Model checking modal transition systems using ...

    
  !"
#$&%')( *  +,- ./0 ( 1(   2 3547698;:*@´@354*8q?A3Ž©;´'ÅU:"?]4;½GÐ 3Ž@¹;6ª\3Ž²;:°A¹U:*´94*: à ÊUÇOËu½Uש;´9®A
: G>@:´U?]\?]3¬©U´9® ©;µ?A6@35®’¯98q¯d:*°‡8q°]:?]698O?‡·:‘°A:Sª\>94*:?A69: #¸ ©\ª\:@9®µÂ©;° ‡°]3Ž¯@¿;:®f?A°]>94"?A>@°]:®.·Š3^?]6Î8q´ :*ºƒ« ?A:*´`ª\:ªq4"©U94"?A3Ž©;´ 35®@\?.?]©­d:´@©¸h©U°A:4*©;¸h¯@@°]:;½U¾ @¹;6š©U>@°°]:®A>@94"?A>@°]:®3¬´#?A6`8O?8q?A©;¸h3541¯@°A©U¯`©G®f3¬?A3Ž©;´`®8O?˜®f?]8O?]:®8;°A:Š:3^?]6@:*°µy8q@:;Å;©;°>@´9ª@:"?A:°f« ¸#3Ž´@:Sª~½GÒD69:*±#?A°78q´9®fµÂ©;°]¸ ®A>94768.®L?]°A>94"?A>@°]: 3Ž´G?A©?L·1e© ‡°]3¬¯9¿;: ®f?A°]>94!?]>@°A:S®˜8;´9ª8M¸h©\ª\:*< ¸.>\«J4*8;@`®˜µÂ©U°A¸‘>@@¸h:®?A6@:#4"94!?]>@°]:®8;´9ª©;?A6@:° ?A6@°]:*:*«™²O8q@:Sª“4*@°A:†©qµ08;`®f>98;@9®©qµ08;94"« ?A>@°]:·Š3¬?A6¼:"ºƒ?A:´9ª\:*ª O4"©U@°]:®4"©U´9®L?]°A>`4!?A:Sªš3Ž´?A693Ž®1¸š8q´@´9:*°  3^?35®M´@© ¹;°]:8q?A:°’?]698q´À?]6@:h?A3Ž¸h:4"©;¸h¯@º 3Ž® ª\:"³9´9:ª 3Ž´Ð&3Ž¹;>9°A:.Ä@Å9·Š6@:°A:˜¢ 8©»â ¼¾½ 4qů¢ 47»¿â ¼¾½ 8@Å98;´9ª ¯@°]: >¬ Á0†À ÌO»¿â ¼¾½ ³[™˜›¸tÁž¤ ™ Â=› t=&8 ÁA™qv¥Ãq–™ 5 Ì›8u > q™ —›{ÀœU´ ½ à:†°]:"µÂ:*°?A©#¸Ÿ›ŒS³ 8Aq 4ƒ’´ 8;®?A69:M€ % 0;
*
Ä~   7 ½@ÒD69: ®f:¸h8;´G?A354*®’3¬´ÏÐ 3¬¹U>@°A:hÄ35®’?A6@:h®f?]8q´`ª@8q°7ª©;´9:.µÂ©U° †5 Ø\Ò Í\®Å –Å | 2,  µÂ©;°†?]6@:.?]°A:S8O?]¸#:´G? ©qµ´9:*¹U8q?A3Ž©;´7`8 ?A© :²v8;`8O?A:¢ Ï 9 3Ž´à¸h©\ª\:#¸ Å ³9°]®f?M:*²O8q98q?A: Ï 9 3¬´à¸h©ƒª@:¢ ¸ 8q´9ª?A6@:´ ´@:*¹G8O?A:†?]698O? °]:®A>@@?AB@C2

