SEKE 2012 Proceedings - Knowledge Systems Institute

the set of all actions.
(4) VP I , VO P and VH P are disjoint sets of input, output, and
internal variables, respectively. We denote by V P = VP I ∪ VO P ∪
VP
H the set of all variables.
(5) FP S is a map, which maps any state in S P to a state schema
in Z language. Intuitively, for any state s, FP S (s) specifies the
data structure properties of all the variables in the state s.
(6) FP A is a map, which maps any input action in AI P to an
input operation schema in Z language, and maps any output
action in A O P to an output operation schema in Z language, and
maps any internal action in A H P to an internal operation schema
in Z language. Intuitively, for any action a, FP A (a) specifies the
data structure properties of all the variables before and after
performing action a.
(7) G IA
P is a map, which maps any input action in AI P to a
set of input variables. Intuitively, an input action a inputs all
the input variables in G IA
P (a). For any input action a, GIA P (a) ⊆
V I (FP A(a)).
(8) G OA
P is a map, which maps any output action in AI P to a
set of output variables. Intuitively, an output action a outputs
all the output variables in G OA
P (a). For any output action a,
G OA
P (a) ⊆ VO (FP A(a)).
(9) A □ P , A♦ P ⊆ AI P ∪AO P , where A□ P is the set of must actions,
and A ♦ P is the set of may actions.
(10) VP □, V♦ P ⊆ VI P ∪ VO P , where V□ P is the set of must
variables, and V ♦ P is the set of may variables.
(11) T P is the set of transitions between states, T P ⊆ S P ×
A P × S P .If(s, a, t) ∈ T P then ((FP S(s) ∧ FA P (a))\(x 1, ..., x m ) ⇔
FP S(t)[y′ 1/y 1 , ..., y ′ n/y n ]) is a tautology, where {x 1 , ..., x m } is
the set of the variables in FP S(s), {y 1, ..., y n } is the set of the
variables in FP S(t), the set of variables in FA P (a) is the subset
of {x 1 , ..., x m }∪{y ′ 1, ..., y ′ n}.
An action a ∈ A P is enabled at a state s ∈ V P if there
is a step (s, a, s ′ ) ∈ T P for some s ∈ S P . We indicate by
A I P (s), AO P (s), AH P (s) the subsets of input, output and internal
actions that are enabled at the state s and we let A P (s) =
A I P (s) ∪ AO P (s) ∪ AH P (s).
In the following, we call a a must (may) action if a ∈ A □ P
(a ∈ A ♦ P ), and call x a must (may) action if a ∈ V□ P
(a ∈ V ♦ P ). A must action (variable) can be regarded as a
necessary action (variable), i.e., an action (a variable) which
must be included in the implementation, and a may action
(variable) can be regarded as a possible action (variable), i.e.,
an action (a variable) which may be or may not be included
in the implementation. Another usefulness of must actions
(variables) and may actions (variables) is in the abstraction
of systems. In general, abstraction in model checking falls
into three types, depending on the approximation relations
between concrete and abstract models and property preservation
relations for temporal properties. One type is abstraction
methods that support both verification and refutation of program
properties in the same framework, which we refer to
as exact-approximation. In the over-approximation abstraction
framework [6], an abstract model contains more behaviors than
the original program. The dual of this framework is underapproximation
[13]. In this case, an abstract model contains
less behaviors than the original one. In the following definition
of modal refinement relation of modal ZIAs, must actions
(variables) provide the over-approximation method of actions
(variables), and may actions (variables) provide the underapproximation
method of actions (variables).
B. Modal Refinement Relation
The modal refinement relation aims at formalizing the
relation between abstract and concrete versions of the same
component, for example, between a specification and its implementation.
Roughly, a modal ZIA P refines a modal ZIA Q if all the
must actions of P can be simulated by Q and all the may
actions of Q can be simulated by P. To define this concept,
we need some preliminary notions.
In the following, we use V ♦ (A) to denote the set of may
variables in Z schema A, V □ (A) to denote the set of must
variables in Z schema A, and V ⊗ (A) to denote the set of other
variables in Z schema A.
In order to define the modal refinement relation between Z
schemas, we need the following notation.
Definition 2. Consider two Z schemas A and B with
V ♦ (A) =V ♦ (B), V □ (A) =V □ (B) and V ⊗ (A) =V ⊗ (B) =∅.
We use the notation A ≥ B if one of the following cases holds:
(1) If V ♦ (A) ≠ ∅ and V □ (A) ≠ ∅ then given an assignment
ρ on V ♦ (A), for any assignment σ on V □ (A), ρ ∪ σ |=
A implies ρ ∪ σ |= B, and given an assignment σ on V □ (A),
for any assignment ρ on V ♦ (A), ρ∪σ |= B implies ρ∪σ |= A,
where ρ |= A means that A is true under assignment ρ, ρ ∪ σ
is the union of ρ and σ.
(2) If V ♦ (A) ≠ ∅ and V □ (A) =∅ then for any assignment
ρ on V ♦ (A), ρ|= B implies ρ |= A.
(3) If V ♦ (A) =∅ and V □ (A) ≠ ∅ then for any assignment
ρ on V □ (A), ρ|= A implies ρ |= B.
(4) V ♦ (A) =∅ and V □ (A) =∅.
Intuitively, A ≥ B means that schemas A and B have the
same may variables and the same must variables, and schema
B has bigger domains of must variables but smaller ranges of
may variables than schema A. This means that must variables
can be regarded as the over-approximation of variables, and
may variables can be regarded as the under-approximation of
variables.
For example, Â=[x ♦ : R; y □ : N | y □ =2⌊x ♦ ⌋] ≥ B̂=[x ♦ :
N; y □ : R | y □ =2x ♦ ], where x ♦ is a may variable, y □ is a
must variable, N is the set of natural numbers, R is the set of
real numbers, and ⌊x ♦ ⌋ is the largest natural number that is
not larger than x ♦ .
Now we give the modal refinement relation between Z
schemas, which describe the modal refinement relation between
data structures properties of states. Roughly speaking,
for two Z schemas A and B, we say that B refines A if the may
variables and the must variables in A are also in B, and schema
B has bigger domains of these may variables but smaller ranges
of these must variables than schema A.
Definition 3. Consider two Z schemas A and B, we use the
notation A B if
527