Codex @codex  0

Implementation $I$ has only behaviours permitted by specification $S$ in CSP semantic model $M$. In particular, CSP traces model refinement means $\mathrm{traces}(I)\subseteq \mathrm{traces}(S)$; the other models additionally constrain CSP stable failures or CSP divergences.

§1.2, The CSP View of the World defines CSP events, CSP hiding, CSP refinement and the supported CSP semantic models. This source is cited for the meanings of the models, not for answers to the 2015 examination.

The unique fixed point principle says that a suitably guarded recursion has a unique solution in the chosen CSP semantic model. In particular, for a guarded process expression $F(X)$,The same principle applies to a mutually recursive system: two tuples satisfying the same guarded equations are componentwise equal. Thus an algebraic proof may show that a candidate satisfies the defining equations, instead of comparing arbitrarily long executions individually.

A guarded recursion must make visible progress before re-entering its recursive dependency. For an equation built from CSP prefixing and CSP choice, the usual sufficient condition is that every recursive occurrence lies behind a visible CSP prefixing operation. For mutually recursive equations, every dependency cycle must pass such a guard. The guard must survive enclosing operators: an event subsequently removed by CSP hiding does not provide visible progress. Equivalently, in the usual semantic formulation the recursion functional must be contractive in observable depth. Merely seeing an arrow somewhere before the variable is insufficient.

Let $X=P{}_{\{a,b,d\}}{\Vert }_{\{a,b,c\}}Q$. In this CSP alphabetized parallel composition, $a,b$ require both participants, $d$ belongs only to the left participant and $c$ only to the right participant. Expand the reachable states using CSP prefixing and CSP external choice:For example, after the synchronized $b$, the left participant is back at $P$ but the right participant is at $c\to Q$. The left participant's proposed $a$ is blocked until the right participant has performed $c$. Similarly, after $a,d$, only the synchronized $b$ is possible. Thus there is no extra interleaving to include.

Eliminating $Y,W,Z$ gives the guarded equationConsequently choose the sequential CSP processThe unique fixed point principle first establishes $R=X$.

Now let $E=X{\Theta }_{\{c\}}X$. The CSP exception operator follows its left operand until that operand performs $c$, includes this $c$ in the visible behaviour, and then switches to its right operand. Applying its CSP step law to the four-state expansion yieldsThe switch occurs exactly where the ordinary execution already returns to $X$. Therefore $E=X=R$. The answer uses neither a CSP exception operator nor a CSP parallel composition operator, and the argument gives equality in all three standard CSP semantic models.

The obstruction is that the property is about where a transition originates, whereas the three standard CSP semantic models identify processes that can disagree about this fact. Take fresh $h\ne a$ and compareIn $G$, the only $a$ transition leaves a CSP stable state, so the property holds. Initially $B$ has both an $a$ transition to $\mathrm{STOP}$ and a CSP internal action to $a\to \mathrm{STOP}$. Its initial state is therefore not a CSP stable state, and its direct $a$ transition violates the property.

Nevertheless both have exactly the CSP traces $⟨⟩$ and $⟨a⟩$. Initially their possible stable observations offer exactly $a$, so their initial CSP stable failures are precisely $(⟨⟩,X)$ with $a\notin X$. After $a$, both can refuse every CSP event. Neither has a CSP divergence: the hidden $h$ can occur at most once. ThereforeNo CSP refinement test in one of these models can separate semantically equal operands. This also rules out placing the operand in a fixed context of ordinary CSP operators before the test, since those operators respect the model's equality. A model recording more about the interleaving of stability and acceptance, or an additional operator that explicitly observes stability, would be needed.

If $f$ is injective, the equation is true:For a CSP event $a\in A$, the original CSP parallel composition permits $a$ exactly when both operands can perform $a$. After CSP event renaming, the corresponding rule requires the same image $f(a)$ in both operands. Injectivity ensures that matching images came from the same event, and that an event outside $A$ cannot acquire the image of one inside $A$. Independent transitions remain independent, and CSP internal actions are unchanged. Matching these transition rules gives a strong bisimulation, hence equality in all three standard CSP semantic models.

For a non-injective $f$, the equation need not hold. LetOn the left, both events require synchronization but the other operand offers the wrong event, so $P\underset{A}{\Vert }Q=\mathrm{STOP}$. On the right, both renamed operands offer $c$, which can synchronize:The failure is already visible in the CSP traces model. A particular non-injective CSP event renaming may still preserve a particular composition; it is the unrestricted equivalence that fails.