Verification of Systems and Circuits Using LOTOS Petri Nets and CCS 1st Edition Yoeli 2024 Scribd Download
Verification of Systems and Circuits Using LOTOS Petri Nets and CCS 1st Edition Yoeli 2024 Scribd Download
Verification of Systems and Circuits Using LOTOS Petri Nets and CCS 1st Edition Yoeli 2024 Scribd Download
com
https://ebookname.com/product/verification-of-systems-and-
circuits-using-lotos-petri-nets-and-ccs-1st-edition-yoeli/
OR CLICK BUTTON
DOWNLOAD EBOOK
https://ebookname.com/product/biological-petri-nets-
volume-162-studies-in-health-technology-and-informatics-1st-
edition-e-wingender/
https://ebookname.com/product/modeling-and-verification-of-real-
time-systems-1st-edition-nicolas-navet/
https://ebookname.com/product/cad-of-circuits-and-integrated-
systems-1st-edition-ali-mahdoum/
https://ebookname.com/product/unraveling-french-cinema-from-l-
atalante-to-cach-1st-edition-t-jefferson-kline/
The Perfect Portfolio 1st Edition Leland B. Hevner
https://ebookname.com/product/the-perfect-portfolio-1st-edition-
leland-b-hevner/
https://ebookname.com/product/thinking-in-circles-about-obesity-
applying-systems-thinking-to-weight-management-1st-edition-tarek-
k-a-hamid-auth/
https://ebookname.com/product/automating-with-
simatic-s7-1500-configuring-programming-and-testing-with-
step-7-professional-1st-edition-hans-berger/
https://ebookname.com/product/civil-liability-in-criminal-
justice-6th-edition-darrell-l-ross/
https://ebookname.com/product/retina-5th-edition-stephen-j-ryan-
et-al/
The Films of Akira Kurosawa Donald Richie
https://ebookname.com/product/the-films-of-akira-kurosawa-donald-
richie/
VERIFICATION OF
SYSTEMS AND CIRCUITS
USING LOTOS, PETRI
NETS, AND CCS
BY
Michael Yoeli and Rakefet Kol
Technion—Israel Institute of Technology
Haifa, Israel
VERIFICATION OF
SYSTEMS AND CIRCUITS
USING LOTOS, PETRI
NETS, AND CCS
VERIFICATION OF
SYSTEMS AND CIRCUITS
USING LOTOS, PETRI
NETS, AND CCS
BY
Michael Yoeli and Rakefet Kol
Technion—Israel Institute of Technology
Haifa, Israel
Copyright # 2008 by John Wiley & Sons, Inc. All rights reserved.
No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form
or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as
permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior
written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to
the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400, fax
978-646-8600, or on the web at www.copyright.com. Requests to the Publisher for permission should
be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken,
NJ 07030, (201) 748-6011, fax (201) 748-6008.
Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts
in preparing this book, they make no representations or warranties with respect to the accuracy or
completeness of the contents of this book and specifically disclaim any implied warranties of
merchantability or fitness for a particular purpose. No warranty may be created or extended by sales
representatives or written sales materials. The advice and strategies contained herein may not be suitable for
your situation. You should consult with a professional where appropriate. Neither the publisher nor author
shall be liable for any loss of profit or any other commercial damages, including but not limited to
special, incidental, consequential, or other damages.
For general information on our other products and services please contact our Customer Care
Department within the U.S. at 877-762-2974, outside the U. S. at 317-572-3993 or fax 317-572-4002.
Wiley also publishes it books in variety of electronic formats. Some content that appears in print,
however, may not be available in electronic format.
10 9 8 7 6 5 4 3 2 1
To my spouse Nehama, with thanks for her persistent and
helpful encouragement.
