14.08.2013 Views

Reactive Systems: Modelling, Specification and Verification - Cs.ioc.ee

Reactive Systems: Modelling, Specification and Verification - Cs.ioc.ee

Reactive Systems: Modelling, Specification and Verification - Cs.ioc.ee

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

80 CHAPTER 3.5. GAME CHARACTERIZATION OF BISIMILARITY<br />

We remind the reader of the fact that, in the weak bisimulation game from the<br />

current configuration (s, t), if the attacker chooses a move under the silent action<br />

τ (let us say s τ → s ′ ) then the defender can (as one possibility) simply answer by<br />

doing ‘nothing’, i.e., by idling in the state t (as we always have t<br />

τ<br />

⇒ t). In that<br />

case, the current configuration becomes (s ′ , t).<br />

Again, the notions of play <strong>and</strong> universal winning strategy in the weak bisimulation<br />

game are best explained by means of an example.<br />

Example 3.8 Consider the following transition system.<br />

s<br />

a<br />

τ<br />

<br />

<br />

s1 <br />

t1<br />

<br />

b<br />

a<br />

a <br />

<br />

<br />

<br />

<br />

a<br />

<br />

<br />

s2 s3 t2<br />

<br />

τ<br />

t3<br />

We will show that s ≈ t by defining a universal winning strategy for the attacker<br />

in the weak bisimulation game from (s, t).<br />

In the first round, the attacker selects the left-h<strong>and</strong> side <strong>and</strong> action a, <strong>and</strong> plays<br />

the move s a → s1. The defender has thr<strong>ee</strong> possible moves to answer: (i) t a ⇒ t2 via<br />

t1, (ii) t a ⇒ t2 via t1 <strong>and</strong> t3, <strong>and</strong> (iii) t a ⇒ t3 via t1. In case (i) <strong>and</strong> (ii) the current<br />

configuration becomes (s1, t2) <strong>and</strong> in case (iii) it becomes (s1, t3).<br />

From the configuration (s1, t2) the attacker wins by playing s1 b → s3, <strong>and</strong> the<br />

defender loses because t2 b .<br />

From the configuration (s1, t3) the attacker plays the τ-move from the right-<br />

τ<br />

τ<br />

h<strong>and</strong> side: t3 → t2. Defender’s only answer from s1 is s1 ⇒ s1 because no τ<br />

actions are enabled from s1. The current configuration becomes (s1, t2) <strong>and</strong>, as<br />

argued above, the attacker has a winning strategy from this pair.<br />

This concludes the proof <strong>and</strong> shows that s ≈ t because we found a universal<br />

winning strategy for the attacker. <br />

Exercise 3.41 In the weak bisimulation game the attacker is allowed to use a →<br />

moves for the attacks, <strong>and</strong> the defender can use a ⇒ moves in response. Argue that<br />

if we modify the rules of the game so that the attacker can also use moves of the<br />

form a ⇒ then this does not provide any additional power for the attacker. Conclude<br />

that both versions of the game provide the same answer about bisimilarity/nonbisimilarity<br />

of two processes. <br />

a<br />

<br />

t4<br />

t<br />

b<br />

<br />

t5

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!