Reactive Systems: Modelling, Specification and Verification - Cs.ioc.ee

174 CHAPTER 7. MODELLING MUTUAL EXCLUSION ALGORITHMS
Hence, as previously claimed, either a.0 fails the test T or b.0 does. Since
both a.0 and b.0 satisfy the formula [a]ff ∨ [b]ff, this contradicts our assumption
that T tests for it.
The proof is now complete. ✷
The collection of formulae in safety HML is the set of formulae in HML with
recursion that do not contain occurrences of ∨, 〈α〉 and variables defined using
least fixed point recursion equations. For instance, the formula 〈a〉X is not a legal
formula in safety HML if X is defined thus:
X min
= 〈b〉tt ∨ 〈a〉X .
Exercise 7.15 (Strongly recommended) Can you build a test (denoted by a process
in the regular fragment of CCS) for each formula in safety HML without
recursion? Hint: Use induction on the structure of formulae.
It turns out that, with the addition of recursive formulae defined using largest fixed
points, the collection of testable formulae in HML with recursion is precisely the
one you built tests for in the previous exercise! This is the import of the following
result from (Aceto and Ingolfsdottir, 1999).
Theorem 7.1 The collection of formulae in safety HML is testable. Moreover,
every testable property in HML with recursion can be expressed in safety HML.
Thus we can construct tests for safety properties expressible in HML with recursion.
We refer the interested readers to (Aceto and Ingolfsdottir, 1999) for more
details, further developments and references to the literature.