Ignoring nonessential interleavings in assertional reasoning on concurrent programs

In this paper, we investigate several equivalence relations for probabilistic labeled transition systems: bisimulation equivalence, readiness equivalence, failure equivalence, trace equivalence, maximal trace equivalence and finite trace equivalence. We formally prove the inclusions (equalities) among these equivalences. We also show that readiness, failure, trace, maximum trace and finite trace equivalences for finite probabilistic labeled transition systems are decidable in polynomial time. This should be contrasted with the PSPACE completeness of the same equivalences for classical labeled transition systems. Moreover, we derive an efficient polynomial time algorithm for deciding bisimulation equivalence for finite probabilistic labeled transition systems. The special case of initiated probabilistic transition systems will be considered. We show that the isomorphism problem for finite initiated labeled probabilistic transition systems is NC(1) equivalent to graph isomorphism.

A possible approach to studying behavioural equivalences in labelled transition systems is that of characterizing them in terms of homomorphic transformations. This characterization permits relying on algebraic techniques for proving systems properties and reduces equivalence checking of two systems to studying the relationships among the elements of their structures. Different algebraic characterizations of bisimulation-based equivalences in terms of particular transition systems homomorphisms have been proposed in the literature. Here we show, by an example, that trace-based equivalences are not locally characterizable and thus that the above results cannot be extended to these equivalences. However, similar results can be obtained if we confine ourselves to restricted classes of transition systems. Here, the algebraic characterizations of three well known decorated-trace equivalences (ready trace, ready and failure equivalence) for tree-like structures are presented.

Stephen J. Hartley Oxford University Press, New York, 1998, 260 pp. ISBN 0-19-511315-2, $45.00 Concurrent Programming is a thorough treatment of Java multi-threaded programming for both a stand-alone and distributed environment. Designed mostly for students in concurrent or parallel programming classes, the text is also an excellent reference for the practicing professional developing multi-threaded programs or applets. Hartley first provides a complete explanation of the features of Java necessary to write concurrent programs, including topics such as exception handling, interfaces, and packages. He then gives the reader a solid background to write multi-threaded programs and also presents the problems introduced when writing concurrent programs—namely race conditions, mutual exclusion, and deadlock. Hartley also provides several software solutions that do not require the use of common process and thread mechanisms. Once the groundwork is laid for writing concurrent programs, Hartley then takes a different approach than most Java references. Rather than presenting how Java handles mutual exclusion with the synchronized keyword (although it is covered later), he first looks at semaphore-based solutions to classic concurrent problems such as bounded-buffer, readers-writers, and the dining philosophers. Hartley also uses the same approach to develop Java classes for monitors and message passing. This unique approach to introducing concurrency allows the readers to both understand how Java threads are synchronized and how the basic synchronization mechanism can be used to construct more abstract tools such as semaphores. If there is a shortcoming with the text it is with the lack of sufficient coverage of remote method invocation (RMI), although there is a section covering RMI. This is quite understandable as RMI is a fairly recent phenomenon with the Java community. Also, the classes that Hartley provides could easily implement RMI rather than sockets to handle communication. The strengths of the book include its ease in reading, several examples at the end of chapters, a package similar to Xtango that provides algorithm animation, and a supportive web site by the author (see www.mcs.drexel.edu/~shartley/ConcProgJava/index.html ) including compressed source code. As Java becomes more dominant on the server side of multi-tier applications, writing thread-safe concurrent applications becomes even more important. Concurrent Programming is a strong step towards teaching students and professionals such skills. Greg Gagne, Westminster College of Salt Lake City Salt Lake City, Utah

Concurrency, as a useful feature of many modern programming languages and systems, is generally hard to reason about. Although existing work has explored the verification of concurrent programs using high-level languages and calculi, the verification of concurrent assembly code remains an open problem, largely due to the lack of abstraction at a low-level. Nevertheless, it is sometimes necessary to reason about assembly code or machine executables so as to achieve higher assurance.In this paper, we propose a logic-based "type" system for the static verification of concurrent assembly programs, applying the "invariance proof" technique for verifying general safety properties and the "assume-guarantee" paradigm for decomposition. In particular, we introduce a notion of "local guarantee" for the thread-modular verification in a non-preemptive setting.Our system is fully mechanized. Its soundness has been verified using the Coq proof assistant. A safety proof of a program is semi-automatically constructed with help of Coq, allowing the verification of even undecidable safety properties. We demonstrate the usage of our system using three examples, addressing mutual exclusion, deadlock freedom, and partial correctness respectively.

