Synchronizing Asynchronous IOCO

Transcription

1 Synchronizing Asynchronous IOCO Ned Noroozi 1,2, Rmtin Khosrvi 3, MohmmdRez Mousvi 1, nd Tim Willemse 1 1 Eindhoven University of Technology, Eindhoven, The Netherlnds 2 Fnp Corportion (IT Subsidiry of Psrgd Bnk), Tehrn, Irn 3 University of Tehrn, Tehrn, Irn Abstrct. We present three theorems nd their proofs which enble using synchronous testing techniques such input output conformnce testing (IOCO) in order to test implementtions only ccessible through synchronous communiction chnnels. These theorems define when the synchronous test-cses re sufficient for checking ll spects of conformnce tht re observble by synchronous interction with the system under test. 1 Introduction Due to the ubiquitous presence of distributed systems (rnging from distributed embedded systems to the Internet), it becomes incresingly importnt to estblish rigorous model-bsed testing techniques with n synchronous model of communiction with the implementtion under test (IUT). This fct hs been noted by the pioneering pieces work in the re of forml conformnce testing, e.g., see [6, Chpter 5], [9] nd [10], nd hs been ddressed extensively by severl reserchers in this field ever since [2 5, 11, 12]. A widely ccepted model of synchronous testing ssumes FIFO chnnel (or number of them) s the synchronous communiction medium with the implementtion under test nd genertes test-cses using the lgorithm given for input-output conformnce testing (IOCO) [7, 8], or vrint thereof. It is wellknown tht not ll specifictions re menble to synchronous testing since they my feture phenomen (e.g., n internl choice between ccepting input nd generting output) tht cnnot be relibly observed in the synchronous setting (e.g., due to unknown delys in the synchronous setting). In other words, in order to mke sure tht test-cses generted from the originl specifiction cn test the IUT by synchronous interctions nd rech verdicts tht re meningful for the originl system, either the style of specifiction, or the test-cse genertion (or both) hs to be dopted. Relted work In [11, Chpter 8] nd [12], for exmple, both the clss of specifictions hs been restricted (to the so-clled internl choice specifictions) nd further the test-cse genertion lgorithm is dpted to generte restricted set of test-cses. Then, it is rgued (with proof sketch) tht in this setting, the verdict obtined through synchronous interction with the system coincides

2 with the verdict (using the sme set of restricted test-cses) in the synchronous setting. We give full proof of this result in Section?? nd report slight djustment to this result, without which counter-exmple is shown to violte the property. In [5] method is presented for generting test-cses from the synchronous specifiction tht re sound for the synchronous implementtion. The min ide is to tke n IOCO test-cse nd dely observing output ctions before the next observble quiescent nd this will ccount for the dely cused by the synchronous chnnel. The djustment proposed in the our pper is inspired by restriction imposed on synchronous specifictions in [5, Theorem 1]. In [3, 4] the synchronous test frmework is extended to the setting where seprte test-processes cn observer input nd output events nd reltive distinguishing power of these settings re compred. Although this frmework my be nturl in prctice, we void following the frmework of [3, 4] since our ultimte gol is to compre synchronous testing with the stndrd IOCO frmework nd the frmework of [3, 4] is nottionlly very different. For the sme reson, we do not consider the pproch of [2], which uses stmping mechnism ttched to the IUT, thus observing the ctul order input nd output before being distorted by the queues. To summrize, the present pper re-visits the much studied issue of synchronous testing nd formultes nd proves some theorems nd non-theorem tht show when it is (im)possible to synchronize synchronous testing, i.e., use the (synchronous) IOCO test-cse genertion lgorithm in order to test systems through synchronous interction. This gurntees tht the verdict obtined from using IOCO on the synchronous specifiction coincides with the verdict obtined from using IOCO (or its synchronous vrint, in cse of [11]), on the synchronous version of the specifiction, which is equipped with input nd output queues. Structure of the pper To this end, fter presenting some preliminries in Section 2, we give full proof of the min result of [11, Chpter 8] nd [12] (with slight modifiction) in Section 3. Then, in Section 4, we show tht the results of re-formulte nd strengthen the sme results in the pure IOCO setting nd show tht even under weker ssumptions on the specifiction, one cn recst the results in the IOCO setting. Finlly, in Section 5, we show tht the restriction imposed on the specifiction in Section 4 re not only sufficient to obtin the results but lso necessry nd hence chrcterize the specifictions for which synchronous testing cn be reduced to synchronous testing. The pper is concluded in Section 6. 2 Preliminries In this section, we review some common forml definitions from the literture of lbeled trnsition systems nd input-output conformnce testing [8]. II

3 Specifictions, ctions nd trces Specifictions in our pproch to model-bsed testing re in the form of lbeled trnsition systems (LTSs), defined below. Definition 1 (LTS). A lbeled trnsition system (LTS) is 4-tuple M = (Q, L {},, q 0 ), where Q is set of sttes, L is finite lphbet, / L is n unobservble ction, Q (L {}) Q is the trnsition reltion, nd q 0 Q is the initil stte. In LTSs lbels re treted uniformly while for testing, it is essentil to distinguish input nd output ctions; this is chieved in the following definition of input-output lbeled trnsition systems (IOLTSs). Definition 2 (IOLTS). An input-output lbeled trnsition system (IOLTS) is n LTS M = (Q, L {},, q 0 ), where the lphbet L is prtitioned into two sets L I nd L U, representing the input nd output lphbets, respectively. The clss of IOLTSs with L I nd L U, respectively, s the set of input- nd output lphbets is denoted by IOLT S(L I, L U ). We write q q rther thn (q,, q ) ; moreover, we write q when q q for some q, nd q when not q. The trnsition reltion is generlized s follows: Definition 3 ((Wek) Trnsitions nd Trces). Given n IOLTS (Q, L {},, q 0 ) nd q, q, q i Q,, i L {} nd σ L, the notions of (wek) trnsition nd trce re defined s follows. 1. q = q = def (q = q ) q 0,..., q n (q = q 0 q 1... q n 1 q n = q ) 2. q = q = def q 1, q 2 q = q 1 q 2 = q 3. q 1...n = = def q 0,..., q n q = q 1 0 = q1...q n n 1 = qn = q In line with our nottion for trnsitions, we write q = if there is q such tht q = σ q, nd q = σ when no q exists such tht q = σ q. Definition 4 (Initil nd After-Sttes). Given n IOLTS (Q, L {},, q 0 ), some q Q, S Q, we define: 1. init(q) = def { q }, nd we set init(s) = def q S init(q) 2. Sinit(q) = def { q = }, nd we define Sinit(S) = def q S Sinit(q) A stte in n LTS is sid to diverge if it is the strt of n infinite sequence of -lbeled trnsitions. Quiescence, defined below, is n essentil notion for conformnce testing; it chrcterizes system stte tht cnnot produce outputs nd is stble, i.e., it cnnot evolve to nother stte by performing silent ction. Definition 5 (Quiescence (under queue context)). A stte q Q is clled quiescent, denoted by δ(q), when init(q) L I ; it is clled quiescent under queue context, denoted by δ q (q), iff Sinit(q) L I. σ III

