is not. Then there must exist a trace t and process r such that c(p|q) →^{t} r and either for some i ∈ dom t, t(i) = done or t(|t|) = \overline{done} but p′|q′ ≄ 0. The first case is impossible since p and q are well-terminating. To show that the second case is impossible, let t = t′ · \overline{done}. We show by induction on the length of t that r ≃ 0. Subcase n = 1: then c(p)[d_{1}/done] →^{\overline{d_{1}}} Ω and

c(q)[d_{2}/done] →^{\overline{d_{2}}} Ω. But then r = Ω|Ω|0 ≃ 0. Subcase n = k + 1: then let c(p|q) →^{l} r′ →^{t} r. Suppose (l · t)(|l · t|) = \overline{done}. Then t(|t|) = \overline{done}. Now what form has r′? Since l ≠ \overline{done}, one of p or q must make an l-labelled transition to p′ or q′. Therefore one of c(p) or c(q) must make a transition to a process trace equivalent to c(p′) or c(q′). Therefore r′ must be trace equivalent to either c(p′|q) or to c(p|q′). Given this fact, and the fact that t has length k, induction tells us that r ≃ 0. Case p; q: by induction c(p) and c(q) are well-terminating. Now let c(p; q) →^{t} r. Then either c(p)[b/done] →^{t} p′ in which case t has the required properties by induction. Alternatively, c(p)[b/done] →^{t_{1}·b̄} Ω and b.c(q) →^{b·t_{2}} r, where t = t_{1} · t_{2}. Certainly for no i ∈ dom t is t(i) = done (this follows by induction). Also, if t(|t|) = \overline{done} then t_{2}(|t_{2}|) = \overline{done}, which means that r ≃ 0 by induction.

□

Proposition 3.11 For all p ∈P(;), p; Done ≃ c(p).

Proof: By induction on the structure of p. Case 0: trivial. Case l.p: trivial. Case p|q: By induction, p; Done ≃ c(p) and q; Done ≃ c(q). By proposition 3.9(ii) we get p; Done | q; Done ≃ c(p)|c(q). Now Let t be a trace of (p|q); Done. Then either it is a trace of p|q or its final action is \overline{done}. In the first case, it is also a trace of p; Done | q; Done and therefore also of c(p)|c(q) and therefore also of c(p)[d_{1}/done] | c(q)[d_{2}/done] since both c(p) and c(q) are well-terminating and t contains no \overline{done} action. Hence t is also a trace of c(p|q).

Suppose however, t(|t|) = \overline{done}. Let t = t′ ·\overline{done}. Then t′ is a trace of p|q. We can project the transition sequence creating trace t′ into transition sequences of p and q, with traces t_{1} and t_{2}. Moreover, p →^{t_{1}} Ω and q →^{t_{2}} Ω. Therefore t_{1} · \overline{done} is a trace of c(p) and t_{2} · \overline{done} is a trace of c(q). Therefore, t_{1} · \overline{d_{1}} is a trace of c(p)[d_{1}/done] and t_{2} · \overline{d_{2}} is a trace of c(q)[d_{2}/done]. Therefore, by reconnecting the transition sequences, we get t′ · \overline{done} is a trace of c(p|q) by induction on the length of the transition sequence generating t′.

The reverse direction is symmetric.

Case p; q: Suppose t is a trace of (p; q); Done. Then it is also a trace of p; (q; Done). Either t is a trace of p or t = t′ · t′′ where t′ is a trace of p such that p →^{t} Ω and t′′ is a trace of q; Done. In the first case, t is also a trace of c(p) and since it does not contain \overline{done} and c(p) is well-terminating, it is also a trace of c(p)[b/done] when b ∉ Λ(c(p)), and therefore also a trace of c(p; q). In the second case, t′ · b̄ is a trace of c(p)[b/done] and b · t′′ is a trace of b. · (q). Since c(p) is well-terminating, then t′ · t′′ is also a trace of c(p; q).

In the reverse direction, let t be a trace of c(p; q). Then we can split it into traces t′ of c(p)[b/done] and t′′ of b.c(q). Since c(p) is well-terminating, b̄ can only be the last action of t′. If b̄ is not the last action of t′ then t′′ must be empty. Therefore t′ is a trace of c(p) not containing \overline{done}, and therefore also of p, and therefore also of p; (q; Done). If b̄ is the last action of t′, then b must be the first action of t′′ (given that b is restricted in c(p; q)). Therefore t′′ is also a trace of b.q; Done. Let t_{1} be such that t′ = t_{1} · b̄, and t_{2} be such that t′′ = b · t_{2}. Then p →^{t_{1}} Ω, and so t_{1} · t_{2} = t must be a trace of p; q. □

3.4.3 Tree Pruning and partial deductions

One of the problems in using evaluation semantics to give meaning to processes is that they do not specify aberrant behaviours well. This means that we cannot say anything about the partial behaviour of a program before it deadlocks (for example). This is important. Consider the process ⋔= (l.p) \ {l}. It is trivially deadlocking, and so obviously ⋔ √ should be undeducible. However, consider the Chapter 3. Evaluation Semantics and Sequential Deductions 61

process a. ⋔. We cannot say anything about this process either, even though it performs action a first.

Because of this, we cannot use evaluation semantics to define a trace equivalence. Of course, trace equivalence belongs to the transition semantics view of processes, but it seems we cannot define anything similar for evaluation semantics. And if we cannot say anything about abberant behaviours, we cannot check that two processes “behave the same”.

One solution to this problem is to use a pruning rule. This rule is of form X where X can be instantiated to any judgment. (Of course, this assumes that our language of judgments permits this kind of instantiation.) I call this the deduction of no information (written ⊥) because it allows us to deduce things from thin air. Using it, we get the following partial deduction of a.⋔:

⊥ ⋔ ; a.⋔

which has one visible occurrence (a. ⋔), and one instance of the deduction of no information ⊥ ⊢ ⋔.

Strict pruning As chapter 6 shows, a deduction can be seen as an evaluation of a process. What does ⊥ mean in this light? It means that the evaluation has been interrupted. In the above example, evaluation would halt when the deadlocking process ⋔ was encountered. However, if a process halts, no process sequenced after it can proceed. I.e., whenever some occurrence has been pruned, every occurrence sequenced after it must likewise be pruned. I call this strict pruning. Let me write P (Π) for the set of occurrences of Π which are conclusions of instances of the pruning rule.

Given a QI-structure it is easy to determine the pruned occurrences: simply look at the leaves of the trees, and check if they can be deduced by axioms. If they cannot, then they are pruned. However, this leaves us with a problem. We want to say that everything sequenced after a pruned ocurrence is also pruned; but it could easily be that such an occurrence is actually an axiom instance, and therefore not pruned. It will, however, be a leaf. Formally then, the strict pruning condition can be stated

for all A, B ∈ O(F, I, ⊏), if A ∈ P (F, I, ⊏) and A( ˆ⊏)^{∗}B then B is a leaf

Note that these definitions do not concern the semantics of P(;) — they can be equally well be applied to any semantics. Therefore the notion of trace equivalence which we shall define is applicable to any (concurrent) language specified in this way, and the method which we use to prove the equivalence can be adopted for these languages.

When T is a system of interacting rules, I write QI_{⊥}(T ) for the set of partial, strictly pruned deductions of T .

3.4.4 The evaluation semantics proof of correctness

To ease readability in this section, I shall abbreviate judgments of form p√ to p. Let P_{QF}^{(;)} be the system obtained after including the rule to P_{QI}^{(;)}:

{p \atop l.p}

(cf. the I-system P_{F} on page 35.) I say a visible occurrence of a deduction is an occurence of l.p which does not interact with any other occurrence, and which is not pruned. I write V (Π) for the set of visible occurrences of Π.

Restriction To capture restriction in our evaluation semantics, we introduce the following scoping side-condition. Let Π be a QI-deduction, let X be a subset of the set of conclusions of Π and let L ⊂ Lab. Then X scopes L in Π if for all A, B ∈ O(Π) and l ∈ L,

(i) if l.p ∼_{Π} l̄.q and l.p ≳_{Π} X then l̄.q ≳_{Π} X
(ii) for all l.p ∈ V (Π), if l.p ≳ X then l ∉ L ∪ L̄

where A ≳_{Π} X means that A ≳_{Π} B for some B ∈ X. Thus if X scopes L in Π, then either both ends of an L-labelled interaction must occur above X or both ends must not. We write the side-condition graphically

{P^{1} ⋯ P^{n} _{L} P \atop C} e.g., restriction: \begin{matrix}p & L \\ p \ L \end{matrix}

to mean that {P_{1}, …, P_{n}} scopes L in whatever deduction the rule atom is applied to. In a deduction, we draw a box around the scoped trees. Throughout the rest of this section, I shall write the name of the system P_{QF}^{(;)} extended to include restriction P.

The equivalence First I define an equivalence between deductions. I write Π ≃ Σ if there exists a function f : V (Π) ↔ V (Σ) such that for all l.p ∈ V (Π), f(l.p) = l.q for some q, and for all A, B ∈ V (Π)

A ≲_{Π} B iff f(A) ≲_{Σ} f(B)

It says that if l.p is ordered before (or simultaneously with) l′.q in Π, then we get an occurrence l.p′ occurring before (or simultaneously with) an l′.q′ in Σ. The following two propositions are straightforward (but tedious) to prove:

Proposition 3.12 Let Π, Π_{1}, Π_{2}, Σ, Σ_{1}, Σ_{2} ∈ QI(P) have single conclusions. Then

if Π ≃ Σ then  \begin{matrix}Π \\ p \end{matrix} ; l.p  ≃  \begin{matrix}Σ \\ q \end{matrix} ; l.q

if Π_{i} ≃ Σ_{i} for i = 1, 2 then  \begin{matrix}\begin{matrix}Π_{1} \\ p \end{matrix} & \begin{matrix}Π_{2} \\ q \end{matrix} \\ p|q \end{matrix}  ≃  \begin{matrix}\begin{matrix}Σ_{1} \\ p′ \end{matrix} & \begin{matrix}Σ_{2} \\ q′ \end{matrix} \\ p′|q′ \end{matrix}

□ Chapter 3. Evaluation Semantics and Sequential Deductions 63

Now we can define the equivalence between processes. We write p ≃ q if for all Π such that Π ⊢ p, there exists a Σ ⊢ q such that Π ≃ Σ and vice-versa. This can be seen as a trace equivalence.

Well-terminating processes Once again, we must define the notion of wellterminating process. p is well-terminating if for every deduction Π ⊢ p, (1) for no q is done.q ∈ V (Π), and (2) if \overline{done}.q ∈ V (Π) then q ≃ 0 and for all A ∈ V (Π), A ≲_{Π} \overline{done}.q.

Proposition 3.13 For every p ∈P(;), c(p) is well-terminating.

Proof: by induction on the structure of p. Case 0: The only complete deduction is:

{0 \atop Done}

which has only one visible occurrence, \overline{done}.0. This is obviously well-terminating. Case l.p: Let Π ⊢ c(l.p) be such that

Π = \begin{matrix}Π′ \\ c(p) \end{matrix} ; l.c(p)

by induction, c(p) is well-terminating, so for no q is done.q ∈ V (Π) and l.p ≲_{Π} \overline{done}.q if \overline{done}.q ∈ V (Π) because then it must be a member of V (Π′), from which we also get q ≃ 0. Case p|q: Let Π ⊢ c(p|q) consist of the three subdeductions Π_{1} ⊢ c(p)[d_{1}/done], Π_{2} ⊢ c(q)[d_{2}/done] and Π_{3} ⊢ d_{1}.d_{2}.\overline{done}.0. Now by induction, c(p) and c(q) are well-terminating, so the two parts of well-terminatedness are satisifed by Π_{1}[done/d_{1}] ⊢ c(p) and Π_{2}[done/d_{2}] ⊢ c(q). They are obviously true of Π_{3}. Therefore, since in Π, d_{1} and d_{2} are restricted, they must be connected to their partners in Π_{3} by an interaction link. But this means that every visible occurrence in Π_{1} and Π_{2} precedes the only occurrence of \overline{done}.0, in Π_{3}. Case p; q: Let Π ⊢ c(p; q) consist of the two deductions Π_{1} ⊢ c(p)[b/done] and Π_{2} ⊢ b.c(q). By induction, c(p) and c(q) are well-terminating, so therefore Π_{1}[done/b] must satisfy the two properties of well-terminatedness, and so must Π_{2}. Therefore b̄.q is preceded by every visible occurrence in Π_{1} and q ≃ 0. Since b is restricted, the occurrence of b̄ · 0 must be linked to b.c(q) in Π, so therefore, the occurrence of \overline{done}.0 in Π_{2} must be preceded by every other visible occurrence in Π. □

In the following proof, when Π_{1}, Π_{2} are single-conclusioned, let me write Π_{1} ▶ Π_{2} for

\begin{aligned}\begin{matrix}Π_{1} \\ p \end{matrix} & ▶ & \begin{matrix}Π_{2} \\ q \end{matrix} \\ & p; q \end{aligned}

This proof also depends on a result proved in section 4.2.1.

Chapter 3. Evaluation Semantics and Sequential Deductions 64

Corollary VIIa Let Σ_{1} and Σ_{2} be QI-structures whose formulae are those of P such that Σ_{1} ≃ Σ_{2}. If Σ_{1} is the result of breaking interaction links in Σ′_{1} then there exists a Σ′_{2} such that Σ′_{1} ≃ Σ′_{2} and Σ_{2} is the result of breaking interaction links of Σ′_{2}.

Proposition 3.14 For all p ∈P(;), p; Done ≃ c(p).

Proof: By induction on the structure of p. Case 0: trivial. Case l.p: trivial.

Case p_{1}|p_{2}: let Π ⊢ (p_{1}|p_{2}); Done. Then breaking the interaction links between them, we obtain three smaller deductions: Π_{1} ⊢ p_{1}, Π_{2} ⊢ p_{2} and Π_{3} ⊢ Done. Now by induction, p_{1}; Done ≃ c(p_{1}) and p_{2}; Done ≃ c(p_{2}). Therefore, we obtain partial deductions Σ_{1} ⊢ c(p_{1}) and Σ_{2} ⊢ c(p_{2}) such that Π_{1} ▶ Π_{3} ≃ Σ_{1} and Π_{2} ▶ Π_{3} ≃ Σ_{2}. Now, there are two cases, depending on whether or not Π_{3} deduces Done by the pruning rule or not. If so, then neither Σ_{1} nor Σ_{2} will have a \overline{done}-labelled visible occurrence. Therefore, when Σ_{3} = ⊥, we obtain Σ′ equal to

\begin{matrix}Σ_{1}[d_{1}/done] \\ c(p)′ \end{matrix}  \begin{matrix}Σ_{2}[d_{2}/done] \\ c(q)′ \end{matrix}
c(p)′ | c(q)′

\begin{matrix}Σ_{3} \\ d_{1}.d_{2}.Done \end{matrix}

c(p)′ | c(q)′ | d_{1}.d_{2}.Done {d_{1},d_{2}}

c(p|q)

where c(p)′ is an abbreviation of c(p)[d_{1}/done] and c(q)′ is an abbreviation of c(q)[d_{2}/done]. By proposition 3.12, Σ′ ≃ Π′ where Π′ is the parallel composition of Π_{1} and Π_{2}. By corollary VIIa we can reflect the pattern of interaction links between Π_{1} and Π_{2} in Π to between their corresponding occurrences in Σ_{1} and Σ_{2} in Σ′, to yield Σ such that Σ ≃ Π.

The second case, when Π_{3} ≠ ⊥ implies that P (Π_{1}) = P (Π_{2}) = ∅ by strict pruning. Therefore, Σ_{1} and Σ_{2} must be deductions of c(p) and c(q). And therefore, when Σ_{3} is the deduction

{0 \atop \overline{done}.0} ; d_{2}.\overline{done}.0

d_{1}.d_{2}.\overline{done}.0

We construct Σ as above, except that before we reflect the pattern of interactions between Π_{1} and Π_{2} between Σ_{1} and Σ_{2}, we also add interaction links between \overline{d_{1}}.0 of Σ_{1} and d_{1}.d_{2}.Done of Σ_{3} and also between \overline{d_{2}}.0 of Σ_{2} and d_{2}.Done of Σ_{3}. Once again, Σ ≃ Π.

The reverse direction is symmetrical.

Case p_{1}; p_{2}: Let Π ⊢ (p_{1}; p_{2}); Done. Then Π sequences Π_{3} ⊢ Done after Π_{2} ⊢ p_{2} which in turn is sequenced after Π_{1} ⊢ p_{1}. There are two cases. In the first case, Π_{2} = Π_{3} = ⊥. By induction, p_{1}; Done ≃ c(p_{1}). Therefore we obtain a Σ_{1} ⊢ c(p_{1}) such that Π_{1} ▶ ⊥ ≃ Σ_{1}. This means that Π_{1} ≃ Σ_{1}. This means that \overline{done}.0 is not a visible occurrence of Σ_{1}. Therefore, we can build Σ equal to

\begin{matrix}Σ_{1} \\ c(p)[b/done] \end{matrix} \begin{matrix}⊥ \\ b.c(q) \end{matrix}

c(p)[b/done] | b.c(q) {b}

c(p; q)

and it is easy to see that Π ≃ Σ, because the only visible occurrences of Π occur in Π_{1}, and the only visible occurrences of Σ occur in Σ_{1}. The second case is when Π_{2} ≠ ⊥. This must mean that Π_{1} contains no pruned occurrences, because otherwise Π_{2} = ⊥. Then by induction, we get Σ_{1} ≃ (Π_{1} ▶ Δ) (where Δ is a complete deduction of Done) and Σ_{2} ≃ (Π_{2} ▶ Π_{3}). Then we construct Σ

\begin{matrix}Σ_{1} \\ c(p)[b/done] \end{matrix} \begin{matrix}Σ_{2} \\ c(q) \end{matrix} ; b.c(q)

c(p)[b/done] | b.c(q) {b}

c(p; q)

where we have placed an interaction link between the occurrence of \overline{b}.0 in Σ_{1}[b/done] and b.c(q) in Σ_{2}. It is not hard to see that Σ ≃ Π. □

3.4.5 Appraisal (equivalence, nondeterminism, nontermination)

Perhaps the most obvious lesson is that evaluation semantics are restrictive in the kinds of equivalences they can define. We have seen a trace equivalence which is fairly natural. However, it is well known that trace equivalence can equate possibly deadlocking processes with non-deadlocking processes. Failures equivalence [Hoa85], or equivalently testing equivalence [dNH84], appears to be the weakest equivalence which does not confuse deadlocking and deadlock-free processes. Can we give an evaluation semantics characterization of it?

A failure is a pair (t, X) where t is a trace and X is a set of actions none of which a process having this failure will be able to respond to after t. The problem is that this requires the notion of intermediate state, something which evaluation semantics do not express naturally^{1}. So whereas we probably could characterize failures equivalence, it would not be very natural (nevertheless we shall shortly see another, more natural way to characterize deadlock in evaluation semantics).

Another difficulty is that in order to capture partial traces, we had to introduce extra machinery to prune deductions strictly. Neither of these ideas are hard, but Chapter 3. Evaluation Semantics and Sequential Deductions 66

1Note added in Proof: for an alternative approach, see [PR96]

their use seems to subtract from the conceptual simplicity of evaluation semantics. But then again, we do not use transition semantics ‘neat’ either — we have to define what weak traces are using the notions of deduction sequences and silent action, neither of which are required in the evaluation semantics.

Nonetheless, in terms of the actual proof, once the problem of partiality has been overcome, and the idea of “deduction as trace” has been accepted, we do notice a reduction in complexity. The proofs of propositions 3.10 and 3.11 require nested inductions on the length of transition sequences which are missing in the corresponding evaluation semantics proofs (of propositions 3.13 and 3.14 respectively).

The problem of Angelic nondeterminism

Actually, strict pruning is more than a technique to capture a notion of trace in evaluation semantics. By providing a uniform treatment of “interrupted” evaluations, the pruning rule has potential to describe deviant behaviour naturally, such as escape features. In section 5.1.4, we use it to describe a propagation-free characterization of self-abortion.

It also solves the problem of angelic nondeterminism. Consider the instantly deadlocking process ⋔. We saw that without pruning, we could not deduce a.⋔ √ (quite rightly, since a.⋔ does not terminate successfully), but more, we could not say anything about its behaviour. Thus when we have a nondeterministic choice operator +, an evaluation semantics can only give meaning to and reason about the successful choices. An example of this problem occurs in the completeness proofs for total correctness Hoare Logics (e.g., see [NN92, p.197]).

Nontermination

In fact, the pruning rule is based on the pruning judgments of [Mit94] (of form p ⇒ ⊥ for some program p) where he uses them to handle nontermination. However, the judgment form p ⇒ ⊥ does not distinguish nonterminating, divergent and deadlocked behaviours. It simply means “p may (or may not) exhibit unsuccessful behaviour”. The same is true in my system: the judgment p√ says nothing about whether or not p terminates successfully.

However, we do much better when we look at the Heyting semantics of a judgment. Let me write T (A) for the set of T -deductions of A. Then we obtain a very natural partial order ⊑ over P_{⊥}(p√):

Π_{1} ⊑ Π_{2} iff ≲_{Π_{1}}⊆≲_{Π_{2}}

For example, we obtain the following chain of deductions in P_{⊥}(a.p|ā.q√):

\begin{matrix}⊥ \\ a.p|ā.q√ \end{matrix} ⊑ \begin{matrix}\begin{matrix}⊥ \\ a.p√ \end{matrix} & \begin{matrix}⊥ \\ ā.q√ \end{matrix} \\ a.p|ā.q√ \end{matrix} ⊑ \begin{matrix}\begin{matrix}⊥ \\ p√ \end{matrix} ; a.p√ & \begin{matrix}⊥ \\ q√ \end{matrix} ; ā.q√ \\ a.p|ā.q√ \end{matrix} ⊑ {\begin{matrix}⊥ \\ p√ \end{matrix} ; a.p√ − \begin{matrix}⊥ \\ q√ \end{matrix} ; ā.q√ \atop a.p|ā.q√} ⊑ ⋯

Chapter 3. Evaluation Semantics and Sequential Deductions 67

This looks similar to the bottom-up method of constructing deductions, related to the tableaux method [Sun84b,Und95,MP93]. In fact, given the strict pruning condition, it also corresponds to an evaluation order for processes.

Now, if X is a chain of elements of P_{⊥}(p√) then we say it has a limit if there exists a deduction Π ∈ P_{⊥}(p√) such that ≲_{Π}= ⋃_{Σ∈X} ≲_{Σ}. Let me write lim X for the set of limits of chains in X. Then we can distinguish different behaviours of p:

p may terminate if P(p√) ≠ ∅

p may deadlock if lim P_{⊥}(p√) ≠ P(p√)

p might not terminate if there exists a limitless chain in P_{⊥}(p√)

Note that the presence of limitless chains means that ⊑ is not a complete partial order. To obtain a complete partial order, one needs to introduce a notion of infinite (or non well-founded) deduction.

Coinductive definitions

The interpretion of p√ as “p terminates successfully” is due to the inductive definition of QI-deduction. If it were coinductively defined [MT92,Sch95,Tof87] (i.e., we take the greatest fixed point interpretation of the inference rules [Acz77]) then nonterminating evaluations could be represented by non-well founded QIdeductions, or codeductions. Non-well founded codeductions are not finite and therefore cannot be QI-structures, but it is not hard to define a notion of structure which may contain infinitely deep trees. The codeductive interpretation of p√ is “p does not deadlock”.

However, when I tried this (for an extension of P(;) which introduced nontermination), I discovered problems with sequencing, related to the problems [Sch95] notes when using infinitely deep trees to give an evaluation semantics for a simple applicative language. There, a judgment has form ρ ⊢ e ⇓ v intended to mean “in environment ρ, e evaluates to v”. But if e does not terminate, one can codeduce ρ ⊢ e ⇓ v for any v. Therefore what the judgment actually means is “in environment ρ, it is not the case that e doesn’t evaluate to v”. This is not useful. So in both his and my situations, there are too many codeductions.

[Sch95] solves the problem by constraining the set of acceptable deductions. The basic idea is that if one can codeduce ρ ⊢ e ⇓ v for any v, then the only acceptable codeduction for e concludes ρ ⊢ e ⇓ ⊥ where ⊥ is the least-defined value familiar from denotational semantics. I managed to transfer this idea to my setting, but it was not particularly simple. I tried to use this theory of codeductions to prove the correctness of a coding for sequential composition in the nonterminating case. I gave up because the proof techniques became sophisticated, and idea of the proof became obscured by detail. I concluded that a transition semantics (whether ordinary or interacting) would be much better. Perhaps codeduction could be used usefully in [Sch95]’s setting of abstract interpretation.

Representativity

The translation correctness example has indicated that the statement and proof of the correctness of the compilation of P(;) into P is structurally simpler using an evaluation semantics than a transition semantics. The question is how representative the example is: the translation is very simple.

However, my example is representative in that no matter how complex the compiler is, each direction of the correctness proof will always entail a simulation proof. Also, the example used every feature of QI-rules. More complex languages like CSP can also be expressed using QI-systems. Therefore, I should expect that even though the individual rules may be more complex, the kinds of reasoning involved in a correctness proof will remain the same. Last, I believe that the example is representative in that evaluation semantics are less detailed than transition semantics, and the correctness result does not require the extra detail.

3.5 Chapter Summary

We saw that the basic theory of interacting deductions was powerful enough to capture sequential composition, and in at least two language independent ways. Hence the theory is powerful enough to give evaluation semantics to a wide variety of programming languages. Moreover, it managed to give a simple treatment of control-stack semantics.

However, though both methods were general, they were not perspicuous. Therefore we added a notion of sequencing to the metatheory, purely to make representation easier. It does not affect the range of languages we can give semantics to. The presentation of P(;) was much simpler in the evaluation semantics than in the SOS. However, the issue was not so clear regarding the translation correctness proof. The structure of the evaluation semantics proof was simpler than that of the transition semantics proof, but it required extra machinery to deliver the partial deductions. Moreover, all that gave us was a trace equivalence: it was hard to see how to define other equivalences.

On the other hand, the pruning technique is not ad-hoc: it provides us with a general way of talking about aberrant behaviours of programs: deadlock, nontermination and escaping.

The content of interaction

So far deductions have recorded interactions using pairs of occurrences. This approach merely records that an interaction occurred. It does not record what the interaction was about. In this chapter we shall consider a notion of deduction that includes this extra information.

The result, DQI-deduction, is more elegant than both I- and QI-deduction. Moreover, it supports not only proof fragmentation, but also a dual technique called proof assembly, illustrated with a type-checking example and another nondivergence proof (section 4.3). In short it improves the modular treatment of systems (in particular semantic definitions) and proofs about them.

However, the primary purpose of DQI-deduction is to provide a finer (and more accessible) account of QI-deduction. The need is clear. First, the definition of QI-deduction is not particularly elegant. Second, we have been forced to define concepts in the semantics which are more properly concepts of the structure of deductions. For example, the visibility of occurrences (defined in section 3.4.4) depends solely on whether or not the occurrence would interact in a deduction. For another example, the proof of proposition 3.14 (just like the proof of lemma 2.13(i)) uses the technique of breaking and then reassembling interaction links between the children of an inference tree: something which could be done generally. The problem with definition 3.0 is that it does not support this kind of reasoning easily.

To achieve this finer account in a general way implies that we should enrich the structure of deduction again to include the notion of what it is for an interaction link to be broken.

Observations about the environment

What does it mean for an interaction to be broken? In our leading illustration, the community of mathematicians, “breaking” would suggest that communication is cut off (e.g., between the Russians and the Americans). This is a good analysis of what happens during fragmentation. However, the idea is too strong for the proof technique of breaking and reassembling interaction links. There we break links in order to restrict our field of view (say to the Russians). Reassembly means that once we have studied the Russians we are then interested in how they interact Chapter 4. The content of interaction 70

with the Americans. Thus breaking an interaction link only means that we are not currently interested in both halves of the interaction.

For example, the KGB might be interested in the activities of Russian mathematicians, but not their American colleagues. They would tape all of the international conversations, but would not care about American work. Similarly, the CIA might be interested in American mathematicians, but not Russian ones. Only the UN might be interested in both: having taped every conversation between the two countries from both ends, it is in the unique position of being able to reconstruct the entire history of interaction between the two countries, simply by matching up the taped conversations.

So a broken, or better, dangling interaction link is just the perception of an interaction from one side. The content of the interaction, the conversation or flow of ideas, is shared by both parties, although they will perceive it in opposite ways: Russians hear what Americans say, and vice-versa.

Therefore, a dangling interaction is formally a pair (A, α) where A is a formula occurrence and α is a perception of a formula: a pair (A, s) where A is a formula denoting the content of an interaction (for technical simplicity later on, I shall assume that it takes the form P (t_{1}, …, t_{n}) for some n-ary predicate letter P) and s ∈ {+, −} is the polarity of the perception. I write +A for (A, +) and −A for (A, −). It does not matter what + and − “mean”; it is enough that they denote opposite perceptions. I shall write \overline{+A} = −A and \overline{−A} = +A. Last, if X is a set of formulae, I write X^{±} for the set of perceptions of formulae.

Hypotheses about the environment

Thus we can view α as an observation about the environment in which the relevant mathematician works. However, we can also view it as a hypothesis: the perception α is a hypothesis of A. The crucial point here is that a Russian will perceive α only if an American simultaneously percieves ᾱ — i.e., when an interaction occurs between them. An interaction link is formed when two dangling interactions (A, α) and (B, ᾱ) are assembled. (The slogan is assembly is discharge: section 4.3). Just as in Natural Deduction, a formula is properly deduced only when there exist no undischarged hypotheses — i.e., no dangling interactions. Therefore, the process of deduction must consist of rule application (inference) and assembly (hypothesis discharge).

Rules and the principle of meaningful communication

Since we are incorporating assembly into the definition of deduction, the simplest definition of L-labelled DQI-rule is the pair (a, D), where a is a Q-atom, and D is a finite set of perceptions of L-formulae. Finiteness ensures that deductions are finite objects. Conceptually, it corresponds to the fact that mathematicians can only share a finite number of ideas at any point in time: if they can only share what they have deduced, and at each point in time they can have deduced only a finite amount of information, they cannot talk about an infinite number of facts.

Chapter 4. The content of interaction 71

Since an interaction is an exchange of ideas, the objects of discourse must be familiar to both parties. In a rule schema, the objects of discourse are represented by the free variables of the perceived interaction (or interaction hypothesis). Therefore, since objects of discourse must be familiar to both parties, every free variable in a perception must either appear in the rule atom (i.e., be used in the inference) or in another perception (in which case the rule is relaying this information). I call this the principle of meaningful communication. Formally, it is expressed:

for all α ∈ D, F V (α) ⊆ F V (a) ∪ ⋃{F V (β) | β ∈ D, β ≠ α}

Semantic rules will tend to observe this principle naturally.

I write DQI-rules graphically as

\begin{aligned}P_{1} & … & P_{n} \\ & C \end{aligned} D

It will often be convenient to write sets of rules as if they were connected via some pattern of interaction links. Thus I should write

{P rem_{1} \atop C_{1}} −^{A} {P rem_{2} \atop C_{2}}  for  {P rem_{1} \atop C_{1}} +A and {P rem_{2} \atop C_{2}} −A

for example. As a further convention, given that A = P (x_{1}, …, x_{n}) in a rule schema, I shall often abbreviate A above a pseudo-interaction link to P. The idea in this case is that the variables are just those used or relayed by both parties on either side of the link.

DQI-systems A DQI-system is a pair (L, R), where L is a language and R is a set of L-labelled DQI-rules which mention only formulae in L.

To illustrate the following definitions, we give a DQI-system P_{DQI}^{(;)} = (L_{DQI}^{(;)}, R_{DQI}^{(;)}) where L_{DQI}^{(;)} = L_{QI}^{(;)} ∪{comm(a) | a ∈ Nam}, and R_{DQI}^{(;)} is the set of rules generated by:

0√  {p√ \atop a.p√} −^{comm(a)} {p√ \atop ā.p√}  \begin{matrix}p√ & q√ \\ p|q√ \end{matrix}  \begin{aligned}p√ & ▶ & q√ \\ & p; q√ \end{aligned}

where given our convention, the communication rule is really the two rules

{p√ \atop a.p√} +comm(a)  {p√ \atop ā.p√} −comm(a)

4.1 DQI-deduction

4.1.1 Structures, Histories and Binary Assemblies

Labelled binary relations Let X be a set and L a set of labels. Then a labelled binary relation R is a subset of X × L × X. I say R is symmetric if (A, α, B) ∈ Y implies (B, ᾱ, A) ∈ Y. The symmetric closure of R, written R^{∘} is the set R ∪ {(B, ᾱ, A) | (A, α, B) ∈ R}. I write R^{♭} = {(A, B) | ∃α.(A, α, B) ∈ R} for the flattening of R to a binary relation.

For example, when we come to assemble two opposite dangling interactions in a DQI-structure, the interaction link will be represented by a pair of triples (a.p√, +comm(a), ā.q√) and (ā.q√, −comm(a), a.p√).

DQI-structures

An L-labelled DQI-structure is a quadruple (F, I, ⊏, D) where F is a formula forest, I ⊆ O(F) × L × O(F) is symmetric, ⊏⊆ O(F) × O(F) and D ⊆ O(F) × L is finite. I shall use Σ to range over structures. If Σ = (F, I, ⊏, D), I write D(Σ) for D, the set of its dangling interactions. Two structures are disjoint if they share no common occurrences. The union of two disjoint structures is just the pointwise union of the data in the quadruples.

For example, the following is a graphical representation of a DQI-deduction built out of the previous ruleset:

[figure: \begin{matrix}{0√^{1} \atop a.0√} & \begin{matrix}{0√^{2} \atop ā.0√} & ▶ & {0√^{3} \atop b.0√} +comm(b) \\ ā.0; b.0√ \end{matrix} \\ a.0|(ā.0; b.0)√ \end{matrix}]

Where F is the singleton set containing the tree of occurrences, ⊏= {(ā.0√, b.0√)}, I = {(a.0√, +comm(a), ā.0√), (ā.0√, −comm(a), a.0√)} and D is the singleton set containing only (b.0√, +comm(a)).

Note that being (F, I, ⊏, D) a DQI-structure does not imply that (F, I, ⊏) is a QI-structure: apart from being labelled, I is only symmetric and not an equivalence relation. This is a consequence of the decision to take a finer view of interaction than “everybody interacts with everybody else”. The QI-structure corresponding to (F, I, ⊏, D) is (F, (I^{♭})^{∗}, ⊏).

Preorders Dangling interactions do not add extra dependency information, so the preorder of a DQI-structure (F, I, ⊏, D) is just the analogue of the preorder for QI-structures:

≲_{(F,I,⊏,D)} = ≲_{(F,(I^{♭})^{∗},⊏)} = (≲_{F} ∪I^{♭} ∪ ˆ⊏)^{∗}

Histories

Let Σ = (F, I, ⊏, D) be a DQI-structure. Then h : O(Σ) → ℕ is a history of Σ if for all A, B ∈ O(Σ),

if A <_{F} B then h(B) > h(A)
if A ˆ⊏B then h(B) > h(A)
if A I B then h(B) = h(A)

It is easy to show that if h is a history of Σ and A ≲_{Σ} B then h(B) ≥ h(A) (simply consider the path of occurrences from A to B in Σ).

For example, the following is a history of the above deduction:

\begin{matrix}A & a.0|(ā.0; b.0)√ & ā.0; b.0√ & a.0√ & ā.0√ & 0√^{2} & b.0√ & 0√^{3} & 0√^{1} \\ h(A) & 6 & 5 & 4 & 4 & 3 & 2 & 1 & 0 \end{matrix}

And note that this history does indeed correspond to a possible sequence of rules applications to build the deduction.

Proposition 4.0 Σ has a history iff Σ satisfies SLF.

Proof: Similar to that of propositions 3.4 and 3.8. □

Assemblies

We want to take a set of structures and connect their dangling interactions together. To do this we must specify which dangling interactions are to be assembled. A connector is a function that maps dangling interactions to their intended partners. Of course, this means that a connector should be involutive. However, we also want to ensure that we do not introduce a sequencing loop. The easiest way is to use a history: if two dangling interactions can be synchronized in a history then they can be connected.

Connectors A connector of a DQI-structure Σ with respect to a history h : O(Σ) → ℕ is an involution f : H ↔ H (where H ⊆ D(Σ)) such that for all (A, α) ∈ H, f(A, α) = (A′, ᾱ) for some A′ ≠ A, and h(A) = h(A′). I write

⨂_{f}H = {(A, α, B) | (A, α) ∈ H, f(A, α) = (B, ᾱ)}^{∘}

Whenever f is a connector for Σ. Extending notation, I say that a connector of a set of disjoint structures is a connector for the union of the structures.

The above example has only one connector: the empty one. However, suppose its interaction link was broken, i.e., that I = ∅ and D contained three elements (a.0√, +comm(a)), (ā.0√, −comm(a)) and (b.0√, +comm(b)). Then we should have another connector f : H ↔ H where H contains the two elements (a.0√, +comm(a)) and (ā.0√, −comm(a)), and

\begin{matrix}f(a.0√, +comm(a)) = (ā.0√, −comm(a)) \\ f(ā.0√, −comm(a)) = (a.0√, +comm(a)) \end{matrix}

Chapter 4. The content of interaction 74

This is a connector with respect to the history given on the previous page. In this case, ⨂_{f} = {(a.0√, +comm(a), ā.0√), (ā.0√, −comm(a), a.0√)} which is just the set I of the original deduction. If b = a, then we would have another possibility, of connecting ā.0√ to b.0√, but this would require a different history because h(ā.0√) ≠ h(b.0√).

Assembly The assembly of a DQI-structure Σ = (F, I, ⊏, D) with respect to a connector f (written ⨂_{f} Σ) is the quadruple (F, I′, ⊏, D′) where

\begin{matrix}I′ = I ∪ ⨂_{f}(dom f) \\ D = (D \ dom f) \end{matrix}

In what follows, whenever I write ⨂_{f} Σ, I shall assume that f is a connector of Σ with respect to some history h. Extending notation again, I say that the assembly of a set of disjoint structure with respect to a connector is just the assembly for the union of the structures (i.e., ⨂_{f}{Σ_{1}, …, Σ_{n}} = ⨂_{f}(Σ_{1} ∪ … ∪ Σ_{n})).

Proposition 4.1 ⨂_{f}(Y ∪ {⨂_{g} X}) = ⨂_{f⊕g}(X ∪ Y)

Proof: Since dangling interactions can be assembled only once, we get dom g ∩ dom f = ∅ and im g ∩ im f = ∅. Since there is no interference between the two connectors we can easily combine them. The result, f ⊕ g is involutive because f and g are, maps perspectives into their opposite perspectives because f and g do and satisfies the history requirement because f and g do. □

Proposition 4.2 Let Σ satisfy SLF. Then ⨂_{f} Σ satisfies SLF.

Proof: Since Σ satisfies SLF, it has a history (proposition 4.0). Now, by the definition of connector, we know that for some history of Σ, for all (A, α), (A′, ᾱ) ∈ dom f such that f(A, α) = (A′, ᾱ), that h(A) = h(A′). But this means that h is also a history of ⨂_{f}(Σ): if (B, β, B′) is an interaction in ⨂_{f}(Σ) then either it is an interaction of Σ, in which case h(B) = h(B′), or it belongs to ⨂_{f}(dom f). But then, f(B, β) = (B′, β̄), and so h(B) = h(B′) again. The other two properties of histories follow because we do not alter the trees or sequencing relations of Σ. Therefore by proposition 4.0, ⨂_{f} Σ satisfies SLF. □

Binary Assembly A special case is the assembly of two disjoint structures together. This is called binary assembly. A binary assembly of two disjoint structures Σ_{1} and Σ_{2} only adds links between the two structures, as specified by a binary connector. Formally, a binary connector of Σ_{1} and Σ_{2} is a connector of {Σ_{1}, Σ_{2}} such that

for all (A, α) ∈ (dom f ∩ D(Σ_{i})), f(A, α) ∈ D(Σ_{3−i})

Chapter 4. The content of interaction 75

for i = 1, 2. (Note that when i = 1, 3 − i = 2 and vice-versa.) I write Σ_{1} ⊗_{f} Σ_{2} for ⨂_{f}{Σ_{1}, Σ_{2}} when f is a binary connector. Binary assembly is used in the definition of deduction because it does not satisfy the absorption propery of full assembly (proposition 4.1). If we need to assemble n structures together, we have to use n − 1 binary connectors. This allows us to determine a unique size for deductions, which in turn facilitates proofs by induction on the size of deductions.

For example, consider the two deductions

{0√ \atop a.0√} +comm(a)  {0√ \atop b.0√} ; a.b.0√ +comm(a) {0√ \atop b̄.0√} ; ā.b̄.0√ −comm(a)

We cannot apply a binary connector to the second deduction once it has been connected. Once a deduction has been assembled, there is no way for us (using binary assembly) to go back and rewire its internals. So again, there are only two binary assemblies: the empty one, and the one that connects the dangling interaction (a.0√, +comm(a)) to (ā.b̄.0√, −comm(a)).

Proposition 4.3 Σ_{1} ⊗_{f} Σ_{2} = Σ_{2} ⊗_{f} Σ_{1} □

For the following, if g is an injective function with disjoint domain and image, I say the involutive closure of g is the function g ⊕g^{−1}, which I write Inv(g). Binary connectors will be the involutive closure of an isomorphism between subsets of the dangling interactions of two structures.

Proposition 4.4 (Σ_{1} ⊗_{f} Σ_{2}) ⊗_{g} Σ_{3} = Σ_{1} ⊗_{f⊕g_{1}} (Σ_{2} ⊗_{g_{2}} Σ_{3}) where g_{i} = Inv(g ↾ D(Σ_{i})) for i = 1, 2.

Proof: First, g_{i} is an isomorphism because g is and because dom (g ↾ D(Σ_{i})) ∩ im (g ↾ D(Σ_{i})) = ∅. The definition of g_{i} shows immediately that it is involutive. Now g_{i} is contained in g (since g = g^{−1}), so it follows that g_{i} satisfies the properties of being a binary connector: it connects Σ_{i} and Σ_{3−i}. Therefore, as dom f and dom g_{i} are disjoint, f ⊕g_{1} must be a binary connector too. Now (Σ_{1} ⊗_{f} Σ_{2})⊗_{g} Σ_{3} equals ⋃_{f⊕g}{Σ_{1}, Σ_{2}, Σ_{3}}, which equals Σ_{1}⊗_{f⊕g_{1}} (Σ_{2}⊗_{g_{2}} Σ_{3}) because (f ⊕g_{1})⊕g_{2} = f ⊕ g. □

4.1.2 Deduction

This section uses the previous notions to define DQI-deduction. All deductions are DQI-structures. We use histories to capture sequencing, and assembly to model hypothesis discharge. For an informal account of the process, we return to our community of mathematicians. Previously, inference steps (rule applications) were made simultaneously by a group of mathematicians. Now we allow mathematicians to make individual steps on their own as long as they record what hypotheses they are using (or what they have perceived about a colleague’s work). What makes this work is a second kind of inference step: the binary assembly of two deductions.

Definition 4.5 DQI-deduction Let T be a DQI-system. Then the set DQI(T ) of DQI-deductions of T is the least set such that:

1. 0 = (∅, ∅, ∅, ∅) ∈ DQI(T ).

2. If Σ_{1}, Σ_{2} ∈ DQI(T ) then Σ_{1} ⊗_{f} Σ_{2} ∈ DQI(T ).

3. If (a) (F, I, ⊏, D) ∈ DQI(T ) (b) There exists a history h of (F, I, ⊏) such that for all (A, B) ∈⊏_{r}, ĥ(A) > h(B) (c) r matches a rule of T such that flat(r) = {roots(F) \atop C} D_{r}

then (\{{F \atop C}\}, I, ⊏ ∪ ⊏_{r}, D ∪ \{(C, α) | α ∈ D_{r}\}) ∈ DQI(T ).

I write Π ⊢ A_{1}, …, A_{n} if Π is a deduction with conclusions A_{1}, …, A_{n}. I also write T ⊢ A_{1}, …, A_{n} if Π ∈ DQI(T ). A deduction Π is proper if D(Π) = ∅, in which case I write Π ⊩ A_{1}, …, A_{n} and T ⊩ A_{1}, …, A_{n}. It is acyclic if the only cycles of interaction links are of the form (A, α, B), (B, ᾱ, A). A DQI-system is acyclic if all its deductions are.

