CSP Processes Research Articles

How do we enact co-innovation with stakeholders in agricultural research projects? Managing the complex interplay between contextual and facilitation processes

Highlights • Mobilising co-innovation involves a complex interplay between contextual forces and facilitation processes. •This interplay shapes the core co-innovation processes of joint framing, testing of solutions and creating new knowledge. •This interplay between contextual and facilitation processes requires an adaptive approach to research design and management. •An interface space is conceptualised where key CSP roles and processes intersect in co-innovation enactment. •The implications for multi-actor research projects are discussed.

Test case generation, selection and coverage from natural language

In Model-based Testing (MBT), test cases are automatically generated from a formal model of the system. A disadvantage of MBT is that developers must deal with formal notations. This limitation is addressed in this paper, where use cases are used to model the system. In previous work, we have proposed an automatic strategy for generating test cases from use cases written in a Controlled Natural Language (CNL), which is an English textual notation with a well-defined grammar. Due to its precise syntax, it can be processed and translated into a formal representation for the purpose of automatic test case generation. This paper extends our previous work by proposing a state-based CNL for describing use case control flows enriched with state and data operations. We translate state-based use case descriptions into CSP processes from which test cases can be automatically generated. In addition, we show how a similar notation can be used to specify test selection via the definition of state-based test purposes, which are also translated into CSP processes. Test generation and selection are mechanised by refinement checking using the CSP tool FDR. Despite the fact that we work at a purely process algebraic level to define a test generation strategy, we are able to address model coverage criteria. Particularly, by using FDR, it is possible to have access to the underlying LTS models; we then implemented algorithms for covering events or transitions, possibly combined with selection using test purposes. We also discuss several ways of improving the efficiency of the test generation strategy. As far as we are aware, this integration between an algebraic approach to test case generation with an operational approach for coverage criteria is an original and promising insight. All steps of the strategy are integrated into a tool that provides a GUI for authoring use cases and test purposes described in the proposed CNL, so the formal CSP notation is completely hidden from the test designer. We illustrate our tool and techniques with a running example and a more elaborate case study taken from an industrial setting. • A process algebraic approach to test generation from use cases in natural language. • Integration of coverage criteria into a purely algebraic test generation approach. • Test generation considering coverage of events or transitions of the model. • Complexity analysis and a provably sound optimisation of the test generation approach. • An industrial case study with metrics on the efficiency of the test generation strategy.

Trace and Stable Failures Semantics for CSP-Agda

CSP-Agda is a library, which formalises the process algebra CSP in the interactive theorem prover Agda using coinductive data types. In CSP-Agda, CSP processes are in monadic form, which sup- ports a modular development of processes. In this paper, we implement two main models of CSP, trace and stable failures semantics, in CSP-Agda, and define the corresponding refinement and equal- ity relations. Because of the monadic setting, some adjustments need to be made. As an example, we prove commutativity of the external choice operator w.r.t. the trace semantics in CSP-Agda, and that refinement w.r.t. stable failures semantics is a partial order. All proofs and definitions have been type checked in Agda. Further proofs of algebraic laws will be available in the CSP-Agda repository.

Model checking of state-rich formalism by linking to $$CSP\,\Vert \,B$$ C S P ‖ B

Since state-rich formalism [Figure not available: see fulltext.] is a combination of Z, CSP, refinement calculus and Dijkstra's guarded commands, its model checking is intrinsically more complicated and difficult than that of individual state-based languages or process algebras. Current solutions translate executable constructs of [Figure not available: see fulltext.] programs to Java with JCSP, or translate them to CSP processes. Data aspects of [Figure not available: see fulltext.] programs are expressed in the Java programming language or as CSP processes. Both of them have disadvantages. This work presents a new approach to model-checking [Figure not available: see fulltext.] by linking it to $$CSP \parallel B$$CSPźB; then we utilise ProB to model-check and animate the $$CSP \parallel B$$CSPźB program. The most significant advantage of this approach is the direct mapping of the state part in [Figure not available: see fulltext.] to Z and finally to B, which maintains the high-level abstraction of data specification. In addition, introduction of deadlock, invariant violation checking, LTL formula checking and animation is another key advantage. We present our approach, a link definition for a subset of [Figure not available: see fulltext.] constructs, as well as a popular case study (reactive buffer) to show the practical usability of our work. We conclude with a discussion of related work, advantages and potential limitations of our approach and future work.

