Contents i The Theory and Practice of Concurrency A.W. Roscoe Published 1997, revised to 2000 and lightly revised to 2005. The original version is in print in April 2005 with Prentice-Hall (Pearson). This version is made available for personal reference only. This version is copyright (c ) Pearson and Bill Roscoe. Contents Preface ix 0 Introduction 1 0.1 Background 1 0.2 Perspective 4 0.3 Tools 7 0.4 What is a communication? 8 I A FOUNDATION COURSE IN CSP 11 1 Fundamental concepts 13 1.1 Fundamental operators 14 1.2 Algebra 29 1.3 The traces model and traces refinement 35 1.4 Tools 48 2 Parallel operators 51 2.1 Synchronous parallel 51 2.2 Alphabetized parallel 55 2.3 Interleaving 65 2.4 Generalized parallel 68 iv Contents 2.5 Parallel composition as conjunction 70 2.6 Tools 74 2.7 Postscript: On alphabets 76 3 Hiding and renaming 77 3.1 Hiding 77 3.2 Renaming and alphabet transformations 86 3.3 A basic guide to failures and divergences 93 3.4 Tools 99 4 Piping and enslavement 101 4.1 Piping 101 4.2 Enslavement 107 4.3 Tools 112 5 Buffers and communication 115 5.1 Pipes and buffers 115 5.2 Buffer tolerance 127 5.3 The alternating bit protocol 130 5.4 Tools 136 5.5 Notes (2005) 137 6 Termination and sequential composition 139 6.1 What is termination? 139 6.2 Distributed termination 143 6.3 Laws 144 6.4 Effects on the traces model 147 6.5 Effects on the failures/divergences model 148 II THEORY 151 7 Operational semantics 153 7.1 A survey of semantic approaches to CSP 153 7.2 Transition systems and state machines 155 Contents v 7.3 Firing rules for CSP 162 7.4 Relationships with abstract models 174 7.5 Tools 181 7.6 Notes 182 8 Denotational semantics 183 8.1 Introduction 183 8.2 The traces model 186 8.3 The failures/divergences model 195 8.4 The stable failures model 211 8.5 Notes 218 9 Analyzing the denotational models 221 9.1 Deterministic processes 221 9.2 Analyzing fixed points 227 9.3 Full abstraction 232 9.4 Relations with operational semantics 242 9.5 Notes 247 10 Infinite traces 249 10.1 Calculating infinite traces 249 10.2 Adding failures 255 10.3 Using infinite traces 262 10.4 Notes 271 11 Algebraic semantics 273 11.1 Introduction 273 11.2 Operational semantics via algebra 275 11.3 The laws of ⊥N 279 11.4 Normalizing 281 11.5 Sequential composition and SKIP 291 11.6 Other models 294 11.7 Notes 297 vi Contents 12 Abstraction 299 12.1 Modes of abstraction 300 12.2 Reducing specifications 310 12.3 Abstracting errors: specifying fault tolerance 313 12.4 Independence and security 320 12.5 Tools 330 12.6 Notes 330 III PRACTICE 335 13 Deadlock! 337 13.1 Basic principles and tree networks 337 13.2 Specific ways to avoid deadlock 349 13.3 Variants 365 13.4 Network decomposition 376 13.5 The limitations of local analysis 379 13.6 Deadlock and tools 381 13.7 Notes 386 14 Modelling discrete time 389 14.1 Introduction 389 14.2 Meeting timing constraints 390 14.3 Case study 1: level crossing gate 395 14.4 Checking untimed properties of timed processes 405 14.5 Case study 2: the alternating bit protocol 410 14.6 Urgency and priority 417 14.7 Tools 420 14.8 Notes 420 15 Case studies 423 15.1 Combinatorial systems: rules and tactics 424 15.2 Analysis of a distributed algorithm 430 15.3 Distributed data and data-independence 445 15.4 Analyzing crypto-protocols 468 15.5 Notes 488 Contents vii A Mathematical background 491 A.1 Partial orders 491 A.2 Metric spaces 510 B A guide to machine-readable CSP 519 B.1 Introduction 519 B.2 Expressions 520 B.3 Pattern matching 526 B.4 Types 528 B.5 Processes 532 B.6 Special definitions 535 B.7 Mechanics 538 B.8 Missing features 539 B.9 Availability 539 C The operation of FDR 541 C.1 Basic operation 541 C.2 Hierarchical compression 553 Notation 563 Bibliography 567 Main index 577 Index of named processes 589 Preface Since C.A.R. Hoare’s text Communicating Sequential Processes was published in 1985, his notation has been extensively used for teaching and applying concurrency theory. This book is intended to provide a comprehensive text on CSP from the perspective that 12 more years of research and experience have brought. By far the most significant development in this time has been the emer- gence of tools to support both the teaching and industrial application of CSP. This has turned CSP from a notation used mainly for describing ‘toy’ examples which could be understood and analyzed by hand, into one which can and does support the description of industrial-sized problems and which facilitates their automated analysis. As we will see, the FDR model checking tool can, over a