Overview overview7.4 Introduction Modelling parallel systems - PowerPoint PPT Presentation

Analysis by abstraction from stutter steps stutter5.4-4 simplified TS ℓ 1 x =2 y =4 ℓ 1 x =2 y =4 ℓ 1 x =2 y =4 z =3 z =3 z =3 representation ℓ 2 x =1 y =4 z =3 ℓ 2 x =1 y =4 ℓ 2 x =1 y =4 z =3 z =3 z =3 z =3 z =3 ℓ 3 x =1 y =2 ℓ 3 x =1 y =2 ℓ 3 x =1 y =2 z =3 z =3 z =3 ℓ 1 x =1 y =2 ℓ 1 x =1 y =2 ℓ 1 x =1 y =2 z =1 z =1 z =1 z =1 z =1 z =1 ℓ 2 x =2 y =2 z =1 ℓ 2 x =2 y =2 ℓ 2 x =2 y =2 z =1 z =1 z =0 z =0 z =0 ℓ 3 x =2 y =1 z =1 ℓ 3 x =2 y =1 ℓ 3 x =2 y =1 z =1 z =1 . . . . . . . . . ℓ 1 x =2 y =1 z =0 ℓ 1 x =2 y =1 z =0 ℓ 1 x =2 y =1 z =0 . . . . . . . . . 21 / 444

Overview overview7.4-stutter-trace Introduction Modelling parallel systems Linear Time Properties Regular Properties Linear Temporal Logic (LTL) Computation-Tree Logic (CTL) Equivalences and Abstraction bisimulation, CTL/CTL*-equivalence computing the bisimulation quotient abstraction stutter steps stutter LT relations ← ← ← − − − stutter bisimulation simulation relations 22 / 444

Remind: trace relations stutter5.4-5-remind 23 / 444

Remind: trace relations stutter5.4-5-remind trace equivalence for paths π 1 π 1 π 1 , π 2 π 2 π 2 are trace equivalent iff trace ( π 1 ) = trace ( π 2 ) trace ( π 1 ) = trace ( π 2 ) trace ( π 1 ) = trace ( π 2 ) 24 / 444

Remind: trace relations stutter5.4-5-remind trace equivalence for paths π 1 π 1 π 1 , π 2 π 2 π 2 are trace equivalent iff trace ( π 1 ) = trace ( π 2 ) trace ( π 1 ) = trace ( π 2 ) trace ( π 1 ) = trace ( π 2 ) trace inclusion for TS: Traces ( T 1 ) ⊆ Traces ( T 2 ) Traces ( T 1 ) ⊆ Traces ( T 2 ) Traces ( T 1 ) ⊆ Traces ( T 2 ) ∀ π 1 ∈ Traces ( T 1 ) ∀ π 1 ∈ Traces ( T 1 ) ∀ π 1 ∈ Traces ( T 1 ) ∃ π 2 ∈ Traces ( T 2 ) ∃ π 2 ∈ Traces ( T 2 ) ∃ π 2 ∈ Traces ( T 2 ) s.t. π 1 π 1 π 1 , π 2 π 2 π 2 are trace equivalent 25 / 444

Remind: trace relations stutter5.4-5-remind trace equivalence for paths π 1 π 1 π 1 , π 2 π 2 π 2 are trace equivalent iff trace ( π 1 ) = trace ( π 2 ) trace ( π 1 ) = trace ( π 2 ) trace ( π 1 ) = trace ( π 2 ) trace inclusion for TS: Traces ( T 1 ) ⊆ Traces ( T 2 ) Traces ( T 1 ) ⊆ Traces ( T 2 ) Traces ( T 1 ) ⊆ Traces ( T 2 ) ∀ π 1 ∈ Traces ( T 1 ) ∀ π 1 ∈ Traces ( T 1 ) ∀ π 1 ∈ Traces ( T 1 ) ∃ π 2 ∈ Traces ( T 2 ) ∃ π 2 ∈ Traces ( T 2 ) ∃ π 2 ∈ Traces ( T 2 ) s.t. π 1 π 1 π 1 , π 2 π 2 π 2 are trace equivalent trace equivalence for TS: Traces ( T 1 ) ⊆ Traces ( T 2 ) ∧ Traces ( T 2 ) ⊆ Traces ( T 1 ) Traces ( T 1 ) ⊆ Traces ( T 2 ) Traces ( T 1 ) ⊆ Traces ( T 2 ) ∧ ∧ Traces ( T 2 ) ⊆ Traces ( T 1 ) Traces ( T 2 ) ⊆ Traces ( T 1 ) 26 / 444

Remind: trace relations stutter5.4-5-remind trace equivalence for paths π 1 π 1 π 1 , π 2 π 2 π 2 are trace equivalent iff trace ( π 1 ) = trace ( π 2 ) trace ( π 1 ) = trace ( π 2 ) trace ( π 1 ) = trace ( π 2 ) trace inclusion for TS: Traces ( T 1 ) ⊆ Traces ( T 2 ) Traces ( T 1 ) ⊆ Traces ( T 2 ) Traces ( T 1 ) ⊆ Traces ( T 2 ) ∀ π 1 ∈ Traces ( T 1 ) ∀ π 1 ∈ Traces ( T 1 ) ∀ π 1 ∈ Traces ( T 1 ) ∃ π 2 ∈ Traces ( T 2 ) ∃ π 2 ∈ Traces ( T 2 ) ∃ π 2 ∈ Traces ( T 2 ) s.t. π 1 π 1 π 1 , π 2 π 2 π 2 are trace equivalent trace equivalence for TS: Traces ( T 1 ) ⊆ Traces ( T 2 ) ∧ Traces ( T 2 ) ⊆ Traces ( T 1 ) Traces ( T 1 ) ⊆ Traces ( T 2 ) Traces ( T 1 ) ⊆ Traces ( T 2 ) ∧ ∧ Traces ( T 2 ) ⊆ Traces ( T 1 ) Traces ( T 2 ) ⊆ Traces ( T 1 ) Traces ( T 1 ) ⊆ Traces ( T 2 ) Traces ( T 1 ) ⊆ Traces ( T 2 ) Traces ( T 1 ) ⊆ Traces ( T 2 ) iff for each LT property E E E : T 2 | T 2 | T 2 | = E = E = E implies T 1 | T 1 | T 1 | = E = E = E 27 / 444

