Timed CTL Model Checking in Real-Time Maude⋆ - IfI
Timed CTL Model Checking in Real-Time Maude⋆ - IfI
Timed CTL Model Checking in Real-Time Maude⋆ - IfI
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
16 D. Lepri, E. Ábrahám, and P. Cs. Ölveczky<br />
(i) Assume first that d π′′<br />
i<br />
k ∈ I1 = [ml¯r, ml¯r + d2 + d3). We observe that<br />
π ′′<br />
i conta<strong>in</strong>s the state t∗∗ at time po<strong>in</strong>t ml¯r + d2 (we added this sample<br />
po<strong>in</strong>t when ref<strong>in</strong><strong>in</strong>g πi to π ′ i ), thus t∗∗ appears <strong>in</strong> π ′ at time po<strong>in</strong>t (n +<br />
ml)¯r + d1 + d2. Furthermore, we assumed that d π′′<br />
i<br />
k<br />
d π′′<br />
i<br />
k < ml¯r + d2 + d3, imply<strong>in</strong>g that t π′′<br />
i<br />
∈ I1, i.e., ml¯r ≤<br />
k appears <strong>in</strong> π′ at a time po<strong>in</strong>t <strong>in</strong><br />
[(n + ml)¯r + d1, (n + ml + 1)¯r). Thus both t∗∗ and t π′′ i<br />
k appear <strong>in</strong> π′ <strong>in</strong><br />
the <strong>in</strong>terval ((n + ml)¯r, (n + ml + 1)¯r), and from T K, t π′′ i<br />
k |=c ϕ2 we get<br />
by <strong>in</strong>duction that T K, t∗∗ |=c ϕ2.<br />
Note that t∗∗ also appears <strong>in</strong> π ′ j . We want to show that the <strong>in</strong>dex of t∗∗ <strong>in</strong><br />
π ′ j satisfies the conditions for the satisfaction of the until formula by π′ j .<br />
We already have shown that T K, t∗∗ |=c ϕ2. Additionally, t∗∗ appears <strong>in</strong><br />
at time po<strong>in</strong>t ml¯r,<br />
π ′′<br />
i at time po<strong>in</strong>t ml¯r + d2, therefore it appears <strong>in</strong> π ′ j<br />
which is the left end po<strong>in</strong>t of the <strong>in</strong>terval I.<br />
In case ml = 0 we are done, because tπ j satisfies ϕ2 and there are no<br />
states prior to tπ j <strong>in</strong> π′ j . Otherwise, if ml > 0, it rema<strong>in</strong>s to show that all<br />
states prior to t∗∗ <strong>in</strong> π ′ j satisfy ϕ1. There are two cases.<br />
∗ We know that all states t π′′<br />
i<br />
l<br />
with l < k (especially all states at time<br />
po<strong>in</strong>ts less than ml¯r) satisfy ϕ1. We conclude that the states <strong>in</strong> π ′ j at<br />
time po<strong>in</strong>ts less than ml¯r − d2, build<strong>in</strong>g a subset of the above states,<br />
all satisfy ϕ1.<br />
∗ It rema<strong>in</strong>s to show that all states at time po<strong>in</strong>ts from [ml¯r −d2, ml¯r)<br />
<strong>in</strong> π ′ j also satisfy ϕ1. Notice that π ′ i conta<strong>in</strong>s the state t∗ at time<br />
po<strong>in</strong>t ml¯r − d1/2. S<strong>in</strong>ce this time po<strong>in</strong>t is below the lower bound of<br />
I we have T K, t ∗ |=c ϕ1.<br />
This state t ∗ appears <strong>in</strong> π ′ at time po<strong>in</strong>t<br />
(n¯r + d1) + (ml¯r − d1/2) = (n + ml)¯r + d1/2 .<br />
By <strong>in</strong>duction we get that all states appear<strong>in</strong>g <strong>in</strong> π ′ at time po<strong>in</strong>ts<br />
from the <strong>in</strong>terval ((n + ml)¯r, (n + ml + 1)¯r) satisfy ϕ1. I.e., all states<br />
<strong>in</strong> π ′ j at time po<strong>in</strong>ts from<br />
((n + ml)¯r − (n¯r + d1 + d2), (n + ml + 1)¯r − (n¯r + d1 + d2))<br />
= (ml¯r − d1 − d2, (ml + 1)¯r − d1 − d2)<br />
⊇ [ml¯r − d2, ml¯r)<br />
satisfy ϕ1.<br />
(ii) For the case d π′′ i<br />
k ∈ I2 = I\I1 let v be the number of states <strong>in</strong> π pre′<br />
i . We<br />
show that k − v is a proper <strong>in</strong>dex for the satisfaction of the bounded<br />
until along π ′ j .<br />
We observe that t π′<br />
j<br />
l<br />
T K, t π′<br />
j<br />
i = tπ′′<br />
l+v<br />
i<br />
for all l. Therefore, T K, tπ′′<br />
k |=c ϕ2 implies<br />
k−v |=c ϕ2. S<strong>in</strong>ce d π′′ i<br />
k ∈ I2 we have d π′′ i<br />
k ≥ ml¯r + d2 + d3 and<br />
thus d π′<br />
j<br />
i<br />
k−v = dπ′′<br />
k − d2 ≥ ml¯r + d3, i.e., the duration of π ′ j until the<br />
(k − v)-th state is above the lower bound of I. It is easy to see that this