Michael
1. Introduction 1
1.1 Event-Based Approach 2
1.2 Event-Based Systems 2
1.3 Types of Verification 2
1.4 Toolsets Used 3
1.5 Level-Based Approach 3
1.6 Overview of the Book 3
1.7 References 5
2. Processes 7
2.1 Introduction 7
2.2 Examples of Processes and Basic Concepts 7
2.3 About Prefixing 10
2.4 Process Graphs 10
2.5 Choice Operator 11
2.6 Another Process Example 13
2.7 Equivalences 13
2.7.1 Strong Equivalence 13
2.7.2 Observation Equivalence 14
2.7.3 Some Additional Laws 15
2.8 Labeled Transition Systems (LTSs) 15
2.9 Parallel Operators 16
2.9.1 Parallel Composition 16
2.9.2 Synchronization Operator k (Blot Version) 16
2.9.3 Examples of Parallel Compositions 17
2.9.4 More Laws 17
vii
viii CONTENTS
4. Introducing LOTOS 39
4.1 From Blot to Basic LOTOS 39
4.1.1 Recursion 40
4.2 Some Semantics 41
4.3 From LTS to LOTOS 42
4.4 Comparing Parallel Operators 43
4.5 Sequential Composition 44
4.6 Hiding 44
4.7 Equivalences and Preorders 44
4.8 About CADP 45
4.8.1 Getting Started with CADP 45
4.8.2 Verifying Equivalences and Preorders Using CADP 46
CONTENTS ix
6. Introducing CCS 95
6.1 About CCS 95
6.2 Operators ‘Prefix’ and ‘Sum’ 95
6.2.1 Semantics 96
6.3 Recursion 97
6.3.1 Semantics 97
6.4 Concurrency Operator 97
6.5 Equivalences 98
6.6 Restriction 98
6.7 CTL 99
6.7.1 Introducing CTL 99
6.8 The Concurrency Workbench (CWB) 100
6.8.1 The ‘sim’ and ‘compile’ Commands 100
6.8.2 Checking Equivalences 102
6.8.3 Checking Restrictions 103
6.8.4 HML Formulas 103
6.8.5 Equivalences—Counterexamples 104
6.8.6 More Equivalence Checking 105
6.8.7 Using the mu-Calculus 106
6.8.8 Using CTL 107
6.9 CCS and CWB Application Examples 109
6.9.1 The CCS XCEL-Circuit Example 109
CONTENTS xi
Index 229
&CHAPTER 1
Introduction
Verification of Systems and Circuits Using LOTOS, Petri Nets, and CCS, by
Michael Yoeli and Rakefet Kol
Copyright # 2008 John Wiley & Sons, Inc.
1
2 INTRODUCTION
The greater part of this text deals with system specifications and descriptions
using an event-based approach, rather than a level-based approach. Here
“event” refers to an action of the system or its environment, which may be
considered to be instantaneous; that is, its duration is negligible. In the case
of actions that take some time, we consider the event of starting the action
and the event of terminating the action.
In the event-based approach, circuits and systems are specified and
described by means of instantaneous events, which could be inputs,
outputs, or internal (non-observable) events.
In this book we will discuss several systems that are preferably specified and
described using the event-based approach. Examples of such circuits and
systems include:
Obviously, there are other examples of circuits and systems that are not
covered in this text; these include “synchronous” circuits (i.e., sequential cir-
cuits controlled by a global clock) and arithmetic units (e.g., adders and mul-
tipliers). These examples are well covered elsewhere as, for example, in (3).
We distinguish between two major types of verification. The first type, which
we refer to as “realization”, is concerned with relating behavioral
1.6 OVERVIEW OF THE BOOK 3
One outstanding feature of this text is the extensive use of three different
theories of communicating and concurrent processes, namely LOTOS and
its associated toolset CADP (see Chapter 4), Petri nets and their related
toolset PETRIFY (see Chapter 5), and CCS (Calculus of Communication
Systems) and its toolset CWB (Concurrency Workbench) (see Chapter 6).
Suitable introductions to the relevant theories and their related toolsets are
provided in Chapters 4 –6. Chapter 4 deals both with Basic LOTOS, restricted
to control aspects only, and with Full LOTOS, which also deals with the
handling of data.
Whereas the major part of this book deals with the above event-based
approach, a small part nevertheless illustrates a level-based approach. The
well-known level-based approach is widely used in connection with
the specification and description of combinational circuits, synchronous
(i.e., clock-controlled) circuits, logic–arithmetic units, and many others.
In this book we are mainly concerned with the specification and
analysis of combinational circuits (i.e., digital circuits without memory),
such as AND-gates and OR-gates. Their inputs and outputs are assumed to
be two-valued, either logic-0 and logic-1, or (alternatively) FALSE and
TRUE. For details, see Sections 3.6, 4.9, and 10.1.
1.7 REFERENCES
Processes
2.1 INTRODUCTION
VM1 : = coin;(coffee; $)
Here we use the symbol ‘:5’ to mean “is defined by.” The symbol ‘$’ denotes
the trivial behavior of doing nothing. Following LOTOS (see Chapter 4), we
will refer to the symbol ‘;’ as a prefix operator. An expression such as X;Y is
admissible only if X is an event and Y is a behavior pattern. If this is the case,
then X;Y is to be interpreted as the behavior pattern “event X, followed
Verification of Systems and Circuits Using LOTOS, Petri Nets, and CCS, by
Michael Yoeli and Rakefet Kol
Copyright # 2008 John Wiley & Sons, Inc.
