Proofs on expressing nested GR(1) properties in GR(1)

Σχετικά έγγραφα
Every set of first-order formulas is equivalent to an independent set

C.S. 430 Assignment 6, Sample Solutions

Fractional Colorings and Zykov Products of graphs

2 Composition. Invertible Mappings

Lecture 2. Soundness and completeness of propositional logic

Nowhere-zero flows Let be a digraph, Abelian group. A Γ-circulation in is a mapping : such that, where, and : tail in X, head in

The Simply Typed Lambda Calculus

Ordinal Arithmetic: Addition, Multiplication, Exponentiation and Limit

Example Sheet 3 Solutions

Problem Set 3: Solutions

Phys460.nb Solution for the t-dependent Schrodinger s equation How did we find the solution? (not required)

ORDINAL ARITHMETIC JULIAN J. SCHLÖDER

Uniform Convergence of Fourier Series Michael Taylor

Inverse trigonometric functions & General Solution of Trigonometric Equations

HOMEWORK 4 = G. In order to plot the stress versus the stretch we define a normalized stretch:

4.6 Autoregressive Moving Average Model ARMA(1,1)

Other Test Constructions: Likelihood Ratio & Bayes Tests

Bounding Nonsplitting Enumeration Degrees

Approximation of distance between locations on earth given by latitude and longitude

Concrete Mathematics Exercises from 30 September 2016

Overview. Transition Semantics. Configurations and the transition relation. Executions and computation

Homomorphism in Intuitionistic Fuzzy Automata

Sequent Calculi for the Modal µ-calculus over S5. Luca Alberucci, University of Berne. Logic Colloquium Berne, July 4th 2008

EE512: Error Control Coding

3.4 SUM AND DIFFERENCE FORMULAS. NOTE: cos(α+β) cos α + cos β cos(α-β) cos α -cos β

Statistical Inference I Locally most powerful tests

derivation of the Laplacian from rectangular to spherical coordinates

Reminders: linear functions

Solutions to Exercise Sheet 5

5. Choice under Uncertainty

A Note on Intuitionistic Fuzzy. Equivalence Relation

Homework 3 Solutions

Matrices and Determinants

Econ 2110: Fall 2008 Suggested Solutions to Problem Set 8 questions or comments to Dan Fetter 1

ST5224: Advanced Statistical Theory II

CHAPTER 25 SOLVING EQUATIONS BY ITERATIVE METHODS

SCHOOL OF MATHEMATICAL SCIENCES G11LMA Linear Mathematics Examination Solutions

5.4 The Poisson Distribution.

Lecture 15 - Root System Axiomatics

TMA4115 Matematikk 3

Section 8.3 Trigonometric Equations

Fourier Series. MATH 211, Calculus II. J. Robert Buchanan. Spring Department of Mathematics

Lecture 2: Dirac notation and a review of linear algebra Read Sakurai chapter 1, Baym chatper 3

Απόκριση σε Μοναδιαία Ωστική Δύναμη (Unit Impulse) Απόκριση σε Δυνάμεις Αυθαίρετα Μεταβαλλόμενες με το Χρόνο. Απόστολος Σ.

2. Let H 1 and H 2 be Hilbert spaces and let T : H 1 H 2 be a bounded linear operator. Prove that [T (H 1 )] = N (T ). (6p)

6.1. Dirac Equation. Hamiltonian. Dirac Eq.

Math221: HW# 1 solutions

Srednicki Chapter 55

Practice Exam 2. Conceptual Questions. 1. State a Basic identity and then verify it. (a) Identity: Solution: One identity is csc(θ) = 1

1. Introduction and Preliminaries.

Finite Field Problems: Solutions

Second Order RLC Filters

( y) Partial Differential Equations

Homework 8 Model Solution Section

Tridiagonal matrices. Gérard MEURANT. October, 2008

LTL to Buchi. Overview. Buchi Model Checking LTL Translating LTL into Buchi. Ralf Huuck. Buchi Automata. Example

Distances in Sierpiński Triangle Graphs

Coefficient Inequalities for a New Subclass of K-uniformly Convex Functions

Dynamic types, Lambda calculus machines Section and Practice Problems Apr 21 22, 2016

