Translation of CCS into CSP, Correct up to Strong Bisimulation

. We present a translation of CCS into CSP which is correct with respect to strong bisimulation. To our knowledge this is the ﬁrst such translation to enjoy a correctness property. This contributes to the uniﬁcation of the CCS and CSP families of concurrent calculi, in the spirit of Hoare and He’s uniﬁcation programme through Unifying Theories of Programming. To facilitate this translation, we deﬁne CCSTau, the extension of CCS with visible synchronisation actions and the hiding operator. This separation of concerns between synchronisation and hiding turns out be suﬃcient to obtain our correct translation. Our translation, implemented in a Haskell prototype, makes it possible to use CSP-based veriﬁers such as FDR to reason about trace and failure (hence may-and must-testing) preorders for CCS processes.


Introduction
The CCS/Pi-calculus [1,16,17] and CSP/CSPmob [4,14,22] families of calculi are established formalisms for analysing concurrent systems. Not long after their inception there have been efforts to relate the two calculi and bridge their differences [15]. This would have clear benefits for theoreticians as it would allow them a deeper understanding of the nature of concurrency and the ability to transition from one mathematical formulation to the other in a rigorous manner. It would also benefit practitioners working in Process Algebra as it would allow them to use verification technology from both worlds to address challenges in assuring system correctness modelled in either family of calculi. To achieve this, semantics preserving transformations between CCS and CSP are needed.
In previous work, Van Glabbeek [10] builds a general framework for comparing the expressiveness of process calculi, with an application proposing a translation from CSP to CCS that is correct up to trace equivalence. Hatzel et al. [12] propose an encoding from CSP into asynchronous CCS with two notable encodings of CSP multiway synchronisation into CCS binary synchronisation. Brookes [3] encodes CSP models as synchronisation trees showing that CSP failure equivalence is implied by CCS observational equivalence under certain restrictions. He and Hoare [13] build a retract between CCS and CSP semantics.
To our knowledge however, no translation from CCS into CSP exists to date. The present paper aims to fill this gap. In particular, we present a translation from finite state CCS into CSP that is correct up to strong bisimulation, i.e., the source and target terms are strongly bisimilar. This correctness criterion allows us to use a prototype implementation of our translation to leverage FDR [5] for reasoning about trace and failure refinements of CCS terms. The translation is efficient as it only polynomially increases the size of the term. In the worst case, the target term has O(nm) additional communication prefixes, where n and m are the maximum number of prefixes with the same name and corresponding co-name, respectively, in the source term. For practical systems with a relatively small number of synchronising prefixes this translation is thus tractable.
One major challenge in achieving a correct translation from CCS to CSP has been the reconciliation of the different communication primitives in the two languages, and how these interact with other primitives in the language. To bridge the gap between binary CCS and multiway CSP synchronisations, our translation assigns a unique name a ij to every pair of a/a-prefixes that might synchronise, and carefully annotates the interfaces between parallel processes to enable these synchronisations, effectively implementing binary synchronisation in multiway CSP semantics. Moreover, a unique name a i is assigned to every CCS prefix that may be interleaved. This separation of interleaving and synchronisation is key to obtaining our translation (see Example 8). Finally, the CCS mixed-choice operator is translated to CSP external choice with a special tau-event to enable internal choice resolution (see Example 9). We use CSP hiding to turn internal synchronisation events a ij and tau events into proper CSP τ -events.
Our translation from CCS to CSP relies on a novel intermediate language called CCSTau. This is a CCS-like calculus with observable binary synchronisation and the CSP hiding operator. Our translation is then obtained by the composition of an initial translation from CCS into CCSTau, a number of transformations within the CCSTau language itself, and a final translation from CCSTau into CSP including hiding of internal transitions. This sequence of smaller translation steps simplifies the task at hand and allows us to obtain a correct, up to strong bisimulation, overall translation. The contributions of this work are summarised as follows.
-We provide the first translation from finite state CCS to CSP which is correct up to strong bisimulation. The translation is efficient and only polynomially increases the size of the term. -We propose CCSTau, which adapts CCS by making synchronisation actions visible and introducing CSP-like hiding, as a middle-ground between CCS and CSP. This calculus is instrumental in disentangling complex CCS behaviour such as mixed choice and combined interleaving/synchronisation and encoding it into CSP. -We provide a prototype implementation of our translation in Haskell [23] which enables the use of the FDR refinement tool [5] to reason about mayand must-testing refinement of CCS processes.
In the rest of the paper we briefly overview definitions for CCS and CSP (Sect. 2), and provide the high-level intuitions of our translation (Sect. 3). We then define CCSTau, the extension of CCS with visible synchronisation actions and the hiding operator (Sect. 4), before defining the actual translation (Sect. 5 and Sect. 6) and prove its correctness (Sect. 7). Section 8 discusses an alternative translation, correct up to failure equivalence. Section 9 evaluates our translation against Gorla's criteria [11] for valid translations. Finally, we present conclusions and discuss future work (Sect. 10).

