Download Full Formal Techniques for Distributed Objects Components and Systems 39th IFIP WG 6 1 International Conference FORTE 2019 Held as Part of the 14th International Federated Conference on Distributed Computing Techniques DisCoTec 2019 Kongens Lyngby Denm Jorge A. Pérez PDF All Chapters
Download Full Formal Techniques for Distributed Objects Components and Systems 39th IFIP WG 6 1 International Conference FORTE 2019 Held as Part of the 14th International Federated Conference on Distributed Computing Techniques DisCoTec 2019 Kongens Lyngby Denm Jorge A. Pérez PDF All Chapters
com
OR CLICK BUTTON
DOWNLOAD NOW
Formal Techniques
LNCS 11535
123
Lecture Notes in Computer Science 11535
Commenced Publication in 1973
Founding and Former Series Editors:
Gerhard Goos, Juris Hartmanis, and Jan van Leeuwen
Formal Techniques
for Distributed Objects,
Components, and Systems
39th IFIP WG 6.1 International Conference, FORTE 2019
Held as Part of the 14th International Federated Conference
on Distributed Computing Techniques, DisCoTec 2019
Kongens Lyngby, Denmark, June 17–21, 2019
Proceedings
123
Editors
Jorge A. Pérez Nobuko Yoshida
University of Groningen Imperial College London
Groningen, The Netherlands London, UK
This Springer imprint is published by the registered company Springer Nature Switzerland AG
The registered company address is: Gewerbestrasse 11, 6330 Cham, Switzerland
Foreword
This volume contains the papers presented at FORTE 2019: the 39th IFIP WG 6.1
International Conference on Formal Techniques for Distributed Objects, Components,
and Systems. FORTE 2019 was held as one of three main conferences of the 14th
International Federated Conference on Distributed Computing Techniques (DisCoTec),
during June 17–21, 2019 in Lyngby, Denmark.
FORTE is a well-established forum for fundamental research on theory, models,
tools, and applications for distributed systems, with special interest in:
– Software quality, reliability, availability, and safety
– Security, privacy, and trust in distributed and/or communicating systems
– Service-oriented, ubiquitous, and cloud computing systems
– Component- and model-based design
– Object technology, modularity, software adaptation
– Self-stabilization and self-healing/organizing
– Verification, validation, formal analysis, and testing of the above
The Program Committee received a total of 42 quality submissions, written by
authors from 21 different countries. Of these, 18 papers were selected for inclusion in
the scientific program: 15 full papers, one short paper, and two “journal first” papers—a
new submission category we introduced this year. Each submission was reviewed by at
least three Program Committee members with the help of external reviewers in selected
cases. There was one submission with which both of us declared ourselves in conflict;
Uwe Nestmann kindly agreed to oversee and lead the discussion for this submission,
which was eventually accepted.
The selection of accepted submissions was based on electronic discussions via the
EasyChair conference management system. Toward the end of this electronic discus-
sion, there was a two-day physical meeting in which we discussed the referee reports
for each submission with the relevant Program Committee members. We found this
combination of electronic and physical discussion highly effective.
As program chairs, we actively contributed to the selection of the five keynote
speakers of DisCoTec 2019:
– Prof. David Basin (ETH Zürich, Switzerland)
– Dr. Anne-Marie Kermarrec (Inria Rennes, France)
– Prof. Marta Kwiatkowska (University of Oxford, UK)
– Prof. Silvio Micali (MIT, USA)
– Prof. Martin Wirsing (LMU, Germany)
We are most grateful to Prof. Basin for accepting our invitation as FORTE-related
keynote speaker. This volume includes the abstract of his keynote talk: “Security
Protocols: Model Checking Standards.”
viii Preface
As is traditional in DisCoTec, a joint session with the best papers from each main
conference was organized. The best paper of FORTE 2019 was “Psi-Calculi Revisited:
Connectivity and Compositionality” by Johannes Åman Pohjola (Data61/CSIRO,
University of New South Wales, Australia).
We wish to thank all the authors of submitted papers, all the members of the
Program Committee for their thorough evaluations of the submissions, and the 26
external reviewers who assisted the evaluation process. We are also indebted to the
Steering Committee of FORTE for their advice and suggestions. Last but not least, we
thank the DisCoTec general chair, Alberto Lluch Lafuente, and his organization team
for their hard, effective work on providing an excellent environment for FORTE 2019
and all other conferences and workshops.