`Q5P*HKMPqi;CDK 'F GLb •

\ F
a(c

HÅ
H € 2* \"b0d
2* 2W€ %  h Ð 3Ž¹;>@°]:ÏÊÜ®A6@©O· ®“8 ‡°]3¬¯9¿;:à2–Ò ÍÛ·Š3¬?A6"n:oHp ↳JIC´ ?A698q?‘¸h©\ª\:*#®A8q?A35®LµÂ± 9ª­8¢ 9–µÂ©U°.à žC¹:žË 3 º 8q´`ª~Å9: U>93¬²O8q@´9ª\:°f«J®A¯`:S4"3¬³9:ªh¸h©\ª\:*93¬°]:*¸h:*´G?7®*Åd·Š6@:*°]: – Å 2*/ | ’4*©;´9®A35®L?]:*´94*± 4769:47¿\®‘ÁA• žâ 3 9 Ì8;´9ª–8U®A®A:*°A?A3Ž©;´476@:S47¿\® Á0• ž â # 9 Ì!Å :;½ ¹9½&8U®‡µÂ©;>9´9ª3Ž´Ï?A6@:¼©;@­ _L:S4!?f«u¸h©\ª\:*@99®†©;µ18q@°]°A:´94":S® ©qµ7) ¬0Å%) 'j¬~ÅU8;´9ª )à ¹¬„¹ Ë`8q°]:Š°A:¯@@¹;6#?]6@: ¯d©U®A3^?]3¬²U: ´@©;°]¸š8q@@@9®’µÂ©; ° ‡°]3¬¯9¿;:‘2–Ò Í\®‡·Š3^?]6À®A3Ž¹;´98q?A>@°]: ÁRn3oHp:qvn*s\̒?A©8;´À8;\?]©;¸š8O?78ÙÁ[®f:: :;½ ¹9½ŠÃ ÊUÕOËÂ̑©;° ’5 Ø\Ò Í\®Ã¬Æ v˙½ÒD6@:®A3¬¹U´@3¬³`4*8;´94":“©qµ’?A6@: @3Ž²O8q9@3¬²O8;\?D©;>@°3¬´G?A:´G?©qµ'®A>9476š?]°]8;´9®LµÂ©U°A¸š8q?A3Ž©;´9®35®¸#©U°A:’®f¯d:4*3^³`43¬´?A698q? ·:‡®f::*¿#?A©h¯@°]:®A:*°]²;:¸#:S8q´@3Ž´@¹G®µÂ©U°D8;@°]:hÁ0n3o[p3qrnCs\Ì13¬´G?]© ?L·© 5†Ø\Ò Í\®˜• - 8q´`ª¸• ; ©;µD8;´Ï:"ºƒ?A:´9ª\:ªÏ®A3¬¹U´98O?]>@°]: Á n3o[p3qrnCs\Ì!½ $±À4"©U´9®L?]°A>`4!?A3Ž©;´0Å 476@:47¿ƒ3Ž´@¹ 9æ3¬´Ù¸#©\ª\:À8Î8;´9ª 4©U´ ?A6@: ‡°A3Ž¯@¿U:2Ò Í • 35®: U>93¬²O8q9@°]:šÁ n3oHp:qvn*s\Ì °]:*¯9°A:*« ®f:´U?]3¬´9¹‘?]6@: 2  ”>€   . | 8;´9 ª 2*.”€  . | 3Ž´G?A:°A¯@°]:"?78O?]3¬©U´9®‡Ã vË'©qµ• Á°]:®A¯d:4!?]3¬²U:*94"?A>@°]:®·Š3^?]6Ù®f3Ž¹;´`8O?A>9°A¶ :{nCs Šn3oHpÎ35®š?A69: ®L?78q´9ª@8;°]ª‘©;´9: :;½ ¹9½;®A:*:à qË  8q´9ª#·1: 8q@°¸h©\ª\:*94!?]3¬©U´8q@°]:® ä­`:?A6@:±:®f?]8;­@9°M>9®f:š©;µD8;94"?A>@°]: 3¬´G?A©?L·© ‡°]3¬¯9¿;: ®f?A°]>94!?]>@°A:S®8q´`ªš8M¸h©ƒª98q\«u48q94!?]3¬©U´Ü¯@°]©\4"::ª@®‘3¬´Ü?L·1©À®f?]8;¹;:®Å ©;´@:“©qµ†·Š6@3Ž476Ü3Ž®š8;´Ü8Uª@8q¯\?78O?]3¬©U´Î©qµ†8 °A:Sª\>94!?]3¬©U´‘©;µd¸h©\ª\:@9® µÂ©U°A¸‘>@9®°A:*µÂ:*°]:*:®8q°]:Š?A6`8q´@¿U:ª#µÂ©;°˜?A6@:3¬° 4"©;´`®L?]°A>94"?A3Ž²;:†µÂ:*:Sª\­98U47¿d½ 




