November 1990 Report No. STAN-CS-90- 1342

Modeling Concurrency with Geometry

bY

Vaughan Pratt

Department of Computer Science

Stanford University Stanford, California 94305 To appear in POPL-91

Modeling Concurrency with Geometry

Vaughan Pratt t Computer Science Department St anford University Stanford, CA 94305 [email protected]

Abstract concurrency. Milner [Mi180] has made a convincing case for includ- The phenomena of branching time and true or noninter- ing the timing of nondeterministic choices in any com- leaving concurrency find their respective homes in au- prehensive model of computation, distinguishing linear tomata and schedules. But these two models of compu- time (all choices made at the outset) from branching tation are formally equivalent via Birkhoff duality, an time (choices made on-the-fly to take into account the equivalence we expound on here in tutorial detail. So latest information). Park’s not ion of bisimulat ion equiv- why should these phenomena prefer one over the other? alence [Par811 has emerged as a particularly fine equiv- We identify dimension as the culprit: l-dimensional au- alence of labeled transition systems, though not so fine tomata are skeletons permitting only interleaving con- as to abandon the idempotence of choice. Two recent currency, whereas true n-fold concurrency resides in comprehensive yet complementary accounts are given transitions of dimension n. The truly concurrent au- by Bergstra and Klop [BK89] and their student van tomaton dual to a schedule is not a skeletal distributive Glabbeek [Gla90], with the latter also addressing true one We introduce true nondeter- lattice but a solid ! concurrency in more detail. minism and define it as monoidal homotopy; from this The most natural computational setting for branch- perspective nondeterminism in ordinary automata arises ing time would appear to be transition systems or state from forking and joining creating nontrivial homotopy. The automaton dual to a poset schedule is simply con- automata, where the branching is naturally represented nected whereas that dual to an event structure schedule by that of the automaton. These may be “unrolled” to need not be, according to monoidal homotopy though yield synchronization trees so as not to represent other not to group homotopy. We conclude with a formal defi- information. However Nielsen, Plotkin, and Winskel nition of higher dimensional automaton as an n-complex have defined event structures as an extension of sched- or n-category, whose two essential axioms are associa- ules with a conflict relation to represent branching time, tivity of concatenation within dimension aud an inter- about which we will have more to say later. change principle between dimensions. Lamport [Lam861 and independently the present au- thor argue against the interleaving model of concurrency on the ground that “exactly what is interleaved depends 1 Background on which events of a process one takes to be atomic” [Pra86, p.371. When a supposedly atomic action is “re- A central problem in the semantics of imperative com- fined,” which from a pragmatic viewpoint can be taken putation is the construction of convenient models of to mean “looked at more closely to reveal its substruc- computation embodying the apparent aspects of both ture,” the interleaving model can be seen not to have in- branching time and true or noninterleaving or causal terleaved the subactions, having been forced to commit itself in advance to a particular level of granularity. This t This work was supported by the National Science failure to interleave subactions is characteristic not of E’oundation under grant number CCR-88 1492 1. true concurrency but rather of mutual exclusion. Thus in an interleaving model the truly concurrent execution of two atomic events cannot be distinguished from the mutually exclusive execution of those events. Castellano et al [CDP87] formalize this intuition with a simple example showing that interleaving semantics is not preserved under refinement (where refinement is de- fined as substitution of a complex behavior for an atomic behavior), but that partial order semantics is so pre- 2 A Geometric Model of Com- served. putation The natural computational setting for true concur- rency is that of schedules or partially ordered sets of Our thesis is that both branching time and true con- events. If branching time can be moved from automata currency can be described together in a single geomet- to schedules [NPW81], can true concurrency go the ric model. Branching time is represented literally by other way? branchings of geometric objects, exactly as one would picture it. In particular we treat a transition system Van Glabbeek and Goltz [vGG89] strengthen the re- as a one-dimensional space consisting of edges (its tran- sult of Castellano et al in several ways. First they give sitions) meeting and branching at vertices (its states). a stronger example to show that step semantics (a form True concurrency is represented by dimension: an n- of concurrency intermediate between interleaving and dimensional cell (element of space) is used to represent partial orders, permitting multiple but synchronized ac- the concurrent execution of n sequential processes, and tions at each clock tick) is, like interleaving semantics, its boundaries represent the starting or halting of some not preserved under refinement. Then they extend the of those processes. linear time result of [CDP87] to encompass branching Our geometric view is closely related on the one hand time. Finally they point to ST-bisimulation, a delight- to ST-bisimulation [vGG89], and on the other to Pa- fully simple extension of the notion of Petri net mark- padimitriou’s geometrical model for database concur- ing due to van Glabbeek and Vaandrager [GV87] that is rency control [Pap86, chap.61. preserved by refinement yet supports branching time, as To be cryptically succinct, we propose to extend inter- an example of a semantics that models true concurrency leaving concurrency to true concurrency by filling holes, and furthermore treats branching time, all without re- and then to extend true concurrency to branching time quiring partial orders. by putting some of those holes back. Now ST-bisimulation comes within striking distance So what is a hole? Consider two automata, each hav- of the problem we just posed of moving true concur- ing two states and one transition and accepting the re- rency to the automaton model. However Petri nets are spective regular sets CA and b, each consisting of one unit- neither schedules nor automata, but a symmetric combi- length string. With interleaving concurrency the con- nation of both, in that Petri nets alternate the vertices of current execution of these two automata is their prod- schedules, as transitions, with the vertices of automata, uct, a square whose four sides represent four transitions, as places. accepting the regular ab + ba as in Figure B’ four pages hence. The main contribution of this paper is a geometric This automaton contains a hole, namely the interior model of concurrency. This model completes the pas- of the square. To formalize this, embed the automaton, sage of true concurrency to automata by redefining the treated as a graph, in the Euclidean (real) plane. For schedule aspects of a Petri net, namely its transitions definiteness locate its states at the lattice points (O,O), represented in Petri nets as vertices, as higher dimen- (l,O), (0, l), and (1,l) (the corners of the unit square sional transitions of an automaton! This also yields a [0, 112; y is oriented negatively in 8’). Take the initial model that is in our opinion mathematically more at- state to be the origin, and take the four transitions to tractive than Petri nets, certainly those with unbounded be the four sides of this square. The hole is then the place capacities. interior of the square. There are two side contributions. One is a much To “fill the hole,” take the interior of the square, a needed tutorial on the duality of schedules and au- surface, as the ninth component of this product automa- tomata around which our introduction has revolved and ton. The four vertices, qua states, and the four edges, which continues to play a role in the sequel. The other qua transitions, comprise the other eight cells of what is the application of n-categories or n-complexes to con- we shall refer to as a cell complex. currency theory, as a formal model of higher dimensional These nine cells represent the nine possible “states” of automaton, for which we contend they are more natu- the concurrent automaton. Four states are completely rally adapted than other extant algebraic structures.’ idle (states in the usual sense), four have one constituent automaton active, and one has both constituents active. This last may be described as a two-dimensional or “su- perficial” transition. It provides a notion of “joint tran- 1 Among other recent applications of so-called Australian cate- si tion” of two processes. gory theory to concurrency is an application of enriched categories Van Glabbeek and Vaandrager [GV87] have in- to the abstract modeling of time a la Floyd-Warshall, presented to a category audience [CCMPSS]. We regret not having had the troduced ST-bisimulation, in which not only places opportunity to present this at POPL-88 or POPG89. (Stellen) of Petri nets but transitions ( 7hnsitionen,