Program Committee
Samik Basu Iowa State University, USA
Annette Bieniusa University of Kaiserslautern, Germany
Stefano Calzavara Università Ca’ Foscari Venezia, Italy
Natalia Chechina Bournemouth University, UK
Mila Dalla Preda University of Verona, Italy
Rayna Dimitrova University of Leicester, UK
Patrick Eugster University of Lugano (USI), Switzerland
Ichiro Hasuo National Institute of Informatics, Japan
Thomas Hildebrandt University of Copenhagen, Denmark
Sophia Knight University of Minnesota, USA
Etienne Lozes I3S, University of Nice and CNRS, France
Emanuela Merelli University of Camerino, Italy
Roland Meyer TU Braunschweig, Germany
Uwe Nestmann TU Berlin, Germany
Gustavo Petri IRIF, Paris Diderot, Paris 7, France
Jorge A. Pérez University of Groningen, The Netherlands
Willard Rafnsson IT University of Copenhagen, Denmark
Anne Remke WWU Münster, Germany
Guido Salvaneschi TU Darmstadt, Germany
Cesar Sanchez IMDEA Software Institute, Spain
Ana Sokolova University of Salzburg, Austria
Alexander J. Summers ETH Zurich, Switzerland
Peter Thiemann Universität Freiburg, Germany
Jaco van de Pol Aarhus University, Denmark
Tim Willemse Eindhoven University of Technology, The Netherlands
Nobuko Yoshida Imperial College London, UK
Lukasz Ziarek SUNY Buffalo, USA
Additional Reviewers
David Basin
The design of security protocols is typically approached as an art, rather than a science,
and often with disastrous consequences. But this need not be so! I have been working
for ca. 20 years on foundations, methods, and tools, both for developing protocols that
are correct by construction [9, 10] and for the post-hoc verification of existing designs
[1–4, 8]. In this talk I will introduce my work in this area and describe my experience
analyzing, improving, and contributing to different industry standards, both existing
and upcoming [5–7].
References
1. Basin, D.: Lazy infinite-state analysis of security protocols. In: Secure Networking — CQRE
[Secure] 1999. CQRE. LNCS, vol. 1740, pp. 30–42. Springer, Heidelberg (1999)
2. Basin, D., Cremers, C., Dreier, J., Sasse, R.: Symbolically analyzing security protocols using
tamarin. SIGLOG News 4(4), 19–30 (2017). https://doi.org/10.1145/3157831.3157835
3. Basin, D., Cremers, C., Meadows, C.: Model checking security protocols. In: Clarke, E.,
Henzinger, T., Veith, H., Bloem, R. (eds.) Handbook of Model Checking, pp. 727–762.
Springer, Cham (2018)
4. Basin, D., Mödersheim, S., Viganò, L.: OFMC: a symbolic model checker for security
protocols. Int. J. Inf. Secur. 4(3), 181–208 (2005). published online December 2004
5. Basin, D.A., Cremers, C., Meier, S.: Provably repairing the ISO/IEC 9798 standard for entity
authentication. J. Comput. Secur. 21(6), 817–846 (2013)
6. Basin, D.A., Cremers, C.J.F., Miyazaki, K., Radomirovic, S., Watanabe, D.: Improving the
security of cryptographic protocol standards. IEEE Secur. Priv. 13(3), 24–31 (2015). https://
doi.org/10.1109/MSP.2013.162, http://dx.doi.org/10.1109/MSP.2013.162
7. Basin, D.A., Dreier, J., Hirschi, L., Radomirovic, S., Sasse, R., Stettler, V.: Formal analysis of
5G authentication. CoRR abs/1806.10360 (2018). http://arxiv.org/abs/1806.10360
8. Schmidt, B., Meier, S., Cremers, C., Basin, D.: Automated analysis of Diffie-Hellman pro-
tocols and advanced security properties. In: Proceedings of the 25th IEEE Computer Security
Foundations Symposium (CSF), pp. 78–94 (2012)
9. Sprenger, C., Basin, D.: Refining key establishment. In: Proceedings of the 25th IEEE
Computer Security Foundations Symposium (CSF), pp. 230–246 (2012)
10. Sprenger, C., Basin, D.: Refining security protocols. J. Comput. Secur. 26(1), 71–120
(2018). https://doi.org/10.3233/JCS-16814, http://dx.doi.org/10.3233/JCS-16814
Contents
Full Papers
1 Introduction
This paper is mainly concerned with channel connectivity, by which we mean the
relationship that describes which input channels are connected to which output
channels in a setting with message-passing concurrency. In the pi-calculus [18],
channel connectivity is syntactic identity: in the process
a(x).P | b y.Q
where one parallel component is waiting to receive on channel a and the other
is waiting to send on channel b, interaction is possible only if a = b.
a(x).P | b y.Q | (a = b)
then communication is possible. Other examples may be found in e.g. calculi for
wireless communication [19], where channel connectivity can be used to directly
model the network’s topology.
Psi-calculi [2] is a family of applied process calculi, where standard meta-
theoretical results, such as the algebraic laws and congruence properties of bisim-
ulation, have been established once and for all through mechanised proofs [3] for
all members of the family. Psi-calculi generalises e.g. the pi-calculus and the
explicit fusion calculus in several ways. In place of atomic names it allows chan-
nels and messages to be taken from an (almost) freely chosen term language.
In place of fusions, it admits the formulas of an (almost) freely chosen logic as
first-class processes. Channel connectivity is determined by judgements of said
logic, with one restriction: the connectivity thus induced must be symmetric and
transitive.