CCS, CSP, Correct Translations: a Brief Overview
CCS (Calculus of Communicating Systems) [1,17] and CSP (Communicating Sequential Processes) [14,22] are process algebras that allow reasoning about concurrent systems. Here we overview the main definitions of the two calculi.

CCS
In CCS [17], we assume a set of countable names N , ranged over by a, b, c, with a total bijective function · with the property that a = a. This function identifies co-names, the names that can synchronise. The symbol τ denotes an unobservable internal move. We let α range over names and τ . The syntax of CCS processes is given by the grammar The semantics of CCS is traditionally given as a Labelled Transition System (LTS), shown in Table 1. Term 0 (or NIL) is the process that performs no action, whereas α.P performs an action α, where α is either a name a or τ , and then behaves like P (Prefix rule). The choice term P + Q behaves either like P or Q (SumL rule). The parallel P |Q runs P and Q in parallel; P and Q may interleave (Par rule) or synchronise on co-actions, resulting in a silent τ action (Com rule). Restriction P B cannot engage in actions consisting of names in B ∪ B, where B = {ā|a ∈ B} (Res rule); however, names in B ∪ B can be used for internal synchronisation in P . Term μ X.P encodes recursion, where variable X, appearing as a process in P , denotes a recursive unfolding (Rec rule). We only consider closed processes where X is under a corresponding μX operator. Moreover, as we are interested in finite state processes, we apply the sufficient requirement that no parallel operator appears under recursion.
Equivalence based on bisimulations is the preferred choice for distinguishing CCS processes (cf. [17,21]). [21]). A strong bisimulation is a symmetric binary relation R on processes satisfying the following: P RQ and

Definition 2 (Strong Bisimulation
Example 3. In CCS, internal and external choices can be combined thus yielding a mixed choice, e.g., a.P + b.Q + τ.R. According to Table 1, this process enables external choice between a and b, meaning that the context of the process, through synchronisation on a or b, can force this process to become P or Q. Additionally, the process itself can non-deterministically decide to evolve to R, resolving the choice independently from external stimuli. As we show in Example 9, this mixed choice in CCS needs to be encoded specifically into CSP, where internal reductions do not resolve an external choice.

CSP
In CSP, we assume again a countable set of names N , called the set of observable events and ranged over by a, b, c, the special event denotes termination, and the τ event denotes an internal move. We let α range all events. The syntax of CSP processes we consider is given by the grammar: 1 P, Q, R :: The alphabet of CSP processes is defined hereafter. 1 In what follows, whether P, Q, R refer to CCS or CSP will be clear by the context.
We present the semantics of CSP as an LTS in Table 2, following Schneider [22]: Term SKIP refuses to engage in any event, terminates immediately (Term rule), and does not diverge. Term ST OP is unable to interact with its environment. The prefix process α → P first engages in event α then behaves like P (Prefix rule). Term P Q behaves like P or Q, with the choice decided internally (InChL), whereas P 2 Q behaves like P or Q, with the choice decided by the environment (ExtChL1,2 rules). Parallel P B Q runs processes P and Q in parallel, which must synchronise on the set of events in B and the event (ParL and Sync rules). The renaming term f (P ) engages in f (a) whenever P engages in a (Ren rule). Hiding P \A engages in all events of P except those in A (Hide1, 2 rules), and μ X.P runs P recursively (Rec rule).
Equivalence based on (enriched versions of) traces is the preferred choice for distinguishing CSP processes (cf. [14,21,22]). [21]). A failure is a pair (tr, A), where tr is a finite sequence of actions (or trace) and A a set of actions. The failure (tr, A) belongs to process P if, for some P :

Definition 5 (Failure equivalence
. P is failure equivalent to Q, written P = F Q, if they have the same sets of failures.