Lecture 21: Properties and robustness of LSE

ω ω ω ω ω ω+2 ω ω+2 + ω ω ω ω+2 + ω ω+1 ω ω+2 2 ω ω ω ω ω ω ω ω+1 ω ω2 ω ω2 + ω ω ω2 + ω ω ω ω2 + ω ω+1 ω ω2 + ω ω+1 + ω ω ω ω2 + ω

ΕΛΛΗΝΙΚΗ ΔΗΜΟΚΡΑΤΙΑ ΠΑΝΕΠΙΣΤΗΜΙΟ ΚΡΗΤΗΣ. Ψηφιακή Οικονομία. Διάλεξη 10η: Basics of Game Theory part 2 Mαρίνα Μπιτσάκη Τμήμα Επιστήμης Υπολογιστών

Chap. 6 Pushdown Automata

Partial Differential Equations in Biology The boundary element method. March 26, 2013

Μηχανική Μάθηση Hypothesis Testing

Solution Series 9. i=1 x i and i=1 x i.

Lecture 34 Bootstrap confidence intervals

CRASH COURSE IN PRECALCULUS

Main source: "Discrete-time systems and computer control" by Α. ΣΚΟΔΡΑΣ ΨΗΦΙΑΚΟΣ ΕΛΕΓΧΟΣ ΔΙΑΛΕΞΗ 4 ΔΙΑΦΑΝΕΙΑ 1

Commutative Monoids in Intuitionistic Fuzzy Sets

A Conception of Inductive Logic: Example

Jesse Maassen and Mark Lundstrom Purdue University November 25, 2013

Appendix to Technology Transfer and Spillovers in International Joint Ventures

9.09. # 1. Area inside the oval limaçon r = cos θ. To graph, start with θ = 0 so r = 6. Compute dr

w o = R 1 p. (1) R = p =. = 1

MINIMAL CLOSED SETS AND MAXIMAL CLOSED SETS

Depth versus Rigidity in the Design of International Trade Agreements. Leslie Johns

Chapter 6: Systems of Linear Differential. be continuous functions on the interval

DESIGN OF MACHINERY SOLUTION MANUAL h in h 4 0.

Models for Probabilistic Programs with an Adversary

12. Radon-Nikodym Theorem

SCITECH Volume 13, Issue 2 RESEARCH ORGANISATION Published online: March 29, 2018

On a four-dimensional hyperbolic manifold with finite volume

SOME PROPERTIES OF FUZZY REAL NUMBERS

Math 446 Homework 3 Solutions. (1). (i): Reverse triangle inequality for metrics: Let (X, d) be a metric space and let x, y, z X.

Generating Set of the Complete Semigroups of Binary Relations

ANSWERSHEET (TOPIC = DIFFERENTIAL CALCULUS) COLLECTION #2. h 0 h h 0 h h 0 ( ) g k = g 0 + g 1 + g g 2009 =?

Section 9.2 Polar Equations and Graphs

ECE 308 SIGNALS AND SYSTEMS FALL 2017 Answers to selected problems on prior years examinations

Space-Time Symmetries

Lecture 13 - Root Space Decomposition II

Pg The perimeter is P = 3x The area of a triangle is. where b is the base, h is the height. In our case b = x, then the area is

The challenges of non-stable predicates

Notes on the Open Economy

Chapter 3: Ordinal Numbers

General 2 2 PT -Symmetric Matrices and Jordan Blocks 1

k A = [k, k]( )[a 1, a 2 ] = [ka 1,ka 2 ] 4For the division of two intervals of confidence in R +

Potential Dividers. 46 minutes. 46 marks. Page 1 of 11

Congruence Classes of Invertible Matrices of Order 3 over F 2

The Probabilistic Method - Probabilistic Techniques. Lecture 7: The Janson Inequality

Transcript:

Proofs on expressing nested GR(1 properties in GR(1 Ioannis Filippidis ifilippi@caltech.edu Control and Dynamical Systems California Institute of Technology December 22, 2017 Abstract This is a proof that any nested GR(1 property is equivalent to a GR(1 property, by adding an auxiliary variable that counts up to the nesting depth, which is at most equal to the number of states. In practice the nesting depth is small. The proof style below is described in [1]. The results are proved for stutter-sensitive properties, and stutter-sensitive temporal quantification (,. Wherever we invoke arguments about history-determined variables, these are analogous to the stutter-invariant case [2]. The rules of TLA + are assumed for declaring variables, so when writing q : a in a theorem statement, the identifier q stands for a fresh name in the context where the theorem is applied. For this reason, where possible we do not mention assumptions about what identifiers can occur when. assume The operators take Boolean values, except where otherwise noted. Definition 1 Let d Nat, H k Nat, Ξ m Nat. A chain condition is a formula of the form: m 1..d : P m 1 Q m l 0..Ξ m : ξ ml P m 1 m 0..d : Q m P m l 0..H m : η ml (P m Q m l 0..Ξ m : ξ ml Q m assume ChainCondition = The operators P m, Q m, ξ ml, η ml satisfy a chain condition (Definition 1. Definition 2 (Nested GR(1 property [3] Let φ is a nested GR(1 property. φ = m 0..d P m k m..d Q m ( Q m l 0..Ξ m 1

A nested GR(1 property is defined here as a liveness formula. Inserting a liveness formula of this form in a stepwise implication operator ( +, WhilePlusHalf, or some other choice can yield an open-system property. Proposition 3 let φ 1 = (( i A i B = ( i A i B in φ 1 1 1. define φ 1 = (( i A i B = ( i A i B 1 2. suffices assume new σ, IsABehavior(σ prove σ = φ 1 1 3. case σ = i A i 2 1. σ = ( i A i ( i A i 2 2. case σ = B 3 1. σ = B BY 2 2 3 2. σ = i A i by 1 3, 2 1 3 3. σ = φ 1 ( i A i B ( B ( i A i ( i A i B 3 4. σ = B i A i ( ( i A i B 3 5. qed by 3 3, 3 4 2 3. case σ = B by 2 3 def φ 1, 2 4. qed by 2 2, 2 3 1 4. case σ = i A i 2 1. σ = φ 1 by 1 4 def φ 1 2 2. σ = 3 1. σ = i A i by 1 4 3 2. qed by 3 1 def 2 3. qed by 2 1, 2 2 1 5. qed by 1 3, 1 4 2

Proposition 4 prove let φ 1 in φ 1 = (a b = q : q = true ( q (b (q a q 1 1. suffices assume new σ, IsABehavior(σ prove σ = φ 1 1 2. assume σ = φ 1 prove σ = The variable q is history-determined in Hist q : (q = true (q = b ( a q. It remains to show that φ 1 and Hist imply q. The case a implies b, so q. The case a is split as ( a (a a. For the subcase a, q starts and remains true. For the subcase (a a, some infinite suffix of σ has a from the second state onwards, and b, so q. Thus, q. 1 3. assume σ = prove σ = φ 1 The case (a b implies a b. The case (a b implies q. By q, eventually there is a (q q-step. Such a step implies b. The two cases are exhaustive, thus (a b. 1 4. qed by 1 2, 1 3 Proposition 5 prove ( ((a j b j c ( ( j b j (a c 1 1. ( (a j b j c ( ( j b j (a c 1 2. qed by 1 1, Proposition 3 with A i b j, i j, B (a c Proposition 6 prove ( ( j b j (a c q : ( j b j q = true (q = c (q a q proof by Proposition 4, rules for. From this point on we assume that history-determined variables (q, r, etc. do not occur implicitly (so c, a, etc. below are independent of those history variables, only explicitly where shown. 3

Proposition 7 define φ 1 = q : ( j b j q = true (q = c ( a q q = r, q : ( j b j q = true r true (r = c (r a (q = c (q a q prove φ 1 proof by the rules for introducing bound variables, r does not occur in any of the expressions a, c, b j, q. So r is a history-determined variable. Proposition 8 define φ 1 = r, q : ( j b j q = true (q = c ( a q q r = true (r = c ( a r = r : ( j b j r r = true (r = c ( a r prove φ 1 1 1. φ 1 Within the consequent, q and r are both history-determined by the same formulas. Thus, (q = r, which together with q implies r in the consequent. We then eliminate q (recall the assumption that q, r do not occur in a, c, b j. 1 2. φ 1 Introduce a history-determined variable r in the consequent. Again, identical formulas imply that (r = q within the consequent, so q implies r. Omit the conjunct q. 1 3. qed by 1 1, 1 2 Proposition 9 prove ( ( (a j b j c q : q = true (q = c ( a q ( j b j q (1 by Proposition 5, Proposition 6, Proposition 7, Proposition 8. 4