The main contribution of the present paper is a new way to define the seman-
tics of psi-calculi that lets us lift this restriction, without sacrificing any of the
algebraic laws and compositionality properties. It is worth noting that this was
previously believed to be impossible: Bengtson et al. [2, p. 14] even offer coun-
terexamples to the effect that without symmetry and transitivity, scope extension
is unsound. However, a close reading reveals that these counterexamples apply
only to their particular choice of labelled semantics, and do not rule out the
possibility that the counterexamples could be invalidated by a rephrasing of the
labelled semantics such as ours.
The price we pay for this increased generality is more complicated transition
labels: we decorate input and output labels with a provenance that keeps track
of which prefix a transition originates from. The idea is that if I am an input
label and you are an output label, we can communicate if my subject is your
provenance, and vice versa. This is offset by other simplifications of the semantics
and associated proofs that provenances enable.
– We prove, again using Nominal Isabelle, that this paper’s developments con-
stitute a conservative extension of the original psi-calculi (Sect. 3.2).
– We further validate our semantics by defining a reduction semantics and
strong barbed congruence, and showing that they agree with their labelled
counterparts (Sect. 3.2).
– We capture a pi-calculus with preorders by Hirschkoff et al. [11], that was
previously beyond the scope of psi-calculi because of its non-transitive channel
connectivity. The bisimilarity we obtain turns out to coincide with that of
Hirschkoff et al. (Sect. 4.1).
– We exploit non-transitive connectivity to show that mixed choice is a derived
operator of psi-calculi in a very strong sense: its encoding is fully abstract
and satisfies strong operational correspondence (Sect. 4.2).
For lack of space we elide proofs; please see the associated technical report [1].
2 Definitions
This section introduces core definitions such as syntax and semantics. Many
definitions are shared with the original presentation of psi-calculi, so this section
also functions as a recapitulation of [2]. We will highlight the places where the
two differ.
We assume a countable set of names N ranged over by a, b, c, . . . , x, y, z. A
nominal set [8] is a set equipped with a permutation action ·; intuitively, if X ∈ X
and X is a nominal set, then (x y) · X, which denotes X with all occurrences
of the name x swapped for y and vice versa, is also an element of X. n(X) (the
support of X) is, intuitively, the set of names such that swapping them changes
X. We write a#X (“a is fresh in X) for a ∈ / n(X). A nominal set X has finite
support if for every X ∈ X, n(X) is finite. A function symbol f is equivariant if
p · f (x) = f (p · x); this generalises to n-ary function symbols in the obvious way.
Whenever we define inductive syntax with names, it is implicitly quotiented by
permutation of bound names, so e.g. (νx)ax = (νy)ay if x, y#a.
Psi-calculi is parameterised on an arbitrary term language and a logic of
environmental assertions:
.
Definition 1 (Parameters). A psi-calculus is a 7-tuple (T, A, C, , ⊗, 1, →)
with three finitely supported nominal sets:
.
Intuitively, M → K means the prefix M can send a message to the prefix K. The
substitution functions must satisfy certain natural criteria wrt. their treatment
of names; see [2] for the details.
Note that since the abelian monoid is closed, static equivalence is preserved
by composition. Henceforth we will only consider valid psi-calculi. The original
. .
presentation of psi-calculi had ↔ for channel equivalence in place of our →,
.
and required that channel equivalence be symmetric (formally, Ψ M ↔ K iff
.
Ψ K ↔ M ) and transitive.
Definition 5 (Frames). The frame of P , written F(P ) = (νbP )ΨP where bP
bind into ΨP , is defined as
F(P ) = 1 otherwise
Psi-Calculi Revisited: Connectivity and Compositionality 7
We extend entailment to frames as follows: F(P ) ϕ holds if, for some bP , ΨP
such that F(P ) = (νbP )ΨP and bP #ϕ, ΨP ϕ. The freshness side-condition
bP #ϕ is important because it allows assertions to be used for representing local
state. By default, the assertion environment is effectively a form of global non-
monotonic state, which is not always appropriate for modelling distributed pro-
cesses. With ν-binding we recover locality by writing e.g. (νx)(x = M | P ) for
a process P with a local variable x.
The notion of provenance is the main novelty of our semantics. It is the key
technical device used to make our semantics compositional:
M (ν
x)N (output) M N (input) τ (silent)
. .