The size of deductions This definition is much more elegant than the previous definitions, because we have not had to apply the several rule atoms at once. Thus we shall be able to prove results such as proposition 3.14 and lemma 2.13(i) more directly, without requiring special “fragmented” systems which allowed us to break interaction links in inductive proofs. To aid inductive proofs, let me define the size of a DQI-deduction as follows:

size(Σ) = \{ \begin{matrix}0 & if Σ = 0 \\ 1 + max(size(Σ_{1}), size(Σ_{2})) & if Σ = Σ_{1} ⊗_{f} Σ_{2} \\ 1 + size(Σ_{1}) & if Σ = {Σ_{1} \atop C} D \end{matrix}

Note that this is well-defined. As mentioned previously, because we only use binary assemblies in the definition of deduction, and binary assemblies only add interactions between deductions (i.e., they assemble no extra interactions within an argument deduction), it follows that there must exist a fixed number of binary assemblies within each deduction.

Proposition 4.6 Every DQI-deduction has a history □

Proposition 4.7 Every DQI-deduction satisfies SLF.

Proof: Straightforward from propositions 4.6 and 4.0. □

Characterizing the DQI-deductions

Once again the DQI-deductions are the DQI-structures that satisfy SLF and which are built only from the appropriate DQI-rules. The following treatment is straightforward.

DQI-neighbourhoods We need the notion of DQI-neighbourhood. As usual, I shall drop the prefix, and simply refer to neighbourhoods. Let A be an occurrence of a DQI-structure (F, I, ⊏, D). Then its DQI-neighbourhood (written N(A)) is the triple (N, ⊏_{N}, D_{N}) where

N = {atom(A)}
⊏_{N}=⊏ ∩O(N) × O(N)
D_{N} = {α | (A, α) ∈ D} ∪ {α | ∃B.(A, α, B) ∈ I}

Thus the DQI-neighbourhood of A is simply the atom that introduces A in F together with information about how its premises are sequenced and its interactive ability (i.e., the interactions and dangling interactions incident to A in the structure).

Rule matching I say a rule (a, D_{a}) matches a neighbourhood (N, ⊏, D_{N}) via f : O(a) ↔ O(N) (written (a, D_{a}) ≡_{f} (N, ⊏, D_{N})) if

\begin{matrix}(a) & \{a\} ≡_{f} (N, ⊏_{N}) \\ (b) & D_{a} = D_{N} \end{matrix}

Lemma V(i) Let Σ = (F, I, ⊏, D) be an L-labelled DQI-structure, and let Σ_{i} = (F_{i}, I_{i}, ⊏_{i}, D_{i}) (for i = 1, 2) be disjoint structures such that F_{1} ∪ F_{2} = F, ⊏=⊏_{1} ∪ ⊏_{2} and I_{i} ⊆ I and for all A ∈ D(Σ_{i}), N_{Σ_{i}}(A) = N_{Σ}(A). Then there exists a connector f such that Σ = ⨂_{f}{Σ_{1}, Σ_{2}}

Proof: Let us define Σ′ = Σ_{1}∪Σ_{2} = (F, I′, ⊏′, D′). We know that I′ = I_{1}∪I_{2} ⊆ I. Therefore, by the definition of DQI-neighbourhood, D′ = D_{1}∪D_{2} ⊇ D, otherwise there would exist a neighbourhood in either Σ_{1} or Σ_{2} which had a different communicative ability from its corresponding neighbourhood in Σ, which is again impossible.

Let us define X = {(A, α) | ∃B.(A, α, B) ∈ I \ I′}. We show X = D′ \ D. First we show X ⊆ D′ \ D. Let (A, α) ∈ X. Then there exists B such that (A, α, B) ∈ I \ I′. Therefore (A, α) ∈ D_{A} where N_{Σ}(A) = (atom(A), ⊏_{A}, D_{A}) = N_{Σ′}(A). Therefore, since (A, α, B) ∉ I′, (A, α) ∈ D′. Since (A, α, B) ∈ I, (A, α) ∉ D. Therefore (A, α) ∈ D′ \ D. Second we show that D′ \ D ⊆ X. Let (A, α) ∈ D′ \ D. Then (A, α) ∈ D_{A}, which means (because (A, α) ∉ D, that for some B, (A, α, B) ∈ I \ I′, i.e., that (A, α) ∈ X.

Therefore, let p : (I\I′) ↔ (D′\D) be the isomorphism defined by p(A, α, B) = (A, α). To assemble Σ let f : (D′ \D) ↔ (D′ \D) be defined by f = p∘swap∘p^{−1}, Chapter 4. The content of interaction 78

where swap(A, α, B) = (B, ᾱ, A). Let h be any history of Σ. Then, since ≲_{Σ′}⊆≲_{Σ}, h is also a history of Σ′. We show f is a connector.

First, f(A, α) = p ∘ swap(A, α, B) = p(B, ᾱ, A) = (B, ᾱ). Second, it is involutive because swap is involutive. Third, to show that it satisfies the history property, Let (A, α), (A′, ᾱ) ∈ D′ \ D be such that f(A, α) = (A′, ᾱ). Since (A, α, A′) is part of an interaction link in h, it follows that h(A) = h(A′).

The last thing to show is that Σ = ⨂_{f}{Σ_{1}, Σ_{2}}. The only nontrivial things to check are that

\begin{matrix}I = I_{1} ∪ I_{2} ∪ ⨂_{f}(D′ \ D) \\ D = D \ (D′ \ D) \end{matrix}

But these follow from the definitions and elementary set-theoretic manipulation. □

We can strengthen this result: when I_{i} = I ∩ (O(F_{i}) × L × O(F_{i})) we can show that the f constructed is in fact binary. This follows because in this case the only interaction links in I \ I′ are those that occur between the structures Σ_{1} and Σ_{2}.

Theorem V Let T = (L, R) be a DQI-system. Then (F, I, ⊏, D) ∈ DQI(T ) if and only if (F, I, ⊏, D) is an L^{±}-labelled DQI-structure satisfying SLF and such that every neighbourhood matches a rule of T .

Proof: ⇒: Let Σ ∈ DQI(T ). Then by proposition 4.7, it satisfies SLF. We show by strong induction on the size n of Σ that every neighbourhood matches a rule of T . Case n = 0: vacuously true. Case n = k + 1: two subcases. First, suppose Σ = ⊗_{f}Σ′ where Σ′ = (F′, I′, ⊏′, D′) = Σ_{1} ∪ … ∪ Σ_{n}, f : H ↔ H, and Σ_{i} = (F_{i}, I_{i}, ⊏_{i}, D_{i}). Then by induction, every neighbourhood of Σ_{i} matches a rule in T . Suppose there exists an occurrence A (say from the Σ_{j} part) whose neighbourhood (N, ⊏_{N}, D_{N}) does not match a rule of T . Let (N′, ⊏′_{N}, D′_{N}) be its neighbourhood in Σ_{j}. By induction, it matches (a, D_{a}). By the definition of neighbourhood, (N, ⊏_{N}) = (N′, ⊏′_{N}), so it must be that D_{N} ≠ D_{a} since (N, ⊏_{N}, D_{N}) does not match (a, D_{a}). Thus:

D′_{N} = {α | (A, α) ∈ D_{j}} ∪ {α | ∃B.(A, α, B) ∈ I_{j}}
D_{N} = {α | (A, α) ∈ D′ \ H}
∪ {α | ∃B.(A, α, B) ∈ I′ ∪ ⨂_{f} H}
= {α | (A, α) ∈ (D_{j} \ H)} ∪ {α | ∃B.(A, α, B) ∈ I_{j} ∪ ⨂_{f} H}

since A ∈ O(Σ_{j}). But this means that D_{N} = D′_{N} since every dangling interaction in H becomes half an interaction in ⨂_{f} H. Contradiction.

Second, Σ = {Σ_{1} \atop C} D follows easily from induction, and the fact that the rule

introducing C must match that rule applied to Σ_{1} that made Σ.

⇐: Let Σ = (F, I, ⊏, D) be a DQI-structure satisfying SLF and such that every neighbourhood matches a rule. We show by strong induction on the number of occurrences in F that (F, I, ⊏, D) is in DQI(T ). Case n = 0: trivial. Case n = k + 1: There are two subcases. First, suppose F = \{{F_{1} \atop C}\}. Let Chapter 4. The content of interaction 79

(atom(C), ⊏_{C}, D_{C}) be the neighbourhood of C, and let it match r via f. By SLF, there are no interaction links incident to C, so by induction, the structure Σ_{1} = (F_{1}, I, ⊏ \ ⊏_{C}, D \ D_{C}) is in DQI(T ). Now, since Σ satisfies SLF, then it satisfies the sequencing constraints of r (i.e., for every history h of Σ, and every (A, B) ∈⊏_{C}= {(f(A), f(B)) | (A, B) ∈⊏_{r}}, ĥ(A) > h(B)) then we can apply f(r) to Σ_{1} to obtain Σ. Hence Σ ∈ DQI(T ).

The second subcase occurs when |F | > 1. Then we arbitrarily split it into two disjoint, nonempty subsets F_{1} and F_{2}. We define (for i = 1, 2) Σ_{i} = (F_{i}, I_{i}, ⊏_{i}, D_{i}) where F = F_{1} ∪ F_{2}, I_{i} = I ∩ O(F_{i}) × L^{±} × O(F_{i}) and for all A ∈ O(Σ_{i}), N_{Σ_{i}}(A) = N_{Σ}(A). Then by induction, Σ_{1}, Σ_{2} ∈ DQI(T ). By lemma V(i), we find a connector f such that Σ = ⨂_{f}{Σ_{1}, Σ_{2}}. Moreover, since I_{i} = I ∩ O(F_{i}) × L^{±} × O(F_{i}), we can show that f is binary, hence Σ = Σ_{1} ⊗_{f} Σ_{2}, whence Σ ∈ DQI(T ). □

4.1.3 Coding QI-deduction into DQI-deduction

The point of DQI-deduction is to provide a finer and more accessible account of QI-deduction. This section makes the claim more precise. The following theorem shows how QI-deduction can be simulated by proper DQI-deduction. To do this we have to break up QI-rules into DQI-rules such that these new rules only interact when they are pieces of the same QI-rule.

Encoding rules and rulesets We say a graph G encodes r with respect to L if G = (r, E) (i.e., its vertices are the atoms of r) and it is both connected and acyclic, and every edge is labelled uniquely from L. I write aE_{α}a′ if there is an edge from a to a′ labelled by α. Let us pick one such encoding arbitrarily for each rule r ∈ R such that no two rules share a label in their encodings. Let us write G_{r} for this distinguished encoding of r. Then we say the graph G_{R} encodes R with respect to L if G_{R} is the union of the distinguished encodings of its rules.

Now, let G_{R} = (V, E), and let ≤ be an arbitrary total order over V. Let me write aE⃗_{α}a′ if there exists an α-labelled edge from a to a′ and moreover a < a′ in the total order. Then we define the interactive ability of each atom a of G_{R} as follows:

D_{a} = {+α | aE⃗_{α}a′} ∪ {−α | a′E⃗_{α}a}

Then we write R(G_{R}, ≤) for the set of rules {(a, D_{a}) | a ∈ V }, the DQI-encoding of R with respect to the edges of G_{R} and the order ≤.

Encoding QI-systems Let T = (L, R) be a QI-system. Then we say that a DQI-system T′ = (L′, R′) encodes T if there exists a set L of formulae disjoint from L such that L′ = L ∪ L and there exists an encoding G_{R} of R with respect to L and a total order ≤ over the vertices of G_{R} such that R′ = R(G_{R}, ≤).

Theorem VI Let T be a QI-system, and let T′ be a DQI-encoding of it. Then T ⊢ A_{1}, …, A_{n} if and only if T′ ⊩ A_{1}, …, A_{n}.

Proof: ⇒: Let T′ be constructed from T via L, G_{R} = (V, E) and ≤. Suppose there exists a QI-deduction Σ = (F, I, ⊏). Then we construct a proper DQIdeduction Σ′ = (F, I′, ⊏, ∅) such that I = ((I′)^{♭})^{∗} by induction on the n, number of QI-neighbourhoods of Σ. Let ⩽ be any total order containing the neighbourhood ordering of Σ. Case n = 0: trivial. Case n = k + 1:. Consider the least (with respect to ⩽) neighbourhood. Let Σ_{1} = (F_{1}, I_{1}, ⊏_{1}) consist of the highest (w.r.t. ⩽) k-neighbourhoods of Σ. Then by induction, we have a proper deduction Σ′_{1} = (F_{1}, I′_{1}, ⊏_{1}, ∅). Let the lowest neighbourhood match r, and let {(a_{1}, D_{1}), …, (a_{n}, D_{n})} be the set of DQI-rules that encode it, ordered by ≤ (the total order over the vertices V of G_{R}). We know that the sequencing constraints of r are satisfied by Σ_{1}, so they will be satisfied by Σ′_{1} too (because I_{1} = ((I′_{1})^{♭})^{∗}, hence ≲_{Σ_{1}}=≲_{Σ′_{1}}). We fragment Σ′_{1} into Π_{0}, …, Π_{n} such that

Σ′_{1} = ⨂_{f}{Π_{0}, Π_{1}, Π_{2}, … Π_{n}}

(using the absorption property of assembly) and for i = 1, …, n, Π_{i} concludes the premises of a_{i}. Then we can apply each rule (a_{i}, D_{i}) to Π_{i} to yield Π′_{i}. To glue them back together to get Σ, we must construct another connector, f′. Suppose the old connector f : H ↔ H is defined with respect to history h : O(Σ′_{1}) → ℕ. We construct H′ by

H′ = H \begin{matrix}∪\{(C_{i}, +α) | atom(C_{i}) E⃗_{α} atom(C_{j})\} \\ ∪\{(C_{i}, −α) | atom(C_{j}) E⃗_{α} atom(C_{i})\} \end{matrix}

(where i, j range over 1 to n). Then we construct f′ : H′ ↔ H′ and h′ : O(Σ′) → ℕ by

f′(A, α) = \{ \begin{matrix}f(A, α) & if (A, α) ∈ H \\ (B, ᾱ) & if (A, α) ∉ H and atom(A) E_{α} atom(B) \end{matrix}

h′(A) = \{ \begin{matrix}h(A) & if A ∈ O(Σ′_{1}) \\ 1 + max(im h) & ow \end{matrix}

It is straightforward to show that f′ : H′ ↔ H′ and that it is a connector with respect to h′. Then we glue them together to get Σ′:

⨂_{f′}{Π_{0}, Π′_{1}, Π′_{2}, …, Π′_{n}}

which satisfies SLF. It remains to show that Σ′ is proper. Suppose not. Then there exists a dangling interaction (C_{i}, +α) (or (C_{i}, −α), which is a symmetric case) in Σ′. But then atom(C_{i}) E_{α} atom(C_{j}) which implies that (C_{j}, −α) exists in Σ′. This is impossible by the definition of H′.

⇐: Let Σ = (F, I, ⊏, ∅) be a proper T′ deduction, and let Σ′ = (F, (I^{♭})^{∗}, ⊏) be a QI-structure. Obviously it will satisfy SLF, since the preorder of the DQIdeduction also takes the reflexive and transitive closure of I^{♭}. Thus it remains to show that evey QI-neighbourhood of Σ matches a rule. Let (N, ⊏) be the Chapter 4. The content of interaction 81

QI-neighbourhood of A in Σ′. It will consist of n ≥ 1 atoms, a_{1}, …, a_{n}. Each will be connected by I in Σ′, and no other atom will be connected by I. Let N_{1}, …, N_{n} be the distinct DQI-neighbourhoods of Σ such that N_{i} = (a_{i}, ⊏_{i}, D_{i}) for some ⊏_{i} and D_{i}. Since the atoms in each neighbourhoods are connected, it must be that for every dangling interaction α ∈ D_{i} there exists ᾱ ∈ D_{j} (for i ≠ j). But regarding the encoding, this must mean that a_{1}, …, a_{n} match the vertices of some connected component of G_{R} (where R is the ruleset of T ). This means that ({a_{1}, …, a_{n}}, ⋃_{i} ⊏_{i}) must match a rule of R. The result follows by theorem V. □

4.2 Proof Fragmentation

This section is devoted to the theory of fragments of DQI-systems and structures. In a sense it is simply continuing the work of the last theorem: reinterpreting the old theory in terms of the new situation. We obtain the interaction replacement theorem, which justifies the technique of breaking links, proving results and then reassembling links afterwards. This was required in the proof of proposition 3.14, and should also be useful in any similar situation. Once again, we have the proof fragmentation theorem, and we prove one half of a simple type-checking example (section 4.2.3).

Definition 4.8 (Fragment)

System fragments Let T = (L, R) and T′ = (L′, R′) be DQI-systems. Then T is a fragment of T′ if L ⊆ L′ and R ⊆ R′.

Structure fragments Let Σ = (F, I, ⊏, D) and Σ′ = (F′, I′, ⊏′, D′) be DQIstructures. Then Σ is a fragment of Σ′ if F ⊆ F′, I ⊆ I′ and for all A ∈ O(Σ), N_{Σ}(A) = N_{Σ′}(A).

Thus if Σ is a fragment of Σ′, it contains a subset of the trees of Σ′, exactly the sequencing constraints of Σ′ restricted to Σ, and while it contains no extra interaction links, the interactive ability of each neighbourhood is preserved. So in the following picture Σ′ is not a fragment of Σ because D is able to interact in Σ, while it cannot in Σ′.

Σ = \begin{matrix}\begin{aligned}A & & B \\ & C \end{aligned} α & D \\ E \end{matrix}  \begin{aligned}ᾱ & \begin{aligned}F & & A \\ & H \end{aligned} \\ & I \end{aligned}  Σ′ = \begin{matrix}\begin{aligned}A & & B \\ & C \end{aligned} α & D \\ E \end{matrix}

Proposition 4.9 Let Σ be a DQI-structure such that Σ_{1} and Σ_{2} are disjoint fragments of Σ such that O(Σ) = O(Σ_{1}) ∪ O(Σ_{2}). Then there exists an f such that Σ = ⨂_{f}{Σ_{1}, Σ_{2}}.

Chapter 4. The content of interaction 82

Proof: Since Σ_{1} and Σ_{2} are fragments, and O(Σ) = O(Σ_{1}) ∪ O(Σ_{2}), then the forest of Σ is the union of the disjoint forests of Σ_{1} and Σ_{2}. Therefore the results follow from lemma V(i). □

Proposition 4.10 Let Σ satisfy SLF. Then every fragment of Σ satisfies SLF too. □

Proposition 4.11 Every fragment of a DQI-deduction is a DQI-deduction.

Proof: Let T be a DQI-system, let Π ∈ DQI(T ) and let Σ be a fragment of Π. Then by theorem V, Π satisfies SLF and every neighbourhood matches a rule of T . By proposition 4.10, Σ satisfies SLF. Furthermore, every neighbourhood of Σ is a neighbourhood of Π and so it must match a rule of T also. Therefore, by theorem V, Σ ∈ DQI(T ). □

4.2.1 The interaction reflection theorem

Proposition 3.14 showed that the coding of a P(;) process as a P process did not affect the behaviour of the process. To do this, it showed that whenever a process could be evaluated, its coding could be too with the same behaviour and viceversa. In current terminology, having the “same behaviour” meant that the two “equivalent” deductions could be assembled in the same way to the same context. Now whereas we could have proved this result specifically for the system P_{QF}^{(;)} , it is more obviously a property which can be proved independently of particular systems: assembly is a concept belonging to the metatheory of deduction.

In this section, we prove the Interaction reflection theorem. This says that if we have two structures where the dangling interactive dependencies of one are “contained” within that of the other, then whenever we assemble the larger one, we can reflect the pattern of connections of the larger structure in the smaller one to obtain a parallel assembly.

Simulation Let Σ_{1} and Σ_{2} be DQI-structures. Then Σ_{2} simulates Σ_{1} (written Σ_{1} ⪯ Σ_{2}) if there exists an isomorphism f : D(Σ_{1}) ↔ D(Σ_{2}) such that for all (A, α) ∈ D(Σ_{1}), f(A, α) = (A′, α) for some A′, and for all (A, α), (B, β) ∈ D(Σ_{1}),

if A ≲_{Σ_{1}} B then A′ ≲_{Σ_{2}} B′

where f(A, α) = (A′, α) and f(B, β) = (B′, β). We write Σ_{1} ≃ Σ_{2} if Σ_{1} ⪯ Σ_{2} and Σ_{2} ⪯ Σ_{1}.

Theorem VII (Interaction Reflection) Let Σ′_{1} be an assembly of Σ_{1}, and let Σ_{2} be such that Σ_{2} ⪯ Σ_{1}. Then there exists an assembly Σ′_{2} of Σ_{2} such that Σ′_{2} ⪯ Σ′_{1}.

Chapter 4. The content of interaction 83

Proof: Suppose Σ′_{1} = ⨂_{f_{1}} Σ_{1}, and that f is a connector with respect to history h_{1}. let g : D(Σ_{2}) ↔ D(Σ_{1}) be the function that witnesses Σ_{2} ⪯ Σ_{1}. We show that f_{2} = g^{−1} ∘ f_{1} ∘ g is a connector of Σ_{2}. First, let (A, α) ∈ dom f′. Then f_{2}(A, α) = (g^{−1} ∘ f_{1})(A′, α) = g^{−1}(B′, ᾱ) = (B, ᾱ) for some A′, B′ ∈ O(Σ_{1}) and B′ ∈ O(Σ_{2}). Second, f_{2} must be involutive because f_{1} is. Third, let h_{2} be any history of Σ_{2}. Then we construct histories h′_{1} and h′_{2} of Σ_{1} and Σ_{2} such that h′_{1}(A) ≤ h′_{1}(B) if and only if h_{1}(A) ≤ h_{1}(B) and such that for all (A, α) ∈ D(Σ_{1}), if g(A, α) = (A′, α), h′_{1}(A) = h′_{2}(A′). The method of construction is iterative. First, we totally order the dangling interactions with respect to the preorder of Σ_{1}. Then for the ith dangling interaction g(A_{i}, α_{i}) = (A′_{i}, α_{i}), if h_{1}_{i}(A_{i}) < h_{2}_{i}(A′_{i}) then add the difference to every timestamp in h_{1}_{i} greater than or equal to that of A_{i}. Then h_{1}_{i+1} equals the altered h_{1}_{i}, and h_{2}_{i+1} = h_{2}_{i}. If h_{1}_{i}(A_{i}) > h_{2}_{i}(A′_{i}) then we alter h_{2}_{i} in the same way. h_{1}_{i+1} and h_{2}_{i} are calculated in the symmetric way to the previous case. h′_{1} and h′_{2} are h_{1}_{n} and h_{2}_{n} for the final n.

Now it is easy to show that for all (A, α), (A′, ᾱ) ∈ dom f_{2} h′_{2}(A) = h′_{2}(A′): h′_{2}(A) = h′_{1}(A) = h′_{1}(A′) = h′_{2}(A′).

Therefore we get Σ′_{2} = ⨂_{f_{2}} Σ_{2}. It is straightforward to show that Σ′_{2} ⪯ Σ′_{1} because we have not altered the relative dependencies of the remaining dangling interactions: we can show simulation using g ↾ D(Σ′_{2}). □

Application to the translation correctness proof

We complete the proof of proposition 3.14. That proof was an indication of the way one would like to reason about deductions, and so left out the messy detail of preserving interactions, which (as we have seen) could be done generally. The following corollary simply interprets the interaction reflection theorem in terms of the terminology of section 3.4.4.

Corollary VIIa Let Σ_{1} and Σ_{2} be QI-structures whose formulae are those of P_{QI}^{(;)} such that Σ_{1} ≃ Σ_{2}. If Σ_{1} is the result of breaking interaction links of Σ′_{1} then there exists a Σ′_{2} such that Σ′_{1} ≃ Σ′_{2} and Σ_{2} is the result of breaking interaction links of Σ′_{2}.

Proof: We define an isomporhism between QI-structures and DQI-structures if they have the same preorder. We define an isomorphism between the visible occurrences of a QI-structure and the dangling interactions of the isomorphic DQI-structure, and then the corollary follows naturally. □

4.2.2 The Proof Fragmentation Theorem

Once again, we define 𝔽_{T} (X) for the set of all fragments of DQI-fragments of DQI-deductions in X that are built from rules only in T .

Theorem VIII (Proof Fragmentation) Let T′ be a system fragment of T . Then DQI(T′) ⊇ 𝔽_{T′}(QI(T ))

Proof: Let Π ∈ 𝔽_{T′}(QI(T )). Then by theorem V, Π satisfies SLF and by definition every neighbourhood matches a rule of T′. Hence by theorem V again, Π ∈ DQI(T′). □

4.2.3 An example: Type checked processes do not fail

To illustrate proof fragmentation and motivate the proof assembly technique, we consider a simple type-checking example. We introduce the notions of value and type to P (calling the language P(v)). Processes in this language may fail to terminate successfully in one of two ways: they may deadlock, or attempt to evaluate an expression with wrongly typed arguments. This latter event I call a run-time error. If a process exhibits a run-time error, I say it fails.

In the following subsections I introduce the language, its dynamic semantics and its static semantics. The static semantics simply checks types — the intention being that a process type-checks if and only if it exhibits no run-time errors. Since no P process can execute indefinitely, we could also test for deadlock-freeness — perhaps using a type system like that of [MG95] where types are behaviours (see also [GS86]). However, testing for deadlock is in general undecidable (seen via a reduction to the halting problem: consider a program which sequences a trivially deadlocking process after a possibly nonterminating process) though perhaps one may be able to decide deadlock-freeness for restricted, but nonetheless interesting, classes of processes.

We shall be able to prove that no type-checked process fails using proof fragmentation. However, we shall not be able to prove that every process which does not fail type checks in this way. In this case we really have to take account of what interactions are about. This motivates the technique of proof assembly described in section 4.3.

The Language P(v)

Consider the langage P(v), a typed value-passing variant of P. It consists of the following syntax:

\begin{matrix}p ::= 0 | a!e.p | a?x.p | p|p \\ e ::= v | x | e op e \end{matrix}

where x ranges over the countable set V ar, v over the set V al of integers and booleans, op over a set of binary integer and boolean operations OP, and a ranges over the action set A. The grammar of expressions is a straightforward extension of the expressions of P(:=) (page 25) to include boolean expressions. (We need at least two types to make type-checking non-trivial.) The grammar defines the set Exp, ranged over by e.

Dynamic semantics

The dynamic semantics of P(v) is given by the DQI-system P_{QI}^{(v)} = (L_{QI}^{(v)}, R_{QI}^{(v)}) where L_{QI}^{(v)} is the set of judgments of form

E ⇛ p√ and E ⇛ e ⇝ v and comm(a, v)

Where E ranges over the set of environments E : V ar ⇀ V al, p ∈P(v), e ∈ Exp, and v ∈ V al. It is customary to use turnstile notation, E ⊢ p√, for environment judgments: E is seen as a collection of hypotheses about variables. However, I already use ⊢ in the metatheory, so I use ⇛ instead, because of its connotations of implication. The ruleset R_{QI}^{(v)} is given by the following rules:

\begin{matrix}E ⇛ 0√ & \begin{matrix}E ⇛ p_{1}√ & E ⇛ p_{2}√ \\ E ⇛ p_{1}|p_{2}√ \end{matrix} & \begin{matrix}E ⇛ e ⇝ v & ▶ & E ⇛ a!v.p√ \\ E ⇛ a!e.p√ \end{matrix} \\ \begin{aligned}E ⇛ p_{1}√ & typof(a) = typof(v) \\ & E ⇛ a!v.p_{1}√ \end{aligned} & −^{comm(a,v)} & {E′[v/x] ⇛ p_{2}√ \atop E′ ⇛ a?x.p_{2}√} \\ E ⇛ v ⇝ v & E ⇛ x ⇝ E(x) & \begin{matrix}E ⇛ e_{1} ⇝ v_{1} & E ⇛ e_{2} ⇝ v_{2} \\ E ⇛ e_{1} op e_{2} ⇝ app(op, v_{1}, v_{2}) \end{matrix} \end{matrix}

The partial function app : OP × V al × V al ⇀ V al applies operations to their arguments. It is not defined when its arguments are wrongly typed.

Static semantics

Let BT = {int, bool} be the set of base types, and T ypes (ranged over by τ) be the least set containing BT and τ_{1} × τ_{2} when τ_{1}, τ_{2} ∈ T ypes. For base types and actions, let typof : V al ∪ OP ∪ A → T ypes assign arbitrary types to actions and for the base types be such that typof(b) = bool for all booleans b; typof(n) = int for all integers n; and for operations op, typof(op) = τ_{1} × τ_{2} × τ_{3} for some τ_{1}, τ_{2} and τ_{3} if and only if for every v_{1}, v_{2} and v_{3}, if app(op, v_{1}, v_{2}) = v_{3} then typof(v_{i}) = τ_{i} for i = 1, 2, 3. This fact is used in the proof of lemma 4.12(i). A typing environment is a function T : V ar → T ypes. Then I say a P(v) process p (expression e) is type-checked by type environment T if T ⇛ p (for expressions, T ⇛ e : τ for some τ ∈ T ypes) is deducible in the following system T P:

T ⇛ 0  \begin{matrix}T ⇛ p_{1} & T ⇛ p_{2} \\ T ⇛ p_{1}|p_{2} \end{matrix}  \begin{matrix}T ⇛ e : typof(a) & T ⇛ p \\ T ⇛ a!e.p \end{matrix}

{T [typof(a)/x] ⇛ p \atop T ⇛ a?x.p}  T ⇛ v : typof(v)  T ⇛ x : T (x)

\begin{aligned}T ⇛ e_{1} : τ_{1} & T ⇛ e_{2} : τ_{2} & typof(op) = τ_{1} × τ_{2} × τ_{3} \\ & T ⇛ e_{1} op e_{2} : τ_{3} \end{aligned}

We extend the typing judgment to environments, writing E : T when for all x ∈ dom E, T (x) = typof(E(x)).

Type-checked processes do not fail

This condition can be stated formally: if T P ⊢ T ⇛ p then P_{QI}^{(v)} ⊢ E ⇛ p√ when E : T. Note that I do not ask that the evaluation judgment be properly deduced: that would amount to asserting deadlock-freeness of type-checked processes.

This is a candidate for the proof fragmentation theorem: we can simply break the communication interaction link, and prove the property by induction on the size of P_{QI}^{(v)}-deductions. First, however, we need a lemma attesting that typechecked expressions do not fail. The expression evaluation fragment does not involve interaction, so we can prove both directions of this lemma in the usual manner.

Lemma 4.12(i) For all e ∈ Exp, v ∈ V al, and environments E and T such that E : T, we have P_{QI}^{(v)} ⊢ E ⇛ e ⇝ v if and only if T P ⊢ T ⇛ e : typof(v). □

This lemma is the heart of the type checking proof: run-time errors occur when an operation is applied to wrongly-typed arguments. Nevertheless I do not give its proof; first because it is so simple the result should not be in doubt, but mainly because we are more concerned with the way one proves results about interacting deductions.

Proposition 4.12 Let E : T. Then if T P ⊢ T ⇛ p then P_{QI}^{(v)} ⊢ E ⇛ p√

Proof: by induction on the depth of inference of T ⇛ p. Case T ⇛ 0: trivial. Case T ⇛ p|q: straightforward induction. Case T ⇛ a!e.p: this follows when T ⇛ e : typof(a) and T ⇛ p. By lemma 4.12(i), we know that if E ⇛ e ⇝ v then typof(v) = typof(a). By induction, E ⇛ p√. Therefore, E ⇛ a!v.p√ Since E ⇛ e ⇝ v we can also infer E ⇛ a!e.p√.

Case T ⇛ a?x.p: this follows when T [typof(a)/x] ⇛ p. By induction, we know for all E′ such that E′ : T [typof(a)/x] that E′ ⇛ p√. In particular, this will be true in those cases when E′ = E[v/x] and typof(v) = typof(a). Since this binding of v to x does not appear in E, we can conclude that E ⇛ a?x.p√ is deducible. □

4.2.4 Proof fragmentation is not always enough

So we have shown that type-checked processes do not fail. However, the proof of the result that terminating processes type-check fails at the case for input:

case input: Suppose E ⇛ a?x.p and E : T. (We are required to prove that T ⇛ a?x.p is deducible by T P.) Then E[v/x] ⇛ p√ is deduced by a smaller tree. By induction we know that for all T′ such that E[v/x] : T′, we can deduce T′ ⇛ p. In particular, this is true when T′ = T [typof(v)/x] ...

The problem here is that we cannot guarantee that typof(v) = typof(a), which would allow us to infer that T′ = T [typof(a)/x], from which we could deduce T ⇛ a?x.p. Yet the other half of the communication rule guarantees typof(a) = typof(v): therefore the case for the input rule must follow when the rule fragment is known to be part of a P_{QI}^{(v)}-deduction.

4.3 Proof Assembly

We could not prove that terminating processes type-check because the case for input required more information than was contained in the premises to the input rule atom:

{E′[v/x] ⇛ p_{2}√ \atop E′ ⇛ a?x.p_{2}√} −comm(a, v)

Specifically, we wanted to know that typof(a) = typof(v). The object of study of this chapter is the content of interaction. In the type-checking proof, we know that typof(a) = typof(v) holds in proper deductions. Therefore, whatever the content of the interaction labelled comm(a, v) is, it must imply that typof(a) = typof(v).

At this point the idea that dangling interactions are hypotheses becomes useful. We simply view −comm(a, v) as a hypothesis about the environment that the deduction occurs within. Then, in the proof, whenever we see a −comm(a, v) dangling interaction, we simply hypothesize that comm(a, v) implies typof(a) = typof(v). We have already noted that the case for the output rule will guarantee this. So whenever we see +comm(a, v), we have to view this as an obligation to prove that comm(a, v) implies typof(a) = typof(v).

Assembly is Discharge

Thus labels are interpreted as propositions and dangling interactions mark interaction hypotheses and interaction guarantees. The slogan is Assembly is Discharge: assembling a hypothesis with its guarantee will discharge the hypothesis.

The idea is borrowed from the world of parallel program verification [Jon83]. There the goal is to prove results about processes compositionally. This is achieved by using sets of rely and guarantee conditions (elsewhere called assumption and commitment conditions [ZdBdR83]) which encapsulate the relevant information about the interactive behaviour of a process and its environment.

The proof fragmentation theorem enables one to reason about deduction fragments using system fragments. The proof assembly theorem enables one to compose proofs of fragments “in parallel” to obtain a result about deductions.

The proof assembly theorem

In this section, we assume that formulae of a language have tree structure, and we write them P (M_{1}, …, M_{n}) where P is the principal syntactic constructor of the formula and M_{1}, …, M_{n} are the subformulas or terms that occur as children of the formula. So, for example, the evaluation judgment of P(v) would be written (· ⇛ ·√)(E, p). We say a judgment is atomic if its arguments are all terms.

Chapter 4. The content of interaction 88

Operational semantics judgments and interaction labels by convention, are atomic. Therefore, we shall restrict our discussion to atomic judgments: this makes the treatment very easy.

Of course, this restricts the following notion of proof assembly to those semantics which use a standard tree notion of syntax for judgments and programs. However, since the aim of the restriction is to allow a straightforward notion of formula interpretation, I believe that the technique could be extended to other notions of syntax (e.g., higher-order abstract syntax [PE88,Han93]) straightforwardly, given a suitable notion of interpretation.

Interpretation Let T = (L, R) be a DQI-system, and let J_{n} be the set of all judgment constructors P that have n arguments in L. Then an interpretation of T is a family of functions I_{n} : J_{n} → ℘(L^{n}). Thus an interpretation maps each judgment constructor J to a set of n-tuples of terms and formulae. That is, the interpretation returns the extension of the property the formula represents. In the example above, the interpretation of comm would be the set of pairs (a, v) such that typof(a) = typof(v).

If I is an interpretation, and Σ is a DQI-structure, then Σ is I-consistent with respect to a judgement P if for all (A, ±P (t_{1}, …, t_{n})) ∈ D(Σ), (t_{1}, …, t_{n}) ∈ I_{n}(P).

On Hypotheses and Guarantees Let X be a set of DQI-structures, and I an interpretation. Then a judgment constructor P is guaranteed in X if for all Σ ∈ X, Σ is I-consistent with respect to P. Dually, P is hypothesized in X if there exists a Σ ∈ X such that Σ is I-consistent with respect to P. For a non-empty set X, if P is guaranteed in X it is also hypothesized. Thus in a given proof (which will determine the interpretation) about T we can determine which labels are hypotheses and which are guarantees. If the inverse of every hypothesis is a guarantee then we shall be able to use the technique of proof assembly.

Relative guarantees We want to be able to say that something is guaranteed when certain hypotheses hold. In notation reminiscent of [Sti88,MC81], I write X ⊧_{I} [H] ϕ [G] where ϕ is some formula, and H and G are sets of formula perceptions if for all Σ ∈ X, if Σ is I-consistent with respect to every constructor in H, then it is also I-consistent with respect to the constructors in G. Thus H can be seen as a set of hypotheses, and G a set of guarantees. Obviously, X ⊧_{I} [H] ϕ [G] implies X ⊧_{I} [H′] ϕ [G′] when H ⊆ H′ and G′ ⊆ G. X ⊧_{I} ϕ abbreviates X ⊧_{I} [∅] ϕ [∅].

Parallel proofs Let T_{1} and T_{2} be disjoint fragments of T , and suppose ϕ_{1} is a property about T_{1}-deductions, and ϕ_{2} a property about T_{2}-deductions. Then I write X ⊧_{I} [H] ϕ_{1} ∧ ϕ_{2} [G] if under the hypotheses H, G is guaranteed and ϕ_{1} is true about every T_{1}-fragment of structures in X, and ϕ_{2} is true about every T_{2} fragment.

Chapter 4. The content of interaction 89

Theorem IX (Proof Assembly) Let T be an acyclic DQI-system and I be an interpretation of T . Let T_{1}, …, T_{n} (for n ≥ 1) be disjoint fragments of T , such that T_{1} ∪ … ∪ T_{n} = T and DQI(T_{i}) ⊧_{I} [H_{i}] ϕ_{i} [G_{i}]. Then if ⋃_{i=1}^{n} H_{i} ⊆ ⋃_{i=1}^{n} \overline{G_{i}} then QI(T ) ⊧_{I} ϕ_{1} ∧ … ∧ ϕ_{n}

Proof: Let Σ ∈ QI(T ) and let Σ_{1}, …, Σ_{n} be fragments of Σ such that Σ_{i} is the T_{i} fragment of Σ, and such that Σ is the assembly of them all. We know that if Σ is I-consistent with respect to H_{i} then both Σ_{i} satisfies ϕ_{i} and Σ_{i} is I-consistent with respect to G_{i}. Thus we have to show that Σ_{i} is I-consistent with respect to the labels in H_{i}.

Suppose not. Then there exists P ∈ H_{i} and (A, ±P (M_{1}, …, M_{n})) ∈ D(Σ_{i}) such that (M_{1}, …, M_{n}) ∉ I_{n}(P). Since Σ is proper there must exist a Σ_{j} (i ≠ j) with a dangling interaction (B, ∓P (M_{1}, …, M_{n})) that is assembled with (A, P (M_{1}, …, M_{n})). Now, since ⋃_{i=1}^{n} H_{i} ⊆ ⋃_{i=1}^{n} \overline{G_{i}}, ∓P ∈ G_{j}. Since (M_{1}, …, M_{n}) ∉ I_{n}(P), then there exists in turn a P′ ∈ H_{j} such that Σ_{j} is not I-consistent with respect to P′. By similar reasoning, we find an infinite chain of dangling interactions in Σ_{1} ∪ … ∪ Σ_{n} such that the dangling interaction is not consistent with its label’s interpretation. Since T is acyclic, this must mean that there exists an infinite number of dangling interactions in Σ_{1} ∪ … ∪ Σ_{n}, and hence an infinite number of interactions in Σ. But this is impossible because deductions can contain only a finite number of interactions. □

The next section shows how proof assembly can be used to prove that terminating processes type-check. However, this is a result stated and proved using evaluation semantics. We cannot use the proof assembly theorem so easily for a result about a transition semantics, which will concern sequences of deductions (section 4.3.2). Proof fragmentation can be used either for transition or evaluation semantics, so it is only natural to expect a form of proof assembly for sequences of deductions. The following corollary is such a form.

Proof assembly for sequences of deductions

Given an interpretation I of T , we say that a sequence of T -deductions is Iconsistent if all of its elements are. Then, if X is a set of sequences of deductions, we write X ⊧_{I} [H] ϕ [G] if for all s ∈ X, if s is I-consistent with respect to H then it is also I-consistent with respect to G, and ϕ is true about s.

Let T′ be a fragment of T , and let s be a T -deduction sequence. Then I say that s′ is a T′-fragment of s if |s′| = |s| and for all i ∈ dom s, s′(i) is the T′-fragment of s(i).

Let T_{1} and T_{2} be disjoint fragments of T , and ϕ_{1} is a property about T_{1}- deduction sequences, and ϕ_{2} a property about T_{2}-deduction sequences. Then I write X ⊧_{I} [H] ϕ_{1} ∧ ϕ_{2} [G] if under the hypotheses H, G is guaranteed and ϕ_{1} is true about every T_{1}-fragment of sequences in X, and ϕ_{2} is true about every T_{2} fragment.

Chapter 4. The content of interaction 90

Corollary IXa (Proof assembly for sequences) Let T be an acyclic DQIsystem and I be an interpretation of T . Let T_{1}, …, T_{n} (for n ≥ 1) be disjoint fragments of T , such that T_{1} ∪ … ∪ T_{n} = T and DQI(T_{i})^{ω} ⊧_{I} [H_{i}] ϕ_{i} [G_{i}]. Then if ⋃_{i=1}^{n} H_{i} ⊆ ⋃_{i=1}^{n} \overline{G_{i}} then QI^{ω}(T ) ⊧_{I} ϕ_{1} ∧ … ∧ ϕ_{n}

Proof: Let s ∈ QI^{ω}(T ). We show by transfinite induction on n that every T_{i}- fragment of a prefix of s of length n is I-consistent with respect to H_{i}. Case n = 0: vacuous. Case n = k + 1: By induction, the result holds for the deductions s(1) to s(k). It is trivial to show that under the hypothesis H_{i} that s_{i}(k + 1) is I-consistent with respect to H_{i}, guaranteeing G_{i}. By proof assembly, every T_{i}-fragment of s(k + 1) is I-consistent with respect to H_{i}. Case n = ω: if not, there must exist a finite k for which the k-prefix fails the property. This is contradicted by induction.

Therefore, if we have an s ∈ QI^{ω}(T ) failing to satisfy ϕ_{1} ∧ … ∧ ϕ_{n} then there must be some T_{i} such that the T_{i}-fragment of s fails to satisfy ϕ_{i}. But this can only happen when s is not I-consistent with respect to H_{i}, which we have just seen is impossible. □

4.3.1 Example: Terminating processes type-check

To illustrate this theorem, we prove the other half of the type-checking theorem, that type-checking is sufficient. Here the input rule hypothesizes that the content of the interaction comm(a, v) implies that typof(a) = typof(v), and that the output rule guarantees this consequence.

Proposition 4.13 For all p ∈ P(v), and environments E, T such that E : T, we have that P_{QI}^{(v)} ⊢ E ⇛ p√ if and only if T P ⊢ T ⇛ p.

Proof: We prove that if E : T then P_{QI0}^{(v)} ⊢ E ⇛ p√ iff T P ⊢ T ⇛ p, under the interaction hypothesis that −comm(a, v) implies typof(a) = typof(v), and guaranteeing that +comm(a, v) implies typof(a) = typof(v). Then the result will follow by the proof assembly theorem.

by induction on the depth of inference of E ⇛ p√. Case E ⇒ 0√: trivial. Case E ⇒ p|q√: straightforward induction. Case E ⇒ a!v.p√: this follows when E ⇛ p√ and typof(a) = typof(v) (which guarantees the interaction hypothesis). We know that T ⇛ v : typof(v), so therefore T ⇛ v : typof(a). By induction we know T ⇛ p. Therefore, T ⇛ a!v.p.

Case E ⇒ a!e.p√: this follows from E ⇛ e ⇝ v and E ⇛ a!v.p√. By lemma 4.12(i) we know that T ⇛ e : typof(v). By induction we know that T ⇛ a!v.p, which means typof(a) = typof(v). Therefore T ⇛ e : typof(a), and so T ⇛ a!e.p.