2 whence ST) are marked in a state (an assignment of order constraints. For any two transitions of different tokens to vertices). (It is extraordinary that this simple automata we may require that one not start until t’he and intuitively clear extension of the notion of Petri net other has finished, a precedence constraint. We shall state has not been proposed before!) The relationship call such a collection of constraints a schedule, the term with ST-bisimulation may be easily seen by consider- used in (inter alia) the Macintosh world for PERT charts ing the corresponding example for Petri nets. As usual or pomsets. a one-transition automaton becomes a Petri net simply With this generalization the second trivial generaliza- by converting its transition from an edge to a vertex and tion now becomes redundant, since we can achieve the adding two edges to represent respectively the pre-event effect of a sequential automaton having m transitions by or input arc and postevent or output arc, each incident using m concurrent one-transition automataconstrained on the one transition. The concurrence of two such nets to execute in a specified sequential order. To simplify is “smaller” than that of the corresponding automata, the model we therefore withdraw generalization two. being just their juxtaposition, having for its vertices not This restricts our basic automata to single-transition the Cartesian product of the vertices of the underlying automata, more conventionally called events. We may nets as was the case for the automata but rather their now describe each precedence constraint as holding be- . tween such events i and j, without having to further If we mark the initial place of each of the two compo- specify a particular transition within each event. These nents of this juxtaposition and then play the usual “to- constraints, which we write as i < j, then amount to ken game ,” we obtain four possible markings of places, a partial ordering of the set (or multiset in the labeled corresponding to the four vertices of the square au- case) of d events. tomaton. If however we extend the token game as in We saw already that the square (2-cube) had nine ST-bisimulation to permit transitions to be marked, cells. More generally the d-cube has 3d cells. The num- we obtain an additional four markings each involving ber three arises as the possible states of an event: initial, one transition (the four edges of the square), together transition, final, or 0, T, 1 for short. Each cell can then with a single marking involving both (the interior of the be identified as a d-tuple over (0, T, 1) = 3. The stan- square), completing the promised correspondence. dard interpretaiion of i < j is to exclude ~11 cells save There are three trivial generalizations we can make those whose j-th event is 0 or whose i-th event is 1. immediately. First we may increase the number of au- In place of { 0, T, 1) we may take the unit interval tomata executing concurrently. With three automata [0, l] on the real line, whose interior (0, 1) corresponds we obtain a cube in the obvious way, with four a 4- to T alone and whose endpoints are the correspondingly cube, etc. We refer to the d-dimensional elements of named elements of (0, T, 1). Then the d-cube becomes such a complex as d-cells, with O-cells or points corre- the unit cube [0, lid in d-dimensional Euclidean space sponding to the old notion of state, l-cells or edges the Rd, having a continuum of points rather than just 3d. old notion of transition, and the higher-dimensional cells Now one quite reasonable interpretation of i < j is to constituting a new notion of concurrent transition. restrict to the polyhedral subspace of the cube consisting Second, we may let the i-th automaton, for 0 5 i < d, of those points whose i-th coordinate is greater than run for rni transitions, provided its graph forms a chain their j-th coordinate. This corresponds to permitting so that it accepts just one string, of length rni. Our unit events i and j to run concurrently but without letting cube then expands to a larger complex of size ni mi. j get ahead of i. For any partial ordering of events Third, we may label transitions. If we associate alpha- this subspace is convex and can be easily shown to have bet X:i with the i-th sequential automaton for 0 5 i < d, volume k/d! where k is the number of linearizations of we may label its edges in the standard way for automata. the partial order, being the (essentially) disjoint union To extend this to higher dimensions we require for each of k tetrahedra one per linearization. subset of this set of d alphabets the alphabet formed as However this is not the proper analog in Rd of sub- the product of that subset, yielding 2d alphabets. Each spaces of 3d, since it cuts faces into tetrahedra. The n-cell is then labeled with an n-tuple of labels from the appropriate real-valued analog further restricts the sub- appropriate alphabet, namely that corresponding to the space to those points such that either the j-th coordinate subset of automata whose activity is represented by the is 0 or the i-th coordinate is 1. But this is exactly how cell. All completely quiescent states (O-cells) are labeled we expressed the condition for 3d. In fact i < j was in- with the unique 0-tuple, indicating the absence of activ- terpreted without mentioning T at all, being expressed ity. l-cells are labeled with 1-tuples, as in an ordinary solely in terms of the initial and final states of an event, automaton. 2-cells are labeled with pairs (a, b) indicat- regardless of what structure we impart to its interior. ing the joint execution of transitions a and b, and so on Unlike the interpretation of i < j in the previous para- for higher dimensions. graph, the subspace of Rd given by the standard inter- Less trivial is the next generalization, which imposes pretation is not convex. However, as will be seen to be