4 The notion of quiescence under queue context refers to the synchronous setting where quiescence cnnot be observed directly (i.e., the tester cnnot observe whether the system under test is engged in some internl trnsitions or hs come to stndstill) nd hence the system is considered quiescent when it cnnot show ny observble output even fter performing some internl trnsitions. In prctice, this is implemented by timeout mechnism which is set to the mximum witing time before producing outputs. By the sme token, in n synchronous setting it becomes impossible to distinguish divergence from quiescence; we re-visit this issue in our proofs of synchronizing synchronous conformnce testing. Next, we define the notion of test-cse, which is tree-shped IOLTS prescribing when n input should be fed to the implementtion under test nd when its possible outputs should be observed leding to lef of the tree lbeled with the pss- or the fil verdict. In test cse, the observtion of quiescence is modeled using θ symbol. TW: this definition does not sound right to me; why omit θ in one cse? fter ll, it is n observed output Definition 6 (Test cse). Given n input lphbet L I nd n output lphbet L U, test cse t is n IOLT S t = Q, L U L I {θ}, T, q 0, where Q is finite set of sttes rechble from q 0 Q contining two distinct terminl sttes pss nd fil, θ is fresh lbel (θ / L I L U {}), T is n cyclic nd deterministic trnsition reltion where pss nd fil sttes pper only s trgets of trnsitions lbeled by n element of L U {θ} nd for ech non-terminl stte q Q, it holds tht init(q) = L U {} for some L I {θ}. The clss of test cses for the sets of L I of input lbels nd L U of output lbels, is denoted by T T S(L U, L I ) (note tht the order of input nd output re reversed: outputs of the system re inputs of the test-cse nd vice vers). A test suite T is defined set of test cses, i.e. T T T S(L U, L I ). Definition 7 (Synchronous execution). Given test cse t T T S(L U, L I ), n IUT i IOLT S(L I, L U ), nd let L, then the synchronous test cse execution opertor is defined by the following inference rules: i i t i t i (R1) t t, i i t i t i (R2) θ t t, δ(i) (R3) θ t i t i Definition 8 (psses). Given n implementtion i IOLT S(L I, L U ) nd test cse t T T S(L U, L I ), then i psses t def σ (L {θ}), i σ t i = fil i. 3 AIOCO Settings In order to perform conformnce testing in the synchronous setting, in [11] nd [12], both the clss of specifictions nd test cses hve been restricted to the so-clled internl choice specifictions. Then, it is rgued (with proof sketch) tht in this setting, the verdict obtined through synchronous interction with the system coincides with the verdict (using the sme set of restricted test-cses) IV

5 in the synchronous setting. In this section, we re-visit the pproch of [11] nd [12], give full proof of their min result nd point out slight imprecision in it. 3.1 Internl Choice Specifictions Asynchronous communiction delys obscure the observtion of the tester; for exmple, the tester cnnot precisely estblish when the input sent to the system is ctully consumed by it. Hence, if the specifiction produces different outputs bsed on the exct point of time when n input is consumed (so-clled externlchoice), the verdict of synchronous tester my be different from tht of n synchronous one. Hence, in [11, 12], the clss of specifictions is restricted to those in which the choice bout the exct moment of input is not determined by the tester but by the specifiction itself, leding to internl-choice specifictions. Exmple 1. Figure 1 shows the difference between internl nd externl choice specifictions. In the IOLTS m 0, there is rce between input nd output. Thus the tester controls the test execution nd bsed on the exct moment of performing the input trnsition, cn decide whether the pproprite output is produced or not (i.e., it rejects n implementtion which produces 1! output fter feeding n? to the system). This exct moment of time is not visible in synchronous testing nd hence, synchronous testing my ccept n implementtion which is rejected by the synchronous testing (i.e., the tester my provide n? to the system, but before its consumption, the system my produce 1! output). Although IOLTS n 0 does not feture n immedite rce between input nd output ctions, the tester cn rule out the possibility of output 1! by providing input?. Agin this kind of control is not vilble to n synchronous tester nd hence this kind of specifiction flls beyond the internl-choice ctegory. All other IOLTS s depicted in Figure 1 fll into the internl-choice ctegory. For exmple, in the IOLTS strting from i 0, the tester cn rule out the possibility of being in the initil stte by observing quiescence; in tht cse the user cn mke sure tht by providing n input to the system it will be consumed by the system nd no output is llowed to be produced. m 0 n 0 i 0 r 0 c 0? 1!? 1!??? 1!? 1! 1!?? 1! 1!? Fig. 1. Input-output lbeled trnsition systems with different choice e 0 These observtions hs led into the the following definition of internl-choice specifiction in [11, 12]. V

6 Definition 9. A given LTS M = (Q, L I L U {},, q 0 ) is n internl choice LT S (L I, L U ), if input ctions re enbled only in quiescent sttes, i.e. q Q, ( L I init(q)) implies δ(q). we hven t sid nything bout input enbledness yet! So this prgrph hd better to be rephrsed, mybe By observing quiescence before ny input, the tester will provide n input for the implementtion only when it is redy to ccept it. Hence implementtion doesn t need to be ssumed input enbled t ny stte. It is sufficient tht implementtion ccept ll inputs t sttes which the quiescence is observble. Definition 10. An internl choice input output trnsition system (IOT S (L I, L U )) is n internl choice IOLT S (L I, L U ) where ll input ctions re enbled (possibly preceded by trnsitions) in quiescent sttes, L I, q Q (δ(q) implies q ). θ! θ 1? fil t 0 pss pss t 0 θ 1?! pss θ 1? fil Fig. 2. An exmple of internl choice test cse Definition 11 (Internl choice test cse). An internl choice test cse (T T S ) is n T T S M = Q, L U L I {θ}, T, q 0, where ny stte q Q with init(q) L I is only rechble by θ-lbeled trnsitions. Exmple 2. The left nd right IOLTS s in figure 2 show internl test cses of IOLT S (L I, L U ) c 0 nd i 0 in figure 1 respectively. Outputs (inputs of implementtion) re enbled only in sttes rechble by θ-trnsitions. Property 1. In n internl choice test execution, following properties lwys hold: 1. t σ. t nd L I implies tht σ σ = σ.θ. 2. t i σ. t i nd L I implies tht σ σ = σ.θ. 3.2 Asynchronous Specifictions Asynchronous communiction, s mentioned in [6, Chpter 5], cn be simulted by composition of two FIFO chnnels with implementtion, one for input nd one for output. Tester puts its stimulus in the input queue nd get the outputs of the implementtion from the output queue. Also, communiction between tester nd implementtion equipped with FIFO queues is done synchronously. In the following definition, the behvior of FIFO chnnels re formlly defined. VI