Case E ⇛ a?x.p√: this follows from E[v/x] ⇛ p√. By induction, we know for all T′ such that E[v/x] : T′ that T′ ⇛ p. In particular, this is true when T′ = T [typof(v)/x]. By the interaction hypothesis, T [typof(v)/x] = T [typof(a)/x]. Therefore T ⇛ a?x.p. □

A similar result would be to extend P(:=) with types, and show that only correctly typed processes could evaluate. There the problem is to ensure that the store maintains correct typing. Thus we get two parallel subproofs: one proof for the P(:=) programs, and the other for stores. They depend on each other: the program proof relies on the store proof to maintain correct typing, and guarantees that everything it sends the store is correctly typed. The store proof relies on the program proof to send it correct information, and guarantees that it outputs correct information.

Thus we obtain two kinds of proof dependency: the usual “functional” dependency of the proof for processes on the proof for expressions, and the “interactive” dependency between the proof for stores and the proofs for expressions and processes. The next section illustrates an interactive dependency between subproofs of a nondivergence result.

4.3.2 Example: Another nondivergence proof

In this section, we apply the technique of proof assembly to show that our process calculus P extended with the iterators of section 2.5.1 preserves the nondivergence property of P. In order to use the proof assembly theorem we need some kind of interaction between two different fragments. Therefore we shall treat the iterator constants as process variables which have to be looked up in the store. Thus to prove the nondivergence result, we shall assemble a proof concerning process transitions and a proof concerning the contents of the store.

Let P(it) be the language with the grammar

p ::= 0 | l.p | p|p | It^{n}C.p | C

where n ∈ ℕ and C is a member of Const, a countable set of process constants.

The dynamic semantics is given by the transition system T S_{I} = ⟨P(it), →, Ω⟩ where Ω is the same set of final states as for P and →⊆ P(it) × P(it) is the relation defined by (p, q) ∈→ if and only if P_{I}^{(It)} ⊢ p → q where P_{I}^{(It)} is the DQI-system (L_{I}^{(It)}, R_{I}^{(It)}) such that L_{I}^{(It)} consists of the following judgments

p → q  σ ⇝ σ′  comm(a)  write(C, n, p)  read(C, p)

where σ, σ′ ∈ ItStore which is the set of stores that bind processes to process constants, and the ruleset R_{I}^{(It)} consists of the following rules:

a.p → p −^{comm(a)} ā.q → q

{p → p′ \atop p|q → p′|q}  {q → q′ \atop p|q → p|q′}  \begin{matrix}p → p′ & q → q′ \\ p|q → p′|q′ \end{matrix}
It^{0}C.p → 0  It^{n+1}C. → p[C_{n}/C] −^{write(C,n,p)} σ ⇝ σ[It^{n}C.p/C_{n}]
C → p −^{read(C,p)} {σ(C) = p \atop σ ⇝ σ}

Note that this semantics is quite reckless: it takes no account of scoping. There may be two iterators of C, and if they are executed in parallel then one iterator will overwrite the other. We could simply state a static condition to exclude such processes. Then a nicely bound process would be such that no constant was bound more than once, and every constant occurs bound. However, while nice binding makes sense, it does not affect the nondivergence proof.

Thus this system is just the system P_{I} extended with labels and with rules for iterators and constants. To aid induction, we define the size of p inductively as follows:

|p| = \{ \begin{matrix}1 & if p = 0 or p = C_{n} \\ 1 + |q| & if p = l.q \\ 1 + max(|q_{1}|, |q_{2}|) & if p = q_{1}|q_{2} \\ 1 + n|q| & if p = It^{n}C.q \end{matrix}

Let me say that a process is finite if it can be attributed no infinite deduction sequence. Then the nondivergence proof for processes becomes:

Lemma 4.14(i) For all processes p, under the hypothesis that read(C, q) implies that q is finite, then p is finite, and write(C, n, p) is guaranteed to imply that It^{n}C.p is finite.

Proof: By strong induction on n = |p|. Case n = 1: then there are three subcases, when p = 0, when p = C and when p = It^{0}C.q. The first follows because 0 is attributed no transition sequences; the second from the interaction hypothesis; the third is trivial. Case n = k + 1: There are three sub cases. First, p = l.q: trivial. Second, p = q_{1}|q_{2}: follows from similar reasoning to that in proposition 2.8. Third, p = It^{m+1}C.q: This is the interesting case. Since |It^{m}C.q| < |It^{m+1}C.q|, we know by strong induction that It^{m}C.q is finite. Thus we have guaranteed the condition on write(C, m, q). Since also |It^{m+1}C.q| > |q[C_{m}/C]|, we know by induction that q is finite, and so therefore neither is p. □

I say a deduction sequence attributed to the empty store empty binds finitely if for every prefix of the deduction sequence ending in σ, every constant bound in σ is bound to a finite process.

Chapter 4. The content of interaction 93

Lemma 4.14(ii) Under the interaction hypothesis that write(C, n, p) implies that It^{n}C.p is finite, then every deduction sequence attributed to the empty store binds finitely, and read(C, p) is guaranteed to imply that p is finite.

Proof: by transfinite induction on the length n of prefixes of deduction sequences attributed to the empty store. Case n = 0: vacuous. Case n = k+1: suppose not. Let s be the sequence that does not bind finitely. By induction, we know that the k-length prefix of s binds finitely, so it must be the last store which violates the property. Consider then the last transition: σ ⇝ σ′. There are two cases. Either it is the result of a read transition, in which case σ′ = σ (and therefore the read condition is guaranteed), or it is the result of a write transition, in which case σ′ = σ[It^{n}C.p/C_{n}]. In the first case, σ′ cannot violate the property because σ does not. In the second, we know by the interaction hypothesis that C_{n} is bound to a finite process, and we know σ satisfies the invariant. Contradiction.

Case n = ω: suppose not. Then there must exist a finite first point when the invariant was violated. By induction this is impossible. □

Proposition 4.14 No process in P(it) diverges.

Proof: This follows by the assembly of lemmas 4.14(i) and 4.14(ii) (and of course also by the corollary to the proof assembly theorem). □

4.4 Chapter summary

We extended the treatment of interacting deduction to include an analysis of the content of interaction. Intuitively, this is that which is discussed when two ideas are shared. The result was a more elegant and usable definition, constructed from the two notions of rule application (inference) and interaction assembly (assumption discharge). We obtained the proof fragmentation theorem again, which allows us to ignore contexts of trees, and also the dual proof assembly theorem which allows us to build proofs from proofs concerning individual trees. We saw a simple evaluation-semantics type-checking example, and also a transition-semantics nondivergence proof.

Chapter 4. The content of interaction 94

A Semantics and Logic for CSP

To date my examples have all been extensions of a trivial process calculus P. However, this is not a convincing programming language. Communicating Sequential Processes (CSP) [Hoa78] is the canonical imperative parallel programming language. CSP is widely used in the analysis of concurrent algorithms, and is also the core of the language Occam [Wex89].

In this chapter I give an evaluation semantics for CSP and consider various extensions. There are many different dialects of CSP: I base this account on Plotkin’s [Plo83], explaining differences as I proceed. The major difference is the syntactic simplicity of the judgments.

I also give a compositional Hoare Logic for the partial correctness of CSP and prove it sound with respect to my semantics. This Hoare Logic uses the method of invariants to establish communicative relationships between processes, but unlike other compositional systems, it does not make use of traces.

Section 5.1 describes the syntax and semantics of our version of CSP, which allows top-level parallel composition only. Section 5.2 describes six different alternative features: nested parallelism, communication via shared variables, dynamic process creation, pre-emption, multicasting and recursive procedures. Section 5.3 presents a Hoare Logic for the partial correctness of CSP, and proves it sound.

5.1 A Definition of CSP

5.1.1 Syntax and informal semantics

The abstract syntax of CSP is given by the following EBNF grammar.

programs:

p ::= R :: c | p ∥ p

commands:

c ::= x := e | skip | abort | c; c | if g fi | do g od | R?x | Q!e guarded commands:

g ::= b⇒c | g [] g

expressions:

e ::= v | x | e op e

Chapter 5. A Semantics and Logic for CSP 96

The grammar defines the sets P rog of programs, Com of commands, GCom of guarded commands and Exp of expressions where x ranges over a set V ar of variables, b over a set BExp ⊆ Exp of boolean expressions, op over the set of operators {+, −, ×, ÷, <, ≤} and P, Q and R over a set P id of process identifiers.

Plotkin ignores expressions. We do not because here the treatment of reading and writing variables is important.

Informal semantics

A CSP program is the parallel composition of a collection of sequential processes. Processes do not communicate via shared variables (as in, e.g., Concurrent Pascal [BH83] and Modula [Wir83]). Instead, they communicate via handshaking (or synchronized message-passing), where two processes synchronize, one to send data, and the other to receive it.

Handshaking is not via named channels (as in CCS [Mil89], Concurrent ML [Rep91a], Occam [Wex89] and later versions of CSP [Hoa85]), but by explict addressing. Thus if a variable is shared by two processes, it must remain constant. Each process is identified by a name and communication occurs when a process Q directs output to process R, and R simultaneously receives it from Q. For this scheme to work, each name must refer to a unique process. This is ensured by the static semantics of CSP (which also requires that no process may write to a shared variable) found in section 5.1.2.

The relevant commands are: R!e to evaluate e and send its value to process R; Q?x to input a message from Q and store it in variable x; R :: c to declare the process R to have sequential body c and p_{0} ∥ p_{1} to execute p_{0} and p_{1} in parallel.

The sequential processes are based on the programs of Dijkstra’s Guarded Command Language [Dij76] augmented with the commands for input and output. The syntax is specified in the command, guarded command and expression syntactic categories.

Expression evaluation is straightforward. Constants evaluate to themselves, variables are looked up in the store, and operations are applied to their arguments in the standard way. Unlike [Plo83], expressions (and hence guarded commands) never raise an error.

A guarded command is either primitive (b ⇒ c where b is the guard of c) or the alternative composition of two guarded commands (g_{0} [] g_{1}). The primitive guarded command is Plotkin’s concurrent variant of Dijkstra’s guarded command, b → c. Dijkstra’s command only permits c to be executed if b is true; otherwise it fails. In an alternative composition, only one of the true-guarded commands is selected. If every guard is false then the composition fails as a whole.

Plotkin’s strongly guarded command b⇒c only permits c to be selected if both b evaluates to true and c can proceed (i.e., it is not blocked waiting to communicate). The point of this is to allow external processes to determine which command is selected. If the first action of each command c_{1}, …, c_{n} is a communication, and the guards b_{1}, …, b_{n} all evaluate to true then the alternative composition of b_{1} ⇒c_{1} up to b_{n} ⇒c_{n} will select one of the commands that can successfully communicate at Chapter 5. A Semantics and Logic for CSP 97

selection time. Note that if no true-guarded command can proceed, the guarded command blocks until such time as one can. It does not fail. Thus a guarded command will either fail if no guard is true, block, or select a command.

The command skip does nothing. The sequential composition c_{0}; c_{1} of c_{0} and c_{1} executes c_{0} first and then c_{1} after c_{0} has finished. abort stops the execution of the entire program signalling an error. The conditional if g fi selects and executes a true-guarded command that can proceed from g. If g fails, an error has occurred and the command aborts the program. The repetition command do g od repeatedly executes the guarded command g until it fails.

5.1.2 Static Semantics

We mentioned above that the static semantics for CSP consisted of two conditions: no two processes should share a name, and processes may only share read-only variables. Another important property is the well-typedness of expressions. I could present a separate deduction system for the static semantics, in the manner of [Plo83]; however to do so would distract attention — it would not be used in what follows.

Instead, we shall add a suitable side condition to the parallel composition rule of the dynamic semantics. This side condition depends on the functions F V (c), W V (c) and A(p) that return the variables occurring in c (or p), the variables written to by c (or p), and the agent names given bodies in p respectively. They are defined by the following tables.

v x  e_{1} op e_{2}
F V ∅ {x} F V (e_{1}) ∪ F V (e_{2})
W V ∅ ∅  ∅

Expressions

           x := e  skip abort  c_{0}; c_{1}  if g fi  do g od

F V {x} ∪ F V (e) ∅  ∅  F V (c_{0}) ∪ F V (c_{1}) F V (g) F V (g)
W V  {x}  ∅  ∅  W V (c_{0}) ∪ W V (c_{1}) W V (g) W V (g)

The sequential component

P?x Q!e  p_{0} ∥ p_{1}  R :: c
F V {x} F V (e)  F V (p_{0}) ∪ F V (p_{1})  F V (c)
W V {x}  ∅  W V (p_{0}) ∪ W V (p_{1})  W V (c)
A −  −  A(p_{0}) ∪ A(p_{1})  {R}

The concurrent component

b⇒c  g_{0} [] g_{1}
F V  F V (b) ∪ F V (c)  F V (g_{0}) ∪ F V (g_{1})
W V  W V (c)  W V (g_{0}) ∪ W V (g_{1})

The guarded command component

sorts: Store, IV ar, BV ar, V ar, V al
functions: \begin{matrix}empty : Store \\ ·[·/·] : Store × V al × V ar → Store \\ ·(·) : Store × V ar → V al \end{matrix}

metavars: σ, σ′, …, σ_{0}, σ_{1}, …

equations: empty(x) = 0 if x ∈ IV ar empty(x) = ff if x ∈ BV ar

σ[v/x](x) = v

σ[v/x](y) = σ(y) if y ≠ x

Figure 5–1: Algebraic definition of stores

5.1.3 Auxiliary Definitions: Stores

The semantics of CSP requires a store. Let IV ar be a countable set of integer variables and BV ar be a disjoint countable set of boolean variables. Then a store maps elements of V ar = IV ar∪BV ar to elements of the set V al of values (ranged over by v), consisting of both the integers n and the booleans b. The set Store (ranged over by σ) is defined algebraically in figure 5–1 such that σ(x) returns the value of x in σ, and σ[v/x] updates the value of x to v. A good introduction to algebraic definitions is [Wec92].

5.1.4 Dynamic semantics

This section gives an evaluation DQI-semantics of CSP. The main purpose of this section is to demonstrate that the techniques established in previous chapters scale up to a larger semantics. Note that in appendix B we outline the proof of an equivalence result (proposition B.12) between the following evaluation semantics and a more traditional structural operational semantics. This theorem helps both to explain the nonstandard evaluation judgments and also to improve our confidence that the following semantic definition really does define CSP.

The abortion-free fragment

The dynamic semantics for the abortion-free fragment of CSP can be found in figure 5–2. Let us call the abortion-free fragment CSP. The rules are very concise because the judgments have minimal structure. The following table describes the intended meaning of the abortion-free judgments.

Judgment Intended meaning
R : e → v agent R evaluates e to v
R : c  agent R performs c successfully
R : g  agent R evaluates guard g successfully
R ∗ g  agent R fails to evaluate guard g
p  the agents of p co-operate successfully
σ ⇝ σ′ the agents transform store σ to σ′

Once again, we require two extra judgments: R : set(x, v) and R : out(Q, v). The need for these was discussed in section 3.3 in the context of the language P(;,:=). Figure 5–3 illustrates the evaluation of a simple CSP program.

Aborting programs

The most straightforward way to capture abortion is to use propagation rules, in much the same way as exceptions are propagated in the definition of Standard ML. This increases the number of rules — for each ordinary rule with n premises, n extra propagation rules are required. To aid legibility of the definition, the authors introduce an exception convention (see [HMT90, §6.7]) to minimise the number of rules they have to write.

We can use this technique to capture abortion as follows (we shall give another technique which avoids propagation shortly). We use the following judgments:

Judgment Intended meaning
p†  the agents of p aborted
R † c  agent R aborted while running c
R † g  agent R aborted while evaluating guard g

The rules can be found in figure 5–4. We use abortion contexts to cut down the number of propagation rules required. These are based on the evaluation contexts of [FFHD87] in transition semantics. Their use is cosmetic: when proving results about languages defined with evaluation contexts, we still have to unwind the definition of “context”, which may require an extra lemma.

Our abortion contexts are defined by the following grammar:

G ::= [·] | G [] g | g [] G
A ::= [·] | A; c | if G fi | do G od

Aborting parallel programs is an interesting problem. Hoare [Hoa78, p.668] simply says that “the parallel command terminates successfully only if and when [the processes] have all successfully terminated”. This is a loose specification: the semantics of abort may be either to kill every process simultaneously or to wait until the other processes have terminated (which may not happen).

The second choice is more natural from an implementer’s point of view, and is the semantics given in figure 5–4. It is also easier to express in an evaluation semantics (unlike the transition semantics of [Plo83], where it is marginally easier to express the former).

Chapter 5. A Semantics and Logic for CSP 100 Rules for expressions

R : v → v R : x → v −^{lookup} σ ⇝ σ σ(x) = v ; \begin{matrix}R : e_{1} → v_{1} & R : e_{2} → v_{2} \\ R : e_{1} op e_{2} → app(op, v_{1}, v_{2}) \end{matrix}

Rules for the sequential component

{R : e → v ▶ R : set(x, v) \atop R : x := e}  R : set(x, v) −^{assign} σ ⇝ σ[v/x]
\begin{matrix}R : c_{0} & ▶ & R : c_{1} \\ R : c_{0}; c_{1} \end{matrix}  {R : g \atop R : if g fi}        \begin{aligned}σ ⇝ σ′ & ▶ & σ′ ⇝ σ′′ \\ & σ ⇝ σ′′ \end{aligned}
R : g ▶ R : do g od

            R : do g od

R ∗ g R : do g od

                                                   R : skip

Rules for guards

\begin{matrix}\begin{matrix}R : b → tt & ▶ & R : c \\ R : b⇒c \end{matrix} & {R : b → ff \atop R ∗ b⇒c} \\ {R : g_{0} \atop R : g_{0} [] g_{1}} & {R : g_{1} \atop R : g_{0} [] g_{1}} & \begin{matrix}R ∗ g_{0} & R ∗ g_{1} \\ R ∗ g_{0} [] g_{1} \end{matrix} \end{matrix}

Rules for the concurrent component

R : out(Q, v) −^{comm} Q : R?x −^{assign} σ ⇝ σ′[v/x]
{R : e → v ▶ R : out(Q, v) \atop R : Q!e}  {R : c \atop R :: c}
\begin{matrix}p_{0} & p_{1} \\ p_{0} ∥ p_{1} \end{matrix} F V (p_{0}) ∩ W V (p_{1}) = F V (p_{1}) ∩ W V (p_{0}) = A(p_{0}) ∩ A(p_{1}) = ∅

Figure 5–2: Evaluation semantics rules for the abortion-free fragment of CSP

[figure: \begin{matrix}\begin{matrix}\begin{matrix}R : 1 ⇝ 1 & ▶ & R : set(x, 1) \\ R : x := 1 \end{matrix} & ▶ & \begin{aligned}R : x ⇝ 1 & ▶ & R : out(Q, 1) \\ & R : Q!x \end{aligned} \\ R : (x := 1; Q!x) \end{matrix} ; R :: (x := 1; Q!x) & {Q : R?y \atop Q :: (R?y)} \\ R :: (x := 1; Q!x) ∥ Q :: (R?y) \end{matrix} ; \begin{matrix}\begin{matrix}σ ⇝ σ[1/x] & ▶ & σ[1/x] ⇝ σ[1/x] \\ σ ⇝ σ[1/x] \end{matrix} & ▶ & σ[1/x] ⇝ σ[1/x][1/y] \\ σ ⇝ σ[1/x][1/y] \end{matrix}]

Note that the interaction links are flowing behind the upper inference tree.

Figure 5–3: Evaluation of a simple program

Rules that generate abortion

                     R † abort      {R ∗ g \atop R † if g fi}

Rules that propagate abortion

R : c_{0} ▶ R † c_{1} R † c_{0}; c_{1} R : g ▶ R † do g od

                          R † do g od

R : b → tt ▶ R † c R † b⇒c
{R † c \atop R † A[c]}  {R † c \atop R :: c†}  \begin{matrix}p_{0}† & p_{1} \\ p_{0} ∥ p_{1}† \end{matrix}  \begin{matrix}p_{0} & p_{1}† \\ p_{0} ∥ p_{1}† \end{matrix}  \begin{matrix}p_{0}† & p_{1}† \\ p_{0} ∥ p_{1}† \end{matrix}

Figure 5–4: Abortion rules for CSP Propagation-free abortion rules

We can model self-abortion (and I think also exceptions) without the use of propagation rules. Instead we use the strictly pruned deductions of section 3.4.3. The main observation is that in a sequential process, the leaves of an evaluation deduction after an aborting command are sequenced. Therefore, if we ensure that aborting commands can only be deduced using the pruning rule, everything sequenced after an abort will be pruned too (in a strictly pruned deduction). That is, the program sequenced after the aborting command will not be evaluated.

Figure 5–5 contains the rules. The special formula “abort” cannot be deduced by any rule except pruning. We use the formula “aborted” to indicate that abortion has occurred. The scoping of the abort signal ensures that we cannot ignore this indicator.

Note that it makes use of the scoping condition borrowed from section 3.4.4. It has to be redefined for the current context:

Let Π be a DQI-deduction, let X be a set of copremises of Π and let L be a set of formula perspectives. Then X scopes L in Π if for all A, B ∈ O(Π) and α ∈ L,

(i) if AI_{α}B and A ≳_{Π} X then B ≳_{Π} X
(ii) D(Π) ∩ (O(Π) × L) = ∅

where I_{α} is the set of α-labelled interactions of Π, and A ≳_{Π} X means that A ≳_{Π} B for some B ∈ X. Thus if X scopes L in Π, then either both ends of an L-labelled interaction must occur above X or both ends must not. Again we write the side-condition graphically

{P^{1} ⋯ P^{n} _{L} P \atop C}

to mean that {P_{1}, …, P_{n}} scopes L in whatever deduction the rule atom is applied to. In a deduction, we draw a box around the scoped trees.

For these rules to make sense, we have to stress that the pruning rule is used only to terminate aborted programs. That is, for each program p, we take the deductions to be the limits of the chains in CSP_{⊥}^{(†)}(p). These deductions will also include deadlocking evaluations, and other stuck states. The following deduction is an example, where g_{1} = tt ⇒skip and g_{2} = tt ⇒abort:

tt → tt ▶ R : skip

tt → tt ▶ \begin{matrix}⊥ \\ abort \end{matrix} ; R : abort

\begin{matrix}⊥ \\ R : do g_{1} [] g_{2} od \end{matrix}

aborted

K

R : tt ⇒skip

R : g_{1} [] g_{2} ▶

R : tt ⇒abort

R : g_{1} [] g_{2} ▶

R : do g_{1} [] g_{2} od R : do g_{1} [] g_{2} od

R :: do g_{1} [] g_{2} od†

abort ; R : abort

−^{abort}

aborted

R ∗ g ▶ abort

                                     R : if g fi

−^{abort}

aborted

\begin{matrix}R : c aborted & K \\ R :: c† \end{matrix}  \begin{matrix}R : c & K \\ R :: c \end{matrix}

\begin{matrix}p_{0}† & p_{1} \\ p_{0} ∥ p_{1}† \end{matrix} \begin{matrix}p_{0} & p_{1}† \\ p_{0} ∥ p_{1}† \end{matrix} \begin{matrix}p_{0}† & p_{1}† \\ p_{0} ∥ p_{1}† \end{matrix}

Where K = {abort}. These rules are added to the rule of CSP_{⊥} except for the old naming rule, which is replaced by the two naming rules above. Call the resulting system CSP_{⊥}^{(†)}.

Figure 5–5: Propagation-free abort rules for CSP_{⊥}

5.2 Some alternative features

We consider ways of capturing the semantics of six different alternative features, intended to capture different aspects of concurrent languages. It turns out that four extensions require the scoping side-condition.

The alternative features are: • Nested parallelism • Shared variables • Dynamic Process Creation • Pre-emption • Multicasting • Recursive Procedures

5.2.1 Nested Parallelism

If a program has nested parallelism it means that the parallel composition operator can occur arbitrarily deeply in a program, not just at the top level. The simplest way to introduce this is to add an extra production to the syntax of commands:

c ::= … | [p]

Where p ∈ P rog. The major difficulty is one of scope. If we can name processes arbitrarily then we can introduce holes in the scope of namings, where a parallel composition nested in R may include another process named R. Within that nested composition, all communications naming R will refer to the inner process. Outside it, all communications naming R will refer to the outer process. For instance, consider the two programs

R :: [Q :: R!1 ∥ R :: Q?x] ∥ Q :: skip
R :: [Q :: skip ∥ R :: Q?x] ∥ Q :: R!1

Chapter 5. A Semantics and Logic for CSP 104

the first will not deadlock, whereas the second will. This means that the obvious

rule for [p], namely {p \atop R : [p]} , is not sufficient — it would not force the second

example to deadlock. There is no notion of scoping. Therefore we use the scoping side-condition.

\begin{aligned}p & AGENT S(p) \\ & R : [p] \end{aligned}

where AGENT S(p) = {comm(R, Q, v) | v ∈ V al and R ∈ A(p) or Q ∈ A(p)} is the set of all labels that record a communication with an agent defined in the top level of p.

5.2.2 Shared Variables

CSP communicates by message-passing. The alternative way to communicate is via shared variables. This requires mutual exclusion primitives such as semaphores [Dij65] or monitors [Hoa74]. Concurrent Pascal [BH83], Modula [Wir83], and the communication paradigm Linda [BCGL88] use shared variables to communicate.

It is easy to introduce shared variables to our semantics: we drop the “no shared variable” condition from the static semantics. To add mutual exclusion primitives is harder. Mutual exclusion is the function of the await command [OG76]:

                           await b then c

where c does not contain a nested await , communication or parallel composition. When a process attempts to execute an await command, it is delayed until b is true. Then c is executed as an indivisible action. If a number of processes are awaiting b, only one may proceed when b is true. The evaluation of b is treated as if it were part of the indivisible action c. This implies some kind of scheduling mechanism, but we do not need to build one into the semantics.

One can use this primitive to code semaphores. If s is a binary semaphore (a variable with value 0 or 1) then the operations P (s) (wait until s is free, i.e., s = 0, and then grab it) and V (s) (signal that s is free) can be coded:

P (s) await s = 0 then s := 1
V (s) s := 0

The await command is not intended as a practical programming language feature: it is too powerful to be implemented efficiently. But it does embody all the relevant semantic features of mutual exclusion and synchronization. The semantic rule for await is given by:

R : b → tt ▶ R : c  σ ⇝ σ′ _{ST ORE}

                   R : await b then c

−^{atomic}

σ ⇝ σ′

Where ST ORE is the set of all assign and lookup labels. That is,

ST ORE = \begin{matrix}\{assign(x, v) | x ∈ V ar, v ∈ V al\}∪ \\ \{lookup(x, v) | x ∈ V ar, v ∈ V al\} \end{matrix}

Chapter 5. A Semantics and Logic for CSP 105

The scoping condition forces every store interaction of the evaluation of b and the execution of c to be with the inference tree above the σ ⇝ σ′ premise of the await rule atom. No outside process can interfere with this internal store tree. When c has finished, the outer, world copy of the store is altered (in one step — i.e., atomically) according to how the atomic action altered it.

5.2.3 Dynamic process creation

The next feature we wish to consider is dynamic process creation, such as the spawn function in Concurrent ML [Rep91b]. In the version of CSP with nested parallelism, if the parallel composition of a number of processes is composed sequentially before c (say), then c will only be executed after all of the processes have terminated.

The behaviour of spawn is different. Once a process has been spawned the spawning process can proceed immediately, executing concurrently with the new process. One does not usually find parallel composition and spawn together in a language, so this “extension” is not really an extension. Instead, we remove parallel composition from our language, and add a spawn command, to get:

\begin{matrix}p ::= R :: c \\ c ::= ⋯ | spawn (Q, c) \end{matrix}

Where Q ∈ P id. For the dynamic semantics, we introduce a special thread judgment to provide a place where spawned processes can be evaluated:

thread(X) R : spawn (Q, c) − Q : c thread(X \ {Q}) thread(X ∪ {Q}) R ∉ X

The judgment thread(X) is simply a space-filler, where X denotes the set of process identifiers not in use. The condition X ∪{Q} in the conclusion of the second atom of the second rule ensures that Q is not already being used, and X \ {Q} ensures that no other process can use it.

5.2.4 Pre-emption

A control feature is pre-emptive if it can influence the behaviour of another process. Common pre-emptive features are interruption, restart, checkpointing, alternation (all in [Hoa85, §5.4]), abortion and suspension (in [Ber93a]).

[Ber93a] distinguishes two forms of pre-emption: must pre-emption where the parallel processes are pre-empted instantaneously and may pre-emption where the pre-emption may be delayed for an arbitrarily large period of time. This latter form of pre-emption is the only one which can be defined in CSP or CCS, because they have no intrinsic notion of time. In chapter 6 I show that the computational semantics of DQI-deduction is (a subset of) the CCS. This implies that we cannot use our system of evaluation semantics to model must pre-emption, and therefore languages like Esterel [BG92].

5.2.5 Multicasting

Multicasting is sending a message to a collection of named processes. It is a generalisation of the point-to-point communication paradigm we have been considering so far. It is a restriction of broadcasting which sends a message to every process. We extend the syntax of CSP commands to become

\begin{matrix}c ::= & ⋯ | ⟨P idlist⟩!e \\ P idlist ::= & P id | P id, P idlist \end{matrix}

Intuitively, R : ⟨Q_{1}, …, Q_{n}⟩!e will evaluate e and send it to each process Q_{1}, …, Q_{n} simultaneously. (Of course there is a static condition: no process ought to multicast to itself.) We use the structure of DQI-systems in an essential way to give us a collection of building bricks, out of which we can build chains of communications.

\begin{aligned}R : e → v & ▶ & R : ms(Q_{1}, …, Q_{n}, v) \\ & R : ⟨Q_{1}, …, Q_{n}⟩!e \end{aligned}

R : ms(Q_{1}, …, Q_{n}, v) ms(R, Q_{1}, …, Q_{n}, v)

\overline{ms}(R, x_{1}, …, x_{i−1}, Q_{i}, …, Q_{n}, v) {1 ≤ i ≤ n \atop Q_{i} : R?x_{i}} ms(R, x_{1}, …, x_{i}, Q_{i+1}, …, Q_{n}, v)

\overline{ms}(R, x_{1}, …, x_{n}, v) σ ⇝ σ[v/x_{1}] … [v/x_{n}]

Broadcasting (e.g. [Pra91,Pra93]) could be implemented in a similar manner, but it requires that the semantic rules maintain a central record of nonterminated processes. This is a problem in its own right.

5.2.6 Procedures

We introduce procedures and block structure to CSP. Let P roc be a set of procedure names (ranged over by π). Then we extend the grammar of commands to include three new constructs:

c ::= … | proc π(x) is c | π(e) | var x = v in c

The first defines a procedure π with parameter x (it is a straightforward extension to handle many parameters) to have body c. The second calls procedure π with argument the value of e. The third declares variable x to have initial value v with scope c.

Procedures introduce non-local flow-of-control into programs: the definition of a procedure will not be part of a program’s local structure. Consequently, there may be a difference in variable bindings when a procedure is defined and when it is invoked. The question is which binding to look up when running a procedure. The static binding discipline is to use the define-time variable bindings. The dynamic binding discipline is to use the call-time variable bindings.

Chapter 5. A Semantics and Logic for CSP 107

A simple store-based approach is no longer sufficient. The reason is one of scope: a variable may refer to different locations at different times. For instance, a procedure call may temporarily rebind a variable.

Therefore, modeling the binding disciplines requires both environments and stores. An environment maps variables to store locations Loc and procedure names to procedure closures. A closure is either static or dynamic, depending on the binding discipline. Intuitively, a static closure is a triple ⟨x, c, E⟩ which parcels up the formal parameter x, the body c and the define-time environment E (thus environments and static closures are mutually dependent notions).

Formally, we define the Static Environments, SEnv to be the set ⋃_{i∈ℕ} SEnv_{i} where

\begin{matrix}SEnv_{0} = V ar ⇀ Loc \\ SEnv_{i+1} = SEnv_{i} ∪ (P roc ⇀ V ar × Com × SEnv_{i}) \end{matrix}

This scheme is sufficient to allow us to define recursive procedures (and also, with more work, families of mutually recursive procedures [Mit].) An alternative approach, using coinduction, is to allow infinite closures that model recursively defined procedures directly [MT92,Sch95].

A dynamic closure is a pair ⟨x, c⟩. Formally, we define the Dynamic Environments, DEnv to be the set

DEnv = (V ar ⇀ Loc) ∪ (P roc ⇀ V ar × Com)

We use E to range over both SEnv and DEnv, and σ to range over stores in Stores. The definition is the same as in section 5.1.3 except that it maps locations in Loc to values in V al. We introduce a special judgment to record environments: R : E means that the environment of process R is E. (In a shared variable context, the environment would be global like the store.) The rules for the extension of CSP can be found in figure 5–6, where we have abbreviated labels to their names for clarity.

The rules depend on the auxiliary definition ENV (R). This is the set of all environment accessing labels (i.e., the def, call, read and write labels) that mention R. Its precise definition is similar to that of ST ORE:

ENV (R) = \begin{matrix}\{def(R, π, x, c) | π ∈ P rocs, x ∈ V ar, c ∈ Com\}∪ \\ \{call(R, π, x, c, E) | π ∈ P rocs, x ∈ V ar, c ∈ Com, E ∈ Env\}∪ \\ \{block(R, E, n, v) | E ∈ Env, n ∈ ℤ, v ∈ V al\}∪ \\ \{read(R, x, v) | x ∈ V ar, v ∈ V al\}∪ \\ \{write(R, x, v) | x ∈ V ar, v ∈ V al\} \end{matrix}

The main rules are the first two, which deal with procedure definition and invocation. We have only given one half of these rules: they can be completed to support static or dynamic binding. The rule fragments for static binding are:

\begin{matrix}−^{\overline{def}(R,π,x,c)} & {R : E[⟨x, c, E⟩/π] \atop R : E} \\ −^{\overline{call}(R,π,x,c,E′)} & \begin{aligned}R : E & E(π) = ⟨x, c, E′⟩ \\ & R : E \end{aligned} \end{matrix}

Chapter 5. A Semantics and Logic for CSP 108

R : proc π(x) is c −^{def(R,π,x,c)}

\begin{matrix}R : c R : E[n/x] _{ENV (R)} & n ∉ dom E \\ R : call(π, v) \end{matrix} − σ ⇝ σ[v/n] −^{call(R,π,x,c,E)}

\begin{aligned}R : e ⇝ v & ▶ & R : call(π, v) \\ & R : π(e) \end{aligned}

R : c R : E[n/x] _{ENV (R)}  n ∉ dom E
R : var x = v in c

−^{block} {R : E \atop R : E} −^{assign}

σ ⇝ σ[v/n]

R : x ⇝ v −^{read} {R : E \atop R : E} −^{lookup} {σ(E(x)) = v \atop σ ⇝ σ}

R : x ⇝ v −^{write} {R : E \atop R : E} −^{assign} σ ⇝ σ[v/E(x)]

R : out(Q, v) − Q : R?x −^{write} {Q : E \atop Q : E} −^{assign} σ ⇝ σ[v/E(x)]

R : E

Figure 5–6: DQI-Rules for recursive procedures and blocks While the rule fragments for dynamic binding are:

\begin{matrix}−^{\overline{def}(R,π,x,c)} & {R : E[⟨x, c⟩/π] \atop R : E} \\ −^{\overline{call}(R,π,x,c,E)} & \begin{aligned}R : E & E(π) = ⟨x, c⟩ \\ & R : E \end{aligned} \end{matrix}

This example is quite untidy: it shows that while we can add environments and procedures “in a modular way”, if we do so, we end up with a mess. It would probably be better to attach environments to evaluation judgments explicitly, especially since each process has its own environment.

5.3 An Application: Program Verification

Program verification is an important area of computer science: in the real world, erroneous programs cause disasters. It follows that “correctness” and “safety” proofs (i.e., proofs that programs meet some specification) are important.

But programs are complex, which means that reasoning about them will be complex too. We need to minimise the cost of verification. One way is to reason in a syntax-directed manner: one inserts assertions about the state of the world between program statements and shows that the program satisfies them [Flo67]. For instance, if we have a program x := 0; y := 1, we might add assertions

{true} x := 0 {x = 0} y := 1 {x = 0 ∧ y = 1}

which tell us what we know about the store after each atomic step of the program.

The question is how to prove that a program satisfies these assertions. There is a wide variety of techniques: for instance, weakest preconditions [Dij76], “Hoare Logics” [Hoa69], specification logic [Rey81], evaluation logic [Pit91], dynamic logic [Har84], and other modal and temporal logics [Sti92].

We consider a “Hoare Logic” for the partial correctness of CSP programs. Since our version of CSP does not have full procedures, this approach is “quite satisfactory” [OPTT95]. (The problem with procedures is that they can introduce aliasing which means that differently named variables can interfere with each other. See op. cit. for a full discussion.)

A Hoare Logic is really a deductive system whose judgments relate pre- and post-conditions to program statements. The judgments are of form {ϕ} c {ψ}, and intuitively mean “if ϕ is true immediately before executing c then ψ is true immediately after”. [Apt81] is a comprehensive survey of Hoare Logics for sequential while-languages. [Hoo86] is a survey of deductive systems for partial correctness of CSP.

There are three main points motivating this application. First, it is an example application: we can use (a modified form of) CSP to prove the rules of the Hoare Logic sound. Second, it is distinct from previous Hoare Logics because it is an Chapter 5. A Semantics and Logic for CSP 110

DQI-system in its own right. Third, because it is a DQI-system, it demonstrates an application of our work outside the sphere of operational semantics.

To illustrate the method, we consider the ubiquitous greatest common divisor algorithm, as implemented by the program GCD:

i := m; j := n; do i > j ⇒ i := i − j []j > i ⇒ j := j − i

                       od

The program is intended to run in the situation where both m and n are constants greater than zero. We have to prove that when started in this situation, the program will terminate such that i = j = gcd(m, n). That is, we want to prove

{m > 0 ∧ n > 0} GCD {i = j = gcd(m, n)}

Figure 5–7 gives our deductive system for CSP. For the moment, we ignore the concurrency rules, and use the sequential system to prove the above program correct. The deduction is too big to write on the page, so instead we give the following proof outline [AO91] which can be thought of as a flattened deduction:

{m > 0 ∧ n > 0} i := m;

{m > 0 ∧ n > 0 ∧ i = m}

j := n; {m > 0 ∧ n > 0 ∧ i = m ∧ j = n} {gcd(i, j) = gcd(m, n)}

do i > j ⇒ \begin{matrix}\{gcd(i − j, j) = gcd(m, n)\} \\ i := i − j \\ \{gcd(i, j) = gcd(m, n)\} \end{matrix}

[]j > i ⇒ \begin{matrix}\{gcd(i, j − i) = gcd(m, n)\} \\ j := j − i \\ \{gcd(i, j) = gcd(m, n)\} \end{matrix}

                 od

{gcd(i, j) = gcd(m, n) ∧ i = j}

The proof depends on the well-known fact about the greatest common divisor:

i > j ∧ gcd(i, j) = gcd(m, n) ⊃ gcd(i − j, j) = gcd(m, n)

In the following we shall abbreviate proof outlines to record only the essential information.

Verifying concurrent programs

Verifying concurrent programs is much harder. The reason is that one often wants to verify relationships that hold between processes. In a strictly compositional system (such as [MC81] or [ZdBdR83]) one has to break global relationships of Chapter 5. A Semantics and Logic for CSP 111

processes into invariant properties of communication. It is not clear how to break global relationships of distributed algorithms such as the distributed GCD algorithm [AO91].

Levin and Gries’s proof system for CSP [LG81] splits the verification process into two halves. First, one proves properties about the sequential processes in isolation. Second, one proves an interference freedom result (in the spirit of Owicki-Gries’s method [OG76]) to show that no process inadvertently falsifies the assertions of another process. CSP processes do not share variables, but in this system they can share the auxiliary variables (so one can prove global relationships using global auxiliary variables). The main problem here is that the interference freedom test “if approached mechanically, is an awesome task” [LG81, p291]. To reduce the work, one has to structure one’s program and choose assertions carefully.

Apt et al.’s proof system [AFdR80] also splits the verification process into two halves. However, it forbids even auxiliary variables to be shared between processes. Again first, proofs about the sequential processes are done, and then global relationships are established second (the “co-operation proof”). This approach handles global relationships naturally. However, the co-operation proof also involves a large amount of work, having to consider every syntactically matching pair of communication commands.

These approaches are not compositional, and so are not suited to aid program development. The advantage of strictly compositional proof systems are that one knows if one’s program is correct as soon as one has a proof outline for the program. Therefore one can develop one’s programs in a modular manner.

The deductive system in figure 5–7 is compositional, belonging to the school of [ZdBdR83], yet is inspired by the rules of [AFdR80]. We shall use it to deduce that a simple set partitioning program is correct.

A Set Partitioning program

This is taken from [AFdR80], and assumes that CSP is extended to include sets of integers and operations for manipulating them. The modifications required to the semantics are trivial.

Given two disjoint sets of integers S and T, the problem is to partition S ∪ T into S′ and T′ such that |S| = |S′| and |T | = |T′| and max(S′) < min(T′). The solution is given in the following program SP = p_{1} ∥ p_{2}, where p_{1} and p_{2} are

Q_{1} :: mx := max(S); Q_{2}!mx; S := S \ \{mx\}; Q_{2}?x; S := S ∪ \{x\}; mx := max(S); do mx > x ⇒ \begin{matrix}Q_{2}!mx; S := S \ \{mx\}; \\ Q_{2}?x; S := S ∪ \{x\}; \\ mx := max(S); \end{matrix} od and Q_{2} :: Q_{1}?y; T := T ∪ \{y\}; mn := min(T); Q_{1}!mn; T := T \ \{mn\}; do true ⇒ \begin{matrix}Q_{1}?y; T := T ∪ \{y\}; \\ mn := min(T); \\ Q_{1}!mn; T := T \ \{mn\}; \end{matrix} od

Chapter 5. A Semantics and Logic for CSP 112

respectively. Intuitively, processes p_{1} and p_{2} own S and T respectively. The program repeatedly swaps the greatest element of S and the least element of T until the greatest element of S is less than the least element of T.

5.3.1 A Hoare Logic for the partial correctness of CSP

Our deductive system is similar to Misra and Chandy’s system in that it is compositional and uses rely and guarantee conditions. It does not require an interferencefreedom or co-operation proof. It is dissimilar in that it does not use trace variables. It is similar to Levin and Gries’s system in that a special class of auxiliary variables called views can be shared between communicating processes. Last, it is similar to Apt et al.’s system in that no auxiliary variable can be used globally.

In the following, I assume a first-order language L of assertions with equality and sets over V ar ranged over by ϕ, χ, ψ. I use the symbols ∧ for conjunction and ⊃ for implication. Let T r_{L} be the set of true sentences of L (perhaps described by some other deductive system). Let F V : L → ℘(V ar) be a function which returns the set of program variables contained in an assertion. Similarly, I use the function F V defined in section 5.1.2 that returns the set of variables mentioned in a program fragment.

The rules in figure 5–7 are mostly similar to those of [LG81,AFdR80]. (I leave their dependence on the set T r_{L} implicit.) The rule for do-loops uses the following auxiliary function

Gu(g) = \{ \begin{matrix}b & if g = b⇒c \\ Gu(g_{1}) ∨ Gu(g_{2}) & if g = g_{1} [] g_{2} \end{matrix}

The main difference lies with the concurrent rules. One feature is that the rule for parallel composition is quite simple. Another is that the rules for communication have dangling interactions. Each dangling interaction is labelled with a special formula that expresses an invariant property of the communicated information.

Views When process R transmits the value of expression e to Q, we say that Q has a view of the value of e in R. Now R knows what Q’s view of e will be since it sent it. Thus there exists a natural class of information which is shared between communicating processes. We model this information using a special class of auxiliary variables called views, which may be altered only at communication, and which are shared between communicating processes.

However, views will not be related to particular expressions (i.e., data) but to particular occurrences of output commands in the program (i.e., locations). The reason is that expressions may play different roles at different parts of a program, whereas each part of a program plays one well-defined role, established by its preand post- conditions in a proof outline. The “role” of a location in a particular deduction is formalised by a special property called the communication invariant. This is the information that is shared with a communicating process about the actual message. In fact, it can be thought of as an abstract message.

Chapter 5. A Semantics and Logic for CSP 113

Actually, it is more convenient to identify sets of locations that play the same role, and associate communication invariants with sets of locations. For instance, in our example program, process p_{1} sends the maximum element of S from two locations. It makes sense and simplifies reasoning to have one view of the maximum element of S.

In what follows, I use u, w to range over sets of occurrences of output commands in programs, and I shall annotate programs to indicate how output occurrences are referred to in proofs. I write \underline{u} for the view of u.

