Hennessy-Milner Logic Research Articles

Characteristic Formulas for Processes with Divergence

Characteristic formulae have been introduced by Graf and Sifakis to relate equational reasoning about proceses to reasoning in a modal logic, and therefore to allow proofs about processes to be carried out in a logical framework. This work, which concerned finite processes and bisimulation-like equivalences, has later on been extended to finite state processes and further equivalences. Based upon an intuitionistic understanding of Hennessy-Milner Logic (HML) with mutual recursion, we extend these results to cover bisimulation-like preorders, which are sensitive to liveness properties. This demonstrates the expressive power of intuitionistically interpreted HML with mutual recursion, and it builds the theoretical basis for a uniform and efficient method to automatically verify bisimulation-like relations between processes by means of model checking.

Model checking for action-based logics

A model checker is described that supports proving logical properties of concurrent systems. The logical properties can be described in different action-based logics (variants of Hennessy-Milner logic). The tools is based on the EMC model checker for the logic CTL. It therefore employs a set of translation functions from the considered logics to CTL, as well as a model translation function from labeled transition systems (models of the action-based logics) to Kripke structures (models for CTL). The obtained tool performs model checking in linear time complexity, and its correctness is guaranteed by the proof that the set of translation functions, coupled with the model translation function, preserves satisfiability of logical formulae.

The expressive power of implicit specifications

In this paper we investigate the expressive power of implicit specifications of concurrent systems. That is, we consider specifications S specifying a system P not directly, but rather in combination with a given environment. Formally, we shall represent the environment as a CCS context of the form ( A∣[ ][ Φ]⧹ L, where A is a process expression and ∣, ⧹ L and [Φ] are the parallel, restriction and renaming operators of CCS, respectively. We investigate the expressive power of the following three types of implicit specifications: (A∣P[Φ])⧹L≈B , (i) where ≈ is strong bisimulation equivalence and B is a process expression; (A∣P[Φ])⧹L ◁ S , (ii) where S is a modal specification and ◁ is refinement between modal specifications (a generalization of bisimulation equivalence); and (A∣P[Φ])⧹L ⊨ F , (iii) where F is a formula of Hennessy-Milner logic extended with a (maximal) recursion construct. The paper offers the following two main results. When A, B and S are recursion-free and F is a Hennessy-Milner logic formula, the expressive powers of all three types of implicit specifications are the same and equal that of Hennessy-Milner logic. When A and S are regular, the expressive powers of implicit specifications of type (ii) and (iii) are the same and identical to that of Hennessy-Milner logic extended with (maximal) recursion. Finally, we recall from [21] that the expressive power of implicit specifications does not increase by modelling the environment as other contexts (of CCS or other process calculi).

Modal logics for mobile processes

In process algebras, bisimulation equivalence is typically defined directly in terms of the operational rules of action; it also has an alternative characterization in terms of a simple modal logic (sometimes called Hennessy-Milner logic). This paper first defines two forms of bisimulation equivalence for the π- calculus, a process algebra which allows dynamic reconfiguration among processes; it then explores a family of possible logics, with different modal operators. It is proven that two of these logics characterize the two bisimulation equivalences. Also, the relative expressive power of all the logics is exhibited as a lattice. The results are applicable to most value-passing process algebras.

Graphical versus logical specifications

This paper studies the relations between two specification formalisms and verification methods for concurrent systems, namely Larsen-Thomsen's modal transition systems - here called graphical specifications - and Hennessy-Milner Logic. We show that any graphical specification may be expressed by a logical specification having the same models. Conversely, we give a characterization of the formulae that are graphically representable.

Observational structures and their logic

A poweful paradigm is presented for defining semantics of data types which can assign sensible semantics also to data representing processes. Processes are abstractly viewed as elements of observable sort in an algebraic structure, independently of the language used for their description. In order to define process semantics depending on the observations we introduce observational structures, essentially first-order structures where we specify how processes are observed. Processes are observationally related by means of experiments considered similar depending on a similarity law and relations over processes are propagated to relations over elements of non-observable sort by a propagation law. Thus an observational equivalence is defined, as union of all observational relations, which can be seen as a very abstract generalization of bisimulation equivalences introduced by David Park. Though being general and abstract our construction allows to extend and improve interesting classical results. For example it is shown that for finitely observable structures the observational equivalence is obtainable as a limit of a denumerable chain of iterations; our conditions, which apply to algebraic structures in general, when instantiated in the case of labelled transition systems, are more liberal than the finitely branching condition. More importantly, we show how to associate with an observational structure various modal observational logics, related to sets of experiment schemas, that we call pattern sets. The main result of the paper proves that for any family of pattern sets representing the simulation law the corresponding modal observational logic is a Hennessy—Milner logic: two observable objects are observationally equivalent if and only if they satisfy the same set of modal observational formulas. Indeed observational logics generalize to first-order structures various modal logics for labelled transition systems. Applications are shown to multilevel parallelism, higher-order concurrent calculi, distributed and branching bisimulation. The theory presented in the paper is not at all confined to give semantics of processes. Indeed it provides a general semantic paradigm for abstract data type specifications, where some data are processes. In order to support this claim, in the final section we briefly consider algebraic specifications and give small examples of specifications integrating processes, data types and functions.