Remind: trace relations stutter5.4-5-remind trace equivalence for paths π 1 π 1 π 1 , π 2 π 2 π 2 are trace equivalent iff trace ( π 1 ) = trace ( π 2 ) trace ( π 1 ) = trace ( π 2 ) trace ( π 1 ) = trace ( π 2 ) trace inclusion for TS: Traces ( T 1 ) ⊆ Traces ( T 2 ) Traces ( T 1 ) ⊆ Traces ( T 2 ) Traces ( T 1 ) ⊆ Traces ( T 2 ) ∀ π 1 ∈ Traces ( T 1 ) ∀ π 1 ∈ Traces ( T 1 ) ∀ π 1 ∈ Traces ( T 1 ) ∃ π 2 ∈ Traces ( T 2 ) ∃ π 2 ∈ Traces ( T 2 ) ∃ π 2 ∈ Traces ( T 2 ) s.t. π 1 π 1 π 1 , π 2 π 2 π 2 are trace equivalent trace equivalence for TS: Traces ( T 1 ) ⊆ Traces ( T 2 ) ∧ Traces ( T 2 ) ⊆ Traces ( T 1 ) Traces ( T 1 ) ⊆ Traces ( T 2 ) Traces ( T 1 ) ⊆ Traces ( T 2 ) ∧ ∧ Traces ( T 2 ) ⊆ Traces ( T 1 ) Traces ( T 2 ) ⊆ Traces ( T 1 ) Traces ( T 1 ) ⊆ Traces ( T 2 ) Traces ( T 1 ) ⊆ Traces ( T 2 ) Traces ( T 1 ) ⊆ Traces ( T 2 ) iff for each LT property E E E : T 2 | T 2 | T 2 | = E = E implies T 1 | = E T 1 | T 1 | = E = E = E � � �    trace equivalent TS satisfy the same LTL formulas 28 / 444

Stutter equivalence for paths stutter5.4-stutter-equiv-paths 29 / 444

Stutter equivalence for paths stutter5.4-stutter-equiv-paths stutter equivalence for infinite path fragments: 30 / 444

Stutter equivalence for paths stutter5.4-stutter-equiv-paths stutter equivalence for infinite path fragments: ∆ ∆ ∆ π 1 = π 2 π 1 π 1 = π 2 = π 2 iff there exists an infinite word 2 AP � ω s.t. the 2 AP � ω 2 AP � ω � � � A 0 A 1 A 2 . . . ∈ A 0 A 1 A 2 . . . ∈ A 0 A 1 A 2 . . . ∈ traces of π 1 π 1 π 1 and π 2 π 2 π 2 are of the form A 0 . . . A 0 A 1 . . . A 1 A 2 . . . A 2 . . . A 0 . . . A 0 A 1 . . . A 1 A 2 . . . A 2 . . . A 0 . . . A 0 A 1 . . . A 1 A 2 . . . A 2 . . . 31 / 444

Stutter equivalence for paths stutter5.4-stutter-equiv-paths stutter equivalence for infinite path fragments: ∆ ∆ ∆ π 1 = π 2 π 1 π 1 = π 2 = π 2 iff there exists an infinite word 2 AP � ω s.t. the 2 AP � ω 2 AP � ω � � � A 0 A 1 A 2 . . . ∈ A 0 A 1 A 2 . . . ∈ A 0 A 1 A 2 . . . ∈ traces of π 1 π 1 π 1 and π 2 π 2 π 2 are of the form A n 0 A n 0 A n 0 0 A n 1 0 A n 1 0 A n 1 1 A n 2 1 A n 2 1 A n 2 2 . . . 2 . . . 2 . . . n 0 , n 1 , n 2 , . . . ≥ 1 where n 0 , n 1 , n 2 , . . . n 0 , n 1 , n 2 , . . . are natural numbers ≥ 1 ≥ 1 32 / 444

Stutter equivalence for paths stutter5.4-stutter-equiv-paths stutter equivalence for infinite path fragments: ∆ ∆ ∆ π 1 = π 2 π 1 π 1 = π 2 = π 2 iff there exists an infinite word 2 AP � ω s.t. the 2 AP � ω 2 AP � ω � � � A 0 A 1 A 2 . . . ∈ A 0 A 1 A 2 . . . ∈ A 0 A 1 A 2 . . . ∈ traces of π 1 π 1 π 1 and π 2 π 2 π 2 are of the form A 0+ A 1+ A 2+ . . . A 0+ A 1+ A 2+ . . . A 0+ A 1+ A 2+ . . . 33 / 444

Stutter equivalence for paths stutter5.4-stutter-equiv-paths stutter equivalence for infinite path fragments: ∆ ∆ ∆ π 1 = π 2 π 1 π 1 = π 2 = π 2 iff there exists an infinite word 2 AP � ω s.t. the 2 AP � ω 2 AP � ω � � � A 0 A 1 A 2 . . . ∈ A 0 A 1 A 2 . . . ∈ A 0 A 1 A 2 . . . ∈ traces of π 1 π 1 π 1 and π 2 π 2 π 2 are of the form A 0+ A 1+ A 2+ . . . A 0+ A 1+ A 2+ . . . A 0+ A 1+ A 2+ . . . stutter equivalence for finite path fragments: ∆ ∆ ∆ π 1 ˆ π 1 π 1 ˆ ˆ = ˆ = ˆ = ˆ π 2 π 2 π 2 iff there exists a finite word 2 AP � + s.t. 2 AP � + 2 AP � + � � � A 0 A 1 A 2 . . . A n ∈ A 0 A 1 A 2 . . . A n ∈ A 0 A 1 A 2 . . . A n ∈ the traces of ˆ π 1 π 1 ˆ ˆ π 1 and ˆ π 2 π 2 ˆ ˆ π 2 are in A 0+ A 1+ A 2+ . . . A n + A 0+ A 1+ A 2+ . . . A n + A 0+ A 1+ A 2+ . . . A n + 34 / 444

Stutter trace relations for TS stutter5.4-5 stutter equivalence for infinite path fragments: ∆ ∆ ∆ π 1 = π 2 π 1 π 1 = π 2 = π 2 iff there exists an infinite word 2 AP � ω s.t. the 2 AP � ω 2 AP � ω � � � A 0 A 1 A 2 . . . ∈ A 0 A 1 A 2 . . . ∈ A 0 A 1 A 2 . . . ∈ traces of π 1 π 1 π 1 and π 2 π 2 π 2 are of the form A 0+ A 1+ A 2+ . . . A 0+ A 1+ A 2+ . . . A 0+ A 1+ A 2+ . . . 35 / 444