7 Definition 12 (Queue opertor). Let σ i L I nd σ u L U, then the unry queue opertor [σu. σi]: LT S(L I, L U ) LT S(L I, L U ) is defined by the following two xioms [σ u S σi] [σu S σ i ], L I (A1) x [x σ u S σi] [σu S σi], x L U (A2) nd by the following inference rules: [σ u S σi] S S [σu S σ i] S S, L I [σ u S σ i] x [σu S σ i] S S, x L U [σ u S σi] [σ u x S σ i] The initil stte of queue context contining n LTS S is given by Q(S) = def [ S ]. Property 2. Let i, i IOT S(L I, L U ), t, t T T S(L U, L I ) nd σ (L {θ}) then, σ 1. i = i implies Q(i) = σ Q(i ) σ 2. t i = t i implies t Q(i) = σ t Q(i ) 3. Sinit(t i) = Sinit(t Q(i)). Proposition 1. For ech i, i IOT S(L I, L U ), t T T S(L U, L I ), σ i, σ i L I nd σ u, σ u L U the following sttements hold: 1. i = i iff t i = t i (R 1 ) σ i = [σu S σi.σ i ], σ i L I ). (A 1 2. [σu S σi] σ u 3. [σ u.σ u S σi] = [σu S σi], σ u L U (A ) [σu i σi] = [σu i σ i] iff i = i (I ) [σu i σi.σ i ] = [σu i σ i ] iff i = σi i (I ) [σu i σi] = [σu.σ u i σ i] iff i σ u = i (I 3 ). Corollry 1. For ech i, i IOT S(L I, L U ), t, t T T S(L U, L I ), nd x x {L U θ}, if t Q(i) = t Q(i ), then the following two sttements hold: x 1. t t nd x 2. Q(i) = Q(i ). Moreover, if x = θ, then δ q (Q(i)) nd δ q (Q(i )) re concluded. Corollry 2. For ech i, i IOT S(L I, L U ) nd t, t T T S(L U, L I ), t Q(i) = t Q(i ) L I concludes the following: 1. t t 2. Q(i) = Q(i ). Moreover, if i IOT S (L I, L U ), then i IOT S (L I, L U ) i = i = i δ(i ). (I1) (I2) (I3) VII

8 3.3 Synchronizing Theorem for AIOCO It is rgued in [12, 5], if n input is provided to the IUT only fter observing quiescence (i.e., in stble stte), the queue cnnot distort the order of observtions nymore. Hence, subset of synchronous test-cses, nmely those which only provide n input fter observing quiescence, re sufficient for testing synchronous systems. This is summrized in the following theorem from [12, 11] (nd with slightly different formultion in [5]): Theorem 1 (non-theorem). Let i IOT S (L I, L U ) nd t T T S (L U, L I ), then i psses t Q(i) psses t. The theorem however, does not hold in its full generlity s illustrted by the following exmple. Exmple 3. Running test cse t in figure 2 synchronously with c= IOT S (L I, L U ) in figure 1 my result in fil, though c psses t. In fct IOT S (L I, L U ) c hs loop which is considered quiescence in queue context(δ q (c)). By omitting diverging IOLTS from the internl choice specifictions, we restrict the domin of the internl choice specifictions to be ble to prove the theorem given in [12, 11]. Theorem 2. Let i IOT S (L I, L U ) nd t T T S (L U, L I ) nd i doesn t diverge then i psses t Q(i) psses t. Unfortuntely, only proof sketch is provided in [12, 11] for Theorem 1 nd our order of business in this section is to give full proof for its corrected version, Theorem 4. (In [5] only the theorem is mentioned without forml proof.) To this end, we need number of uxiliry lemmt nd corollries, given below. In the following lemm, we show tht if δ q (Q(i)), then either i is quiescent stte or i cn rech quiescent stte by tking finite -steps. As we mentioned in Exmple 3, if i cn diverge, then Q(i) is considered quiescent, though i neither is quiescent or rech quiescent stte. This my led to wrong verdict in the test execution. Lemm 1. Let i IOT S (L I, L U ), then δ q (Q(i)) implies tht i IOT S (L I, L U ) such tht i = i δ(i ) Proposition 2. Let s, s IOT S (L I, L U ), T T S T = Q, L U L I {θ}, T, q 0, t, t Q nd σ (L {θ}) σ. Then t Q(s) = t [σu s σ i] implies tht there exists s IOT S (L I, L U ) such tht t Q(s) = σ t Q(s ) Corollry 3. Let s, s IOT S (L I, L U ), T T S T = Q, L U L I {θ}, T, q 0, t, t Q nd σ (L {θ}) σ. Then t Q(s) = t Q(s ) nd σ = σ.x with σ (L {θ}) nd x (L {θ}) implies tht there exist s IOT S (L I, L U ) nd t Q such tht t Q(s) = σ t Q(s x ) = t Q(s ). VIII

9 Lemm 2. Let s, s IOT S (L I, L U ), T T S T = Q, L U L I {θ}, T, q 0, t, t Q nd σ (L {θ}) σ. Then t Q(s) = t Q(s ) implies tht there exists non-empty subset of (s fter ) like S such tht q S t s = σ t q Sinit(t Q(s )) = q S Sinit(t q). Proof. We prove this lemm by induction on the length of σ (excluding tutrnsition). Assume for the induction bsis tht the length of σ is 0; thus it follows from the item 4 in Proposition 1 tht s = s. We clim S = {q s = q}. It follows from the item 1 in Proposition 1 tht q S we hve t s = t s nd t s = t q. Combintion of the two trnsition culminte in t s = t q which is the first property of S nd Sinit(t Q(s )) = q S Sinit(t q) is concluded from item 2 in Definition 4 s well. Thus S holds the two properties which ws to be shown. For the induction step, ssume tht the thesis holds for ll σ with length n 1 or less nd length of σ is n. It follows from the item 3 in Definition 3 nd Corollry 3 tht there exist i n 1 IOT S (L I, L U ), t n 1 T T S (L U, L I ) nd σ n 1 (L θ) nd x (L θ) such tht σ n = σ n 1.x nd t Q(s) σn 1 = t x n 1 Q(i n 1 ) = t n Q(s ). Induction hypothesis follows tht S n 1 (i n 1 fter ) ( q S n 1 t s σn 1 = t n 1 q n 1 ) nd Sinit(t n 1 Q(i n 1)) = q S n 1 Sinit(t n 1 q). We distinguish three cses, bsed on the type of x: either it is θ, n input ction or n output ction. x = θ x L I θ Corollry 1 nd t n 1 Q(i n 1) = nd Lemm 1 conclude tht there exists n i IOT S (L I, L U ) such tht i n 1 = s = i nd i is quiescent. We clim tht S n = {q (S n 1 fter ) s = q δ(q)}. Definition of Sinit() (item 2 in Definition 4) results ll member of S n 1 re either quiescent or leding to quiescent stte fter some steps, thus S n is not empty nd lso S n S n 1. It is concluded from induction hypothesis tht q S n q S n 1 t s σn 1 = t n 1 q = t n 1 q θ t q is concluded. Combintion of the two trnsition shows tht q S n t s = σn t n q. Hence the first property is held by S. Q(s ) is quiescent (δ q (Q(s ))), thus Sinit(t Q(s )) = L I {θ}. On the other hnd, definition of Sinit() culmintes in Sinit(t q) = L I {θ} for ll member of S. Thus init(t Q(s )) = q S n init(t q) nd the second property is held by S s well. It follows from induction hypothesis nd Definition 10 tht ll member of S n 1 re quiescent, thus they cn perform ny input ction. We clim tht S n = {q q x = q q S n 1 s = q}. It follows from Corollry 1 tht i IOT S (L I, L U ) i n 1 = i x = s δ(i ). According to the definitions of S n 1 nd S n, it is cler tht i S n 1 nd i n S n, thus S n cnnot be empty nd it hs t lest one member. Induction hypothesis results tht q S n q S n 1 t s σn 1 = t n 1 q x = t q, thus the first property is held by S n. Since s S n, it is cler tht Sinit(t s ) q S Sinit(t q). For ech member of S such s q S n, we hve Sinit(t q) Sinit(t s ), thus q S Sinit(t q) Sinit(t s ) s well. These observtions led to Sinit(t s ) = q S Sinit(t q). Property 2 IX