FDR3: a parallel refinement checker for CSP

Failures divergence refinement 3 (FDR3) is a complete rewrite of the CSP refinement checker FDR2 that incorporates a significant number of enhancements. In this paper, we describe the operation of FDR3 at a high level and give a detailed description of several of the more important innovations. FDR3 has a new parallel refinement-checking algorithm that is able to achieve a near linear speedup as the number of cores increases. This algorithm scales linearly not only on shared-memory systems, but also on distributed systems (i.e. clusters). In particular, this paper presents experimental results that show FDR3 can achieve a speedup factor in excess of 1000 versus the sequential case on a cluster of 64, 16-core machines (i.e. 1024 cores): we obtain similar performance improvements on a supercomputer and, more interestingly, on a commodity cloud computing provider. We also present experimental results that compare FDR3 to related tools, and indicate that (as far as we know) FDR3 is unique in being able to scale beyond the bounds of main memory. This paper also describes the new algorithm that FDR3 uses to construct its internal representation of CSP processes, one of the key problems to solve in order to efficiently model-check process algebras.

Formalization and Verification of REST on HTTP Using CSP

Representational State Transfer (REST), as a promising software architecture style, has been used in large scale since proposed. But considerable confusions about REST exist and many examples of supposedly RESTful applications violate key REST constraints. In this paper, we focus on the most important constraints of REST, stateless property and hypertext-driven property. First we establish a formal model for REST on HTTP in CSP. In the model, components in RESTful systems communicate with each other using standard HTTP methods and are modeled as CSP processes. From the model we can find the effects of HTTP methods on resources. Then we give formal descriptions for failure cases of stateless, hypertext-driven constraints of REST, and safe, idempotent properties of HTTP methods, within which whether a system breaks REST constraints or basic HTTP requirements can be checked. Furthermore, we use model checker PAT to prove all the constraints hold in our model. In the end, a case study about the process of buying food is mapped to our model to better illustrate the REST concepts and our approach.

Test generation from state based use case models

Abstract We present a strategy for the automatic generation of test cases from parametrised use case templates that capture control flow, state, input and output. Our approach allows test scenario selection based on particular traces or states of the model. The templates are internally represented as CSP processes with explicit input and output alphabets, and test generation is expressed as counter-examples of refinement checking, mechanised using the FDR tool. Soundness is addressed through an input–output conformance relation formally defined in the CSP traces model. This purely process algebraic characterisation of testing has some potential advantages, mainly an easy automation of conformance verification and test case generation via model checking, without the need to develop any explicit algorithm.

A type reduction theory for systems with replicated components

The Parameterised Model Checking Problem asks whether an implementation Impl(t) satisfies a specification Spec(t) for all instantiations of parameter t. In general, t can determine numerous entities: the number of processes used in a network, the type of data, the capacities of buffers, etc. The main theme of this paper is automation of uniform verification of a subclass of PMCP with the parameter of the first kind, i.e. the number of processes in the network. We use CSP as our formalism. We present a type reduction theory, which, for a given verification problem, establishes a function \phi that maps all (sufficiently large) instantiations T of the parameter to some fixed type T^ and allows us to deduce that if Spec(T^) is refined by \phi(Impl(T)), then (subject to certain assumptions) Spec(T) is refined by Impl(T). The theory can be used in practice by combining it with a suitable abstraction method that produces a t-independent process Abstr that is refined by {\phi}(Impl(T)) for all sufficiently large T. Then, by testing (with a model checker) if the abstract model Abstr refines Spec(T^), we can deduce a positive answer to the original uniform verification problem. The type reduction theory relies on symbolic representation of process behaviour. We develop a symbolic operational semantics for CSP processes that satisfy certain normality requirements, and we provide a set of translation rules that allow us to concretise symbolic transition graphs. Based on this, we prove results that allow us to infer behaviours of a process instantiated with uncollapsed types from known behaviours of the same process instantiated with a reduced type. One of the main advantages of our symbolic operational semantics and the type reduction theory is their generality, which makes them applicable in a wide range of settings.

