Reactive Systems: Modelling, Specification and Verification - Cs.ioc.ee

CHAPTER 6. HML WITH RECURSION 117
expressed by the conjunct [a] i 〈a〉tt because a is the only action in our
example labelled transition system).
On the other hand, the process q has the option of terminating at any time by performing
the a-labelled transition leading to process r, or equivalently it is possible
from q to satisfy [a]ff. Let us call this property Pos([a]ff). We can express it in
an extension of HML as the following infinite disjunction:
Pos([a]ff) = [a]ff ∨ 〈a〉[a]ff ∨ 〈a〉〈a〉[a]ff ∨ · · · =
〈a〉 i [a]ff ,
where 〈a〉 i stands for a sequence of modal operators 〈a〉 of length i. This formula
can be read as follows:
In order for a process to have the possibility of refusing an a-action at
some point, this action should either be refused now (as expressed by
the disjunct [a]ff), or, for some positive integer i, it should be possible
to reach a state in which an a can be refused by performing a sequence
of i actions (as expressed by the disjunct 〈a〉 i [a]ff because a is the
only action in our example labelled transition system).
Even if it is theoretically possible to extend HML with infinite conjunctions and
disjunctions, infinite formulae are not particularly easy to handle (for instance they
are infinitely long, and we would have a hard time using them as inputs for an
algorithm). What do we do instead? The answer is in fact both simple and natural
for a computer scientist; let us introduce recursion into our logic. Assuming for the
moment that a is the only action, we can then express Inv(〈a〉tt) by means of the
following recursive equation:
i≥0
X ≡ 〈a〉tt ∧ [a]X , (6.1)
where we write F ≡ G if and only if the formulae F and G are satisfied by exactly
the same processes—i.e., if [F ] = [G]. The above recursive equation captures the
intuition that a process that can invariantly perform an a-labelled transition—that
is, one that can perform an a-labelled transition in all of its reachable states—can
certainly perform one now, and, moreover, each state that it reaches via one such
transition can invariantly perform an a-labelled transition. This looks deceptively
easy and natural. However, the mere fact of writing down an equation like (6.1)
does not mean that this equation makes sense! Indeed, equations may be seen as