Reactive Systems: Modelling, Specification and Verification - Cs.ioc.ee
Reactive Systems: Modelling, Specification and Verification - Cs.ioc.ee
Reactive Systems: Modelling, Specification and Verification - Cs.ioc.ee
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
7.1. SPECIFYING MUTUAL EXCLUSION IN HML 163<br />
It is not possible for both processes to be in their critical sections at<br />
the same time.<br />
In light of our CCS formalization of the processes P1 <strong>and</strong> P2, we know that process<br />
Pi (i ∈ {1, 2}) is in its critical section precisely when it can perform action exiti.<br />
So our formula F can be taken to be<br />
F def<br />
= [exit1]ff ∨ [exit2]ff .<br />
The formula Inv(F ) now states that it is invariantly the case that either P1 is not<br />
in the critical section or that P2 is not in the critical section, which is an equivalent<br />
formulation of our correctness criterion.<br />
Throughout this chapter, we are interpreting the modalities in HML over the<br />
transition system whose states are CCS processes, <strong>and</strong> whose transitions are weak<br />
transitions of the form α ⇒ for any action α including τ. So a formula like [exit1]ff<br />
is satisfied by all processes that do not afford an exit1<br />
⇒ -labelled transition—that is,<br />
by those processes that cannot perform action exit1 no matter how many internal<br />
steps they do before.<br />
Exercise 7.4 Consider the formula Inv(G), where G is<br />
([enter1][enter2]ff) ∧ ([enter2][enter1]ff) .<br />
Would such a formula be a good specification for our correctness criterion? What<br />
if we took G to be the formula<br />
(〈enter1〉[enter2]ff) ∧ (〈enter2〉[enter1]ff) ?<br />
Argue for your answers! <br />
Now that we have a formal description of Peterson’s algorithm, <strong>and</strong> a specification<br />
of a correctness criterion for it, we could try to establish whether process Peterson<br />
satisfies the formula Inv(F ) or not.<br />
With some painstaking effort, this could be done manually either by showing<br />
that the set of states of the process Peterson is a post-fixed point of the set function<br />
associated with the mapping<br />
S ↦→ [F ] ∩ [·Act·]S ,<br />
or by iteratively computing the largest fixed point of the above mapping. The good<br />
news, however, is that we do not n<strong>ee</strong>d to do so! One of the benefits of having<br />
formal specifications of systems <strong>and</strong> of their correctness criteria is that, at least in