A Compositional Specification Theory for Component Behaviours

Abstract

Abstract. We propose a compositional specification theory for reasoning about components that interact by synchronisation of input and output (I/O) actions, in which the specification of a component constrains the temporal ordering of interactions with the environment. Such a theory is motivated by the need to support composability of components, in addition to modelling environmental assumptions, and reasoning about run-time behaviour. Models can be specified operationally by means of I/O labelled transition systems augmented by an inconsistency predicate on states, or in a purely declarative manner by means of traces.We introduce a refinement preorder that supports safe-substitutivity of components. Our specification theory includes the operations of parallel composition for composing components at run-time, logical conjunction for independent development, and quotient for incremental development. We prove congruence properties of the operations and show correspondence between the operational and declarative frameworks.

An algebraic theory of interface automata

“…Again, let t ∈ A * R be an arbitrary trace such that t A R/P = t. If t A P ∈ T P , then t ∈ T E(R) , and if t A P ∈ F P , then t ∈ F E(R) , since P || Q imp R. By the arbitrariness of t , it follows that t ∈ T R/P . This definition of quotient generalises that supplied in [6] and [4], both of which require that the interface of R/P synchronises with all actions of P. Although in this article we take A I R/P = A I R \ A I P , our definition works for any set such that A I R \ A I P ⊆ A I R/P ⊆ A R , with the results of Theorem 5 continuing to hold. In other words, the quotient operation can be parameterised on the set A I R/P of input actions of R/P.…”

“…Condition I3 ensures that P and Q are compatible, that is, they are not allowed to mix action types. In [6] we did not impose this constraint, as it is not necessary to guarantee substitutivity. However, in this article we choose to include the constraint for three reasons: (i) it is not necessarily meaningful to convert outputs into inputs during refinement; (ii) compositionality of hiding does not hold without this constraint; and (iii) mixing of action types is problematic for assume-guarantee reasoning, which deals with the behaviour of the environment.…”

“…In contrast to the definition in [6], here we give a more elaborate handling of τ transitions in order to use the same base definition for conjunction under substitutivity and progress. The original definition permitted τ transitions to proceed independently, which allows the conjunction to diverge if at least one of the components can diverge.…”

“…A preliminary version of this article appeared as [6], where we introduced the operations of parallel, conjunction and quotient, but did not consider an extension with quiescence. To demonstrate the applicability of the theory to component-based design, the quotient operation was used to synthesise mediator components in [18] and [3].…”

Assume-Guarantee Reasoning for Safe Component Behaviours

“…In earlier work [4], we introduced a component-based specification theory, in which components communicate by synchronisation of I/O actions, with the understanding that inputs are controlled by the environment, while outputs (which are non-blocking) are under the control of the component. The component-model is conceptually similar to the interface automata of de Alfaro and Henzinger [5], except that our refinement is based on classical sets of traces, as opposed to alternating simulation, and that we allow explicit specification of inconsistent traces, which can model underspecification and errors, etc.…”