On the limits of refinement-testing for model-checking CSP

Abstract Refinement-checking, as embodied in tools like FDR, PAT and ProB, is a popular approach for model-checking refinement-closed predicates of CSP processes. We consider the limits of this approach to model-checking these kinds of predicates. By adopting Clarkson and Schneider’s hyperproperties framework, we show that every refinement-closed denotational predicate of finitely-nondeterministic, divergence-free CSP processes can be written as the conjunction of a safety predicate and the refinement-closure of a liveness predicate. We prove that every safety predicate is refinement-closed and that the safety predicates correspond precisely to the CSP refinement checks in finite linear observations models whose left-hand sides (i.e. specification processes) are independent of the systems to which they are applied. We then show that there exist important liveness predicates whose refinement-closures cannot be expressed as refinement checks in any finite linear observations model , divergence-strict model or non-divergence-strict divergence-recording model , i.e. in any standard CSP model suitable for reasoning about the kinds of processes that FDR can handle, namely finitely-branching ones. These liveness predicates include liveness properties under intuitive fairness assumptions, branching-time liveness predicates and non-causation predicates for reasoning about authority. We conclude that alternative verification approaches, besides refinement-checking, currently under development for CSP should be further pursued.

Changing system interfaces consistently: A new refinement strategy for [formula omitted

This paper is concerned with event refinement in the context of CSP ∥ B . Our motivation to include this notion within the CSP ∥ B framework is the desire to increase flexibility in the refinement process. This approach provides the ability to change the events of CSP processes and B machines when refining a system. Notions of refinement based on traces and on traces/divergences allow abstract events to be refined by sequences of concrete events. A complementary notion of refinement between B machines is also proposed, yielding compositionality results for refinement of CSP ∥ B controlled components. The paper also introduces a notion of I/O refinement into our event refinement framework.

Faster FDR Counterexample Generation Using SAT-Solving

With the flourishing development of efficient SAT-solvers, bounded model checking (BMC) has proven to be an extremely powerful symbolic model checking technique. In this paper, we address the problem of applying BMC to con- current systems involving the interaction of multiple processes running in parallel. We adapt the BMC framework to the context of CSP and FDR yielding bounded refinement checking. Refinement checking reduces to checking for reverse con- tainment of possible behaviours. Therefore, we exploit the SAT-solver to decide bounded language inclusion as opposed to bounded reachability of error states, as in most existing model checkers. We focus on the CSP traces model which is sufficient for verifying safety properties. We present a Boolean encoding of CSP processes resting on FDR's hybrid two-level approach for calculating the operational seman- tics using supercombinators. We describe our bounded refinement-checking algo- rithm which is based on watchdog transformations and incremental SAT-solving. We have implemented a tool, SymFDR, written in C++ which uses FDR as a shared library for manipulating CSP processes and the state-of-the-art SAT-solver Min- iSAT. Experiments indicate that in some cases, especially for complex combinato- rial problems, SymFDR significantly outperforms FDR.

Multiple Synchrony in MSC

We propose an extension to Message Sequence Charts (MSC); MSC diagrams comprise processes (called instances) and messages. Messages in MSC are either asynchronous or method calls. Our extension adds multiple synchronous messages. We present a transformation algorithm that takes as input a diagram in the extended MSC and generates an equivalent one in the standard MSC. The synchronous messages are transformed to the standard notation via the introduction of several control messages. We also define a semantics for MSC (both the standard and our extension) using the process algebra CSP. Both instances and messages in MSC are characterised as CSP processes. This semantics allows us to formally establish the equivalence between an extended MSC diagram and its corresponding standard diagram (generated by the transformation algorithm). Although our strategy is application independent, the motivation came from an attempt to generate test scripts from MSC diagrams describing the behaviour of mobile phone devices.

Mobile CSP||B.

CSP||B is a combination of CSP and B in which CSP processes are used as control executives for B machines. This architecture enables a B machine and its controller to interact and communicate with each other while working in parallel. The architecture has focused on sequential CSP processes as dedicated controllers for B machines. This paper introduces Mobile CSP||B, a formal framework based on CSP||B which enables us to specify and verify concurrent systems with mobile architecture instead of the previous static architecture. In Mobile CSP||B, a parallel combination of CSP processes act as the control executive for the B machines and these B machines can be transferred between CSP processes during the system execution. The paper introduces the foundations of the approach, and illustrates the result with an example.

Unifying theories in ProofPower-Z

Abstract The increasing interest in the combination of different computational paradigms is well represented by Hoare and He in the Unifying Theories of Programming (UTP). In this paper, we present a mechanisation of part of that work in a theorem prover, ProofPower-Z; the theories of alphabetised relations, designs, reactive and CSP processes are in the scope of this paper. Furthermore, the mechanisation of Circus , a language that combines Z, CSP, specification statements and Dijkstra’s guarded command language, is also presented here. We also present an account of how this mechanisation is achieved, and more interestingly, of what issues were raised, and of our decisions. We aim at providing tool support not only for CSP and Circus , but also for further explorations of Hoare and He’s unification, and for the mechanisation of languages whose semantics is based on the UTP.

