Reactive Systems: Modelling, Specification and Verification - Cs.ioc.ee

7.3. TESTING MUTUAL EXCLUSION 171
Definition 7.3 [Tests] A test is a finite, rooted LTS T over the set of actions Act ∪
{bad}, where bad is a distinguished channel name not occurring in Act. We use
root(T ) to denote the start state of the LTS T .
As above, the idea is that a test acts as a monitor that ‘observes’ the behaviour of
a process and reports any occurrence of an undesirable situation by performing a
bad-labelled transition.
In the remainder of this section, tests will often be concisely described using
the regular fragment of Milner’s CCS—that is the fragment of CCS given by the
following grammar :
T ::= 0 | α.T | T + T | X ,
where α can be any action in Act as well as the distinguished action bad, and X
is a constant drawn from a given, finite set of process names. The right-hand side
of the defining equations for a constant can only be a term generated by the above
grammar. For example, the process MutexTest we specified above is a regular CCS
process, but the term
X def
= a.(b.0 | X)
is not.
We now proceed to describe formally how tests can be used to check whether
a process satisfies a formula expressed in HML with recursion.
Definition 7.4 [Testing properties] Let F be a formula in HML with recursion,
and let T be a test.
• For every state s of an LTS, we say that s passes the test T iff
(s | root(T )) \ L bad
.
(Recall that L stands for the collection of observable actions in CCS except
for the action bad.) Otherwise we say that s fails the test T .
• We say that the test T tests for the formula F (and that F is testable) iff for
every LTS T and every state s of T ,
s |= F iff s passes the test T .
• A collection of formulae in HML with recursion is testable iff each of the
formulae in it is.