A process algebra with global variables
OO. Dardha and J. Rot (Eds.): Combined Workshop on Expressiveness inConcurrency and Structural Operational Semantics (EXPRESS/SOS 2020).EPTCS 322, 2020, pp. 33–50, doi:10.4204/EPTCS.322.5 c (cid:13)
M.S. Bouwman, et al.This work is licensed under theCreative Commons Attribution License.
A process algebra with global variables
Mark Bouwman Bas Luttik Wouter Schols Tim A.C. Willemse
Eindhoven University of TechnologyEindhoven, The Netherlands [email protected] [email protected] [email protected] [email protected]
In standard process algebra, parallel components do not share a common state and communicatethrough synchronisation. The advantage of this type of communication is that it facilitates compo-sitional reasoning. For modelling and analysing systems in which parallel components operate onshared memory, however, the communication-through-synchronisation paradigm is sometimes lessconvenient. In this paper we study a process algebra with a notion of global variable. We also pro-pose an extension of Hennessy-Milner logic with predicates to test and set the values of the globalvariables, and prove correspondence results between validity of formulas in the extended logic andstateless bisimilarity and between validity of formulas in the extended logic without the set opera-tor and state-based bisimilarity. We shall also present a translation from the process algebra withglobal variables to a fragment of mCRL2 that preserves the validity of formulas in the extendedHennessy-Milner logic.
Communication between parallel components in real world systems takes many forms: packets overa network, inter-process communication, communication via shared memory, communication over abus, etcetera. Process algebras usually offer an abstract message passing feature. Not all forms ofcommunication fit well in a message passing paradigm, in particular, global variables and other forms ofshared memory do not fit in well. In some cases it would be desirable to have global variables as firstclass citizens. To illustrate this we introduce a small example.
Example 1.
Consider a traffic light and a car approaching a junction. If the light is green the car performsan action drive and moves past the junction. If the light is red the car performs an action brake and stops.Once the traffic light is green again the car performs the action drive . The specification should result inthe following LTS. drivechange red brakechange green change green change red change red change green drive
It would be natural to model the car and the traffic light as two parallel components. The car andthe traffic light need to communicate so that the car can make a decision to drive or brake dependingon the current state of the traffic light. Typically, such global information is modelled by introducingan extra parallel component that maintains the global information, in this case the colour of the trafficlight. However, taking that approach we obtain a different LTS, which has an extra transition modelling4 Aprocess algebra withglobal variablesthe communication of car and traffic light with the extra component. Moreover, one must take care thatdecisions to drive or brake are made on the basis of up-to-date information, e.g., by implementing aprotocol that locks the additional component. In many cases it is realistic that the observed value is nolonger up to date and in some cases we are also interested in analysing the consequences of this. In othercases however, we might want to abstract from such complications. When the information is constantlyavailable to the observers, as is the case with a traffic light, we have even more reason to not introduceseparate transitions communicating the global information.In some process algebras it is possible to define a communication function that specifies that a drive action is the result of a communication between two actions of parallel components, e.g. a drive i f green action from the car and a signal green action from the traffic light. This is somewhat unnatural as thetraffic light does not really actively participate in the driving of the car. Moreover, if we introduce a sec-ond car that only wants to drive when the traffic light is red we would need to change the communicationfunction, even though the communication of information does not essentially change. It would be betterto let the colour of the traffic light be in a global variable. In that way the behaviour of the traffic lightand cars acting upon information from the traffic light is more separated, we obtain a better separationof concerns.In the early days of process algebra, doing away with global variables in favour of message pass-ing and local variables was an important step to further develop the field [2]. Since then there have,nevertheless, been some efforts to reintroduce notions of globally available data.In [1] propositional signals and a state operator are presented. The state operator tracks the value ofsome information. Based on the current value a number of propositions can be signalled to the rest ofthe system. In the example of the traffic lights the process modelling the traffic light could track the stateof the light, emitting signals such as lightGreen and ¬ lightRed , which can in turn be used as conditionsin the process modelling the car. In this approach the value of the global variable is not communicateddirectly, which restricts conditions based on global variables to propositional logic.Other approaches, such as the one presented in [11, Chapter 19], model global variables as separateparallel processes and use a protocol to ensure only one process accesses a global variable at the time.This approach introduces extra internal steps, which increase the statespace. Moreover, it introducesdivergence when a process locks a global variable, reads the value, concludes that it cannot make a stepand unlocks the variable again.Formalisms based on Concurrent Constraint Programming (CCP) [12] have global data at their core.In CCP a central store houses a set of constraints. Concurrent processes may tell a constraint, adding it tothe global store or ask a constraint, checking whether it is entailed by the constraints in the store. An askwill block until other processes have added sufficient constraints to the store. Process calculi based onthe coordination language LINDA [10] also use global data. In these process calculi there is a global setof data elements. Similarly to CCP, processes may tell a data element (adding it to the global set) or aska data element (checking whether it is in the set). Additionally, processes may get an element, removingit from the data set. LINDA does not have a concept of variables, just a central set of data elements.Generally, process calculi based on CCP or LINDA do not allow asking a constraint/data element andacting upon the information in a single step.The goal of our work is to propose and study (i) a process calculus with global variables (ii) a modallogic that can refer to the values of global variables (iii) an encoding in an existing process calculusand logic with tool support. In this paper we propose a simple process calculus where every componentof the system can access the current value of global variables directly. We define appropriate notionsof equivalence for our process calculus. Our first contribution is an extension of the Hennessy-Milner.S.Bouwman,etal. 35Logic (HML) with two new operators that is strong enough to differentiate non-equivalent process ex-pressions. Our second contribution is an encoding of our process algebra in mCRL2 and our extendedlogic in standard HML. This encoding is such that the translated formula holds for the translated processexpression if and only if the original formula holds for the original process expression.This paper is organised as follows. In Section 2 we define a simple process algebra with globalvariables. In Section 3 we give appropriate notions of equivalence for our process algebra. We continueby defining an extension of the Hennessy-Milner Logic in Section 4 and relating it to our equivalencenotions in Section 5. In Section 6 we show how our process algebra with global variables can be encodedin mCRL2. Sections 7 and 8 discuss the results and conclude this work. In this section we will introduce a process algebra with global variables and its semantics. For conve-nience we will, in this paper, assume a single data domain D . We will use Var to denote the finite set ofglobal variable names.We presuppose a set of actions
Act and derive a set of transition labels
T L def = Act ∪ { assign ( v , d ) | v ∈ Var ∧ d ∈ D } . We also presuppose a set of process names PN . The set of process expressions P is gen-erated by the following grammar containing action prefix, inaction, choice, parallelism, encapsulation,recursion and conditionals : P : = λ . P | δ | P + P | P k P | ∂ B ( P ) | X | ( v = d ) −→ P , where λ ∈ T L , B ⊆ Act , X ∈ PN , v ∈ Var and d ∈ D . Inaction is similar to the process constant 0 in,for example, CCS [8] and TCP [1]. Our process algebra supports recursion because we also define arecursive specification E defining the process names. Let a recursive equation be an equation of the form X def = t with X ∈ PN and t a process expression in P . A recursive specification contains one recursiveequation X def = t for every X ∈ PN . Every recursive specification should be guarded. This means that everyoccurrence of X in t is in the scope of an action prefix. For communication between parallel processeswe use an ACP style communication function. We presuppose a binary communication function on theset of actions, i.e., a partial function γ : Act × Act ⇀ Act that is commutative and associative. We onlyallow handshakes (communication between two parties): if γ ( a , b ) = c then γ ( c , d ) is undefined for every d . Let V be the set of all functions Var → D , i.e. the set of all valuations. Let V ∈ V ; we denote by V [ v d ] the assignment defined, for all v ′ ∈ Var by: V [ v d ]( v ′ ) = (cid:26) d if v ′ = vV ( v ′ ) if v ′ = v In Definition 2 we give the usual definition of Labelled Transition Systems (LTSs).