Contextual equivalences for cryptographic process calculi can be used to reason about correctness of protocols, but their definition suffers from quantification over all possible contexts. Here, we focus on two such equivalences, may-testing and barbed equivalence, and investigate tractable proof methods for them. To this aim, we develop an 'environment-sensitive' labelled transition system, where transitions are constrained by the knowledge the environment has of names and keys. On top of the new transition system, a trace equivalence and a co-inductive weak bisimulation equivalence are defined, both of which avoid quantification over contexts. Our main results are soundness of trace semantics and of weak bisimulation with respect to may-testing and barbed equivalence, respectively. This leads to more direct proof methods for equivalence checking. The use of such methods is illustrated via a few examples concerning implementation of secure channels by means of encrypted public channels. We also consider a variant of the labelled transition system that gives completeness, but is less handy to use.

In our previous paper [1], a new model of a Labeled Transition System (LTS)-type implementation was proposed. In ordinary LTSs, transitions are labeled by actions; therefore, they can be called LTSs of actions. The new model is an LTS of observations; in this model, observations and test actions (buttons) are used instead of actions. This model generalizes many testing semantics that are based on the LTS of actions but use additional observations (refusals, ready sets, etc.). Moreover, systems with priority, which are not described by the LTS of actions, are simulated uniformly. In the present paper, we develop this approach by focusing on the composition of systems. The point is that, on observation traces, one cannot define a composition with respect to which a composition of LTSs would possess the property of additivity: the set of traces of a composition of LTSs coincides with the set of all pairwise compositions of traces of LTS operands. This is explained by the fact that an observation in a composition state is not calculated based on observations in states-operands. In this paper, we propose an approach that eliminates this drawback. To this end, we label the transitions of LTSs by symbols (events) that, on the one hand, can be composed to guarantee the property of additivity, and, on the other hand, can be used to generate observations under testing: a transition by an event gives rise to an observation related to this event. This model is called an LTS of events. In this paper, we define (1) a transformation of an LTS of events into an LTS of observations to conform with the principles of our previous paper [1]; (2) a composition of LTSs of events; (3) a composition of specifications that preserves conformance: a composition of conformal implementations is conformal to a composition of specifications; and (4) a uniform simulation of LTSs of actions in terms of the LTSs of events, which allows one to consider an implementation in any interaction semantics admissible for LTSs of actions. In this case, a composition of LTSs of events obtained as a result of simulation of the original LTSs of actions is equivalent to the LTS of events obtained as a result of simulation of the composition of these LTSs of actions.

When a Petri net is synthesised from a labelled transition system, it is frequently desirable that certain additional constraints are fulfilled. For example, in circuit design, one is often interested in constructing safe Petri nets. Targeting such subclasses of Petri nets is not necessarily computationally more efficient than targeting the whole class. For example, targeting safe nets is known to be NP-complete while targeting the full class of place/transition nets is polynomial, in the size of the transition system. In this paper, several classes of Petri nets are examined, and their suitability for being targeted through efficient synthesis from labelled transition systems is studied and assessed. The focus is on choice-free Petri nets and some of their subclasses. It is described how they can be synthesised efficiently from persistent transition systems, summarising and streamlining in tutorial style some of the authors’ and their groups’ work over the past few years.

