Timed CTL Model Checking in Real-Time Maude⋆ - IfI

14 D. Lepri, E. Ábrahám, and P. Cs. Ölveczky
– ϕ ′ = true: R, t |=c true for all t by the definition of |=c.
– ϕ ′ = p: Since all steps between tπ i and tπj are tick steps, the property follows
from the tick-invariance of p.
Assume now that the lemma holds for the subformulae ϕ1 and ϕ2.
– ϕ ′ = ¬ϕ1:
– ϕ ′ = ϕ1 ∧ ϕ2:
– ϕ ′ = E ϕ1 UI ϕ2:
R, t π i |=c ¬ϕ1 ⇐⇒ not (R, t π i |=c ϕ1)
induction
⇐⇒ not (R, t π j |=c ϕ1)
⇐⇒ R, t π j |=c ¬ϕ1 .
R, t π i |=c ϕ1 ∧ ϕ2 ⇐⇒ R, t π i |=c ϕ1 and R, t π i |=c ϕ2
induction
⇐⇒ R, t π j |=c ϕ1 and R, t π j |=c ϕ2
⇐⇒ R, t π j |=c ϕ1 ∧ ϕ2 .
We define d1 = dπ i −n¯r, d2 = dπ j −dπi and d3 = (n+1)¯r−d π j . Let furthermore
πpre denote the prefix of π ending at tπ i and let πpre i denote the tick sequence
tπ ri
i −→ . . . rj−1
−→ tπ j . Let ml¯r be the lower bound of I. The upper bound of I
is either INF or a finite bound mu¯r.
“⇒”: The proof structure is illustrated on Figure 1.
Assume that R, t π i |=c E ϕ1 UI ϕ2 holds. Then by definition there is a path
πi ∈ tfPaths T K(t π i ) such that for each time refinement π′ i ∈ tfPaths T K(t π i )
of πi there is an index k s.t. d π′ i
i
k ∈ I, T K, tπ′
k |=c ϕ2, and T K, t π′ i
l |=c ϕ1 for
all 0 ≤ l < k.
Let πi be such a path. Due to time robustness, πi has a time refinement
π ′ i ∈ tfPathsT K(tπ i ) which contains the state tπj at time point d2, a state t∗ at time point7 ml¯r − d1/2 in case ml > 0, and a state t∗∗ at time point
ml¯r + d2 (which is tπ j in case ml = 0). Note that time robustness assures
that the state in π ′ i at time point d2 is tπ j .
Let π ′ i be such a path. Let πpre′ i and πj be the prefix resp. suffix of π ′ i
ending resp. starting at tπ j at the time point d2. We show that πj satisfies
the conditions for R, tπ j |=c E ϕ1 UI ϕ2.
Let π ′ j be a time refinement of πj. Then the concatenation π ′′
i
of πpre′
i
π ′ j is a time refinement of πi. By assumption there is an index k s.t. d π′′
i
k
and
∈ I,
T K, t π′′
i
k |=c ϕ2, and T K, t π′′
i
l |=c ϕ1 for all 0 ≤ l < k.
Let k be such an index and let π ′ be the concatenation of πpre and π ′′
i .
Remember that ml¯r is the lower bound of I. We distinguish between (i)
d π′′
i
k ∈ I1 = [ml¯r, ml¯r + d2 + d3) and (ii) d π′′
i
k ∈ I2 = I\I1.
7 For intuition we sample the middle point between ml¯r − d1 and ml¯r. However, any
time point in the interval (ml¯r − d1, ml¯r) would fit for our purpose.