wide range of application areas, perform analyses and solve problems that are beyond most, if not all, humans. In order to use these tools effectively you need a good grasp of the fundamen- tal concepts of CSP: the tools are most certainly not an alternative to gaining an understanding of the theory. Therefore this book is still, in the first instance, a text on the principles of the language rather than being a manual on how to apply its tools. Nevertheless the existence of the tools has heavily influenced both the choice and presentation of material. Most of the chapters have a section specifically on the way the material in them relates to tools, two of the appendices are tool-related, and there is an associated web site http://www.comlab.ox.ac.uk/oucl/publications/books/concurrency/ on which readers can find • a list of tools available for CSP x Preface • demonstrations and details of some of the tools • directories of example files containing most of the examples from the text and many other related ones • practical exercises which can be used by those teaching and learning from this book • a list of materials available to support teaching (overhead foils, solutions to exercises, etc.) and instructions for obtaining them as well as supporting textual material. Contact information, etc., relating to those tools specifically mentioned in the text can be found in the Bibliography. The Introduction (Chapter 0) gives an indication of the history, purpose and range of applications of CSP, as well as a brief survey of the classes of tools that are available. There is also a discussion of how to go about one of the major steps when using CSP to model a system: deciding what constitutes an event.Itprovides background reading which should be of interest to more experienced readers before beginning the rest of the book; those with no previous exposure to concurrency might find some parts of the Introduction of more benefit after looking at Part I. The rest of the book is divided into three parts and structured to make it usable by as wide an audience as possible. It should be emphasized, however, that the quantity of material and the differing levels of sophistication required by various topics mean that I expect it will be relatively uncommon for people to attempt the whole book in a short space of time. Part I (Chapters 1–6) is a foundation course on CSP, covering essentially the same ground as Hoare’s text except that most of the mathematical theory is omitted. At an intuitive level, it introduces the ideas behind the operational (i.e., transition system), denotational (traces, failures and divergences) and algebraic models of CSP, but the formal development of these is delayed to Part II. Part I has its origins in a set of notes that I developed for an introductory 16-lecture course for Oxford undergraduates in Engineering and Computing Science. I would expect that all introductory courses would cover up to Section 5.1 (buffers), with the three topics beyond that (buffer tolerance, communications protocols and sequential composition1) being more optional. Part II and Part III (Chapters 7–12 and 13–15, though Chapter 12 arguably belongs equally to both) respectively go into more detail on the theory and practice 1Instructors who are intending to deal at any length with the theory presented in Part II should consider carefully whether they want to include the treatment of sequential composition, since it can reasonably be argued that the special cases it creates are disproportionate to the usefulness of that operator in the language. Certainly it is well worth considering presenting the theory without these extra complications before going back to see how termination and sequencing fit in. Preface xi of CSP. Either of them would form the basis of a one-term graduate course as a follow-on to Part I, though some instructors will doubtless wish to mix the material and to include extracts from Parts II and III in a first course. (At Oxford, intro- ductory courses for more mathematically sophisticated audiences have used parts of Chapters 8 and 9, on the denotational semantics and its applications, and some courses have used part of Chapter 13, on deadlock.) The chapters of Part III are largely independent of each other and of Part II.2 This book assumes no mathematical knowledge except for a basic under- standing of sets, sequences and functions. I have endeavoured to keep the level of mathematical sophistication of Parts I and III to the minimum consistent with giv- ing a proper explanation of the material.