Counters The proof technique works by associating invariant properties to each view. The proof outline at the output command occurrence u ought to guarantee that the invariant property holds of \underline{u}. Then the proof outline at an input command occurrence can rely on that invariant property. But this depends on the fact that we know which input commands communicate with which output commands. To do this, we introduce special auxiliary views called counters which return the last view shared between two communicating processes. Initially, we set the counters to a special null value, written ⊥. There will be two counters for every pair of processes: \underline{QR} records R’s last view of Q (i.e., the last communication from Q to R) and \underline{RQ} records Q’s last view of R. These counters have to be maintained by the communication invariants. As a convention, for every program we use R⃗Q for the set of all occurrences in R that output to Q.

Communication Invariants Typical communication invariants relate old and new values of views. At the communication rules, we write \underline{u}′ for the new value of view u and \underline{RQ}′ for the new value of the counter RQ. It is a temporary name used when working out the postcondition of the input rule. It does not itself occur in any pre- or postcondition. I write ψ^{♮} for the result of de-priming every primed view or counter in ψ. So, for example, (\underline{u}′ = 5)^{♮} is \underline{u} = 5. This operation occurs in the conclusion of the input rule.

Let V iews be the set of all views and counters. I also assume a function vw : L → ℘(V iews) that returns the set of views and counters mentioned in an assertion. Note that views and counters may not appear in a program. Last, I write V V : L → ℘(V iews ∪ V ar) for the function V V (ϕ) = F V (ϕ) ∪ vw(ϕ).

Rules for Input and Output

The only complex rules are the ones for input and output. The output rule is simpler, so we explain it first. All it has to do is show that the precondition implies the postcondition and guarantees the appropriate communication invariant. The main difficulty is that we have to update the appropriate view and counter. Since this is like an assignment, we borrow the “backward assignment” idea and write

ϕ = ψ[e/\underline{u}][u/\underline{RQ}]

where ϕ is the precondition, ψ the postcondition, u the relevant location and the communication sends e from R to Q. This is straightforward. To guarantee the Chapter 5. A Semantics and Logic for CSP 114

Rules for the sequential component

{ϕ} skip {ϕ}_{R}  {ϕ[e/x]} x := e {ϕ}_{R}
\begin{matrix}\{ϕ\} c_{1} \{ψ\}_{R} & \{ψ\} c_{2} \{χ\}_{R} \\ \{ϕ\} c_{1}; c_{2} \{χ\}_{R} \end{matrix}  {\{ϕ\} g \{ψ\}_{R} \atop \{ϕ\} if g fi \{ψ\}_{R}}

{\{ϕ\} g \{ϕ\}_{R} \atop \{ϕ\} do g od \{ϕ ∧ ¬Gu(g)\}_{R}}

Rules for guards

{\{ϕ ∧ b\} c \{ψ\}_{R} \atop \{ϕ\} b⇒c \{ψ\}_{R}}  \begin{matrix}\{ϕ\} g_{1} \{ψ\}_{R} & \{ϕ\} g_{2} \{ψ\}_{R} \\ \{ϕ\} g_{1} [] g_{2} \{ψ\}_{R} \end{matrix}

Rules for the concurrent component

−^{+CI} \begin{matrix}ϕ = ψ[e/\underline{u}][u/\underline{RQ}] & ϕ ⊃ CI(u)[e/\underline{u}′][u/\underline{RQ}′] \\ \{ϕ\} u : Q!e \{ψ\}_{R} \end{matrix}
−^{−CI} {∀u ∈ Q⃗R. ϕ ∧ CI(u) ⊃ ψ[\underline{u}′/x] ∧ \underline{QR}, \underline{u} ∉ V V (ψ) \atop \{ϕ\} Q?x \{ψ^{♮}\}_{R}}

{\{ϕ\} c \{ψ\}_{R} \atop \{ϕ\} R :: c \{ψ\}}

\begin{matrix}\{ϕ_{1}\} p_{1} \{ψ_{1}\} & \{ϕ_{2}\} p_{2} \{ψ_{2}\} \\ \{ϕ_{1} ∧ ϕ_{2}\} p_{1} ∥ p_{2} \{ψ_{1} ∧ ψ_{2}\} \end{matrix}

Logical rules

\begin{aligned}ϕ ⊃ ϕ′ & \{ϕ′\} c \{ψ′\} & ψ′ ⊃ ψ \\ & \{ϕ\} c \{ψ\} \end{aligned}  \begin{aligned}ϕ ⊃ ϕ′ & \{ϕ′\} p \{ψ′\} & ψ′ ⊃ ψ \\ & \{ϕ\} p \{ψ\} \end{aligned}

Figure 5–7: A Hoare Logic for the partial correctness of CSP Chapter 5. A Semantics and Logic for CSP 115

communication invariant, we need values for the temporary new view \underline{u}′ and new counter \underline{RQ}′. But since we are sending the message, we know both these values: e and u respectively. Thus we show

ϕ ⊃ CI(u)[e/\underline{u}′][u/\underline{RQ}′]

The input rule is more complex because we do not know the values of the new view and new counter. These have to be supplied by the communication invariant. However, we do not know which communication invariant gives the right answers. Therefore for soundness, we have to check that the postcondition follows from the conjunction of the precondition and each communication invariant. This would be restrictive were it not for the counters. Suppose the communication is from R to Q. The precondition to the input rule should know what the current value of the counter \underline{RQ} is. Then every communication invariant CI(u) which asserts a different value for this counter will contradict the precondition, from which anything (in particular the desired postcondition) follows. The correct communication invariant will entail the desired postcondition naturally. The idea is related to Lamport’s at predicates [LS84].

Once again, we have to fiddle with the primed views and counters. For each viewable location u we show two things. First that

ϕ ∧ CI(u) ⊃ ψ[\underline{u}′/x]

which allows the postcondition to contain references to the variable x which receives the information (in particular it allows us to prove the important fact x = \underline{u}′ trivially). Second that

ϕ ∧ CI(u) ⊃ \underline{RQ}, \underline{u} ∉ V V (ψ)

which is really a condition on the kinds of postcondition we allow. Essentially, this ensures that when we deprime ψ to adopt the new values of the view and counter we do not conflict with the old values.

5.3.2 An example partial correctness proof

In this section, we show SP to be partially correct using our Hoare Logic. We simply prove the result: it will be appraised in section 5.3.4. The bulk of the proof concerns the deduction of p_{1}, and we need an auxiliary variable T′ in p_{1} that represents p_{1}’s view of T in p_{2}. To keep T′ up to date we need auxiliary communications of T. The bodies of the two processes become:

Q_{1} :: Q_{2}?T′; mx := max(S); Q_{2}!mx; S := S \ \{mx\}; Q_{2}?x; S := S ∪ \{x\}; Q_{2}?T′; mx := max(S); do mx > x ⇒ \begin{matrix}Q_{2}!mx; S := S \ \{mx\}; \\ Q_{2}?x; S := S ∪ \{x\}; \\ Q_{2}?T′; \\ mx := max(S); \end{matrix} od and Q_{2} :: Q_{1}!T; Q_{1}?y; T := T ∪ \{y\}; mn := min(T); Q_{1}!mn; T := T \ \{mn\}; Q_{1}!T; do true ⇒ \begin{matrix}Q_{1}?y; T := T ∪ \{y\}; \\ mn := min(T); \\ Q_{1}!mn; T := T \ \{mn\}; \\ Q_{1}!T; \end{matrix} od

Chapter 5. A Semantics and Logic for CSP 116

We label the output occurrences Q_{2}!mx in p_{1}, u; the two occurrences of Q_{1}!mn in p_{2}, w_{1}; and the three occurrences of Q_{1}!T in p_{2}, w_{2}. The communication invariants are

\begin{matrix}CI(u) = & \underline{Q_{1}Q_{2}} ∈ \{⊥, u\} ∧ \underline{Q_{1}Q_{2}}′ = u \\ CI(w_{1}) = & \underline{Q_{2}Q_{1}} = w_{2} ∧ \underline{Q_{2}Q_{1}}′ = w_{1} ∧ \underline{w_{1}}′ ≤ \underline{u} \\ CI(w_{2}) = & \underline{Q_{2}Q_{1}} ∈ \{⊥, w_{1}\} ∧ \underline{Q_{2}Q_{1}}′ = w_{2} \begin{matrix}∧ (\underline{Q_{2}Q_{1}} = ⊥ ⊃ \underline{w_{2}}′ = T_{0}) \\ ∧ (\underline{Q_{2}Q_{1}} = w_{1} ⊃ \underline{w_{2}}′ = \underline{w_{2}} ∪ \{\underline{u}\} \ \{\underline{w_{1}}\}) \end{matrix} \end{matrix}

The abbreviated proof outline for the modified forms of p_{1} and p_{2} can be found in figures 5–8 and 5–9 respectively. Applying the parallel composition and consequence rules, we get

{|S| = n_{1} > 0, |T | = n_{2} > 0, S = S_{0}, T = T_{0}, S ∩ T = ∅}

SP
{S ∩ T = ∅, S ∪ T = S_{0} ∪ T_{0}, max(S) < min(T)}

Which is the desired result.

5.3.3 Soundness of the Hoare Logic

The above proof only works if the proof rules are valid — i.e, if they make sound inferences from sound premises. [Sti88,Apt83] prove validity for Hoare Logics of concurrent languages using a transition-style operational semantics. [ZdRvEB85] proves validity for their Hoare Logic of DNP (a CSP variant) with respect to a denotational semantics of process traces. In this section, we sketch a proof of the validity of our Hoare Logic with respect to a modification of our evaluation semantics CSP.

The meaning of programs and all that

The soundness proof is going to be split into two: one half for the sequential component and one half for the concurrent component. In this subsection we modify CSP to incorporate a semantic account of views and counters. We also define some auxiliary notations and definitions including an important interference-freedom property of deductions. Last we define the meaning of a program to be the set of all interference-free deductions of the program.

Views and Counters in CSP The required modification to CSP is slight. It consists of two changes. In the following I shall use u, w to range over occurrences of output commands, and I shall write u : Q!e if Q!e is occurrence u in the overall program. Let us extend the function vw to range over commands and programs: let vw(c) (or vw(p)) return the set of views of output occurrences in c (or p). Let V V = F V ⊕ vw as before.

First, we replace the rules for communication with the following:

\begin{matrix}\begin{aligned}R : e → v & ▶ & R : out(Q, v, u, σ) \\ & R : u : Q!e \end{aligned} & {R : in(Q, x, v, u, σ) \atop R : Q?x} \\ R : out(Q, v, u, σ) & −^{out(R,Q,v,u,σ)} & σ ⇝ σ[v/x][v/\underline{u}][u/\underline{RQ}] & −^{in(R,Q,x,v,u,σ)} & Q : in(R, x, v, u, σ) \end{matrix}

\{|S| = n_{1} > 0, S = S_{0}, S ∩ T′ = ∅, T′ = T_{0}, \underline{Q_{2}Q_{1}} = \underline{Q_{1}Q_{2}} = ⊥\}

Q_{1} :: Q_{2}?T′;  \{… \underline{w_{2}} = T_{0}, \underline{Q_{2}Q_{1}} = w_{2}\}

mx := max(S);  {… mx = max(S)}

u : Q_{2}!mx; \{… mx = \underline{u}, \underline{Q_{1}Q_{2}} = u\}

S := S \ {mx};

\{… S ≠ S_{0}, S ∩ (T_{0} ∪ \{\underline{u}\}) = ∅, S ∪ (T_{0} ∪ \{\underline{u}\}) = S_{0} ∪ T_{0}\}

Q_{2}?x;  \{… x = \underline{w_{1}} ≤ \underline{u}, \underline{Q_{2}Q_{1}} = w_{1}\}

S := S ∪ {x};

\{… S ∩ (T_{0} ∪ \{\underline{u}\} \ \{\underline{w_{1}}\}) = ∅, S ∪ (T_{0} ∪ \{\underline{u}\} \ \{\underline{w_{1}}\}) = S_{0} ∪ T_{0}\}

Q_{2}?T′;

\{… T′ = \underline{w_{2}}, S ∩ T′ = ∅, S ∪ T′ = S_{0} ∪ T_{0}, \underline{Q_{2}Q_{1}} = w_{2}\}

mx := max(S);

do mx > x ⇒  {LI_{1}}

u : Q_{2}!mx; S := S \ {mx};

\{…, mx = \underline{u}, \underline{Q_{1}Q_{2}} = u,

S ∩ (T′ ∪ \{\underline{u}\}) = ∅, S ∪ (T′ ∪ \{\underline{u}\}) = S_{0} ∪ T_{0}\}

Q_{2}?x; S := S ∪ {x};

\{… x = \underline{w_{1}} ≤ \underline{u}, \underline{Q_{2}Q_{1}} = w_{1}, S ∩ (T′ ∪ \{\underline{u}\} \ \{\underline{w_{1}}\}) = ∅, S ∪ (T′ ∪ \{\underline{u}\} \ \{\underline{w_{1}}\}) = S_{0} ∪ T_{0}\}

Q_{2}?T′;

\{… T′ = \underline{w_{2}}, S ∩ T′ = ∅, S ∪ T′ = S_{0} ∪ T_{0},

\underline{Q_{2}Q_{1}} = w_{2}\}

mx := max(S); {LI_{1}}

od

\{|S| = n_{1} > 0, S ∩ \underline{w_{2}} = ∅, S ∪ \underline{w_{2}} = S_{0} ∪ T_{0}, max(S) = \underline{w_{1}}, …\} Where LI_{1} is the loop invariant:

\begin{aligned}LI_{1} : & |S| = n_{1} > 0, T′ = \underline{w_{2}}, x = \underline{w_{1}}, \underline{Q_{2}Q_{1}} = w_{2}, \\ & S ∩ T′ = ∅, S ∪ T′ = S_{0} ∪ T_{0}, max(S) = mx ≥ x \end{aligned}

Figure 5–8: An abbreviated proofoutline for p_{1} Chapter 5. A Semantics and Logic for CSP 118

\{|T | = n_{2} > 0, T = T_{0}, \underline{Q_{1}Q_{2}} = \underline{Q_{2}Q_{1}} = ⊥\}

Q_{2} :: w_{2} : Q_{1}!T; \{… \underline{Q_{2}Q_{1}} = w_{2}, \underline{w_{2}} = T_{0}\}

Q_{1}?y;  \{… \underline{Q_{1}Q_{2}} = u, y = \underline{u}\}
T := T ∪ \{y\}; \{… T = \underline{w_{2}} ∪ \{\underline{u}\}, |T | = n_{2} + 1\}
mn := min(T); \{… mn = min(\underline{w_{2}} ∪ \underline{u})\}

w_{1} : Q_{1}!mn; \{… \underline{w_{1}} ≤ \underline{u}, \underline{Q_{2}Q_{1}} = w_{1}\}

T := T \ \{mn\}; \{… T = (\underline{w_{2}} ∪ \{\underline{u}) \ \underline{w_{1}}\}, \underline{w_{1}} < min(T)\}

w_{2} : Q_{1}!T; \{… T = \underline{w_{2}}, \underline{Q_{2}Q_{1}} = w_{2}\}

do true ⇒ {LI_{2}}

Q_{1}?y;  \{… \underline{Q_{1}Q_{2}} = u, y = \underline{u}\}
T := T ∪ \{y\}; \{… T = \underline{w_{2}} ∪ \{\underline{u}\}, |T | = n_{2} + 1\}
mn := min(T); \{… mn = min(\underline{w_{2}} ∪ \underline{u})\}

w_{1} : Q_{1}!mn; \{… \underline{w_{1}} ≤ \underline{u}, \underline{Q_{2}Q_{1}} = w_{1}\}

T := T \ \{mn\};  \{… T = (\underline{w_{2}} ∪ \{\underline{u}) \ \underline{w_{1}}\}, \underline{w_{1}} < min(T)\}

w_{2} : Q_{1}!T; {LI_{2}}

                od

\{|T | = n_{2}, T = \underline{w_{2}}, min(T) > \underline{w_{1}}\} Where LI_{2} is the loop invariant

|T | = n_{2}, T = \underline{w_{2}}, min(T) > \underline{w_{1}}, \underline{Q_{1}Q_{2}} = u, \underline{Q_{2}Q_{1}} = w_{2}

Figure 5–9: An abbreviated proofoutline for p_{2} Chapter 5. A Semantics and Logic for CSP 119

There are three differences. First, the judgment R : out(⋯) has been extended to contain more variables. Second, we have a new judgment R : in(⋯) which also includes variables not in the input command. These extra variables are used when hypothesizing and guaranteeing communication invariants. The third change is that the store judgment has been extended to update views and counters and also altered to interact with both the input and output commands. (Thus in this system every interaction involves the store.) Formerly, it did not interact with the output atom. This is to facilitate reasoning about the shared views and counters.

The second change is to add a null store transition:

σ ⇝ σ

This alteration is done purely to simplify the following definitions and proofs. For convenience, let us also call this modified system CSP (this brooks no confusion: we never refer to the old system in this section).

Assertions and stores Let ⊧⊆ Store × L be a relation such that σ ⊧ ϕ if the values of variables (or views) in σ satisfy the assertion ϕ (i.e., substituting the variables in ϕ with their values in σ returns a sentence in T r_{L}). Technically, the relation should be subscripted by T r_{L}, but we omit this to ease clutter.

Interference Freedom: programs and commands Intuitively, a deduction Π is interference free over a set of views (output occurrences) and variables X if no element of X is altered in the store by a process outside Π. That is, every update of an element of X must be sanctioned by an interaction link in Π. That is, the behaviour of the program fragment of Π with respect to that part of the store pertinent to X is fully specified by the deduction. For assignment and lookup, this means that there can be no assign or lookup dangling interactions in Π that mention variables in X. However, since both sides of a communication interact with the store, we can allow one of the interactions to dangle; though if Π contains the output command, then it cannot be the out link, and if it contains the input, it cannot be the in link.

Therefore we say a CSP-deduction Π is interference-free with respect to a set of variables and output occurrences X (written Π✓X) if for all (A, α) ∈ D(Π),

\begin{matrix}(i) & F V (α) ∩ X = ∅ \\ (ii) & vw(α) ∩ X = ∅ or α = ±in(⋯) \end{matrix}

Condition (i) asserts interference freedom on variables; condition (ii) states that either no relevant view occurs, or if it does, it occurs in an input link. (Note that if Π contains both input and output commands of an interaction then condition (i) will ensure that the input link is intact, and (ii) that the output link is intact.)

Proposition 5.0 Let Σ ⊢ σ ⇝ σ′ be interference-free with respect to X. Then for all ϕ such that V V (ϕ) ⊆ X, if σ ⊧ ϕ then σ′ ⊧ ϕ.

Proof: Straightforward induction on size(Σ). □

Chapter 5. A Semantics and Logic for CSP 120

Accessible views and variables The assertions of a sequential process may refer to any variable in that process. We want to ensure that if a command does not mention certain variables or views, then their values will remain untouched. So, whenever we reason about the meaning of a command, we shall want to talk about those deductions that are interference-free with respect to the entire set of views and variables in the sequential process. We define

Acc(R, p) = \{ \begin{matrix}V V (c) & if p = R :: c \\ ∅ & if p = Q :: c and R ≠ Q \\ Acc(R, p_{1}) ∪ Acc(R, p_{2}) & if p = p_{1} ∥ p_{2} \end{matrix}

For the set of views and variables accessible by process R in p.

The meaning of commands and programs The meaning of a command (program) will be the set of all its deductions which are interference-free over the variables accessible by the command (program). Thus the meaning of a command c belonging to process R in program p is defined to be the set

M_{(R,p)}[c] = {Π ∈ DQI(CSP) | Π ⊢ R : c, σ ⇝ σ′ and Π✓Acc(R, p)}

We really need to restrict attention to the deductions which are interference-free on Acc(R, p). It is not enough to assert interference-freedom for the views and variables of the particular program fragment c, because the pre- and post-assertions of c may refer to any view or variable accessible to R.

The meaning of a program p

M[p] = {Π ∈ DQI(CSP) | Π ⊢ p, σ ⇝ σ′and Π✓V V (p)}

The meaning of Hoare Triples is easily defined by

⊧_{(R,p)} {ϕ} c {ψ} iff

for all Π ∈ M_{(R,p)}[c], if Π ⊢ R : c, σ ⇝ σ′ and σ ⊧ ϕ then σ′ ⊧ ψ

⊧ {ϕ} p {ψ} iff for all Π ∈ M[p], if Π ⊢ p, σ ⇝ σ′ and σ ⊧ ϕ then σ′ ⊧ ψ

The meaning of a Hoare triple can be paraphrased “for every deduction fragment of c (or p) interference-free on every variable or view in c (or p), such that ϕ holds before executing it, ψ holds afterwards”.

Notes on Communication Invariants In the following, let us write ⊢_{(R,p)}^{CI} {ϕ} c {ψ} if the Hoare triple is provable in the above system, when c is a command occurrence of R in p, and the communication invariants are given by CI : V iews → L. Moreover, we say a set of deductions X is CI-input correct if for all Π ∈ X, for all occurrences of form R : in(Q, x, v, u, σ) ∈ O(Π), σ ⊧ CI(u)[v/\underline{u}′][u/\underline{QR}′]. Similarly, we say a set X of deductions is CI-output correct if for all Π ∈ X, for all occurrences of form R : out(Q, x, v, u, σ) ∈ O(Π), σ ⊧ CI(u)[v/\underline{u}′][u/\underline{RQ}′].

A convenient notation and related results

To aid the following proof, we use the following notation. Let Π_{1} ⊢ A_{1}, σ ⇝ σ′ and Π_{2} ⊢ A_{2}, σ′ ⇝ σ′′. Then we write Π = Π_{1} ▶ Π_{2} if Π is the deduction

[figure: \begin{matrix}Π_{1} & Π_{2} \\ A_{1}, σ ⇝ σ′ & A_{2}, σ′ ⇝ σ′′ \\ \begin{aligned}A_{1} & ▶ & A_{2} \\ & A_{3} \end{aligned} & \begin{aligned}σ ⇝ σ′ & ▶ & σ′ ⇝ σ′′ \\ & σ ⇝ σ′′ \end{aligned} \end{matrix}]

Note that in CSP, A_{3} is uniquely determined by A_{1} and A_{2}. We extend the notation: if Σ_{1} ⊢ σ ⇝ σ′ and Σ_{2} ⊢ σ′ ⇝ σ′′ we write Σ_{1} ▶ Σ_{2} for the deduction of σ ⇝ σ′′ with children Σ_{1} and Σ_{2} in sequence.

Proposition 5.1 (Store Reshuffling) Let Σ ∈ DQI(CSP) be such that Σ ⊢ σ ⇝ σ′. Let X ⊆ D(Σ) be upwards closed with respect to ≲_{Σ}. Then there exists a store σ′′ and CSP-deductions Π_{1} ⊢ σ ⇝ σ′′ and Π_{2} ⊢ σ′′ ⇝ σ′ such that X = D(Π_{2}) and Σ ≃ (Π_{1} ▶ Π_{2}).

Proof: By induction on n = |X| × size(Σ). Case n = 0: Two cases: either |X| = ∅ or size(Σ) = 0. We set

\begin{matrix}Π_{1} = Σ \\ Π_{2} =σ′ ⇝ σ′ \end{matrix}  and  \begin{matrix}Π_{1} =σ ⇝ σ \\ Π_{2} = Σ \end{matrix}

respectively. In both cases, the other conditions are satisfied trivially. Case n > 0: We have Σ = (Σ_{1} ▶ Σ_{2}) where Σ_{1} ⊢ σ ⇝ σ′′ and Σ_{2} ⊢ σ′′ ⇝ σ′. There are two cases. First, either X ⊆ D(Σ_{2}), in which case by induction there exists Π_{21} and Π_{22} such that Σ_{2} ≃ (Π_{21} ▶ Π_{22}) and D(Σ_{2}) = D(Π_{22}). Then we set Π_{1} = (Σ_{1} ▶ Π_{21}) and Π_{2} = Π_{22}, and the conditions follow trivially.

Second, X ∩ D(Σ_{1}) ≠ ∅ (in which case D(Σ_{2}) ⊆ X as X is upwards closed). Let Y = X ∩ D(Σ_{1}). Clearly X = Y ∪ D(Σ_{2}). By induction, there exists Π_{11} and Π_{12} such that Σ_{1} ≃ (Π_{11} ▶ Π_{12}) and Y = D(Π_{12}). Then we set Π_{1} = Π_{11} and Π_{2} = (Π_{12} ▶ Σ_{2}), and the conditions follow trivially. □

Proposition 5.2 Let Π ⊢ A_{3}, σ ⇝ σ′ be a CSP deduction such that A_{3} is introduced by a rule atom instance with premises A_{1} ▶ A_{2}. Then there exist σ′′ and CSP-deductions Π_{1} ⊢ A_{1}, σ ⇝ σ′′ and Π_{2} ⊢ A_{2}, σ′′ ⇝ σ′ such that Π = Π_{1} ▶ Π_{2}.

Proof: (Sketch) essentially, the command judgment occurrence A_{3} is deduced from the deduction concluding A_{1} and A_{2}. We want to split the tree concluding σ ⇝ σ′ into two subtrees concluding σ ⇝ σ′′ and σ′′ ⇝ σ′, such that the first subtree interacts only with the tree concluding A_{1} and the second interacts only with that concluding A_{2}. The precise details of how this is done are tedious.

Chapter 5. A Semantics and Logic for CSP 122

Briefly: first we break every interaction link of Π. Second, we isolate the set of dangling interactions that used to interact with the tree concluding A_{2}. Then we take its upper closure (with respect to <_{Π}) and apply proposition 5.1 to build the two desired subtrees. Reassembly is easy because proposition 5.1 alters neither the set of dangling interactions above the store tree, nor the relative dependencies between the dangling interactions. Therefore, one can apply the interaction reflection theorem using the identity function to get the result. □

Soundness for commands

Lemma 5.3(i) If ⊢_{(R,p)}^{CI} {ϕ} c {ψ}_{R} and M_{(R,p)}[c] is CI-input correct then ⊧_{(R,p)} {ϕ} c {ψ}_{R} and M_{(R,p)}[c] is CI-output correct.

Proof: By induction on the depth of inference of ⊢ {ϕ} c {ψ}. We shall only give the cases for input, output and sequential composition: all the rest follow by simpler arguments. Case {ϕ} Q?x {ψ}_{R}. Let Π ∈ M_{(R,p)}[Q?x] be such that Π ⊢ R : Q?x, σ ⇝ σ′ and σ ⊧ ϕ.

The bottom-most command rule in Π will be the input rule. This depends on the premise R : in(Q, x, v, u, σ_{0}) for some store σ_{0}. By CI-input correctness, σ_{0} ⊧ CI(u)[v/\underline{u}′][u/\underline{QR}′] (♠).

Now, since Π is interference-free on all variables and views accessible to R, this means that any writes to x in the store must be marked by an interaction link between the appropriate store transition formula occurrence and command evaluation formula occurrence. But in Π, the only formula occurrence the store can interact with is R : in(Q, x, v, u, σ_{0}). Let

−^{out(Q,R,v,u,σ_{0})}σ_{0} ⇝ σ_{0}[v/x][v/\underline{u}][u/\underline{QR}] −^{in(Q,R,x,v,u,σ_{0})}R : in(Q, x, v, u, σ_{0})

for some σ_{0} be this single instance of the input rule in Π. By interference freedom, we know that this rule instance is the only one that can change an accessible variable or view. Therefore, since σ ⊧ ϕ so also σ_{0} ⊧ ϕ (proposition 5.0). By ♠, we get σ_{0} ⊧ ϕ ∧ CI(u)[v/\underline{u′}]. Together with the premise to the input rule, we get σ_{0} ⊧ (ψ[v/x])[v/\underline{u′}][u/\underline{QR}′]. Since u, QR ∉ V V (ψ), we get σ_{0} ⊧ (ψ[v/x])[v/\underline{u′}][u/\underline{QR}′]^{♮}, i.e., σ_{0} ⊧ (ψ^{♮})[v/x][v/\underline{u}][u/\underline{QR}]. Therefore σ_{0}[v/x][v/\underline{u}][u/\underline{QR}] ⊧ ψ^{♮}. Last, by interference-freedom (and proposition 5.0) we know that no other variable or view accessible to R in p is altered in Π. Therefore σ′ ⊧ ψ^{♮}.

Case {ϕ} u : Q!e {ψ}. Let Π ∈ M_{(R,p)}[Q!e]. Then Π ⊢_{(R,p)} R : Q!e, σ ⇝ σ′′ and σ ⊧ ϕ. From the premises of the Hoare rule, σ ⊧ ψ[e/\underline{u}][u/\underline{RQ}] and also (by modus ponens), σ ⊧ CI(u)[e/\underline{u}′][u/\underline{RQ}′]. Now R : Q!e is inferred from R : e → v and R : out(Q, v, u, σ_{0}) for some σ_{0} (sequenced in that order). Therefore, σ ⊧ ψ[v/\underline{u}][u/\underline{RQ}] and σ ⊧ CI(u)[v/\underline{u}′][u/\underline{RQ}′]..

By interference freedom (and proposition 5.0), we know that Π must contain an instance of the rule fragment

R : out(Q, v, u, σ_{0}) −^{out(R,Q,v,u,σ_{0})}σ_{0} ⇝ σ_{0}[v/x][v/\underline{u}][u/\underline{RQ}] −^{in(R,Q,x,v,u,σ_{0})}

Moreover, it also follows from interference freedom that since R : Q!e does not write to any variables of R, the accessible variables will remain untouched. The only accessible view altered is \underline{u}, and we know how that is altered. Therefore, for every σ_{0} mentioned in Π, since σ_{0} ⊧ ϕ, we know σ_{0} ⊧ CI(u)[v/\underline{u}′][u/\underline{RQ}′]. Thus Π is CI-output correct.

We also know σ_{0} ⊧ ϕ, and so also trivially σ_{0}[v/\underline{u}][u/\underline{QR}] ⊧ ψ, and so also by interference freedom (and proposition 5.0), σ′ ⊧ ψ.

Case {ϕ} c_{1}; c_{2} {ψ}. If ⊢_{(R,p)} {ϕ} c_{1}; c_{2} {ψ} then it was inferred from ⊢_{(R,p)} {ϕ} c_{1} {χ} and ⊢_{(R,p)} {χ} c_{2} {ψ} for some cut-formula χ.

Let Π ∈ M_{(R,p)}[c_{1}; c_{2}] be such that Π ⊢_{(R,p)} R : c_{1}; c_{2}, σ ⇝ σ′ and σ ⊧ ϕ. By proposition 5.2, we can find σ′′ and two deductions Π_{i} ∈ M_{(R,p)}[c_{i}] for i = 1, 2, such that Π_{1} ⊢ R : c_{1}, σ ⇝ σ′′ and Π_{2} ⊢ R : c_{2}, σ′′ ⇝ σ′ such that Π = Π_{1} ▶ Π_{2}. Now, if M_{(R,p)}[c_{1}; c_{2}] is CI-input correct, so must M_{(R,p)}[c_{i}] be, since the input occurrences of c_{1}; c_{2} is the union of the input occurrences of c_{1} and c_{2}.

Therefore, by induction, ⊧_{(R,p)} {ϕ} c_{1} {χ} and ⊧_{(R,p)} {χ} c_{2} {ψ}. Therefore, whenever σ ⊧ ϕ, we get σ′′ ⊧ χ and so σ′ ⊧ ψ. Similarly, M_{(R,p)}[c_{1}; c_{2}] will be CI-output correct because M_{(R,p)}[c_{1}] and M_{(R,p)}[c_{2}] are. □

Soundness of Programs

Lemma 5.3(ii) If ⊢ {ϕ} p {ψ} and M[p] is CI-input correct then ⊧ {ϕ} p {ψ} and M[p] is CI-output correct.

Proof: by induction on p. Case p = R :: c: the result follows from lemma 5.3(i). Case p = p_{1} ∥ p_{2}: let Π ∈ M[p_{1} ∥ p_{2}] be such that Π ⊢ p_{1} ∥ p_{2}, σ ⇝ σ′ and σ ⊧ ϕ_{1} ∧ ϕ_{2}. We remove the bottom parallel composition rule to get Π_{0} ⊢ p_{1}, p_{2}, σ ⇝ σ′. Now, let Π_{1}, Π_{2} be the fragments of Π_{0} such that Π_{i} ⊢ p_{1}, σ ⇝ σ′ and Π_{i}✓V V (p_{i}), for i = 1, 2. Thus, the only interaction links broken to get Π_{i} are the links between the store trees and the tree concluding p_{3−i} (for i = 1, 2).

Now we get Π_{i} ∈ M_{p′}[p_{i}] (i = 1, 2). Therefore, by induction, we get ⊧ {ϕ_{i}} p_{i} {ψ_{i}} (for i = 1, 2). That is, if σ ⊧ ϕ_{i} then σ′ ⊧ ψ_{i}. Since σ ⊧ ϕ_{1} ∧ ϕ_{2}, we get σ′ ⊧ ψ_{1} ∧ ψ_{2}. □

The previous lemma shows that the deductive system is sound for programs whenever the meaning of a command is CI-input correct. This condition can only be guaranteed in the context of the entire program. To complete the soundness proof, we simply have to show that CI-input correctness is guaranteed by CIoutput correctness.

Chapter 5. A Semantics and Logic for CSP 124

We say p ∈ P rog is whole if every process identifier mentioned in p is bound to a process in p. Then interference-freedom implies that for whole p, M[p] ⊆ QI(CSP) (essentially because every output occurrence viewed in p will occur in p.)

Proposition 5.3 If ⊢ {ϕ} p {ψ} then ⊧ {ϕ} p {ψ} when p is whole.

Proof: Suppose ⊢ {ϕ} p {ψ} where p is whole. By lemma 5.3(ii), if M[p] is CI-input correct, then ⊧ {ϕ} p {ψ} and M[p] is CI-output correct.

Now, since M[p] ⊆ QI(CSP), if we break every in- and out-labelled interaction of every deduction in M[p] to get X, we have X ⊆ DQI(CSP). Then input- and output-correctness correspond to the following interaction hypotheses and guarantees:

(1) +out(R, Q, v, u, σ) : σ ⊧ CI(u)[v/\underline{u}′][u/\underline{RQ}′] guaranteed
(2) −out(R, Q, v, u, σ) : σ ⊧ CI(u)[v/\underline{u}′][u/\underline{RQ}′] hypothesized
(3) +in(R, Q, v, u, σ) : σ ⊧ CI(u)[v/\underline{u}′][u/\underline{RQ}′] guaranteed
(4) −in(R, Q, v, u, σ) : σ ⊧ CI(u)[v/\underline{u}′][u/\underline{RQ}′] hypothesized

(1) is guaranteed by output correctness. (3) is guaranteed under the hypothesis of (2). Hypothesizing (4) allows us to prove the first half of input-correctess. Thus we have the following result: for all Π ∈ DQI(CSP), under the above interaction hypotheses, if Π ∈ X and ⊢^{CI} {ϕ} p {ψ} then if Π ⊢ p, σ ⇝ σ′ and σ ⊧ ϕ then σ′ ⊧ ψ and the above guarantees are guaranteed. By proof assembly, we can discharge the interaction hypotheses and guarantees to get soundness. □

5.3.4 Appraisal

The first thing to notice is that the actual proof system for the Hoare Logic did not make much use of the dangling interactions. They only seemed to remove the need to propagate the communication invariant everywhere. This is reminiscent of the convention employed in [ZdBdR83] to avoid propagating their assumption and commitment conditions.

The burden of proof

The most obvious thing about the partial correctness proof of section 5.3.2 was that although there were two processes which performed roughly equal amounts of work, the burden of the proof fell on one process (see figure 5–8). The role of the other process was to maintain communication invariants (and to show that \underline{w_{1}} < max(T)).

Thus the proof technique seems to enforce a master-slave paradigm on the processes: the bulk of the proof is performed in the master, and the slaves simply fill in the appropriate gaps. This was acceptable for our example SP, but it is more difficult for programs such as the distributed greatest common divisor program DGCD given in [AO91]. Here we wish to find the common divisor of n numbers.

Chapter 5. A Semantics and Logic for CSP 125

We build a ring of identical processes, each of which owns one of the variables. At each step of the algorithm each process either sends its value to the next processor or accepts a value of the previous one. It then adjusts its value accordingly.

To prove this correct, I had to postulate a special observer process which at each step read the values from each processor and showed that the set of all the values satisfied a global invariant condition. (That is, at each step, the gcd of all the values equalled the gcd of the original values.)

The most obvious problem is that if we modify the communicative behaviour of the processes to continually pass around important values, how do we know if the original program is correct? In our example, it should be clear that the auxiliary communications do not upset the original communications, but this might not always be so evident.

I believe that with more work this problem could be circumvented in a straightforward manner. One solution might be to “piggy-back” the auxiliary communications on top of existing communications. One would send tuples of views, each of which would have to be broken into their consituents by the communication invariant at the input commands.

More speculatively, we might rectify the anomalous distribution of work in a proof by introducing global communication invariants. The idea here would be to introduce a special “broadcasting” primitive (purely for auxiliary communications) to access the global invariant. The idea would be that each view of a broadcasting location would be globally accessible. Associated to each broadcast view would be a global invariant. Each broadcast would have to show that it maintained the invariant. It is unlike the input and output rules in that the global views would be accessible everywhere in the proof outline. That is, the global invariant would have to be propagated everywhere. However, at the moment, this is an idea I have not pursued very far.

Of this and other Hoare Logics

Another point of interest is that our Hoare Logic for CSP is very simple. It is simpler than the systems of Apt et al. [AFdR80] and Levin and Gries [LG81] in that it is a compositional, one-level system. It is more compositional than that of Lamport et al. [LS84], in that our invariants are decomposed at the parallel rule. Last, it is simpler than those of Misra and Chandy [MC81] and Zwiers et al. [ZdBdR83,ZdRvEB85] because it does not use trace variables. However, I think we could easily maintain trace variables manually for those programs whose correctness proof requires them (e.g., rebound sorting [Oss83, §4]).

The soundness proof

The soundness proof was very simple. It required a minimal number of concepts. Structurally, it was just an assembly of a simple inductive proof. However, somewhat ironically, the proof could have been even simpler if we had not fragmented the store and program judgments. Since CSP processes do not interfere Chapter 5. A Semantics and Logic for CSP 126

via shared variables, we could have used traditional natural semantics judgments of form R : c, σ ⇒ σ′ and p, σ ⇒ σ′. Most of the rules would have been straightforward — the only two interesting cases would have been the communication and parallel composition rules:

R : Q!v, σ_{1} ⇒ σ_{1}[v/\underline{u}][u/\underline{RQ}] −^{comm} Q : R?x, σ_{2} ⇒ σ_{2}[v/x][v/\underline{u}][u/\underline{RQ}] ; \begin{matrix}p_{1}, (σ ↾ V V (p_{1})) ⇒ σ_{1} & p_{2}, (σ ↾ V V (p_{2})) ⇒ σ_{2} \\ p_{1} ∥ p_{2}, σ ⇒ σ_{1} ⊕ σ_{2} \end{matrix}

Where σ ↾ X is an operation to restrict the domain of the store, and σ_{1} ⊕ σ_{2} is an operation to overwrite σ_{1} with σ_{2}. These would have to be defined algebraically.

In this setting we would not have needed to prove propositions 5.1 and 5.2. The fact that at least the first proof is modular is irrelevant. Thus we have seen a case where fragmentation is not always useful. However, the technique we have seen would be applicable for soundness proofs of Hoare Logics for concurrent languages with shared variables.

Proving Deadlock-freeness

One important property we should like to prove about CSP programs is that processes are deadlock-free. I do not currently know how we could prove this directly within our Hoare Logic, since it is a property of the system as a whole.

[AFdR80] prove deadlock-freeness by extending their two-level proof system to reason about the set of all blocked states of a program. Deadlock-freeness follows when every blocked states fails a global invariant test. It is not clear how to do this compositionally: [MC81] say it is impossible.

Total Correctness

However, given such a technique we can alter the Hoare Logic in a standard way to prove the total correctness of CSP programs. Following [Apt83], we say a program is totally correct if it is partially correct, terminates, does not abort, and is deadlock-free. We know how to obtain partial correctness proofs. Termination (or more properly, non-nontermination) can be achieved with a modification of the repetitive rule:

\begin{aligned}ϕ(0) ⊃ ¬Gu(g) & ϕ(n + 1) ⊃ Gu(g) & \{ϕ(n + 1)\} g \{ϕ(n)\}_{R} \\ & \{∃n.ϕ(n)\} do g od \{ϕ(0)\}_{R} \end{aligned}

Non-abortion can be proved by altering the alternative composition rule:

\begin{matrix}ϕ ⊃ Gu(g) & \{ϕ\} g \{ψ\}_{R} \\ \{ϕ\} if g fi \{ψ\}_{R} \end{matrix}

Relative completeness (in the sense of Cook)

I do not know if our Hoare Logic is complete relative to the set of true sentences of the assertion language L. If it is not, I would be surprised if we could not rectify the situation by adding some extra logical rules and rules for manipulating auxiliary variables — every other Hoare Logic seems to have them.

I think such a completeness proof would follow using the standard technique of strongest postconditions. The strongest postcondition of a program and precondition SP (p, ϕ) is such that σ ⊧ SP (p, ϕ) if and only if

∃σ′.σ′ ⊧ ϕ ∧ ∃Π ∈ M[p].Π ⊢ p, σ′ ⇝ σ

This would require an assertion language sufficiently expressive to code the semantics. (For instance the language of Peano arithmetic.) Then the completeness proof would proceed in two steps. First, to show that if ⊧ {ϕ} p {ψ} then SP (p, ϕ) ⊃ ψ, and second to show that for all p and ϕ, ⊢ {ϕ} p {SP (p, ϕ)}. This should follow by induction on the structure of programs.

5.4 Chapter Summary

This chapter uses interacting deductions to give a semantics to CSP. The point was to show that we could extend our techniques to less trivial languages, and to more usable proofs. We considered how to model various different concurrent features in the evaluation semantics setting, mostly with success. One interesting feature was that we could give propagation-free rules for abortion.

We saw in section 5.2.4 that evaluation semantics is not well suited to specifying pre-emptive primitives. Also, we saw that it is not well suited to features that operate on a snapshot of the entire system of processes (e.g., broadcasting and global abort).

An important lesson was that modularity may sometimes be achieved at the expense of other desirable properties of semantics. We saw this twice. First, in section 5.2.6, we gave a modular semantics for recursive procedures. (That is, we added the rules for procedures to CSP without changing any of the original rules.) The result was a mess. One feels that environments ought to be bound closely to judgments. Second, in the soundness proof of the Hoare Logic, because we separated the store judgments from the program judgments, we had to do more work, both in defining the notion of interference-freedom, and also in having to prove proposition 5.1. Neither would have had to have been done if we had not fragmented rules. (Of course this example is mitigated by the fact that the fragmented stores could be useful in other contexts.)

Another lesson, gleaned from section 5.2 was that the scoping condition was ubiquitous.

Finally, in section 5.3, we saw a very simple Hoare Logic for the partial correctness of CSP. This in itself is an achievement. (There were some difficulties, but future work should solve them.) One nice feature was that despite the above Chapter 5. A Semantics and Logic for CSP 128

reservations, its soundness proof was very easy using the evaluation semantics and proof assembly. In fact the above reservations suggest that the proof could be made even easier.

The process calculus interpretation

So far I have only given a syntactic account of interacting deductions. Now I intend to give a semantic account. This account is intended to explain why we can call DQI-systems like CSP operational semantics. This chapter shows that the computational content of an interacting deduction is a set of traces of some CCS-like process. Using Heyting’s idea that the meaning of a formula is the set of its deductions, the meaning of an “evaluation” judgment like “R : c” is a set of evaluations of a process corresponding to R : c. In this sense CSP is an operational semantics.

On a more practical level, the result indicates that in principle we can use process calculus simulators (e.g., languages like Pict [PT95], or tools such as the Concurrency Workbench [CPS89,CWB] or similar [IP91], perhaps with some modification) to build prototype interpreters for languages from semantic definitions. This is similar to the way that Typol systems use Prolog to build prototypers for Natural Semantics definitions [Des84].

In fact process evaluation is a semidecision procedure which is a natural analogue to the tableaux method. Another corollary of this result is that we can obtain suitable models for deductive systems.

We can also go in the reverse direction, and show that every evaluation of a CCS process corresponds to the deduction of a certain formula. A corollary is that there is no procedure that decides if a set of occurrences is deducible in an arbitrary DQI-system.