3 important shortly in our approach to nondeterminism, the automaton to be in state Y means that the set of it contains no holes. jobs done thus far is Y. This is the Hasse diagram of its lattice, i.e. the smallest DAG whose transitive closure is the inclusion order c between subsets. This lattice is of 3 Schedule-Automaton Duality course a Boolean algebra, meaning a distributive lattice with a complement operation. With this last generalization we have passed from un- It is helpful to regard the states of the automaton as scheduled to scheduled activity, the latter being the 2” bit vectors of length n, with bit x being 1 in state essence of the pomset model [Gra81, Pra82]. From a Y just when job x has run by the time that state is mathematical perspective we have passed (at least in reached. Then the set operations Y U Z and Y n Z are the finite case) from the Birkhoff-Stone duality between bit vector operations such that in each bit position they sets (of events, as points of a finite discrete topologi- are just V and A. cal space) and Boolean algebras (of states) to the much Decompilation is traditionally harder than compila- richer Birkhoff duality between posets (still of events) tion, but in this case decompilation is just as easy as and distributive lattices (still of states). compilation. Given such an automaton A, form its The Birkhoff duality is becoming better known in the power automaton 2A, consisting of certain sets of states CS community of late. However there remains consid- of erable confusion in both the mathematical and CS lit- A. erature over the difference between Birkhoff duality and Now if an automaton were simply a set of states, Stone duality, perpetrated in our opinion by an unwar- 2A would mean the power set of A. But that would ranted enthusiasm for topological methods to the ex- be huge-and fortunately wrong. The right way to clusion of combinatorial. It is very helpful to see these form the power widget 2 w of a widget W is to take distinctions clearly when working with our geometrical all widget maps from W to 2. This works provided model of concurrency. Hence we give here an overview there’s a sensible way to construe 2 as a widget. The of this duality and its application to concurrency. automaton A is a lattice, and luckily the poset 2 is Sequential computers alternately work during a tran- schizophrenic enough to be also the lattice 0 5 1 of truth sition and then rest up at a state. This scenario is con- values. Hence we take for 2A all lattice maps (homo- ventionally rendered as a graph whose vertices represent morphisms) from A = 2’ to 2, meaning functions that either transitions or states. If transitions then we have preserve the lattice structure, i.e. j(0) = 0, j(S) = 1, and f(Y n Z) = j(Y) A j(Z). a PERT chart or schedule, and the edges of the graph fwJZ)=f(Y)WZ), denote precedence relations, possibly labeled with dura- It can be easily seen that preserving this much implies tions indicating bounds on the time from one transition preserving complement as well, so these are also Boolean to the next. If states then we have a machine or uu- algebra maps. tom&on whose edges are transitions from state to state, So what maps does this give us? One that possibly labeled with attributes of the transition. But satisfies the desired conditions above is the predicate jz which picture is the right one? that tells of each state whether job x has run yet. But The Petri net answer is neither: transitions and states looking at A as 2” bit vectors, this is just the function should be granted equal rights by both being vertices. that watches bit x. As long as bit x works reliably, These then serve as respectively the conjunctive and dis- when Y U Z is formed bit x will appear to be computing junctive elements of an intriguing logic of concurrency. Y= V Z=, and dually for n. But this is what the above The duality theory answer is both: for at least a cer- conditions require. So these functions are lattice maps. tain class S of schedules and class A of automata they They are in fact the n projections of 2x onto 2, 2x being depict the same scene because S and A are equivalent. the product of n copies of 2. That they are different can Not isomorphic, which would imply a l-l correspon- be seen by their behavior on states. Hence dence between the elements of S and A, but equivalent these maps form a set isomorphic to X, that is, having in the sense of a l-l correspondence between the isomor- cardinality IX]. That it is only isomorphic and not equal phism classes of S and A. (This is exactly the category is why the duality is only an equivalence and not an theoretic notion of equivalence.) isomorphism! Here is a simple special case of this equivalence. And these are all the lattice maps there are from A A finite schedule S that is just an unordered set of n to 2. For j can’t be 0 on every singleton or it would jobs (transitions) to be done in parallel is very easy to make j(S) = 0, S being finite. But j can’t be 1 on compile into an automaton. The automaton is just the two or more singletons since that would make j(0) = 1. power set 2’ drawn in the standard way with the empty So j must be 1 on exactly one singleton {x}. But now set at bottom as the start state and S at top as the j({x} n Y) = j({x}) A j(Y) = j(Y) whence j(Y) = 1 final state, and edges between just those sets differing exactly when x E Y, making j = ji. by exactly one job, with that job labeling that edge. For But the theorem is that decompilation back to sched- ules works for an isomorphism class of automata, so we tures, that of a partial order and that of a topology, aren’t allowed to refer to states as singletons per se. Stone’s in this case. The partial order deals with the However this is no problem: we can spot the singletons absence of complementation, generalizing Boolean alge- by context as being just those states immediately fol- bras to distributive lattices, and dually on the schedule lowing the start state, namely the atoms of the Boolean side, sets to posets. The Stone topology, which resides algebra. So we revise the above argument to work for on the schedule side, caters to the phenomenon whereby all automata isomorphic to 2’ by substituting “atom” a countably infinite Boolean algebra, and by the same for “singleton.” token a distributive lattice, can have a countably infinite So we now have a l-l correspondence between all iso- subalgebra not isomorphic to its parent, by forbidding morphism classes of finite sets and some set of isomor- those combinations of jobs (i.e. subsets of X) corre- phism classes of finite Boolean algebras. But the reader sponding to missing elements of said subalgebra. well knows (though it is some work to prove) that every Thus Birkhoff’s and Stone’s halves of this beautiful finite Boolean algebra is isomorphic to the power set of duality theory are essentially independent. Both halves some finite set, and so we have the promised equivalence. have potential computational significance. Birkhoff du- But this very special case of Birkhoff-Stone duality is ality is relevant to scheduling, the main thrust of this as boring as the natural numbers, since the finite sets fall paper. Stone duality is relevant to continuous situa- into isomorphism classes according solely to their car- tions, e.g. parallel solutions to stock-cutting problems dinality n, one class per number, and correspondingly where the regions can get arbitrarily small without ever there is just one isomorphism class of Boolean algebras becoming points. It may also prove fruitful in reasoning of cardinality 2”. about large systems where the number of jobs makes it So the picture so far is that if schedules are just un- uneconomical or infeasible for a scheduler to deal with ordered sets of jobs, there is, up to isomorphism, just individual jobs, forcing it to batch them, the chief diffi- one schedule of each size n and one matching automa- culty here being that of translating the logic of infinity ton of size 2”. down to large but finite numbers. This duality can now be spiced up in two essentially For our geometry-of-concurrency purposes however orthogonal ways, a combinatorial one due to G. Birkhoff we currently have no application for Stone duality. In [Bir35] and a topological one due to M. Stone [Sto36]. this paper we focus on schedules structured by a par- Remarkably, that these ways were orthogonal passed un- tial order, and hence on Birkhoff duality, a finite and noticed until pointed out by H. Priestley in 1970 [Pri70]. pleasantly combinatorial phenomenon.2 Finite posets are far less boring than finite sets. Keeping everything finite, Birkhoff duality generalizes Whereas the number of isomorphism classes of sets of the discrete schedules to partially ordered schedules, and each cardinality goes 1, 1, 1, 1, 1, 1, 1, . . . the correspond- generalizes the automata to distributive lattices. On the ing sequence for posets goes 1,2,5,16,63,318,2045,. . . . other hand, keeping the automata Boolean, Stone dual- So when you are scheduling 7 jobs, there are 2045 differ- ity generalizes everything to the infinite case. In order ent ways to schedule them, one of which is the discrete to allow every Boolean algebra to be viewed as the com- order, no precedence constraints, at one extreme and pilation of some schedule Stone generalizes schedules of another of which is the linear order (this is only up to jobs to schedules of sets of jobs called (nowadays) Stone isomorphism, or we would have 7! linear orders) at the spaces. Instead of running individual jobs one must now other. run sets of jobs at a time, and only in those combina- tions that are permitted. The automaton produced by Despite this enormously richer software library (and compiling such a schedule will now be a proper Boolean this is before we’ve labeled the vertices to say what each subalgebra of the power set of the set of all jobs in the job does, being only up to isomorphism), the story about schedule, due to the schedule restrictions eliminating schedules and automata remains almost completely un- some states, e.g. those containing only finitely many changed! To compile S form A = 2’. To decompile A jobs. back again form S = 2A. It will become clear shortly that these definitions as Stone did extend his Boolean duality to distributive they stand are time reversing in both directions. We lattices [Sto37], but purely topologically rather than via couldn’t see this before because sets and Boolean alge- the more natural blend of order and topology devised bras are both isomorphic to their duals. We fix this by Priestley. As Rota put it, “Stone’s representation by reversing the input to each exponentiation. Thus theorem of 1936 for distributive lattices closely imitated his representation theorem for Boolean algebras, and as a consequence turned out to be too contrived.” [Rot731 Priestley simply equips the schedule with both Birkhoff’s partial order and Stone’s topology to make it a partially ordered Stone space, a set bearing two struc-