Stutter trace relations for TS stutter5.4-5 stutter equivalence for infinite path fragments: ∆ ∆ ∆ π 1 = π 2 π 1 π 1 = π 2 = π 2 iff there exists an infinite word 2 AP � ω s.t. the 2 AP � ω 2 AP � ω � � � A 0 A 1 A 2 . . . ∈ A 0 A 1 A 2 . . . ∈ A 0 A 1 A 2 . . . ∈ traces of π 1 π 1 π 1 and π 2 π 2 π 2 are of the form A 0+ A 1+ A 2+ . . . A 0+ A 1+ A 2+ . . . A 0+ A 1+ A 2+ . . . stutter trace inclusion for transition systems: T 1 � T 2 T 1 � T 2 T 1 � T 2 iff for all paths π 1 π 1 π 1 of T 1 T 1 T 1 there exists a path π 2 π 2 of T 2 π 2 T 2 T 2 ∆ ∆ ∆ s.t. π 1 π 1 π 1 = π 2 = π 2 = π 2 36 / 444

Example: stutter trace inclusion � � � stutter5.4-5-ex T 1 � T 2 T 1 � T 2 T 1 � T 2 iff ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) ∆ ∆ ∆ s.t. π 1 π 1 π 1 = π 2 = π 2 = π 2 = ∅ = ∅ = ∅ = { a } = { a } = { a } = { b } = { b } = { b } 37 / 444

Example: stutter trace inclusion � � � stutter5.4-5-ex T 1 � T 2 T 1 � T 2 T 1 � T 2 iff ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∃ π 2 ∈ Paths ( T 2 ) ∀ π 1 ∈ Paths ( T 1 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) ∆ ∆ ∆ s.t. π 1 π 1 π 1 = π 2 = π 2 = π 2 = ∅ = ∅ = ∅ � � � = { a } = { a } = { a } = { b } = { b } = { b } 38 / 444

Example: stutter trace inclusion � � � stutter5.4-5-ex T 1 � T 2 T 1 � T 2 T 1 � T 2 iff ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∃ π 2 ∈ Paths ( T 2 ) ∀ π 1 ∈ Paths ( T 1 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) ∆ ∆ ∆ s.t. π 1 π 1 π 1 = π 2 = π 2 = π 2 = ∅ = ∅ = ∅ � � � = { a } = { a } = { a } = { b } = { b } = { b } ( ∅ + { b } + { a } + ) ω all traces have the form ( ∅ + { b } + { a } + ) ω ( ∅ + { b } + { a } + ) ω or ( ∅ + { b } + { a } + ) ∗ ∅ ω ( ∅ + { b } + { a } + ) ∗ ∅ ω ( ∅ + { b } + { a } + ) ∗ ∅ ω 39 / 444

Stutter trace inclusion and LTL stutter5.4-5-LTL T 1 � T 2 T 1 � T 2 T 1 � T 2 iff ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) ∆ ∆ ∆ s.t. π 1 π 1 π 1 = π 2 = π 2 = π 2 Does stutter trace inclusion preserve LTL properties? 40 / 444

Stutter trace inclusion and LTL stutter5.4-5-LTL T 1 � T 2 T 1 � T 2 T 1 � T 2 iff ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) ∆ ∆ ∆ s.t. π 1 π 1 π 1 = π 2 = π 2 = π 2 Does stutter trace inclusion preserve LTL properties? � � �       ϕ i.e., for all LTL formulas ϕ ϕ : T 1 � T 2 T 1 � T 2 T 1 � T 2 ∧ ∧ ∧ T 2 | T 2 | T 2 | = ϕ = ϕ = ϕ implies T 1 | T 1 | T 1 | = ϕ = ϕ = ϕ 41 / 444

Stutter trace inclusion and LTL stutter5.4-5-LTL T 1 � T 2 T 1 � T 2 T 1 � T 2 iff ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) ∆ ∆ ∆ s.t. π 1 π 1 π 1 = π 2 = π 2 = π 2 Does stutter trace inclusion preserve LTL properties? � � �       ϕ i.e., for all LTL formulas ϕ ϕ : T 1 � T 2 T 1 � T 2 T 1 � T 2 ∧ ∧ ∧ T 2 | T 2 | T 2 | = ϕ = ϕ = ϕ implies T 1 | T 1 | T 1 | = ϕ = ϕ = ϕ answer: no 42 / 444

Stutter trace inclusion and LTL stutter5.4-5-LTL T 1 � T 2 T 1 � T 2 T 1 � T 2 iff ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) ∆ ∆ ∆ s.t. π 1 π 1 π 1 = π 2 = π 2 = π 2 Does stutter trace inclusion preserve LTL properties? � � �       ϕ i.e., for all LTL formulas ϕ ϕ : T 1 � T 2 T 1 � T 2 T 1 � T 2 ∧ ∧ ∧ T 2 | T 2 | T 2 | = ϕ = ϕ = ϕ implies T 1 | T 1 | T 1 | = ϕ = ϕ = ϕ answer: no Example: LTL formulas of the form � a � a � a 43 / 444

Stutter trace inclusion and LTL \� \� \� stutter5.4-5-thm T 1 � T 2 T 1 � T 2 T 1 � T 2 iff ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) ∆ ∆ ∆ s.t. π 1 π 1 π 1 = π 2 = π 2 = π 2 Let T 1 T 1 T 1 and T 2 T 2 T 2 are TS without terminal states and ϕ ϕ ϕ an LTL \� \� formula. Then: \� T 1 � T 2 T 1 � T 2 T 1 � T 2 ∧ ∧ ∧ T 2 | T 2 | T 2 | = ϕ = ϕ = ϕ implies T 1 | T 1 | T 1 | = ϕ = ϕ = ϕ 44 / 444

Stutter trace inclusion and LTL \� \� \� stutter5.4-5-thm T 1 � T 2 T 1 � T 2 T 1 � T 2 iff ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∃ π 2 ∈ Paths ( T 2 ) ∀ π 1 ∈ Paths ( T 1 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) ∆ ∆ ∆ s.t. π 1 π 1 π 1 = π 2 = π 2 = π 2 Let T 1 T 1 T 1 and T 2 T 2 T 2 are TS without terminal states and ϕ ϕ ϕ an LTL \� \� formula. Then: \� T 1 � T 2 T 1 � T 2 T 1 � T 2 ∧ ∧ ∧ T 2 | T 2 | T 2 | = ϕ = ϕ = ϕ implies T 1 | T 1 | T 1 | = ϕ = ϕ = ϕ where LTL \� \� = = = LTL without the next operator � � � \� 45 / 444

