Reactive Systems: Modelling, Specification and Verification - Cs.ioc.ee

6.4. GAME CHARACTERIZATION FOR HML WITH RECURSION 129
where a ∈ Act and there is exactly one defining equation for the variable X, which
is of the form
or
X min
= FX
X max
= FX ,
where FX is a formula of the logic which may contain occurrences of the variable
X.
Let (Proc, Act, { a →| a ∈ Act}) be a labelled transition system and F a formula
of Hennessy-Milner logic with one (recursively defined) variable X. Let s ∈ Proc.
We shall describe a game between an ‘attacker’ and a ‘defender’ which has the
following goal:
• the attacker is aiming to prove that s |= F , while
• the defender is aiming to prove that s |= F .
The configurations of the game are pairs of the form (s, F ) where s ∈ Proc and F
is a formula of Hennessy-Milner logic with one variable X. For every configuration
we define the following successor configurations according to the structure of
the formula F (here s is ranging over Proc):
• (s, tt) and (s, ff) have no successor configurations,
• (s, F1 ∧F2) and (s, F1 ∨F2) both have two successor configurations, namely
(s, F1) and (s, F2),
• (s, 〈a〉F ) and (s, [a]F ) both have the successor configurations (s ′ , F ) for
every s ′ such that s a → s ′ , and
• (s, X) has only one successor configuration (s, FX), where X is defined via
the equation X max
= FX or X min
= FX.
A play of the game starting from (s, F ) is a maximal sequence of configurations
formed by the players according to the following rules.
• The attacker picks a successor configuration for every current configuration
of the form (s, F1 ∧ F2) and (s, [a]F ).
• The defender picks a successor configuration for every current configuration
of the form (s, F1 ∨ F2) and (s, 〈a〉F ).