Definition 2.
A Labelled Transition System (LTS) is a tuple ( S , L , −→ , s ) , where • S is a set of states, • L is a set of transition labels, • → ⊆ S × L × S is the transition relation, • s ∈ S is the initial state.6 Aprocess algebra withglobal variables (P REF ) h a . P , V i a −→ h P , V i (A SGN ) h assign ( v , d ) . P , V i assign ( v , d ) −→ h P , V [ v d ] i (C ON ) h P , V i λ −→ h P ′ , V ′ ih ( v = d ) → P , V i λ −→ h P ′ , V ′ i V ( v ) = d (R EC ) h P , V i λ −→ h P ′ , V ′ ih X , V i λ −→ h P ′ , V ′ i X def = P (S UM - L ) h P , V i λ −→ h P ′ , V ′ ih P + Q , V i λ −→ h P ′ , V ′ i (S UM - R ) h Q , V i λ −→ h Q ′ , V ′ ih P + Q , V i λ −→ h Q ′ , V ′ i (P AR - L ) h P , V i λ −→ h P ′ , V ′ ih P k Q , V i λ −→ h P ′ k Q , V ′ i (P AR - R ) h Q , V i λ −→ h Q ′ , V ′ ih P k Q , V i λ −→ h P k Q ′ , V ′ i (C OMM ) h P , V i a −→ h P ′ , V i h Q , V i b −→ h Q ′ , V ih P k Q , V i c −→ h P ′ k Q ′ , V i γ ( a , b ) = c (E NC ) h P , V i λ −→ h P ′ , V ′ ih ∂ B ( P ) , V i λ −→ h ∂ B ( P ′ ) , V ′ i λ / ∈ B Table 1: Structural operational semantics.We now want to associate an LTS with the process algebra. As the behaviour of a process expressiondepends on the valuation of global variables a state is a pair h P , V i of a process expression P and avaluation function V . The set of states is P × V . The transition relation is the least relation on statessatisfying the rules of the structural operational semantics (see Table 1).Note that we only allow processes to synchronise on actions and not on assignments. This designdecision was made since assignments change the valuation function, whereas actions cannot change thevaluation. When two processes synchronise on assignments then it is not clear what the resulting effecton the value of the variable should be. Example 3.
Consider the interaction between a car and a traffic light controller (TLC). The TLC sets thecolour of a traffic light which the driver of the car acts upon. There is one global variable t and the datadomain consists of two elements D = { green , red } . The recursive specification consists of two processequations, given below. CAR def = (( t = green ) −→ drive . δ ) + (( t = red ) −→ brake . (( t = green ) → drive . δ )) T LC def = (( t = green ) −→ assign ( t , red ) . T LC )+(( t = red ) −→ assign ( t , green ) . T LC ) Using the SOS we can derive an LTS with h CAR || T LC , V i as initial state, where V ( t ) = green . Note thatthis LTS is isomorphic to the LTS presented in Example 1. We only show the states reachable from theinitial state. The initial state is marked with an arrow pointing to it..S.Bouwman,etal. 37 h CAR k T LC , V ih CAR k T LC , V [ t red ] i h ( t = green ) → drive . δ k T LC , V [ t red ] ih ( t = green ) → drive . δ k T LC , V i h δ k T LC , V [ t red ] ih δ k T LC , V i driveassign ( t , red ) brakeassign ( t , green ) assign ( t , green ) assign ( t , red ) assign ( t , red ) assign ( t , green ) drive We will examine equivalence relations in the context of global variables. To start we note that we canexamine equivalence on two levels: on the level of process expressions and on the level of pairs ofprocess expression together with an initial valuation (from which we can derive an LTS). We begin byexploring the equivalence of process expressions.We require of the equivalence relation on process expressions that if P and Q are equivalent then wecan safely replace P with Q in any larger process expression. In other words, the equivalence relation onprocess expressions should be a congruence for the process algebra.Typically, equivalence of process expressions is established by a notion of bisimilarity. Most variantsof bisimulation only consider the labels on transitions. Strong bisimilarity (defined in Definition 4) is,however, not a congruence for our process algebra, which we will demonstrate with an example. Definition 4.
Strong bisimilarity: A relation R ⊆ S × S , where S is the set of states of an LTS, is a strongbisimulation relation if and only if for all states s and t and labels λ we have ( s , t ) ∈ R implies that • for all states s ′ : s λ −→ s ′ implies there exists a state t ′ such that t λ −→ t ′ and ( s ′ , t ′ ) ∈ R , • for all states t ′ : t λ −→ t ′ implies there exists a state s ′ such that s λ −→ s ′ and ( s ′ , t ′ ) ∈ R .Two states s and t are strongly bisimilar, denoted by s ↔ t , if and only if there exists a strong bisimulationrelation R such that ( s , t ) ∈ R . Example 5.