∆ ∆ ∆ = Stutter trace equivalence = = for TS stutter5.4-5a 46 / 444

∆ ∆ ∆ = Stutter trace equivalence = = for TS stutter5.4-5a stutter trace inclusion T 1 � T 2 T 1 � T 2 T 1 � T 2 ∆ ∆ ∆ ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) s.t. π 1 π 1 π 1 = π 2 = π 2 = π 2 47 / 444

∆ ∆ ∆ = Stutter trace equivalence = = for TS stutter5.4-5a stutter trace inclusion T 1 � T 2 T 1 � T 2 T 1 � T 2 ∆ ∆ ∆ ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) s.t. π 1 π 1 π 1 = π 2 = π 2 = π 2 stutter trace equivalence ∆ ∆ ∆ T 1 T 1 T 1 = T 2 = T 2 = T 2 iff T 1 � T 2 T 1 � T 2 T 1 � T 2 and T 2 � T 1 T 2 � T 1 T 2 � T 1 48 / 444

∆ ∆ ∆ = Stutter trace equivalence = = for TS stutter5.4-5a stutter trace inclusion T 1 � T 2 T 1 � T 2 T 1 � T 2 ∆ ∆ ∆ ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) s.t. π 1 π 1 π 1 = π 2 = π 2 = π 2 stutter trace equivalence ∆ ∆ ∆ T 1 T 1 T 1 = T 2 = T 2 = T 2 iff T 1 � T 2 T 1 � T 2 T 1 � T 2 and T 2 � T 1 T 2 � T 1 T 2 � T 1 � � �    kernel of � � � , i.e., coarsest equivalence that refines � � � 49 / 444

∆ ∆ ∆ = Stutter trace equivalence = = for TS stutter5.4-5a stutter trace inclusion T 1 � T 2 T 1 � T 2 T 1 � T 2 ∆ ∆ ∆ ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) s.t. π 1 π 1 π 1 = π 2 = π 2 = π 2 For all LTL \� \� formulas ϕ ϕ ϕ : \� T 1 � T 2 T 1 � T 2 T 1 � T 2 ∧ ∧ ∧ T 2 | T 2 | T 2 | = ϕ = ϕ = ϕ implies T 1 | T 1 | T 1 | = ϕ = ϕ = ϕ stutter trace equivalence ∆ ∆ ∆ T 1 T 1 T 1 = T 2 = T 2 = T 2 iff T 1 � T 2 T 1 � T 2 T 1 � T 2 and T 2 � T 1 T 2 � T 1 T 2 � T 1 � � �    kernel of � � � , i.e., coarsest equivalence that refines � � � 50 / 444

∆ ∆ ∆ = Stutter trace equivalence = = for TS stutter5.4-5a stutter trace inclusion T 1 � T 2 T 1 � T 2 T 1 � T 2 ∆ ∆ ∆ ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∀ π 1 ∈ Paths ( T 1 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) ∃ π 2 ∈ Paths ( T 2 ) s.t. π 1 π 1 π 1 = π 2 = π 2 = π 2 For all LTL \� \� formulas ϕ ϕ ϕ : \� T 1 � T 2 T 1 � T 2 T 1 � T 2 ∧ ∧ ∧ T 2 | T 2 | T 2 | = ϕ = ϕ = ϕ implies T 1 | T 1 | T 1 | = ϕ = ϕ = ϕ stutter trace equivalence ∆ ∆ ∆ T 1 T 1 T 1 = T 2 = T 2 = T 2 iff T 1 � T 2 T 1 � T 2 T 1 � T 2 and T 2 � T 1 T 2 � T 1 T 2 � T 1 ∆ ∆ ∆ If T 1 T 1 T 1 = T 2 = T 2 = T 2 then T 1 T 1 T 1 and T 2 T 2 T 2 are LTL \� \� equivalent. \� 51 / 444

Correct or wrong? stutter5.4-13a ∆ ∆ ∆ = = = 52 / 444

Correct or wrong? stutter5.4-13a ∆ ∆ ∆ = = = correct 53 / 444

Correct or wrong? stutter5.4-13a ∆ ∆ ∆ = = = correct T 2 have the form • + + • + + or • ω ω ω + + The traces of T 1 T 1 T 1 and T 2 T 2 54 / 444

Correct or wrong? stutter5.4-13a ∆ ∆ ∆ = = = correct T 2 have the form • + + • + + or • ω ω ω + + The traces of T 1 T 1 T 1 and T 2 T 2 ∆ ∆ ∆ = = = 55 / 444

Correct or wrong? stutter5.4-13a ∆ ∆ ∆ = = = correct T 2 have the form • + + • + + or • ω ω ω + + The traces of T 1 T 1 T 1 and T 2 T 2 wrong ∆ ∆ ∆ = = = 56 / 444

Correct or wrong? stutter5.4-13a ∆ ∆ ∆ = = = correct T 2 have the form • + + • + + or • ω ω ω + + The traces of T 1 T 1 T 1 and T 2 T 2 wrong ∆ ∆ ∆ = = = T 1 has a finite trace • + + • , while T 2 + T 1 T 2 T 1 T 2 has not 57 / 444

Correct or wrong? stutter5.4-13b If T 1 T 1 T 1 and T 2 T 2 T 2 are TS over AP AP AP then: ∆ ∆ ∆ T 1 ∼ T 2 T 1 = T 2 T 1 ∼ T 2 T 1 ∼ T 2 implies T 1 T 1 = T 2 = T 2 58 / 444

Correct or wrong? stutter5.4-13b If T 1 T 1 T 1 and T 2 T 2 T 2 are TS over AP AP AP then: ∆ ∆ ∆ T 1 ∼ T 2 T 1 = T 2 T 1 ∼ T 2 T 1 ∼ T 2 implies T 1 T 1 = T 2 = T 2 ր տ ր ր տ տ bisimulation stutter trace equivalence equivalence 59 / 444

Correct or wrong? stutter5.4-13b If T 1 T 1 T 1 and T 2 T 2 T 2 are TS over AP AP AP then: ∆ ∆ ∆ T 1 ∼ T 2 T 1 = T 2 T 1 ∼ T 2 T 1 ∼ T 2 implies T 1 T 1 = T 2 = T 2 ր տ ր ր տ տ bisimulation stutter trace equivalence equivalence correct 60 / 444