Proposition 10 assume For all m 0..d, for any j with j 0..d j m, variable q m does not occur in any of P m, η kl, Q m. prove let φ 1 = m 0..d ((P m ( k m..d Q m = q 0,..., q d : m 0..d q m true in φ 1 ( q m = Q m ( P m q m ( k m..d q m 1 1. assume new m 0..d prove ((P m ( k m..d Q m q m : q m (q m = Q m ( P m q m ( k m..d q m proof Substitute a P m, b j η kl, c Q m, q q m in Proposition 9. 1 2. qed By hypothesis, 1 1, dm=0 ((P m ( Q m k m..d dm=0 q m : q m true q 0,..., q d (q m = Q m ( P m q m ( k m..d q m : d m=0 q m true (q m = Q m ( P m q m ( k m..d q m (2 Proposition 11 prove let φ 1 in φ 1 = m 0..d q m = true 1 1. define φ 1 = m 0..d q m = true ( q m = Q m ( P m q m ( k m..d = m 0..d q m = true ( q m = Q m ( P m q m ( k 0..d ( q m = Q m ( P m q m ( k m..d = m 0..d q m = true ( q m = Q m ( P m q m ( k 0..d 1 2. suffices assume new σ, IsABehavior(σ prove σ = φ 1 q m q m q m q m 5

1 3. assume σ = φ 1 prove σ = obvious 1 4. assume σ = prove σ = φ 1 2 1. k 0..d : l 0..H k : η kl (P k Q k P k 2 2. k 0..(d 1 : P k Q k+1 2 3. k 0..(d 1 : l 0..H k : η k P k Q k+1 by 2 1, 2 2 2 4. k 0..(d 1 : r k..d : Q k Q r 3 1. k 0..(d 1 : Q k Q k+1 4 1. k 0..(d 1 : P k Q k+1 by ChainCondition 4 2. k 0..d : Q k P k 4 3. qed by 4 1, 4 2 3 2. k 0..(d 1 : r (k + 1..d : Q k Q r 4 1. r (k + 1..d : k < k + 1 r d k < r d 4 2. qed by 4 1, 3 1, NatInduction 3 3. k : Q k Q k 3 4. qed by 3 2, 3 3. 2 5. m 0..d : k 0..(m 1 : l 0..H k : η kl Q m 3 1. m 0..d : k 0..(m 1 : l 0..H k : η kl Q k+1 4 1. m 0..d : k 0..(m 1 : k 0..(m 1 = 0..(d 1 4 2. qed by 4 1, 2 3. 3 2. m 0..d : k 0..(m 1 : Q k+1 Q m 4 1. m 0..d : k 0..(m 1 : m (k + 1..d 5 1. k 0..(m 1 k m 1 k + 1 m 5 2. m 0..d m d 5 3. qed by 5 1, 5 2. 4 2. m 0..d : k 0..(m 1 : (k +1 0..(m 1+1 = 0..m 0..d (the k +1 here is k in 2 4. 4 3. qed by 4 1, 4 2, 2 4. 3 3. qed by 3 1, 3 2, m 0..d : k 0..(m 1 : l 0..H k : ( (η kl Q k+1 (Q k+1 Q m η kl Q m 2 6. m 0..d : k 0..(m 1 : l 0..H k : η kl Q m 3 1. (A B ( A B 3 2. ( B ( B 3 3. (A B ( A B by 3 1, 3 2. 3 4. (η kl Q m ( η kl Q m by 3 3 with A η kl, B Q m 6

3 5. qed by 2 5, 3 4. 2 7. σ = m 0..d ( q m = Q m ( P m q m 2 8. m 0..d : σ = Q m q m 3 1. σ = Q m q m by 2 7. 3 2. qed by 3 1 and q m q m 2 9. m 0..d : k 0..(m 1 : l 0..H k : σ = η kl q m by 2 6, 2 8 2 10. m 0..d : σ = ( k 0..(m 1 3 1. m 0..d : σ = ( k 0..(m 1 by 2 9 3 2. m 0..d : ( k 0..(m 1 3 3. qed by 3 1, 3 2 2 11. qed by 2 10, as follows: 1 5. qed by 1 3, 1 4 Proposition 12 let φ 1 η kl q m η kl k 0..(m 1 q m q m σ = σ = m 0..dq = true m 0..d (q m = Q m ( P m q m k 0..d η kl q m σ = m 0..dq = true m 0..d (q m = Q m ( P m q m k m..d η kl k 0..(m 1 η kl q m σ = m 0..dq = true m 0..d (q m = Q m ( P m q m k m..d η kl q m q m σ = m 0..dq = true m 0..d (q m = Q m ( P m q m k m..d η kl q m σ = φ 1 = m 0..d P m k m..d Q m q m = q 0,..., q d : m 0..dq m true m 0..d ( q m Q m ( P m q m ( η ml m 0..d q m in φ 1 7

