Reactive Systems: Modelling, Specification and Verification - Cs.ioc.ee

7.2. SPECIFYING MUTUAL EXCLUSION USING CCS ITSELF 167
Note that the collection of weak traces coincides with that of traces for processes
that, like MutexSpec, do not afford internal transitions. (Why?)
We claim that the processes Peterson and MutexSpec are weak trace equivalent,
and therefore that Peterson does meet our specification of mutual exclusion modulo
weak trace equivalence. This can be checked automatically using the command
mayeq provided by the CWB. (Do so!) This equivalence tells us that not only each
weak trace of process Peterson is allowed by the specification MutexSpec, but also
that process Peterson can exhibit as a weak trace each of the traces permitted by
the specification.
If we are just satisfied with checking the pure safety condition that no trace
of process Peterson violates the mutual exclusion property, then it suffices only to
show that Peterson is a weak trace approximation of MutexSpec. A useful proof
technique that can be used to establish this result is given by the notion of weak
simulation. (Compare with the notion of simulation defined in Exercise 3.17.)
Definition 7.2 [Weak simulation] Let us say that a binary relation R over the set
of states of an LTS is a weak simulation iff whenever s1 R s2 and α is an action
(including τ):
- if s1 α → s ′ 1 , then there is a transition s2 α ⇒ s ′ 2 such that s′ 1 R s′ 2 .
We say that s ′ weakly simulates s iff there is a weak simulation R with s R s ′ .
Proposition 7.1 For all states s, s ′ , s ′′ in a labelled transition system, the following
statements hold.
1. State s weakly simulates itself.
2. If s ′ weakly simulates s, and s ′′ weakly simulates s ′ , then s ′′ weakly simulates
s.
3. If s ′ weakly simulates s, then each weak trace of s is also a weak trace of s ′ .
In light of the above proposition, to show that Peterson is a weak trace approximation
of MutexSpec, it suffices only to build a weak simulation that relates Peterson
with MutexSpec. The existence of such a weak simulation can be checked using
the command pre offered by the CWB. (Do so!)
Exercise 7.8 Prove Proposition 7.1.
Exercise 7.9 Assume that s ′ weakly simulates s, and s weakly simulates s ′ . Is it
true that s and s ′ are observationally equivalent? Argue for your answer.