Correct or wrong? stutter5.4-13b If T 1 T 1 T 1 and T 2 T 2 T 2 are TS over AP AP AP then: ∆ ∆ ∆ T 1 ∼ T 2 T 1 = T 2 T 1 ∼ T 2 T 1 ∼ T 2 implies T 1 T 1 = T 2 = T 2 ր տ ր ր տ տ bisimulation stutter trace equivalence equivalence correct , as • T 1 ∼ T 2 T 1 ∼ T 2 T 1 ∼ T 2 implies Traces ( T 1 ) = Traces ( T 2 ) Traces ( T 1 ) = Traces ( T 2 ) Traces ( T 1 ) = Traces ( T 2 ) • trace equivalent paths are stutter trace equivalent 61 / 444

Correct or wrong? stutter5.4-13b If T 1 T 1 T 1 and T 2 T 2 T 2 are TS over AP AP AP then: ∆ ∆ ∆ T 1 ∼ T 2 T 1 = T 2 T 1 ∼ T 2 T 1 ∼ T 2 implies T 1 T 1 = T 2 = T 2 ր տ ր ր տ տ bisimulation stutter trace equivalence equivalence correct , as • T 1 ∼ T 2 T 1 ∼ T 2 T 1 ∼ T 2 implies Traces ( T 1 ) = Traces ( T 2 ) Traces ( T 1 ) = Traces ( T 2 ) Traces ( T 1 ) = Traces ( T 2 ) • trace equivalent paths are stutter trace equivalent obviously: Traces ( T 1 ) ⊆ Traces ( T 2 ) Traces ( T 1 ) ⊆ Traces ( T 2 ) Traces ( T 1 ) ⊆ Traces ( T 2 ) implies T 1 � T 2 T 1 � T 2 T 1 � T 2 62 / 444

Stutter-insensitive LT properties stutter5.4-st-ins-prop 63 / 444

Stutter-insensitive LT properties stutter5.4-st-ins-prop stutter equivalence for infinite words 64 / 444

Stutter-insensitive LT properties stutter5.4-st-ins-prop 2 AP � ω 2 AP � ω 2 AP � ω : � � � stutter equivalence for infinite words σ 1 σ 1 σ 1 , σ 2 ∈ σ 2 ∈ σ 2 ∈ 65 / 444

Stutter-insensitive LT properties stutter5.4-st-ins-prop 2 AP � ω 2 AP � ω 2 AP � ω : � � � stutter equivalence for infinite words σ 1 σ 1 σ 1 , σ 2 ∈ σ 2 ∈ σ 2 ∈ ∆ ∆ ∆ σ 1 = σ 2 σ 1 σ 1 = σ 2 = σ 2 iff there exists an infinite word 2 AP � ω s.t. σ 1 2 AP � ω 2 AP � ω � � � A 0 A 1 A 2 . . . ∈ A 0 A 1 A 2 . . . ∈ A 0 A 1 A 2 . . . ∈ σ 1 σ 1 and σ 2 σ 2 σ 2 A 0+ A 1+ A 2+ . . . are in A 0+ A 1+ A 2+ . . . A 0+ A 1+ A 2+ . . . 66 / 444

Stutter-insensitive LT properties stutter5.4-st-ins-prop 2 AP � ω 2 AP � ω : 2 AP � ω � � � stutter equivalence for infinite words σ 1 σ 1 , σ 2 ∈ σ 1 σ 2 ∈ σ 2 ∈ ∆ ∆ ∆ σ 1 = σ 2 σ 1 σ 1 = σ 2 = σ 2 iff there exists an infinite word 2 AP � ω s.t. σ 1 2 AP � ω 2 AP � ω � � � A 0 A 1 A 2 . . . ∈ A 0 A 1 A 2 . . . ∈ A 0 A 1 A 2 . . . ∈ σ 1 σ 1 and σ 2 σ 2 σ 2 A 0+ A 1+ A 2+ . . . are in A 0+ A 1+ A 2+ . . . A 0+ A 1+ A 2+ . . . 2 AP � ω be an LT property. E 2 AP � ω 2 AP � ω � � � Let E ⊆ E ⊆ E ⊆ E E is called 2 AP � ω 2 AP � ω 2 AP � ω : � � � stutter-insensitive iff for all σ 1 σ 1 , σ 2 ∈ σ 1 σ 2 ∈ σ 2 ∈ ∆ ∆ ∆ if σ 1 ∈ E σ 1 ∈ E σ 1 ∈ E and σ 1 σ 1 σ 1 = σ 2 = σ 2 = σ 2 then σ 2 ∈ E σ 2 ∈ E σ 2 ∈ E 67 / 444

Stutter-insensitive LT properties stutter5.4-st-ins-prop 2 AP � ω 2 AP � ω 2 AP � ω : � � � stutter equivalence for infinite words σ 1 σ 1 σ 1 , σ 2 ∈ σ 2 ∈ σ 2 ∈ ∆ ∆ ∆ σ 1 = σ 2 σ 1 σ 1 = σ 2 = σ 2 iff there exists an infinite word 2 AP � ω s.t. σ 1 2 AP � ω 2 AP � ω � � � A 0 A 1 A 2 . . . ∈ A 0 A 1 A 2 . . . ∈ A 0 A 1 A 2 . . . ∈ σ 1 σ 1 and σ 2 σ 2 σ 2 A 0+ A 1+ A 2+ . . . are in A 0+ A 1+ A 2+ . . . A 0+ A 1+ A 2+ . . . 2 AP � ω be an LT property. E 2 AP � ω 2 AP � ω � � � Let E ⊆ E ⊆ E ⊆ E E is called 2 AP � ω 2 AP � ω 2 AP � ω : � � � stutter-insensitive iff for all σ 1 σ 1 , σ 2 ∈ σ 1 σ 2 ∈ σ 2 ∈ ∆ ∆ ∆ if σ 1 ∈ E σ 1 ∈ E σ 1 ∈ E and σ 1 σ 1 σ 1 = σ 2 = σ 2 = σ 2 then σ 2 ∈ E σ 2 ∈ E σ 2 ∈ E Example: if ϕ ϕ ϕ is an LTL \� \� formula then \� E = Words ( ϕ ) E = Words ( ϕ ) E = Words ( ϕ ) is stutter-insensitive 68 / 444

Stutter-insensitive LT properties stutter5.4-st-ins-prop Let T 1 T 1 T 1 , T 2 T 2 T 2 be two TS and E E E a stutter-insensitive LT-property. Then: T 1 � T 2 T 1 � T 2 T 1 � T 2 and T 2 | T 2 | T 2 | = E = E = E implies T 1 | T 1 | T 1 | = E = E = E 69 / 444