Correct Translations
A correct translation of one language into another is a mapping from the valid expressions in the first language to those in the second, that preserves their meaning [10]. Below we recap the main two definitions of correctness.
Let L = (T L , L ) denote a language as a pair of a set T L of valid expressions in L and a surjective mapping L : T L → D L from T L to some set of meanings D L . Candidate instances of L are traces and failures (Definition 5).

Definition 6 (Correct Translation up to Semantic Equivalence
Operational correspondence allows matching the transitions of two processes, which can help determine the appropriate relation (semantic equivalence) between a term and its translation. Let the operational semantics of L be defined by the labelled transition system (T L , Act L , − → L ), where Act L is the set of labels [8,20]). Let T : T L → T L be a mapping from the expressions of a language L to those of a language L , and let f : Act L → Act L be a mapping from the labels of L to

Intuitions of the Translation
In this section, we illustrate some of the differences between CCS and CSP, and how we address them in the different stages of our translation shown in Fig. 1. We start with the challenges in translating CCS binary into CSP's multiway synchronisation in a term where both interleaving and synchronisation of prefixes is possible.  Table 1).
We initially translate this process into CCSTau through the c2ccsτ function (Definition 11), which gives us ((a.P | a.Q )\{τ [a|a]} | a.R )\{τ [a|a]}. As we will see in the following section, in CCSTau, a.P can perform an observable τ [a|a] synchronisation with one of the other two parallel processes. This transition is turned into an internal τ -transition via the hiding operator (−\{τ [a|a]}) borrowed from CSP. After this first translation, the source and target terms have the same transition system, i.e., they are strongly bisimilar (Theorem 12).
We then apply a sequence of three transformations within CCSTau. The first one, ix (Property 13), assigns a unique index to the names of every prefix, thus obtaining the process a 1 .P | a 2 .Q | a 3 .R . The ix-indexed process cannot perform any synchronisation and therefore hiding of synchronisation actions is removed. However, the next transformation, g * (Definition 15), adds new prefixes, denoted with double indices, which re-introduces these synchronisations (though without hiding them): (a 1 + a 12 + a 13 ).P | (a 2 + a 12 ).Q | (a 3 + a 13 ).R where (a + b).S is syntactic sugar for a.S + b.S. For simplicity in this example, we assume that a does not appear in P , Q and R.
At this stage in our translation, every prefix that may lead to an interleaved action is represented by an a i prefix, while every possible synchronisation has its own unique name and co-name, a ij , a ij . In this way, we separate synchronisation from interleaving, which is crucial for translating into CSP.
Note here that the introduction of the additional a ij prefixes also introduces interleaved a ij transitions. These will be removed by hiding at a following stage of the translation.
Transformation conm (Definition 18) identifies co-names synchronisation events, and tl (Definition 20) maps CCS operators to corresponding CSP constructs while filling in the interface sets in every CSP parallel operator. We thus obtain: To obtain a CSP process with a transition system identical to the original CCS term, we need to apply the final two stages of the translation. These introduce a top-level hiding operator for tau events (not relevant in this example) and all a ij synchronisation events, as well as a renaming operation ai2a (Definition 25) which maps all a i names to a. The final CSP term is thus: The original CCS and final CSP terms have indeed strongly bisimilar LTSs (Theorem 30).
Example 9. Consider again the mixed choice a.P + b.Q + τ.R (Example 3). After applying the c2ccsτ translation and the ix, g * and conm transformations, we obtain the CCSTau term: a 1 .P + b 2 .Q + τ.R . We assume here that P, Q, R do not contain a and b prefixes and thus no hiding or additional n ij prefixes are introduced. Translation tl is the most important for this example. It results in the CSP process a 1 → P 2 b 2 → Q 2 tau → R . Crucially, the last prefix involves the special name tau, which is different than τ and can indeed resolve the choice. In order to turn tau into a CSP τ move, the translation then hides this name and, with the application of the final renaming function ai2a, the CSP term we obtain is (a → P 2 b → Q 2 tau → R ) \ {tau} which indeed has an LTS which is strongly bisimilar to that of the original CCS term.