5 we actually compile with 2’O’ and decompile with 2Aop, straightened out. Now a new element c is added in on where X”P denotes the order dual of X. the left; the relevant piece of the diagram is a coproduct Remarkably, nothing about our reasoning for un- E whose inclusions are maps 3 and 4. The dual of a co- ordered schedules needs be changed until we get to the product is a product; 3’ : E’ ---, C’ projects out c while matter of whether there are any other maps besides the 4’ : E’ - D’ projects out a and b. Now 5 augments f=‘s. The arguments involving singletons are no longer with a 5 c, again knocking out a corner. Finally 6 adds sound, because there may now be fewer singletons, in two new elements, d after 6 and e spliced in between a the extreme case only one if some job has to go first. and c. But we achieve the same effect by taking, for each x, A’ e-ca0 the state {y]y 5 x} ( a so-called principal order ideal +lY because it is generated by one element, z), clearly in A. This state is the earliest moment at which x could o- -a.o have run. To make this abstract (remember, we claim only an equivalence, not an isomorphism), the analog of “atom” is now obtained by noticing that these states are exactly those that aren’t the union, or rather join since this is going to be for lattices, of two smaller states, i.e. they are join-irreducible. The states we’ve picked can’t be so represented because x has to be in one of them and there is no smaller such state. Those we left out are not principal and hence have at least two maximal oc E E’ ;” t” b t” elements, in which case they can be represented as the t+?.o--bO union of the principal order ideals generated by each of 5’ their maximal elements. t &co--5L 0 We now observe that our jZ’s are all distinct because I I I F each first becomes true at its own join-irreducible state. F’ 15 C Furthermore when we compare the fZ’s coordinatewise by inclusion we find fi C jY (which we can read as “if 6 6’ x has happened then y has happened”) just when y 5 x b d t b d in S. So this ordering of the fZ’s coincides with the g -kO- -co o- %p--.pp original order on S, showing that 2A is isomorphic to the original poset S. This equivalence of the classes of finite posets and finite distributive lattices is actually a contravariant equivalence of categories. This means that the corre- ib C spondence between posets and lattices extends to their One may well imagine that distributive lattices would maps, with “contravariant” meaning that correspond- be harder to visualize than Boolean algebras. This need ing arrows go in opposite directions, i.e. the poset map not be so. The key to visualizing a distributive lattice f :P- Q corresponds to a lattice map f’ : q’ - p’ pop is to interpret the precedence constraints of S in between the corresponding lattices. pop . What each constraint x 5 y does is to delete all The adjacent figure contains two diagrams, one in states violating that constraint, namely those containing the category of finite posets, on the left, the other on y but not x. The remaining states retain their original the right in the category of finite distributive lattices. positions, preserving the geometry of the cube. Thus a Each diagram has seven objects A through G, primed finite distributive lattice is simply an eroded cube. on the right. The six goset maps on the left, numbered One immediate application of dualities of this kind is 1 through 6, go down while the corresponding lattice that it maps colimits to limits in passing from schedules maps on the right go up. to automata. This follows from the manner in which du- Object A is a one-job schedule while A’ is the corre- ality is obtained as the exponentiation D”, for a suitable sponding one-transition automaton. The map 1 : A + dualizing object D, in the category of posets, yielding B is an inclusion which adds job b while the correspond- for example D”+Y = D” x DY. Casley et al [CCMP89] ing map 1’ : B’ ---) A’ is a projection, projecting out b. outline a language for concurrency a number of whose 2: B - C is an augmentation of the discrete order in operations are describable as colimits in a category of B to a linear order in C. This constraints knocks out schedules; these are therefore carried to the correspond- the bottom left corner of B’, represented by an inclu- ing limits in the dual situation. The language is defined sion2’:C’- B’. C’ is the top and right edges of B’, for schedules having various notions of time, such as