Interactive tool support for CSP || B consistency checking

Abstract CSP || B is an integration of two well known formal notations: CSP and B. It provides a method for modelling systems with both complex state (described in B machines) and control flow (described as CSP processes). Consistency checking within this approach verifies that a controller process never calls a B operation outside its precondition. Otherwise the behaviour of the operation cannot be predicted. In previous work, this check was carried out by manually decomposing the model before preprocessing the CSP processes to perform a hand-written weakest precondition proof. In this paper, a framework is described that mechanises consistency checking in a theorem prover and removes the need for preprocessing. This work is based on an existing PVS embedding of the CSP traces model, but it is extended by introducing a notion of state so that the interaction between processes and machines can be analysed. Numerous rules have been defined (and proved) which enable consistency checking and decomposition via PVS proof. These rules also formally justify the relaxation of previous constraints on CSP || B architectures, thereby widening the scope of CSP || B modelling. The PVS embedding and rules presented in this paper are not only applicable to CSP || B specifications, but to other combined approaches which use a non-blocking semantics for the state-based operations.

Remarks on Testing Probabilistic Processes

We develop a general testing scenario for probabilistic processes, giving rise to two theories: probabilistic may testing and probabilistic must testing. These are applied to a simple probabilistic version of the process calculus CSP. We examine the algebraic theory of probabilistic testing, and show that many of the axioms of standard testing are no longer valid in our probabilistic setting; even for non-probabilistic CSP processes, the distinguishing power of probabilistic tests is much greater than that of standard tests. We develop a method for deriving inequations valid in probabilistic may testing based on a probabilistic extension of the notion of simulation. Using this, we obtain a complete axiomatisation for non-probabilistic processes subject to probabilistic may testing.

Compositional software verification based on game semantics and process algebra

We present an approach to software model checking based on game semantics and the CSP process algebra. Open program fragments (i.e. terms-in-context) are compositionally modelled as CSP processes which represent their game semantics. This translation is performed by a prototype compiler. Observational equivalence and regular properties are checked by traces refinement using the FDR tool. We also present theorems for parameterised verification of polymorphic terms and properties. The effectiveness of the approach is evaluated on several examples.

Processes as formal power series: A coinductive approach to denotational semantics

We characterize must testing equivalence on CSP in terms of the unique homomorphism from the Moore automaton of CSP processes to the final Moore automaton of partial formal power series over a certain semiring. The final automaton is then turned into a CSP-algebra: operators and fixpoints are defined, respectively, via behavioural differential equations and simulation relations. This structure is then shown to be preserved by the final homomorphism. As a result, we obtain a fully abstract compositional model of CSP phrased in purely set-theoretical terms.

Software Model Checking Based on Game Semantics and CSP

We present an approach for software model checking based on game semantics and CSP. Open program fragments are compositionally modelled as CSP processes which represent their game semantics. This translation is performed by a prototype compiler. Observational equivalence and verification of properties are checked by traces refinement using the FDR tool. The effectiveness of our approach is evaluated on several examples.

Structural Refinement of Systems Specified in Object-Z and CSP

Abstract. This paper is concerned with methods for refinement of specifications written using a combination of Object-Z and CSP. Such a combination has proved to be a suitable vehicle for specifying complex systems which involve state and behaviour, and several proposals exist for integrating these two languages. The basis of the integration in this paper is a semantics of Object-Z classes identical to CSP processes. This allows classes specified in Object-Z to be combined using CSP operators. It has been shown that this semantic model allows state-based refinement relations to be used on the Object-Z components in an integrated Object-Z/CSP specification. However, the current refinement methodology does not allow the structure of a specification to be changed in a refinement, whereas a full methodology would, for example, allow concurrency to be introduced during the development life-cycle. In this paper, we tackle these concerns and discuss refinements of specifications written using Object-Z and CSP where we change the structure of the specification when performing the refinement. In particular, we develop a set of structural simulation rules which allow single components to be refined to more complex specifications involving CSP operators. The soundness of these rules is verified against the common semantic model and they are illustrated via a number of examples.