10 leds to Sinit(t Q(s )) = q S Sinit(t q). Thus S n holds the two required properties which ws to be shown. x L U We clim tht S n = {q q x = q q S n 1 s = q}. It follows from the induction hypothesis tht q S n q S n 1 t s σn 1 = t n 1 q x = t q. Hence S n holds the first property. By Corollry 1 we know tht i IOT S (L I, L U ) i n 1 = i x = i n, thus i S n 1 nd subsequently s S n. These results show tht S is not empty nd it hs t lest one member. Since s S n, it is cler tht Sinit(t s ) q S Sinit(t q). For ech member of S such s q, we hve Sinit(t q) Sinit(t s ), thus q S Sinit(t q) Sinit(t s ) s well. These observtions led to Sinit(t s ) = q S Sinit(t q). Property 2 leds to Sinit(t Q(s )) = q S Sinit(t q). Thus S n holds the two required properties which ws to be shown. Using the lemms given bove we re ble to provide the proof of Theorem 4 s follows. Proof of Theorem 4. We prove ech impliction by contrdiction method. Assume, towrds contrdiction, tht i psses t doesn t imply tht Q(i) psses t. It follows from Definition 8 tht σ (L {θ}) i IOT S σ (L I, L U ) t i = fil i nd σ (L θ) i IOT S (L I, L U ) t Q(i) = σ fil i. Corollry 3 follows t Q(i) = σ t Q(i x ) = fil i, with σ (L {θ}) nd σ = σ.x. According to Definition 6, we know tht test cse only by observing either n output ction or θ reches fil stte, thus x is either n output or θ. Corollry 1 results in t x fil. Lemm 2 concludes tht S (i fter ) q S t i = σ t q Sinit(t Q(i )) q S Sinit(t q). Thus there must exist n s S such tht t s =. x According to the previous observtion t fil. Hence there exists pth x leding t i to fil i stte nd this is in contrdictory to our ssumption tht i psses t. proof of the left impliction is lmost identicl to the right impliction. Assume, towrds contrdiction tht Q(i) psses t doesn t imply tht i psses t. It follows from Definition 8 σ (L θ) i IOT S (L I, L U ) σ t Q(i) = fil i σ (L θ) i IOT S (L I, L U ) t i = σ fil i. Property 2 shows the behvior of synchronous context includes the behvior of synchronous context, thus t i = σ fil i results in t Q(i) = σ fil Q(i ). Hence there is pth leding t Q(i) to fil i nd this contrdicts our ssumption tht Q(i) psses t. 4 IOCO Settings In this section, we im t re-csting the results of the previous section to the setting with the originl IOCO test-cse genertion lgorithm. We first define X

11 IOCO nd its test-cse genertion lgorithm below nd then show tht the results of the previous section cnnot be trivilly generlized to the IOCO-setting. Then using n pproch inspired by [6, Chpter 5] nd [5], we show how to re-formulte Theorem in this setting. 4.1 Specifictions nd Test Cses Input output lbeled trnsition systems (IOLTS) re llowed to under-specify the behvior of system; this is chieved by selectively omitting input ctions in the behviorl model. The testing hypothesis underlying the IOCO theory, however, sttes tht implementtions re lwys input enbled. Formlly, implementtions rnge over input-output trnsition systems, formlly defined below. Definition 13 (IOTS). An input-output trnsition system (IOTS) is n IOLTS in which ll input ctions re enbled (possibly preceded by -trnsitions) in ll sttes. The IOTS subset of IOLT S(L I, L U ) is denoted by IOT S(L I, L U ). Informlly, the ioco reltion sttes tht n implementtion shown by n IOTS conforms given specifiction modeled in IOLTS iff the observble behviors of n implementtion re lso vlid observble behviors of the specifiction. In the context of IOCO, the observble behviors re essentilly trces, clled suspension trces, consisting of inputs, outputs nd observtions of quiescence. For given set of sttes Q nd trnsition reltion Q (L {}) Q, suspension trces re defined through n uxiliry trnsition reltion = δ Q (L {δ}) Q, specified through the following deduction rules: q = δ q q σ = δ q δ(q ) q σδ = δ q q σ = δ q q x = q q σx = δ q Definition 14 (Suspension trces). Assuming n IOLTS (Q, L {},, q 0 ), the suspension trces of stte q Q re Strces(q) = def {σ L δ q = σ δ }. Definition 15. Given n IOLTS (Q, L {},, q 0 ), some q Q, S Q, L nd σ (L {δ}), we define: 1. out(q) = def { L U q } {δ δ(q)}, nd we set out(s) = def q S out(q) 2. q fter σ = def {q q σ = δ q }, nd we set S fter σ = def q S q fter σ Definition 16 (IOCO). Let i IOT S(L I, L U ) nd s LT S(L I, L U ) then i ioco s def σ Strces(s) out(i fter σ) out(s fter σ). Algorithm 17 (IOCO test cse genertion) Let s LT S(L I, L U ) be specifiction, nd let S initilly be S = s fter. A test cse t T T S(L U, L I ) is obtined from non-empty set of sttes S by finite number of recursive pplictions of one of the following three nondeterministic choices: 1. t :=pss XI