From CCS to CCSTau
We define CCSTau to serve as a middle-ground calculus between CCS and CSP for our translation. CCSTau is obtained from CCS, as described in Sect. 2.1, by two modifications: making binary synchronisation observable, and introducing CSP-style hiding.
To make binary synchronisation observable we introduce an additional action which can appear on the transitions of our LTS: τ [a|a]. We let β range over CCS actions α and the new synchronisation actions τ [a|a], and define the CCSTau LTS with rules of the form P β − → Q. To make synchronisation observable we use the following Com rule, instead of that in Table 1.
Note that we annotate the parallel operator with a T -subscript to make clear that it is the CCSTau parallel. Its alphabet contains visible synchronisations.

Definition 10. A(P | T Q) = A(P ) ∪ A(Q) ∪ {τ [a|a] | a ∈ A(P ),ā ∈ A(Q)}
To introduce hiding, we extend CCS syntax with the hiding construct: P :: = . . . | P\ T B. The set B contains actions which are names a or τ [a|a], with the closure condition that "if a ∈ B then a ∈ B and τ [a|a] ∈ B." We introduce the following hiding rules in the LTS which are similar to the CSP rules (Table 2) Hide1 : P The remaining LTS rules consist of Prefix, SumL (and its symmetric), ParL, Res and Rec from Table 1, with the only change that we now use β instead of α for transition annotations. Note that CCSTau restriction cannot restrict τ [a|a] actions as these are single-name actions only.
Encoding CCS into CCSTau. We describe here a translation of CCS processes into CCSTau. This encoding is concerned with hiding the now-observable synchronisation actions.
Definition 11 (c2ccsτ ). Translation function c2ccsτ , when applied to a CCS process, returns a CCSTau process.
In the above definition the only interesting case is parallel which hides the CCStau synchronisation actions, leaving all other actions unaffected. The following theorem shows that the translated terms are strongly bisimilar to the original CCS terms, when there is no parallel under recursion. 2 Theorem 12. Let P be a CCS process. Then: P ∼ c2ccsτ (P ).
Proof. By observing that c2ccsτ is the identity CCS-to-CCSTau translation on parallel-free processes, and then proving the conditions of bisimulation via rule induction on the LTS transitions.

CCSTau Transformations
We provide a translation of CCSTau into CSP in two parts. Here we describe the first part involving the CCSTau transformations, ix, g * , conm, mentioned in Sect. 3.
Indexing (ix). The intention here is that an indexing function assigns unique indices to every prefix in a CCS process. There are many straightforward schemes to choose these indices from the set of natural numbers N. Here, instead of defining a concrete scheme, we specify how it should distribute over CCSTau operators.
where ix −i is some indexing scheme which does not assign the i-index, and ix 1 , ix 2 are some indexing schemes that assign disjoint indices.
Since ix generates unique indexed names, ix(P ) cannot synchronise, whence hidden τ [a|ā] synchronisations are dropped out. They will be recovered later on. In the following, we assume an indexing function ix which satisfies the above properties. Our Haskell implementation [23] indeed implements such an indexing function.
Explicit Binary Synchronisation (g * ). Given an indexed process ix(P ), function g * generates, by over-approximation, a unique name a ij for every possible synchronisation pair (a i ,ā j ) from ix(P ).
Given a set S of names in the context, the next definition shows how g * applies to a CCSTau action and set of actions. For technical convenience, the definition ensures that smaller indices always come first. Definition 14 (g * (S, a), gπ 2 (S, a)).
We can now define our transformation function g * over CCSTau processes.
Definition 15 (g * (S, P )). Let P, Q be ix-indexed CCSTau processes and S a set of names such that S ∩ A(P ) = S ∩ A(Q) = {}.
When P is the top context, we require S = {}. We define: g * (P ) = g * ({}, P ). Condition S ∩ AP = {} allows us to separate P from its context, while the condition that the processes are ix-indexed excludes processes where indexing has not been applied consistently such as g * ((a 1 + a 2 ) {a 2 }).
For restriction, no a i ∈ B should be able to interact with the environment. Hence, (dummy) synchronisations between B and S, {a ij |a i ∈ B,ā j ∈ S|i < j} ∪ {a ji |a i ∈ B,ā j ∈ S|j < i}, should also be restricted.  For hiding, no a i ∈ B should be visible. Unlike restriction, we must hide both dummy and proper synchronisations involving hidden a i s. Identifying Co-names (conm). Unlike CCSTau, synchronisation occurs in CSP between pairs of events that have the same name. That is, (a → P ) Before going into CSP, we need to ensure that a can synchronise withā, more precisely, we only need a ij to synchronise withā ij . This can be achieved through the following renaming function, conm, which transforms anyā ij -name into an a ij -name.

