Lemma 14.12. Bisimulation is an equivalence relation Proof. Reflexivity: P
14.3 Preservation properties
The preservation lemmas are similar to those for CCS, with some excep-tions. Most notably, as bound names can be communicated between the agents with the OPENand CLOSE-rules, any rule involving Parallel must take into account that the scope of the binders can change.
14.3.1 Output and Tau
The proofs that bisimilarity is preserved Output and Tau are straightfor-ward.
Lemma 14.13. If (P, Q) ∈ R then τ.P ,→Rτ.Q.
Proof. Follows from the definition of,→, the fact that τ.P and τ.Q can each only do aτ-action and (P, Q) ∈ R.
Lemma 14.14. If P .
∼ Q then τ.P .
∼ τ.Q .
Proof. Follows by coinduction and settingX to {(τ.P, τ.Q), (τ.Q, τ.P)}, and Lemma 14.13.
Lemma 14.15. If (P, Q) ∈ R then ab.P ,→Rab.Q.
Proof. Follows from the definition of,→, the fact that ab.P and ab.Q can each only do an output-action and (P, Q) ∈ R.
Lemma 14.16. If P .
∼ Q then ab.P .
∼ ab.Q .
Proof. Follows by coinduction, setting X to {(ab.P, ab.Q), (ab.Q, ab.P)}, and Lemma 14.15.
14.3.2 Match and Mismatch
Lemma 14.17. If P,→RQ and R ⊆ R0then [a=b]P ,→R0[a=b]Q.
Proof. Follows from the definition of,→, the MATCHinversion rule from Figure 13.4.2 and the MATCH-rule from the operational semantics. The in-version rule ensures that a = b and hence the agents can do exactly the same transitions.
Lemma 14.18. If P .
∼ Q then [a=b]P .
∼ [a=b]Q .
Proof. Follows by coinduction and settingX to {([a =b]P, [a =b]Q), ([a = b]Q, [a=b]P)}, and Lemma 14.17.
Lemma 14.19. If P,→RQ and R ⊆ R0then [a6=b]P ,→R0[a6=b]Q.
Proof. Follows from the definition of,→, the MISMATCHinversion rule from Figure 13.4.2 and the MISMATCH-rule from the operational semantics. The inversion rule ensures that a 6= b and therefore, the agents can do exactly the same transitions.
Lemma 14.20. If P .
∼ Q then [a6=b]P .
∼ [a6=b]Q .
Proof. Follows by coinduction and settingX to {([a 6=b]P, [a 6=b]Q), ([a 6=
b]Q, [a6=b]P)}, and Lemma 14.19.
14.3.3 Sum Lemma 14.21.
If P,→RQ and Id ⊆ R0and R ⊆ R0then P + R ,→R0Q + R .
Proof. Follows from the definition of,→, the SUMinversion rule from Fig-ure 13.4.2 and the SUM1 and SUM2-rule from the operational semantics. In the case where R does a transition, the assumption Id ⊆ R0is used to ensure that the derivatives remain inR0.
Lemma 14.22. If P .
∼ Q then P + R .
∼ Q + R .
Proof. Follows by coinduction and settingX to {(P + R , Q + R ), (Q + R , P + R )}, and Lemma 14.21.
14.3.4 Restriction Lemma 14.23.
P,→RQ
^R S y. (R, S) ∈ R
((νy)R, (νy)S) ∈ R0 R ⊆ R0 eqvtR eqvtR0 (νx)P ,→R0(νx)Q
Proof. Follows from the definition of,→, the SCOPEinversion rule and the OPEN, SCOPEF and SCOPEB-rules from the operational semantics. The as-sumptionVR S y. (R, S) ∈ R =⇒ ((νy)R, (νy)S) ∈ R0is used in the OPEN-case, as the restricted names are dropped from the derivatives.
Lemma 14.24. If P .
∼ Q then (νx)P .
∼ (νx)Q .
Proof. Follows by coinduction and settingX to {((νx)P, (νx)Q) : P .
∼ Q }, and Lemma 14.23.
14.3.5 Parallel
The scope migrating capabilities of the pi-calculus make the proofs for Parallel more involved than their CCS counterparts. The first step is to prove what is required for simulation to be preserved by Parallel. We will start by proving a more general lemma, in which two simulations are composed.
Lemma 14.25.