12 2. t := ; t Σ{x j ;fil x j L U, x j / out(s)} Σ{x i ; t xi x i L U, x i out(s)} where L I such tht S fter, t is obtined by recursively pplying the lgorithm for the set of sttes S fter, nd for ech x i out(s), t xi is obtined by recursively pplying the lgorithm for the set of sttes S fter x i. 3. t := Σ{x j ;fil x j L U, x j / out(s)} Σ{θ;fil δ / out(s)} Σ{x i ; t xi x i L U, x i out(s)} Σ{θ; t θ δ out(s)} where for ech x i out(s), t xi is obtined by recursively pplying the lgorithm for the set of sttes S fter x i nd t θ is obtined by recursively pplying the lgorithm for the set of sttes S fter δ. pss! θ 1? t 0 1? fil pss Fig. 3. An exmple of IOCO test cse Exmple 4. Figure 3 shows test cse for IOLTS i 0 in Figure 1 which is generted ccording to ioco test cse genertion lgorithm( Algorithm 17). Although IOLTS i 0 is internl choice, test cse t 0 in Figure 3 feeds input to the implementtion without observing quiescence despite of test cse t 0 in Figure 2. Consider sequence?.1! which leds t 0 to fil stte. In queue context, the execution t 0 Q(i 0 ) = t 0 [1 i 1 ] t 1 [1 i 1 ] fil [ i 1 ] is possible? 1! which leds to fil stte but?.1! / Strces(t 0 e 0 ). Hence s we cn see in this exmple, Theorem 4 cnnot be generlized to the IOCO-setting. 4.2 Synchronizing Theorem for IOCO In this section, we investigte specifictions whose synchronous IOCO test cses re sound for synchronous execution s well. To this end, we first consider the reltion between trces of system nd its queue context s. In fct, trces in queue context re reordered in respect to their originl one by preceding input ctions to output ctions. Definition 18 (Dely reltion). 1. The L L is defined s the smllest reltion such tht: XII

13 () if σ 1, σ 2 L I, then σ 1@σ 2 = def σ 1 σ 2, where denotes the trceprefix pre-order, (b) if σ 1 = ρ 1.x 1.σ 1, σ 2 = ρ 2.x 2.σ 2, with ρ 1, ρ 2 L I, x 1, x 2 L U, nd σ 1, σ 2 L, then σ 2 = def ρ 1 ρ 2 nd x 1 = x 2 nd σ 1@(ρ 2 \ ρ 1 ).σ 2 2. if σ 2, then the opertion \\ is defined by () if σ 1, σ 2 L I, then σ 2 \\σ 1 = def σ 2 \ σ 1 (b) if σ 1 = ρ 1.x 1.σ 1, σ 2 = ρ 2.x 2.σ 2, with ρ 1, ρ 2 L I, x 1, x 2 L U, nd σ 1, σ 2 L, then σ 2 \\σ 1 = def (ρ 2 \ ρ 1 ).σ 2 \\σ 1 Definition 19 (Fixed Dely reltion). The L L is defined s if σ 1, σ 2 L nd σ σ 2 then σ 2 nd σ 1 = σ 2. Corollry 4. Let S IOLT S(L I, L U ) nd σ 1, σ 2 (L I L U ), then 1. σ 2 nd σ 1 trces(s) imply σ 2 trces(q(s)) 2. σ 2 nd σ 1 trces(q(s)) imply σ 2 trces(q(s)) 3. σ 2 trces(q(s)) implies tht σ 1 trces(s) σ 2 Corollry 4.2 expresses tht trces(q(s)) is right-closed with respect to Definition 20 ((Fixed) Dely right-closure). Set s is (fixed) delyed rightclosed if σ 2 (σ σ 2 ), with σ 1, σ 2 L then σ 1 S implies σ 2 S. Definition 21 ((Fixed) Dely right-closed IOLTS). A given LTS M = (Q, L I LU {, δ}) is (fixed) dely-right-closed (LT (L I, L U ))LT (L I, L U ), if q Q σ Strces(q), ( x L U, L I x init(q fter σ) init(q fter σ)) implies Strces((q fter σ)) is (fixed) dely right-closed. Definition 22 ((Fixed) Dely right-closed IOTS). A dely-right-closed input output trnsition system IOT (L I, L U ), is (fixed) dely-right-closed (IOLT (L I, L U )) IOLT (L I, L U ) where ll input ction is enbled (possibly preceded by -trnsition) in ll sttes. b? 1! b?? 2! 1!? s 0 2! 1! b? 2! r 0 b? 1! 2!? 2! Fig. 4. Exmples of delyed right-closed IOLTS XIII

14 Exmple 5. Figure 4 shows two IOLT S for L I = {, b} nd L U = {1, 2} s input nd output lphbet respectively. In IOLTS s 0, {, b} init(s 0 fter ) nd x init(s 0 fter ) s well. Also, Strces(s 0 fter ) = {(b?) 1!(b?)?2!, (b?)?1!, (b?)?2!} nd due to Definition 20, Strces(s 0 fter ) is fixed delyed right-closed. Thus IOLTS s is fixed dely right-closed IOLT Similrly, IOLTS r is IOLT too. As stted in the following theorem, the results of test execution of n IOCO test cse with n IOT implementtion re sme in both synchronous nd synchronous environment. Theorem 3. i IOT t T T S ioco then i psses t Q(i) psses t. To prove this theorem we first show, s expressed in the following lemm, tht i nd its queue context, Q(i) hve unique suspension trces set. Lemm 3. Let LTS M = (Q, L I L U {}) IOT (L I, L U ) nd i Q nd σ (L I L U ), then σ (StrcesQ(i)) implies σ Strces(i). Proof. The proof is given by induction on the number of output ctions in σ. Assume, for the induction bsis, σ L I. It follows from Corollry 4.3 tht there exists σ 1 Strces(i) such tht σ Due to Definition 18, σ = σ 1.ρ i with ρ i L I. Since i is input-enbled, ρ i Strces(i fter σ 1 ). Thus σ Strces(i). For the induction step, ssume tht the thesis holds for ll σ with n 1 or less output ctions. Suppose tht σ = ρ.x.σ with ρ L I, x L U, σ L nd the number of output ctions in σ is equl to n. It follows from Corollry 4.3 there exists σ 1 Strces(i) such tht σ From Definition 18 we know tht σ 1 = ρ 1.x.σ 1 with ρ 1 L I, σ 1 L nd σ 1@(ρ \ ρ 1 )σ. Distinguish between ρ \ ρ 1 = nd ρ \ ρ 1. ρ \ ρ 1 = In this cse, no input is preceded to output ction x, thus there exists n i such tht Q(i) = ρ.x Q(i ) =. σ Thus σ Strces(Q(i )) with one output ction less thn σ. It follows from induction hypothesis tht σ Strces(i ). Also, it is concluded from the first observtion(ρ.x is not delyed sequence) tht i = ρ.x i. Thus i = ρ.x i σ =, or in other words (σ = ρ.xσ ) Strces(i) which ws to be shown. ρ \ ρ 1 The sequence σ cn be written s ρ 1 (ρ \ ρ 1 ).x.σ. Since ρ \ ρ 1, L I such tht ρ \ ρ 1 =.σi with σi L I. Thus init(i fter ρ 1 ). It is concluded from sequence σ 1 tht x init(i fter ρ 1 ). According to Definition 22, (i fter ρ 1 ) is dely-closed-right. Thus σ 1 Strces(i fter ρ 1 ) implies if σ 1@σ d then σ d Strces(i fter ρ 1 ). It follows from σ 1@(ρ \ ρ 1 )σ tht x.σ 1@x.(ρ \ ρ 1 )σ. From Definition 18 we know tht x.(ρ \ ρ 1 \ ρ 1 )x.σ s well. Thus the two lst observtions nd trnsitivity property of result x.σ 1@(ρ \ ρ 1 )x.σ. Hence (ρ \ ρ 1 )x.σ Strces(i fter ρ 1 ) which culmintes in ρ 1 (ρ \ ρ 1 )x.σ Strces(i). Thus σ Strces(i). Proof of Theorem 3. Using the lemm given bove, the proof of theorem becomes strightforwrd. We prove ech impliction seprtely. XIV