Ψ K→M Ψ M →K
In
Out
K N [
y :=L] KN
Ψ M (λ
y )N . P −−−−−−−→ P [
y := L] Ψ M N . P −−→ P
M M
α
→ P
ΨQ ⊗ Ψ P −
π
ParL α bn(α)#Q
Ψ P | Q −−−→ P | Q
π↓
bQ
α
→ Q
ΨP ⊗ Ψ Q −
π
ParR α bn(α)#P
Ψ P | Q −−−−→ P | Q
(ν
bP )π
M (ν
a)N KN
ΨQ ⊗ Ψ P −−−−−−→ P ΨP ⊗ Ψ Q −−−−−−→ Q
(ν
bP ;
x)K (ν
bQ ;
y )M
Com τ
a#Q
Ψ P |Q − a)(P | Q )
→ (ν
⊥
α α
→ P
Ψ Pi − Ψ ϕi → P
Ψ P −
π π
Case α
Scope α b#α, Ψ
: P −→ P
Ψ case ϕ Ψ (νb)P −−−→ (νb)P
π↓ (νb)π
M (ν
a)N
Ψ P −−−−−→ P b#a, Ψ, M → P
Ψ P | !P −
α
π
Open Rep
π
M (ν
a∪{b})N b ∈ n(N ) α
Ψ (νb)P −−−−−−−−→ P Ψ !P −→ P
(νb)π π↓
The operational semantics differs from [2] mainly by the inclusion of prove-
nances: anything underneath the transition arrows is novel.
The Out rule states that in an environment where M is connected to K, the
prefix M N may send a message N from M to K. The In rule is dual to Out,
but also features pattern-matching. If the message is an instance of the pattern,
as witnessed by a substitution, that subtitution is applied to the continuation P .
Psi-Calculi Revisited: Connectivity and Compositionality 9
In the Com rule, we see how provenances are used to determine when two
processes can interact. Specifically, a communication between P and Q can be
derived if P can send a message to M using prefix K, and if Q can receive a
message from K using prefix M . Because names occuring in M and K may
be local to P and Q respectively, we must be careful not to conflate the local
names of one with the other; this is why the provenance records all binding
names that occur above M, K in the process syntax. Note that even though we
identify frames and provenances up-to alpha, the Com rule insists that we con-
sider alpha-variants such that the frame binders and the outermost provenance
binders coincide. This ensures that the K on Q’s label really is the same as the
K in the provenance.
It is instructive to compare our Com rule with the original:
M (ν
a)N
ΨQ ⊗ Ψ P −−−−−−→ P
KN .
ΨP ⊗ Ψ Q −−−→ Q Ψ ⊗ ΨP ⊗ ΨQ M ↔ K
Com-Old
a#Q
τ
a)(P | Q )
Ψ P | Q −→ (ν
where F(P ) = (νbP )ΨP and F(Q) = (νbQ )ΨQ and bP #Ψ, bQ , Q, M, P and
bQ #Ψ, bQ , Q, K, P . Here we have no way of knowing if M and K are able to syn-
chronise other than making a channel equivalence judgement. Hence any deriva-
tion involving Com-Old makes three channel equivalence judgements: once each
in In, Out and Com-Old. With Com we only make one—or more accurately,
we make the exact same judgement twice, in In resp. Out. Eliminating the
redundant judgements is crucial: the reason Com-Old needs associativity and
commutativity is to stitch these three judgements together, particularly when
one end of a communication is swapped for a bisimilar process that allows the
same interaction via different prefixes.
Note also that Com has fewer freshness side-conditions. A particularly unin-
tuitive aspect of Com-Old is that it requires bP #M and bQ #K, but not bP #K
and bQ #M : we would expect that all bound names can be chosen to be distinct
from all free names, but adding the missing freshness conditions makes scope
extension unsound [14, pp. 56–57]. With Com, it becomes clear why: because
bQ binds into M .
All the other rules can fire independently of what the provenance of the
premise is. They manipulate the provenance, but only for bookkeeping purposes:
α
in order for the Com rule to be sound, we maintain the invariant that if Ψ P −
→
π
P , the outer binders of π are precisely the binders of F(P ). Otherwise, the rules
are exactly the same as in the original psi-calculi.
The reader may notice a curious asymmetry between the treatment of prove-
nance binders in the ParL and ParR rules. This is to ensure that the order of
the provenance binders coincides with the order of the frame binders, and in the
frame F(P | Q), the binders of P occur syntactically outside the binders of Q
(cf. Definition 5).
10 J. Åman Pohjola
3 Meta-theory
In this section, we will derive the standard algebraic and congruence laws of
strong bisimulation, develop an alternative formulation of strong bisimulation
in terms of a reduction relation and barbed congruence, and show that our
extension of psi-calculi is conservative. While weak equivalences are beyond the
scope of the present paper, we believe it is possible (if tedious) to adapt the
results about weak bisimilarity from [15] to our setting.
3.1 Bisimulation
α α
We write Ψ P −→ P as shorthand for ∃π. Ψ P − → P . Bisimulation is
π
then defined exactly as in the original psi-calculi:
Definition 9 (Strong bisimulation). A symmetric relation R ⊆ A × P × P
is a strong bisimulation iff for every (Ψ, P, Q) ∈ R
1. Ψ ⊗ F(P ) Ψ ⊗ F(Q) (static equivalence)
2. ∀Ψ .(Ψ ⊗ Ψ , P, Q) ∈ R (extension of arbitrary assertion)
α α
3. If Ψ P −→ P and bn(α)#Ψ, Q, then there exists Q such that Ψ Q −→
Q and (Ψ, P , Q ) ∈ R (simulation)
. .
