Reactive Systems: Modelling, Specification and Verification - Cs.ioc.ee

7.3. TESTING MUTUAL EXCLUSION 173
1. For every action a in L, the formula 〈a〉tt is not testable.
2. Let a and b be two distinct actions in L. Then the formula [a]ff ∨ [b]ff is not
testable.
Proof: We prove each statement in turn.
• PROOF OF (1). Assume, towards a contradiction, that a test T tests for the
formula 〈a〉tt. Since T tests for 〈a〉tt and 0 |= 〈a〉tt, we have that
(0 | root(T )) \ L bad
⇒ .
Consider now the term P = a.0 + τ.0. As P a → 0, the process P satisfies
the formula 〈a〉tt. However, P fails the test T because
(P | root(T )) \ L τ → (0 | root(T )) \ L bad
⇒ .
This contradicts our assumption that T tests for 〈a〉tt.
• PROOF OF (2). Assume, towards a contradiction, that a test T tests for the
formula [a]ff ∨ [b]ff, with a = b. Since the state a.0 + b.0 does not satisfy
the formula [a]ff ∨ [b]ff, it follows that
((a.0 + b.0) | root(T )) \ L bad
⇒ . (7.2)
We now proceed to show that this implies that either the state a.0 fails the
test T or b.0 does. This we do by examining the possible forms transition
(7.2) may take.
– CASE: ((a.0 + b.0) | root(T )) \ L bad
⇒ because root(T ) bad
⇒. In this
case, every state of an LTS fails the test T , and we are done.
– CASE: ((a.0 + b.0) | root(T )) \ L τ ⇒ (0 | t) \ L bad
→, because
root(T ) ā ⇒ t for some state t of T . In this case, we may infer that
(a.0 | root(T )) \ L τ ⇒ (0 | t) \ L bad
→
and thus that a.0 fails the test T .
– CASE: ((a.0 + b.0) | root(T )) \ L τ ⇒ (0 | t) \ L bad
→, because
root(T ) ¯ b ⇒ t for some state t of T . In this case, reasoning as above, it
is easy to see that b.0 fails the test T .