Reactive Systems: Modelling, Specification and Verification - Cs.ioc.ee
Reactive Systems: Modelling, Specification and Verification - Cs.ioc.ee
Reactive Systems: Modelling, Specification and Verification - Cs.ioc.ee
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
7.3. TESTING MUTUAL EXCLUSION 169<br />
is, for instance,<br />
MutexTest<br />
MutexTest1<br />
MutexTest2<br />
def<br />
= enter1.MutexTest1 + enter2.MutexTest2<br />
def<br />
= exit1.MutexTest + enter2.bad.0<br />
def<br />
= exit2.MutexTest + enter1.bad.0 ,<br />
where we have assumed that our monitor process outputs on channel name bad,<br />
when it discovers that two enter actions have occurred without an intervening exit.<br />
In order to check whether process Peterson ensures mutual exclusion, it is now<br />
sufficient to let it interact with MutexTest, <strong>and</strong> ask whether the resulting system<br />
(Peterson | MutexTest) \ {enter1, enter2, exit1, exit2}<br />
can initially perform the action bad. Ind<strong>ee</strong>d, we have the following result.<br />
Proposition 7.2 Let P be a CCS process whose only visible actions are contained<br />
in the set L ′ = {enter1, enter2, exit1, exit2}. Then (P | MutexTest)\L ′ bad<br />
⇒ iff either<br />
P σ ⇒ P ′ enter1<br />
⇒ P ′′ enter2<br />
⇒ P ′′′ σ<br />
or P ⇒ P ′ enter2<br />
⇒ P ′′ enter1<br />
⇒ P ′′′ , for some P ′ , P ′′ , P ′′′<br />
<strong>and</strong> some sequence of actions σ in the regular language (enter1exit1+enter2exit2) ∗ .<br />
Proof: For the ‘if implication’, assume, without loss of generality, that<br />
P σ ⇒ P ′ enter1 ′′ enter2 ′′′<br />
⇒ P ⇒ P<br />
for some P ′ , P ′′ , P ′′′ <strong>and</strong> sequence of actions σ ∈ (enter1exit1 +enter2exit2) ∗ . We<br />
shall argue that (P | MutexTest) \ L ′ bad<br />
⇒. To s<strong>ee</strong> this, note that, using induction on<br />
the length of the sequence σ, it is not hard to prove that<br />
(P | MutexTest) \ L ′ τ ⇒ (P ′ | MutexTest) \ L ′<br />
Since P ′ enter1<br />
⇒ P ′′ enter2<br />
⇒ P ′′′ , we have that<br />
(P ′ | MutexTest) \ L ′ τ ⇒ (P ′′ | MutexTest1) \ L ′ τ ⇒ (P ′′′ | bad.0) \ L ′ bad<br />
→ .<br />
Combining the above sequences of transitions, we may conclude that<br />
which was to be shown.<br />
(P | MutexTest) \ L ′ bad<br />
⇒ ,<br />
,<br />
.