We let bisimilarity ∼ be the largest bisimulation. We write P ∼Ψ Q to mean
. . .
(Ψ, P, Q) ∈ ∼, and P ∼ Q for P ∼1 Q.
Clause 3 is the same as for pi-calculus bisimulation. Clause 1 requires that two
bisimilar processes expose statically equivalent assertion environments. Clause 2
states that if two processes are bisimilar in an environment, they must be bisim-
ilar in every extension of that environment. Without this clause, bisimulation is
not preserved by parallel composition.
This definition might raise some red flags for the experienced concurrency
theorist. We allow the matching transition from Q to have any provenance,
irrespectively of what P ’s provenance is. Hence the Com rule uses information
that is ignored for the purposes of bisimulation, which in most cases would result
in a bisimilarity that is not preserved by the parallel operator.
Before showing that bisimilarity is nonetheless compositional, we will argue
that bisimilarity would be too strong if Clause 4 required transitions with match-
ing provenances. Consider two distinct terms M, N that are connected to the
. .
same channels; that is, for all Ψ, K we have Ψ M → K iff Ψ N → K. We
would expect M .0 and N .0 to be bisimilar because they offer the same interac-
tion possibilities. With our definition, they are. But if bisimulation cared about
provenance they would be distinguished, because transitions originating from
M .0 will have provenance M while those from N .0 will have N .
The key intuition is that what matters is not which provenance a transition
has, but which channels the provenance is connected to. The latter is preserved
by Clause 3, as this key technical lemma—formally proven in Isabelle, by a
routine induction—hints at:
Psi-Calculi Revisited: Connectivity and Compositionality 11
∼ . .
case ϕ
: (νa)P : P if a#ϕ
Ψ (νa)case ϕ (νa)(νb)P ∼Ψ (νb)(νa)P
The proofs of Theorems 1 and 2 have been mechanised in Nominal Isabelle.
Note that bisimilarity is not preserved by input, for the same reasons as the
pi-calculus. As in the pi-calculus, we can define bisimulation congruence as the
substitution closure of bisimilarity, and thus obtain a true congruence which
satisfies all the algebraic laws above. We have verified this in Nominal Isabelle,
following [2].
The fact that bisimilarity is compositional yet ignores provenances suggests
that the semantics could be reformulated without provenance annotations on
labels. To achieve this, what is needed is a side-condition S for the Com rule
which, given an input and an output with subjects M, K, determines if the input
transition could have been derived from prefix K, and vice versa:
M (ν
a)N KN
ΨQ ⊗ Ψ P −−−−−−→ P ΨP ⊗ Ψ Q −−−→ Q S
τ
a)(P | Q )
Ψ P | Q −→ (ν
12 J. Åman Pohjola
But we already have such an S: the semantics with provenances! So we can let
M (ν
a)N KN
S = ΨQ ⊗ Ψ P −−−−−−→ P ∧ ΨP ⊗ Ψ Q −−−−−−→ Q
(ν
bP ;
x)K (ν
bQ ;
y )M
Of course, this definition is not satisfactory: the provenances are still there,
just swept under the carpet. Worse, we significantly complicate the definitions
by effectively introducing a stratified semantics. Thus the interesting question is
not whether such an S exists (it does), but whether S can be formulated in a way
that is significantly simpler than the semantics with provenances. The author
believes the answer is negative: S is a property about the roots of the proof trees
used to derive the transitions from P and Q. The provenance records just enough
information about the proof trees to show that M and K are connected; with
no provenances, it is not clear how this information could be obtained without
essentially reconstructing the proof tree.
3.2 Validation
We have defined semantics and bisimulation, and showed that bisimilarity satis-
fies the expected laws. But how do we know that they are the right semantics, and
the right bisimilarity? This section provides two answers to this question. First,
we show that our developments constitute a conservative extension of the origi-
nal psi-calculi. Second, we define a reduction semantics and barbed bisimulation
that are in agreement with our (labelled) semantics and (labelled) bisimilarity.
.
Let −→o and ∼o denote semantics and bisimilarity as defined by Bengtson
et al. [2], i.e., without provenances and with the Com-Old rule discussed in
Sect. 2. The following result has been mechanised in Nominal Isabelle:
.
Theorem 3 (Conservativity). When → is symmetric and transitive we have
. .
∼o = ∼ and −→o = −→.
P −→ P
P | Q −→ P | Q α.P + Q | α.R + S −→ P | R
A parallel rule like the above would be unsound because Q might contain asser-
tions that retract some conditions needed to derive P ’s reduction. The reduction
axiom assumes prefix-guarded choice. We want our semantics to apply to the full
calculus, without limiting the syntax to prefix-guarded case statements.
But first, a few auxiliary definitions. The reduction contexts are the contexts
in which communicating processes may occur:
Psi-Calculi Revisited: Connectivity and Compositionality 13
P ≡Q Q −→ Q Q ≡ P P −→ Q
Struct Scope
P −→ P (νa)P −→ (νa)Q
.