The heart of this chapter is section 6.2 which contains both the interpretation and its soundness and completeness results. Section 6.1 describes the relevant preliminaries, and section 6.3 explores the aforementioned consequences.

6.1 Preliminaries

6.1.1 On formula occurrences

The heart of our semantic theorem depends upon the close association of a formula in a deductive system with a process constant defined in some corresponding system of equations. A technicality is that deductions concern formula occurrences. There is no formal notion of constant occurrences in process calculus, because one can easily distinguish different occurrences of a constant in a term according to their positions in the (abstract syntax tree of the) term.

There is no notion of position in a set — that is, sets are not rigid objects. Therefore, in order to map sets of formula occurrences into process terms which are rigid, I introduce a total order over the set of all formula occurrences of a language that will distinguish one enumeration of any set of occurrences.

Let ⊴_{L} be a total order over the formulae in L. (For brevity we omit the subscript L: it will always be clear which language is intended.) When our language is defined algebraically from a finite number of constructors — as one would expect a language of operational judgments to be — some kind of gödelnumbering [Men79] of the terms and formulae will provide this total order. A crucial point is that the gödelnumbering function is primitive recursive, which means that the total order over formulae is decidable.

I lift ⊴ to be an order on formula occurrences and formula perspectives. In chapter 2 I said that a formula occurrence was a pair (A, n) where A is a formula and n is a natural number. Thus the total order ⊴ over occurrences is just the lexicographic order over pairs (A, n):

(A, n) ⊴ (A′, n′) iff A ⊴ A′ or (A = A′ and n ≤ n′)

I write A ⊲ B if A ⊴ B and A ≠ B.

The total order ⊴ over formula perspectives is obtained by ignoring the sign information:

(A, s) ⊴ (A′, s′) iff A ⊴ A′

Thus both +A ⊴ −A and vice-versa. This property is required on page 136 when I define an order over D(Π) from a history of Π. It is important that connectable dangling interactions are assigned equal position in that order: this is used in the proof of lemma X(i) (specifically, near the middle of page 138).

As a convention, unless otherwise stated, whenever I write Π ⊢ A_{1}, …, A_{n} I also mean A_{1} ⊴ … ⊴ A_{n}. Also, when I write sets of premise occurrences {P_{1}, …, P_{n}} or perspectives {α_{1}, …, α_{n}} I shall also assume that they are ordered. This is unproblematic except when both +A and −A are perspectives dangling from the same occurrence. In that case, I order +A before −A. (Such a case seems unnatural in practice, and it cannot occur in acyclic systems.)

6.1.2 The process calculus

For the interpretation we use CCS extended with sequential composition. In fact, we shall use the Before operator defined by Milner [Mil89, ch 8]. For this to work, our interpretation must use his well-terminating processes. Throughout, I assume that the reader is familiar with the theory of CCS.

Syntax Like P, CCS is built over an action set Act. This is built from an infinite set Nam of names, ranged over by a, b, c, . . .. \overline{Nam} denotes the set of conames of Nam (distinct from Nam), ranged over by ā, b̄, c̄, . . .. The set of labels is Lab = Nam ∪ \overline{Nam}, ranged over by l. I define complementation \overline{·} : Lab → Lab by: l̄ = ā if l = a and l̄ = a if l = ā. The action set Act = Lab ∪ {τ} (and is ranged over by α) where τ ∉ Lab is called the silent action.

Last, let C range over a countable set Const of process constants. Then the syntax of CCS is given by

p ::= 0 | α.p | p|p | p \ M | p[f] | ∑_{i∈I} p_{i} | C

For some index set I and function f : Act → Act such that for all l ∈ Lab, f(l̄) = \overline{f(l)} and f(τ) = τ. I use p and q to range over CCS processes.

Semantics The constructors have their usual meanings: inaction, prefixing, parallel composition, restriction, relabelling, summation and constants. Technically, the semantics is given by a labelled transition system LI_{Δ} = ⟨CCS, Act, →, Ω⟩ where Δ : Const ⇀ CCS gives the constant bindings and Ω is the least set such that

0 ∈ Ω p \ M ∈ Ω when p ∈ Ω
p|q ∈ Ω when p, q ∈ Ω p[f] ∈ Ω when p ∈ Ω
∑_{i∈I} p_{i} ∈ Ω when every p_{i} ∈ Ω

And the labelled transition relation is defined by (p, α, q) ∈→ iff C_{Δ} ⊢ p →^{α} q, where the system C_{Δ} = (L, R) and L is just the language of labelled transition judgments and R consists of the following rules:

α.p →^{α} p  {p →^{α} p′ \atop p|q →^{α} p′|q}  {q →^{α} q′ \atop p|q →^{α} p|q′}

\begin{matrix}p →^{α} p′ & q →^{ᾱ} q′ \\ p|q →^{τ} p′|q′ \end{matrix}  \begin{matrix}p_{j} →^{α} p′ & j ∈ I \\ ∑_{i∈I} p_{i} →^{α} p′ \end{matrix}  {Δ(C) →^{α} p′ \atop C →^{α} p′}

\begin{matrix}p →^{α} p′ & α ∉ M ∪ \overline{M} \\ p \ M →^{α} p′ \ M \end{matrix}  {p →^{α} p′ \atop p[f] →^{f(α)} p′[f]}

I say a deduction sequence s is a sequence of C_{Δ}-deductions, and I write s : p →^{t} p′

if s = Σ_{1}·. . .·Σ_{n}, and Σ_{1} ⊢ p →^{α_{1}} p_{1}; for all 1 < i ≤ n, Σ_{i} ⊢ p_{i−1} →^{α_{i}} p_{i}; t = α_{1}·. . .·α_{n}

and p_{n} = p′; and no occurrence appears more than once in the sequence.

6.1.3 Well-terminating processes

We use a slightly different definition from that of page 59: we use Milner’s original definition to reuse as many of his results as possible.

A process p is well-terminating if, for every derivative p′ of p, p′ \underrightarrow{done} is impos-

sible, and also if p′ \underrightarrow{\overline{done}} then p′ ∼ \overline{done}.0.

Proposition 6.0 If p is well-terminating and p →^{α} p′ then p′ is well-terminating. If also p ∼ q then q is well-terminating. □

We define the following combinators:

Done =^{def} \overline{done}.0
p;q =^{def} (p[done ↦ b] | b.q) \ {b}
p∥q

=^{def}
(p[done ↦ d_{1}] | q[done ↦ d_{2}] |
d_{1}.d_{2}.Done + d_{2}.d_{1}.Done) \ {d_{1}, d_{2}}

where b, d_{1} and d_{2} are new names.

Proposition 6.1 If p and q are well-terminating, so are p;q and p∥q. □

Proposition 6.2

\begin{matrix}p;(q;r) = (p;q);r  p∥q = q∥p  p∥(q∥r) = (p∥q)∥r \\ Done;p ≈ p  Done∥p ≈ p \end{matrix}

where = (respectively ≈) denotes CCS observation congruence (respectively, equivalence) [Mil89, ch 7]. □

6.1.4 Formalising scoping

My intention is to relate the scoping side-condition of section 5.2.1 to restriction in CCS. This means that when I interpret rules I shall need to interpret such side-conditions too. This in turn means that I need a formal way to represent scoping. The following is meant to capture it in a simpleminded manner.

SDQI-rules An X-scoped SDQI-rule is a triple (a, D, sc) where (a, D) is a DQIrule and sc ⊆ X is the set of labels which its premises are meant to scope. Thus scoping is restricted to rule atoms. This means that the await rule in section 5.2.2 is no longer acceptable. However, it can be rewritten into the following acceptable form:

R : scope.await(b, c, σ, σ′) R : await b then c − σ ⇝ σ′
R : b → tt ▶ R : c  σ ⇝ σ′ _{ST ORE}
R : scope.await(b, c, σ, σ′)

Chapter 6. The process calculus interpretation 133

Where ST ORE is as defined in section 5.2.2. Thus we have split the previous definition into two parts.

An SDQI-system is a pair (L, R) where L is a language of formulae, and R is a set of L-scoped SDQI-rules mentioning only formulae in L.

Definition 6.3 (SDQI-deduction) Let T be a SDQI-system. Then SDQI(T ) is the least set of quadruples (F, I, ⊏, D) such that

1. 0 = (∅, ∅, ∅, ∅) ∈ SDQI(T ).

2. If Σ_{1}, Σ_{2} ∈ SDQI(T ) then Σ_{1} ⊗_{f} Σ_{2} ∈ SDQI(T ).

3. If (a) (F, I, ⊏, D) ∈ SDQI(T ) and (a, D_{a}, sc) matches a rule of T such that (a, D_{a}) can be applied to (F, I, ⊏, D) to yield (F′, I′, ⊏′, D′) and (b) D ∩ (O(F) × sc^{±}) = ∅

then (F′, I′, ⊏′, D′) ∈ SDQI(T )

Thus an SDQI-deduction is just a DQI-deduction that has satisfied some scoping constraints. I say that a deduction Π is proper if D(Π) = ∅.

6.2 The interpretation

Let (L, R) be a DQI-system. The interpretation is going to assign to each formula A ∈ L a well-terminating process \underline{A} such that A is deducible if and only if \underline{A} reduces silently to a terminal state (i.e., its only visible action being \overline{done}).

Thus our interpretation bears some resemblence to the quantifier-free case of Gödel’s functional interpretation of Heyting Arithmetic (HA) [Göd58]. (The Dialectica interpretation is also explained clearly in [HS86, Chapter 18].) In the quantifier-free case, logical formulae A (with free variables x_{1}, …, x_{n}) are interpreted by programs A^{∗} such that if A is provable in HA then for all closed programs X_{1}, …, X_{n}, A[X_{1}/x_{1}, …, X_{n}/x_{n}] beta-reduces to ¯0 (the church numeral zero).

However, the resemblance ends there. Gödel’s interpretation is for a specific proof-system (for extensions to other systems see [Tro73]), and it proceeds by induction on the structure of the formula being interpreted. We shall be interpreting arbitrary SDQI-systems T , and therefore do not have an inductive structure of formulae to work with. Instead, we use the idea that the meaning of a formula is captured by the rule that introduces it [Sun84a]. We define the interpretation of T -formulae directly from the structure of the T -rules.

We are going to interpret rules as process constant bindings. A rule is seen as a procedure for establishing its conclusion. Formulae correspond to process constants. Therefore, a rule will typically be bound to a restriction of some parallel composition (∥) of sequenced process constants. Now, for this to make sense, every process constant mentioned in a rule interpretation ought to be bound to some process. This corresponds to the proof-theoretic condition that every premise of Chapter 6. The process calculus interpretation 134

a rule is potentially deducible (i.e., there exists some rule which concludes it). I call these systems sensible.

There are situations where unsensible systems are useful: for instance, the propagation-free rules for abortion in section 5.1.4 were unsensible. But there we had the pruning rule to restore sensibility. In this section I shall only interpret sensible systems, which give rise to well-terminating processes. Pruning corresponds to unnatural, premature termination, which suggests a different treatment. In the interests of simplicity, I shall not provide such a treatment. Nevertheless, if one so desires, one can regard the pruning rule as an ordinary rule with a lot of instances.

Let us fix an arbitrary SDQI-system T = (L, R), and occurrence ordering ⊴. We lift ⊴ to order sets of occurrences: X_{1} ⊴ X_{2} if (min X_{1}) ⊴ (min X_{2}) (where min X is the minimum occurrence of X with respect to ⊴).

We define an injection \underline{·} : L → Const that maps formulae to process constants. We extend \underline{·} to occurrences: \underline{(A, n)} = \underline{A}.

We interpret T as a set of CCS constant bindings Δ_{T} in the following way. Each rule atom is interpreted as a process that forms a partial definition of the constant associated to its conclusion. Then we define each conclusion with the sum of the bodies that partially define it (so if there are three rules concluding C, process constant \underline{C} will be defined as the sum of three bodies).

When D is a set of actions, let me write

D.p = \{ \begin{matrix}τ.p & if D = ∅ \\ α_{1}. · · · .α_{n}.p & if D = \{α_{1}, …, α_{n}\} \end{matrix}

(remembering the convention that α_{1}, …, α_{n} lists the elements of D using the fixed order). For sequences of occurrences, let me write \underline{A_{1} · . . . · A_{n}} for \underline{A_{1}}; …;\underline{A_{n}}. Then the interpretation of an SDQI-rule is given by

\underline{((\{P_{1}, …, P_{n}\}, C), D, sc)} = D.(\underline{P_{1}}∥ … ∥\underline{P_{n}}) \ sc

and by convention, the parallel composition of zero processes is simply Done, the null well-terminating process.

Rule systems to constant bindings Finally, let R(C) be the set of rules in R that conclude C. Then, we define the constant binding environment by Δ_{T} as follows:

Δ_{T} (\underline{C}) = ∑_{r∈R(C)} \underline{r}

Some examples

For example, I give the interpretation of the QI-system P_{QI}^{(;)}, the I-system P_{SOS} and the await rule. I abbreviate the interpretation by giving only equation schemes. Technically there should be different constants for different instantiations of process variables p and q. I label the communication interactions comm(a) when a is the name of the communicating action.

\underline{0√} =^{def} τ.Done
\underline{a.p√} =^{def} +comm(a).\underline{p√}
\underline{ā.p√} =^{def} −comm(a).\underline{p√}
\underline{p|q√} =^{def} τ.(\underline{p√} ∥ \underline{q√})
\underline{p; q√} =^{def} τ.(\underline{p√}; \underline{q√})

\underline{a.p →^{a} p} =^{def} +comm(a).Done
\underline{ā.p →^{ā} p} =^{def} −comm(a).Done
\underline{p|q →^{α} p′|q} =^{def} τ.\underline{p →^{α} p′}
\underline{p|q →^{α} p|q′} =^{def} τ.\underline{q →^{α} q′}
\underline{p|q →^{τ} p′|q′} =^{def} τ.(\underline{p →^{α} p′} ∥ \underline{q →^{ᾱ} q′})

As a more complex example, I give the schema for the interpretation of the modified await rule atom:

\underline{R : await b do c} =^{def} +atomic(σ, σ′).\underline{R : scope.await(b, c, σ, σ′)}

\underline{R : scope.await(b, c, σ, σ′)} =^{def} τ.((\underline{b → tt} ; \underline{R : c}) ∥ \underline{σ ⇝ σ′}) \ ST ORE

The next result is that the interpretation binds every constant to a wellterminating process. Now well-terminating process need not terminate, therefore we are showing a safety property: no process terminates without signalling \overline{done} first. This can be seen as a consistency result.

Proposition 6.4 Let T be a sensible SDQI-system. Then every constant in Δ_{T} is bound to a well-terminating process.

Proof: Say a set X ⊆ dom Δ_{T} checks out if for all \underline{C} ∈ X,

(1) F V (Δ_{T} (\underline{C})) ⊆ X
(2) if every C′ ∈ F V (Δ_{T} (\underline{C})) is well-terminating, then so is Δ_{T} (\underline{C})

We show by coinduction on the definition of the relation checks out that dom Δ_{T} checks out. Let \underline{C} ∈ dom Δ_{T} and p = Δ_{T} (\underline{C}). (1) F V (p) ⊆ dom Δ_{T} by the sensibility of T . (2) Then p = ∑_{r∈R(C)} \underline{r}. Suppose every C′ ∈ F V (p) is wellterminating. To show p is well-terminating, we must show that every choice is well-terminating. Let q be one such choice. Then q = D.(Done) \ sc or q = D.(\underline{P_{1}}∥ … ∥\underline{P_{n}}) \ sc (for n ≥ 1). In the first case, q is well-terminating because Done is well-terminating, restriction preserves it, and so does prefixing with D, because done, \overline{done} ∉ D by definition. In the second, the same result holds because we know that restriction, D-prefixing and the ; and ∥ operators preserve well-termination. □

Relating deductions and transition sequences

We are going to relate the deductions of a sensible SDQI-system T to terminating transition sequences of Δ_{T} processes. The interesting point is that the order of the non-silent actions is related to the order of the dangling interactions given by Chapter 6. The process calculus interpretation 136

some history. In fact, we use histories to sequentialize ≲_{Π} (where Π ∈ SDQI(T )) and obtain a linear order of the dangling interactions.

Let h be a history of Π. Then we define a lexicographic order over D(Π): (A, α) ≤_{h} (B, β) if

h(A) > h(B) or (h(A) = h(B) and α ⊴ β)

Let Π ∈ SDQI(T ) have history h. Let s be a C_{Δ_{T}} -deduction sequence. We say s traces Π via h if there exists an injective function f : D(Π) → dom (s) such that

if (A, α) ≤_{h} (B, β) then f(A, α) ≤ f(B, β)
for all (A, α), act(s(f(A, α))) = α
for all i ∈ dom (s) \ im f, act(s(i)) ∈ \{τ, \overline{done}\}

where act(Σ) = α if Σ ⊢ p →^{α} p′ for some p, p′. The first condition says that traces must respect the historical order of dangling interactions. The second states that every undischarged formula perspective is an action in the trace. The third states that the only non-\overline{done} actions in the trace are undischarged formula perspectives.

For convenience, we label the C_{Δ}-deductions that conclude with an instance of the communication rule Communication deductions.

6.2.1 The interpretation is sound

Figure 6–1 defines a partial function sub which strips out the evaluation transition sequence of an immediate subprocess of p|q. (This is called projection in [Bes83]) If s : p|q →^{α}^{∗} Ω then sub(1, s) : p →^{α}^{∗} Ω and sub(2, s) : q →^{α}^{∗} Ω are the evaluations of the processes on the left and right of the parallel composition respectively.

Let h and h′ be histories. Then we say h subsumes h′ if dom h′ ⊆ dom h and for all A, B ∈ dom h′, h′(A) ≤ h′(B) if and only if h(A) ≤ h(B). That is, one history subsumes another if it preserves the timestamping relationship between common formula occurrences. This timestamping relationship is used to determine the order in which we compute the transitions of the interpreting process.

Lemma X(i) (Assembly) Suppose we have a deduction sequence s of p_{1}|p_{2} →^{t} Ω, and suppose for i = 1, 2 that projection s_{i} of s of p_{i} →^{t_{i}} Ω that there exists a Π_{i} with history h_{i} such that s_{i} traces Π_{i} via h_{i}. Then there exists a binary connector g of Π_{1} and Π_{2} and a history h of Π = Π_{1} ⊗_{g} Π_{2} such that s traces Π via h and h subsumes h_{1} and h_{2}.

Proof: let f_{i} : D(Π_{i}) → dom (s_{i}) be the appropriate functions that show how s_{i} traces Π_{i} via h_{i}. We construct g according to the communications between s_{1} and s_{2} in s. Let inj_{i} : dom (s_{i}) → dom (s) be the injective function such that for all j ∈ dom (s_{i}), O(s_{i}(j)) ⊆ O(s(inj_{i}(j))). That is, inj_{i} maps the index of deduction Σ of s_{i} to the index of the deduction in s that contains Σ: i.e., from that which it was projected. Since projection preserves the relative order of deductions, it is easy to show that inj_{i} is order-preserving too. Also, if inj_{1}(i) = inj_{2}(j) then the deductions s_{1}(i) and s_{2}(j) were children of a communication rule in s. So we Chapter 6. The process calculus interpretation 137

sub(x, ε) = ε

sub ( 1, \begin{matrix}Σ \\ p →^{α} p′ \end{matrix} ; p|q →^{α} p′|q · s ) = ( \begin{matrix}Σ \\ p →^{α} p′ \end{matrix} ) · sub(1, s)

sub ( 1, \begin{matrix}Σ \\ q →^{α} q′ \end{matrix} ; p|q →^{α} p|q′ · s ) = sub(1, s)

sub ( 1, \begin{matrix}\begin{matrix}Σ_{1} \\ p →^{α} p′ \end{matrix} & \begin{matrix}Σ_{2} \\ q →^{ᾱ} q′ \end{matrix} \\ p|q →^{τ} p′|q′ \end{matrix} · s ) = ( \begin{matrix}Σ_{1} \\ p →^{α} p′ \end{matrix} ) · sub(1, s)

sub ( 2, \begin{matrix}Σ \\ q →^{α} q′ \end{matrix} ; p|q →^{α} p|q′ · s ) = ( \begin{matrix}Σ \\ q →^{α} q′ \end{matrix} ) · sub(2, s)

sub ( 2, \begin{matrix}Σ \\ p →^{α} p′ \end{matrix} ; p|q →^{α} p′|q · s ) = sub(2, s)

sub ( 2, \begin{matrix}\begin{matrix}Σ_{1} \\ p →^{α} p′ \end{matrix} & \begin{matrix}Σ_{2} \\ q →^{ᾱ} q′ \end{matrix} \\ p|q →^{τ} p′|q′ \end{matrix} · s ) = ( \begin{matrix}Σ_{2} \\ q →^{ᾱ} q′ \end{matrix} ) · sub(2, s)

Figure 6–1: The partial function sub : {1, 2} × I(C_{Δ})^{∗} ⇀ I(C_{Δ})^{∗} Chapter 6. The process calculus interpretation 138

define H_{i} = {f_{i}^{−1}(j) | ∃k.inj_{i}(j) = inj_{3−i}(k)} to be the set of dangling interactions of Π_{i} which are to be connected by g. Then g : (H_{1} ∪ H_{2}) ↔ (H_{1} ∪ H_{2}) is defined by

g(A, α) = f_{3−i}^{−1}(inj_{3−i}^{−1}(inj_{i}(f_{i}(A, α))))

when (A, α) ∈ D(Π_{i}). It is straightforward to show that this is involutive. However, we still have to show that it is a connector of Π_{1} ∪ Π_{2} with respect to some history h. If it is a connector, then it is obviously binary.

First note that g(A, α) = (A′, ᾱ). This follows because if s(inj_{i}(f_{i}(A, α))) is a communication of two transitions, then one transition must be labelled α and the other ᾱ. Since s_{3−i} must contain the other transition, it must be labelled ᾱ. Therefore if inj_{3−i}(f_{3−i}(A′, β)) = inj_{i}(f_{i}(A, α)) then β = ᾱ by the properties of f_{i} and f_{3−i}.

Next, suppose that g(A, α) = (A′, ᾱ), g(B, β) = (B′, β̄), and h_{1}(A) ≤ h_{1}(B). We want to show that (A, α) ≤_{h} (B, β) implies f(A, α) ≤ f(B, β). There are two cases. First, suppose h_{1}(A) < h_{1}(B). Then (B, β) <_{h_{1}} (A, α) and so f_{i}(B, β) < f_{i}(A, α). Therefore inj_{i}(f_{i}(B, β)) < inj_{i}(f_{i}(A, α)) which in turn means inj_{3−i}^{−1}(inj_{i}(f_{i}(B, β))) < inj_{3−i}^{−1}(inj_{i}(f_{i}(A, α))), and so (B′, β̄) <_{h_{2}} (A′, ᾱ), and so h_{2}(A′) < h_{2}(B′). When h_{1}(A) = h_{1}(B) the reasoning is similar, except that we have to consider the relative order of α and β. The result goes through because the relative order between perspectives is not affected by taking complements..

With this in mind, we can construct a history of Π_{1} ∪ Π_{2} such that for all A, B ∈ O(Π_{i}), h_{i}(A) ≤ h_{i}(B) iff h(A) ≤ h(B), and if g(A, α) = (A′, ᾱ) then h(A) = h(A′). These properties will ensure that g is a connector with respect to h.

This is achieved by an iterative method, where we consider each element (A, α) of H_{1} (mapped to (A′, ᾱ) of H_{2}) in turn and add displacements in the appropriate places to ensure h(A) = h(A′). We define a sequence of histories h^{0}, …, h^{n} where n = |H_{1}| = |H_{2}| and h^{0} = h_{1} ⊕ h_{2}. We order the elements of H_{1} according to ≤_{h_{1}}. To construct h^{i+1}, we consider the i + 1-th dangling interaction (A_{i}, α_{i}) of H_{1}, and its mate (B_{i}, ᾱ_{i}) in H_{2}. Suppose h^{i}(A) < h^{i}(B). Then we compute the difference d between the two, and alter h^{i+1} by:

h^{i+1}(A) = \{ \begin{matrix}h^{i}(A) & if A ∈ O(Π_{2}) or h^{i}(A) ≤ h^{i}(A_{i}) \\ h^{i}(A) + d & otherwise \end{matrix}

When h^{i}(B) < h^{i}(A) we compute h^{i} in the symmetric way. It is not hard to see that h^{i+1} subsumes h^{i}. We set h = h^{n}.

Thus g is a connector of Π_{1} and Π_{2} with respect to h. Let Π = Π_{1} ⊗_{g} Π_{2}, then h is a history of Π.

We have to modify h again to ensure that dangling interactions unrelated in Π are ordered by h according to the positions of their corresponding transition deductions in s. This will show that s traces Π via the modified history.

Once again, we use a displacement adding argument. We define f : D(Π) → dom (s) by f(A, α) = inj_{i}(f_{i}(A, α)) when (A, α) ∈ D(Π_{i}). f induces a total order over the dangling interactions of Π: if f(A, α) < Chapter 6. The process calculus interpretation 139

f(B, β) then the transition corresponding to (A, α) occurs earlier in s than that of (B, β). Note that no two dangling interactions of Π will be assigned equal positions in s: by our construction, every pair of dangling interactions with equal positions in s were connected by g. So let us order the dangling interactions (A_{1}, α_{1}), …, (A_{n}, α_{n}) such that f(A_{k}, α_{k}) < f(A_{k+1}, α_{k+1}) for all k = 1, …, n−1. Then we define a sequence of histories h^{0}, …, h^{n} by h^{0} = h and for each i + 1, let 1 ≤ k_{i+1} ≤ i be the least index such that such that f(A_{k_{i+1}}, α_{k_{i+1}}) ≥ f(A_{i+1}, α_{i+1}) . If it does not exist, then h^{i+1} = h^{i}. Otherwise, let d = 1 + h^{i}(A_{i+1}) − h^{i}(A_{k_{i+1}}) and

h^{i+1}(A) = \{ \begin{matrix}h^{i}(A) & if h^{i}(A) < h^{i}(A_{k_{i+1}}) \\ h^{i}(A) + d & ow \end{matrix}

A simple inductive proof shows that for all i, h^{i} is a history of Π, h^{i+1} subsumes h^{i} and for 1 ≤ k, k′ ≤ i, (A_{k}, α_{k}) ≤_{h^{i}} (A_{k′}, α_{k′}) if and only if f(A_{k}, α_{k}) ≤ f(A_{k′}, α_{k′}).

It is now straightforward to show that s traces Π via h^{n}. The first condition, that (A, α) ≤_{h^{n}} (B, β) if and only if f(A, α) ≤ f(B, β) is the result of the aforementioned inductive proof.

For the second condition, since (A, α) ∈ D(Π), (A, α) ∉ dom g. Therefore, s(inj_{i}(f_{i}(A, α))) is not a communication deduction. Therefore act(s(inj(f_{i}(A, α)))) equals act(s_{i}(f_{i}(A, α))) which in turn equals α by the main induction. Finally, for the third condition, let j ∈ dom (s) \ im f. Suppose act(s(j)) ∉ \{τ, \overline{done}\}. Then s(j) cannot be a communication deduction, so there must be an i such that act(sub(i, s(j))) = act(s(j)). But this must mean that there exists a k such that s_{i}(k) = sub(i, s(j)), which means that act(s_{i}(k)) ∉ \{τ, \overline{done}\}. But then, by induction, that means there must exist an (A, α) ∈ D(Π_{i}) such that f_{i}(A, α) = k. Since s(inj_{i}(k)) is not a communication deduction, (A, α) is not connected to anything by g, so therefore f(A, α) = inj_{i}(k) = j. Contradiction. □

The following result is an easy corollary of the above. Let us extend the notion of projection to ∥. We define two auxiliary functions, unlabel, unrestrict : I^{∗}(C_{Δ}) ⇀ I^{∗}(C_{Δ}) to remove the relabelling and restriction rules that occur as the lowest rule in each deduction of a sequence.

unlabel(ε) = unrestrict(ε) = ε

unlabel ( \begin{matrix}Σ \\ p →^{α} p′ \end{matrix} ; p[f] →^{f(α)} p′[f] · s ) = Σ · unlabel(s)

unrestrict ( \begin{matrix}Σ \\ p →^{α} p′ \end{matrix} ; p \ L →^{α} p′ \ L · s ) = Σ · unrestrict(s)

Then when s is a deduction sequence of p∥q, we define

sub(i, s) = unlabel(sub(i, unrestrict(s)))

The proof of the following result is easy.

Lemma X(ii) Suppose p_{1} and p_{2} are well-terminating, and we have a deduction sequence s of p_{1}∥p_{2} →^{t} Ω, and suppose for i = 1, 2 that projection s_{i} of s of p_{i} →^{t_{i}} Ω that there exists a Π_{i} with history h_{i} such that s_{i} traces Π_{i} via h_{i}. Then there exists a binary connector g of Π_{1} and Π_{2} and a history h of Π = Π_{1} ⊗_{g} Π_{2} such that s traces Π via h and h subsumes h_{1} and h_{2}.

Proof: By well-termination, s_{1} and s_{2} will perform only one \overline{done} action, and no done actions. Let s′ be the deduction sequence of p_{1}|p_{2} obtained from the projection p_{1}[done ↦ d_{1}] | p_{2}[done ↦ d_{2}] of s simply by removing the evident relabelling operators from each deduction. Then s_{1} and s_{2} are projections of s′. By lemma X(i), we find the binary connector g and the history h such that Π = Π_{1}⊗_{g} Π_{2} is traced by s′, and h subsumes h_{1} and h_{2}. Let f : D(Π) → dom(s′) be the witnessing function.

It remains to relate the original sequence s to Π. We use the witnessing function f again. Then we already know the first property is satisfied. Now, consider act(s(f(A, α))). Since α labels a dangling interaction, it is neither silent nor \overline{done}. Therefore it is not restricted nor a relabelling of \overline{done} by [done ↦ d_{i}]. This means that act(s(f(A, α))) = act(s′(f(A, α))) = α. Last, let i ∈ dom (s) \ im f. Then either i ∈ dom(s′)\im f or not. If so, then act(s′(i)) ∈ \{τ, \overline{done}\}. But given the definition of s′, this means that act(s(i)) ∈ \{τ, \overline{done}\} too (relabelling and restriction do not affect τ actions, and if \overline{done} is relabelled to \overline{d_{i}}, then the restriction forces it to communicate with d_{1} in s, which means that act(s(i)) = τ.) If not, then it can only be an \overline{done} action: the last action of s. □

Lemma X(iii) (Sequencing) Suppose p_{1} and p_{2} are well-terminating and that we have a deduction sequences s of p_{1};p_{2} →^{t} Ω, and suppose for i = 1, 2, there exists a deduction Π_{i} and a history h_{i} of Π_{i} such that s_{i} = sub(i, s) traces Π_{i} via h_{i}. Then there exists a history h of Π = Π_{1} ⊗_{0} Π_{2} such that s traces Π via h, and h subsumes h_{1} and h_{2}.

Proof: Given the definition of the ; operator and by well-termination we find that s is s′_{1} · Σ · s′_{2}, where s′_{1} is just s_{1} all of whose deductions have had an extra rule applied to convert p_{1}’s transitions into p|b.q’s transitions. Similarly, s′_{2} is s_{2} modified to make p_{2}’s transitions transitions of Ω|p_{2}, and Σ is the communication of the \overline{b} and b actions. We define

h(A) = \{ \begin{matrix}h_{2}(A) & if A ∈ O(Π_{2}) \\ h_{1}(A) + 1 + max(im h_{2}) & if A ∈ O(Π_{1}) \end{matrix}

(it is easy to see that h subsumes h_{1} and h_{2}). To show that s traces Π via h, we define f : D(Π) → dom (s) by

f(A, α) = \{ \begin{matrix}f_{1}(A, α) & if (A, α) ∈ D(Π_{1}) \\ f_{2}(A, α) + |s_{1}| & if (A, α) ∈ D(Π_{1}) \end{matrix}

Chapter 6. The process calculus interpretation 141

Once again, there are three things to show. First, suppose (A, α) ≤_{h} (B, β). Then either both (A, α) and (B, β) belong to D(Π_{i}). By hypothesis, f_{i}(A, α) ≤ f_{i}(B, β), and so f(A, α) ≤ f(B, β). If (A, α) ∈ D(Π_{1}) and (B, β) ∈ D(Π_{2}) then f_{1}(A, α) ≤ |s_{1}| + f_{2}(B, β). The other two properties follow almost immediately given that the sequence s effectively appends s_{2} after s_{1}. □

Theorem X (Soundness) Let s be a deduction sequence of \underline{A_{1}}∥ … ∥\underline{A_{n}} →^{t} Ω. Then there exists a deduction Π ⊢ A_{1}, …, A_{n} with history h such that s traces Π via h.

Proof: by induction on the length of s Case |s| = 0: We have Π = 0. Case |s| = k + 1: by strong induction on n: Case n = 1: here the first transition must involve the expansion of the constant \underline{A_{1}}:

\begin{matrix}Σ \\ p →^{α_{1}} p′ \end{matrix} ; ∑_{r∈R(A_{1})}\underline{r} →^{α_{1}} p′ ; \underline{A_{1}} →^{α} p′

Let \underline{r} = D.(\underline{P_{1}}∥ ⋯ ∥\underline{P_{m}}) \ sc. Either D = ∅, in which case α_{1} = τ or D = \{α_{1}, …, α_{k}\}, so \underline{r} = α_{1}. · · · .α_{k}.(\underline{P_{1}}∥ ⋯ ∥\underline{P_{m}}) \ sc. Then s = Σ_{1} · . . . · Σ_{k} · s′ where Σ_{i} records the prefix transitions of α_{i}. Let s′′ be s′ after removing the lowermost restriction rules: s′′ is a deduction sequence of \underline{P_{1}}∥ ⋯ ∥\underline{P_{m}} →^{t′′} Ω where t = α_{1} · . . . · α_{k} · t′′ if D ≠ ∅ and t = t′′ if D = ∅.

Let s_{1}, …, s_{m} be the projections of s′′ such that s_{i} is a deduction sequence of p_{i} →^{t_{i}} Ω. Suppose p_{i} = \underline{A_{i1}}; …;\underline{A_{ik_{i}}}. Then by repeated application of lemma X(iii) we obtain Π_{i} ⊢ A_{i1}, …, A_{ik_{i}} with history h_{i} such that s_{i} traces Π_{i} via h_{i}. By repeated application of lemma X(ii) we obtain Π′′ ⊢ A_{11}, …, A_{mk_{m}} with history h′′ such that s′′ traces Π′′ via h′′. We also know that no element of t′′ is contained within sc (since every deduction of s′ has the restriction rule applied to it). Therefore, D(Π′′) ∩ (O(Π′′) × sc^{±}) = ∅ by the definition of tracing. We know that h′′ subsumes each of its component histories. Therefore the sequencing

constraints can be satisfied. Thus we can apply the rule \begin{aligned}P_{1} & ⋯ & P_{m} \\ & C \end{aligned} D to Π′′ to yield Π ⊢ C. We then define h to be the history of Π such that h(A) = h′′(A) if A ∈ O(Π′′) and h(C) = 1+max(im h′′) otherwise. Since the dangling interactions hanging off C will be ordered according to ⊴, as are the prefixed actions of Δ(\underline{C}), it is easy to show that s traces Π via h.

Case n > 1: by induction and the application of lemma X(i). □

6.2.2 The interpretation is complete

The following lemma contains the heart of the proof. It shows the correspondence between the assembly of deductions and the communication of processes. It is quite lengthy, but not at all difficult.

Lemma XI(i) (Interleaving) Suppose for all histories h_{i} of Π_{i} there exists a deduction sequence s_{i} of p_{i} →^{t_{i}} Ω that traces Π_{i} via h_{i} (for i = 1, 2). Then for all g, there exists a t and a deduction sequence s of p_{1}|p_{2} →^{t} Ω that traces Π_{1} ⊗_{g} Π_{2} via some history h.

Proof: Let h be a history of Π. Let i = 1, 2. Then h ↾ O(Π_{i}) is a history of Π_{i}. Suppose Π_{i} ⊢ A_{i1}, …, A_{in_{i}}. Then by induction we get a deduction sequence s_{i} of p_{i} →^{t_{i}} Ω that traces Π_{i} via h_{i} (and h) for some t_{i}. Let f_{i} be the associated injective functions.

We construct a deduction sequence s of p_{1}|p_{2} →^{t} Ω. To obtain the result we may have to reorganize the parallel composition (for instance it is possible that p_{1} = \underline{A_{11}}| … |\underline{A_{1n_{1}}} and p_{2} = \underline{A_{21}}| … |\underline{A_{2n_{2}}} and A_{1j} ⋬ A_{2k} for some j and k). This is quite trivial: it follows from the commutativity and associativity of | with respect to strong bisimulation [Mil89, Proposition 4.8].

We are going to interleave s_{1} and s_{2} with respect to h. First we must isolate those actions of s_{i} which will communicate with s_{3−i}. Now there are m = |dom g|/2 pairs of interaction links between Π_{1} and Π_{2}, and so there shall be m pairs of deductions from s_{1} and s_{2} which will communicate.

These are specified by the binary connector g. Let

{c_{i1}, …, c_{im}} = {f_{i}(A, α) | (A, α) ∈ (D(Π_{i}) ∩ dom g)}

be the set of indices of s_{i} which correspond to the dangling interactions of Π_{i} which are connected by g. Now, it follows immediately from the definition of connector that if g(A, α) = (A′, ᾱ) and g(B, β) = (B′, β̄) then (A, α) ≤_{h} (B, β) if and only if (A′, ᾱ) ≤_{h} (B′, β̄). This means that for 1 ≤ j ≤ m, c_{11}, …, c_{1m_{1}} occur in s_{1} in the same order as c_{21}, …, c_{2m_{2}} occur in s_{2}. Thus to build s, we shall apply the communication rule to deductions s_{1}(c_{1j}) with s_{2}(c_{2j}). This works because connectors also map formula perspectives into their opposite perspectives. Now we can describe the interleaving of the two sequences. Let us assume that the deductions of s_{1} · s_{2} are disjoint, and let X be the set of these deductions. Then we define the following relation. We say Σ_{1} ⪯ Σ_{2} if and only if there exists i, j, k, (A, α) and (B, β) such that

(1) Σ_{1} = s_{i}(f_{i}(A, α)), Σ_{2} = s_{j}(f_{j}(B, β)) and (A, α) ≤_{h} (B, β) or
(2) Σ_{1} = s_{i}(j), Σ_{2} = s_{i}(k) and j ≤ k

We write Σ_{1} ≺ Σ_{2} if Σ_{1} ⪯ Σ_{2} and not Σ_{2} ⪯ Σ_{1}. We write Σ_{1} ≍ Σ_{2} if both Σ_{1} ⪯ Σ_{2} and vice-versa. Now ⪯ is a preorder: reflexivity follows trivially. Transitivity follows by a straightforward case analysis. It is not a partial order because for each 1 ≤ j ≤ m, c_{1j} = (A, α) and c_{2j} = (B, ᾱ) implies that (A, α) =_{h} (B, ᾱ) because h(A) = h(B) by the definition of connector and ᾱ ⊴ α and vice-versa.

IL_{q}^{p}(ε, ε) = ε

IL_{q}^{p}(ε, ( \begin{matrix}Σ \\ q →^{α} q′ \end{matrix} ) · s) = ( \begin{matrix}Σ \\ q →^{α} q′ \end{matrix} ; p|q →^{α} p|q′ ) · IL_{q′}^{p}(ε, s)

IL_{q}^{p}(( \begin{matrix}Σ \\ p →^{α} p′ \end{matrix} ) · s, ε) = ( \begin{matrix}Σ \\ p →^{α} p′ \end{matrix} ; p|q →^{α} p′|q ) · IL_{q}^{p′}(s, ε)

IL_{q}^{p}(( \begin{matrix}Σ \\ p →^{α} p′ \end{matrix} ) · s_{1}, ( \begin{matrix}Σ \\ q →^{β} q′ \end{matrix} ) · s_{2}) = \{ \begin{matrix}( \begin{matrix}Σ \\ p →^{α} p′ \end{matrix} ; p|q →^{α} p′|q ) · IL_{q}^{p′}(s_{1}, Σ_{2} · s_{2}) & if Σ_{1} ≺′ Σ_{1} \\ ( \begin{matrix}Σ \\ q →^{β} q′ \end{matrix} ; p|q →^{α} p|q′ ) · IL_{q′}^{p}(Σ_{1} · s_{1}, s_{2}) & if Σ_{2} ≺′ Σ_{2} \\ ( \begin{matrix}\begin{matrix}Σ \\ p →^{α} p′ \end{matrix} & \begin{matrix}Σ \\ q →^{β} q′ \end{matrix} \\ p|q →^{τ} p′|q′ \end{matrix} ) · IL_{q′}^{p′}(s_{1}, s_{2}) & if Σ_{1} ≍′ Σ_{2} \end{matrix}

Figure 6–2: Interleaving two interacting sequences

Therefore s_{1}(c_{1j}) ≍ s_{2}(c_{2j}). Now, let ⪯′ be any extension of ⪯ such that for all Σ_{1}, Σ_{2} ∈ X,

Σ_{1} ⪯′ Σ_{2} or Σ_{1} ≍′ Σ_{2} or Σ_{2} ⪯′ Σ_{1}
if Σ_{1} ≍′ Σ_{2} then Σ_{1} ≍ Σ_{2}

Thus it is a total order which preserves the order of ⪯, and which adds no new equalities. Then we define the interleaving of s_{1} and s_{2} with respect to ⪯′ to be IL_{p_{2}}^{p_{1}}(s_{1}, s_{2}) where IL_{q}^{p}(s_{1}, s_{2}) is defined in figure 6–2.

Note that from what has gone before, in the last case, Σ_{1} ≍′ Σ_{2} implies Σ_{1} ≍ Σ_{2} which implies that for some i, (A, α) and (B, β) that s_{i}(f_{i}(A, α)) = Σ_{1} and s_{3−i}(f_{3−i}(B, β)) = Σ_{2} and g(A, α) = (B, β), whence ᾱ = β as g is a connector. Thus act(Σ_{1}) = α and act(Σ_{2}) = ᾱ and so we can apply the communication rule.

Finally we show that s traces Π via h. Let f : D(Π) → dom (s) be defined by f(A, α) = j where if (A, α) ∈ D(Π_{i}) then O(s(j)) ⊇ O(s_{i}(f_{i}(A, α))). To show injectivity, suppose f(A, α) = f(B, β) = k and (A, α) ≠ (B, β) where (A, α) ∈ D(Π_{i}) and (B, β) ∈ D(Π_{j}). Then O(s(k)) ⊇ O(s_{i}(f_{i}(A, α)) and O(s(k)) ⊇ O(s_{j}(f_{j}(B, β))). From the definition of s, s(k) is built from one or two deductions in X. In the first case, s_{i}(f_{i}(A, α)) = s_{j}(f_{j}(B, β)) from which i = j and so (A, α) = (B, β) by the injectivity of f_{i}. Contradiction. In the second case, s(k) concludes a τ transition. But then by the translation, this only occurs when (A, α) is connected to (B, β) which means that the two do not occur in D(Π), and hence do not appear in the domain of f. Contradiction.

Second, let (A, α), (B, β) ∈ D(Π) be such that (A, α) ≤_{h} (B, β). Suppose (A, α) ∈ D(Π_{i}) and (B, β) ∈ D(Π_{j}). Then we know that s_{i}(f_{i}(A, α)) ⪯′ s_{j}(f_{j}(B, β)), and therefore the first deduction will occur earlier in s than the second. Hence f(A, α) ≤ f(B, β).

Chapter 6. The process calculus interpretation 144

Third, we show act(s(f(A, α))) = α. From the definition of s, there must exist a j such that O(s(f(A, α))) ⊇ O(s_{j}(f_{j}(A, α))). By induction, act(s_{j}(f_{j}(A, α))) = α. The result follows from the definition of s: act(s(f(A, α))) = act(s_{j}(f_{j}(A, α))).

Fourth and last, we have to show that for all i ∈ dom (s) \ im f, act(s(i)) ∈ \{τ, \overline{done}\}. Suppose not: let i ∈ dom(s) \ im f be such that act(s(i)) ∉ \{τ, \overline{done}\}. Then from the definition of s, there must exist a j and k such that O(s(i)) ⊇ O(s_{j}(k)), and moreover, since act(s_{j}(k)) ≠ τ, it cannot be a communication deduction. By induction, k = f_{j}(A, α) for some (A, α) ∈ D(Π_{j}). Since s(k) is not a communication of two deductions, it must be that (A, α) ∉ dom g and so (A, α) ∈ D(Π), which means by the definition of f that i ∈ im f. Contradiction.