7
8 PROCESSES
VM1 : = coin;coffee;$
clock := tick;tick;tick;…
2.2 EXAMPLES OF PROCESSES AND BASIC CONCEPTS 9
The above informal three-dot notation (…) may be replaced by the following
recursive definition:
clock := tick;clock
Now consider the equation
X = tick;X
where tick is an event and X is an unknown process. This equation can be
solved for the unknown process X. Hoare (1) teaches how to treat such
equations. It can be proven that the above equation X 5 tick;X has a
unique solution, which corresponds informally to the above definitions for
clock. For details, see Section 2.8 of Reference 1.
Consider now a recursive definition proc :5 seq;proc, where proc is a
process name and seq is a finite sequence of events. It is frequently con-
venient to replace such a recursive definition by the following “star-notation”:
proc :5*[seq], where the star symbol is to be interpreted as “repeat forever.”
Thus, the process clock may alternatively be defined by
clock := *[tick]
PBL := push?;on!;push?;off!;push?;on!;push?;off!;…
PBL : = push?;on!;push?;off!;PBL
10 PROCESSES
Or as
PBL : = push;on;push;off;PBL
This definition is based on the fact that after the first occurrence of the
sequence push?;on!;push?;off!; the system returns to its initial state.
Alternatively, we may use the star-notation (as in Example 2.2), and define
PBL as
PBL := *[push?; on!; push?; off!]
We have already introduced (in Section 2.2) the prefix operator ‘;’.
Note that P = a;Q implies that a is the one and only event that P is capable
of engaging in. Note furthermore that P 5a;Q implies that P is uniquely
determined, given Q and a.
This is summarized in the following law, wherein we informally use the
equals symbol ‘5’, to mean “specify the same event or behavior.” A more
formal definition is presented in Section 2.7.
This law also holds if a and b are replaced by finite sequences of events.
Using only the operators ‘;’ and ‘*’, introduced so far, we are restricted to
behaviors that can be represented by a single sequence (finite or infinite) of
events. However, we are frequently interested in behaviors represented by a
choice between different event sequences. Hence we now introduce the
choice operator ‘[ ]’.
To illustrate the usage of the choice operator, consider a vending machine
VM2 that, once a coin is inserted, lets you choose between receiving coffee
and receiving tea. Specifically, this vending machine has a “coffee” button
and a “tea” button. After you insert the coin, you should press one of these
12 PROCESSES
two buttons, and the machine will output the corresponding drink. Vending
machine VM2 may be specified by the following behavior expression:
VM2 : = coin;CM2
CM2 : = coffee;$ [ ] tea;$
coffee : = press_coffee_button;get_coffee_drink
tea : = press_tea_button; get_tea_drink
where ‘[ ]’ is the above choice operator. Similar to VM1, this machine also
functions only once.
Alternatively, this vending machine can be represented by the process graph
of Fig. 2.3. For simplicity, we have omitted the details of the compound events
coffee and tea in this figure, and we view them as a single (compound) event.
The notation P[a > Q will be used to indicate that a is one of the events P is
capable of performing, and that, after engaging in the event a, the process
P behaves as specified by process Q. Thus, in the above example,
CM2[coffee > $ and CM2[tea > $. This means that process CM2 may
engage in the (compound) event coffee, or it may engage in the compound
event tea. In both cases it will reach the null process $.
Stated generally, let P1 and P2 be processes. Their choice P1 [ ] P2 defines
the process P, which may behave either as P1 or as P2. Thus, P may be
defined as follows:
Note If P1[x > R1 and P2[x > R2, then P1 [ ] P2[x > R1 as well as P1 [ ] P2
[x > R2.
Vending machines have been used extensively by Hoare (1) to illustrate pro-
cesses. Our process examples introduced so far are modified versions of
Hoare’s machines.
2.7 EQUIVALENCES
Recall the distinction between events that are observable by an outside observer
and events that are not observable (introduced in Section 2.2). Following Basic
LOTOS (which is discussed in Chapter 4), we shall be concerned with a unique
non-observable event, denoted ‘i’. We wish to clarify under which conditions
two processes may appear equivalent to an outside observer, although they may
differ, as far as internal events are concerned. It is convenient to use process
graphs for the formal definitions of process equivalences.
(iii) If pRq and q[a . q’ in GQ, then there exists a node p’ in GP, such
that p[a . p’ and p’Rq’.
Note If in the above definition, condition (iii) is omitted, we say that process P
is a strong preorder of process Q, or process Q is a strong cover of process P.