Consider process expressions P = ( v = ) → a . δ and Q = a . δ . Note that P and Q aresimply abbreviations of process expressions, not process names. Let V map a global variable v to 0 and D = { , } . The reachable fragments of the LTSs with h P , V i and h Q , V i as initial state are shown inFigure 1. h P , V ih Q , V i h δ , V ih δ , V i P : Q : aa Figure 1: Part of the transition system space of P and Q Processes P and Q seem behaviourally equivalent looking at the reachable transitions, the states h P , V i and h Q , V i are in fact strongly bisimilar. The problem arises when we add a parallel component that can8 Aprocess algebra withglobal variablesassign a different value to the global variable. Let us consider the process expression R = assign ( v , ) . δ .The reachable fragments of the LTSs with P k R and Q k R as initial state are shown in Figure 2. Clearly P k R and Q k R are not strongly bisimilar and therefore strong bisimilarity is not a congruence for ourprocess algebra. h P k R , V i h δ k R , V ih P k δ , V [ v ] i h δ k δ , V [ v ] ih Q k R , V i h δ k R , V ih Q k δ , V [ v ] i h δ k δ , V [ v ] i P k R : Q k R : a assign ( v , ) assign ( v , ) a assign ( v , ) assign ( v , ) a Figure 2: Part of the transition system space of P and Q We will use the notion of stateless-bisimilarity, defined in [9], as an equivalence relation on processexpressions. In essence, stateless-bisimilarity relates process expressions that behave the same under anyvaluation.
Definition 6.
Stateless-bisimilarity: A relation R sl ⊆ P × P is a stateless bisimulation relation if andonly if for all process expressions P and Q and labels λ we have ( P , Q ) ∈ R sl implies that • for all process expressions P ′ and valuation functions V , V ′ ∈ V : h P , V i λ −→ h P ′ , V ′ i implies thereexists a process expression Q ′ such that h Q , V i λ −→ h Q ′ , V ′ i and ( P ′ , Q ′ ) ∈ R sl , • for all process expressions Q ′ and valuation functions V , V ′ ∈ V : h Q , V i λ −→ h Q ′ , V ′ i implies thereexists a process expression P ′ such that h P , V i λ −→ h P ′ , V ′ i and ( P ′ , Q ′ ) ∈ R sl .Two process expressions P and Q are stateless bisimilar, denoted by P ↔ sl Q , if and only if there existsa stateless bisimulation relation R sl such that ( P , Q ) ∈ R sl .The deduction system of our process algebra is in process-tyft format from which it follows thatstateless-bisimilarity is a congruence [9].In the case that global variables cannot be changed by the environment and we have a specific initialvaluation in mind we might not care about the behaviour under valuations that will never occur. To thatend we use state-based bisimilarity [9], which is defined on states rather than process expressions. Definition 7.
State-based bisimilarity: A relation R sb ⊆ ( P × V ) × ( P × V ) is a state-based bisimula-tion relation if and only if for all states h P , V i and h Q , V i and labels λ we have ( h P , V i , h Q , V i ) ∈ R sb implies that V = V and • for all process expressions P ′ and valuation functions V ′ : h P , V i λ −→ h P ′ , V ′ i implies there exists aprocess expression Q ′ such that h Q , V i λ −→ h Q ′ , V ′ i and ( h P ′ , V ′ i , h Q ′ , V ′ i ) ∈ R sb ,.S.Bouwman,etal. 39 • for all process expressions Q ′ and valuation functions V ′ : h Q , V i λ −→ h Q ′ , V ′ i implies there exists aprocess expression P ′ such that h P , V i λ −→ h P ′ , V ′ i and ( h P ′ , V ′ i , h Q ′ , V ′ i ) ∈ R sb .Two states h P , V i and h Q , V i are state-based bisimilar, denoted by h P , V i ↔ sb h Q , V i , if and only ifthere exists a state-based bisimulation relation R sb such that ( h P , V i , h Q , V i ) ∈ R sb .State-based bisimilarity is not a congruence for our process algebra, the problem shown in Example5 applies.There is a relation between stateless-bisimilarity and state-based bisimilarity. For any two processexpressions P and Q we have that if P ↔ sl Q then also h P , V i ↔ sb h Q , V i for all valuations V ∈ V [9].State-based bisimilarity distinguishes LTSs on the valuation that is in a state: two states that arestrongly bisimilar may not be state-based bisimilar due to differences in valuations in reachable states.This takes into account that the value of global variables may be essential to the modelled system andmay be visible to the environment. In order to reason about properties of a process expression or system specification we define a logic.Standard Hennessy-Milner Logic (HML) [7] is insufficient for our purpose, for two reasons. The firstreason is that we would like to conveniently refer to global variables in the logic. The second reason forextending the logic is that we want a correspondence between the logic and stateless bisimilarity. Processexpressions a . δ and ( v = ) −→ a . δ are not stateless bisimilar but in the case that we have a valuationfunction V that maps v to 0 then states h a . δ , V i and h ( v = ) −→ a . δ , V i cannot be distinguished usingHML.We extend HML with two new operators. The first operator is the check operator ( v = e ) . Thisoperator returns a boolean which is true if and only if a global variable v has value e . The secondoperator is the set operator ↓ ( v : = e ) . The set operator sets the value of a global variable v to e . Thisresults in the following syntax for our logic: φ : = true | f alse | ( v = e ) | ¬ φ | φ ∧ φ | φ ∨ φ | h T i φ | [ T ] φ | ↓ ( v : = e ) φ where T is a nonempty finite set of transition labels. Depending on whether we include the checkoperator, the set operator or both, we will refer to the logic with HML check , HML set or HML check + set ,respectively.The formula true holds in every state and f alse holds in no states. The operators ¬ , ∧ , ∨ have theirusual meaning. The diamond operator h T i φ is true in a state s if and only if a transition s λ −→ s ′ existswhere φ holds in s ′ and λ ∈ T . The box operator [ T ] φ holds in a state s if and only if for every state s ′ and transition label λ ∈ T we have s λ −→ s ′ implies φ holds in s ′ .The check operator ( v = e ) is true in a state h P , V i if and only if V ( v ) = e . The set operator ↓ indicatesthat ↓ ( v : = e ) φ is true in all states h P , V i if and only if φ is true in h P , V [ v e ] i . Note that the set operatorallows us to reason about parts of an LTS that are not reachable from the initial state. Further note thatthe set operator allows us to distinguish h a . δ , V i and h ( v = ) −→ a . δ , V i even if V ( v ) = ↓ ( v : = ) h{ a }i true distinguishes them. We will use the notation ↓ ( V ) , V ∈ V , to set the value of allglobal variables to the value specified by V . This is a shorthand for a sequence of regular set operations.Note that the number of global variables is finite and the order of set operations is irrelevant in thesequence of set operations as each sets a different variable.0 Aprocess algebra withglobal variables In this section we will define semantic rules to obtain all states that satisfy a HML check + set formula. Wehave obtained the semantics of standard HML from [6]. Let φ be a modal formula, let ( S , L , −→ , s ) bean LTS. We inductively define the interpretation of φ , notation J φ K , where J φ K contains all states u ∈ S where φ is true. Note that the check and set operators are only defined for LTSs where states consist ofboth a process expression and a valuation. J true K = S J f alse K = /0 J v = e K = {h P , V i ∈ S | V ( v ) = e } J ¬ φ K = S \ J φ KJ φ ∧ φ ′ K = J φ K ∩ J φ ′ KJ φ ∨ φ ′ K = J φ K ∪ J φ ′ KJ h T i φ K = { u ∈ S | ∃ u ′ ∈ J φ K , λ ∈ T : u λ −→ u ′ } J [ T ] φ K = { u ∈ S | ∀ u ′ ∈ S , λ ∈ T : ( u λ −→ u ′ ) ⇒ u ′ ∈ J φ K } J ↓ ( v : = e ) φ K = {h P , V i ∈ S | h P , V [ v e ] i ∈ J φ K } There is a nice correspondence between strong bisimilarity and HML: two states in an LTS are stronglybisimilar if and only if they satisfy the same HML formulas [7]. This correspondence is often calledthe Hennessy-Milner theorem. We would like a similar correspondence between process expressionsand states and the extended HML. First, we introduce the notion of an image-finite process. As an LTScontains all possible process expressions (and valuations) we want to impose image-finiteness only forreachable states and process expressions, so we start by defining reachability.