Stutter-insensitive LT properties stutter5.4-st-ins-prop Let T 1 T 1 T 1 , T 2 T 2 T 2 be two TS and E E E a stutter-insensitive LT-property. Then: T 1 � T 2 T 1 � T 2 T 1 � T 2 and T 2 | T 2 | T 2 | = E = E = E implies T 1 | T 1 | T 1 | = E = E = E Let T 1 T 1 T 1 , T 2 T 2 T 2 be two TS and ϕ ϕ ϕ an LTL \� \� formula. \� T 1 � T 2 T 2 | = ϕ T 1 | = ϕ T 1 � T 2 T 1 � T 2 and T 2 | T 2 | = ϕ = ϕ implies T 1 | T 1 | = ϕ = ϕ 70 / 444

Stutter-insensitive LT properties stutter5.4-st-ins-prop Let T 1 T 1 T 1 , T 2 T 2 T 2 be two TS and E E E a stutter-insensitive LT-property. Then: T 1 � T 2 T 1 � T 2 T 1 � T 2 and T 2 | T 2 | T 2 | = E = E = E implies T 1 | T 1 | T 1 | = E = E = E Let T 1 T 1 T 1 , T 2 T 2 be two TS and ϕ T 2 ϕ an LTL \� ϕ \� formula. \� T 1 � T 2 T 2 | = ϕ T 1 | = ϕ T 1 � T 2 T 1 � T 2 and T 2 | T 2 | = ϕ = ϕ implies T 1 | T 1 | = ϕ = ϕ remind: if ϕ ϕ ϕ is an LTL \� \� formula then \� E = Words ( ϕ ) E = Words ( ϕ ) E = Words ( ϕ ) is stutter-insensitive 71 / 444

Overview overview7.4a Introduction Modelling parallel systems Linear Time Properties Regular Properties Linear Temporal Logic (LTL) Computation-Tree Logic (CTL) Equivalences and Abstraction bisimulation, CTL/CTL*-equivalence computing the bisimulation quotient abstraction stutter steps stutter LT relations stutter bisimulation ← ← ← − − − simulation relations 72 / 444

Stutter bisimulation stutter5.4-def-stutter-bis 73 / 444

Stutter bisimulation stutter5.4-def-stutter-bis Let T = ( S , Act , → , S 0 , AP , L ) T = ( S , Act , → , S 0 , AP , L ) T = ( S , Act , → , S 0 , AP , L ) be a TS, possibly with terminal states. 74 / 444

Stutter bisimulation stutter5.4-def-stutter-bis Let T = ( S , Act , → , S 0 , AP , L ) T = ( S , Act , → , S 0 , AP , L ) T = ( S , Act , → , S 0 , AP , L ) be a TS, possibly with terminal states. T A stutter bisimulation for T T is .... 75 / 444

Stutter bisimulation stutter5.4-def-stutter-bis Let T = ( S , Act , → , S 0 , AP , L ) T = ( S , Act , → , S 0 , AP , L ) T = ( S , Act , → , S 0 , AP , L ) be a TS, possibly with terminal states. T R A stutter bisimulation for T T is a binary relation R R on S S S s.t. 76 / 444

Stutter bisimulation stutter5.4-def-stutter-bis Let T = ( S , Act , → , S 0 , AP , L ) T = ( S , Act , → , S 0 , AP , L ) T = ( S , Act , → , S 0 , AP , L ) be a TS, possibly with terminal states. T R A stutter bisimulation for T T is a binary relation R R ( s 1 , s 2 ) ∈ R on S S S s.t. for all ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R : (1) labeling condition (2) simulation condition up to stuttering “ s 2 s 2 s 2 can mimick all transitions of of s 1 s 1 s 1 ” (3) simulation condition up to stuttering “ s 1 s 1 s 1 can mimick all transitions of of s 2 s 2 s 2 ” 77 / 444

Stutter bisimulation stutter5.4-def-stutter-bis Let T = ( S , Act , → , S 0 , AP , L ) T = ( S , Act , → , S 0 , AP , L ) T = ( S , Act , → , S 0 , AP , L ) be a TS, possibly with terminal states. T R A stutter bisimulation for T T is a binary relation R R ( s 1 , s 2 ) ∈ R on S S S s.t. for all ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R : L ( s 1 ) = L ( s 2 ) (1) labeling condition: L ( s 1 ) = L ( s 2 ) L ( s 1 ) = L ( s 2 ) (2) simulation condition up to stuttering “ s 2 s 2 s 2 can mimick all transitions of of s 1 s 1 s 1 ” (3) simulation condition up to stuttering “ s 1 s 1 s 1 can mimick all transitions of of s 2 s 2 s 2 ” 78 / 444

Stutter bisimulation stutter5.4-def-stutter-bis Let T = ( S , Act , → , S 0 , AP , L ) T = ( S , Act , → , S 0 , AP , L ) T = ( S , Act , → , S 0 , AP , L ) be a TS, possibly with terminal states. T R A stutter bisimulation for T T is a binary relation R R ( s 1 , s 2 ) ∈ R on S S S s.t. for all ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R : L ( s 1 ) = L ( s 2 ) (1) labeling condition: L ( s 1 ) = L ( s 2 ) L ( s 1 ) = L ( s 2 ) (2) simulation condition up to stuttering “ s 2 s 2 s 2 can mimick all transitions of of s 1 s 1 s 1 ” (3) simulation condition up to stuttering “ s 1 s 1 s 1 can mimick all transitions of of s 2 s 2 s 2 ” 79 / 444

Simulation condition stutter5.4-def-stutter-bis A stutter bisimulation for T T T is a binary relation R R R on S S s.t. for all ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R : ( s 1 , s 2 ) ∈ R S . . . . . . . . . . . . . . . . . . (2) simulation condition up to stuttering s 1 - R R - s 2 R s 1 s 2 s 1 s 2 s ′ s ′ s ′ 1 1 1 80 / 444

Simulation condition stutter5.4-def-stutter-bis A stutter bisimulation for T T T is a binary relation R R R on S S s.t. for all ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R : ( s 1 , s 2 ) ∈ R S . . . . . . . . . . . . . . . . . . (2) simulation condition up to stuttering s 1 - R R R - s 2 s 1 s 2 s 1 s 2 s ′ s ′ s ′ 1 1 1 with ( s ′ ( s ′ ( s ′ 1 , s 2 ) / 1 , s 2 ) / 1 , s 2 ) / ∈ R ∈ R ∈ R 81 / 444

