Reactive Systems: Modelling, Specification and Verification - Cs.ioc.ee
Reactive Systems: Modelling, Specification and Verification - Cs.ioc.ee
Reactive Systems: Modelling, Specification and Verification - Cs.ioc.ee
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
104 CHAPTER 5. HENNESSY-MILNER LOGIC<br />
We write p |= F , read ‘p satisfies F ’, iff p ∈ [F ].<br />
Two formulae are equivalent if, <strong>and</strong> only if, they are satisfied by the same<br />
processes in every transition system. <br />
Example 5.1 In order to underst<strong>and</strong> the definition of the set operators 〈·a·〉, [·a·]<br />
introduced above, it is instructive to look at an example. Consider the following<br />
labelled transition system.<br />
Then<br />
s<br />
a<br />
<br />
<br />
t<br />
<br />
a<br />
<br />
a<br />
<br />
<br />
<br />
b<br />
s1<br />
<br />
s2 <br />
t1 <br />
〈·a·〉{s1, t1} = {s, t} .<br />
This means that 〈·a·〉{s1, t1} is the collection of states from which it is possible to<br />
perform an a-labelled transition ending up in either s1 or t1. On the other h<strong>and</strong>,<br />
[·a·]{s1, t1} = {s1, s2, t, t1} .<br />
The idea here is that [·a·]{s1, t1} consists of the set of all processes that become<br />
either s1 or t1 no matter how they perform an a-labelled transition. Clearly, s does<br />
not have this property because it can perform the transition s a → s2, whereas t does<br />
because its only a-labelled transition ends up in t1. But why are s1, s2 <strong>and</strong> t1 in<br />
[·a·]{s1, t1}? To s<strong>ee</strong> this, look at the formal definition of the set<br />
[·a·]{s1, t1} = {p ∈ Proc | p a → p ′ implies p ′ ∈ {s1, t1}, for each p ′ } .<br />
Since s1, s2 <strong>and</strong> t1 do not afford a-labelled transitions, it is vacuously true that all<br />
of their a-labelled transitions end up in either s1 or t1! This is the reason why those<br />
states are in the set [·a·]{s1, t1}.<br />
We shall come back to this important point repeatedly in what follows. <br />
Exercise 5.1 Consider the labelled transition system in the example above. What<br />
are 〈·b·〉{s1, t1} <strong>and</strong> [·b·]{s1, t1}? <br />
Let us now re-examine the properties of our computer scientist that we mentioned<br />
earlier, <strong>and</strong> let us s<strong>ee</strong> whether we can express them using HML. First of all, note<br />
that, for the time being, we have defined the semantics of formulae in M in terms<br />
b<br />
b