by Propositions 10 and 11 Proposition 13 assume new m 0..d prove let φ 1 = ( Q m l 0..Ξ m = l 0..Ξ m in φ 1 1 1. define φ 1 = ( Q m l 0..Ξ m = l 0..Ξ m 1 2. suffices assume new σ, IsABehavior(σ prove σ = φ 1 1 3. assume σ = prove σ = φ 1 2 1. Ξ m l=0 Ξ m l=0 proof Ξ m l=0 Ξ m l=0 Ξ m l=0 2 2. ( Ξ m l=0 (( Q m Ξ m l=0 proof ( Ξ m l=0 (( Q m Ξ m l=0 2 3. qed by 1 3, 2 1, 2 2 1 4. assume σ = φ 1 prove σ = 2 1. case σ = Q m 3 1. l 0..Ξ m : ξ ml Q m by ChainCondition 3 2. l 0..Ξ m : Q m ξ ml by 3 1 3 3. l 0..Ξ m : ( Q m ( by 3 2 3 4. qed by 2 1, 3 3 2 2. case σ = Q m 3 1. φ 1 Q m l 0..Ξ m 3 2. l 0..Ξ m l 0..Ξ m l 0..Ξ m by [4, p.93], (A B ( A ( B. 3 3. qed by 2 2, 3 1, 3 2 2 3. qed by 1 4, 2 1, 2 2 1 5. qed by 1 3, 1 4 Proposition 14 prove let φ 1 = ( η ml m 0..d = m 0..d l 0..Ξ m in φ 1 l 0..Ξ m 8

1 1. define φ 1 = ( η ml m 0..d l 0..Ξ m = m 0..d l 0..Ξ m 1 2. suffices assume new σ, IsABehavior(σ prove σ = φ 1 1 3. σ = φ 1 obvious 1 4. σ = φ 1 2 1. define F = η ml 2 2. case σ = F by 2 2 def F, φ 1, 2 3. case σ = F 3 1. ( F η ml 3 2. η ml m 0..d : l 0..H m : η ml 3 3. m 0..d : l 0..H m : η ml k 0..d : r 0..H k : ξ kr 4 1. m 0..d : l 0..H m : η ml P m Q m 4 2. m 0..(d 1 : P m P m+1 4 3. m 0..(d 1 : q (m + 1..d : P m P q by 4 2, NatInduction 4 4. m 0..(d 1 : q (m + 1..d : P q P m 4 5. m 0..d : l 0..Ξ m : ξ ml Q m by ChainCondition 4 6. m 1..d : l 0..Ξ m : ξ ml P m 1 by ChainCondition 4 7. ξ ml P m 1 P m 2 P 0 r 0..(m 1 : l 0..Ξ m : ξ ml P r and m (r + 1..d : l 0..Ξ m : P r ξ ml 4 8. m 0..(d 1 : Q m Q m+1 4 9. m 0..(d 1 : q m..d : Q q Q m and Q q Q q 4 10. m 0..d : l 0..Ξ ml : ξ ml Q m proof m 0..d : l 0..Ξ m : Q m ξ ml 4 11. m 0..q : l 0..Ξ m : Q q ( Q m ξ ml 4 12. qed proof m 0..d : l 0..H m : η ml Q m k 0..m : θ 0..Ξ k : ξ kθ by 4 1, 4 11. Also, m 0..d : l 0..H m : η ml P m k (m + 1..d : θ 0..Ξ k : ξ kθ by 4 7. These imply that k 0..d : θ 0..Ξ k : ξ kθ. 3 4. m 0..d : l 0..H m : η ml k 0..d : r 0..Ξ k : ξ kr by 3 3 3 5. m 0..d : l 0..H m : η ml k 0..d : r 0..Ξ k : ξ kr by 3 4, ( A ( A 3 6. m 0..d : l 0..H m : η ml k 0..d 3 7. η ml k 0..d by 3 2, 3 6 3 8. qed by 2 3, 3 7 def φ 1, 2 4. qed by 2 2, 2 3 1 5. qed r 0..Ξ k ξ kr r 0..Ξ k ξ kr 9