Example 2.7 Let P1 5 a;$ [ ] b;$ and P2 5 i;a;$ [ ] b;$. Here P2 may
perform the internal action i, and become a;$. No corresponding action
is possible in P1. In view of the last sentence of our above definition of
observation-equivalence, the two processes are not observation-equivalent.
However, the two processes are again trace-equivalent.
In this section we introduce labeled transition systems (cf. Milner (2)) and
show how they are related to finite state machines as well as to processes.
A Labeled Transition System is a 4-tuple S ¼ (Q,A,T,q0), where
Max Eastman Stops Address When Disgusted Auditors Leave and Officers Arrive
Cutting his lecture short, when many of his auditors left Trinity Auditorium in
disgusted anger, probably saved Max Eastman, editor of a radical Socialist
publication, from a police intervention last night.
Before the speaker had entered far upon his subject, “Hands Off Russia,” his
remarks were deemed so unpatriotic and his unwarranted attack upon the
administration so vitriolic that scores left the auditorium and telephoned the
Federal authorities and the police, denouncing Eastman and demanding his arrest.
Apparently scenting trouble, Eastman effected a sudden diminuendo, his anti-
climax coming when he left the rostrum to conduct a canvassing of his audience for
prospective subscribers to his magazine and purchasers of stock in same. When the
police officers appeared on the scene, nothing of treasonable nor anarchistic
nature was heard.
Eastman’s address contained many statements so preposterous that even the
most gullible refused to believe them. He demanded that Eugene Debs, Thomas J.
Mooney and all I. W. W.’s in jail should be freed and advised his hearers to emulate
the Russian Bolsheviks and rise in revolution.
Only a scant audience heard the address.
As it happens, I do not have to ask the reader to take either my
word or Eastman’s about this meeting. Here is part of a letter written
to Max Ihmsen, managing editor of the “Los Angeles Examiner,” by
Rob Wagner, artist and author of “Film Folk.”
Mar. 2, 1919.
Dear Max Ihmsen:
The other night Mrs. Wagner, Charlie Chaplin and I, seeking light on darkest
Russia, went to hear Max Eastman’s lecture. During what we thought was a very
thoughtful and unimpassioned address, he made the statement that the press of
the country was in a deliberate conspiracy to withhold or color all news from that
country.
We all felt that he was unfair in including all the papers with those notorious
offenders, such as the “Times,” from which one could expect nothing else. But the
next morning we read an account of the lecture in the “Examiner” that was false
from the headline to the final sentence, which said: “Only a scant audience heard
the address.”
The lecture was not broken up by the police; in fact if there were any police
present no one even saw them. The chairman announced that Mr. Eastman would
speak on Russia; then Mr. McBride would tell them about their magazine; and
then at the end Mr. Eastman would answer questions. The program was finished
exactly that way, without the slightest interruption, and to the very sympathetic
applause of some twenty-five hundred auditors.
Nor did Mr. Eastman insult the President. In urging the withdrawal of
American troops from Russia—a policy vigorously urged by Hearst papers—he
simply stated that there was a striking inconsistency between President Wilson’s
words and his deeds; for when the President addressed his memorandum on the
Marmora conference he assured the delegates that America had absolutely no
interest in the internal affairs of Russia, and would not take sides; while at that
moment he was commander-in-chief of an army that was at war with the Russians
on two fronts.
Rob Wagner went on to explain that he wrote this protest “in the
kindliest spirit”; and Mr. Ihmsen in reply expressed his regret, and
promised to investigate the matter. You remember how it was with
the express companies in the old days; they would lose your package,
and promise to “investigate”—which meant that they filed your
complaint away with five hundred thousand others of the same sort.
Six months later I am preparing the manuscript of this book, and I
write to Mr. Ihmsen that I desire to verify every charge I bring
against American Journalism. Will he inform me if he has ever
published a correction of this falsehood? Mr. Ihmsen replies that he
has unfortunately overlooked the matter, but will be glad to publish a
correction now. He does—the very next day! I wonder if this will
seem as funny to the reader as it seems to me. Mr. Ihmsen brands
Max Eastman in the public mind as a coward and a blatherskite, and
for six months he lets that brand remain, though he knows it is
undeserved. But then suddenly he learns that he himself is to be
branded as a character-assassin; and so he makes a quick jump. But
even so, he cannot be really fair. He gave the original story half a
column; he gives the correction two inches of space, in a corner so
remote that I, who read the “Examiner” every morning, do not see it
until he sends me a marked copy!