Ψ M → N x := T]
K = L[ ∀ϕ ∈ conds(C). Ψ ϕ
Ctxt
Ψ | C[M K.P, N (λx)L.Q] −→ Ψ | P | Q[x := T ] | ppr(C)
C := PG (process) [] (hole)
C | C (parallel)
: PG [] ϕ : C [] ϕ : QG (case)
case ϕ
Let H(C) denote the number of holes in C. C[P G ] denotes the process that results
from filling each hole of C with the corresponding element of P G , where holes
are numbered from left to right; if H(C) = |P
G |, C[PG ] is undefined.
: P
ppr(case ϕ
G [] ϕ : C [] ϕ : QG ) = ppr(C) conds(PG ) = ∅
: P
conds(case ϕ
G [] ϕ : C [] ϕ : QG ) = {ϕ } ∪ conds(C)
In words, Ctxt states that if an input and output prefix occur in a reduc-
tion context, we may derive a reduction if the following holds: the prefixes are
connected in the current assertion environment, the message matches the input
pattern, and all conditions guarding the prefixes are entailed by the environ-
ment. The ppr(C) in the reduct makes sure any processes in parallel to the holes
are preserved.
14 J. Åman Pohjola
τ
Theorem 4. P −→ P iff there is P such that 1 P −→ P and P ≡ P
For barbed bisimulation, we need to define what the observables are, and
what contexts an observer may use. We follow previous work by Johansson et
al. [15] on weak barbed bisimilarity for the original psi-calculi on both counts.
First, we take the barbs to be the output labels a process can exhibit: we define
M (ν
a)N
P ↓M (νa)N (P exposes M (ν a)N ) to mean ∃P . 1 P −−−−−→ P . We write
τ
P ↓M for ∃ a, N.P ↓M (ν A)N
, and P ⇓α for P −→ ↓α . Second, we let observers
use static contexts, i.e. ones built from parallel and restriction.
.
Definition 12 (Barbed bisimilarity). Barbed bisimilarity, written ∼ , is
barb
.
the largest equivalence on processes such that P ∼ Q implies
barb
1. If P ↓M (νa)N and
a#Q then Q ↓M (νa)N (barb similarity)
.
2. If P −→ P then there exists Q such that Q −→ Q and P ∼ Q
barb
(reduction simulation)
.
a)(P | R) ∼ (ν
3. (ν a)(Q | R) (closure under static contexts)
barb
Our proof that barbed and labelled bisimilarity coincides only considers psi-
calculi with a certain minimum of sanity and expressiveness. This rules out some
degenerate cases: psi-calculi where there are messages that can be sent but not
received, and psi-calculi where no transitions whatsoever are possible.
The first clause means that no process can exhaust the set of barbs. Hence
observing contexts can signal success or failure without interference from the
process under observation. For example, in the pi-calculus MP , KP can be any
name x such that x#P . The second clause states that for swapping of distinct
names, substitution and permutation have the same behaviour. Any standard
definition of simultaneous substitution should satisfy this requirement. These
assumptions are present, explicitly or implicitly, in the work of Johansson et
al. [15]. Ours are given a slightly weaker formulation.
We can now state the main result of this section:
. .
Theorem 5. In all observational psi-calculi, P ∼ Q iff P ∼1 Q.
barb
4 Expressiveness
Recall that pi-F [25] extends the pi-calculus with name equalities (x = y) as
first-class processes. Communication in pi-F gives rise to equalities rather than
substitutions, so e.g. xy.P | xz.Q reduces to y = z | P | Q: the input and output
objects are fused. Hirschkoff et al. [11] observed that fusion and subtyping are
fundamentally incompatible, and propose a generalisation of pi-F called the pi-
calculus with preorders or πP to resolve the issue.
We are interested in πP because its channel connectivity is not transitive.
The equalities of pi-F are replaced with arcs a/b (“a is above b”) which act
as one-way fusions: anything that can be done with b can be done with a, but
not the other way around. The effect of a communication is to create an arc
with the output subject above the input subject, so x(y).P | x(z).Q reduces to
(νxy)(z/y | P | Q). We write ≺ for the reflexive and transitive closure of the
“is above” relation. Two names x, y are considered joinable for the purposes of
synchronisation if some name z is above both of them: formally, we write x y
for ∃z.x ≺ z ∧ y ≺ z.
Hirschkoff et al. conclude by saying that “[it] could also be interesting to study
the representation of πP into Psi-calculi. This may not be immediate because
the latter make use of on an equivalence relation on channels, while the former
uses a preorder” [11, p. 387]. Having lifted the constraint that channels form
an equivalence relation, we happily accept the challenge. We write ΨP for the
psi-calculus we use to embed πP . We follow the presentation of πP from [12,13],
where the behavioural theory is most developed.
TN C {x ≺ y : x, y ∈ N } ∪ {x y : x, y ∈ N }
A Pfin ({x ≺ y : x, y ∈ N }) 1 {} ⊗ ∪
.