□

Lemma XI(ii) Suppose for all histories h_{i} of Π_{i} there exist well-terminating processes p_{i} and deduction sequences s_{i} of p_{i} →^{t_{i}} Ω that traces Π_{i} via h_{i} (for i = 1, 2). Then for all g, there exists a t and a deduction sequence s of p_{1}∥p_{2} →^{t} Ω that traces Π_{1} ⊗_{g} Π_{2} via some history h.

Proof: By lemma XI(i), we obtain a t, an h and a deduction sequence s that traces Π = Π_{1} ⊗_{g} Π_{2} via h. We construct a deduction sequence of p_{1}∥p_{2} →^{t′} Ω which also traces Π via h. Since p_{1} and p_{2} are well-terminating s performs exactly two \overline{done} actions, one of which must occur at the end. We construct the deduction sequence s′ = par(s, d_{1}.d_{2}.Done + d_{2}.d_{1}.Done). The function par is defined in figure 6–3. We have to show that s exists par is well-defined. This follows by induction on the length of prefixes of s. The shortest possible length of s must be two, when it performs the two \overline{done} actions. A simple check shows that s′ exists in this case. If the size is k + 1, then induction tells us that k-length prefix of s′ exists. Consider the k + 1th deduction. By symmetry there are three cases, given by the three cases in figure 6–3. The first and third case are trivial. The second case is the most interesting: it exists if r can perform the d_{1} transition. Suppose it cannot. r is a derivative of d_{1}.d_{2}.Done + d_{2}.d_{1}.Done, so the only case when it cannot make a d_{1} transition is if it has already performed one. But this is impossible, because s_{1} only performs one \overline{done} action by well-terminatedness, hence the k-prefix of s cannot have performed it. By induction then, s′ exists.

The last thing to do is construct s′′ by appending a deduction to perform the last \overline{done} action of p∥q. An easy induction shows that s′′ traces Π via h. □

Let Π_{1}, …, Π_{n} be a set of disjoint deductions, and let Π = ⨂_{0}{Π_{1}, …, Π_{n}}. Then a history h of Π sequences Π_{1}, …, Π_{n} in Π if for all 1 ≤ i < j ≤ n, for all A ∈ O(Π_{i}) and B ∈ O(Π_{j}), h(B) > h(A).

Lemma XI(iii) (Sequencing) Suppose that for all histories h_{i} of Π_{i} ⊢ A_{i} (for i = 1, …, n) there exists a deduction sequence s_{i} of \underline{A_{i}} →^{t_{i}} Ω that traces Π_{i} via h_{i}. Then for all histories h that sequence Π_{1}, …, Π_{n} in Π = ⨂_{0}{Π_{1}, …, Π_{n}} there exists a deduction sequence s of \underline{A_{1}}; …;\underline{A_{n}} →^{t} Ω that traces Π via h for some t.

Chapter 6. The process calculus interpretation 145 Let λ_{1} be the relabelling function [done → d_{1}] and λ_{2} be the function [done → d_{2}]. Last, let us write p∥_{r}q for the process (p[λ_{1}] | q[λ_{2}] | r) \ {d_{1}, d_{2}}.

\begin{matrix}par(ε, r) = ε \\ par(Σ · s, r) = Σ′ · par(s, r′) \end{matrix}

where Σ′ and r′ are defined by cases as follows.

When Σ = \begin{matrix}Σ \\ p →^{α} p′ \end{matrix} ; p|q →^{α} p′|q , Σ′ = \begin{matrix}Σ \\ p α^{→} p′ \end{matrix} ; p[λ_{1}] →^{α} p′[λ_{1}] ; p[λ_{1}] | q[λ_{2}] →^{α} p′[λ_{1}] | q[λ_{2}] ; (p[λ_{1}] | q[λ_{2}] | r) →^{α} (p′[λ_{1}] | q[λ_{2}] | r) ; p∥_{r}q →^{α} p′∥_{r}q r′ = r

where α ≠ \overline{done}, and so λ_{1}(α) = α. When α = \overline{done} then

Σ′ = \begin{matrix}\begin{matrix}Σ \\ p α^{→} p′ \end{matrix} ; p[λ_{1}] →^{\overline{d_{1}}} p′[λ_{1}] ; p[λ_{1}] | q[λ_{2}] →^{\overline{d_{1}}} p′[λ_{1}] | q[λ_{2}] & \begin{matrix}Σ′ \\ r →^{d_{1}} r′ \end{matrix} \\ (p[λ_{1}] | q[λ_{2}] | r) →^{τ} (p′[λ_{1}] | q[λ_{2}] | r) \end{matrix} ; p∥_{r}q →^{τ} p′∥_{r}q

The cases for when q makes the transition are symmetric. Last, when

Σ = \begin{matrix}\begin{matrix}Σ_{1} \\ p →^{α} p′ \end{matrix} & \begin{matrix}Σ_{2} \\ q →^{ᾱ} q′ \end{matrix} \\ p|q →^{τ} p′|q′ \end{matrix} Σ′ = \begin{matrix}\begin{matrix}Σ_{1} \\ p →^{α} p′ \end{matrix} ; p[λ_{1}] →^{α} p′[λ_{1}] & \begin{matrix}Σ_{2} \\ q →^{ᾱ} q′ \end{matrix} ; q[λ_{2}] →^{ᾱ} q′[λ_{2}] \\ (p[λ_{1}] | q[λ_{2}]) →^{τ} (p′[λ_{1}] | q′[λ_{2}]) \end{matrix} ; (p[λ_{1}] | q[λ_{2}] | r) →^{τ} (p′[λ_{1}] | q′[λ_{2}] | r) ; p∥_{r}q →^{τ} p′∥_{r}q′ r′ = r

Figure 6–3: The definition of par : I^{∗}(C_{Δ}) ⇀ I^{∗}(C_{Δ})

Chapter 6. The process calculus interpretation 146

Proof: If A ∈ O(Π_{i}) and B ∈ O(Π_{j}) where i < j then h(A) > h(B). Therefore for all (A, α) ∈ D(Π_{i}) and (B, β) ∈ D(Π_{j}), (A, α) <_{h} (B, β). Let q_{i} be the terminal state of p_{i}, and λ be the relabelling function that acts as the identity everywhere except at done, where λ(done) = b. Then we construct s to be s′_{1} · . . . · s′_{n} where for each i and j ∈ dom (s_{i}),

s′_{i}(j) = \begin{matrix}s_{i}(j) \\ p →^{α} p′ \end{matrix} ; p[λ] →^{λ(α)} p′[λ] ; p[λ]|b.(\underline{A_{i+1}}; …;\underline{A_{n}}) →^{λ(α)} p′[λ]|b.(\underline{A_{i+1}}; …;\underline{A_{n}}) ; p;\underline{A_{i+1}}; …;\underline{A_{n}} →^{λ(α)} p′;\underline{A_{i+1}}; …;\underline{A_{n}} ; q_{1}| … |q_{i−1}|p;\underline{A_{i+1}}; …;\underline{A_{n}} →^{λ(α)} q_{1}| … |q_{i−1}|p;\underline{A_{i+1}}; …;\underline{A_{n}}

(The exception is the s′_{n}, which does not use the relabelling function λ), and s′_{i}(|s_{i}| + 1) is the deduction

\begin{matrix}\begin{matrix}Σ_{1} \\ p[λ] →^{\overline{b}} q_{i} \end{matrix} & b.(\underline{A_{i+1}}; …; \underline{A_{n}}) →^{b} \underline{A_{i+1}}; …; \underline{A_{n}} \\ p[λ]|b.(\underline{A_{i+1}}; …; \underline{A_{n}}) →^{τ} q_{i}|\underline{A_{i+1}}; …; \underline{A_{n}} \end{matrix} ; p;\underline{A_{i+1}}; …;\underline{A_{n}} →^{τ} q_{i}|\underline{A_{i+1}}; …;\underline{A_{n}} ; q_{1}| … |q_{i−1}|p;\underline{A_{i+1}}; …;\underline{A_{n}} →^{τ} q_{1}| … |q_{i}|\underline{A_{i+1}}; …;\underline{A_{n}}

We show that s traces Π via h. Define f : D(Π) → dom (s) by f(A, α) = f_{i}(A, α) + ∑_{j=i}^{i−1} |s_{j}|. There are three properties of f to show. First, suppose (A, α) ≤_{h} (B, β). There are two cases. First, suppose (A, α), (B, β) ∈ D(Π_{i}) for some i. Then by induction f_{i}(A, α) ≤ f_{i}(B, β), and so f(A, α) ≤ f(B, β). Second, suppose (A, α) ∈ D(Π_{i}) and (B, β) ∈ D(Π_{j}) where i ≠ j. Then by the definition of ≤_{h}, h(A) > h(B) and so i < j. Thus f(A, α) < f(B, β).

Second, we get act(s(f(A, α))) = act(s_{i}(f_{i}(A, α))) = α by the construction and induction. Third, we know that for all i ∈ dom (s) \ im f, act(s(i)) ∈ \{τ, \overline{done}\}, from induction. □

Theorem XI (Completeness) For all Π ∈ SDQI(T ), if Π ⊢ A_{1}, …, A_{n} then for every history h of Π, there exists a C_{Δ_{T}} -deduction sequence s of \underline{A_{1}}∥ … ∥\underline{A_{n}} →^{t} Ω that traces Π via h for some t.

Proof: By induction on the depth of inference of Π. Case Π = 0: we set s = ε, which is a deduction sequence attributed to 0. Case Π = Π_{1} ⊗_{g}

Π_{2}: follows immediately from lemma XI(ii). Case Π = \begin{matrix}Π′ & _{sc} \\ C \end{matrix} ^{D} : Let Π′ ⊢

A_{1}, …, A_{n}, and let h be a history of Π. Let r be the rule applied to Π_{1} to achieve Π. Sequencing: consider the premises of r: P_{1}, …, P_{m}. Suppose O(P_{i}) = {A_{i1}, …, A_{in_{i}}} where the occurrences are ordered according to their sequencing. Then by the associativity and commutativity of binary assembly (propositions 4.3 and 4.4), Π′ can be assembled from Π_{11} ⊢ A_{11}, …, Π_{mn_{m}} ⊢ A_{mn_{m}} by:

Π_{1} ⊗_{g_{1}} (Π_{2} ⊗_{g_{2}} (⋯ (Π_{m−1} ⊗_{g_{m−1}} Π_{m}) ⋯))

Chapter 6. The process calculus interpretation 147

where Π_{i} = Π_{i1} ⊗_{g_{i1}} (Π_{i2} ⊗_{g_{i2}} (⋯ (Π_{i(n_{i}−1)} ⊗_{g_{i(n_{i}−1)}} Π_{in_{i}}) ⋯)). Now, by induction,

for all i, j and histories h_{ij} of Π_{ij}, we get deduction sequences s_{ij} of \underline{A_{ij}} →^{t_{ij}} Ω that traces Π_{ij} via h_{ij}. Now since we can apply the sequencing constraints specified by P_{1}, …, P_{m}, it follows that there can be no interactions between any deduction in {Π_{i1}, …, Π_{im_{i}}}. This means that g_{i1} = g_{i2} = … = g_{in_{i}} = 0 for each i. Therefore, Π_{i} = ⨂_{0}{Π_{i1}, …, Π_{in_{i}}}. By lemma XI(iii), we get for all histories h_{i} that sequence Π_{i1}, …, Π_{in_{i}} in Π_{i} a deduction sequence s_{i} of \underline{A_{i1}}; …;\underline{A_{in_{i}}} →^{t_{i}} Ω that traces Π_{i} via h_{i}. By definition, history h of Π must satisfy the sequencing constraints imposed by r, and therefore h ↾ O(Π_{i}) will sequence Π_{i1}, …, Π_{in_{i}} in Π_{i}. Therefore, by lemma XI(i) for every history h of Π restricted to Π′, we know that there exists a deduction sequence s′ of \underline{P_{1}}∥ … ∥\underline{P_{m}} →^{t} Ω that traces Π′ via h.

Restriction: let f : D(Π′) → dom (s′) be the associated injective function. Now, from the definition of deduction, we know D(Π′)∩(O(Π′)×sc) = ∅. Therefore by the properties of f, for no Σ ∈ s′, act(Σ) ∈ sc. Thus we can construct a deduction sequence s′′ of (\underline{P_{1}}∥ … ∥\underline{P_{m}})\sc →^{t} Ω simply by applying the restriction rule to each deduction in s′. Moreover, s′′ traces Π′ via h.

Prefixing: Let D = {α_{1}, …, α_{n}}. (By convention, α_{1} ⊴ α_{2} ⊴ … ⊴ α_{n}). Thus we obtain a deduction sequence s′′′ by prefixing the following deduction sequence to s′′:

α_{1}.α_{2}. · · · .α_{n}.p →^{α_{1}} α_{2}. · · · .α_{n}.p · _{α_{2}.α_{3}. · · · .α_{n}.p →^{α_{2}} α_{3}. · · · .α_{n}.p} · . . . · _{α_{n}.p →^{α_{n}} p}

Where p = (\underline{P_{1}}∥ … ∥\underline{P_{m}}) \ sc. Constants: last we construct the deduction sequence s:

\begin{matrix}s′′′(1) \\ p →^{α_{1}} p′ \end{matrix} ; ∑_{r∈R(C)}\underline{r} →^{α_{1}} p′ ; \underline{C} →^{α_{1}} p′ · s′′′(2) · . . . · s′′′(|s′′′|)

where p′ is the right-hand side of the conclusion of s′′′(1). It should be clear from the interpretation that D.(\underline{P_{1}}∥ … ∥\underline{P_{m}})\sc is one of the summands of \underline{C} in 𝔼(T ).

Last, we have to show that s traces Π via history h. Since s′′ traces Π′ via h there must exist an injective function f′′ : D(Π′) → dom (s′′) with the required properties. We construct an injective function f : D(Π) → dom(s) with the three properties. Let f(C, α_{n}) = n and f(A, α) = f′′(A, α)+m when A ∈ O(Π′), where m = 1 if D = ∅ or m = n if D = {α_{1}, …, α_{n}}. m counts the number of elements stuck on the front of s′′ in the construction of s. Now there are three things to show. First, let (A, α), (B, β) ∈ D(Π) be such that (A, α) ≤_{h} (B, β). If both are also in D(Π′) then the result follows by induction: f′′(A, α) + m < f′′(B, β) + m. If neither are, then A = B = C and α ⊴ β (but not vice-versa). Then α = α_{i} and β = α_{j} where i < j. Hence f(A, α) < f(B, β). Otherwise, suppose that (A, α) = (C, α_{i}) and (B, β) ∈ D(Π′). Then f(A, α) = i and f(B, β) > m ≥ i.

The other two properties are even more straightforward by induction and the construction of s. □

6.2.3 The reverse interpretation

We can also go in the reverse direction, and show that every CCS constant environment Δ corresponds to a DQI-system T_{Δ} such that whenever process p reduces to 0, T_{Δ} ⊢ f(p) for some translation function f. The difficult approach would be to attempt to translate the constant equations in Δ into inference rules. This could be done. However, the easy way is just to add a cut rule

\begin{matrix}p →^{t_{1}} p′′ & p′′ →^{t_{2}} p′ \\ p →^{t_{1}·t_{2}} p′ \end{matrix}

to the theory C_{Δ}. This translation is obviously correct. In the following, define the function f by f(p, t, p′) = p →^{t} p′.

Theorem XII For every Δ : Const ⇀ CCS there exists a DQI-system T_{Δ} = (L_{Δ}, R_{Δ}) and a function f : CCS × Act^{∗} × CCS ⇀ L_{Δ} such that p →^{t} p′ if and only if T_{Δ} ⊢ f(p, t, p′) □

6.3 Some consequences

6.3.1 Sequencing is not primitive

It is easy to show that sequencing is not primitive. Let T be any QI-system, and T^{∗} an equivalent DQI-encoding. Then C_{Δ_{T ^{∗}}} is an I-system. Let us extend it to D by adding judgments of form p√ and rules

{p →^{\overline{done}} Ω \atop p√}  \begin{matrix}p →^{τ} p′ & p′√ \\ p√ \end{matrix}

Then we get that T ⊢ A_{1}, …, A_{n} if and only if T^{∗} ⊩ A_{1}, …, A_{n} if and only if there exists a C_{Δ_{T ^{∗}}}-deduction sequence of \underline{A_{1}}∥ … ∥\underline{A_{n}} →^{\overline{done}} Ω, if and only if D ⊢ \underline{A_{1}}∥ … ∥\underline{A_{n}}√. Therefore, if we define T^{∗} = D and the family of functions f_{n} such that f_{n}(A_{1}, …, A_{n}) = \underline{A_{1}}∥ … ∥\underline{A_{n}}√ we obtain

Theorem IV For all QI-systems T = (L, R), there exists an I-system T^{∗} = (L^{∗}, R^{∗}) and a family of injective maps f_{n} : L^{n} → L^{∗} such that T ⊢ A_{1}, …, A_{n} if and only if T^{∗} ⊢ f_{n}(A_{1}, …, A_{n}) □

6.3.2 Deducibility is undecidable

The previous proof has the side-effect that for every p and every i, j ≥ 1, every well-behaved (with respect to Act) terminating trace of p performs signal a_{i} as its last action. We can use this fact to help prove that there is no procedure for deciding if a formula is deducible in an arbitrary DQI-system. The proof goes Chapter 6. The process calculus interpretation 149

via a reduction from the question “is a trace t a trace of process p?”, which is undecidable in CCS. From the interpretation, we know that Π ⊢ A_{1}, …, A_{n} if and only if there exists a deduction sequence s of \underline{A_{1}}∥ … ∥\underline{A_{n}} →^{t·\overline{done}} Ω for some t. When t = α_{1} · . . . · α_{m} (for m ≥ 0), this means that A_{1}, …, A_{n} is deducible iff t · \overline{done} is a trace of \underline{A_{1}}∥ … ∥\underline{A_{n}}.

Theorem XIII There is no procedure to decide whether or not an arbitrary trace t is a trace of an arbitrary CCS process p.

Proof: By a reduction from the halting problem for Turing Machines. □

Theorem XIV Let T be an arbitrary DQI-system. Then there is no procedure that decides whether or not a set of occurrences is deducible or properly deducible in T .

Proof: Suppose not, i.e., that there is such a decision procedure. Then we construct a decision procedure to test whether a given trace is a trace of a given process given some constant environment Δ. Let t ∈ Act^{∗} and p ∈ CCS. Then there must exist a p′ such that p →^{t} p′ in Δ. By theorem XII, this is true iff there exists an f such that T_{Δ} ⊢ f(p, t, p′). By supposition, this is decidable. Contradiction. □

Corollary XIVa There is no procedure to decide whether a given set of formulae is deducible in a given I-, QI- or SDQI-system.

Proof: There cannot be such a procedure for SDQI-systems because the DQIsystems can be easily coded as SDQI-systems: we simply scope every rule by the empty set. By theorem VI, we have that QI-deduction is just proper DQIdeduction. By theorem IV, this in turn implies that there is no descision procedure for I-deduction either. □

6.3.3 Models

Another consequence of the interpretation is that we can use models of CCS to give a model-theoretic account of our notion of deduction, and therefore establish a model-theoretic account of the formulae of particular systems. For example, we have event structures [Win82,Win88,NPW81]. For other kinds of models, see [WN94].

What does our interpretation actually interpret? There are two related answers. The first is that it interprets deductions: a deduction is a terminating Chapter 6. The process calculus interpretation 150

transition sequence (or an evaluation) of a particular process. Thus a denotational semantics of a deduction would be a trace, or set of traces of a particular process. The denotation of a formula A (via the Heyting semantics) would then be the set of all traces of the process \underline{A}.

The second answer is that it interprets formulae directly: the meaning of formula A is the process \underline{A}. Here, a denotational semantics for CCS (e.g., using labelled event structures [Win82]) gives a denotation to formulae directly: a formula is a labelled event structure.

Another model is the synchronization tree. If we attempt to evaluate process \underline{A}, we are attempting to find a deduction of A. Thus the synchronization tree of a process corresponds to the tableaux of a formula. The idea that the tableaux method for a deductive system gives its computational semantics is also found in more standard proof theory. Underwood [Und95] uses tableaux in this way to give semantics to intuitionistic predicate logic: “a bounded tableau search procedure can be interpreted as the computational content about prefixes of (possibly infinite) Kripke countermodels”.

6.4 Chapter Summary

We have seen that DQI-deduction corresponds to the termination of CCS processes. This is philosophically appealing: it confirms that evaluation semantics judgments really do concern process evaluation. We can also reinterpret standard results about CCS as results about DQI-deduction. For instance, the undecidability of termination for CCS programs implies the undecidability of DQI-deduction. Moreover, we can use process calculus tools to manipulate deductions.

Conclusions

In this thesis I have investigated a way of improving the pragmatics of operational semantics. Particularly, I have presented a way of decreasing the syntactic complexity of and improving the modularity of both semantic definitions and proofs about them. I achieved this by increasing the functionality of the notion of deduction. Thus I have traded off the complexity of the metatheory with the complexity of semantic definitions. However, the increase in complexity of the metatheory has been slight, and the result corresponds to a well-understood notion of computation. This seems a small price to pay.

7.1 The theory of interacting deductions

Standard proof theories are all essentially functional in flavour. An inference rule is seen as a function that delivers a proof of some result given proofs of its arguments. One strand of this thesis has been to ask what a concurrent flavour of proof theory would look like.

The basic theory The novel idea was to introduce the notion of interaction between inference trees. Thus a deduction would be a forest of interacting inference trees. In the basic theory of interacting deductions, a deduction would be represented by a pair (F, I), where F is the forest and I the interactions — pairs of formula occurrences. We saw that they obeyed a simple temporal property, that one cannot interact with a previous state. Deductions were built from simple interacting rules: finite sets of ordinary rules, each of which are meant to be applied to different parts of the forest simultaneously.

We saw that we could indeed improve the modifiability and modularity of definitions and proofs using the proof fragmentation theorem, which allows one to isolate those parts of a deduction relevant to the result at hand.

Extensions We saw some simple examples based upon a transition semantics. We gave some evaluation semantics too. However, to do so simply we needed to introduce a notion of sequentiality into the metatheory. The result, the theory of Chapter 7. Conclusions 152

sequential deductions was easily codable in the basic theory. It simply provided a way to give evaluation semantics easily.

We also saw the method of pruning deductions. This was introduced to recover the notion of trace from the evaluation semantics. We also saw that it could be used for a number of purposes, for instance to characterize possible deadlock and nontermination, and to provide propagation-free abort rules. Another proof-theoretic feature used to capture various different semantic features was the scoping side-condition.

The feeling is that although the basic theory is expressive enough, sometimes simple features are so cumbersome to express that we need to add extensions (“tweaks”) to the basic theory for the sake of simplicity. Whereas the notions of sequencing, pruning and scoping are straightforward, one wonders if they cover everything. Perhaps we shall need an infinite progression of ever more refined tweaks.

The fact that we require tweaks suggests that our proof theory is not quite right for our application. On the other hand, the fact that these tweaks seem to be ubiquitous suggests that we have discovered a standard repertoire of semantic techniques.

The content of interaction The basic theory is certainly flawed on two counts. First, when we wished to prove results by induction on the depth of inference of inference trees, we could not use the definition of deduction directly: we had to fragment deductions manually to obtain the individual trees. This occurred in proofs about both transition and evaluation semantics. Second, sometimes we had to develop a semantics-specific notion of visible occurrence to aid our proofs. In fact, the notion of visibility was actually a property of the structure of particular deductions than the semantics. An occurrence was visible if it should have been part of an interaction link, but was not. So we introduced the notion of dangling interaction, which gave a formal treatment of the content of interactions.

This extension proved fundamental. It achieved an elegant and usable definition of deduction which — like Natural Deduction — included the notions of inference (rule application) and the mechanism of assumption and discharge (assembly). This refinement of deduction also gave rise to the technique of proof assembly, which was dual to proof fragmentation. Fragmentation showed how we could break deductions to reason about individual parts. Assembly showed how we could construct proofs about deductions from proofs of individual parts.

What deductions are Last, we saw that our resultant theory was not ad hoc: the computational semantics of a deductive system was a set of CCS constant definitions. Formulae corresponded to processes and deductions corresponded to terminating evaluations of processes. In this framework, we saw that dangling interactions were just action prefixes (and thus assembly was communication), scoping was restriction, sequencing was sequential composition and pruning was just unfinished evaluation.

Chapter 7. Conclusions 153

CCS is well-understood and foundational in the theory of concurrency. Therefore the correspondence between CCS and interacting deductions lends credence to our belief that we have a metatheory suitable for giving semantics to concurrent languages. It is also philosophically attractive for at least two other reasons. First, in terms of our application, it showed that since deductions were process evaluations, then evaluation judgments really were about evaluation. Second, it allows us to reinterpret results about CCS in our setting. For example, we saw that deducibility was undecidable. Another result was the reinterpretation of models of processes as models of deduction. Practically, the correspondence also suggests how we may use process calculus simulators to provide prototype interpreters for languages.

7.2 Application to operational semantics

Our initial examples concerned transition semantics of a simple process calculus P. We saw that we did not need to propagate action information to obtain a definition of processes. However, we also saw some limitations of not doing so: we could not limit the number of interactions to one per transition, and anyway action information is very useful in process calculus applications.

Nevertheless, propagation-freeness can be useful. We saw that we could add a notion of store to the various semantics of P almost uniformly. Moreover we obtained a modular proof about the stores which held true without alteration for each of the semantics.

We then considered evaluation semantics. We saw that we could give evaluation semantics, but not in as simple a way as we might like. Along the way we discovered a distributed control-stack semantics which could be useful for languages with firstclass continuations.

We introduced the notion of sequentiality to permit simple presentations of evaluation semantics. The resulting evaluation semantics of P(;) (P extended with sequential composition) was much more concise than the standard operational semantics. However, the results were not so clear in the example translation correctness result. Negatively, the only equivalence easily definable in the evaluation semantics was a trace equivalence (and even then we needed the notion of pruning). This equivalence is acceptable for deterministic languages, and indeed many “real” programs are deterministic. Positively, we saw that the evaluation semantics proof was less structurally complex than the transition semantics proof. It contained no subinductions on the length of transition sequences.

We saw another, more positive use of evaluation semantics in the soundness proof of our Hoare Logic for the partial correctness of CSP. The evaluation judgments were ideally suited to interpret Hoare triples {ϕ} p {ψ} which concern the effect of the evaluation of p. The proof was easy, and it could have been made even easier if we had not fragmented stores from evaluation judgments!

We also considered how many different linguistic features we could capture in an evaluation semantics. Most of the features we considered could be captured:

Chapter 7. Conclusions 154

shared variables, dynamic process creation, nested parallelism, multicasting and procedures. This latter case showed that while we could add procedures in a modular fashion, the result was a mess. In particular, it feels as if environments ought always to be bound to program judgments.

One kind of feature we cannot expect to model are pre-emptive actions that must occur instantaneously. Another kind of feature we cannot model easily are those that require a snapshot of the entire system (e.g., broadcasting).

7.3 Further work

In the body of the thesis, we noted several possible avenues of further research. Chapter two suggested that we might be able to make a more careful analysis of the kinds of propositions provable via proof fragmentation (and in retrospect also proof assembly). Perhaps there are further techniques to be discovered. Chapter three suggested that the coinductive notion of deduction might be useful in the field of abstract interpretation [CC77,Sch95] for concurrent languages. Chapter five noted some improvements to our Hoare Logic. Last, chapter six suggested that we could use process calculus simulators to implement semantic definitions, and also to describe models of deduction.

In addition, there are at least four other topics which suggest themselves: scoping, static semantics, exploration of further proof-theoretic extensions and the relationship to linear logic.

7.3.1 Scope Extrusion

Our scoping side-condition corresponds to CCS-like restriction. However, there are languages (such as the π-calculus [MPW92], Concurrent ML [Rep91a]) which require a more liberal kind of scoping, which permits scope-extrusion, where scoped channels may be communicated out of scope.

We have stressed the idea that deduction order is opposite to evaluation order. To this way of thinking, scope extrusion (at least for the appropriate variant of P) is not a problem: when we come to apply the (appropriate variant of) the scoping condition, we shall already know how the scoped channels have been used, and therefore we can widen the forest of trees which are scoped to include those parts of those trees to which scope has been extruded.

For functional languages, where the evaluation judgment can return a value (including a channel) the situation becomes more complex. There scope can be extruded in two ways: first by communication, and second by function value. For example, channel x in x will return channel x, even though it will be out of scope whenever it is subsequently used.

To capture scope extrusion in this setting would require a finer notion of judgment and preorder between judgments. For instance, an evaluation judgment would be split into a simple kind of sequent: A ⇒ B, where A was an expression Chapter 7. Conclusions 155

and B its value. The point here would be that the meaning of dependency would alter. If A ⇒ B occurred above A′ ⇒ B′ in a forest F, then A′ would precede A, and both A and B would precede B′. Thus evaluation would be seen as “going up” the left-hand side of judgments and “going down” the right-hand side. To capture scope extrusion, we would have to scope left-hand sides only, and ensure that every occurrence that came after it in the preorder obeyed the scoping conditions. Of course, we should always have to make sure that rules applied subsequently which used a scoped channel did not violate the required condition.

7.3.2 Static semantics

In this thesis we have concentrated primarily on the use of interaction in dynamic semantics. It seems harder to use interaction usefully in static semantics. One exception would be name servers. In the definition of Standard ML, the static semantics have to pass around the set of currently generated type names so that whenever a new name is required (e.g., rules (19) and (20) on page 25), it is guaranteed not to clash with a previous choice of name.

Another way to capture this idea of “generativity” would be to include special “fresh” judgments:

fresh(α)

−

free.names(X \ {α})
free.names(X ∪ {α})

free.names(X)

The idea would be that each invocation of the fresh judgment would pick a different name from the global set of free names. Of course, such a scheme would require that only one name server existed per deduction.

7.3.3 More Extensions

Relabelling

We consider the use of scoping to extend P with relabelling. The syntax is extended to get P([f]):

p ::= ⋯ | p[f]

where f : A → A is a relabelling function (see section 6.1.2). The simplest way to model CCS-like relabelling would be to propagate the relabelling function f upwards, and apply it directly at the communication rule, for instance as in:

{p√_{f} \atop a.p√_{f}} − {q√_{g} \atop b̄.q√_{g}} f(a) = g(b)

However, we can also find DQI-rules which avoid propagation. These make use of dangling interactions in an essential way. The idea is that each communication signal is routed through a series of “relabelling stations” until it is received.

\begin{aligned}{p√ \atop a.p√} +comm(p, a) & {q√ \atop ā.q√} −comm(p, a) & {Rel(q, f) \atop Rel(q, f)} \begin{matrix}−comm(p, a) \\ +comm(q, f(a)) \end{matrix} \\ & \begin{matrix}p√ Rel(p, f) & REL(p,f) \\ p[f]√ \end{matrix} & Rel(p, f) \end{aligned}

Chapter 7. Conclusions 156

Where REL(p, f) = {comm(q, a) | q ∈ P([f]), p ≠ q, a ∈ Act}. The label comm(p, a) is meant to denote that the action a has been performed, and is associated with the process p. This process tag is meant to distinguish different occurrences of the same relabelling function, e.g., so that p[f][f] is guaranteed to relabel every action of p via f twice.

Once again, we have found that the evaluation semantics of a straightforward concurrency primitive is not so straightforward. One obvious proposal would be then to extend the metatheory of deduction to contain relabelling. At first glance, this appears quite attractive. First, it would not ruin our interpretation of deduction — relabelling is already a feature of CCS. Second, it would improve the modularity of DQI-deduction again: e.g., we might be able to reuse the algebraic definition of stores for some other storage device.

However, it is hard to see what relabelling corresponds to logically. If Roger participated in a discussion about A, then his interlocutor was not discussing f(A) (unless f is the identity of course). Talk of “translation functions” is fatuous: one cannot guarantee +A with −¬A. The lack of a deduction-theoretic explanation of relabelling is a serious obstacle to its institution in the meta-theory of deduction.

Metatheories ad nauseam

We introduced sequencing into the metatheory of deduction because although we could capture sequential composition in an evaluation semantics I-system, we could not capture it simply. We have also seen several other similar proposals. For example, we have the above relabelling proposal. Another example is the sequent-style rules for scope extrusion. Another concerns the propagation-free abort rules which made use of pruning rules. The problem here is that the result was not neat. We might be tempted to introduce the notion of escaping into our metatheory, perhaps using the idea of continuation proof [Und93, §5.3.5]).

There are two questions that concern this drive for better metatheories of evaluation semantics. The first is how many different extensions such a philosophy would need. At some point we have to draw the line and say “this is our theory of deduction”. To some extent I have done this already: the fact that the theory of interacting deductions corresponds to the well-known calculus CCS suggests that we have a reasonable notion of deduction which is expressive enough.

The second question concerns the pragmatic value of such a philosophy. The law of diminishing returns tells us that the more we tweak our metatheory the less gains we shall achieve. We have already seen that evaluation semantics has limited value for concurrency: the only equivalence we can talk easily about is trace equivalence. This suggests that it is not a suitable medium for analysing nondeterminism. Of course, that is not to say that evaluation semantics for concurrency has no merit. Similarly, more complex theories of deduction (provided they are comprehensible) may also have meritorious applications.

There will always be semantic features that are hard to express in metatheories that are not tailored to express them. Perhaps one solution to the problem might be to consider a universe of metatheories of deduction and their relationships, Chapter 7. Conclusions 157

perhaps in a manner similar to Moggi’s use of monads for modularity in denotational semantics [Mog91]. Maybe Milner’s work on action calculi and control structures [Mil,MRP] is a suitable framework.

7.3.4 The relationship to Linear Logic

Our notion of deduction is inherently linear: each formula occurrence in a deduction is the conclusion of one rule and the premise of at most one rule. In this section we consider the relationship between linear logic [Gir87,Gir89] and interacting deductions. It turns out that I-deduction is fairly easy to characterize in linear logic, using just tensor product and linear implication. QI-deduction is harder to characterize: it requires two tensors, one commutative and the other non-commutative. There does not seem to be any simple logical account of DQIdeduction.

A logical treatment of I-deduction The following account is a logical perspective of I-deduction owing to Gordon Plotkin. Let Γ, Δ range over multisets of formulae (see figure 2–2 for a formal account of multisets). In this context, I write Γ, Δ for the multiset union of Γ and Δ and 1 for the empty multiset. Then we define ⊢ Δ inductively using the following rules:

⊢ 1

{⊢ Γ_{1}, …, Γ_{n}, Δ \atop ⊢ A_{1}, …, A_{n}, Δ}  when  \{ {Γ_{1} \atop A_{1}} , …, {Γ_{n} \atop A_{n}} \} is an I-rule.

Thus ⊢ Γ if and only if Γ is deducible in the ambient system of rules. This characterization is logically straightforward, but it is not amenable to the technique of fragmentation.

Now, if we code multisets of formulae Γ = A_{1}, …, A_{n} by the intuitionistic

linear formula ϕ_{Γ} = A_{1} ⊗ … ⊗ A_{n}, and we code rules r = \{{Γ_{1} \atop A_{1}}, …, {Γ_{n} \atop A_{n}}\} by the formula

ϕ_{r} = (ϕ_{Γ_{1}} ⊸ A_{1}) ⊗ … ⊗ (ϕ_{Γ_{n}} ⊸ A_{n})

Then I believe that ⊢ Γ (under ambient rules r_{1}, …, r_{n}) if and only if !ϕ_{r_{1}}, …,!ϕ_{r_{n}} ⊢ ϕ_{Γ} is provable in intuitionistic linear logic. Apart from helping us to understand I-deduction better, another consequence of this result would be to use linear logic programming languages such as Forum [Mil94] or Lolli [HM94] or others [Milar] to build prototype interpreters. Perhaps also it could inspire a coherence-space semantics [GLT89].

A logical treatment of QI-deduction The main problem in giving a simple inductive account of QI-deduction is that sequencing and rule application are not distinct operations. In our definition, we chose to say that premises were sequenced after conclusions (given that the evaluation order seems to be opposite to deduction Chapter 7. Conclusions 158

order). Any definition of QI-deduction must take this into account. I cannot think of a simple way to do this here, although I can for the DQI-deductions.

The main problem in giving a logical account is that we require two tensors: one commutative tensor as before and one non-commutative tensor for sequencing. Retoré [Ret93] studied such a linear logic, introducing the précède tensor < which was both self-dual (i.e., (A < B)^{⊥} = (A^{⊥} < B^{⊥})) and in-between tensor and par: A ⊗ B ⊸ A < B and A < B ⊸ A^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}_{.}_{.}_{.}_{.}_{.}_{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.}^{.} B. Reddy [Red93b,Red93a] uses this work to help him develop a logic for reasoning about state in imperative programming languages. Here, sequent calculus contexts correspond not to multisets but to partially-ordered multisets. Reddy writes the non-commutative tensor ⊳. Using his sequent calculus LLMS, we could code a Q-atom

\begin{aligned}P_{11} ▶ … ▶ P_{1n_{1}} & ⋯ & P_{m1} ▶ … ▶ P_{mn_{m}} \\ & C \end{aligned}

as [(P_{11} ⊳ … ⊳ P_{1n_{1}}) ⊗ … ⊗ (P_{m1} ⊳ … ⊳ P_{mn_{m}})] ⊸ C

I do not know, but I think it would not be hard to prove that in this setting QIdeducibility corresponded to provability in LLMS. I do not know of a logic programming language that could be used to build prototype interpreters, although we may be able to appropriate Retoré’s coherence space semantics for models.

A logical treatment of DQI-deduction We have suggested that I-deducibility can be captured in intuititionistic linear logic and QI-deducibility can be captured in the more exotic linear logic model of state. However, it is not clear what kind of logic could capture DQI-deduction. The problem is that it is not clear how to treat dangling interactions and assembly. One solution might be to use a classical linear logic (i.e., introduce linear negation). This would use linear negation to distinguish opposite perspectives of dangling interactions, which would be treated as logical hypotheses. Thus we may have a sequent calculus style presentation of DQI-deduction (in much the same way that we can get sequent calculus style presentations of natural deduction [Sun84b]). For this we need a grammar of contexts which allows arbitrarily deep nesting of sequential and parallel composition of formulae:

Γ ::= 1 | A | Γ, Γ | Γ; Γ
Γ[·] ::= [·] | Γ, Γ[·] | Γ[·], Γ | Γ; Γ[·] | Γ[·]; Γ

and the following rules:

⊢ 1

Γ ⊢ Δ Γ′ ⊢ Δ′
Γ; Γ′ ⊢ Δ; Δ′

Γ ⊢ Δ Γ′ ⊢ Δ′
Γ, Γ′ ⊢ Δ, Δ′
{Θ ⊢ Γ \atop D; Θ ⊢ A}  when  {Γ \atop A} D is a DQI-rule.
{Γ[A, A^{⊥}] ⊢ Δ \atop Γ[1] ⊢ Δ}

Γ[(Γ_{1}; Δ_{1}) , (Γ_{2}; Δ_{2})] ⊢ Δ
Γ[(Γ_{1}, Γ_{2}) ; (Δ_{1}, Δ_{2})] ⊢ Δ

Chapter 7. Conclusions 159

plus rules for the commutativity and associativity of ‘,’, the associativity of ’;’ and the unity of 1. There are three interesting rules. The first is the coding of DQIrules: this rule clearly shows how rule application corresponds to sequencing. The left hand side of the conclusion, D; Θ shows that interactions occur before premises are evaluated. The other choice, represented by Θ; D, shows that interactions occur after premise evaluation.

The other two interesting rules are the assembly rules (the left-hand side rules). The first “assembles” one interaction link. The second schedules interaction links.

We could, perhaps, use higher-order linear formulae to encode the sequents Γ ⊢ Δ as ϕ_{Γ} ⊸ ϕ_{Δ} (where ϕ_{Γ} is some suitable encoding of context Γ). But then it is hard to see how to code rules: how do we distinguish rule premises and dangling interactions?

Chapter 7. Conclusions 160

Appendix A

Languages of operational judgments

In this appendix, we give a brief account of the notion of languages of terms and formulae. In section A.1 we give an axiomatic description. In section A.2 we give an algebraic account, and sketch its use in operational semantics.

A.1 A formal definition of language

This definition comes from [Gar95]. A (many-sorted) language L is a quintuple (S, L, V, F V, sub) where S is a set of sorts, L is an S-sorted family of sets of formulae (ranged over by A, B, C, …), V is an S-sorted family of sets of variables that appear in L (ranged over by x, y), F V : L_{⊤} → ℘(V_{⊤}) is an S-sorted function that returns the free variables of a formula, and sub : (V → L) → L → L is a function that applies a substitution θ : V → L to a formula, such that

1. If A ∈ L_{s} then (sub θ A) ∈ L_{s}
2. If x ∈ V_{s} then (sub θ x) = θ_{s}x
3. sub id = id_{L}
4. (sub θ_{0}) ∘ (sub θ_{1}) = (sub θ_{3}) where for x ∈ V_{⊤}, θ_{3}x = sub θ_{0} (θ_{1}x)
5. F V (x) = {x}
6. F V (sub θ A) = ⋃_{x∈F V (A)} F V (θx)
7. If θ_{0} ↾ (F V (A)) = θ_{1} ↾ (F V (A)) then sub θ_{0} A = sub θ_{1} A

We abbreviate sub θ A by θA, and the composition of substitution θ_{1} after θ_{0} by θ_{1}θ_{0}. If L is a language, we write A ∈ L if A is a formula of L. Similarly, we often treat L as if it were just a(n S-sorted) set of formulae.

A.2 Algebras and operational semantics

An operational semantics consists of a language of judgments that relate to the evaluation of programs, and a set of rules that build proofs of these judgments. In this section, we describe how one can use many-sorted algebraic signatures with equations to specify an arbitrary language of judgments.

A judgment consists of some evaluation symbol (e.g., ⇒) and one or two machine configurations. That is, a judgment will be a term of the algebraic signature (i.e., an element of the term algebra).

A configuration consists of a program and a machine state, which may be composed of various different entities (e.g., a store, an environment or an input-output buffer). For want of a better term, we call these entities machine components.

We summarize Wechler’s [Wec92, ch4] account of Σ-algebras here. The reader familiar with universal algebra may safely skip this section. We use it only to describe judgment-formulae and the notions of substitution and instantiation which make up the notion of language described in section 2.1. Further details can be found in [Coh65,Grä79,GB90,ST99].

Sorted families of sets Let S be a set of sorts, and X a set. Then an S-sorted family of subsets of X is a function F : S → ℘(X). For s ∈ S, we write F_{s} for F (s). We also define F_{⊤} = ⋃_{s∈S} F_{s}. When F and G are S-sorted families of sets, an S-sorted function from F to G (written f : F → G) is an S-sorted family of sets of functions f_{s} : F_{s} → G_{s}. When F is an S-sorted family of sets, the identity function id_{F} is the S-sorted family of identity functions: id_{s} : F_{s} → F_{s}.

When S is a set, an S-sorted (or S-indexed) family A of sets of type T is a function A : S → ℘(T). We write A_{s} for the set of type T corresponding to sort s. We define the union, intersection, powerset operations over indexed families of sets pointwise. E.g., (A ∪ B)_{s} = A_{s} ∪ B_{s}. We use ℘_{fin} for the finite powerset operation.

Σ-Algebras. A (many sorted) algebraic signature Σ is a pair ⟨S, F ⟩ where S is a set of sorts, and F is an S^{∗} × S-sorted family of sets of function names. We abbreviate f ∈ F_{s_{1},...,s_{n},s} as f : s_{1} ⋯ s_{n} → s. When n = 0 we write f : s and f is said to be a constant.

A Σ-algebra is a pair ⟨A, F ⟩ where A is an S-sorted set and F is a family of operations such that each operation symbol f : s_{1} ⋯ s_{n} → s of Σ is realized as an operation f^{A} : A_{s_{1}} × ⋯ × A_{s_{n}} → A_{s}.

An algebraic signature Σ defines a set of Σ-terms that may be constructed from metavariables and function names. Let Σ = ⟨S, F ⟩ be an algebraic signature, let V be an S-sorted family of countably infinite sets of metavariable universes, and X an S-sorted set of metavariables from V. Then, for s ∈ S, we say T_{Σ}(X)_{s} is the set of terms of sort s with metavariables in X. It is defined inductively:

• if x ∈ X_{s} then x ∈ T_{Σ}(X)_{s} • if f ∈ F_{s_{1},...,s_{n},s} and t_{1}, …, t_{n} are in T_{Σ}(X)_{s_{1}}, …, T_{Σ}(X)_{s_{n}} respectively, then

f(t_{1}, …, t_{n}) ∈ T_{Σ}(X)_{s}.