Simulation condition stutter5.4-def-stutter-bis A stutter bisimulation for T T T is a binary relation R R R on S S s.t. for all ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R : S . . . . . . . . . . . . . . . . . . (2) simulation condition up to stuttering s 1 - R R R - s 2 s 1 - R R - s 2 R s 1 s 2 s 1 s 2 s 1 s 2 s 1 s 2 can be u 1 u 1 u 1 completed to s ′ s ′ s ′ . . . 1 1 1 . . . . . . u n u n u n with ( s ′ ( s ′ ( s ′ 1 , s 2 ) / 1 , s 2 ) / 1 , s 2 ) / ∈ R ∈ R ∈ R s ′ s ′ s ′ s ′ s ′ s ′ - R R R - 1 2 1 1 2 2 82 / 444

Simulation condition stutter5.4-def-stutter-bis A stutter bisimulation for T T T is a binary relation R R R on S S s.t. for all ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R : S . . . . . . . . . . . . . . . . . . (2) simulation condition up to stuttering s 1 - R R R - s 2 s 1 - R R - s 2 R s 1 s 2 s 1 s 2 s 1 s 2 s 1 s 2 can be u 1 u 1 u 1 completed to s ′ s ′ s ′ . . . 1 1 1 . . . s 1 - R - u i s 1 - R - u i s 1 - R - u i . . . u n u n u n with ( s ′ ( s ′ ( s ′ 1 , s 2 ) / 1 , s 2 ) / 1 , s 2 ) / ∈ R ∈ R ∈ R s ′ s ′ s ′ s ′ s ′ s ′ - R R R - 1 2 1 1 2 2 83 / 444

Stutter bisimulation for a TS stutter5.4-stbis Let T T T be a transition system wih state space S S S . A stutter bisimulation for T T T is a binary relation R R R on S S S such that for all ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R : (1) L ( s 1 ) = L ( s 2 ) L ( s 1 ) = L ( s 2 ) L ( s 1 ) = L ( s 2 ) s 1 → s ′ ( s ′ for each transition s 1 → s ′ s 1 → s ′ 1 with ( s ′ ( s ′ 1 , s 2 ) / ∈ R (2) 1 , s 2 ) / 1 , s 2 ) / ∈ R ∈ R 1 1 s 2 u 1 u 2 . . . u n s ′ there exists a path fragment s 2 u 1 u 2 . . . u n s ′ s 2 u 1 u 2 . . . u n s ′ 2 2 2 . . . s.t. . . . . . . (3) . . . . . . . . . 84 / 444

Stutter bisimulation for a TS stutter5.4-stbis Let T T T be a transition system wih state space S S S . A stutter bisimulation for T T T is a binary relation R R R on S S S such that for all ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R : (1) L ( s 1 ) = L ( s 2 ) L ( s 1 ) = L ( s 2 ) L ( s 1 ) = L ( s 2 ) s 1 → s ′ ( s ′ for each transition s 1 → s ′ s 1 → s ′ 1 with ( s ′ ( s ′ 1 , s 2 ) / ∈ R (2) 1 , s 2 ) / 1 , s 2 ) / ∈ R ∈ R 1 1 s 2 u 1 u 2 . . . u n s ′ there exists a path fragment s 2 u 1 u 2 . . . u n s ′ s 2 u 1 u 2 . . . u n s ′ 2 2 2 n ≥ 0 ( s 1 , u i ) ∈ R 1 ≤ i ≤ n s.t. n ≥ 0 n ≥ 0 and ( s 1 , u i ) ∈ R ( s 1 , u i ) ∈ R for 1 ≤ i ≤ n 1 ≤ i ≤ n (3) . . . . . . . . . 85 / 444

Stutter bisimulation for a TS stutter5.4-stbis Let T T T be a transition system wih state space S S S . A stutter bisimulation for T T T is a binary relation R R R on S S S such that for all ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R : (1) L ( s 1 ) = L ( s 2 ) L ( s 1 ) = L ( s 2 ) L ( s 1 ) = L ( s 2 ) s 1 → s ′ ( s ′ for each transition s 1 → s ′ s 1 → s ′ 1 with ( s ′ ( s ′ 1 , s 2 ) / ∈ R (2) 1 , s 2 ) / 1 , s 2 ) / ∈ R ∈ R 1 1 s 2 u 1 u 2 . . . u n s ′ there exists a path fragment s 2 u 1 u 2 . . . u n s ′ s 2 u 1 u 2 . . . u n s ′ 2 2 2 n ≥ 0 ( s 1 , u i ) ∈ R 1 ≤ i ≤ n s.t. n ≥ 0 n ≥ 0 and ( s 1 , u i ) ∈ R ( s 1 , u i ) ∈ R for 1 ≤ i ≤ n 1 ≤ i ≤ n (3) symmetric condition 86 / 444

Stutter bisimulation for a TS stutter5.4-stbis Let T T T be a transition system wih state space S S S . A stutter bisimulation for T T T is a binary relation R R R on S S S such that for all ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R : (1) L ( s 1 ) = L ( s 2 ) L ( s 1 ) = L ( s 2 ) L ( s 1 ) = L ( s 2 ) s 1 → s ′ ( s ′ for each transition s 1 → s ′ s 1 → s ′ 1 with ( s ′ ( s ′ 1 , s 2 ) / ∈ R (2) 1 , s 2 ) / 1 , s 2 ) / ∈ R ∈ R 1 1 s 2 u 1 u 2 . . . u n s ′ there exists a path fragment s 2 u 1 u 2 . . . u n s ′ s 2 u 1 u 2 . . . u n s ′ 2 2 2 n ≥ 0 ( s 1 , u i ) ∈ R 1 ≤ i ≤ n s.t. n ≥ 0 n ≥ 0 and ( s 1 , u i ) ∈ R ( s 1 , u i ) ∈ R for 1 ≤ i ≤ n 1 ≤ i ≤ n for each transition s 2 → s ′ s 2 → s ′ s 2 → s ′ 2 with ( s 1 , s ′ ( s 1 , s ′ ( s 1 , s ′ (3) 2 ) / 2 ) / 2 ) / ∈ R ∈ R ∈ R 2 2 there exists a path fragment s 1 v 1 v 2 . . . v n s ′ s 1 v 1 v 2 . . . v n s ′ s 1 v 1 v 2 . . . v n s ′ 1 1 1 n ≥ 0 ( v i , s 2 ) ∈ R 1 ≤ i ≤ n s.t. n ≥ 0 n ≥ 0 and ( v i , s 2 ) ∈ R ( v i , s 2 ) ∈ R for 1 ≤ i ≤ n 1 ≤ i ≤ n 87 / 444