→ the relation denoted in [13].
The prefix operators of πP are different from those of psi-calculi: objects are
always bound, communication gives rise to an arc rather than a substitution, and
a conditional silent prefix [ϕ]τ.P is included.2 These are encodable as follows:
2
We ignore protected prefixes because they are redundant, cf. Remark 1 of [12].
16 J. Åman Pohjola
a(x)
P −−−→ P F(P ) a ≺ b
b(x)
P −−→ P
.
Fix a psi-calculus P = (T, A, C, , ⊗, 1, →) with mixed choice; this will be
our source language. We will construct a target psi-calculus and an encoding such
that the target terms make no use of the case operator. The target language
E(P) adds to T the ability to tag a term M with a name x; we write Mx for the
tagged term. We write αx for tagging the subject of the prefix α with x. Tags
are used to uniquely identify which choice statement a prefix is a summand of.
As the assertions of E(P) we use A × Pfin (N ), where Pfin (N ) are the disabled
tags.
The encoding from P to E(P) is homomorphic on all operators except
assertion and choice, where it is defined as follows:
Ψ = (Ψ, ∅) α.P +β.Q = (νx)(αx .(P | (1, {x}) | βx .(Q | (1, {x})
where x#α, β, P, Q. If we disregard the tag x, we see that the encoding sim-
ply offers up both summands in parallel. This clearly allows all behaviours of
α.P + β.Q, but there are two additional behaviours we must prevent: (1) com-
munication between the summands, and (2) lingering summands firing after the
other branch has already been taken. The tagging mechanism prevents both, as
a consequence of how we define channel equivalence on tagged terms in E(P):
. .
(Ψ, N) Mx → Ny if Ψ M → N and x = y and x, y ∈
/N
That is, tagged channels are connected if the underlying channel is connected. To
prevent (1) we require the tags to be different, and to prevent (2) we require that
the tags are not disabled. Note that this channel connectivity is not transitive,
not reflexive, and not monotonic wrt. assertion composition—not even if the
source language connectivity is.
Here α⊥ denote the label α with all tags removed. It is immediate from Theo-
rem 7 and the definition of that our encoding also satisfies the other standard
quality criteria [10]: it is compositional, it is name invariant, and it preserves and
reflects barbs and divergence.
In the original psi-calculi, our target language is invalid because of non-
transitive connectivity. If we remove the requirement that tags are distinct, and
only allow separate choice (where either both summands are inputs or both
summands are outputs), the encoding is correct for the original psi-calculi.
These results generalise in a straightforward way to mixed Case state-
ments case ϕ1 : α.P [] ϕ2 : β.Q by additionally tagging terms with a condition,
i.e. Mx,ϕ1 , that must be entailed in order to derive connectivity judgements
Exploring the Variety of Random
Documents with Different Content
yet at the same time convey lastingly any high order of serious
emotion or effect. The great men doing serious work in sculpture will
never find it necessary to go beyond the law of nature for the
architectonic basis of their expression. Faulty or arbitrary proportion
in handling the human figure is unnecessary; it is of no real help to
the artist, and no more desired by him than is the liberty of 16 lines
and ballad measure, by the sonneteer expert in the Petrarchan form
and rhyme of 14 pentameter verses. The real matter to be dealt with
in respect of peculiarities of site and circumstances lies within the
sphere of the artistic capacity, and is at once more easy and more
difficult than any wooden process of mis-handling the proportions of
the figure. It is at issue in the legend of the Byzantine writer, Tzetzes,
to which reference is made, wherein it is said that Pheidias and
Alcamenes competed on one occasion with rival figures of Athene,
but the explanation given of the reason why the work of Pheidias was
admired and preferred at the site, is, I venture to say, the wrong one,
in as far as it presupposes abnormal proportions in the successful
statue. To the author’s mind, no doubt, something profound and
abstruse was necessary in order to explain such a triumph, and the
idea that Pheidias was deeply versed in what must then have been
the occult mysteries of optics and geometry, fitted the need and was
pleasant to the love of the marvellous.
‘In such a case, Pheidias would certainly, with the intuitive artistic
sense and experience of a master, handle the style, composition,
lights and shadows, mass, line and silhouette of his work in relation
to its size, and the average height and distance from which it was to
be viewed. It might be finished highly in respect of surface, or left
moderately rough, a condition of little consequence compared with
the factors enumerated above. It would be made readable and
expressive, but there would be no modification of the sacred
proportions of the figure; no trace of allowance in order that “the
upper part which is further off from the eye should appear to be in
proportion when compared with the lower, which is nearer.” That
artists should appear to give up natural truth in their images for
considerations of abstract beauty, was grateful to the mind of Plato,
but is only another proof of the soaring qualities of the White Horse
in the Human Chariot!