6 real-valued time3, set-valued time, and causal-accidental lattice property uniquely determines two vertices, re- time, with posets having merely truth-valued (0 and 1) spectively the meet and join of the union of those paths, time. in turn determining (not uniquely) extensions of the paths to those points to give them a common beginning and end, this being confluence. And the distributivity 4 Event Structures. property uniquely determines the appropriate filling-in of the “holes” in the lattice, yielding a simply-connected The next generalization takes us to the event structure space through which the two paths may be continuously model [NPW81].4 H ere we specify a symmetric irreflex- deformed into each other in the intuitively obvious way, ive binary relation i#j on events, whose meaning is that provided we regard this space as Euclidean, i.e. a subset not both of i and j may run. In the presence of schedul- of Rd rather than 3 d. By suitably defining the discrete ing we require that i#j and j < imply that is, k i#k, analog of continuous deformation we may achieve the conflict is a condition. An event structure is persistent same effect in 3d, addressed below, but for now our in- then such a set <, #), being the set of events. (V, V tuition with Euclidean space will suffice. The effect of the scheduling order < was to erode the In topological language, any two paths with common corresponding automaton by deleting certain cells, con- endpoints in such a simply-connected space are auto- verting it from a cube or Boolean algebra to a distribu- matically an equivalence relation on paths tive lattice. (Every finite distributive lattice arises in homotopic, [Bro88, Whi49, Whi78]. They become nonhomotopic this way.) The effect of conflict # is to further erode when a hole appears somewhere in the space between the automaton, this time only from the top down (a them to inhibit their deformation into one another. consequence of the persistence of conflict), deleting just those cells such that for some i#j neither the i-th nor Homotopy is ordinarily studied for spaces the move- j-th component of that cell is 0, corresponding to states ments in which form a group under composition, where in which both i and j are either running or have halted’. homotopy is inhibited only by holes. The typical irre- In these generalizations the filled-in holes of a given versibility of computation however calls for a monoid. distributive lattice have not themselves added any in- This in turn calls for a generalization of the notion of formation, since they can be reconstructed from the homotopy from grouphomotopy to monoid-homotopy, distributive lattice by first passing to its dual poset, leading to other ways of inhibiting homotopy. For now taking this to be a scheduling of events, and construct- we settle for the following stopgap notion, defined only ing the filled-in lattice from the poset by the procedure for our present setting of distributive lattices. given above, as a subspace of either 3d or Rd as desired. Given two ascending paths p, q in a distributive lattice However event structures currently provide the largest L having common endpoints, and given a subspace X known class of schedules to date that we are aware of of the Euclidean fill-in of this lattice, we say that p and for which this holds. q are group-homotopic with respect to X when they are homotopic in X in the standard sense of topology. Given two ascending paths p, q not necessarily having common 5 Monoidal Homotopy endpoints, we say that p and q are monoid-homotopic with respect to X when they extend to paths that are We now define a preliminary notion of monoidal homo- group-homotopic with respect to X. topy and use it as the basis for a definition of “true This generalizes homotopy by permitting paths with- nondeterminism.” It is expected that a more formal no out common endpoints, the application of which will be tion of monoidal homotopy will be able to be based on apparent shortly. Henceforth by “homotopic” we shall the n-complex model of higher dimensional automata mean monoid-homotopic. presented in the concluding section. We think of decisions involving choices between paths A finite distributive lattice is both conj?uent and as essential just when the paths are not homotopic, and simply-connected in the following sense. Given any two hence of filled-in distributive lattices as deterministic or (ascending) paths in the lattice (defined as just the ver- choiceless automata. Nondeterminism is the condition tices they pass through, the edges can be inferred), the in which there exist paths not homotopic to each other; 31nfinitesimally fine interleaving looks like true concurrency un- we think of the choice between nonhomotopic paths as til one notices it is taking time L1 or x + y. Truly concurrent real an essential decision. time requires only L, or max(x, y), a theme developed in future work. Conflict introduces nondeterminism into distributive 4As Girard-[Gir81] has noticed to good effect in developing the lattices, by selectively destroying confluence in the for- notion of coherent space, this generalization can be made inde- ward (upward) direction, by making “notches” in the pendently of the preceding one. “top” of an automaton. Two paths on opposite sides of ‘Without scheduling these are Girard’s coherent spaces, or rather coherent algebras if we adhere to the duality theorists’ nam- such a notch are committed to their respective sides and ing convention for such duali ties. cannot be extended upward to group-homotopic paths,

7 there being no join to extend to; hence they are not We programmers tend to be more like servicemen homotopic in our broader sense. (Since the effect of than viewers. Years of thinking about individual in- persistence is to limit notching to the top, making such struction sequences have conditioned us to believe that an automaton an order ideal of the distributive lattice the sequence is the correct object of study. If instead we it was obtained from, it follows that for conflict it would were to assemble many such sequences, properly aligned, make no substantial difference if we restricted the defi- into a single picture, the resulting shapes that would ma- nition of monoid-homotopy just to paths with common terialize would make it much easier to reason about our beginnings, since any two paths can be extended to have processes. a common beginning.) (v) Algebraic structure. Geometry is an “alge- braically mature” subject, and we are optimistic that some of this algebra will rub off on our geometrically 6 Benefits of a Geometric Model based model of computation. Thus far we have in fact elicited some algebraic structure, but mainly from that The biggest advantage for us of this geometric perspec- of event structures via duality. We are presently work- tive is that it makes the duality of schedules and au- ing on replacing this convenient but limited derivation tomata more convincing. If by leaving two events un- with an elementary development of homology based on ordered we have supposedly represented their true con- monoids instead of groups to yield what we feel will be currency, how do we then explain the automaton dual to a more comprehensive and convincing algebrization. To this discrete poset, namely the four-state four-transition be more precise, we base it not exactly on monoids but square already discussed ? The latter is ezactly the au- rather on their generalization to n-categories [Ehr63] fol- tomaton one would expect the interleaving model to pro- lowing roughly the lines of Street [Str87], as more ap duce! propriately expressing the dimensional aspect. One answer to this puzzle is to say that such a square alutays indicates true concurrency, and to rep resent ij + ji (namely the mutual exclusion of i and j) 7 Extensions of Event Struc- by not letting the ij and ji branches rejoin when done. Our answer is instead to fill in the square to indicate t ures true concurrency and simply leave it hollow to indicate mutual exclusion. Despite the fact that event structures were introduced We see this approach as having the following benefits. more than a decade ago [Win80], there have been no fur- (i) Naturality. Lines, surfaces, and volumes, attached ther generalizations of event structures where the dual- to each other in possibly branching ways, are familiar ity has been maintained. Yet there are many phenomena and easily visualized concepts, requiring relatively little of computation each describable with a suitable exten- mathematical sophistication to at least begin to appre- sion of this model, some of which we give now. Thus ciate. far we have been able to make these extensions only on (ii) Flexibility. A greater variety of situations may the algebra or automaton side of the duality, where the now be represented. For example we now can choose higher-dimensional cells are described explicitly. The whether ij and ji are to rejoin immediately, a little role of the cells in making these extensions may once later, or never. For reason (iii) (complexity) we will again be made inessential, albeit almost certainly still in general prefer the first, but we may on occasion find convenient, if a suitable extension of the duality can be it meaningful to “rip upwards” a little or a long way. found, a problem we return to later. (iii) Complexity. An m x n rectangle contains only Although event structures themselves reside on the mn squares but (“,+” ) paths (between adjacent lattice topology side of the duality, the completeness of the points) from start to end. Even if we associate informa- duality up to this point permits us to extend starting tion with every square (e.g. by forbidding some), the from either side. All extensions considered here will be geometric representation of this information is of poly- to the algebra or automaton side, where the nature of nomial size in the sides whereas the interleaving repre- the higher-dimensional cells, of dimension two and up, sentation, in terms of the paths, is of exponential size. is clear. (iv) Continuity. Tearing a picture into little strips Mutual Exclusion. The mutual exclusion of events i is an inherently discontinuous operation. Decomposing and j is the condition that i and j not overlap. In ST- a d-dimensional space as a set of paths through it is bisimulation terms it is the naturally expressed condi- somewhat akin to identifying a TV picture with its one- tion that in no state are transitions i and j both marked. dimensional representation as a sequence of scan lines. The corresponding requirement for the geometric model A TV serviceman who never saw a screen but only the is of course that no cell exist whose i-th and j-th compo- scan lines laid end to end may find this perspective nat- nents are both 2’ (for the discrete or 3d model) or both ural, but certainly not a viewer. in the open interval (0,l) (for the Euclidean model).