 –0£ 0¡§¯. 

S• • R HLKMPSNUVÂYS0•  V‹œ9Y • 1C]HJILe`Y • 1VWNG‰JUTUHLXUYOc1•v FNU›!F;Y R •O`FNGiU—vC]H!YOa@•OjhFSiUP*HJˆ S FVWKhY R •;cVWC7KMC]gOC]H!Y•ƒa;VWNGXC]HLKFN9Y;FNƒi‘j¼•†•&F*Hfi;V• ceGC  P*HAa;E\C7bILC7KME\PHfF*_\_¬F*NGXTƒFXC R NU&C U ILC7KME\PHfF*_@EUHLPSE\CAHJI™gqˆy‰JE\C7b7V[ƒb!F"ILVWPSNh_^FNUXSTGFXSC•aqTGGKMV‹IJILC!i@Y'Fb_•  Z[Q9V‹I&ILT;HLNG‰0PST;I ILeƒF"I DHLVWEUŒvCjhca;‰ b7FNM\CIJHfFNG‰J_^F"ILC!i‡ILPEGF*HJILV^F_GDHLV^EUŒvC‰uIJHLTGb]ILT;HLC7‰0‰JTGbfe ILeƒF"I HL&C [GNGC7KMC7NOIL‰&F*HLC˜EUHLC7‰JCAHL—vC!iFNGiMHLC ƒC7b]ILC7i9YvILeUC7N‡ILeGC˜XSC7NUC]HfF_WVW›7C!i.KMPqiUC7_UbAeUC7bfŒ;VWNUXP*Q \ =c b7FNh\CŠF*EGEU_^VWC!i.ILP‡DHLVWEGŒvC jhcaq‰˜F? ‰ UC7_W_¶• _

q• c1• F*_^_¶Y R • E PqiUC]_^‰JŒqV¶Y\F*Nƒi‘a@•;‡• 1F JF*KFNGV¶• &POPS_WC!FNF*Nƒi#RF*HJILC7‰JV^FN R G‰uIJHfF*b]ILVWPSN‘QŽPH j#Pqi;C7_0R eGC]bAŒqVWNGX#R E HLPSXHfF*KM‰7• Z™Nc1•djhF*HLXSF*HLV^FhF*Nƒi … • DV¶Y\C7iUV‹ILPHL‰7Y
      "!#!#$"Y'—vPS_WTGKMCF
ab_šP*Q&%'(UY0EƒFXC7‰ F(^*),+ F)
a;Y 1C]NGP"—SFqY0Z[IfF_‹gOY R EUHLVW_ Fb_• aqEUHLVWNGXC]H 0C]HL_^FXU• a;•  •  CAHLNGeGP_‹IL›SYj¼•  F"HfiUV¶Y FNƒi E • … PS_WE\C]H!• R N R T;ILPSKF*IfF"ˆ[ceGC7P*HLC]ILVWb R EGE;HLPvF*bAe–ILP 0HfFNGbfeGVWNUXˆ[cVWKMCj#PqiUC]_Wˆ™R eUC7bAŒqVWNGX;• Z™. N -/1032 4/, 5678 9 9:9 ;.7=:?/@ 9AB C D  EF 9