‘Outside of a somewhat conscious effort towards the decorative in
form and towards the effective articulation of parts, I find little in the
work of Donatello to justify his being specially singled out as
illustrating those principles of the modification of true proportions
for sculpture in relation to the exigencies of site. The statues on the
Campanile need not, I imagine, be taken too seriously as exhibitions
of Donatello’s most careful judgement. Compared with such works of
his as we may feel at liberty to believe personal, they are rude and ill-
considered in design and execution. There is in the bones, mass, and
arrangement of the work very probably something of Donatello, but
in the detail and execution there is little or nothing of the hand that
did the Christ of S. Antonio of Padua, the bronze David of the
Bargello, or the bust of Niccolo da Uzzano.’
PROPORTIONATE ENLARGEMENT.
[§ 48, Transference of the full-sized Model to the Marble Block, ante,
p. 151.]
‘To enlarge the figure proportionately in the marble.’ Vasari has
said, ante, p. 150, that the model is to be the full size of the marble so
that there would be no question of enlargement but only of
accurately copying the form of the model in the new material. For
this mechanical aids are invoked, the latest and most elaborate of
which is the ‘pointing machine’ now in common use. The appliances
in Vasari’s time were much simpler. Cellini, in his Trattato sopra la
Scultura, describes the mechanical arrangements he made for
enlarging a model to the size of a proposed colossal effigy, and the
principle is the same whether there is to be enlargement or exact
reproduction.
The model, and a block roughly trimmed by rule of thumb to the
size and shape required, but of course somewhat larger than will
ultimately be needed, are placed side by side on tables of exactly the
same form and dimensions. About the model is set up a sort of
framework simple or elaborate, according to the character of the
piece, and a framework precisely similar in all respects is disposed
about the block. A measurement is then taken from one or more
points on the framework to a point on the model, and from a point or
points similarly situated on the other framework, and in the same
relative direction, a similar measurement is led towards the block. As
this is ex hypothesi a little larger than the model, the full
measurement cannot be taken until some of the superfluous marble
has been removed by suitable tools. When this is done a point can be
established on the block exactly corresponding to the point already
fixed on the model. This process can be repeated as often as is
necessary until all the important or salient points on the model have
been successively established on the marble block, which will
ultimately have approached so nearly to the exact similitude of the
model, that the artist can finish it by the eye.
The nature of what has been termed the framework, from which all
the measurements are taken, may vary. Cellini, on the occasion
referred to, surrounded his model with a sort of skeleton of a cubical
box, from the sides and corners of which he measured. In the
Encyclopédie of Diderot and d’Alembert, of the middle of the
eighteenth century, similar square frames, like those used as
stretchers for canvases, are suspended horizontally over model and
block, and plumb lines are hung from the corners, so that skeleton
cubes are established, which would answer the same purpose as
Cellini’s box. See Plate X, A. The arrangement contemplated by
Vasari was somewhat simpler. He does not establish a complete
hollow cube about his model and his block, but is apparently
satisfied with erecting perpendiculars beside each, from which the
measures would be led. The carpenter’s square (squadra) he has in
mind consists of two straight legs joined together at right angles. If
one leg be laid horizontally along the table the one at right angles to
it will be vertical, and from this the measurements are taken. In the
treatise on Sculpture by Leon Battista Alberti there is an elaborate
description of a device he invented for the purpose in view, and one
of his editors has illustrated this by a drawing reproduced here in
Plate X, B. The device explains itself, and any number of similar
contrivances could be employed.
When these cartoons are used for fresco or wall painting, every day
at the junction with yesterday’s work a piece of the cartoon is cut off
and traced on the wall, which must be plastered afresh and perfectly
smoothed.[192] This piece of cartoon is put on the spot where the
figure is to be, and is marked; so that next day, when another piece
comes to be added, its exact place may be recognized, and no error
can arise. Afterwards, for transferring the outlines on to the said
piece, the artist proceeds to impress them with an iron stylus upon
the coat of plaster, which, being fresh, yields to the paper and thus
remains marked. He then removes the cartoon and by means of
those marks traced on the wall goes on to work with colours; this
then is how work in fresco or on the wall is carried out. The same
tracing is done on panels and on canvas, but in this case the cartoon
is all in one piece, the only difference being that it is necessary to rub
the back of the cartoon with charcoal or black powder, so that when
marked afterwards with the instrument it may transmit the outlines
and tracings to the canvas or panel. The cartoons are made in order
to secure that the work shall be carried out exactly and in due
proportion. There are many painters who for work in oil will omit all
this; but for fresco work it must be done and cannot be avoided.
Certainly the man who found out such an invention had a good
notion, since in the cartoons one sees the effect of the work as a
whole and these can be adjusted and altered until they are right,
which cannot be done on the work itself.
CHAPTER III. (XVII.)
Of the Foreshortening of Figures looked at from beneath, and of
those on the Level.
§ 79. Foreshortenings.
Our website is not just a platform for buying books, but a bridge
connecting readers to the timeless values of culture and wisdom. With
an elegant, user-friendly interface and an intelligent search system,
we are committed to providing a quick and convenient shopping
experience. Additionally, our special promotions and home delivery
services ensure that you save time and fully enjoy the joy of reading.
textbookfull.com