P,→RQ (P, Q) ∈ R R,→R0S (R, S) ∈ R0
^P0Q0R0S0. (P0, Q0) ∈ R (R0, S0) ∈ R0 (P0| R0, Q0| S0) ∈ R00 P | R ,→R00Q | S
Proof. Follows from the,→-I introduction rule, the PARF and PARB inver-sion rule and the PAR, COMM and CLOSE-rules from the operational se-mantics. The requirement thatR00is closed under restriction is used in the CLOSE-cases to allow for scope migration. The Isabelle proof can be found in Figure 14.1.
This lemma is more general than strictly necessary to prove that bisimilarity is preserved by Parallel. It will also be useful when we prove that bisimilarity is preserved by Replication. The lemma needed for parallel preservation is easily derivable.
Lemma 14.26.
P,→RQ (P, Q) ∈ R
^S T U. (S, T ) ∈ R
(S | U , T | U ) ∈ R0 ^S T x. (S, T ) ∈ R0 ((νx)S, (νx)T) ∈ R0 P | R ,→R0Q | R
Proof. Follows from Lemma 14.25 by setting its relationsR00toR0andR0 to the identity relation.
Before moving on to the bisimilarity part of this proof, we need to intro-duce the concept of a binding sequence.
The binders that have been discussed thus far have all been single binders in the sense that they are declared and bound one at a time. This turns out to be enough for most cases, but in bisimilarity proofs on parallel agents it becomes necessary to reason about sequences of binders. The reason for this is that the scope of binders can change using the OPENand CLOSE-rules.
A binding sequence is a finite, possibly empty, list of restrictions.
Definition 14.27 (Binding sequences). A sequence of namesy binding intoe an agent P is denoted (νy)P.e
(ν[])P = P (ν(x·y))P = (νx)(νee y)P
Figure 14.1: Isabelle proof that simulation is preserved by Parallel.
Page 1/4 lemma parCompose:
fixes P :: pi and Q :: pi and R :: pi and T :: pi
andR :: (pi × pi) set and R0 :: (pi × pi) set and R00:: (pi × pi) set assumes P,→RQ and R,→R0T and (P, Q) ∈ R and (R, T) ∈ R0
and Par:VP0Q0R0T0. [[(P0, Q0) ∈ R; (R0, T0) ∈ R0]] =⇒ (P0| R0, Q0| T0) ∈ R00 and Res:VP0Q0x. (P0, Q0) ∈ R00=⇒ ((νx)P0, (νx)Q0) ∈ R00
shows P | R ,→R00Q | T
proof(induct rule: simCases) — Apply introduction rule,→-I case(Bound a x U)
from〈x] (P | R)〉have x] P and x ] R by simp+
from〈Q | T −−−−→ Ua(νx) 〉show ∃S. P | R −−−−→ S ∧ (S, U) ∈ Ra(νx) 00 proof(induct rule: parCasesB) — Apply PARB inversion rule from
Figure 13.4.2 PAR1 case
Given that Q −−−−→ Qa(νx) 0prove that there exists an S such that P | R −−−−→ S and (S, Qa(νx) 0| T ) ∈ R00.
case(cPar1 Q0)
from〈P,→RQ〉 〈Q −−−−→ Qa(νx) 0〉 〈x] P〉obtain P0
where PTrans: P −−−−→ Pa(νx) 0and P0RQ0: (P0, Q0) ∈ R by(blast dest: elim) from PTrans〈x] R〉have P | R −−−−→ Pa(νx) 0| R by(rule Par1B)
moreover from P0RQ0〈(R, T) ∈ R0〉have (P0| R, Q0| T) ∈ R00by(rule Par) ultimately show ∃PR0. P | R −−−−→ PRa (νx) 0∧ (PR0, Q0| T) ∈ R00by blast next
PAR2 case
Given that T −−−−→ Ta(νx) 0prove that there exists an S such that P | R −−−−→ S and (S, Q | Ta(νx) 0) ∈ R00.