Definition 8.
Reachability states: A state s ′ is reachable from a state s if there exist states s , . . . , s n andlabels λ , . . . , λ n such that s = s ∧ s λ −→ s ∧ · · · ∧ s n − λ n −→ s n ∧ s n = s ′ . Definition 9.
Reachability process expressions: Process expression P ′ is reachable from a process ex-pression P if there exist processes P , . . . , P n and labels λ , . . . , λ n such that P = P ∧ ∃ V , V h P , V i λ −→h P , V i ∧ · · · ∧ ∃ V n − , V n h P n − , V n − i λ n −→ h P n , V n i ∧ P n = P ′ . Definition 10.
Image-finiteness: A state h P , V i is image finite if and only if the set {h P ′ , V ′ i|h P , V i λ −→h P ′ , V ′ i} is finite for every label λ . A process expression P is image finite if and only if for every processexpression P ′ reachable from P and every valuation V the state h P ′ , V i is image-finite.An example of a state that is not image finite is h A , V i , with A def = a . δ || A .We can now prove the following two correspondences on the level of process expressions and states. Theorem 11.
Let P and Q be two image-finite process expressions. Then P ↔ sl Q if and only if for allvaluations V and all HML check + set formulas φ we have that h P , V i ∈ J φ K ⇔ h Q , V i ∈ J φ K . Proof.
We prove the two implications separately. To prove the implication from left to right assume P ↔ sl Q . The proof that for some HML check + set formula φ we have that h P , V i ∈ J φ K if and only if h Q , V i ∈ J φ K is straightforward by induction on the structure of φ ..S.Bouwman,etal. 41For the implication from right to left we assume that h P , V i and h Q , V i satisfy exactly the sameformulae in HML check + set . We shall prove that h P , V i ↔ sl h Q , V i . To this end, note that it is sufficient toshow that the relation R sl = { ( T , U ) | T , U ∈ P and ∀ V ∈ V h T , V i and h U , V i satisfy the same HML check + set formulae } is a stateless bisimulation relation. Assume that T R sl U and h T , V i λ −→ h T ′ , V ′ i for some valuation V .We shall now argue that there is a process U ′ such that h U , V i λ −→ h U ′ , V ′ i and T ′ R sl U ′ . Since R sl issymmetric, this suffices to establish that R sl is a stateless bisimulation relation.Now assume, towards a contradiction, that there is no h U ′ , V ′ i such that h U , V i λ −→ h U ′ , V ′ i and forall valuations V ∈ V , h U ′ , V i satisfies the same HML check + set formulas as h T ′ , V i . Since h U , V i is imagefinite, the set of processes that h U , V i can reach by performing a λ -labelled transition is finite, say {h U , V i , . . . , h U n , V n i} with n ∈ N . For every i ∈ { . . . n } , there exist a formula φ i and valuation V ′ i suchthat h T ′ , V ′ i i ∈ J φ i K and h U i , V ′ i i / ∈ J φ i K or valuations V i and V ′ differ for variable v .We are now in a position to construct a formula that is satisfied by h T , V i but not by h U , V i , contra-dicting our assumption that h T , V i and h U , V i satisfy the same formulae.We define for each i ∈ { . . . n } : re f ute ( i ) = (cid:26) ↓ ( V ′ i ) φ i if h T ′ , V ′ i i ∈ J φ i K and h U i , V ′ i i / ∈ J φ i K ( v = V ′ ( v )) if the valuations of V ′ and V ′ i differ for v The formula h λ i ( re f ute ( ) ∧ re f ute ( ) ∧ · · · ∧ re f ute ( n )) is satisfied by h T , V i but not by h U , V i . Theorem 12.
Let h P , V i and h Q , V i be states in some LTS ( S , T L , −→ , s ) and let all states reachable from h P , V i and h Q , V i be image-finite. Then h P , V i ↔ sb h Q , V i if and only if for all HML check formulas φ wehave that h P , V i ∈ J φ K ⇔ h Q , V i ∈ J φ K . Proof.