The set of terms T_{Σ}(X) forms the term-algebra over X whose operations are just the term constructors. We define the ground terms to be members of the set T_{Σ}(∅) which is written T_{Σ}.

A substitution θ is an S-sorted family of total functions such that θ_{s} : X_{s} → T_{Σ}(X)_{s}. The θ-instance of term t is given by the recursively defined function I_{s} : (X → T_{Σ}(X)) → T_{Σ}(X)_{s} → T_{Σ}(X)_{s}:

• I_{s} θ x = θ_{s}(x) when x ∈ X_{s}

• I_{s} θ f(t_{1}, …, t_{n}) = f(I_{s_{1}} θ t_{1}, …, I_{s_{n}} θ t_{n}) when f : s_{1} ⋯ s_{n} → s.

For brevity, we write θt for I_{s} θ t.

We show how Σ-algebras with equations can describe the syntax of programming languages, the structure of and operations over machine components, and hence the structure of semantic judgments.

Program Syntax We use Σ-algebras to give the syntax of programming languages. The sorts are the syntactic classes and the operations the productions of a grammar. For instance, the simple language with grammar

\begin{matrix}e ::= x | n | e_{0} + e_{1} \\ c ::= x := e | c_{1}; c_{2} \end{matrix}

is represented by the algebra with sorts S = {e, c, V ar, ℤ} where V ar is a set of variable names and ℤ is the set of integers, and functions

+ : e × e → e
:=: V ar × e → c
; : c × c → c

The set of terms over this signature corresponds to the set of syntax trees of the language, which may contain metavariables. One does not usually identify non-identical terms, although it can sometimes be useful to do so (see, for example [Mil91, p25]).

Machine components We use many-sorted algebraic signatures with equations to define the various components that record the state of an interpreter. We use equations to define various primitive operations over them. For example, simple stores can be defined by the following signature:

srts: Store, V ar, ℤ
fns: \begin{matrix}empty : Store \\ ·[·/·] : Store × ℤ × V ar → Store \\ ·(·) : Store × V ar → ℤ \end{matrix}

metavars: σ, σ′, …, σ_{0}, σ_{1}, …
eqns:  \begin{matrix}empty(x) = 0 \\ σ[n/x](x) = n \\ σ[n/x](y) = σ(y) if y ≠ x \end{matrix}

Appendix A. Languages of operational judgments 164

Many sorted equations Given an algebraic signature Σ, an equation of sort s is a triple ⟨X, t_{0}, t_{1}⟩ usually written ∀X(t_{0} = t_{1}) or just ∀x_{1} : s_{1}, …, x_{n} : s_{n}.t_{0} = t_{1} when x_{i} ∈ X_{s_{i}} for all i = 1, …, n, or even t_{0} = t_{1} when the universal quantification of the variables is understood.

We can consider a set of equations E as a family Ē of ℘_{fin}(V)-indexed family of S-sorted families E(X) of sets E(X)_{s} = {(t_{0}, t_{1}) | ∀X(t_{0} = t_{1}) ∈ E_{s}}.

A clone congruence R is a family of S-sorted families of relations R(X) where X_{s} is a finite subset of V_{s} for all s, which are congruences invariant under αconversion. The full details are in [Wec92, §4.1]. The importance of clone congruences come from the generalized Birkhoff criterion for equational theories: A set E of equations is an equational theory (i.e., describes some abstract class of algebras) if and only if Ē is a clone congruence. Of course, not every set of equations E will describe a clone congruence in this way until we close them with respect to reflexivity, symmetry, transitivity, congruence and α-equivalence.

The ground equational theory of E, written G(E) is an S-sorted relation such that G(E)_{s} = {(θt_{0}, θt_{1}) | ∀X(t_{0} = t_{1}) ∈ Ē_{s}, θ : X → T_{Σ}}. That is, it is the set of pairs of equal ground terms (terms without variables).

Then the initial semantics T_{⟨Σ,E⟩} of ⟨Σ, E⟩ is the class T_{Σ}/=_{G(E)}, where =_{G(E)} is the clone congruence generated by the ground equational theory of E. The initial semantics of an abstract syntax (without equations) will be a set of equivalence classes, each of which being singleton terms (representing programs). The initial semantics for the store will be sets of equivalence classes of stores and of values. Each store equivalence class will be singleton since distinct stores are not identified. For each value (here, integer) there will be an equivalence class containing every store lookup expression that equals it. So, for instance, the equivalence class of the value 3 will contain the values 3, σ[3/x](x), σ[3/y][4/x](y) etc.

Directed equations We can read the equations for stores operationally by directing the equations to make a term rewriting system:

\begin{matrix}∀x : V ar. & empty(x) → 0 \\ ∀x : V ar, n : ℤ, σ : Store. & σ[n/x](x) → n \\ ∀x : V ar, y : V ar, n : ℤ, σ : Store. & σ[n/x](y) → σ(y) if y ≠ x \end{matrix}

We do not bother to give the details here: these may be found in [Wec92, §4.1.3].

Appendix B

The correctness of CSP

In this appendix, we outline the main details of an equivalence between the semantic definition of CSP given in chapter 5. This should increase our confidence that that semantics for CSP is correct.

This equivalence shows how terminating sequences of a cut-down version of Plotkin’s Structural Operational Semantics for CSP [Plo83] corresponds to the CSP evaluation judgments. The proof proceeds via three intermediate semantic definitions. Section B.1 presents the SOS, CSP_{SOS}, which gives an interleaving semantics. Section B.2 presents a more truly concurrent semantics CSP_{MSOS}, and indicates their equivalence. Section B.3 presents an interacting transition semantics, CSP_{I}, and indicates its equivalence with CSP_{MSOS}. These results mirror those in section 2.5.3. Section B.4 is the main part which shows how an extenstion of CSP_{I} (called CSP_{CUT}) relates to CSP.

We shall assume all of the auxiliary definitions presented in chapter 5, as well as some new ones, defined shortly. In particular, the grammar is as before, as is the static semantics.

In this appendix, we shall use Plotkin’s convention for abbreviating families of transition rules (also in [Plo83]. When n ≥ 1,

{γ ⟶^{λ} γ_{1} | … | γ_{n} \atop γ′ ⟶^{λ′} γ′_{1} | … | γ′_{n}}

abbreviates the n rules

{γ ⟶^{λ} γ_{1} \atop γ′ ⟶^{λ′} γ′_{1}}  ⋯  {γ ⟶^{λ} γ_{n} \atop γ′ ⟶^{λ′} γ′_{n}}

and for m, n ≥ 1,

\begin{matrix}γ′ ⟶^{λ′} γ′_{1} | … | γ′_{m} & γ′′ ⟶^{λ′′} γ′′_{1} | … | γ′′_{n} \\ γ ⟶^{λ} γ_{11} | … | γ_{1n} | … | γ_{m1} | … | γ_{mn} \end{matrix}

Appendix B. The correctness of CSP 166

abbreviates the m × n rules

\begin{matrix}γ′ ⟶^{λ′} γ′_{1} & γ′′ ⟶^{λ′′} γ′′_{1} \\ γ ⟶^{λ} γ_{11} \end{matrix} … \begin{matrix}γ′ ⟶^{λ′} γ′_{1} & γ′′ ⟶^{λ′′} γ′′_{n} \\ γ ⟶^{λ} γ_{1n} \end{matrix}
…

\begin{matrix}γ′ ⟶^{λ′} γ′_{m} & γ′′ ⟶^{λ′′} γ′′_{1} \\ γ ⟶^{λ} γ_{m1} \end{matrix} … \begin{matrix}γ′ ⟶^{λ′} γ′_{m} & γ′′ ⟶^{λ′′} γ′′_{n} \\ γ ⟶^{λ} γ_{mn} \end{matrix}

In this appendix, we treat I-systems as special cases of DQI-systems. This is purely to facilitate the equivalence proof.

B.1 A Structural Operational Semantics of CSP

This section gives a transition semantics CSP_{SOS} for CSP. It is based on Plotkin’s Structured Operational Semantics for CSP [Plo83], but differs in three ways. First, the parallel composition of processes occurs only at the top level. Second, because of this, we have to model partially aborted networks of processes differently. When one process aborted, Plotkin simply sequenced another abort command after the rest of the network. Here we use a different trick: we extend the syntax of programs to include a special “aborted process” production:

p ::= R :: c | p ∥ p | aborted

together with the equations aborted ∥ aborted = aborted. This addition is a convenience to allow us to represent partially aborted networks of processes.

The third difference is that expressions (and hence guarded commands) cannot abort.

B.1.1 The Labelled transition system

The following labelled transition systems are required for CSP. We require one each for expressions, guarded commands, commands and programs. These make use of the following communication labels.

Communication labels

The first definition comes straight from [Plo83]. To model communication, we define the set of labels

Λ = {P?v, Q :: P?v, Q!v, P :: Q!v | P, Q ∈ P id, P ≠ Q, v ∈ V al} ∪ {ε}

ranged over by λ. Labels consist of three parts. The first (optional) part denotes the name of the process that has performed the communication (the agent). The second denotes the name of the other process involved in the communication. The third denotes the message that was sent. No label has form P :: P!v (or P :: P?v). Such labels would correspond to the action of self-communication, which is impossible for synchronized communication.

Appendix B. The correctness of CSP 167

Configurations

We require four transition systems: one each for the expressions, guarded commands, commands and programs. From the informal account of the semantics of CSP, an expression configuration can either be an expression waiting to be evaluated or its value. A guarded command can either fail or select a command that can proceed. Selecting a command involves making its first step, which may abort. Commands may either terminate or abort, as may programs. The following table expresses this more formally.

Syntactic class (L)TS  Terminal Config’ns (Ω) Config’ns (Γ)
expressions ⟨Γ_{e}, Ω_{e}, ⟶_{e}⟩ V al Exp × Store ∪ Ω_{e}
g’d commands ⟨Γ_{g}, Ω_{g}, Λ, ⟶_{g}⟩ Com × Store ∪ Store GCom × Store ∪ Ω_{g}

                             ∪{failure, aborted}

commands  ⟨Γ_{c}, Ω_{c}, Λ, ⟶_{c}⟩ Store ∪ {aborted}  Com × Store ∪ Ω_{c}
programs  ⟨Γ_{p}, Ω_{p}, Λ, ⟶_{p}⟩ Store ∪ {aborted}  P rog × Store ∪ Ω_{p}

The transition rules can be found in figures B–1 and B–2, where we have dropped the subscripts from the transition relations.

Before we give the rules for the programs, we describe a partial function over labels, R :: (·) : Λ ⇀ Λ, which takes a label of form P?v or P!v and adds R :: in front if R ≠ P. If the label is empty, it is undefined — thus {| R :: ε |} = ∅.

R :: (λ) = \{ \begin{matrix}R :: P?v & if λ = P?v and P ≠ R \\ R :: Q!v & if λ = Q!v and Q ≠ R \end{matrix}

Figure B–2 lists the transition rules for programs. We do not discuss them here: the details are just those of [Plo83].

B.2 Stage one: from interleaving to true concurrency

The first step of the equivalence proof is essentially just that of section 2.5.3 — where we present a transition I-system for CSP, and prove it equivalent to the previous structured operational semantics. Just as before, this proof is factored into two: first between CSP_{SOS} and a semantics CSP_{MSOS} which allows multiple communications to occur simultaneously; second, between this intermediate language and the I-system CSP_{I}. In this section we give CSP_{MSOS} and state the equivalence with CSP_{SOS}. Modulo some difficulty with stores, it is no more exciting than before.

The two systems only differ in the rules for programs. Figure B–3 lists the rules for programs. Again, each program rule is decorated with multisets of labels from Λ. We define complementation over Λ by

\overline{R :: P!v} = P :: R?v and \overline{R :: P?v} = P :: R!v

Appendix B. The correctness of CSP 168 Rules for expressions

⟨v, σ⟩ ⟶ v ⟨x, σ⟩ ⟶ σ(x) \begin{matrix}⟨e_{1}, σ⟩ ⟶ v_{1} & ⟨e_{2}, σ⟩ ⟶ v_{2} \\ ⟨e_{1} op e_{2}, σ⟩ ⟶ app(op, v_{1}, v_{2}) \end{matrix}

Rules for guarded commands

⟨b, σ⟩ ⟶ tt  ⟨c, σ⟩ ⟶^{λ} ⟨c′, σ′⟩ | σ′ | aborted

⟨b⇒c, σ⟩ ⟶^{λ} ⟨c′, σ′⟩ | σ′ | aborted

⟨g_{i}, σ⟩ ⟶^{λ} ⟨c′, σ′⟩ | σ′ | aborted

⟨g_{1} [] g_{2}, σ⟩ ⟶^{λ} ⟨c′, σ′⟩ | σ′ | aborted

i = 1, 2
⟨b, σ⟩ ⟶ ff

⟨b⇒c, σ⟩ ⟶^{ε} failure

⟨g_{1}, σ⟩ ⟶^{ε} failure ⟨g_{2}, σ⟩ ⟶^{ε} failure

⟨g_{1} [] g_{2}, σ⟩ ⟶^{ε} failure

Rules for commands

              ⟨skip, σ⟩ ⟶^{ε} σ  ⟨abort, σ⟩ ⟶^{ε} aborted

{⟨e, σ⟩ ⟶ v \atop ⟨Q!e, σ⟩ ⟶^{Q!v} σ} ⟨Q?x, σ⟩ ⟶^{Q?v} σ[v/x]

{⟨e, σ⟩ ⟶ v \atop ⟨x := e, σ⟩ ⟶^{ε} σ[v/x]} ⟨c_{1}, σ⟩ ⟶^{λ} ⟨c′_{1}, σ′⟩ | σ′ | aborted

⟨c_{1}; c_{2}, σ⟩ ⟶^{λ} ⟨c′_{1}; c_{2}, σ′⟩ | ⟨c_{2}, σ′⟩ | aborted

⟨g, σ⟩ ⟶^{λ} ⟨c′, σ′⟩ | σ′ | failure | aborted

⟨if g fi, σ⟩ ⟶^{λ} ⟨c′, σ′⟩ | σ′ | aborted | aborted

⟨g, σ⟩ ⟶^{λ} ⟨c′, σ′⟩ | σ′ | failure | aborted

⟨do g od, σ⟩ ⟶^{λ} ⟨c′; do g od, σ′⟩ | ⟨do g od, σ′⟩ | σ | aborted

Figure B–1: SOS transition rules for CSP excluding programs Appendix B. The correctness of CSP 169 Rules for communication

⟨c, σ⟩ ⟶^{λ} ⟨c′, σ′⟩ | σ′ | aborted

⟨R :: c, σ⟩ ⟶^{R::λ} ⟨R :: c′, σ′⟩ | σ′ | ⟨aborted, σ⟩

{⟨p_{1}, σ⟩ ⟶^{λ} ⟨p′_{1}, σ′⟩ | σ′ \atop ⟨p_{1} ∥ p_{2}, σ⟩ ⟶^{λ} ⟨p′_{1} ∥ p_{2}, σ′⟩ | ⟨p_{2}, σ′⟩}  {⟨p_{2}, σ⟩ ⟶^{λ} ⟨p′_{2}, σ′⟩ | σ′ \atop ⟨p_{1} ∥ p_{2}, σ⟩ ⟶^{λ} ⟨p_{1} ∥ p′_{2}, σ′⟩ | ⟨p_{1}, σ′⟩}

\begin{matrix}⟨p_{1}, σ⟩ ⟶^{Q::P?v} ⟨p′_{1}, σ′⟩ | σ′ & ⟨p_{2}, σ⟩ ⟶^{P::Q!v} ⟨p′_{2}, σ⟩ | σ \\ ⟨p_{1} ∥ p_{2}, σ⟩ ⟶^{ε} ⟨p′_{1} ∥ p′_{2}, σ′⟩ | ⟨p_{1}, σ′⟩ | ⟨p_{2}, σ′⟩ | σ′ \end{matrix}

\begin{matrix}⟨p_{1}, σ⟩ ⟶^{P::Q!v} ⟨p′_{1}, σ⟩ | σ & ⟨p_{2}, σ⟩ ⟶^{Q::P?v} ⟨p′_{2}, σ′⟩ | σ′ \\ ⟨p_{1} ∥ p_{2}, σ⟩ ⟶^{ε} ⟨p′_{1} ∥ p′_{2}, σ′⟩ | ⟨p_{1}, σ′⟩ | ⟨p_{2}, σ′⟩ | σ′ \end{matrix}

Figure B–2: SOS transition rules for CSP programs

Rules for programs

⟨c, σ⟩ ⟶^{λ} ⟨c′, σ′⟩ | σ′ | aborted

⟨R :: c, σ⟩ ⟶^{{| R::λ |}} ⟨R :: c′, σ′⟩ | σ′ | ⟨aborted, σ⟩

{⟨p_{1}, σ⟩ ⟶^{m} ⟨p′_{1}, σ′⟩ | σ′ \atop ⟨p_{1} ∥ p_{2}, σ⟩ ⟶^{m} ⟨p′_{1} ∥ p_{2}, σ′⟩ | ⟨p_{2}, σ′⟩}  {⟨p_{2}, σ⟩ ⟶^{m} ⟨p′_{2}, σ′⟩ | σ′ \atop ⟨p_{1} ∥ p_{2}, σ⟩ ⟶^{m} ⟨p_{1} ∥ p′_{2}, σ′⟩ | ⟨p_{1}, σ′⟩}
\begin{matrix}⟨p_{1}, σ⟩ ⟶^{m_{1}} ⟨p′_{1}, σ_{1}⟩ | σ_{1} & ⟨p_{2}, σ⟩ ⟶^{m_{2}} ⟨p′_{2}, σ_{2}⟩ | σ_{2} \\ ⟨p_{1} ∥ p_{2}, σ⟩ ⟶^{m} ⟨p′_{1} ∥ p′_{2}, σ′⟩ | ⟨p_{1}, σ′⟩ | ⟨p_{2}, σ′⟩ | σ′ \end{matrix} ∗

∗ where ∃m′ ⊆ (m_{1} ∩ \overline{m_{2}}).m = (m_{1} \ m′) ∪ (m_{2} \ \overline{m′}) and σ′ = σ ⊕ (σ_{1} ↾ W V (p_{1})) ⊕ (σ_{2} ↾ W V (p_{2}))

Figure B–3: MSOS transition rules for CSP programs Appendix B. The correctness of CSP 170

Note that these rules make use of the W V function defined in section 5.1.2. It also makes use of two new functions on stores. These are defined as follows:

\begin{matrix}σ ⊕ 0 = σ \\ σ ⊕ (σ′[v/x]) = (σ ⊕ σ′)[v/x] \end{matrix}  \begin{matrix}0 ↾ X = 0 \\ (σ[v/x]) ↾ X = σ ↾ X if x ∉ X \\ (σ[v/x]) ↾ X = (σ ↾ X)[v/x] if x ∈ X \end{matrix}

The first defines the operation of overwriting one store with another, and the other restricts a store to consist of only those bindings to variables that belong to a specified set X.

When the MSOS semantics describes a transition of p, it may write to the store many times. However, each process in a transition may write to the store at most once. Since processes do not share variables, this means that each variable is updated only once. This explains the side condition

σ′ = σ ⊕ (σ_{1} ↾ W V (p_{1})) ⊕ (σ_{2} ↾ W V (p_{2}))

in figure B–3. We need the following relation

σ_{1} ≃_{X} σ_{2} iff for all x ∈ X. σ_{1}(x) = σ_{2}(x)

and we write σ_{1} ≃ σ_{2} for σ_{1} ≃_{V ar} σ_{2}. This allows us to relate the stores obtained after executing a series of CSP_{SOS} transitions and one CSP_{MSOS} transition. Modulo this caveat, we obtain the “boring”[sic] proofs again:

Proposition B.0 For all p, p′, σ, σ′, λ, and for each row in the following table, if CSP_{SOS} deduces the left hand entry, then CSP_{MSOS} deduces the right hand entry.

\begin{matrix}⟨p, σ⟩ ⟶^{λ} ⟨p′, σ′⟩ & ⟨p, σ⟩ ⟶^{m} ⟨p′, σ′⟩ \\ ⟨p, σ⟩ ⟶^{λ} σ′ & ⟨p, σ⟩ ⟶^{m} σ′ \end{matrix}

where in both cases m = {| λ |} if λ ≠ ε and m = ∅ otherwise. □

The other direction requires the notion of t-traced deduction sequences again, which can be straightforwardly copied from page 35. Then we get

Proposition B.1 For all p, p′, σ, σ′, m and traces t of m, and for each row in the following table, if CSP_{MSOS} deduces the left-hand entry then CSP_{SOS} deduces the middle entry such that the right hand-hand entry is true.

\begin{matrix}⟨p, σ⟩ ⟶^{m} ⟨p′, σ′⟩ & ⟨p, σ⟩ ⟶^{t} ⟨p′, σ′′⟩ & σ′ ≃ σ′′ \\ ⟨p, σ⟩ ⟶^{m} σ′ & ⟨p, σ⟩ ⟶^{t} σ′′ & σ′ ≃ σ′′ \end{matrix}

□

Appendix B. The correctness of CSP 171

B.3 Stage two: from ordinary to interacting transition rules

In this section, we introduce a transition I-semantics for CSP, called CSP_{I}. (Actually, it is really a DQI-system bu we call it CSP_{I} because the only sequencing constraints occur in the store rule.) The syntax and static semantics and auxiliary definitions are as before. The main change lies in the actual transition systems defined. First, they are labelled with process identifiers rather than from Λ. Second, the transition systems for commands,guarded commands and programs contain an extra item done in the set of terminal states. This token is intended to represent successful termination.

The following table lists the transition systems. Note that the sets should be primed in order to distinguish them from the previous transition systems. We do not do so here to ease legibility.

Syntactic class (L)TS  Terminal Config’ns (Ω)  Config’ns (Γ)
expressions  ⟨Γ_{e}, Ω_{e}, ⟶_{e}⟩  V al  Exp ⊇ Ω_{e}
g’d commands ⟨Γ_{g}, Ω_{g}, Λ, ⟶_{g}⟩ Com ∪  GCom ∪ Ω_{g}

                              {done , failure, aborted}

commands  ⟨Γ_{c}, Ω_{c}, Λ, ⟶_{c}⟩ {done , aborted}  Com ∪ Ω_{c}
programs  ⟨Γ_{p}, Ω_{p}, Λ, ⟶_{p}⟩ {done , aborted}  P rog ∪ Ω_{p}
stores  ⟨Store, ∅, ⇝⟩  Store

And for convenience once again, we add some equations for the new done production:

          done ∥ p = p ∥ done = p  done ∥ done = done

In addition to the transition rules found in figures B–4 and B–5, we require the following rules for stores:

σ ⇝ σ \begin{aligned}σ ⇝ σ′ & ▶ & σ′ ⇝ σ′′ \\ & σ ⇝ σ′′ \end{aligned}

The first is the dummy transition rule of page 119 and the second is actually the store composition rule of CSP, found in figure 5–2.

The proofs of equivalence between CSP_{MSOS} and CSP_{I} is almost exactly identical to that between P_{MSOS} and P_{I} found in section 2.5.3, modulo some difficulty with stores. In CSP_{I} we have to accept that processes other than those mentioned in the judgment currently of interest can write to the store; interference freedom guarantees that they will not affect those parts relevant to the processes at hand.

We label the communication interactions comm(P, Q, v). In the following, we associate P :: Q!v with +comm(P, Q, v) and Q :: P?v with −comm(P, Q, v).

Let us write Π[m] ⊢ Δ if m is the multiset of labels of Λ associated to the communicative dangling interactions of Π, which deduces the set of conclusions Δ. Note that Π may or may not have store dangling interactions. Let us write Appendix B. The correctness of CSP 172 Rules for expressions

v ⟶^{P} v x ⟶^{P} v − {σ(x) = v \atop σ ⇝ σ} ; \begin{matrix}e_{1} ⟶^{P} v_{1} & e_{2} ⟶^{P} v_{2} \\ e_{1} op e_{2} ⟶^{P} app(op, v_{1}, v_{2}) \end{matrix}

Rules for guarded commands

b ⟶^{P} ff

     b⇒c ⟶^{P} failure

b ⟶^{P} tt ▶ c ⟶^{P} c′ | done | aborted

                               b⇒c ⟶^{P} c′ | done | aborted
                  g_{i} ⟶^{P} c | done | aborted
                g_{1} [] g_{2} ⟶^{P} c | done | aborted

i = 1, 2

                  g_{1} ⟶^{P} failure g_{2} ⟶^{P} failure

g_{1} [] g_{2} ⟶^{P} failure

Rules for commands

                skip ⟶^{P} done      abort ⟶^{P} aborted

\begin{matrix}e ⟶^{P} v & ▶ & P : set(x, v) \\ x := e ⟶^{P} done \end{matrix} \begin{matrix}e ⟶^{R} v & ▶ & R : out(Q, v) \\ Q!e ⟶^{R} done \end{matrix}
P : set(x, v)−σ ⇝σ[v/x]  R : out(Q, v)−R?x⟶^{Q}done −σ ⇝σ[v/x]

                  g ⟶^{P} c | done | failure | aborted
               if g fi ⟶^{P} c | done | aborted | aborted
                  g ⟶^{P} c | done | failure | aborted
            do g od ⟶^{P} c; do g od | do g od | done | aborted

Figure B–4: Transition (Q)I-rules for CSP except programs Rules for programs

                       c ⟶^{R} c′ | done | aborted

R :: c ⟶ R :: c′ | done | aborted

\begin{matrix}p_{1} ⟶ p′_{1} & p_{2} ⟶ p′_{2} \\ p_{1} ∥ p_{2} ⟶ p′_{1} ∥ p′_{2} \end{matrix}

{p_{1} ⟶ p′_{1} \atop p_{1} ∥ p_{2} ⟶ p′_{1} ∥ p_{2}}  {p_{2} ⟶ p′_{2} \atop p_{1} ∥ p_{2} ⟶ p_{1} ∥ p′_{2}}

Figure B–5: Transition I-rules for CSP programs

CSP_{I}[m] ⊢ Δ if there exists a Π ∈ I(CSP_{I}) such that Π[m] ⊢ Δ, in which case we shall say [m] ⊢ Δ is deducible in CSP_{I}.

Then the following propositions are easy to prove by induction and analogously to proposition 2.13 (although we do not need to use fragmentation).

Proposition B.2 For all e in Exp, v in V al, κ, κ′ in Comm ∪ GComm ∪ P rog which occur as subphrases of an R-labelled process in p, σ, σ′, σ′′ in Store, m ∈ ℕ^{Λ}, for each row in the following table, if the left hand entry is deducible in CSP_{MSOS} then the middle entry is deducible in CSP_{I} such that the condition in the right hand entry is satisfied.

⟨e, σ⟩ → v  e ⟶^{R} v, σ ⇝ σ′  σ′ ≃_{X} σ
⟨κ, σ⟩ →^{m} ⟨κ′, σ′⟩ [m] ⊢ κ ⟶^{R} κ′, σ ⇝ σ′′  σ′ ≃_{X} σ′′
⟨κ, σ⟩ →^{m} σ′  [m] ⊢ κ ⟶^{R} done , σ ⇝ σ′′ σ′ ≃_{X} σ′′
⟨κ, σ⟩ →^{m} aborted [m] ⊢ κ ⟶^{R} aborted, σ ⇝ σ′ σ ≃_{X} σ′

where X = Acc(R, p) if κ is not a program, and X = F V (κ) otherwise. □

Proposition B.3 For all e in Exp, v in V al, κ, κ′ in Comm ∪ GComm ∪ P rog which occur as subphrases of an R-labelled process in p, σ, σ′, σ′′ in Store, m ∈ ℕ^{Λ}, for each row in the following table, if the middle entry is deducible in CSP_{I} then the left hand entry is deducible in CSP_{MSOS} such that the condition in the right hand entry is satisfied. □

In order to take stock of where we are at the moment, we define the full transition system of CSP_{I} as ⟨Γ_{I}, Ω_{I}, ⟶_{I}⟩ where Γ_{I} = Γ_{p}×Stores, Ω_{I} = {done , aborted}× Stores and ⟶_{I}⊆ Γ_{I} × Γ_{I} is defined by

⟨p, σ⟩ ⟶ ⟨p′, σ′⟩ iff CSP_{I} ⊩ p ⟶ p′, σ ⇝ σ′

Appendix B. The correctness of CSP 174

Note the use of proper deducibility: it ensures that every alteration to the store is accounted for, and moreover so is every interaction of the program.

Then so far we have asserted that for all p, p′ ∈ P rog, σ, σ′, σ′′ ∈ Store and each row in the following table, if CSP_{SOS} (sequentially) deduces the left-hand entry then CSP_{I} (sequentially) deduces the middle entry such that the right-hand entry is true. Moreover, if CSP_{I} deduces the middle entry, then CSP_{SOS} deduces the left-hand entry such that the right-hand entry is true.

⟨p, σ⟩(⟶^{ε})^{+}⟨p′, σ′⟩  ⟨p, σ⟩ ⟶^{+} ⟨p′, σ′⟩  σ′ ≃_{F V (p)} σ′′
⟨p, σ⟩(⟶^{ε})^{+}σ′  ⟨p, σ⟩ ⟶^{+} ⟨done , σ′⟩  σ′ ≃_{F V (p)} σ′′
⟨p, σ⟩(⟶^{ε})^{+}aborted ⟨p, σ⟩ ⟶^{+} ⟨aborted, σ′⟩

B.4 Stage three: from interacting transitions to evaluations

We introduce yet another intermediate semantics, but this time we simply introduce the following three rules to CSP_{I}:

\begin{matrix}γ ⟶^{⟨R⟩} γ′ & ▶ & γ′ ⟶^{⟨R⟩} γ′′ \\ γ ⟶^{⟨R⟩} γ′′ \end{matrix}

     g ⟶^{R} done ▶ do g od ⟶^{R} γ

            do g od ⟶^{R} γ

c_{1} ⟶^{R} done ▶ c_{2} ⟶^{R} γ c_{1}; c_{2} ⟶^{R} γ

where γ, γ′, γ′′ ∈ Γ_{c} ∪ Γ_{g} ∪ Γ_{p} and the angle brackets denote options — either the R labels all exist in a rule instance or they do not. (See the options convention of the definition of standard ML [HMT90, §4.10].) We shall refer to the first rule as the “cut” rule, and the system as a whole as CSP_{CUT}. We refer to the last two rules as evaluation rules, because they are similar to the sequential composition and repetition rules of CSP. We refer to a deduction as cut-free if it contains no instance of a cut rule, and eval-free if it contains no instance of an evaluation rule. CSP_{I} transitions are both cut and eval-free. We can cut sequences of CSP_{I} transitions together to get eval-free deductions. The key idea behind the following proof is that CSP program transitions correspond to cut-free deductions of terminating transition sequences.

First, we state a cut-elimination result for CSP_{CUT}, which uses the eval rules to remove cuts. The proof itself is standard, but depends on specialized notions of cut-formula and degree of cut-formula and deductions.

A cut-formula is the configuration that occurs on the left-hand side of the lefthand premise of a cut-rule. (This is in contrast with the usual, logical notion of cutrule where the cut formula occurs on the right-hand side of the left-hand premise. The reason for this is that the semantic rules are syntax-directed according to the left-hand sides of transition rules.) In the above cut rule schema, the cut-formula is the configuration γ. Note that no cut formula has form done or aborted.

\begin{matrix}\begin{matrix}\begin{matrix}Σ_{1} \\ b ⟶^{R} tt \end{matrix} & ▶ & \begin{matrix}Σ_{2} \\ c ⟶^{R} c′ \end{matrix} \\ b⇒c ⟶^{R} c′ \end{matrix} & ▶ & \begin{matrix}Σ_{3} \\ c′ ⟶^{R} γ \end{matrix} \\ b⇒c ⟶^{R} γ \end{matrix} ⇝ \begin{aligned}\begin{matrix}Σ_{1} \\ b ⟶^{R} tt \end{matrix} & ▶ & \begin{matrix}\begin{matrix}Σ_{2} \\ c ⟶^{R} c′ \end{matrix} & ▶ & \begin{matrix}Σ_{3} \\ c′ ⟶^{R} γ \end{matrix} \\ c ⟶^{R} γ \end{matrix} \\ & b⇒c ⟶^{R} γ \end{aligned} \begin{matrix}\begin{matrix}Σ_{1} \\ g_{i} ⟶^{R} c \end{matrix} ; g_{1} [] g_{2} ⟶^{R} c & ▶ & \begin{matrix}Σ_{2} \\ c ⟶^{R} γ \end{matrix} \\ g_{1} [] g_{2} ⟶^{R} γ \end{matrix}  ⇝  \begin{matrix}\begin{matrix}Σ_{1} \\ g_{i} ⟶^{R} c \end{matrix} & ▶ & \begin{matrix}Σ_{2} \\ c ⟶^{R} γ \end{matrix} \\ g_{i} ⟶^{R} γ \end{matrix} ; g_{1} [] g_{2} ⟶^{R} γ Figure B–6: Elimination rules for guarded commands

The degree of a cut formula A, ∂(A) is defined inductively as follows:

∂(abort) = ∂(skip) = ∂(x := e) = ∂(Q!e) = ∂(Q?x) = 0
∂(if g fi) = ∂(do g od) = 1 + ∂(g)
∂(b⇒c) = 1 + ∂(c)
∂(g_{1} [] g_{2}) = 1 + max{∂(g_{1}), ∂(g_{2})}
∂(c_{1}; c_{2}) = 1 + max{∂(c_{1}), ∂(c_{2})}
∂(R :: c) = 1 + ∂(c)
∂(p_{1} ∥ p_{2}) = 1 + max{∂(p_{1}), ∂(p_{2})}

The degree of a deduction is the maximum of the degrees of its cut formulae.

Now we can prove the following result in exactly the same way as one would prove an ordinary cut-elimination theorem (see, e.g., [GLT89, ch 13]), using the elimination rules found in figures B–6, B–7, B–8 and B–9.

Proposition B.4 If CSP_{CUT} ⊢ p ⟶ p′ then there exists a CSP_{CUT} -deduction of degree 0 which also deduces it. □

An important consequence of a deduction being cut-free is that it will contain no instance of either of the rules

{p_{1} ⟶ p′_{1} \atop p_{1} ∥ p_{2} ⟶ p′_{1} ∥ p_{2}}  {p_{2} ⟶ p′_{2} \atop p_{1} ∥ p_{2} ⟶ p_{1} ∥ p′_{2}}

because these are elminated by the second rule (and its symmetric counterpart) in figure B–8.

\begin{matrix}\begin{matrix}Σ_{1} \\ c_{1} ⟶^{R} c′_{1} \end{matrix} ; c_{1}; c_{2} ⟶^{R} c′_{1}; c_{2} & ▶ & \begin{matrix}Σ_{2} \\ c′_{1} ⟶^{R} γ \end{matrix} ; c′_{1}; c_{2} ⟶^{R} γ′ \\ c_{1}; c_{2} ⟶^{R} γ′ \end{matrix}  ⇝  \begin{matrix}\begin{matrix}Σ_{1} \\ c_{1} ⟶^{R} c′_{1} \end{matrix} & ▶ & \begin{matrix}Σ_{2} \\ c′_{1} ⟶^{R} γ \end{matrix} \\ c_{1} ⟶^{R} γ \end{matrix} ; c_{1}; c_{2} ⟶^{R} γ′

\begin{matrix}\begin{matrix}\begin{matrix}Σ_{1} \\ c_{1}; c_{2} →^{R} c_{2} \end{matrix} & ▶ & \begin{matrix}Σ_{2} \\ c_{2} →^{R} c′_{2} \end{matrix} \\ c_{1}; c_{2} ⟶^{R} c′_{2} \end{matrix} & ▶ & \begin{matrix}Σ_{3} \\ c′_{2} →^{R} γ \end{matrix} \\ c_{1}; c_{2} ⟶^{R} γ \end{matrix} ⇝

\begin{matrix}\begin{matrix}Σ_{1} \\ c_{1}; c_{2} →^{R} c_{2} \end{matrix} & ▶ & \begin{matrix}\begin{matrix}Σ_{2} \\ c_{2} →^{R} c′_{2} \end{matrix} & ▶ & \begin{matrix}Σ_{3} \\ c′_{2} →^{R} γ \end{matrix} \\ c_{2} ⟶^{R} γ \end{matrix} \\ c_{1}; c_{2} ⟶^{R} γ \end{matrix}

\begin{matrix}Σ_{1} \\ g ⟶^{R} c \end{matrix} ; if g fi ⟶^{R} c ▶ \begin{matrix}Σ_{2} \\ c ⟶^{R} γ \end{matrix}

if g fi ⟶^{R} γ

⇝

\begin{matrix}\begin{matrix}Σ_{1} \\ g ⟶^{R} c \end{matrix} & ▶ & \begin{matrix}Σ_{2} \\ c ⟶^{R} γ \end{matrix} \\ g ⟶^{R} c \end{matrix} ; if g fi ⟶^{R} γ

\begin{matrix}Σ_{1} \\ g ⟶^{R} c \end{matrix}

do g od ⟶^{R} c; do g od ▶

\begin{matrix}Σ_{2} \\ c ⟶^{R} γ \end{matrix} ; c; do g od ⟶^{R} γ′

do g od ⟶^{R} γ′

⇝

\begin{matrix}\begin{matrix}Σ_{1} \\ g ⟶^{R} c \end{matrix} & ▶ & \begin{matrix}Σ_{2} \\ c ⟶^{R} γ \end{matrix} \\ g ⟶^{R} γ \end{matrix} ; do g od ⟶^{R} γ′

\begin{matrix}\begin{matrix}Σ_{1} \\ c ⟶^{R} c′ \end{matrix} ; R :: c ⟶ R :: c′ & ▶ & \begin{matrix}Σ_{2} \\ c′ ⟶^{R} γ \end{matrix} ; R :: c′ ⟶ γ′ \\ R :: c ⟶ γ′ \end{matrix} ⇝ \begin{matrix}\begin{matrix}Σ_{1} \\ c ⟶^{R} c′ \end{matrix} & ▶ & \begin{matrix}Σ_{2} \\ c′ ⟶^{R} γ \end{matrix} \\ c ⟶^{R} γ \end{matrix} ; R :: c ⟶ γ′

Figure B–7: Elimination rules for commands and atomic programs

\frac{\begin{matrix}\begin{matrix}Σ_{1} \\ p_{1} ⟶ p′_{1} \end{matrix} ; p_{1} ∥ p_{2} ⟶ p′_{1} ∥ p_{2} & ▶ & \begin{matrix}Σ_{2} \\ p′_{1} ⟶ p′′_{1} \end{matrix} ; p′_{1} ∥ p_{2} ⟶ p′′_{1} ∥ p_{2} \\ p_{1} ∥ p_{2} ⟶ p′′_{1} ∥ p_{2} \end{matrix}  ⇝  \begin{matrix}\begin{matrix}Σ_{1} \\ p_{1} ⟶ p′_{1} \end{matrix} & ▶ & \begin{matrix}Σ_{2} \\ p′_{1} ⟶ p′′_{1} \end{matrix} \\ p_{1} ⟶ p′′_{1} \end{matrix} ; p_{1} ∥ p_{2} ⟶ p′′_{1} ∥ p_{2} and symmetrically for p_{2} \begin{matrix}\begin{matrix}Σ_{1} \\ p_{1} ⟶ p′_{1} \end{matrix} ; p_{1} ∥ p_{2} ⟶ p′_{1} ∥ p_{2} & ▶ & \begin{matrix}Σ_{2} \\ p_{2} ⟶ p′_{2} \end{matrix} ; p′_{1} ∥ p_{2} ⟶ p′_{1} ∥ p′_{2} \\ p_{1} ∥ p_{2} ⟶ p′_{1} ∥ p′_{2} \end{matrix}  ⇝  \begin{matrix}\begin{matrix}Σ_{1} \\ p_{1} ⟶ p′_{1} \end{matrix} & \begin{matrix}Σ_{2} \\ p_{2} ⟶ p′_{2} \end{matrix} \\ p_{1} ∥ p_{2} ⟶ p′_{1} ∥ p′_{2} \end{matrix} and symmetrically for p_{2} \begin{matrix}\begin{matrix}Σ_{1} \\ p_{1} ⟶ p′_{1} \end{matrix} ; p_{1} ∥ p_{2} ⟶ p′_{1} ∥ p_{2} & ▶ & \begin{matrix}\begin{matrix}Σ_{2} \\ p′_{1} ⟶ p′′_{1} \end{matrix} & \begin{matrix}Σ_{3} \\ p_{2} ⟶ p′_{2} \end{matrix} \\ p′_{1} ∥ p_{2} ⟶ p′′_{1} ∥ p′_{2} \end{matrix} \\ p_{1} ∥ p_{2} ⟶ p′′_{1} ∥ p′_{2} \end{matrix}  ⇝ \begin{matrix}\begin{matrix}\begin{matrix}Σ_{1} \\ p_{1} ⟶ p′_{1} \end{matrix} & ▶ & \begin{matrix}Σ_{2} \\ p′_{1} ⟶ p′′_{1} \end{matrix} \\ p_{1} ⟶ p′′_{1} \end{matrix} & \begin{matrix}Σ_{3} \\ p_{2} ⟶ p′_{2} \end{matrix} \\ p_{1} ∥ p_{2} ⟶ p′′_{1} ∥ p′_{2} \end{matrix} and symmetrically for p_{2} \begin{matrix}\begin{matrix}\begin{matrix}Σ_{1} \\ p_{1} ⟶ p′_{1} \end{matrix} & \begin{matrix}Σ_{2} \\ p_{2} ⟶ p′_{2} \end{matrix} \\ p_{1} ∥ p_{2} ⟶ p′_{1} ∥ p′_{2} \end{matrix} & ▶ & \begin{matrix}Σ_{3} \\ p′_{1} ⟶ p′′_{1} \end{matrix} ; p′_{1} ∥ p′_{2} ⟶ p′′_{1} ∥ p′_{2} \\ p_{1} ∥ p_{2} ⟶ p′′_{1} ∥ p′_{2} \end{matrix}  ⇝ \begin{matrix}\begin{matrix}\begin{matrix}Σ_{1} \\ p_{1} ⟶ p′_{1} \end{matrix} & ▶ & \begin{matrix}Σ_{3} \\ p′_{1} ⟶ p′′_{1} \end{matrix} \\ p_{1} ⟶ p′′_{1} \end{matrix} & \begin{matrix}Σ_{2} \\ p_{2} ⟶ p′_{2} \end{matrix} \\ p_{1} ∥ p_{2} ⟶ p′′_{1} ∥ p′_{2} \end{matrix} and symmetrically for p_{2} \begin{matrix}\begin{matrix}\begin{matrix}Σ_{1} \\ p_{1} ⟶ p′_{1} \end{matrix} & \begin{matrix}Σ_{2} \\ p_{2} ⟶ p′_{2} \end{matrix} \\ p_{1} ∥ p_{2} ⟶ p′_{1} ∥ p′_{2} \end{matrix} & ▶ & \begin{matrix}\begin{matrix}Σ_{3} \\ p′_{1} ⟶ p′′_{1} \end{matrix} & \begin{matrix}Σ_{4} \\ p′_{2} ⟶ p′′_{2} \end{matrix} \\ p′_{1} ∥ p′_{2} ⟶ p′′_{1} ∥ p′′_{2} \end{matrix} \\ p_{1} ∥ p_{2} ⟶ p′′_{1} ∥ p′′_{2} \end{matrix}  ⇝ \begin{matrix}\begin{matrix}\begin{matrix}Σ_{1} \\ p_{1} ⟶ p′_{1} \end{matrix} & ▶ & \begin{matrix}Σ_{3} \\ p′_{1} ⟶ p′′_{1} \end{matrix} \\ p_{1} ⟶ p′′_{1} \end{matrix} & \begin{matrix}\begin{matrix}Σ_{2} \\ p_{2} ⟶ p′_{2} \end{matrix} & ▶ & \begin{matrix}Σ_{4} \\ p′_{2} ⟶ p′′_{2} \end{matrix} \\ p_{2} ⟶ p′′_{2} \end{matrix} \\ p_{1} ∥ p_{2} ⟶ p′′_{1} ∥ p′′_{2} \end{matrix}}{Figure B–8: Elimination rules for parallel composition}

\begin{matrix}\begin{matrix}Σ_{1} \\ c_{1} ⟶^{R} done \end{matrix} ; c_{1}; c_{2} ⟶^{R} c_{2} & ▶ & \begin{matrix}Σ_{2} \\ c_{2} ⟶^{R} γ \end{matrix} \\ c_{1}; c_{2} ⟶^{R} γ \end{matrix}  ⇝  \begin{matrix}\begin{matrix}Σ_{1} \\ c_{1} ⟶^{R} done \end{matrix} & ▶ & \begin{matrix}Σ_{2} \\ c_{2} ⟶^{R} γ \end{matrix} \\ c_{1}; c_{2} ⟶^{R} γ \end{matrix}

\begin{matrix}Σ_{1} \\ g ⟶^{R} done \end{matrix}

  do g od ⟶^{R} do g od ▶

\begin{matrix}Σ_{2} \\ do g od ⟶^{R} γ \end{matrix}

            do g od ⟶^{R} γ

⇝ \begin{matrix}Σ_{1} \\ g ⟶^{R} done \end{matrix} ▶ \begin{matrix}Σ_{2} \\ do g od ⟶^{R} γ \end{matrix}

                                                 do g od ⟶^{R} γ

Figure B–9: Elimination rules for evaluations

Proposition B.5 For each of the rows in the following table, if CSP_{CUT} deduces the left-hand column, then CSP deduces the right-hand column:

                    p ⟶ done  p
                    p ⟶ aborted  p†

c ⟶^{R} done  R : c

                    c ⟶^{R} aborted  R † c

g ⟶^{R} done  R : g

                    g ⟶^{R} aborted  R † g
                    g ⟶^{R} failure  R ∗ g

e ⟶^{R} v  R : e ⟶ v

Proof: (Sketch) For each case, we take a cut-free deduction of the required judgment, and then recursively replace each of the above CSP_{CUT} judgments with their CSP equivalents. □

The last step in the proof of this direction is to construct the corresponding CSP-deduction of the store transitions, and then assemble it back together with the newly constructed constructed program CSP-deduction. This is easily done: first, it is quite straightforward to notice that every CSP_{CUT} store deduction is also a CSP-deduction. Second, it is easy to show that the constructed CSP program deduction is simulated by the original CSP_{CUT} -deduction (shown by ruleinduction, and the fact that the elimination rules actually removes dependencies between dangling interactions. Therefore we can use the Interaction Reflection theorem to assemble the program deduction and the store deduction to make a proper CSP-deduction.