case(cPar2 T0)
from〈R,→R0T〉 〈T −−−−→ Ta(νx) 0〉 〈x] R〉obtain R0
where RTrans: R −−−−→ Ra(νx) 0and R0R0T0: (R0, T0) ∈ R0by(blast dest: elim) from RTrans〈x] P〉have P | R −−−−→ P | Ra(νx) 0by(rule Par2B)
moreover from〈(P, Q) ∈ R〉R0R0T0have (P | R0, Q | T0) ∈ R00by(rule Par) ultimately show ∃PR0. P | R −−−−→ PRa (νx) 0∧ (PR0, Q | T0) ∈ R00by blast qed
Page 2/4 next
case(Freeα QT0)
from〈Q | T −→ QTα 0〉show ∃PR0. P | R −→ PRα 0∧ (PR0, QT0) ∈ R00 proof(induct rule: parCasesF[where C=(P, R)]) — PARF inversion rule
PAR1 case
Given that Q −→ Qα 0prove that there exists an S such that P | R −→ S and (S, Qα 0| T ) ∈ R00.
case(cPar1 Q0)
from〈P,→RQ〉 〈Q −→ Qα 0〉obtain P0
where PTrans: P −→ Pα 0and PR: (P0, Q0) ∈ R by(blast dest: elim) from PTrans have P | R −→ Pα 0 | R by(rule Par1F)
moreover from PR〈(R, T) ∈ R0〉have (P0| R, Q0 | T) ∈ R00by(rule Par) ultimately show ∃PR0. P | R −→ PRα 0∧ (PR0, Q0| T) ∈ R00by blast next
PAR2 case
Given that T −→ Tα 0prove that there exists an S such that P | R −→ S and (S, Q | Tα 0) ∈ R00.
case(cPar2 T0)
from〈R,→R0T〉 〈T −→ Tα 0〉obtain R0
where RTrans: R −→ Rα 0and RR: (R0, T0) ∈ R0by(blast dest: elim) from RTrans have P | R −→ P | Rα 0by(rule earlySemantics.Par2F) moreover from〈(P, Q) ∈ R〉RR have (P | R0, Q | T0) ∈ R00by(rule Par) ultimately show ∃PR0. P | R −→ PRα 0∧ (PR0, Q | T0) ∈ R00by blast next
COMM1 case
Given that Q −−→ Qab 0and T −−−→ Ta [b] 0prove that there exists an S such that P | R −→ S and (S, Qτ 0| T0) ∈ R00.
case(cComm1 Q0T0a b)
from〈P,→RQ〉 〈Q −−→ Qab 0〉obtain P0
where PTrans: P −−→ Pab 0and P0RQ0: (P0, Q0) ∈ R by(blast dest: elim) from〈R,→R0T〉 〈T −−→ Tab 0〉obtain R0
where RTrans: R −−→ Rab 0and RRT0: (R0, T0) ∈ R0by(blast dest: elim) from PTrans RTrans have P | R −→ Pτ 0| R0by(rule Comm1)
moreover from P0RQ0RRT0have (P0| R0, Q0 | T0) ∈ R00by(rule Par) ultimately show ∃PR0. P | R −→ PRτ 0∧ (PR0, Q0| T0) ∈ R00by blast
Page 3/4 next
COMM2 case
Given that Q −−−→ Qa [b] 0and T −−→ Tab 0prove that there exists an S such that P | R −→ S and (S, Qτ 0| T0) ∈ R00.
case(cComm2 Q0T0a b)
from〈P,→RQ〉 〈Q −−→ Qab 0〉obtain P0
where PTrans: P −−→ Pab 0and P0RQ0: (P0, Q0) ∈ R by(blast dest: elim) from〈R,→R0T〉 〈T −−→ Tab 0〉obtain R0
where RTrans: R −−→ Rab 0and R0R0T0: (R0, T0) ∈ R0by(blast dest: elim) from PTrans RTrans have P | R −→ Pτ 0| R0by(rule Comm2)
moreover from P0RQ0R0R0T0have (P0| R0, Q0| T0) ∈ R00by(rule Par) ultimately show ?case by blast
next
CLOSE1 case
Given that Q −−→ Qax 0and T −−−−→ Ta(νx) 0prove that there exists an S such that P | R −→ S and (S, (νx)(Qτ 0| T0)) ∈ R00.