The proof is very similar to the one given for Theorem 11. We will only provide the distinguishingformula.Let h T , V i λ −→ h T ′ , V ′ i and let {h U , V i , . . . , h U n , V n i} be the set of states h U , V i can reach with a λ -labelled transition. For every i ∈ { . . . n } , there exists a formula φ i such that h T ′ , V ′ i ∈ J φ i K and h U i , V i i / ∈ J φ i K or valuations V i and V ′ differ for variable v .We define for each i ∈ { . . . n } : re f ute ( i ) = (cid:26) φ i if h T ′ , V ′ i ∈ J φ i K and h U i , V i i / ∈ J φ i K ( v = V ′ ( v )) if the valuations of V ′ and V i differ for v The formula h λ i ( re f ute ( ) ∧ re f ute ( ) ∧ · · · ∧ re f ute ( n )) is satisfied by h T , V i but not by h U , V i .Note that for process expressions we need the set operator in the logic, whereas for states we canonly have the check operator on top of regular HML. Intuitively, we need the set operator on the level ofprocess expressions to say something about the behaviour of the process for any valuation. For process algebras without global variables it might be the case that global variables can be modelledusing different language constructs. Modelling global variables then often requires a protocol to regu-late the access to global variables. In this section we explore how a process expression in our process2 Aprocess algebra withglobal variablesalgebra with global variables can be translated to mCRL2 without introducing extra internal activity.The resulting mCRL2 specification induces an LTS that is isomorphic to the LTS of the original processexpression, save some selfloops signalling information on the valuation of that state. We also give atranslation from HML check to the modal µ -calculus, which is the logic that is used in mCRL2 to expressproperties. We show that a HML check formula holds for the original process expression if and only if thetranslated formula holds for the translated process expression. We will introduce the syntax and semantics of the fragment of mCRL2 that is needed to encode globalvariables. In particular, we will introduce actions parametrised with data and multi-actions. We will notgo into the details of the data language itself. It suffices that there exists a semantic interpretation function J . K that maps data expressions to elements of the data domain. We declare a set of data expressions D and a set of Boolean expressions B of which the interpretation is an element of D or { true , f alse } ,respectively. We also presuppose an equality relation ≈ on data expressions. For more information onthe syntax and semantics of mCRL2 we refer the reader to [6]. Multi-actions in combination with theallow operator were first proposed in [13].We presuppose a set of action names Λ , each with an associated arity. An action label a ( d , . . . , d n ) consists of an action name a ∈ Λ of arity n and a list of data parameters d , . . . , d n . We denote by Λ theset of action labels. If α ∈ Λ , then we denote by α its name (e.g., a ( , , true ) = a ).The set of multi-actions M is generated by the following grammar: α : = α | α | τ | a ( d , . . . , d n ) , where a ( d , . . . , d n ) ∈ Λ and d to d n are data expressions or Boolean expressions. Also for each multi-action α we define α : τ = τ a ( d , ..., d n ) = a α | β = α | β . The set of multi-actions where each action label in the multi-action is in Λ is M .We define a multi-set over A , ( A , m ) , where m : A → N is a function assigning a multiplicity to eachelement of A . We define a ∈ ( A , m ) to be true if and only if m ( a ) >
0. As notation we use HI wherethe elements are listed together with their multiplicity, e.g. H a : 2 , b : 3 I . Over multi-sets ( A , m ) and ( A , m ′ ) we define a binary operator addition , denoted by + , that results in a multi-set ( A , m ′′ ) , where forall a in A it is the case that m ′′ ( a ) = m ( a ) + m ′ ( a ) . Similarly, we define a binary operator subtraction ,denoted by − , such that it results in a multi-set ( A , m ′′ ) , where for all a ∈ A we have that m ′′ ( a ) = max ( m ( a ) − m ′ ( a ) , ) . Furthermore, we define inclusion, denoted by ⊆ , to hold if and only if for all a ∈ A we have that m ( a ) ≤ m ′ ( a ) . For multi-sets over labels we define ( Λ , m ) = ( Λ , m ′ ) , where for all a ∈ Λ it holds that m ( a ) = m ′ ( a ) .Given a multi-action α we inductively associate a semantic multi-action J α K with it: J τ K = HIJ a ( d , ..., d n ) K = H a ( J d K , ..., J d n K ) : 1 IJ α | β K = J α K + J β K .S.Bouwman,etal. 43The set of all semantic multi-actions is M . The set P mCRL of process expressions of the fragmentof mCRL2 that we need in the translation is generated by the following grammar: P : = λ . P | δ | P + P | P k P | ∇ M ( P ) | X ( d , ..., d n ) | ∑ d : D P | τ I ( P ) | Γ C ( P ) , where λ ∈ M , M a set of multi-action names, M ⊆ M , X is a process name, I is a set of action names, I ⊆ Λ , and C is set of renamings from a set of multi-action names to an action name, notation a | ... | b → c .We introduce a function γ C ( α ) , where α is a semantic multi-action that applies communications in C to α , e.g. Γ { a | b → c } H a : 2 , b : 3 I = H b : 1 , c : 2 I . A communication can only be performed when theparameters of action labels match. For the exact semantics of γ C ( α ) we refer the reader to [6].We define a function θ I (( Λ , m )) , such that it results in a multi-set ( Λ , m ′ ) such that ∀ a ∈ Λ m ′ ( a ) = (cid:26) a ∈ Im ( a ) if a / ∈ I The sum operator facilitates a non-deterministic choice over a data domain. For example, in the casethe data domain D is the natural numbers, ∑ n : D a ( n ) . P can make an a ( ) step to process P [ n : = ] , an a ( ) step to process P [ n : = ] , etcetera. (P REF ) α . P J α K −→ P (P AR ) P α −→ P ′ Q β −→ Q ′ P k Q α + β −→ P ′ k Q ′ (R EC ) P [ d : = t , ..., d n : = t n ] α −→ P ′ X ( d : D , ..., d n : D n ) def = PX ( t , ..., t n ) α −→ P ′ (S UM - L ) P α −→ P ′ P + Q α −→ P ′ (S UM - R ) Q α −→ Q ′ P + Q α −→ Q ′ (S UM ) P [ d : = t e ] α −→ P ′ t e ∈ D ∑ d : D P α −→ P ′ (H IDE ) P α −→ P ′ τ I ( P ) θ I ( α ) −→ τ I ( P ′ ) (P AR - L ) P α −→ P ′ P k Q α −→ P ′ k Q (P AR - R ) Q α −→ Q ′ P k Q α −→ P k Q ′ (C OMM ) P α −→ P ′ Γ C ( P ) γ C ( α ) −→ Γ C ( P ′ ) (A LLOW ) P α −→ P ′ ∇ M ( P ) α −→ ∇ M ( P ′ ) J α K ∈ M Table 2: Structural operational semantics of our fragment of mCRL2.An LTS ( S , M , −→ , P ) can be associated to a process expression P . The set of states is the set ofprocess expressions, S = P mCRL . The set of transitions is generated by the proof system based on thestructural operation semantics (see Table 2).4 Aprocess algebra withglobal variables Recall that a specification in the process algebra with global variables consists of the following: a datadomain D , a set of variable names Var , a set of action labels
Act , a set of process names PN and theirdefining equations, a communication function γ , and an initial state consisting of a process expressionand an initial valuation V . We consider a restricted grammar for the translation. Sequential components
The set of sequential process expressions P Seq is generated by the followinggrammar (with v ranging over Var , d ranging over D , X ranging over PN and λ ranging over T L ): Seq : = Seq + Seq | ( v = d ) −→ Seq | λ . Seq | δ | λ . X . By a sequential recursive specification E we mean a set of defining equations X def = t , with t a sequen-tial process expression, including precisely one such equation for every X ∈ PN . Parallel-sequential processes
Presupposing a sequential recursive specification E , the set of parallel-sequential process expressions P Par over E is generated by the following grammar (with X ranging over PN and Seq ranging over sequential process expressions):
Par : = Par k Par | X | Seq . We assume that the recursive specification E is sequential and that the process expression underconsideration for translation is of the shape ∂ B ( P ) , where P is parallel-sequential process expression and B ⊆ Act . For the sake of readability, in our explanations below we restrict our attention to the case thatthere is one global variable g . In Section 7 we explain how to generalise the translation to any number ofvariables. Now that the input for the translation is clear, we show how it is translated to mCRL2.The value of global variables is tracked by a dedicated process Globs , defined below.