Definition 18 (conm).
Let a i , a ij range over g * -indexed names. Then:

From CCSTau to CSP
Translation into CSP (tl). The translation of CCSTau processes into CSP requires us to translate CCSTau prefixes. To do this we use a fresh (not previously used) CSP event tau, which we will later hide, thus creating a true CSP internal transition. Moreover, we need to translate CCS restriction, which is part of the CCSTau language, into CSP. We do this by introducing a deadlock for the restricted names.

Definition 19. Let P be a CSP process. Then:
We can now present the translation tl from CCSTau to CSP. Hereafter, it will be convenient to refer to the composition of all CCSTau transformations and the tl-translation into CSP as a single function, which we call t2csp. The following definition gives the end-to-end translation from CCS to CSP, as described in Sect. 3.

Definition 25.
Let P be a CCS process. Then: Example 26. In Sect. 3, we discuss at length the translation of CCS binary synchronisation into CSP. This can be illustrated more succinctly as follows:

Correctness of the Translation
Here we discuss the correctness up to a semantic equivalence (Definition 6) of functions g * , t2csp, and ccs2csp defined above. In each case, we use labelled operational correspondence to relate a source term to its translation. In the end, the labelled operational correspondence between a CCS term and its CSP translation is a strong bisimulation, hence, translation ccs2csp is correct up to strong bisimulation.
First, we consider the correctness of g * .
Let P be a CCSTau process. Let c4star(S, P ) = g * S, ix(P ) . Then: Proof. By co-induction on the transitions of P and c4star(S, P ) respectively. E.g., consider every rule yielding a τ transition, e.g., Prefix, Sum. Induction over each rule yields structural induction over P . Apply the definition of c4star, then c4star(S, P ) has a τ transition by successive application of the Sum rule then the Prefix rule. Conversely, given c4star(S, P ), induction over each rule yields structural induction over c4star(S, P ).
Since a ij -names denote synchronisation, τ [a ij |ā ij ]-actions only should be visible/allowed, viz., a ij -names must be restricted. Hence, g * (S, ix(P )) is not correct. We obtain a correct translation by restricting all a ij names.
Proof. Apply the restriction operator, {gπ 2 (S, a i )|a i ∈ Aix(P )}, to every clause in Theorem 27. This eliminates clauses 5 and 6 since a ij can no longer occur.
Theorem 29 (Operational Correspondence of t2csp). Let P be a CCSTau process. Then: Proof. By co-induction on the transitions of P and t2csp(P ) respectively.
Theorem 30 (Correctness of ccs2csp). Let P be a CCS process. Then: We say that ccs2csp is correct up to strong bisimulation.
Proof. Apply c2ccsτ (Definition 11), this turns CCS process P into CCSTau process ccs2τ (P ). Apply −\ csp {a ij }, this hides every a ij from t2csp(c2ccsτ (P )). As a consequence, this eliminates clauses 5 and 6 from Theorem 29. Then apply ai2a, this renames every a i into an a. Thus, every a i from Theorem 29 becomes an a.
The above theorems culminate to the following correctness result of our endto-end translation.
Corollary 31 (Correctness of the Translation up to Strong Bisimulation). Let P be a CCS process. Then: ccs2csp(P ) ∼ P .
A trivial consequence of this corollary is that P ∼ Q ⇔ ccs2csp(P ) ∼ ccs2csp(Q). Since strong bisimulation is included in failure equivalence, we have P ∼ Q ⇔ ccs2csp(P ) = F ccs2csp(Q). We illustrate this subsequently. We have: We also have: Example 33. In particular, from the definition of ccs2csp 2 , we derive: (tl 2 -prefix) implies that τ prefixes are absent from the LTS of the CSP translation. As a consequence, P and ccs2csp 2 (P ) are not strong bisimilar ; however, they are failure equivalent: P = F ccs2csp 2 (P ). Note that ccs2csp (Definition 25) is failure equivalent to ccs2csp 2 : ccs2csp 2 (P ) = F ccs2csp(P ). 3