The main contribution of this work is a fast algorithm for checking whether a labelled transition system (LTS) is operationally deterministic. Operational determinism is a condition on the LTS designed to capture the notion of “deterministic behaviour” without ruling out invisible actions and divergence, and without strictly devoting oneself to any single process-algebraic semantics. Indeed, we show that in the case of operationally deterministic LTSs, all divergence-sensitive equivalences between divergence-sensitive branching bisimilarity and trace + divergence trace equivalence collapse to the same equivalence. The running time of the algorithm is linear except a term that, roughly speaking, grows as slowly as Ackermann's function grows quickly. If the original LTS is operationally deterministic, the algorithm produces as a by-product a structurally deterministic LTS that is divergence-sensitive branching bisimilar to the original one. This LTS can be minimised like a deterministic finite automaton. The overall approach is so cheap that it makes almost always sense to first try it and revert to a semantics-specific reduction or minimisation algorithm only if the LTS proves operationally nondeterministic.

Model checking is a technique for finding bugs in systems by systematically exploring their state spaces. We wish to extract sound models from concurrent programs automatically and check the behaviors of these models systematically. The zing project is an effort to build a flexible infrastructure to represent and model check abstractions of large concurrent software.To support automatic extraction of models from programs written in common programming languages, zing’s modeling language supports three facilities present in modern programming languages: (1) procedure calls with a call-stack, (2) objects with dynamic allocation, and (3) processes with dynamic creation, using both shared memory and message passing for communication. We believe that these three facilities capture the essence of model checking modern concurrent software.Building a scalable model-checker for such an expressive modeling language is a huge challenge. zing’s modular architecture provides a clear separation between the expressive semantics of the modeling language, and a simple view of zing programs as labeled transition systems. This separation has allowed us to decouple the design of efficient model checking algorithms from the complexity of supporting rich constructs in the modeling language. zing’s model checking algorithms have been designed to exploit existing structural abstractions in concurrent programs such as processes and procedure calls. We present two such novel techniques in the paper: (1) compositional checking of zing models for message-passing programs using a conformance theory inspired by work in the process algebra community, and (2) a new summarization algorithm, which enables zing to reuse work at procedure boundaries by extending interprocedural data-flow analysis algorithms from the compiler community to analyze concurrent programs.KeywordsModel CheckModeling LanguageProcedure CallLabel Transition SystemConcurrent ProgramThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

In this chapter, I try to formulate swarms as labelled transition systems with the same set of labels (events or actions): direction, splitting, fusion, repelling. Then I show that these labelled transition systems can implement Kolmogorov-Uspensky machines, but with a low accuracy because of emergent patterns which occur if we have many states of appropriate transition system. Then I propose a p-adic arithmetic and logic to formalize emergent patterns of swarms. To sum up, I offer a general logical approach to swarm intelligence.

Comparing operational models of name-passing process calculi

The bisimulation proof method can be enhanced by employing `bisimulations up-to' techniques. A comprehensive theory of such enhancements has been developed for first-order (i.e., CCS-like) labelled transition systems (LTSs) and bisimilarity, based on abstract fixed-point theory and compatible functions. We transport this theory onto languages whose bisimilarity and LTS go beyond those of first-order models. The approach consists in exhibiting fully abstract translations of the more sophisticated LTSs and bisimilarities onto the first-order ones. This allows us to reuse directly the large corpus of up-to techniques that are available on first-order LTSs. The only ingredient that has to be manually supplied is the compatibility of basic up-to techniques that are specific to the new languages. We investigate the method on the pi-calculus, the lambda-calculus, and a (call-by-value) lambda-calculus with references.

Time/Contention Trade-Offs for Multiprocessor Synchronization

When a Petri net system of some class is synthesised from a labelled transition system, it may be interesting to derive structural properties of the corresponding reachability graphs and to use them in a pre-synthesis phase in order to quickly reject inadequate transition systems, and provide fruitful error messages. The same is true for simultaneous syntheses problems. This was exploited for the synthesis of choice-free nets for instance, for which several interesting properties have been derived. We exhibit here a new property for this class, and analyse if this gets us closer to a full characterisation of choice-free synthesizable transition systems.

Pre-synthesis of Petri nets based on prime cycles and distance paths