Globs ( d : D ) = checkG ( d , true ) . Globs ( d )+ checkG ( d , true ) | checkG ( d , true ) . Globs ( d )+ Σ new : D . checkG ( d , true ) | assignG ( g , new ) . Globs ( new )+ value ( g , d ) . Globs ( d ) ;The process can communicate the current value of the global variable with a checkG action, of which thefirst parameter is of type D and the second a constant of type Bool . It can perform a checkG action twicein a multi-action to facilitate informing two parallel processes in one step. Since our process algebrawith global variables only allows handshaking communication there can never be more than two parallelprocesses that participate in a transition. It facilitates changing the value of the global variable with an assignG action, with one parameter of type D carrying the new value. It can emit the current value of aglobal variable with a value action, with a single parameter of type D .We translate the recursive specification E to a recursive mCRL2 specification E ′ , which includesdefining equations for all the process names in PN and additionally a defining equation for Globs . Let ℘ ( A ) denote the powerset of A . We introduce a function χ : P Seq × ℘ ( D ) → P mCRL , which we willdefine shortly. For every defining equation X def = t in E there is a defining equation X def = χ ( t , /0 ) in E ′ . Thefunction χ is defined below, where ε ⊆ D is a set of constraints on the global variable that is eventuallytransformed into an appropriate checkP action..S.Bouwman,etal. 45 χ ( P + P , ε ) = χ ( P , ε ) + χ ( P , ε ) χ (( g = d ) −→ P , ε ) = χ ( P , ε ∪ { d } ) χ ( a . P , ε ) = ( ∑ d : D a | checkP ( d , V d ∈ ε d ≈ d )) . χ ( P , /0 ) χ ( assign ( g , d ′ ) . P , ε ) = ( ∑ d : D assignP ( g , d ′ ) | checkP ( d , V d ∈ ε d ≈ d )) . χ ( P , /0 ) χ ( X , ε ) = X χ ( δ , ε ) = δ We define a set of communications C γ , such that a | b → c ∈ C γ or b | a → c ∈ C γ if and only if γ ( a , b ) = c (we should include only one of a | b → c and b | a → c in C γ to satisfy the requirement that the left-handsides of communications in C γ are disjoint). We define an extended set of communications that includescommunications with Globs : C G γ = C γ ∪ { assignP | assignG → assign , checkP | checkG → check } . Givena set of encapsulated actions B we define a set of allowed actions A B = ( Act \ B ) ∪ { value , assign } . Weextend χ to parallel-sequential process expressions in the following way. χ ( P || P , /0 ) = χ ( P , /0 ) || χ ( P , /0 ) We translate the process expression ∂ B ( P ) , with an initial valuation V , V ( g ) = d , to the mCRL2process expression ∇ A B ( τ { check } ( Γ C G γ ( χ ( P , /0 ) || Globs ( d )))) , which we abbreviate to Ψ ( P , V ) . The selfloops labelled with value provide information on the values of global variables in every state,which we will exploit in the translation of HML check formulas. Given a HML check formula we eliminateeach occurrence of the check operator of the shape ( v = e ) by substituting it with h value ( v , e ) i true . Wedenote this substitution function with θ , which we define inductively: θ ( true ) = true , θ ( f alse ) = f alse , θ ( v = e ) = h value ( v , e ) i true , θ ( ¬ φ ) = ¬ θ ( φ ) , θ ( φ ∧ φ ) = θ ( φ ) ∧ θ ( φ ) , θ ( φ ∨ φ ) = θ ( φ ) ∨ θ ( φ ) , θ ( h T i φ ) = h T i θ ( φ ) , θ ([ T ] φ ) = [ T ] θ ( φ ) . From here on, when we consider the translation of some state h P , V i to Ψ ( P , V ) we assume that the contextof the process expression, such as the data domain D , the set of actions and a recursive specification havebeen encoded in mCRL2 as described in the previous section.We will prove that a HML check formula φ holds in a state h P , V i if and only if θ ( φ ) holds for Ψ ( P , V ) .To achieve this we use a stepping stone. In Definition 13 we define a relation between LTSs with andwithout a valuation function in the state, called variable consistency . We prove that the LTSs inducedby h P , V i and Ψ ( P , V ) are variable consistent, which we use in Theorem 23 to prove that any HML check formula φ holds for h P , V i if and only if θ ( φ ) holds for Ψ ( P , V ) Definition 13.
Let L = ( S , T L , → , s ) be an LTS such that S = P × V , and let L = ( S , T L , → , s ) be an LTS such that S = P mCRL . We say that L is variable-consistent with L if there exists amapping ℓ : S → S such that whenever some state s ′ is reachable from s in L , then ℓ ( s ′ ) is reachablefrom ℓ ( s ) in L and6 Aprocess algebra withglobal variables1. for all states s ′ , s ′ ∈ S reachable from s and such that s ′ λ −→ s ′ we have that λ ∈ T L ∪ { value ( v , d ) | v ∈ Var ∧ d ∈ D } ,2. for all h P , V i ∈ S , s ′ ∈ S , v ∈ Var , d ∈ D we have that ℓ ( h P , V i ) value ( v , d ) −−−−−→ s ′ if and only if V ( v ) = d and ℓ ( h P , V i ) = s ′ ,3. for all λ ∈ T L and reachable states s ′ , s ′ ∈ S we have that s ′ λ −→ s ′ if and only if ℓ ( s ′ ) λ −→ ℓ ( s ′ ) .For the first property of variable consistency we prove the following lemma. Lemma 14.
For all parallel-sequential process expressions P , process expression P ′ ∈ P mCRL , valua-tions V , α ∈ M and B ⊆ Act we have that Ψ ( P , V ) α −→ P ′ implies α ∈ T L ∪ { value ( g , d ) | d ∈ D } . Proof.
This follows immediately from the allow operator in Ψ ( P , V ) , which does not allow multi-actionsthat are not in T L ∪ { value ( g , d ) | d ∈ D } .Towards proving the second property of variable consistency we prove the following lemma. Lemma 15.
For all parallel sequential process expressions P , process expression P ′ ∈ P mCRL , valuation V , d ∈ D , B ⊆ Act we have that Ψ ( P , V ) value ( g , d ) −−−−−→ P ′ if and only if V ( g ) = d and Ψ ( P , V ) = P ′ . Proof.