15 It follows from Lemm 3 tht σ Strces(i) implies tht σ Strces(Q(i)). Thus if σ, q σ t Q(i) = fil q, it implies tht i σ t i = fil i nd subsequently it results in i psses t = Q(i) psses t. Since Strces(i) Strces(Q(i)), the left-to-right impliction is very cler. If σ, i σ t i = fil i, it implies tht q t Q(i) = σ fil q. Subsequently it results in Q(i) psses t = i psses t. It is rgued in [7, 8] tht ioco test cse genertion is sound nd exhustive. Soundness mens generted test cses cn detect errors nd exhustiveness mens t lest theoreticlly they cn detect ll non-conforming implementtions. Definition 23 (Soundness nd exhustiveness). Let s IOLT S(L I, L U ) nd T T T S(L U, L I ) then, 1. T is sound def i IOT S(L I, L U ) i ioco s implies i psses T. 2. T is sound def i IOT S(L I, L U ) i ioco s if i psses T. Theorem 4. s IOLT i IOT then i ioco s Q(i) ioco s. Proof. From Definition 23, we know tht i ioco s iff i psses T with T is test suite generted by Algorithm 17 from specifiction s. Also, it is concluded from Theorem 3 tht i psses T implies tht Q(i) psses T. Thus due to Definition 23, the lst observtion results in Q(i) ioco s. Remrk 1. It is noteworthy tht i ioco s with s IOLT i IOT S doesn t imply necessrily tht i IOT nd subsequently Q(i) ioco s. But, if our specifiction is completely specified for input ctions then the bove impliction will hold. In other words, i ioco s with s IOT i IOT S does imply tht i IOT nd subsequently Q(i) ioco s. 5 Necessry nd Sufficient Condition In the previous section, we hve presented clss of implementtion so-clled dely right-closed whose synchronous nd synchronous test executions led to sme verdict. We now show tht being dely right-closed IOTS is necessry condition to hve the sme verdict simultneously in synchronous nd synchronous execution, too. Theorem 5. Let i IOT S(L I, L U ) nd t T T S ioco (L I, L U ), then i psses t Q(i) psses t implies i IOT (L I, L U ). Proof. To prove the theorem given bove, we prove i / IOT (L I, L U ) implies i psses t = Q(i) psses t. Without loss of generlity we ssume tht there exists σ (L {, δ}) such tht i fter σ is both input nd output enbled. In generl we cn formulte it s q 1, q 2 (i fter σ), q 1, q 2, L i, x L U q 1 q 1 x q 2 q 2. It is concluded from i / IOT (L I, L U ) tht Strces(i fter σ) is XV

16 not dely-right-closed. Thus without loss of generlity we cn ssume tht x. Strces(i fter σ) s its delyed sequence.x / Strces(i fter σ). According to Algorithm 17, there exists stte t t which the tester cn either provide the input or observe the output x nondeterministiclly( t t t x ) nd from the previous ssumption we know observing the output x fter providing leds to fil stte. Consider sitution in which the sequence of σ is executed during the test execution nd t reches t. Then the tester provides n input being put in the input queue s the implementtion under the test, produces n output x being put in the output queue, ccording to rule A1 nd I3 in Definition 12 respectively. Thus the implementtion during this execution reches the stte [x q 2 ]. According to rule A2 in Definition 12, the output trnsition of x cn hppen which leds the tester to fil stte which ws to be shown. 6 Conclusions In this pper, we presented theorems which llow for using test-cses generted from ordinry specifictions in order to test synchronous systems. These theorems estblish sufficient conditions when the verdict reched by testing the synchronous system (remotely, through FIFO chnnels) corresponds with the locl testing through synchronous interction. In the cse of IOCO testing theory, we show tht the presented sufficient conditions re lso necessry. The presented conditions for synchronizing IOCO re semnticl in nture. We intend to formulte syntctic conditions tht imply the semnticl conditions presented in this pper. The reserch reported in this pper is inspired by our prcticl experience with testing synchronous systems reported in [1]. We pln to pply the insights obtined from this theoreticl study to improve our prcticl results. References 1. HmidRez Asdi, Rmtin Khosrvi, MohmmdRez Mousvi, nd Ned Noroozi. Towrds model-bsed testing of electronic funds trnsfer systems. In Proceedings of the 4th Interntionl on Fundmentls of Softwre Engineering (FSEN 2011), Lecture Notes in Computer Science. Springer, Clude Jrd, Thierry Jéron, Lénick Tnguy, nd Césr Viho. Remote testing cn be s powerful s locl testing. In IFIP Joint Conferences: FORTE XII) nd (PSTV XIX), volume 156 of IFIP Conference Proceedings, pges Kluwer, Alexndre Petrenko nd Nin Yevtushenko. Queued testing of trnsition systems with inputs nd outputs. In Proceedings of the Workshop on Forml Approches to Testing of Softwre FATES 2002, pges 79 93, Alexndre Petrenko, Nin Yevtushenko, nd Jile Huo. Testing trnsition systems with input nd output testers. volume 2644 of Lecture Notes in Computer Science, pges Springer, Adenilso Simo nd Alexndre Petrenko. From test purposes to synchronous test cses. In Third Interntionl Conference on Softwre Testing, Verifiction, nd Vlidtion Workshops (ICSTW 2010), pges IEEE CS, XVI