case(cClose1 Q0T0a x) from〈x] (P, R)〉have x] P and x ] R by simp+
from〈P,→RQ〉 〈Q −−→ Qax 0〉obtain P0
where PTrans: P −−→ Pax 0and P0RQ0: (P0, Q0) ∈ R by(blast dest: elim) from〈R,→R0T〉 〈T −−−−→ Ta (νx) 0〉 〈x] R〉obtain R0
where RTrans: R −−−−→ Ra (νx) 0and R0R0T0: (R0, T0) ∈ R0 by(blast dest: elim)
from PTrans RTrans〈x] P〉 have P | R −→ (νx)(Pτ 0 | R0) by(rule Close1) moreover from P0RQ0R0R0T0have ((νx)(P0| R0), (νx)(Q0 | T0)) ∈ R00
by(blast intro: Par Res) ultimately show ?case by blast
Page 4/4 next
CLOSE2 case
Given that Q −−−−→ Qa(νx) 0and T −−→ Tax 0prove that there exists an S such that P | R −→ S and (S, (νx)(Qτ 0| T0)) ∈ R00.
case(cClose2 Q0T0a x) from〈x] (P, R)〉have x] P and x ] R by simp+
from〈P,→RQ〉 〈Q −−−−→ Qa (νx) 0〉 〈x] P〉obtain P0
where PTrans: P −−−−→ Pa (νx) 0and P0RQ0: (P0, Q0) ∈ R by(blast dest: elim) from〈R,→R0T〉 〈T −−→ Tax 0〉obtain R0
where RTrans: R −−→ Rax 0and R0R0T0: (R0, T0) ∈ R0 by(blast dest: elim)
from PTrans RTrans〈x] R〉have P | R −→ (νx)(Pτ 0| R0) by(rule Close2) moreover from P0RQ0R0R0T0have ((νx)(P0| R0), (νx)(Q0 | T0)) ∈ R00
by(blast intro: Par Res) ultimately show ?case by blast qed
qed
Binding sequences recursively bind the names of a sequence to an agent.
A lemma which will be used extensively in the upcoming proofs is the following, which states what is required for a simulation to be closed under a binding sequence.
Lemma 14.28.
eqvtR ^R S x. (R, S) ∈ R
((νx)R, (νx)S) ∈ R P,→RQ (νey)P,→R(νy)Qe
Proof. By induction ony.e
Base case (y =[]): Follows immediately from the assumption P ,→e RQ.
Inductive step (y = xe x): Frome the induction hypothesis we get that (νex)P ,→R (νex)Q, and hence by Lemma 14.23 that (νx)(νex)P,→R(νx)(νex)Q
The intuition behind the lemma is quite simple. If a simulation relation R is preserved by the Restriction and P simulates Q preserving R, then sinceR is preserved by restriction and thus (νx)P simulates (νx)Q preserv-ingR for an arbitrary name x, then by induction (νx)P must simulate (νx)Q
preservingR wherex is an arbitrary chain of restricted names. The fact thate the proof is an inductive proof requires the candidate relationR to be the same in the assumptions and the conclusion. This is a general lemma which is used repeatedly when proving bisimilarites involving Parallel.
This section has touched briefly on the notion of binding sequences, and what is needed for this formalisation of the pi-calculus. Most notably, any reasoning about alpha-equivalence of agents with binding sequences has been omitted. Binding sequences is a research area in its own right and will be covered extensively in Part IV where they form an integral part of the calculi being formalised.
We can now prove that bisimilarity is preserved by Parallel.
Lemma 14.29. If P .
∼ Q then P | R .
∼ Q | R .
Proof. Follows by coinduction and settingX to {((νx)(P | R ), (νx)(Q | R )) : P .
∼ Q }, and Lemmas 14.26 and 14.28.
14.3.6 Replication
As for CCS, in order to prove that bisimilarity is preserved by the Replication, we inductively define a candidate relation which is preserved by the Replication. The scope migrating capabilities of the pi-calculus require that any candidate relation involving Parallel is preserved by restriction as well.
Definition 14.30 (bangRel). The bangRel relation is parametrised with a re-lationR.
If (P, Q) ∈ R then (!P, !Q) ∈ bangRel R.
If (R, T ) ∈ R and (P, Q) ∈ bangRel R then (R | P , T | Q ) ∈ bangRel R.
If (P, Q) ∈ bangRel R then ((νa)P, (νa)Q) ∈ bangRel R.
The predicate bangRel takes a relation as an argument, and returns a re-lation which is closed by Replication, Parallel, and Restriction. Moreover, the agents appearing on the right hand side of the |-operator are members of bangRelR; the intuition is that as with Replication the bangRel predicate can be unfolded, adding new parallel agents an arbitrary number of times.
The next step is to prove what is required of a relationR for a simulation to preserve bangRelR.