The process expression Ψ ( P , V ) contains a parallel component Globs ( d ) . The Globs process canmake a value ( g , d ) transition where V ( g ) = d . Moreover, all such value ( g , d ) transitions are self-loops.Finally, the Globs process is the only sub process in Ψ ( P , V ) that is able to produce a value transition.Towards proving the third property of variable consistency we first provide a number of auxiliary lemmas. Lemma 16.
For all sequential process expressions P , process expression P ′ ∈ P mCRL , λ ∈ Act ∪{ assignP ( g , d ) | d ∈ D } , d ∈ D we have that χ ( P , /0 ) λ | checkP ( d , true ) −−−−−−−−−−→ P ′ implies that there exists P ′′ suchthat χ ( P ′′ , /0 ) = P ′ . Proof.
From the definition of χ it follows that if χ ( P , /0 ) can make a λ | checkP ( d , true ) labelled transitionthen there exists some Q and P such that χ ( P , /0 ) = Q + ( ∑ d : D λ | checkP ( d , V d ∈ ε d ≈ d )) . χ ( P , /0 ) .Hence after making the λ | checkP ( d , true ) labelled transition we end up in χ ( P , /0 ) . Lemma 17.
For all parallel-sequential process expressions P , α ∈ M we have that Ψ ( P , V ) α −→ P ′ impliesthat there exists P ′′ and V ′ such that Ψ ( P ′′ , V ′ ) = P ′ . Proof.
By Lemma 14 we conclude that α ∈ T L ∪ { value ( g , d ) | d ∈ D } . In the case that α is a value transition it is a selfloop and ends in Ψ ( P , V ) . In any other case Ψ ( P , V ) makes a step that includesa contribution from one or more of the parallel components of P . From the definition of χ it followsthat any contribution of a parallel component is of the shape λ | checkP ( d , b ) , where d ∈ D and b ∈{ true , f alse } . The checkP must communicate with a checkG , otherwise the action will be blocked bythe allow operator. Hence b = true , enabling us to use Lemma 16 to conclude that for every parallelcomponent contributing to α there exists some process expression P seq such that the parallel componentends in χ ( P seq , /0 ) . The parallel components of Ψ ( P , V ) that do not contribute to α remain in a shape suchthat there exists some process expression P seq such that the parallel component is χ ( P seq , /0 ) . The Globs process remains unchanged or its valuation is updated, in which case there exists some valuation V ′ thatreflects the updated value. The allow, hide and communication operators remain unchanged. Hence,after any α step Ψ ( P , V ) ends in a state Ψ ( P ′′ , V ′ ) ..S.Bouwman,etal. 47 Lemma 18.
For all sequential process expressions P , P ′ , DD ⊆ D , a ∈ Act and assign ( g , d ′ ) ∈ T L wehave that ∀ V ∈ V ( V d ∈ DD V ( g ) = J d K ) = ⇒ h P , V i a −→ h P ′ , V i if and only if ∃ d ∈ D χ ( P , /0 ) a | checkP ( d , true ) −−−−−−−−−→ χ ( P ′ , /0 ) ∧ V d ∈ DD d = J d K and we have that ∀ V ∈ V ( V d ∈ DD V ( g ) = J d K ) = ⇒ h P , V i assign ( g , d ′ ) −−−−−−→ h P ′ , V [ g d ′ ] i if and only if ∃ d ∈ D χ ( P , /0 ) assignP ( g , d ′ ) | checkP ( d , true ) −−−−−−−−−−−−−−−−→ χ ( P ′ , /0 ) ∧ V d ∈ DD d = J d K . Proof.
This can be proven by induction on the structure of P , the induction hypothesis is that the bi-implication holds for every direct subprocess of P and for every defining equation of process names. Thekey insight is the second field of the checkP action is only true when the condition for the data value inthe first field of checkP , constructed by χ , is true. Lemma 19.
For any parallel-sequential process expression P , process expression P ′ , λ ∈ T L and val-uations V , V ′ we have that h ∂ B ( P ) , V i λ −→ h ∂ B ( P ′ ) , V ′ i implies P ′ is again a parallel-sequential processexpression. Proof.
Any step made from ∂ B ( P ) leaves the ∂ B operator and the parallel composition intact. One ormore of the parallel components make a step. By the structure of parallel-sequential process expressionsthese parallel components are either a process name or a sequential process. Since we also assumethat the defining equations of every process name is a sequential process expression the process namewill make a step as such. By the structure of sequential process expressions they can make a step to asequential process expression or a process name. Hence, after any step P is again a parallel compositionwith process names and sequential process expressions. Lemma 20.
For all valuations V and V ′ , λ ∈ T L , parallel-sequential process expressions P , B ⊆ Act wehave that h ∂ B ( P ) , V i λ −→ h ∂ B ( P ′ ) , V ′ i if and only if Ψ ( P , V ) λ −→ Ψ ( P ′ , V ′ ) . Proof.
Both directions of the bi-implication can be proven with a case distinction on the type of transitionusing three cases: an action from
Act stemming from one of the parallel components, a handshakestemming from two parallel components and an assignment. To prove the implication from left to rightLemma 18 can be used to prove that for each contribution by a parallel component of h ∂ B ( P ) , V i the stepcan be matched with an appropriate step from a parallel component of Ψ ( P , V ) . Lemma 19 ensures thatafter taking a transition we end in the translation of a parallel-sequential process again. To prove theimplication from right to left Lemma 16 and Lemma 18 can be used to prove that for each contributionby a parallel component of Ψ ( P , V ) the step can be matched with an appropriate step from a parallelcomponent of h ∂ B ( P ) , V i . Theorem 21.
For all parallel-sequential process expressions P , valuations V , we have that the LTSsinduced by h P , V i and Ψ ( P , V ) are variable consistent. Proof.
For every state h P ′ , V ′ i reachable from h P , V i we define ℓ ( h P ′ , V ′ i ) = Ψ ( P ′ , V ′ ) . Lemma 14 provescondition 1, Lemma 15 proves condition 2 and Lemma 20 together with Lemma 17 proves condition3. Corollary 22.
For all parallel-sequential process expressions P , Q and valuations V , V we have that h P , V i ↔ sb h Q , V i if and only if Ψ ( P , V ) ↔ Ψ ( Q , V ) .8 Aprocess algebra withglobal variables Proof.
This follows immediately from the definition of variable consistency. The difference betweenstate-based bisimilarity and strong bisimilarity is only that state-based bisimilarity requires that the val-uation in states is equal. By condition 2 of variable consistency the valuations V and V are equal if andonly if Ψ ( P , V ) and Ψ ( Q , V ) have the same value labelled self-loops on states. Theorem 23.