8 As defined here mutual exclusion is not persistent. We rant, represents the period during which the message is may have i# j and j < k without i#k since k may not in transit. need the resource that i and j are presumably competing The effect of many communications is to erode the for. After i and j are done, in whichever order, the two upper left (early X and late Y) and lower right (late branches of the computation may rejoin, corresponding X and early Y) regions of the rectangle, creating two to the rest of the computation not remembering the or- jagged boundaries each representing the places where der. one process must wait for messages from the other. The A persistent version of the mutual exclusion of i and boundaries are suggestive of teeth, suggesting the whim- can be defined using two copies of each of i and j, sical term “jaws of communication.” We refer to the arranged as ij + ji, with each of the two events of ij in space between the jaws as the communication corridor. conflict with each of the two events of ji. Persistence of In the interior of the corridor there is no waiting for conflict means that the commitment to one of ij or ji messages; computation may flow unimpeded. is permanent; two paths making this decision differently As the rate of exchange of messages increases the cor- cannot subsequently rejoin. ridor narrows (the jaws close). If this corridor were a This brings us to the question, to persist or not to tube with liquid flowing through it, we would expect persist? such narrowing to impede the flow. In fact we see just One advantage of persistence is that it permits our such an effect, attributable to the high cost of commu- geometrical model to be dispensed with. However to nication. the extent that geometry offers the several benefits we But we need not think of a computation as a specific claimed earlier, all of which are compromised more or path through the corridor, we can broaden it to reflect less seriously by insisting on persistence, this is at the our ignorance of its exact position, just as we would do same time a serious disadvantage of persistence. for the trajectory of a car on a highway, the accuracy For example persistence destroys the complexity ad- of which depends on the application. In the limit we vantage of geometry. If the computation keeps splitting may think of the whole corridor as the computation. If into alternatives without ever rejoining, its size grows it contains no holes or failures of confluence (i.e. persis- exponentially. Rejoining permits a much smaller model tent conflicts) we regard it as a deterministic computa- of a given computation when there is much branching. tion. Otherwise it is nondeterministic, with the essence (The dauntingly many alternative parallel universes of of the nondeterminism residing in homotopy classes (the science fiction may similarly be dramatically reduced in equivalence classes of paths induced by homotopy). number, say to around 1012’ as a match for the number The concern of branching time is then with the details of particles in any one such universe.) of just where the homotopy classes paste together, since It is also particularly distressing to see a local mutual pasted regions represent regions preceding (or follow- exclusion requirement, which we can represent with just ing) where the classes diverge (or converge). Synchro- a small hole, be blown up into a giant tear in the fabric nization trees are the one-dimensional case of this where of the computation simply due to the requirement of words are pasted together along a common initial seg- persistence. ment, a one-dimensional pasting. In general pasting can For these and similar reasons we prefer not to insist take place not just along curves but across surfaces and on persistence, and to permit the expression of nonde- through volumes etc. The pasting need not necessarily terminism not only by absence of confluence (the status be the maximal such, otherwise branching time would quo) but also by the presence of holes even where con- convey no information not already in linear time. At a fluence is possible (our proposed extension to the status fork earlier decisions correspond to earlier suspension of w+ pasting, and dually at a join. Communication. Consider a rectangle representing two processes X and Y running in parallel. A commu- nication from X to Y consists of a transmission T by 8 Directed Cell Complexes and X and a receipt R by Y. These two events together determine a point in the rectangle, which we may think n-Dimensional Automata of as the communication. Taking this point as the ori- gin, divide the rectangle into four quadrants. Think- Thus far the discussion of geometry has relied on an ing for the moment in terms of computations being informal intuition about geometry which might be char- one-dimensional paths, a particular computation path acterized as pastings of fragments of Euclidean space passes through three of these, avoiding the quadrant oriented somehow to represent the irreversibility of com- in which the message would have been received be- putation. This intuition is formalized in the following fore it was transmitted. The middle quadrant the path notion of higher dimensional automaton. passes through, diagonally opposite the excluded quad- A sequential automaton or transition system is a