17 6. Jn Tretmns. A forml Approch to conformnce testing. PhD thesis, University of Twente, The Netherlnds, Jn Tretmns. Test genertion with inputs, outputs nd repetitive quiescence. Softwre Concepts nd Tools, 3: , Jn Tretmns. Model bsed testing with lbelled trnsition systems. In Forml Methods nd Testing, volume 4949 of Lecture Notes in Computer Science, pges Springer, Jn Tretmns nd Louis Verhrd. A queue model relting synchronous nd synchronous communiction. In Proceedings of the IFIP Symposium on Protocol Specifiction, Testing nd Verifiction, volume C-8 of IFIP Trnsctions, pges North-Hollnd, Louis Verhrd, Jn Tretmns, Pim Krs, nd Ed Brinksm. On synchronous testing. In Proceedings of the IFIP Workshop on Protocol Test Systems, volume C-11 of IFIP Trnsctions, pges North-Hollnd, Mrtin Weiglhofer. Automted Softwre Conformnce Testing. PhD thesis, Grz University of Technology, Austri, Mrtin Weiglhofer nd Frnz Wotw. Asynchronous input-output conformnce testing. In Proceedings of the Interntionl Computer Softwre nd Applictions Conference (COMPSAC 09), pges IEEE Computer Society, Appendix Proof of Proposition i = i iff t i = t i (R 1 ) We prove the two implictions by strightforwrd induction on the length of the -trces leding to =, see item 1 in Definition 3: Assume, for the induction bsis, tht i = i is due to -trce of length 0; thus, it follows from the first disjunct of item 1 in Definition 3 tht i = i. It then follows from the sme item tht t i = t i nd since i = i, we hve tht t i = t i, which ws to be shown. For the induction step, ssume tht the thesis holds for ll = resulting from -trce of length n 1 or less nd tht i... i n 1 i. It follows from the induction hypothesis tht t i = t i n 1. Also from i n 1 i nd deduction rule R1 in Definition 7, we hve tht t i n 1 = t i. Hence, it follows from item 1 in Definition 3 tht t i = t i, which ws to be shown. Almost identicl to bove. The induction bsis is identicl to the proof of the impliction from left to right. For the induction step, note tht the lst -step of t i n 1 = t i cn only be due to deduction rule R1 nd hence we hve i n 1 = i, which in turn implies, by using item 1 in Definition 3, tht i = i. 2. [σu S σi] 3. [σ u.σ u S σi] σ i = [σu S σi.σ i ], σ i L I (A 1 ). σ u = [σu S σi], σ u L U (A 2 ). XVII

18 4. [σu i σi] = [σu i σ i] iff i = i (I 1 ). Almost identicl to the previous item: we prove the two implictions by induction on the length of the - trce for leding to = : Assume, for the induction bsis, tht i = i is due to -trce of length 0; thus, it follows from the first disjunct of item 1 in Definition 3 tht i = i. It then follows from deduction the sme item tht [σu i σi] = [σ u i σi] nd since i = i, we hve tht [σu i σi] = [σu i σ i], which ws to be shown. For the induction step, ssume tht the thesis holds for ll = resulting from -trce of length n 1 or less nd tht i... i n 1 i. It follows from the induction hypothesis tht [σu i σi] = [σu i n 1 σ. i] Also from i n 1 i nd deduction rule I1 in Definition 12, we hve tht [σ u i n 1 σ i] [σu i σ i].hence, it follows from item 1 in Definition 3 tht [σu i σi] = [σu i σ i], which ws to be shown. Similr to the bove item. The induction bsis is identicl. The induction step follows from the sme resoning. Note tht [σu i n 1 σ i] = [σ u i σ i] cn only be proven using deduction rule I1 in Definition 12, becuse deduction rules I2 nd I3 produce modified queues in their trget of the conclusion. Hence, the premise of deduction rule I1 should hold nd thus, i n 1 i. Hence, using the induction hypothesis we obtin tht i = i. 5. [σu i σi.σ i ] = [σu i σ i ] iff i = σi i (I ) [σu i σi] = [σu.σ u i σ i] iff i σ u = i (I 3 ). Lemm 4. For ech i, i IOT S (L I, L U ) nd T T S T = Q, L U L I {θ}, T, q 0, t, t Q nd σ u L U nd σ i L I, if t [σ u i σi] = t [σu i σi ], then [σu i σ i] is quiescent(δ q ( [σu i σ i])). Proof of Lemm 4. Assume L I nd t [σu i σi] = t [σu i σi ], from Definition 3 (item 2), we know there exists n i IOT S (L I, L U ) such tht t [σu i σi] = t [σu i σ i] t [σu i σi ] = t [σu i σi ]. It follows from item 4 in Proposition 1 nd t [σu i σi] = t [σu i σ i] tht i = i. Also it is concluded from Proposition 1(item 4) nd t [σu i σi ] = t [σu i σi ] tht i = i. Thus, ccording to item 1 in Definition 3, i = i nd subsequently ccording to Proposition 1(item 4), [σu i σi] = [σu i σ i]. The former observtion nd item 1 in Proposition 1 led to t [σu i σi] = t [σu i σ i]. Using deduction rule A1 in Definition 12 nd pplying deduction rule R2 in Definition 7 result in t [σu i σ i] = t [σu i σi ]. Hence, there is trce strting from t [σu i σi] to t [σu i σ i] = t [σu i σi ]. It follows then from Definition 11 tht δ q ( [σu i σ i]) (since test cse t cn only provide n input if it hs observed quiescent, by looking into ll future trces), which ws to be shown. XVIII

19 Lemm 5. For ech i, i IOT S (L I, L U ) nd T T S T = Q, L U L I {θ}, T, q 0, t, t Q, there is no trce σ (L I L U {θ}) such tht t Q(i) = σ t [σu i σ i] nd (σ i σ u ). Proof of Lemm 5. hold: 1. t Q(i) σ = t [σu i σ i] 2. σ i σ u Assume, towrds contrdiction, tht the following items Since both σ i nd σ u re non-empty, there must exist the lrgest prefix σ of σ during which the two queues re never simultneously non-empty, i.e., by observing single ction fter σ, both queues become non-empty for the first time. Hence, there exists σ, σ (L I L U θ) nd y (L I L U {, θ}) nd postfix σ of σ such tht: 1. σ = σ.y.σ σ = t 1 [σ u i 1 σ i ] 2. there exist σ i (L I), σ u (L U ) such tht t Q(i) ((σ u = σ i ) (σ i = σ u )) 3. there exist σ i (L I ), σ u (L U ) such tht t 1 [σ u i 1 σ i ] t 2 [σ u i 2 σ i ] ((σ u = σ i σ u σ i σ i σ u = σ u)) σ 4. t 2 [σ u i 2 σ i ] = t [σu i σi] = σ i ) (σ i = σ u Note tht fter σ both input nd output queues cnnot be empty, since single trnsition y cn t most increment the size of one of the two queues (see rules A1 nd I3 in Definition 12). Below, we distinguish two cses bsed on the sttus fter performing the trce σ : either the input queue is empty (nd the output queue is not), or the other wy round. σ u = The only possible trnsition tht cn fill n output queue is due to the ppliction of deduction rule I3 in Definition 12. Hence, there must exists some i 2 LT S (L I, L U ) nd x L U such tht [ i 1 σ i ] [x i 2 σ i ] nd subsequently, (t 1 [ i 1 σ i ] t 2 [x i 2 σ i ]) (thereby stisfying the third item with σ u = nd σ u = x). The former x-lbeled trnsition cn only be due to deduction rule I3 in Definition 12 nd hence, we hve x i 1 i 2. However, it follows from σ i tht there exit n L I, i p IOT S (L I, L U ), prefix of σ like σ p nd ρ i L I such tht σ i = ρ i. σ i nd t Q(i) σ p = t 1 [ i p ρi] = t 1 [ i 1 σ i ]. Since, i IOT S (L I, L U ), we hve from Lemm 4 tht δ q ( [ i 1 ρi]). Using deduction rule A2 on x i 1 i 2, we obtin tht [ i 1 ρi] = [x i 2 ρi]. Hence ccording to Definition 5, stte [ i 1 ρi] is not quiescent, which is contrdictory to our erlier observtion bout δ q ( [ i 1 ρi]). = The only trnsition which llows for filling the input queue is due the subsequent ppliction of deduction rules R2 nd A1. Hence, there exists n L I, such tht t 1 [σ u i 1 ] t 2 [σ u i 2 ] ) nd [σ u i 1 ] [σ u i 2 ] y XIX