≈ T Stutter bisimulation equivalence ≈ T ≈ T stutter5.4-def-approx 88 / 444

≈ T Stutter bisimulation equivalence ≈ T ≈ T stutter5.4-def-approx Let T T T be a transition system wih state space S S S . A stutter bisimulation for T T is a binary relation R T R R on S S S such that for all ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R : (1) labeling condition (2) and (3) mutual simulation condition 89 / 444

≈ T Stutter bisimulation equivalence ≈ T ≈ T stutter5.4-def-approx Let T T T be a transition system wih state space S S S . A stutter bisimulation for T T T is a binary relation R R R on S S S such that for all ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R : (1) labeling condition (2) and (3) mutual simulation condition stutter bisimulation equivalence ≈ T ≈ T ≈ T : 90 / 444

≈ T Stutter bisimulation equivalence ≈ T ≈ T stutter5.4-def-approx Let T T T be a transition system wih state space S S S . A stutter bisimulation for T T T is a binary relation R R R on S S S such that for all ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R : ( s 1 , s 2 ) ∈ R (1) labeling condition (2) and (3) mutual simulation condition stutter bisimulation equivalence ≈ T ≈ T ≈ T : s 1 ≈ T s 2 s 1 ≈ T s 2 s 1 ≈ T s 2 iff there exists a stutter bisimulation R R R for T T T s.t. ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R 91 / 444

≈ T ≈ T ≈ T is an equivalence stutter5.4-10 92 / 444

≈ T ≈ T ≈ T is an equivalence stutter5.4-10 symmetry: if s 1 ≈ T s 2 s 1 ≈ T s 2 s 1 ≈ T s 2 then s 2 ≈ T s 1 s 2 ≈ T s 1 s 2 ≈ T s 1 93 / 444

≈ T ≈ T ≈ T is an equivalence stutter5.4-10 s 1 ≈ T s 2 s 2 ≈ T s 1 symmetry: if s 1 ≈ T s 2 s 1 ≈ T s 2 then s 2 ≈ T s 1 s 2 ≈ T s 1 proof: R ( s 1 , s 2 ) ∈ R if R R is a stutter bisimulation with ( s 1 , s 2 ) ∈ R ( s 1 , s 2 ) ∈ R then R − 1 = R − 1 = R − 1 = � � � � � � ( t 2 , t 1 ) : ( t 1 , t 2 ) ∈ R ( t 2 , t 1 ) : ( t 1 , t 2 ) ∈ R ( t 2 , t 1 ) : ( t 1 , t 2 ) ∈ R is a stutter bisimulation that contains ( s 2 , s 1 ) ( s 2 , s 1 ) ( s 2 , s 1 ). 94 / 444

≈ T ≈ T ≈ T is an equivalence stutter5.4-10 symmetry: if s 1 ≈ T s 2 s 1 ≈ T s 2 s 1 ≈ T s 2 then s 2 ≈ T s 1 s 2 ≈ T s 1 s 2 ≈ T s 1 s ≈ T s reflexivity: s ≈ T s s ≈ T s for all states s s s 95 / 444

≈ T ≈ T ≈ T is an equivalence stutter5.4-10 symmetry: if s 1 ≈ T s 2 s 1 ≈ T s 2 s 1 ≈ T s 2 then s 2 ≈ T s 1 s 2 ≈ T s 1 s 2 ≈ T s 1 s ≈ T s reflexivity: s ≈ T s s ≈ T s for all states s s s proof: � � � � � � R = ( s , s ) : s ∈ S R = R = ( s , s ) : s ∈ S ( s , s ) : s ∈ S is a stutter bisimulation 96 / 444

≈ T ≈ T ≈ T is an equivalence stutter5.4-10 symmetry: if s 1 ≈ T s 2 s 1 ≈ T s 2 s 1 ≈ T s 2 then s 2 ≈ T s 1 s 2 ≈ T s 1 s 2 ≈ T s 1 s ≈ T s reflexivity: s ≈ T s s ≈ T s for all states s s s s 1 ≈ T s 2 s 2 ≈ T s 3 s 1 ≈ T s 3 transitivity: s 1 ≈ T s 2 s 1 ≈ T s 2 and s 2 ≈ T s 3 s 2 ≈ T s 3 implies s 1 ≈ T s 3 s 1 ≈ T s 3 97 / 444

≈ T ≈ T ≈ T is an equivalence stutter5.4-10 symmetry: if s 1 ≈ T s 2 s 1 ≈ T s 2 s 1 ≈ T s 2 then s 2 ≈ T s 1 s 2 ≈ T s 1 s 2 ≈ T s 1 s ≈ T s reflexivity: s ≈ T s s ≈ T s for all states s s s s 1 ≈ T s 2 s 2 ≈ T s 3 s 1 ≈ T s 3 transitivity: s 1 ≈ T s 2 s 1 ≈ T s 2 and s 2 ≈ T s 3 s 2 ≈ T s 3 implies s 1 ≈ T s 3 s 1 ≈ T s 3 Proof: Let R 1 , 2 R 1 , 2 R 1 , 2 and R 2 , 3 R 2 , 3 R 2 , 3 be stutter bisimulations s.t. ( s 1 , s 2 ) ∈ R 1 , 2 , ( s 2 , s 3 ) ∈ R 2 , 3 ( s 1 , s 2 ) ∈ R 1 , 2 , ( s 2 , s 3 ) ∈ R 2 , 3 ( s 1 , s 2 ) ∈ R 1 , 2 , ( s 2 , s 3 ) ∈ R 2 , 3 R = R 1 , 2 ◦ R 2 , 3 Show that R = R 1 , 2 ◦ R 2 , 3 R = R 1 , 2 ◦ R 2 , 3 is a stutter bisimulation. 98 / 444

s 1 s 1 s 1 R 1 , 2 s 2 s 2 s 2 R 2 , 3 s 3 s 3 s 3 R 1 , 2 R 1 , 2 R 2 , 3 R 2 , 3 s ′ s ′ s ′ 1 1 1 99 / 444

s 1 s 1 s 1 R 1 , 2 s 2 s 2 s 2 R 2 , 3 s 3 s 3 s 3 R 1 , 2 R 1 , 2 R 2 , 3 R 2 , 3 u 1 u 1 u 1 . . . . . . . . . u j − 1 u j − 1 u j − 1 u j u j u j . . . . . . . . . u k − 1 u k − 1 u k − 1 u k u k u k . . . . . . . . . u m u m u m s ′ s ′ s ′ s ′ s ′ s ′ R 1 , 2 R 1 , 2 R 1 , 2 1 2 1 1 2 2 100 / 444