Structural Properties of the Translation
In the literature of evaluating the relative expressiveness of different calculi, different evaluation criteria for encodings have been proposed (e.g., [6,8,10,11,19,20]). Gorla [11] notably proposes five requirements for a translation to be valid : on the structural end, it must enjoy the compositionality and name invariance properties; on the behavioural end, operational correspondence, divergence reflection, and success sensitiveness. The translation from CCS to CSP we provide here (ccs2csp, Definition 25) is correct up to strong bisimulation (Corollary 31). This is a stronger result than operational correspondence, and by definition, implies both divergence reflection (viz., if a CSP translation diverges then its source CCS term does) and success sensitiveness (viz., a CCS term converges if, and only if, its CSP translation converges, and both converge to the same success final term). Correctness up to strong bisimulation also implies name invariance. E.g., let P be a CCS process, f a given renaming function; then ccs2csp(f (P )) ∼ f (ccs2csp(P )).
Our translation is not compositional in the sense of Gorla [11], whereby a compositional translation T : L 1 → L 2 is such that T(op(S 1 , ..., S k )) = C N op (T(S 1 ), ..., T(S k )), where op is any operator of L 1 , C N op a context that coordinates translated subterms, and N = fn(S 1 , ..., S k ). However, Gorla acknowledges the existence of correct translations that are not compositional and further acknowledges that his proposal is not adequate to deal with encodings defined as a family of translations T Σ , where Σ denotes auxiliary parameters of the translation (including sets of names) [11,Conclusion]. Our encoding from CCS to CSP, ccs2csp (Definition 25), falls into the latter category.

Conclusion and Future Work
In this paper we have studied the relationship between CCS and CSP as part of a greater work that aims to link also Pi-calculus [16] with CSPmob [4]. Many extensions were necessary in order to define the links from CCS to CSP. We have not explored here links in the opposite direction, from CSP to CCS. We leave this to future work. For reference, van Glabbeek [10] proposes a link from CSP to CCS that is correct up to trace equivalence.
We have defined CCSTau, which extends CCS with visible synchronisations and the hiding operator. This allowed us to separate synchronisation from hiding in a CCS context. We notably show that CCS is a subset of CCSTau. We then defined the translation from CCSTau to CSP. In order to achieve this, we extended CSP with the restriction operator.
The most difficult feature to translate was the CCS synchronisation mechanism. In CCS, a single name is capable of both interleaving and synchronisation; and synchronisation (automatically) implies hiding. This is unlike CSP where all these issues are handled in separate operators. The constraint then was to preserve CCS binary synchronisation from capture by CSP multiway synchronisation. To resolve this, we have proposed the g * renaming approach: if two CCS processes can synchronise on an action b, then a name unique to these two processes, say b ij , is generated to substitute b. Hence, only two processes will ever be able to synchronise on b ij after application of g * . This guarantees that in CSP, there will never be more than two processes capable of synchronising on b ij , thus avoiding capture by multiway synchronisation. We show that the g * -based translation is correct. Another solution is possible: extend CSP with binary synchronisation, then translate CCS binary synchronisation into CSP binary synchronisation. We leave the presentation of this alternative to a future publication.
We have proposed here the translation from CCS to CSP only. The main reason for this is our interest in using CSP tools such as FDR for reasoning about CCS processes. With regard to this concern, the g * -renaming approach is more readily implementable than the second approach. The latter would require extending FDR with semantics (viz. rules) for m-among-n synchronisation.
A natural extension of this paper is to translate Pi-calculus [16] into CSPmob [4]. Assuming that CCS is a subset of Pi-calculus and given that CSP is a subset of CSPmob, we will focus our attention on mobility constructs hence. Our final goal is to formalise our results in Unifying Theories of Programming (UTP) [13]. One advantage of the latter would be the extension of both CCS and CSP with a richer notion of state. For illustration, Garavel [9] deplores the limitations of the prefix operator in both CCS and CSP and shows that a richer form of sequential composition can be achieved based on a richer notion of state. Moving to UTP will also allow us to mechanise our results using ongoing mechanisation of UTP theories in Isabelle [7], and link up with Isabelle mechanisation of Psi-calculi [2] (a variant of Pi-calculus).