Local model checking in the modal mu-calculus

The modal mu-calculus, due to Prat t and Kozen [Pr, Ko], is a natural extension of dynamic logic. It is also one method of obtaining a branching time temporal logic from a modal logic [EL]. Furthermore, it extends Hennessy-Milner logic, thereby offering a natural temporal logic for Milner's CCS, and process systems in general. (Discussion of the uses of the mu-calculus for CCS can be found in [GS,Ho,La,St,Sti2].) Within this context we are especially interested in whether or not a particular state, or process, in a finite model satisfies a mu-calculus formula. This is a different enterprise from that addressed by Emerson and Lei [EL] who ask if a given formula is satisfiable in a given finite model. Their model checker appeals to standard approximation techniques for computing the set of states which satisfy a fixpoint formula. But then one has to compute all the states or processes in the model which satisfy that formula. In this paper we present a local model checker for the mu-calculus, as a tableau system. It checks whether or not a particular state satisfies a formula. Instead of using approximation techniques there is an implicit use of fixpoint induction (inspired by [La]). A maximal fixpoint formula, in effect, expresses a safety property. One shows that the assumption that a state has such a property leads to no unforeseen consequences. In contrast, a minimal fixpoint formula expresses a liveness property. Therefore one has to establish that the property holds of a particular state. Formulae involving alternating fixpoints [EL] introduce subtleties. However the resulting tableau system is natural and an equivalent version of it has been implemented by Rance Cleaveland [C1]. In section 2 we describe the syntax and semantics of the modal mu-calculus. A small extension to the calculus, the addition of propositional constants, is detailed in section 3. The model checker, presented as a tableau system, is given in section 4, while the proofs of its soundness, completeness and decidability are the topic of section 6. Finally, in section 5 we use the model checker to analyse a mutual exclusion algorithm when translated into CCS.

A domain equation for bisimulation

Some basic topics in the theory of concurrency are studied from the point of view of denotational semantics, and particularly the “domain theory in logical form” developed by the author. A domain of synchronization trees is defined by means of a recursive domain equation involving the Plotkin powerdomain. The logical counterpart of this domain is described, and shown to be related to it by Stone duality. The relationship of this domain logic to the standard Hennessy-Milner logic for transition systems is studied; the domain logic can be seen as a rational reconstruction of Hennessy-Milner logic from the standpoint of a very general and systematic theory. Finally, a denotational semantics for SCCS based on the domain of synchronization trees is given, and proved fully abstract with respect to bisimulation.

A Modal Characterisation of Distributed Bisimulation

In this paper we consider the distributed bisimulation equivalence defined by Hennessy and Castellani and later developed by Castellani. We present a logic in the style of Hennessy-Milner logic to charaterize the equivalence, i.e. we seek a logic such that whenever two processes are distributed bisimulation equivalent, they satisfy the same set of formulae and vice versa. Furthermore, for a small subset of CCS we provide a proof system which is shown to be sound and complete. The proof system is structural both in the structure of formulae and in the structure of processes. For the case of parallel composition of processes we present inference rules defined via a new combinator introduced. The combinator in question is left merge, a special kind of parallel composition in which the left operand has precedence over the other and must perform the first action observed.

Proof systems for satisfiability in Hennessy-Milner Logic with recursion

An extension of Hennessy-Milner Logic with recursion is presented. A recursively specified formula will have two standard interpretations: a minimal one and a maximal one. Minimal interpretations of formulas are useful for expressing liveness properties of processes, whereas maximal interpretations are useful for expressing safety properties. We present sound and complete proof systems for both interpretations for when a process satisfies a (possibly recursive) formula. The rules of the proof systems consist of an introduction rule for each possible structure of a formula and are intended to extend the work of Stirling and Winskel. Moreover the proof systems may be presented directly in PROLOG to yield a decision procedure for verifying when a finite-state process satisfies a specification given as a (possibly recursive) formula.

A refinement calculus for specifications in Hennessy-Milner logic with recursion

Abstract This paper is about specification and verification of processes, modelled as CCS-agents. We show, by means of examples that Hennessy-Milner Logic (HML) with recursion is a suitable language for expressing implicit or partial specifications. By extending this specification language with refinement operators , i.e. operators that describe the internal structure of a system, we obtain a calculus for stepwise refinement of agents from a specification in HML to a realisation in CCS. The method is demonstrated by proving the alternating-bit protocol under weak assumptions about the unreliable media.