9 graph6 whose vertices denote states and whose edges de- when that notion is fully operational. note transitions. One vertex ~0 is distinguished as the Proceeding topdown, we first define the notion of start state and a set F of vertices constitutes the final concurrent automaton in terms of that of complex, pro- states. The edges are labeled with elements of a set C. vide a motivational interlude, then define complex. The linear-time meaning of this automaton is defined in An n-automaton A = (Q, C, S, S, T) consists of n- terms of paths in the graph, each determining an ele- complexes Q and C, an n-map 6 : Q ---+ C, and subsets ment of C’. The automaton accepts those elements of S,T of (the underlying set of) Q. The m-language uc- C* that are determined by some path from ~0 to a state cepted by A is the subset of C consisting of those 6(z) in F. Two such automata are linear-time-equivalent or for z in Q such that So E S and tm(x) E T where trace-equivalent when they accept the same subset of s,,, , t, are the m-th boundary operators of Q. c*. Before defining complexes let us touch ground mo- In geometric terms such an automaton is a one- mentarily. Our 5-tuple definition parallels the tra- dimensional cell complex whose one-dimensional cells or ditional definition of an automaton as (Q, C, 6, ~0, F) l-cells are its transitions and whose O-cells are its states. [HU79], consisting of state set Q, symbol set C, tran- We would like a model whose definition reduces in the sition function 6, start state ~0, and final state set F, l-dimensional case to the above combinatorial notion of along with the usual definition of accepted language. directed graph, and which captures the geometric intu- With the following adjustments the traditional defini- itions of the foregoing discussions. tion matches ours in the case n = 1, m = 0. Algebraic topology offers a range of models to select View the transitions defined by traditional 6 as a from, such as CW-complexes and simplicial complexes. pair (E, 6) where E is a set of unlabeled edges and But as far as we have been able to tell, all the extant 6 : E -+ C labels them. Rename Q to V for vertices, notions of cell complex in algebraic topology assume re- move E in with V to form a graph (V, E) and recycle versible geometry too early in their development, and Q as Q = (V, E). Now revamp C as a l-graph with one depend too heavily on structural properties of groups, to vertex and with edge set old C. Interpret 6 : Q + C permit their easy adaptation to the irreversible case. We as the obvious graph map. Finally replace (Q, C, 6) by would be delighted to have a pointer to a counterexam- (Q*, C*, 6*) where Q’ is the set of paths in Q, C* is as ple. The following notion of higher dimensional automa- always the free monoid on C, and 6’ : Q’ + C’ is the ton takes its inspiration not from algebraic topology but corresponding extension of 6 : Q - C from paths of instead from the geometry of n-categories [Ehr63]. length 1 to all paths. Take S = (~0) and T = F. This Ordinarily we define an automaton as an edge-labeled gives us the desired l-automaton (Q’ , C*, 6*, S, T). We graph, and define its operation in terms of the paths then rename Q, C, b one more time so as to dispense with in that graph and the operation of path concatenation. the *‘s. This is the translation of a standard automaton However we could just as well start with the paths and into our framework. dispense with the underlying graph. When passing from We now continue with our top-down definitions. Fol- discrete to continuous automata, whose every state tran- lowing Street [Str87], we define an n-complex in terms sition can be decomposed as a concatenation of shorter of l-complexes and 2-complexes. transitions, this is in fact necessary since they have no An n-complex, or small n-category, is a set bearing suitable underlying graph. the structure of n l-complexes CO,. . . , Cn-r, such that For qualitatively different reasons we shall similarly for all i < j, (C;, Cj) is a 2-complex. not start from the underlying graph when passing from It remains to define i-complex for i 5 2. In the follow- one-dimensional to higher-dimensional automata. The ing the s, t, 3: terminology is taken from Street [Str87]; problem is not that suitable underlying graphs cannot we have taken some liberties with the wording of his exist, as with continuous automata, but that a suitable definition but not its content. Note that this definition notion of n-graph has proved elusive, and only halfway- of a l-complex is as a homogeneous category, namely decent notions have emerged to date. The most success- one where the object-morphism distinction is not made; ful of these would appear to be M. Johnson’s notion of the objects can be recovered as any of either the range pasting diagram [Joh87]. However it seems to us that or fixpoints of either s or t, or as the identities of *. his definition presently requires both simplification and Homogeneity simplifies the extension to n-categories. generalization in order to constitute a workable notion A l-complex C = (P, s, t, *) consists of a set P of (ab- of n-graph. Hence as an interim measure we define an stract) paths, two boundary operations s, t : P - P, n-complex to be an n-category, with the eventual goal of and a binary operation * : Pz ---) P of path concatena- redefining it so that it refers to the underlying n-graph tion. The domain P2 C P2 of * is the set of consecutive pairs (2, y) in P2, namely those for which tx = sy. Fur- ‘We allow multiple edges from one vertex to another. In some thermore the following conditions must be satisfied. circles the term multigraph is used to distinguish these from the kind where E C V2. (i) s(P) = t(P) dg PO, constituting the U-cells of C, while PI = P, the l-cells of C. (So PO s PI = P.) two halves of the boundary of a polygon may touch re- (ii) x E PO implies sx = x = t z. (Hence s and t are peatedly, but if the whole region is 2-connected-no cut idempotent, and st = t = tt, ss = s = ts.) point-they can never cross.) Hence the set of all sim- (iii) For all (x, y) E Pz, s(x * y) = s(x) and t(x * y) = ply connected polygons that can be assembled from the t(Y)* elementary polygons of the decomposition constitutes a (iv) (Identities.) 3: E PO implies for all (x, y) in Pz, 2-complex under the compositions x *O y and x *i y. The interchange law is evidently sound in this model. X*Y = y, and for all (y, x) in Pz, y * x = y. (v) (Associativity.) For all (x, y) and (y, Z) in Pz, What is less obvious is that it is complete in the sense 2 * (y 3: %) = (x * y) * z. that any two ways of assembling a polygon from elemen- tary polygons (which will take the form of two terms in A ,&complex C = (P,sO,tO,*O,slrtl,*l) is a pair the language consisting of constants naming polygons (Cs,Cr) of l-complexes CO = (P, so, tO,*o), Cl = and the two compositions) can be proved to give the (P, s1, tl, *I) on a common set P such that same polygon using just the two associativity axioms (i) PO c PI where P; = s;(P), the set of i-cells. P2 = (one for each composition) and the interchange axiom P (everything is a 2-cell). (Hence sltl = tl but soti = under the standard rules of equational logic. This was SO, and PO C PI s P2 = P.) claimed by Kelly and Street [KS74], and was more re- (ii) (Interchange.) ( ~*lx)*o(y*lz) = (~*oy>*1(~*0~) cently extended by John Power to all n-complexes (to when all terms are defined. appear). The idea of the proof for n = 2 is that if Referring to our definition of n-complex u)*i x and y*r z denote the same polygon x, with source &-I) then reveals it in more detail to be a (Co,.-, s= sax and sink T = tax, then each term partitions structure C = (P,sO,tO,*O,. . .,sn-l,tn-l,*n-l) every that polygon via a cut from S to 2”. If these two cuts do pair (Ci, Cj) of which for i < j is a 2-complex. Evi- not cross each other then they bound a region UI n z or dently PO G PI C . . . E P,, = P. x n y with source S and sink T leaving two outside re- An n-map or n- of n-complexes C, C’ is a ho- gions of the polygon with that source and sink, and one momorphism; equivalently, a function f : P - P’ be- then proves equality of those regions separately by in- tween their underlying sets such that f : Ci - Ci is a duction, completing with one application of associativity functor for 0 5 i < n (i.e. on the l-complex at each for $1. Otherwise several island regions are produced, dimension). and interchange can then be used to represent each of It is intuitively clear that associativity is the essential these regions as one region from S to T by extending it axiom of concatenation in one dimensional irreversible out to S and T with l-cells, and then concluding with geometry. The straightforward extension of this to two applications of associativity of $1. dimensions is that a matrix can be formed as a column of This shows that n-complexes capture the essence of rows, and that vertical composition of columns is asso- ordinary geometry of cells, though without its reversibil- ciative, and dually it can be formed as a row of columns, ity, ruled out here by directing all edges and surfaces. with horizontal composition of rows being associative. (This is in contrast to orienting them, where a direction But there is more to it than that. The same ma- is specified but each edge has an inverse.) As the ear- trix can be assembled row by row or column by column. lier sections argue informally, it is just such irreversible While this has the same flavor as associativity, it is not cellular geometry that is needed for a geometric model formal associativity in the sense that vertical compo- of concurrency. sition of columns or horizontal composition of rows is This completes the definition of higher dimensional associative. We therefore require a separate axiom from automaton and the acceptance criterion most closely associativity. This is the function of the interchange law corresponding to language acceptance. This induces a in irreversible geometry. congruence on the class of such automata. We leave the An example of a 2-complex is a polygonal decomposi- further study of this model and associated congruence tion of a simply connected region of the Euclidean plane and the pursuit of other acceptance criteria and congru- R2. The edges of the decomposition form a directed ences to subsequent communications. acyclic graph having a single source vertex and a single sink vertex, as hence do the edges of any of the poly- gons. This partitions every boundary of a polygon x References into halves SIX and tlx, start and terminal, both lead- ing from a common source sax to a common sink tax. [Bir35] G. Birkhoff. On the combination of subal- If two polygons share an edge then that edge must be- gebras. Proc. Cambtidge Phil. Sot, 29:441- long to the start of one and the terminal of the other. 464, 1935. It may be verified that any two such polygons x, y for which tix = siy for i 0 or 1 together form a polygon [BK89] J.A. Bergstra and J.W. Klop. Process meeting these conditions. (Under these conditions the theory based on bisimulation semantics.