GH/I IKJ &E> LNM*O!Y —vP_^TUKM C ) _)hPPQ %Q N/I?" R'S/@ 9 T7j7=:?/@ 9B C D  bE: 9

G7k H/I IGY"—vP_WTGKM C _.^ a
aP*cQ %Q N/I? 'S/@ 9l i7/10F 
*W 2 4/C5:78 9 9W Si:9/lH `D c  9

Y EGFXC7‰ _ 8 + _8) q• R Rj E HLC7‰J‰7Y@jhF7gF _S• _8[;•j¼•   •UBUgOC]H˜F*Nƒi.B†• R •Ga;bfeGKMV^i;I!• `VWKMV‹ILVWNGXMaOIfF*ILC ~œ;EG_WPS‰JVWPN UV‹ILe VW_WILCAHJˆ  F‰JC!i ˜C]ˆ

GNGC7KMC]NqI!•"Z[N
`   1`p7/10F 72%
 L€Rˆov04 =h_EF 99 GH/I C4tu D N5:04  v 1 HW 6>†N /IH#N/I CUY _[[ O• F ;• • R • 'KMC]HL‰JPNFNƒihR•@0•ƒ`C7V¶• (wMb7VWC7NOIDj#PqiUC7_ R eGC7bfŒqV^NUXMVWN dHfFXSKMC]NqIL‰P*Q0ILeUCj#TUˆ b7F_Wb7TG_WTU‰7•UZ[N
,{W/104 xl  /}2 F/, 5#2   ;F^="

1?"< d% CB 1i7=F?"/@ 9`:N X 9W J1%2( - O"YUEƒF*XSC76 ‰ F(^ + F);Y`RFK’UHLV^iUXCSYƒjhF‰J‰7•WcY \STUNGC _8[*) ^q•\Z    E HLC7‰J‰7• FQ_S•&…• UHfF*NGb7C]›SD • xgH  c 9L•qcdC]œqIL‰`FNƒi j#PNGPXHfFEUeG‰ VWNR PKMEGTUILCAH~aqb7VWC7NGb7C•*a;E;HLV^NUXSC]H 0C]HL_^FXUY _8[*)
^;• F Fq• E • 1PqiUC]Q¬HLPSV^i9Y&j¼• S TUILe9Y~F*Nƒi ( • \vF*XvFiUC7C7‰LF*N`• R U‰uIJHfFb]ILVWPSN;ˆyƒF‰JC7ij#PqiUC7_R eUC7bfŒ;VWNUX TU‰JVWNGX#j#PqiGF_&c HfFNU‰JV‹ILV^PNaqg;‰uILC7KM‰7•Z[r N
    Dhd/10F d2 F/@ 9 WH/I IWH*5P78 9 9:9 Ag0F 9^dH: >
H*N/I C U7:N?"  9:N^YO`C7b]ILT;HL C …1P*ILC7‰~VWNMR PKMEGTUILCAH0a;b7VWC7NUb7CSYEƒF*XSC7‰ YF
^+DY*Y;•9aqEUHLVWNGXC]H &CAHL_¬F*XUY R TUXSTG‰u6 I F  _S• F(a;•j¼• S TUILe9 Y • \vFXSFSi;C7C7‰LFN9YUFNƒiMB†•UaqbAeUKMV^i;I!•9j#PqiUF_\IJHfFNU‰JVWILVWPN‘‰ug;‰uILC7KM‰ qFDQŽPSTGNGiGF"ILV^PN QŽPH~ILe;HLC7C]ˆy—SF*_WTGC!i EUHLPXHfFKÛF*NƒF*_Wg;‰JVW‰7•ƒZ[N‡a;FNGiU‰ B†•WYC!iUV‹ILP*H!#Y
    D>p`/104 ?"9=4 H 4^