Proposition B.6 For all p, σ, σ′, and each row of the following table, if CSP_{CUT} properly deduces the left hand column, then CSP properly deduces the right hand Appendix B. The correctness of CSP 179

column.

p ⟶ done , σ ⇝ σ′  p, σ ⇝ σ′
p ⟶ aborted, σ ⇝ σ′ p†, σ ⇝ σ′
□

B.4.1 The other direction: from evaluations to transitions

We have outlined how to show that every terminating sequence of transitions of CSP_{I} corresponds to a CSP evaluation deduction. Now we outline the reverse, that every CSP deduction corresponds to a terminating sequence of transitions of CSP_{I}.

This direction is slightly more difficult in that we have to both discover the individual transitions of each process, and then schedule them. This process is complicated by the fact that the store interactions of the various processes may be interleaved, and therefore have to be swapped around to accord with the chosen scheduling.

Nevertheless, despite this difficulty, the idea of the proof is quite straightforward: we simply identify those parts of the evaluation deduction that correspond to a “first transition”, and then peel it off to make one. This peeling is essentially the cut-elimination process in reverse.

Throughout the rest of this appendix, let Π be a proper CSP-deduction concluding p, σ ⇝ σ′. Let us identify it with its cut-free CSP_{CUT} analogue for convenience. Let Π_{p} be the program fragment of Π and Π_{s} be the store fragment. We assume that the only dangling interactions of Π_{p} are those relating to the store (i.e., Π is a binary assembly of Π_{p} and Π_{s}), so that communicating commands are still connected. We use Σ to range over arbitrary deductions, which in the following will always be trees.

In the following definition, we use the following abbreviations. We write Σ ⊢ Σ′ when Σ′ is obtained from applying a single rule to Σ. We write Σ_{1} ▶ Σ_{2} ⊢ Σ when Σ is the result of applying a single rule with two sequenced premises to Σ_{1} and Σ_{2} in order. Last, we write Σ_{1} ∥ Σ_{2} ⊢ Σ when Σ is the result of applying a single rule with two unsequenced premises to Σ_{1} and Σ_{2}.

When Σ is not a store deduction, let PP (Σ) be the principal phrase of Σ: the left-hand side configuration of the single conclusion of Σ. Let us fix program deduction Π_{p}. Then we define the first transition of command and guarded command subdeductions Σ of Π_{p} to be the set first(Σ) defined inductively by

first(Σ) = \{ \begin{matrix}O(Σ) & if PP (Σ) ∈ \{abort, skip, x := e, Q!e, Q?x\} \\ O(Σ) & if Σ ⊢ g ⟶^{R} failure \\ first(Σ′) & if PP (Σ) ∈ \{if g fi, do g od\} and Σ′ ⊢ Σ \\ first(Σ_{1}) & if Σ_{1} ▶ Σ_{2} ⊢ Σ \\ O(Σ_{1}) ∪ first(Σ_{2}) & if PP (Σ) = b⇒c and Σ_{1} ▶ Σ_{2} ⊢ Σ \end{matrix}

Note that first(Σ) is upwards-closed with respect to aboveness: any occurrence strictly above a member of the set is also in the set. We define the downwards Appendix B. The correctness of CSP 180

closure of first(Σ) to be ↓ first(Σ) = {A | ∃B ∈ first(Σ).A is below B in Σ}. This is important because it contains all the formulae down which we will propagate cuts.

Now, let us write Σ_{1} <_{Π_{p}} Σ_{2} to abbreviate the condition that there exists A_{i} ∈ first(Σ_{i}) such that A_{1} <_{Π_{p}} A_{2}. We get the important result for commands:

Lemma B.7(i) If disjoint subdeductions Σ_{1} and Σ_{2} of Π_{p} deduce behaviour about a guarded command or command, and moreover Σ_{1} <_{Π_{p}} Σ_{2} then Σ_{2} ≮_{Π_{p}} Σ_{1}

Proof: Essentially because first(Σ) contains at most one occurrence which interacts with another part of Π_{p}. □

Then the first transition of deductions of program behaviour can be determined by

first(Σ) = \{ \begin{matrix}first(Σ′) & if PP (Σ) = R :: c and Σ′ ⊢ Σ \\ first(Σ_{1}) & if Σ_{1} ▶ Σ_{2} ⊢ Σ \\ first(Σ_{1}) & if PP (Σ) = p_{1} ∥ p_{2}, Σ_{1} ∥ Σ_{2} ⊢ Σ and Σ_{1} <_{Π_{p}} Σ_{2} \\ first(Σ_{2}) & if PP (Σ) = p_{1} ∥ p_{2}, Σ_{1} ∥ Σ_{2} ⊢ Σ and Σ_{2} <_{Π_{p}} Σ_{1} \\ first(Σ_{1}) ∪ first(Σ_{2}) & if PP (Σ) = p_{1} ∥ p_{2} and neither of the above \\ & two cases \end{matrix}

Proposition B.7 Let disjoint subdeductions Σ_{1} and Σ_{2} of Π_{p} be such that Σ_{1} <_{Π_{p}} Σ_{2} then Σ_{2} ≮_{Π_{p}} Σ_{1}.

Proof: By lemma B.7(i) and induction. □

We use this relation to schedule the transitions. first(Σ_{1}) and first(Σ_{2}) will be disjoint since first(Σ_{i}) ⊆ O(Σ_{i}) and Σ_{1} and Σ_{2} are disjoint trees in the cases for parallel composition above. The only way for an occurrence of first(Σ_{1}) is via a sequence of interaction links. So if first(Σ_{1}) is sequenced after first(Σ_{2}), it means that something in Σ_{1} communicates with a process sequenced after the first transition of Σ_{2}.

Proposition B.8 For all transition judgments γ ⟶^{⟨R⟩} γ′ in first(Σ), γ is a subphrase of PP (Σ).

Proof: Essentially because the only rule of CSP_{CUT} in which the left-hand side of a premise is not a proper subphrase of the left-hand side of the conclusion is the repetition rule. But the definition of first(Σ) ignores the problematic premise.

□

Let us call a cut-formula the left-hand side of the conclusion of an instance of the cut rule. This lemma allows us to define the codegree of a cut-formula as the difference in size between the whole program and the program phrase where the Appendix B. The correctness of CSP 181

cut occurs: when we come to propagate cuts down the deduction (the process of “peeling off the first transition”), the codegree will decrease until the cut formula is the entire program (when it will have codegree zero).

We define the codegree of γ with respect to superphrase γ′, written C(γ, γ′), inductively:

C(γ, γ′) = \{ \begin{matrix}0 & if γ = γ′ \\ 1 + C(γ, g) & if γ′ ∈ \{if g fi, do g od\} \\ 1 + C(γ, c) & if γ′ ∈ \{R :: c, c; c′, b⇒c\} \\ 1 + C(γ, p_{i}) & if γ′ = p_{1} ∥ p_{2} and γ occurs in p_{i} \\ 1 + C(γ, g_{i}) & if γ′ = g_{1} [] g_{2} and γ occurs in g_{i} \end{matrix}

We define the codegree of an eval-free CSP_{CUT} deduction Σ to be the maximum of its codegrees that occur in ↓ first(Σ). (We are only interested in propagating cuts to peel off the first transition.)

Then the following result can be proved in a similar way to that of proposition B.4, using the elimination rules found in figures B–6, B–7 and B–8 in reverse. Note that we choose which parallel composition rules to “unapply” according to our scheduling. For instance, we unapply the last rule of figure B–8 only when we know that the first transitions of p_{1} and p_{2} belong to the first transition of their parallel composition in Π_{p}.

Proposition B.9 If CSP_{CUT} ⊢ p ⟶ p′ then there exists a CSP_{CUT} -deduction of codegree 0 which also deduces it. □

In actual fact, given the above definitions, we can also show that if Π′_{p} has codegree 0 then there exists only one cut-rule in ↓ first(Π′_{p}), and moreover it occurs at the bottom. This follows because after we first introduce cuts by eliminating the evalrules from the CSP_{CUT} analogue of the CSP-deduction, there will be exactly one cut per process whose first transition occurs during the first transition of the whole program. The process of propagating cuts down programs will merge the cuts of parallel programs.

Note that the second rule of figure B–8 and its symmetric counterpart actually introduce cuts, and may therefore increase the codegree. In this case we have to do a separate proof to reduce this codegree to 0 before we can proceed with the overall proof. This works because we can only introduce a bounded number of such cuts.

Another useful property is that the cut propagation rules do not alter the relative dependencies between the dangling interactions attached to occurrences in first(Σ), nor to dangling interactions within the rest of Σ. Instead, all it does is introduce dependencies between these two groups. Thus when we strip away the single cut rule at the bottom, we shall have a cut-free and eval-free CSP_{CUT} - deduction (i.e., a CSP_{I}-deduction) corresponding to the first transition of Π_{p} and another deduction corresponding to all the subsequent transitions, both of which reflect dependencies of Π_{p}. Hence we shall be able to use the Interaction Reflection theorem to glue interactions back with the store.

Appendix B. The correctness of CSP 182

The problem with stores

Unfortunately, it is not quite so simple: in an evaluation deduction, transitions of different processes which are scheduled one after the other may interleave their store writes (e.g., when evaluating expressions). This small subsection outlines the way in which we can reshuffle these store transitions to segregate the transistions induced by the first transition of the program from all the rest. When X ⊆ O(Σ) and Σ is not a store deduction, we define stores(X) to be the set

{A ∈ O(Π_{s}) | ∃B ∈ X.A ∼_{Π} B}

We define the convex closure of stores(X) in Π_{s}, written stores^{⟨Π_{s}⟩}(X), to be the set

{A | ∃B, C ∈ stores(X).B ≲_{Π_{s}} A ≲_{Π_{s}} C}

that is, the set of all store transitions that occur interleaved with those associated with X. What we want in order to peel off the store transitions of the first transitions of Π_{p} is the situation where

stores(first(Π_{p})) = stores^{⟨Π_{s}⟩}(first(Π_{p}))

that is, when there are no extra transitions interleaved with the first ones.

The following proof is not difficult, just tedious. It depends on proposition B.7 and the Store Reshuffling proposition (5.1). It involves repeatedly swapping the order of store transitions, gradually migrating the unwanted transitions after those in stores(first(Π_{p})). The main difficulty is that we have to ensure we do not introduce any sequencing errors — i.e., that we can still reassemble the altered store deduction to the original program deduction. This boils down to the fact that we can only commute the order of two transitions if their respective program occurrences are unrelated by ≲_{Π_{p}}. It can be shown that this is the case.

Proposition B.10 Let Π ⊩ p, σ ⇝ σ′ be a CSP_{CUT} deduction. with fragments Π_{p} ⊢ p and Π_{s} ⊢ σ ⇝ σ′. Then there exists a CSP_{CUT} -deduction Π′_{s} such that Π_{p} ⊗_{f} Π′_{s} ⊩ p, σ ⇝ σ′′ where σ′ ≃ σ′′ and stores(first(Π_{p})) = stores^{⟨Π′_{s}⟩}(first(Π_{p})).

□

We can use the Store Reshuffling proposition to partition the store deduction Π′_{s} into two pieces, joined by a single cut rule. The first piece contains just those transitions induced by first(Π_{p}), and the second contains the rest. Again, the internal dependencies between the interactions of both pieces reflect the dependencies of Π′_{s}. So therefore, we can simply remove the first piece and use the Interaction Reflection theorem to assemble it with the first transition.

By repeating this process, we build up a sequence of interactions. Therefore

Proposition B.11 For all p, σ, σ′, σ′′, and each row of the following table, if CSP properly deduces the left hand column, then CSP_{CUT} properly deduces the middle column such that the right-hand column is true.

p, σ ⇝ σ′  p ⟶ done , σ ⇝ σ′′  σ′ ≃ σ′′
p†, σ ⇝ σ′ p ⟶ aborted, σ ⇝ σ′′ σ′ ≃ σ′′
□

Appendix B. The correctness of CSP 183

Therefore, we have shown that

Proposition B.12 For all p, σ, σ′ there exists a σ′′, and each row of the following table, if CSP_{SOS} deduces the left hand column, then CSP properly deduces the middle column such that the right hand column is true. Moreover, for all p, σ, σ′′ there exists a σ′ such that if CSP properly deduces the middle column then CSP_{SOS} deduces the left hand column such that the right-hand column is true.

\begin{matrix}⟨p, σ⟩(⟶^{ε})^{+}σ′ & p, σ ⇝ σ′′ & σ′ ≃ σ′′ \\ ⟨p, σ⟩(⟶^{ε})^{+}aborted & p†, σ ⇝ σ′′ \end{matrix}

□

Appendix B. The correctness of CSP 184

Bibliography

[ABNB^{+}86] E. Astesiano, C. Bendix Nielsen, N. Botta, A. Fantechi, A. Giovini, P. Inverardi, E. Karlsen, F. Mazzanti, J. Storbank Pedersen, G. Reggio, and E. Zucca. The draft formal definition of ANSI/MIL-STD 1815 Ada. Deliverable 7 of the CEC MAP project, 1986.

[Abr93] S. Abramsky. Computational interpretations of linear logic. Theoretical Computer Science, 111:3–57, 1993. Special issue for MFPS 1990.

[ACO93] I. Attali, D. Caromel, and M. Oudshoorn. A formal definition of the dynamic semantics of the Eiffel language. In Proceedings of the sixteenth Australian Computer Science Conference (ACSC’93), 1993. WWW: http://zenon.intria.fr:8003/croap/centaur/papers.html.

[ACW95] I. Attali, D. Caromel, and A. Wendelborn. From a formal dynamic semantics of Sisal to a Sisal environment. In Proceedings of the 28th Hawaiian conference of system sciences (HICSS). IEEE Computer Society Press, 1995.

[Acz77] P. Aczel. An introduction to inductive definitions. In J. Barwise, editor, The handbook of mathematical logic, pages 739–782. North-Holland, 1977.

[AFdR80] K. R. Apt, N. Francez, and W. P. de Roever. A proof system for communicating sequential processes. ACM Transactions on Programming Languages and Systems, 2(3):359–385, 1980.

[AGN94] S. Abramsky, S. Gay, and R. Nagarajan. Interaction categories and the foundations of typed concurrent programming. In Proceedings of the 1994 Marktoberdorf Summer School. Springer-Verlag, 1994. Available by anonymous ftp from

theory.doc.ic.ac.uk/papers/Abramsky/marktoberdorf.ps.

[AI75] European Computer Manufacturers’ Association and American National Standards Institute. PL/I BASIS/1–12, volume BSR X3.53. Computer and Business Equipment Manufacturers’ Association, 1975.

[And91] James H. Andrews. Logic programming: operational semantics and proof theory. PhD thesis, Laboratory for the Foundations of Computer Science, University of Edinburgh, 1991.

[AO91] K. R. Apt and E-R. Olderog. Verification of sequential and concurrent programs. Springer-Verlag, 1991.

[Apt81] K. R. Apt. Ten years of Hoare’s logic: A survey — part 1. ACM Transactions on Programming Languages and Systems, 3(4):431– 483, October 1981.

[Apt83] K. R. Apt. Formal justification for a proof system for Communicating Sequential Processes. Journal of the Association for Computing Machinery, 30(1):197–216, 1983.

[AR87a] E. Astesiano and G. Reggio. Direct semantics for concurrent languages in the SMoLCS approach. IBM journal of research and development, 31(5):512–534, 1987.

[AR87b] E. Astesiano and G. Reggio. SMoLCS driven concurrent calculi. In Proceedings TAPSOFT’87. Springer-Verlag, 1987. LNCS 245.

[AS]  Action  semantics  home  page.  WWW,

http://www.daimi.aau.dk/~thales/as/AS.html.

[Ast91] E. Astesiano. Inductive and operational semantics. In E. J. Neuhold and M. Paul, editors, Formal Description of Programming Concepts. Springer Verlag, 1991.

[BCGL88] R. Bjornson, N. Carriero, D. Gelernter, and J. Leichter. Linda, the portable parallel. Technical Report Research Report 520, Yale University, 1988.

[Ber89] G. Berry. Real time programming: special purpose or general purpose languages. In G. X. Ritter, editor, Information processing ’89, pages 11–18. North Holland, 1989.

[Ber91] Dave Berry. Generating program animators from programming language semantics. PhD thesis, Laboratory for the Foundations of Computer Science, University of Edinburgh, 1991.

[Ber93a] G. Berry. Preemption in concurrent systems. In Proceedings FSTTCS ’93, pages 72–93. Springer-Verlag, 1993. LNCS 761; WWW: http://cma.cma.fr/ftp/esterel/preemption.ps.gz.

[Ber93b] B. Berthomieu. Programming with behaviours in an ML framework: the syntax and semantics of LCS. Technical Report LAAS/CNRS Technical Report 93144, Laboratoire d’Automatique er d’Analyse des Systèmes du CNRS, Tolouse Cedex, France, 1993.

[Bes83] E. Best. Relational semantics of concurrent programs (with some applications). In D. Bjørner, editor, Formal Description of Programming Concepts – II, pages 431–452. North-Holland, 1983.

Bibliography 187

[BG92] G. Berry and G. Gonthier. The synchronous programming language ESTEREL: design, semantics, implementation. Science of Computer Programming, 19(2):83–152, 1992. WWW: http://cma.cma.fr/ftp/esterel/BerryGonthierSCP.ps.gz.

[BH83] P. Brinch-Hansen. The programming language Concurrent PAS-CAL. In E. Horowitz, editor, Programming languages: A Grand Tour, pages 264–272. Springer-Verlag, 1983.

[BIM88] B. Bloom, S. Istrail, and A. R. Meyer. Bisimulation can’t be traced: preliminary report. In ACM Symposium on the Principles of Programming Languages (POPL), volume 15, 1988.

[BJ78] D. Bjørner and C. B. Jones, editors. The Vienna Development Method: the meta-language. Springer-Verlag, 1978. LNCS 61.

[BJ82] D. Bjørner and C. B. Jones, editors. Formal Specification and Software Development. Prentice-Hall International, 1982.

[CC77] P. Cousot and R. Cousot. Abstract interpretation: a unified lattice model for static analysis of programs. In ACM Symposium on the Principles of Programming Languages (POPL), volume 4, pages 238– 252. ACM Press, 1977.

[CEN]  CENTAUR  home  page.  WWW,

http://zenon.inria.fr:8003/croap/centaur/centaur.html.

[Cen96] Pietro Cenciarelli. Computational Applications of Calculi based on Monads. PhD thesis, LFCS, department of computer science, the University of Edinburgh, Forthcoming, 1996.

[Cli85] W. D. Clinger et. al. The revised revised report on scheme. Technical report, Indiana University 174 and MIT Laboratory for Computer Science 848, 1985.

[CM84] W. F. Clocksin and C. S. Mellish. Programming in Prolog,2nd Edition. Springer-Verlag, 1984.

[Coh65] P. M Cohn. Universal Algebra. New York, Harper and Row, 1965.

[CPS89] R. Cleaveland, J. Parrow, and B. Steffen. The Concurrency Workbench: A semantics-based verification tool for finite-state systems. In Proceedings of the Workshop on Automated Verification Methods for Finite-state Systems. Springer-verlag, 1989. LNCS 407.

[CU73] J. Cleaveland and R. Uzgalis. What every programmer should know about grammar. Technical report, Dept. Computer Science, University of California, Los Angeles, 1973.

[CWB]  Concurrency workbench home page.  WWW,

http://www.dcs.ed.ac.uk/packages/cwb.

Bibliography 188

[DBOM81] B. Du Boulay, T. O’Shea, and J. Monk. The black box inside the glass box: presenting concepts to novices. International Journal of Man-Machine Studies, 14:237–249, 1981.

[deB69] J. W. deBakker. Semantics of programming languages. Advances in Information Systems Science, 2, 1969.

[Des84] Th. Despeyroux. Executable specification of static semantics. In Semantics of data types. Springer-Verlag, 1984. LNCS 173.

[Des88] J. Despeyroux. TYPOL: a formalism to represent natural semantics. Technical Report Research report 94, INRIA, 1988.

[Dij65] E. W. Dijkstra. Cooperating sequential processes. Technical Report EWD-123, Technological University, Eindhoven, The Netherlands, 1965. reprinted in [Gen68], pages 43–112.

[Dij76] E. W. Dijkstra. A discipline of programming. Prentice-Hall, 1976.

[DJ86] M. Dam and F. Jensen. Compiler generation from relational semantics. In European Symposium on Programming, pages 1–30. Springer-Verlag, 1986. LNCS 213.

[dNH84] R. de Nicola and M. Hennessy. Testing equivalences for processes. Theoretical Computer Science, 34:83–133, 1984.

[DS90] E. W. Dijkstra and C. S. Scholten. Predicate calculus and program semantics. Springer-Verlag, 1990.

[DS92] Fabio Q. B. Da Silva. Correctness proofs of compilers and debuggers: an approach based on structural operational semantics. PhD thesis, Laboratory for the Foundations of Computer Science, University of Edinburgh, 1992.

[EA]  Evolving  algebras  home  page.  WWW,

http://www.eecs.umich.edu/ealgebras.

[End77] H. B. Enderton. Elements of Set Theory. Academic Press, 1977.

[FC94] M. Felleisen and R. Cartwright. Extensible denotational language specifications. In TACS ’94. Springer-Verlag, 1994. LNCS 789.

[FFHD86] M. Felleisen, D. P. Friedman, E. Hohlbecker, and B. Duba. Reasoning with continuations. Symposium of Logic in Computer Science, 1:131–141, 1986.

[FFHD87] M. Felleisen, D. P. Friedman, E. Hohlbecker, and B. Duba. A syntactic theory of sequential control. Theoretical Computer Science, 52(3):205–237, 1987. Preliminary version in [FFHD86].

[Flo67] R. W. Floyd. Assigning meanings to programs. In Proceedings AMS Symposium of Applied Mathematics, volume 19, pages 19–31. American Mathematical Society, 1967.

Bibliography 189

[Gar63] J. L. Garwick. The definition of programming languages. In T. B. Steel Jr., editor, Formal language description languages, pages 139– 147. North-Holland publishing company, Amsterdam, The Netherlands, 1963.

[Gar95] P. Gardner. Equivalences between logics and their representing type theories. Mathematical Structures in Computer Science, 5:to appear, 1995.

[GB90] J. Goguen and R. Burstall. INSTITUTIONS: Abstract model theory for specification and programming. Technical Report ECS-LFCS-90-106, LFCS, Edinburgh University, 1990.

[Gen68] F. Genuys. Programming Languages. Academic Press, London, 1968.

[Gir87] J-Y. Girard. Linear logic. Theoretical Computer Science, 50:1–102, 1987.

[Gir89] J-Y. Girard. Towards a geometry of interactions. In J. W. Gray and A. Scedrov, editors, Categories in computer science and logic, volume 92 of Contemporary Mathematics. American Mathematical Society, 1989.

[GK93] Y. Gurevich and Huggins J. K. The semantics of the C programming language. In Proceedings of Computer Science Logic (CSL)’92, pages 274–308. Springer Verlag, 1993. LNCS 702. Obtainable by anonymous FTP — ftp.eecs.umich.edu:groups/Ealgebras/calgebra.ps.

[GLT89] J-Y. Girard, Y. Lafont, and P. Taylor. Proofs and Types. Cambridge Tracts in Theoretical Computer Science 7. Cambridge University Press, 1989. ISBN 0-521-37181-3.

[GMP89] A. Giacalone, A. Mishra, and S. Prasad. Facile: a symmetric integration of concurrent and functional programming. International journal of parallel programming, 18(2):121–160, 1989.

[GMP90] A. Giacalone, A. Mishra, and S. Prasad. Operational and algebraic semantics for Facile: a symmetric integration of concurrent and functional programming. In ICALP 90 (LNCS 443), pages 765–780. Springer-Verlag, 1990.

[Göd58] K. Gödel. Über eine bisher noch nicht benützte Erweiterung des finiten Standpunktes. Dialectica, 12:280–287, 1958. English version in Journal of Philosophic Logic 9:133–142, 1980.

[Grä79] G. Grätzer. Universal Algebra. Springer-Verlag, 2 edition, 1979.

[GS86] S. Graf and J. Sifakis. A modal characterization of observational congruence on finite terms of CCS. Information and Control, 68:125– 145, 1986.

[Gun91] C. Gunter. Forms of semantic specification. Bulletin EATCS, 45:98– 113, 1991.

[Gur91] Y. Gurevich. Evolving algebras, a tutorial introduction. Bulletin EATCS, 43:254–284, Feb. 1991.

[Han93] J. Hannan. Extended natural semantics. Journal of Functional Programming, 3(2):123–152, 1993.

[Har84] D. Harel. Dynamic logic. In Handbook of philosophical logic vol. II, pages 497–604. Kluwer academic publishers, 1984.

[Hen90] M. Hennessy. The semantics of programming languages — an elementary introduction using Structural Operational Semantics. Wiley, 1990.

[HK81] J. L. Hennessy and R. B. Kieburtz. The formal definition of a realtime language. Acta Informatica, 16:309–345, 1981.

[HL74] C. A. R. Hoare and P. E. Lauer. Consistent and complementary formal theories of the semantics of programming languages. Acta Informatica, 3:135–153, 1974.

[HM94] J. S. Hodas and D. Miller. Logic programming in a fragment of intuitionistic linear logic. Information and Computation, 110(2):327– 365, 1994.

[HMT90] R. Harper, R. Milner, and M. Tofte. The Definition of Standard ML. MIT Press, 1990.

[Hoa69] C. A. R. Hoare. An axiomatic basis for computer programming. Communications of the ACM, 12:576–580,583, 1969.

[Hoa74] C. A. R. Hoare. Monitors: An operating systems structuring concept. Communications of the ACM, 17(10):549–557, 1974. Erratum in CACM 18(2), 1975, page 95.

[Hoa78] C. A. R. Hoare. Communicating sequential processes. Communications of the ACM, 21(8):666–677, 1978.

[Hoa85] C. A. R. Hoare. Communicating Sequential Processes. Prentice-Hall International, 1985.

[Hoo86] J. Hooman. The quest goes on: a survey of proofsystems for partial correctness of CSP. In J. W. de Bakker, W-P. de Roever, and G. Rozenberg, editors, Current Trends in Concurrency, pages 343– 395. Springer-Verlag, 1986. LNCS 224.

[HS86] J. R. Hindley and J. P. Seldin. Introduction to Combinators and λ– Calculus. London Mathematical Society Student Texts 1. Cambridge University Press, 1986. ISBN 0-521-31839-4.

Bibliography 191

[HU79] J. E. Hopcroft and J. D. Ullman. Introduction to Automata Theory, Languages and Computation. Addison–Wesley, 1979. ISBN 0-201-02988-X.

[HW73] C. A. R. Hoare and N. Wirth. An axiomatic definition of the programing language PASCAL. Acta Informatica, 2:335–355, 1973.

[IP91] P. Inverardi and C. Priami. Evaluation of tools for the analysis of communicating systems. Bulletin of EATCS, 45:158–185, 1991.

[Jab95] A. Jaber. Spécification de la sémantique dynamique du lanage Sisal. Technical report, DEA, Université de Nice-Sophia Antipolis, June 1995.

[Jon83] C. Jones. Specification and design of (parallel) programs. In Proceedings of IFIP, pages 321–332, 1983.

[Kah87] G. Kahn. Natural semantics. In G. Goos and J. Hartmanis, editors, Proceedings of the Symposium on Theoretical Aspects of Computer Science. Springer-Verlag LNCS, Vol. 247, 1987.

[Kah93] S. Kahrs. Mistakes and ambiguities in the definition of Standard ML. Technical Report ECS-LFCS-93-257, Laboratory for the Foundations of Computer Science, University of Edinburgh, 1993. WWW: http://www.dcs.ed.ac.uk/publications/lfcsreps/EXPORT/93/ECS-LFCS-93-257/.

[Kri68] G. Kriesel. A survey of proof theory. Journal of Symbolic Logic, 33(3), 1968.

[Kri71] G. Kriesel. A survey of proof theory II. In J.E. Fenstad, editor, Proc. 2nd Scandinavian logic symposium, pages 109–170. North Holland, 1971.

[KST94] S. Kahrs, D. Sannella, and A. Tarlecki. The definition of extended ML. Technical Report ECS-LFCS-94-300, Laboratory for the Foundations of Computer Science, University of Edinburgh, 1994.

[Lan64] P. Landin. The mechanical evaluation of expressions. Computer Journal, 6(4):308–320, 1964.

[LG81] G. M. Levin and D. Gries. A proof technique for Communicating Sequential Processes. Acta Informatica, 15:281–302, 1981.

[LS84] L. Lamport and F. Schneider. The “Hoare Logic” of CSP and all that. ACM Transactions on Programming Languages and Systems, 6(2):281–296, 1984.

[LW69] P. Lucas and K. Walk. On the formal description of PL/I. Annual Rev. Automatic Programming, 6(3):105–182, 1969.

[MC81] J. Misra and K. Chandy. Proofs of networks of processes. IEEE Transactions on Software Engineering, SE-7(4):417–426, 1981.

[Men79] E. Mendelson. Introduction to mathematical logic 2nd edition. Van Nostrand Co., 1979.

[MG95] M. Miculan and F. Gadducci. Modal μ-types for processes. In Symposium of Logic in Computer Science, volume 10, pages 221–231. IEEE, 1995.

[Mil]  R. Milner.  Calculi for interaction.  WWW:

ftp://ftp.cl.cam.ac.uk/users/rm135/ac9.ps.Z.

[Mil89] R. Milner. Communication and Concurrency. Prentice Hall, 1989.

[Mil91] R. Milner. The polyadic π-calculus: a tutorial. Technical Report ECS-LFCS-91-180, The laboratory for the foundations of computer science, Edinburgh University, 1991.

[Mil94] D. Miller. Forum: a multiple-conclusion specification logic. In Symposium of Logic in Computer Science, pages 272–281, 94. To appear TCS, and WWW: ftp://ftp.cis.upenn.edu/pub/papers/miller/tcs95.dvi.Z.

[Milar] D. Miller. A survey of linear logic programming. Newsletter of the Network of Excellence on Computational Logic, pages –, To Appear. WWW: ftp://ftp.cis.upenn.edu/pub/papers/miller/ComputNet95/llsurvey.html.

[Mit] K. Mitchell. Language semantics and implementation. Lecture notes, The Department of Computer Science, Edinburgh University, ?

[Mit94] K. Mitchell. Concurrency in a natural semantics. Technical Report ECS-LFCS-94-311, The Laboratory for the Foundations of Computer Science, the University of Edinburgh, 1994. Available via the WWW: http://www.dcs.ed.ac.uk/lfcsreps/EXPORT/94/ECS-LFCS-94-311.

[MLB76] M. Marcotty, H. F. Ledgard, and G. V. Bochmann. A sampler of formal definitions. ACM Computing surveys, 8(2):191–275, 1976.

[Mog90] E. Moggi. An abstract view of programming languages. Technical Report ECS-LFCS-90-113, Laboratory for the foundations of Computer Science, Edinburgh University., 1990.

[Mog91] E. Moggi. Notions of computations and monads. Information and Control, 93(1):55–92, July 1991.

[Mos74] P. D. Mosses. The mathematical semantics of Algol 60. Technical Report PRG–12, Programming research group, University of Oxford, 1974.

[Mos90] P. D. Mosses. Denotational semantics. In J. van Leeuwen, editor, Handbook of Theoretical Computer Science Volume B: Formal Models and Semantics, chapter 11, pages 575–631. Elsevier Science Publishers, B.V., 1990.

[Mos91] P. D. Mosses. Action semantics. Technical Report DAIMI Fn-48, Aarhus University, Denmark, 1991. Now published as volume 26 of Cambridge Tracts in Theoretical Computer Science, Cambridge University Press, 1992.

[MP93] M. C. Mayer and F. Pirri. First order abduction via tableau and sequent calculi. Bulletin of the IGPL, 1(1):99–117, 1993. WWW: http://www.mpi-sb.mpg.de:80/igpl/Bulletin/.

[MPW92] R. Milner, J. Parrow, and D. Walker. A calculus of mobile processes, (parts I and II). Information and Control, 100:1–77, 1992.

[MRP] A. Mifsud, Milner R., and J. Power. Control structures I. WWW: ftp://ftp.cl.cam.ac.uk/users/rm135/cs1.ps.Z.

[MS92] R. Milner and D. Sangiorgi. Barbed bisimulation. In Proceedings of the 19th International Conference on Automata, Languages and Programming (ICALP), pages 685–695. Springer-Verlag, 1992. Lecture Notes in Computer Science vol. 623.

[MT90] R. Milner and M. Tofte. Commentary on Standard ML. MIT press, 1990.

[MT92] R. Milner and M. Tofte. Co-induction in a relational semantics. Theoretical Computer Science, 17:209–220, 1992.

[NN92] H. R. Neilsen and F. Neilsen. Semantics with applications: a formal introduction. John Wiley and sons, 1992.

[NPW81] M. Nielsen, G. Plotkin, and G. Winskell. Petri nets, event structures and domains, part I. Theoretical Computer Science, 13:85–108, 1981.

[OG76] S. Owicki and D. Gries. An axiomatic proof technique for parallel programs I. Acta Informatica, 6:319–340, 1976.

[OPTT95] P.W. O’Hearn, A. J. Power, M. Takeyama, and R. D. Tennent. Syntactic control of interference revisited. Electronic notes in Theoretical computer science, 1, 1995. On the WWW:

http://top.cis.syr.edu/users/ohearn/scir.ps.

[Oss83] M. Ossefort. Correctness proofs of communicating sequential processes: three illustrative examples from the literature. ACM Transactions on Programming Languages and Systems, 5(4):620–640, 1983.

[PE88] F. Pfenning and C. Elliott. Higher-order abstract syntax. In SIG-PLAN ’88 conference on programming language design and implementation, pages 199–208, 1988.

Bibliography 194

[Pit91] A.M. Pitts. Evaluation logic. In G. Birtwistle, editor, Workshops in Computing 283. 4th Higher Order Workshop, Banf. 1990, Springer Verlag, 1991.

[Plo81] G. D. Plotkin. A structural approach to operational semantics. Technical Report DAIMI FN-19, Aarhus University, Denmark, 1981.

[Plo83] G. D. Plotkin. An operational semantics for CSP. In D. Bjørner, editor, Formal description of programming concepts - II, pages 199– 225. North-Holland publishing company, 1983.

[Plo85] G. D. Plotkin. Denotational semantics with partial functions. Lecture at CSLI Summer School, 1985.

[Pol95] Robert Pollack. The Theory of LEGO, a proof checker for the extended calculus of constructions. PhD thesis, Laboratory for the Foundations of Computer Science, University of Edinburgh, 1995.

[PR96] A. M. Pitts and J. R. X. Ross. Process calculus based upon evaluation to committed form. In U. Montanari and V. Sassone, editors, CONCUR’96: Concurrency Theory, Proc. 7th Int. Conf. Pisa, 1996, volume 1119 of Lecture Notes in Computer Sceince, pages 18–33. Springer-Verlag, Berlin, 1996.

[Pra65] D. Prawitz. Natural Deduction. Almquist and Wiksell, Stockholm, 1965.

[Pra71] D. Prawitz. Ideas and results in proof theory. In J.E. Fenstad, editor, Proc. 2nd Scandinavian logic symposium. North Holland, 1971.

[Pra91] K. V. S. Prasad. A calculus of broadcasting systems. In TAP-SOFT’91 Volume 1:CAAP. Springer-Verlag, 1991. LNCS 493.

[Pra93] K. V. S. Prasad. Programming with broadcasts. In CONCUR ’93. Springer-Verlag, 1993. LNCS 715.

[PT95] B. C. Pierce and D. N. Turner. Pict: A programming language based on the pi-calculus, 1995. Compiler, documentation, demonstration programs, and standard libraries; available electronically

http://www.cl.cam.ac.uk/users/bcp1000/ftp/pict.

[Red93a] U. S. Reddy. Global state considered unnecessary: Semantics of interference-free imperative programming. In ACM SIGPLAN Workshop. on State in Programming Languages, pages 120–135. Technical Report YALEU/DCS/RR-968, June 1993.

[Red93b] U. S. Reddy. A linear logic model of state. Available by anonymous ftp from theory.doc.ic.ac.uk in /theory/papers/Reddy, 1993.

[Rep91a] J. H. Reppy. CML: a higher-order concurrent language. In Proceedings of the SIGPLAN’91 conference on programming language design and implementation, pages 293–305, 1991.

Bibliography 195

[Rep91b] J. H. Reppy. An operational semantics of first-class synchronous operations. Technical Report TR 91-1232, Dept. Computer Science, Cornell University, 1991.

[Ret93] C. Retoré. Réseaux et Séquents Ordonnés. PhD thesis, Equipe de Logique, Departement de Mathematiques, Université Paris, 1993.

[Rey81] J. C. Reynolds. The Craft of Programming. Prentice-Hall International, 1981.

[San93] Davide Sangiorgi. Expressing mobility in process algebras: first-order and higher-order paradigms. PhD thesis, Laboratory for the foundations of computer science, University of Edinburgh, 1993.

[San94] P. Sansom. Execution profiling for non-strict functional languages. PhD thesis, Department of Computing Science, University of Glasgow, 1994.

[Sch88] D. Schmidt. Denotational Semantics — a methodology for language development. Wm. C. Brown Publishers, 1988. ISBN 0-697-06849-8.

[Sch95] D. Schmidt. Natural-semantics-based abstract interpretation. In Proceedings of the second international Static Analysis Symposium ’95, pages 1–18. Springer-Verlag, 1995. LNCS 983.

[Sco69] D. Scott. A type-theoretical alternative to CHUCH, ISWIM, OWHY, 1969. Later published in Theoretical Computer Science 121:411–440, 1993.

[SMo] The SMoLCS repository. FTP, ftp://ftp.disi.unige.it/pub/smolcs/.

[ST99] D. Sannella and A. Tarlecki. Foundations of algebraic specifications and formal program development. Cambridge University Press, To appear, 199?

[Sti88] C. Stirling. A generalization of Owicki-Gries’s Hoare Logic for a concurrent while language. Theoretical Computer Science, 58:347– 359, 1988.

[Sti92] C. Stirling. Modal and temporal logics. In Handbook of Logic in Computer Science vol. 2, pages 478–571. Oxford: Clarendon, 1992.

[Sun84a] G. Sundholm. Proof theory and meaning. In D. Gabbay and F. Guenther, editors, Handbook of Philosophical Logic III. Kluwer Academic Publishers, 1984.

[Sun84b] G. Sundholm. Systems of deduction. In D. Gabbay and F. Guenther, editors, Handbook of Philosophical Logic I. Kluwer Academic Publishers, 1984.

[Sve86] E. Svendsen. The professional handbook of the donkey. The donkey sanctuary, 1986.

Bibliography 196

[Tof87] Mads Tofte. Operational Semantics and Polymorphic Type Inference. PhD thesis, The Laboratory for the Foundations of Computer Science, The University of Edinburgh, 1987.

[Tro73] A. S. Troelstra. Metamathematical Investigation of Intuitionistic Arithmetic and Analysis. Springer-Verlag, 1973. Lecture Notes in Mathematics 344.

[TS85] J-P. Tremblay and P. G. Sorenson. The Theory and Practice of Compiler Writing. McGraw-Hill, 1985.

[Und93] J. Underwood. On the computational content of classical sequent proofs. Technical Report ARO Report 94-1, U.S. Department of Defense Army Research Office, 1993.

[Und95] J. Underwood. Tableau for intuitionistic predicate logic as metatheory. Technical Report ECS-LFCS-95-321, Laboratory for the Foundations of Computer Science, Edinburgh University, 1995. WWW: http://www.dcs.ed.ac.uk/lfcsreps/EXPORT/95/ECS-LFCS-95-321.

[VG90] J. Van Glabbeek. The linear-time branching-time spectrum. In Proceedings CONCUR 90, pages 278–297. Springer-Verlag, 1990. LNCS 458.

[vWMP^{+}75] A. van Wijngaarden, B. J. Mailloux, J. E. Peck, C. H. A. Koster, and M. Sintzoff. ALGOL 68 revised report. Acta Informatica, 5:1–236, 1975.

[vWMPK69] A. van Wijngaarden, B. J. Mailloux, J. E. Peck, and C. H. A. Koster. Report on the algorithmic language ALGOL 68. Technical Report MR101, Mathematisch Centrum, Amsterdam, The Netherlands, 1969.

[Wat87] D. A. Watt. An action semantics of Standard ML. In M. Main, A. Melton, M. Mislove, and D. Schmidt, editors, 3rd Workshop on the Mathematical Foundations of Programming Language Semantics, pages 572–598. Springer-Verlag, 1987. LNCS 298.

[Wec92] W. Wechler. Universal Algebra for computer scientists, volume 25 of EATCS monographs on theoretical computer science. Springer-Verlag, 1992.

[Weg72] P. Wegner. The Vienna definition language. Computing Surveys, 4(1):5–63, 1972.

[Weg76] P. Wegner. Programming languages — the first 25 years. IEEE Transactions on computers, pages 1207–1225, Dec 1976.

[Wex89] J. Wexler. Concurrent programming in OCCAM 2. Ellis Horwood (a division of John Wiley and sons), 1989.

Bibliography 197

[Win82] G. Winskel. Event structure semantics for CCS and related languages. In Proceedings 9th ICALP, pages 581–576. Springer-Verlag, 1982. LNCS 140.

[Win88] G. Winskel. An introduction to event structures. In Proceedings, Linear Time, Branching Time and Partial Order in Logics and Models for Concurrency workshop, pages 364–397. Springer-Verlag, 1988. LNCS 354.

[Wir83] N. Wirth. MODULA: a language for modular multiprogramming. In E. Horowitz, editor, Programming languages: A Grand Tour, pages 273–305. Springer-Verlag, 1983.

[WN94] G. Winskel and M. Nielsen. Models for concurrency. Technical Report RS-94-12, BRICS Research Series, May 1994. To appear as a chapter in the Handbook of Logic in Computer Science.

[ZdBdR83] J. Zwiers, A. de Bruin, and W-P. de Roever. A proof system for partial correctness of dynamic networks of processes. In Proceedings, Logics of programs, pages 513–527. Springer-Verlag, 1983.

[ZdRvEB85] J. Zwiers, W-P. de Roever, and P. van Emde Boas. Compositionality and concurrent networks, soundness and completeness of a proofsystem. In International Conference on Automata, Languages and Programming ’85, pages 509–519. Springer-Verlag, 1985. LNCS 194.