Timed CTL Model Checking in Real-Time Maude⋆ - IfI

Timed CTL Model Checking in Real-Time Maude 27
Then dπ′ j ′ is in π0 in an interval (n¯r, (n + 1)¯r) for some n ∈ N0. Furthermore
there is another state tmid at time point n¯r + ¯r/2 and index n0 + j ′′ in π0.
Again by Lemma 1 we have T K, tπ′ j ′′ |=c ϕ2.
Now we can build a time abstraction of π ′ which we obtain by replacing each
rl
tick step sequence tl −→ . . . rl+i−1
−→ tl+i with dπ′ l = n¯r/2 and dπ′
l+i = (n+1)¯r/2
r
for some n ∈ N0 by tl −→ tl+i with r = l+i−1 ri.
This time abstraction π ′′ is a path of T K gcd , and the states of π ′′ appear
at the same time points also in π ′ . Furthermore, since dπ′ j ′′ is a multiple of
¯r/2, it also appears in π ′′ at some position j ′′′ . Finally, since all states in π ′
with index less that j ′′ satisfy ϕ1, also all states in π ′′ with index less that
j ′′′ , building a subset of the previous ones, satisfy ϕ1. Thus π ′′ satisfies the
bounded until path formula, i.e., T K gcd , t |=p E ϕ1 UI ϕ2.
– ϕ = A ϕ1 UI ϕ2: We need to show both implication directions.
“⇐”: Assume that T K gcd , t |=p A ϕ1 UI ϕ2. By definition
T K gcd , t |=p A ϕ1 UI ϕ2 iff for each π ∈ tfPathsT Kgcd(t) there is an index j s.t. dπ j ∈ I,
i=l
T K gcd , t π j |=p ϕ2 and ∀ 0 ≤ i < j T K gcd , t π i |=p ϕ1.
In order to prove that T K, t |=c A ϕ1 UI ϕ2, we have to show that for each
path π ∈ tfPathsT K(t) there exists a time refinement π ′ ∈ tfPathsT K(t) of π
and an index j s.t. dπ′ j ∈ I, T K, tπ′ j |=c ϕ2, and ∀ 0 ≤ i < j T K, tπ′ i |=c ϕ1.
Let π ∈ tfPathsT K(t) and let π ′ ∈ tfPathsT K(t) be a refinement of π containing
a state at each time point n¯r/2, n ∈ N0.
We obtain π ′′ from π ′ rl
by replacing each tick step sequence tl −→ . . . rl+i−1
−→
r
−→ tl+i
tl+i with d π′
l
with r = l+i−1
i=l
= n¯r/2 and dπ′
l+i = (n + 1)¯r/2 for some n ∈ N0 by tl
ri.
Note that π ′′ is in tfPaths T K gcd(t) and thus by assumption there is an index
j such that d π j ∈ I, T Kgcd , t π j |=p ϕ2 and T K gcd , t π i |=p ϕ1 for all 0 ≤ i < j.
Let j be such an index.
Then by construction and induction there exists an index j ′ such that dπ′ j ′ is
a multiple of ¯r/2, dπ′ j ′ ∈ I, T K, tπ′ j ′ |=c ϕ2 and T K, tπ′ i |=c ϕ1 for all 0 ≤ i < j ′
with d π′
i
being a multiple of ¯r/2. For the other states prior to the index j′
we construct π0 as the composition of π pre and π ′ . Note that in each interval
(n¯r, (n + 1)¯r) with (n + 1)¯r < tπ′ j ′ there is a point at n¯r + ¯r/2, for which
we have already shown to satisfy ϕ1. Thus by Lemma 1 also the states that
are prior to the index j ′′ and are not at multiples of ¯r/2 satisfy ϕ1. Hence
π ′ |=c ϕ.
“⇒”: Assume T K, t |=c A ϕ1 UI ϕ2.
T K, t |=c A ϕ1 UI ϕ2 iff for each path π ∈ tfPathsT K(t) there is a time
refinement π ′ ∈ tfPathsT K(t) of π
and an index j s.t. dπ′ j ∈ I,
T K, tπ′ j |=c ϕ2, and ∀ 0 ≤ i < j T K, tπ′ i |=c ϕ1.