A month or two after Max Eastman’s lecture came Louise
Bryant, freshly returned from Russia, and gave one of the most
interesting talks I have ever heard; and next morning not a line in
any Los Angeles newspaper! The following evening she spoke again,
and I came upon the platform, and called the attention of the
audience to this case of newspaper suppression, and asked for funds
to get the truth to the people of Los Angeles. Before I had finished
speaking, money began to shower upon the stage, and the total
collection amounted to twelve hundred and forty dollars. I
interviewed the assistant managing editor of the “Los Angeles
Examiner,” and he agreed to publish a report of the meeting, and
allowed me to dictate a column to a reporter—of which he published
two inches! A committee called upon the managing editor of the “Los
Angeles Times,” and this gentleman not only refused to publish a
line, but refused to accept a paid advertisement giving the news;
incidentally he flew into a rage and insulted the ladies of the
committee. The money collected at the meeting was expended upon
an edition of fifty thousand copies of a local radical paper, the “New
Justice,” containing an account of the whole affair; and when an
attempt was made to distribute these papers among the shipyard
workers in the harbor, the distributors were arrested, and the judge
declared that he wished he could get the editors of the paper.
In connection with this meeting, there was a humorous incident
which ought to be mentioned. Among the statements made by Miss
Bryant was that the Bolsheviki had taken Odessa because the French
troops had refused to fight them; several companies had gone over to
the enemy. This statement was published in the “New Justice,” and
was among those which the Los Angeles newspapers refused to
admit to their columns. Louise Bryant had travelled all over the
country making the statement, and almost everywhere the capitalist
press refused to print it. But two months later came an Associated
Press despatch from Paris; the Odessa incident had become the
subject of interpellations in the French parliament—so at last the
news was out that French troops had mutinied when ordered to fight
the Bolsheviki!
Now comest the joke of the matter. To the Associated Press
despatch, the “New York Times” added the following comment:
The account of the mutiny of the seamen on the French Black Sea Fleet, given
by M. Goude in the French Chamber, rationally explains for the first time the
extraordinary events which took place at Odessa on April 8, the day the city was
evacuated by the Allies and by all the population who could get away.
Don’t you think those words, “for the first time,” are funny?
Almost as funny as the story of “Tom Muni” from Petrograd!
And then President Wilson comes to Los Angeles, and there is
held in the largest music auditorium in the city a mass meeting of
two thousand citizens, which unanimously submits to the President a
request for amnesty for political prisoners. The “Los Angeles Times”
gave this meeting not one word. I am invited to address the City Club
of Los Angeles, and I tell them of this failure of the “Times” to report
the news. Whereupon the “Times” starts a campaign to have me put
in jail! I quote its first editorial; they have followed it up, every other
day for a couple of weeks—they are quite determined that I shall go
to jail!
Get the I. W. W. Seditionists! And lock them up. Tight! Right! But why let
Upton Sinclair roam at large? He spits more poison than the cheap skate. It is
villainy to promote anarchy in these ticklish times. Blood will be on the heads of
some of the civic club managers, male and female. It is a crime for them to invite
disloyal speakers to spout for them; just for amusement. The City Club and some of
the women’s clubs have boosted the Red cause. Bolshevism is no toy to play with,
ladies and gentlemen. An “open forum” should not be open to mobocracy and
treason.
As I have said, I know several of the men and women who help
to edit the newspaper in which the above murderous raving is
published. These men and women will read this book, and I now
request the general public to step outside for a few moments, while I
address these editors privately. I speak, not in my own voice, but in
that of an old-time journalist, venerated in his day, John Swinton,
editor of the “New York Tribune.” He is answering, at a banquet of
his fellow-editors, the toast: “An Independent Press”:
There is no such thing In America as an independent press, unless it is in the
country towns.
You know it and I know it. There is not one of you who dares to write his
honest opinions, and if you did you know beforehand that it would never appear in
print.
I am paid one hundred and fifty dollars a week for keeping my honest
opinions out of the paper I am connected with—others of you are paid similar
salaries for similar things—and any of you who would be so foolish as to write his
honest opinions would be out on the streets looking for another job.
The business of the New York journalist is to destroy the truth, to lie outright,
to pervert, to vilify, to fawn at the feet of Mammon, and to sell his race and his
country for his daily bread.
You know this and I know it, and what folly is this to be toasting an
“Independent Press.”
We are the tools and vassals of rich men behind the scenes. We are the
jumping-jacks; they pull the strings and we dance. Our talents, our possibilities
and our lives are all the property of other men. We are intellectual prostitutes.
PART III
THE REMEDY
CHAPTER LXII
CUTTING THE TIGER’S CLAWS
“STAFF” WAS FLUNKEYING IT FOR OCHS—holding the great man’s hat and
coat, if you will—while he hit the circulation ball a wallop!
CHAPTER LXV
THE PRESS SET FREE