P m Q m q m q m Q m Q m Q m P m Figure 1: The automaton that corresponds to the auxiliary variable p that reduces memory to d + 1. by 1 3, 1 4 Proposition 15 prove ( m 0..d (Q m l 0..Ξ m η ml m 0..d l 0..Ξ m by Propositions 13 and 14 Lemma 16 let φ 1 in φ 1 by Propositions 12 and 15 = m 0..d P m k m..d Q m ( Q m l 0..Ξ m = q 0,.., q d : m 0..d q m true ( q m Q m ( P m q m η ml m 0..d q m l 0..Ξ m 10

Proposition 17 prove let φ 1 in φ 1 = q 0,.., q d : m 0..d q m = true ( q m = Q m ( P m q m q m = p : p = d + 1 p = choose r 0..(d + 1 : m 0..d : (m < r Q m P m p > m (r d Q r P r p > r (p = d + 1 below is stutter-sensitive temporal quantification. Respose(q0,.., qd = m 0.. d : qm true (qm = Qm ( Pm qm qm phi1 = q0,.., qd : Response(q0,.., qd ChooseP(r = m 0.. d : (m < r Qm (r d Qr Pr (p > r Pm (p > m SMP(p = p = d + 1 (p = choose r 0.. (d + 1 : ChooseP(r SpecP(p = SMP(p (p = d + 1 phi2 = p : SpecP(p The satisfaction relation ( = below is of raw TLA+ theorem ReductionWithLinearMemory = assume new sigma, IsABehavior(sigma, ChainCondition prove sigma = phi1 phi2 proof 1 1. sigma = phi1 phi2 2 1. suffices assume sigma = phi1 11

prove sigma = phi2 obvious 2 2. sigma = p : SMP(p by def SMP p is history-determined we will prove liveness of p in SpecP 2 3. pick tau : IsABehavior(tau EqualUpToVars(tau, sigma, p, q0,.., qd tau = SMP(p Response(q0,.., qd by 2 2 2 4. suffices tau = (p = d + 1 by 2 3 def SpecP, SMP, phi2 and that p does not occur in the spec 2 9. tau = ( r 0.. (d + 1 : ChooseP(r 3 1.case m 0.. d : Qm ( Pm (p > m 4 1. m 0.. d : (m < (d + 1 (Qm ( Pm (p > m by 3 1 4 2. ChooseP(d + 1 (d + 1 0.. (d + 1 by 4 1 def ChooseP 4 qed by 4 2 3 2.case m 0.. d : Qm (Pm (p > m 4 1. pick z 0.. d : Qz (Pz (p > z t 0.. d : (t < z (Qt ( Pt (p > t by 3 2, SmallestNumberPrinciple choose the smallest such z. 4 2. (z d ( Qz (Pz (p > z by 4 1 4 3. ChooseP(z z 0.. (d + 1 by 4 1, 4 2 4 qed by 4 3 3 3. r 0.. (d + 1 : ChooseP(r by 3 1, 3 2 which are exhaustive 3 qed by 3 3 2 10. tau = p 0.. (d + 1 ChooseP(p by 2 3, 2 9 def SMP The next step ensures that if ever p < (d + 1, then qm, which starts a chain of Qm, leading to the bottom, and to (p = d + 1 again. 2 5. tau = p p m 0.. d : p = m qm 12