20 (where the former stisfies the third item by tking σ i = nd σ i = ); It follows from i IOT S (L I, L U ), nd Lemm 4 tht δ q ( [σ u i 2 ] ). However since σ u, there exists y L U nd ρ u L U, such tht σ u = y.ρ u x nd using deduction rule A2, we obtin tht tht [σ u i 2 ] nd thus, [σ u i 2 ] is not quiescent, which is contrdictory to our erlier observtion. Lemm 6. For ech i, i IOT S (L I, L U ), T T S T = Q, L U L I {θ}, T, q 0, t, t Q nd σ, σ u, σ i {L I L U θ} σ nd σ i. If t Q(i) = t [σu i σ i] then δ q (i ) nd σ u =. Proof of Lemm 6. By lemm 5, we hve tht σ u =. Assume, towrds contrdiction tht there exists n x L U such tht x Sinit(i ). Since x Sinit(i ), it follows from item 2 in Definition 4 tht there exists n i IOT S (L I, L U ) such tht i x = i. Since σ i there exist σ {L I L U θ}, i p IOT S (L I, L U ), t p T T S (L U, L I ), L I, nd ρ i L I such tht σ σ i = ρ i. nd t Q(i) = t p [ i p ρi] = t [ i σ i]. Hence by Lemm 4, [ i ρ i] is quiescent( δ q ( [ i ρ i])). It follows from the ssumption nd deduction rule I3 in Proposition 1, [ i ρ i] = [x i ρ i]. Since the output queue is non-empty we cn pply deduction rule A2 on the trget stte nd obtin [x i ρ i] x [ i ρ i]. Combining the two trnsitions, we obtin [ i y ρ i] = [ i ρ i]. From the ltter trnsition, we conclude tht [ i ρ i] is not quiescent which is contrdictory to the former observtion. Proof of Lemm 3.1. Assume, towrds contrdiction, tht for ll i such tht i = i, it doesn t hold δ(i ). Tke the i with the lrgest empty trce (by counting the numbers of -lbeled trnsitions). Such i must exist since otherwise, there must be loop of -lbeled trnsition which is opposed to the ssumption tht i doesn t diverge. Since i is not quiescent, ccording to Definition 5, there exists n x L u such tht i x. From item?? in Definition 3, we know tht there must exist n i such tht i x i. It follows from item 4 in Proposition 1 nd deduction rule I3 in Definition 12 tht Q(i) = [x i ] nd since the output queue is non-empty we cn pply the deduction rule A2 on the trget stte nd obtin [x i x ] Q(i ). Combining the two trnsition we obtin Q(i) = Q(i ). From the ltter trnsition x we cn conclude tht Q(i) is not quiescent which is contrdictory to the thesis. Proof of Proposition 3.2. We distinguish four cses bsed on the sttus of input nd output queues. (σ i =, σ u = ) By ssuming s = s, the thesis is proved. (σ i, σ u ) According to Lemm 5, no trce leds to this sitution. (σ i, σ u = ) We prove this cse by n induction on the length of σ i. Since σ i, for the induction bsis, the smllest possible length of σ i is one. Thus there XX

21 must be n x L I such tht σ i = x. From Lemm 6, we know tht x L U, x / Sinit(s ) nd since s doesn t diverge, it must rech eventully stte such s i which performs trnsition other thn n internl one, hence the only possible choice is n input trnsition. From Definition 9 we know tht δ(i) nd ccording to Definition 10, stte i is input-enbled s well. Thus i x i i. Due to the subsequent ppliction of deduction rules of I1, I2 in Definition 12 nd R1 in Definition 7, trnsition t [ s x] = t Q(i ) is possible. By ssuming s = i nd combintion of the ltter σ trnsition nd the ssumption, we hve t Q(s) = t Q(i ) which ws to be shown. For the induction step, ssume tht the thesis holds for ll nonempty input queues with length n 1 or less nd length of σ i is n. It follows from σ i tht there exists n L I nd σ i L I nd σ (L {θ}) such tht σ i = σ i σ. nd t Q(s) = t p [ i σ i ] = t [ s σ i]. It follows σ from the induction hypothesis tht i t Q(s) = t p Q(i). Due to the ppliction of deduction rule R2 in Definition 7 nd A1 in Definition12, we hve t p Q(i) = t [ i ]. It follows from the induction bsis tht s t p Q(i) = t Q(s ). Combintion of the two trnsitions leds to s t Q(s) = σ t Q(s ) which ws to be shown. (σ i =, σ u ) We prove this cse by n induction on the length of σ u. Since σ u, for the induction bsis, the smllest possible length of σ u is one. Thus, ssume, for the induction bsis, tht there exists n x L U such tht σ u = x. The only possible trnsition tht cn fill the output queue is due to the ppliction of deduction rule I3 in Definition 12. Hence, there must exist some s, q IOT S (L I, L U ) such tht [σ u s σ i ] [σ u.x q σ i ] = [σ u.x s σ i ]. Combintion of the two trnsition concludes tht [σ u s σ i ] = [σ u.x q σ i ]. It follows from the ppliction of deduction rule R1 in Proposition 1 tht the input queue t stte [σ u s σ i ] must be empty since otherwise ccording to Lemm 6, s would be quiescent nd could not produce ny output. Thus there exist σ (L {θ}), σ u L U nd t p T T S (L U, L I ) such tht t Q(s) = σ t p [σ u s ] = t p [σ u.x s σ u ] = t [x s ] nd σ = σ.σ u. Due to the ppliction of deduction rules R2 in Definition 7 nd A2 in Definition 12, it concludes tht t p [σ u s σ u ] = t Q(s σ ) nd subsequently we hve t Q(s) = t p [σ u s σ u ] = t Q(s ) which ws to be shown. For the induction step, ssume tht the thesis holds for ll non-empty output queues with length n 1 or less nd length of σ u is n. It follows from σ u tht there exist n x L U nd σ u L U nd σ (L {θ}) such tht σ u = σ u.x nd t Q(s) = σ t p [σ u.σ u q ] t p [σ u.σ u.x q σ u ] = t [σ u.x s ] nd σ = σ.σ u. Due the ppliction of deduction rule R2 u in Definition 7 nd A2 in Definition 12, we hve t p [σ = t [σ u q ]. Thus we cn run the previous execution in new order such u.σ u q ] σ XXI

22 s t Q(s) = σ u t p [σ = t [σ u q ] t [σ u.x s ]. Hence we cn rech new stte with the output length less thn the length of σ u by running the sme execution nd it follows from the induction hypothesis tht s t Q(s) = σ t Q(s ) which ws to be shown. u.σ u q ] σ XXII