Theory Conclusion

(*<*)
―‹ ********************************************************************
 * Project         : HOL-CSPM - Architectural operators for HOL-CSP
 *
 * Author          : Benoît Ballenghien, Safouan Taha, Burkhart Wolff.
 *
 * This file       : Conclusion
 *
 * Copyright (c) 2025 Université Paris-Saclay, France
 *
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
 * met:
 *
 *     * Redistributions of source code must retain the above copyright
 *       notice, this list of conditions and the following disclaimer.
 *
 *     * Redistributions in binary form must reproduce the above
 *       copyright notice, this list of conditions and the following
 *       disclaimer in the documentation and/or other materials provided
 *       with the distribution.
 *
 *     * Neither the name of the copyright holders nor the names of its
 *       contributors may be used to endorse or promote products derived
 *       from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 ******************************************************************************›
(*>*)


chapter‹ Conclusion ›

(*<*)
theory Conclusion                                               
  imports CSPM "HOL-Library.LaTeXsugar"
begin 
  (*>*)



text ‹In this session, we defined three architectural operators: constGlobalDet,
      constMultiSync, and constMultiSeq as respective generalizations 
      of termP  Q, termP S Q, and termP ; Q.
      The generalization of termP  Q, termGlobalNdet, is already in
      sessionHOL-CSP since it is required for some algebraic laws.›



text ‹We did this in a fully-abstract way, that is:
       constDet is commutative, idempotent and admits constSTOP as a neutral element so
        we defined constGlobalDet on a typ'a set termA by making it equal
        to constSTOP when termA = {}. Continuity only holds for finite cases,
        while the operator is always defined.

       constNdet is also commutative and idempotent so in sessionHOL-CSP
        constGlobalNdet has been defined
        on a typ'a set termA by making it equal to constSTOP when termA = {}.
        Beware of the fact that constSTOP is not the
        neutral element for constNdet (this operator does not admit a neutral element) so 
        we ‹do not have› the equality
        @{term [display, eta_contract = false] (p  {a}. P p) = P a  (p  {}. P p)}
        while this holds for constDet and constGlobalDet).
        Again, continuity only holds for finite cases.

       constSync is commutative but is not idempotent so we defined constMultiSync
        on a typ'a multiset termM to keep the multiplicity of the processes.
        We made it equal to constSTOP when termM = {#} but like constNdet,
        constSync does not admit a neutral element so beware of the fact that in general
        @{term [display, eta_contract = false] (Sp ∈# {#a#}. P p)  P a S (Sp ∈# {#}. P p)}.
        By construction, multiset are finite and therefore continuity holds.

       constSeq is neither commutative nor idempotent, and termSKIP r is neutral only on
        the left hand side (note if the second type typ'r of typ('a, 'r) processptick is actually
        typunit, that is to say we go back to the old version without parameterized termination,
        it is neutral element on both sides, see @{thm Seq_SKIP SKIP_Seq}).
        Therefore we defined constMultiSeq on a typ'a list termL to keep the multiplicity
        and the order of the processes, and the folding is done on the reversed list in order to
        enjoy the neutrality of termSKIP r on the left hand side.
        For example, proving
        @{term [eta_contract = false] SEQ p ∈@ L1. P p ; SEQ p ∈@ L2. P p = SEQ p ∈@ (L1 @ L2). P p}
        in general requires termL2  [].›



text ‹We presented two examples: Dining philosophers, and POTS.

      In both, we underlined the usefulness of the architectural operators
      for modeling complex systems.›

text ‹Finally we provided powerful results on constevents_of and constdeadlock_free
      among which the most important is undoubtedly:
      
         @{thm [display, eta_contract = false] MultiInter_deadlock_free[no_vars]}
      
      This theorem allows, for example, to establish:

         @{term [display, eta_contract = false]
             0 < n  deadlock_free (||| m ∈# mset [0..<n]. P m)}

      under the assumption that a family of processes parameterized by
      termm @{text "::"} typnat verifies termm < n::nat. deadlock_free (P m).
      ›

text ‹More recently, two operators constThrow and constInterrupt have been added.
      The corresponding continuities and algebraic laws can also be found
      in this session.›

(*<*)
end
  (*>*)