Let ( S , T L , −→ , s ) be an LTS where S = P × V , let ( S ′ , T L ′ , −→ ′ , s ′ ) be an LTS where S ′ = P mCRL and let these two LTSs be variable consistent. A HML check formula φ holds in some state h P , V i ∈ S if and only if θ ( φ ) holds in ℓ ( h P , V i ) ∈ S ′ . Proof.
The proof is by induction on the structure of φ with the induction hypothesis that any subformula φ ′ of φ holds for h P , V i ∈ S if and only if θ ( φ ′ ) holds for ℓ ( h P , V i ) . In the case φ = ( v = e ) condition 2 ofvariable consistency is necessary to relate the valuation in a state and the value labelled selfloops. Con-dition 3 of variable consistency is needed for the case φ = h T i φ ′ and φ = [ T ] φ ′ to show that transitionscan be mimicked. Furthermore, in the case φ = [ T ] φ ′ we also need condition 1 of variable consistencyto show that ℓ ( h P , V i ) does not have more λ labelled transitions. For the encoding in mCRL2 and subsequent correctness proofs we have made the assumption that thereis only one global variable, which is rather restrictive. To generalize the translation to handle any numberof global variables we would need to adjust the following. The
Globs process should be adjusted to trackmore global variables by making the parameter of the process a mapping from variable names to values.Upon performing an assignG ( v , d ) action Globs should update the mapping such that v maps to d . Tocommunicate the values of global variables in a check ( d , . . . , d n , true ) action we need an ordering onthe global variables: d is given the value of variable one, d is given the value of variable two, etcetera.The condition determining the last parameter of the checkP action should also be adjusted to use thisordering, e.g. when χ gathers a requirement ( v , d ) and variable v is the i th variable then the condition in checkP should include a conjunct d i ≈ d .We intend to continue researching process algebras with global variables. One research directionis to extend mCRL2 with global variables. The simple process algebra presented in this paper onlyallows for very simple conditions on global variables: checking whether a variable has a specific value.If global variables could be integrated into mCRL2 we could use its powerful data language to specifycomplex conditions. We would also like to research scoped shared variables, including creation andscope extrusion. In this paper we have presented a simple process calculus with global variables and studied various as-pects of it. To start we examined appropriate notions of equivalence: stateless bisimulation for processexpressions and state-based bisimulation for states. Then, for our first contribution we presented a logicextending HML with a check and a set operator and proved that HML check is strong enough to differen-tiate states that are not state-based bisimilar and HML check + set is strong enough to differentiate processexpressions that are not stateless bisimilar. Finally, for our second contribution we give a translation tomCRL2, using the multi-action concept, preserving HML check formulas. Translating to mCRL2 allowsus to reuse the already existing tools. The translation mostly preserves the syntactic structure and, inparticular, the parallel composition (adding one extra parallel process)..S.Bouwman,etal. 49When analysing whether a distributed system satisfies a liveness property, it is necessary to definethrough a completeness criterion which runs of the system should be considered in the analysis. Recently, justness was proposed as a suitable completeness criterion that takes into account the component struc-ture of the system [5] and excludes unrealistic runs. Modelling shared variables as separate componentshampers a straightforward definition of justness [4, 3]. Since global variables need not be modelled asseparate components in the process algebra proposed in Section 2, it may facilitate a more elegant analy-sis of liveness properties under justness assumptions for distributed systems that rely on shared variablesfor the communication between components. Acknowledgements
For the presentation of the semantics of mCRL2, and in particular for the semantics of multi-actions,we have benefited from work by Maurice Laveaux. We would also like to extend our gratitude to theanonymous reviewers. Their comments led to Corollary 22.
References [1] J. C. M. Baeten, T. Basten & M. A. Reniers (2009):
Process Algebra: Equational Theories of Com-municating Processes . Cambridge Tracts in Theoretical Computer Science, Cambridge University Press,doi:10.1017/CBO9781139195003.[2] J.C.M. Baeten (2005):
A brief history of process algebra . TheoreticalComputerScience 335(2-3), pp. 131–146, doi:10.1016/j.tcs.2004.07.036.[3] Mark Bouwman, Bas Luttik & Tim A. C. Willemse (2020):
Off-the-shelf automated analysis of livenessproperties for just paths . ActaInformatica57(3-5), pp. 551–590, doi:10.1007/s00236-020-00371-w.[4] Victor Dyseryn, Rob J. van Glabbeek & Peter H¨ofner (2017):
Analysing Mutual Exclusion using ProcessAlgebra with Signals . In Kirstin Peters & Simone Tini, editors: Proceedings Combined 24th InternationalWorkshop on Expressiveness in Concurrency and 14th Workshop on Structural Operational Semantics and14thWorkshoponStructuralOperationalSemantics,EXPRESS/SOS2017,Berlin,Germany,4thSeptember2017., EPTCS 255, pp. 18–34, doi:10.4204/EPTCS.255.2.[5] Rob J. van Glabbeek & Peter H¨ofner (2015):
CCS: It’s not fair! - Fair schedulers cannot be implemented inCCS-like languages even under progress and certain fairness assumptions . Acta Inf. 52(2-3), pp. 175–205,doi:10.1007/s00236-015-0221-6.[6] Jan Friso Groote & Mohammad Reza Mousavi (2014):
Modeling and analysis of communicating systems .MIT press, doi:10.7551/mitpress/9946.001.0001.[7] Matthew Hennessy & Robin Milner (1985):
Algebraic Laws for Nondeterminism and Concurrency . J.ACM32(1), pp. 137–161, doi:10.1145/2455.2460.[8] Robin Milner (1989):
Communication and concurrency . PHI Series in computer science, Prentice Hall.[9] Mohammad Reza Mousavi, Michel A. Reniers & Jan Friso Groote (2005):
Notions of bisimulation andcongruence formats for SOS with data . Inf.Comput. 200(1), pp. 107–147, doi:10.1016/j.ic.2005.03.002.[10] Rocco De Nicola & Rosario Pugliese (1996):
A Process Algebra Based on LINDA . In: COORDINATION,LectureNotesinComputerScience 1061, Springer, pp. 160–178, doi:10.1007/3-540-61052-9 45.[11] A. W. Roscoe (2010):
Understanding Concurrent Systems . Texts in Computer Science, Springer,doi:10.1007/978-1-84882-258-0.[12] Vijay A. Saraswat, Martin C. Rinard & Prakash Panangaden (1991):
Semantic Foundations of ConcurrentConstraint Programming . In: POPL, ACM Press, pp. 333–352, doi:10.1145/99583.99627. [13] Muck van Weerdenburg (2008):