Reactive Systems: Modelling, Specification and Verification - Cs.ioc.ee

Chapter 6
Hennessy-Milner logic with
recursive definitions
An HML formula can only describe a finite part of the overall behaviour of a process.
In fact, as each modal operator allows us to explore the effect of taking one
step in the behaviour of a process, using a single HML formula we can only describe
properties of a fixed finite fragment of the computations of a process. As
those of you who solved Exercise 5.13 already discovered, how much of the behaviour
of a process we can explore using a single formula is entirely determined
by its so-called modal depth—i.e., by the maximum nesting of modal operators in
it. For example, the formula ([a]〈a〉ff) ∨ 〈b〉tt has modal depth 2, and checking
whether a process satisfies it or not involves only an analysis of its sequences of
transitions whose length is at most 2. (We will return to this issue in Section 6.6,
where a formal definition of the modal depth of a formula will be given.)
However, we often wish to describe properties that describe states of affairs
that may or must occur in arbitrarily long computations of a process. If we want
to express properties like, for example, that a process is always able to perform
a given action, we have to extend the logic. As the following example indicates,
one way of doing so is to allow for infinite conjunctions and disjunctions in our
property language.
Example 6.1 Consider the processes p and q in Figure 6.1. It is not hard to come
up with an HML formula that p satisfies and q does not. In fact, after performing
an a-action, p will always be able to perform another one, whereas q may fail to do
so. This can be captured formally in HML as follows:
p |= [a]〈a〉tt but
q |= [a]〈a〉tt .
115