11 In Proc. REX School/Workshop on Linear [Mil80] R. Milner. Calculus of Communicating Be- Time, Branching Time and Partial Order in havior, LNCS 92. Springer-Verlag, 1980. pages Logics and Models for Concurrency, [NPW81] M. Nielsen, G. Plotkin, and G. Winskel. 50-122, Noordwijkerhout, The Netherlands, Petri nets, event structures, and domains, 1989. Springer-Verlag. part I. Theoretical Computer Science, 13, [Bro88] R. Brown. Topology: A geometric account 1981. of general topology, homotopy types and the [Pap861 C. Papadimitriou. The Theory of Database fundamental groupoid. Halsted Press, New Control. Computer Science Press, 1986. York, 1988. [Par8 l] D. Park. Concurrency and automata on in- [CCMP89] R.T Casley, R.F. Crew, J. Meseguer, and finite sequences. In Proc. Theoretical Com- V.R. Pratt. Temporal structures. In puter Science, LNCS 104, pages 167-183. Proc. Conf. on and Com- Springer-Verlag, 198 1. puter Science, LNCS, Manchester, Septem- ber 1989. Springer-Verlag. Revised version [Pra82] V.R. Pratt. On the composition of pro- to appear in Math. Structures in Comp. Sci., cesses. In Proceedings of the Ninth Annual 1:l. ACM Symposium on Principles of Program- ming Languages, January 1982. [CDP87] L. Castellano, G. De Michelis, and [Pra86] V.R. Pratt. Modeling concurrency with par- L. Pomello. Concurrency vs interleaving: an tial orders. International Journal of Parallel instructive example. Bulletin of the EATCS, 15( 1):33-71, February 1986. 31:12-15, February 1987. Programming, [Pri70] H.A. Priestley. Representation of distribu- C. Ehresmann. Categories structurees. [Ehr63] Ann. tive lattices. Bull. London Math. Sot., Sci. Ecole Norm. Sup., 80:349-425, 1963. 2:186-190, 1970. [Gir87] Jean-Yves Girard. Linear logic. Theoretical [Rot731 G.-C. Rota. The valuation ring of a dis- Computer Science, 50:1-102, 1987. tributive lattice. In Proc. Univ. of Houston Lattice Theory Conf. Dept. of Math., Univ. [Gla90] R.J. van Glabbeek. Comparative concur- of Houston, 1973. rency semantics and refinement of actions. PhD thesis, Vrije Univ., Amsterdam, 1990. [Sto36] M. Stone. The theory of representations for Boolean algebras. Trans. Amer. Math. Sot., [Gra81] J. Grabowski. On partial languages. Funda- 40:37-111, 1936. menta Informaticae, IV.2:427-498, 1981. [St0371 M. Stone. Topological representations of [GV87] R.J. van Glabbeek and F.W. Vaandrager. distributive lattices and brouwerian logics. Petri net models for algebraic theories of casopis Pest. Math., 67:1-25, 1937. concurrency. In Proc. PARLE, II, LNCS 259, pages 224-242. Springer-Verlag, 1987. [Str87] R. Street. The algebra of oriented sim- plexes. Journal of Pure and Applied Algebra, [HU79] J.E. Hopcroft and J.D. Ullman. Introduc- 49:283-335, 1987. tion to Automata Theory, Languages, and R. van Glabbeek and U. Goltz. Partial order Computation. Addison-Wesley, 1979. [vGG89] semantics for refinement of actions-neither [Joh87] M. Johnson. Pasting Diagrams in n- necessary nor always sufficient but appro- Categories with Applications to Coherence priate when used with care. Bulletin of the Theorems and Categories of Paths. PhD EATCS, 38: 154-163, June 1989. thesis, Dept. of Pure Mathematics, Sydney [Whi49 J.H.C Whitehead. Combinatorial homotopy University, October 1987. 1 I. Bull. Amer. Math. Sot., 55:213-245,1949.

[KS741 G.M. Kelly and R. Street. Review of the [Whi78] G. W Whitehead. Elements of Homotopy In elements of 2-categories. LNM 4.20. Theory. Springer-Verlag, 1978. Springer-Verlag, 1974. [Win801 G. Winskel. Events in Computation. PhD [Lam861 L. Lamport. On interprocess communi- thesis, Dept. of Computer Science, Univer- cation. Distributed Computing, 1:77-101, sity of Edinburgh, 1980. 1986. 12