Reactive Systems: Modelling, Specification and Verification - Cs.ioc.ee

CHAPTER 6. HML WITH RECURSION 119
• Does (6.1) have a solution? And what precisely do we mean by that?
• If (6.1) has more than one solution, which one do we choose?
• How can we compute whether a process satisfies the formula described by
(6.1)?
Precise answers to these questions will be given in the remainder of this chapter.
However, to motivate our subsequent technical developments, it is appropriate here
to discuss briefly the first two questions above.
Recall that the meaning of a formula (with respect to a labelled transition system)
is the set of processes that satisfy it. Therefore, it is natural to expect that a
set S of processes that satisfy the formula described by equation (6.1) should be
such that:
S = 〈·a·〉Proc ∩ [·a·]S .
It is clear that S = ∅ is a solution to the equation (as no process can satisfy both
〈a〉tt and [a]ff). However, the process p on Figure 6.1 can perform an a-transition
invariantly and p ∈ ∅, so this cannot be the solution we are looking for. Actually
it turns out that it is the largest solution we need here, namely S = {p}. The set
S = ∅ is the least solution.
In other cases it is the least solution we are interested in. For instance, we can
express Pos([a]ff) by the following equation:
Y ≡ [a]ff ∨ 〈a〉Y .
Here the largest solution is Y = {p, q, r} but, as the process p on Figure 6.1 cannot
terminate at all, this is clearly not the solution we are interested in. The least
solution of the above equation over the labelled transition system on Figure 6.1 is
Y = {q, r} and is exactly the set of processes in that labelled transition system that
intuitively satisfy Pos([a]ff).
When we write down a recursively defined property, we can indicate whether
we desire the least or the largest solution by adding this information to the equality
sign. For Inv(〈a〉tt) we want the largest solution, and in this case we write
For Pos([a]ff) we will write
X max
= 〈a〉tt ∧ [a]X .
Y min
= [a]ff ∨ 〈a〉Y .
More generally we can express that the formula F holds for each reachable state
in a labelled transition system having set of actions Act (written Inv(F ), and read