by 2 10, 2 3 (p 0..(d + 1, so if p decreases, then p = r 0..d. Since Choose(p, it is (Qr ( Pr (p > r, thus qr, by def Response. 2 6. (qm boolean (qm = Qm ( Pm qm (( qm (Qm qm by PTL 2 7. tau = (( qm qm Qm (( qm (Qm qm 3 1. tau = qm = true (qm = Qm ( Pm qm by 2 1, 2 3 def EqualUpToVars, phi 1 3 qed by 3 1, 2 6 2 8. tau = m 0.. d : (( qm Qm 3 1. tau = m 0.. d : qm by 2 3 def Response 3 qed by 3 1, 2 7 2 11. tau = (p = m (p 0.. d Qm p = m 3 1. Qm P(m 1.. P0 by ChainCondition 3 2. (p = m p 0.. d r 0.. (m 1 : (p > r obvious 3 3. ( Qm (p = m (p 0.. d r 0.. (m 1 : p > r Pr by 3 1, 3 2 3 4. tau = ( ( Qm (p = m (p 0.. d (p m by 3 3, 2 10 def ChooseP Otherwise the second conjunct of ChooseP would be violated. 3 5. ( Qm (p = m (p 0.. d ( Qm (p m obvious 3 6. tau = ( ( Qm (p = m (p 0.. d (p m by 3 5 def ChooseP Otherwise (m < p so it must be (Qm ( Pm (p > m, which is not the case. 3 qed by 3 4, 3 6 2 define TopOrLower(m = (0.. (d + 1 \ (m.. d 13

2 12. tau = (Qm qm p TopOrLower(m 3 1. tau = (Qm qm by 2 3 def Response 3 2. Qm Q(m + 1.. Qd by ChainCondition 3 3. tau = (Qm (p / m.. d by 2 10, 3 2 def ChooseP The second conjunct of ChooseP would be violated by such a p as r. 3 4. tau = (p 0.. (d + 1 by 2 10, RawRuleINV 2 3 5. tau = (Qm (p ((0.. (m 1 {d + 1} by 3 3, 3 4 3 qed by 3 1, 3 5 def TopOrLower 2 qed by 2 5, 2 7, 2 11, 2 12 Initially p = d + 1 by def SMP. Assume p < p. Then by 2 5, m 0..d : (p = m qm. It is qm Qm. Until qm, it is ( qm qm. by 2 7 follows that Qm until qm qm. by 2 7, qm qm implies Qm. by 2 11, p = m = p while Qm, so while qm qm. by 2 12 Qm implies (p < p = m (p = d + 1. So ((p < p Qm (because we started with Qm, and Qm. So p is strictly decreasing until p = d + 1 (by induction over steps of the behavior. 1 2. sigma = phi2 phi1 2 1. suffices assume sigma = phi2 prove sigma = phi1 obvious 2 2. sigma = p : SpecP(p by 2 1 def phi2 2 3. sigma = q0,.., qd : m 0.. d : qm = true (qm = Qm ( Pm qm obvious q 0,..., q d are history-determined. 2 4. pick tau : IsABehavior(tau EqualUpToVars(tau, sigma, p, q0,.., qd tau = SpecP(p m 0.. d : qm = true (qm = Qm ( Pm qm by 2 2, 2 3 2 5. suffices tau = m 0.. d : qm by 2 4 def phi 1, Response 2 6. suffices tau = m 0.. d : ((qm qm qm by 2 4, PTL whenever any q m becomes false, it eventually becomes again true. Thus, the goal from 2 5 follows. 2 7. tau = m 0.. d : ((qm qm ( Qm Pm by 2 4 2 8. tau = m 0.. d : (p > m 14

by 2 4 def SpecP 2 9. tau = m 0.. d : (( Qm Pm (p m by 2 4 def SpecP, SMP, ChooseP we proved under 1 1 that ChooseP(p holds. 2 10. tau = m 0.. d : ((p > m (Qm ( Pm (p > m by 2 4 def SpecP, SMP, ChooseP 2 11. tau = m 0.. d : (( Qm Pm ((p m (p > m by 2 9, 2 8 2 12. tau = m 0.. d : (( Qm Pm Qm by 2 10, 2 11 2 13. tau = m 0.. d : (Qm qm by 2 4 2 14. tau = m 0.. d : (( Qm Pm qm by 2 12, 2 13 2 qed by 2 7, 2 14 1 qed by 1 1, 1 2 References [1] L. Lamport, How to write a 21st century proof, Journal of fixed point theory and applications, vol. 11, no. 1, pp. 43 63, 2012. [2] M. Abadi and L. Lamport, An old-fashioned recipe for real time, TOPLAS, vol. 16, no. 5, pp. 1543 1571, September 1994. [3] I. Filippidis and R. M. Murray, Symbolic construction of GR(1 contracts for systems with full information, in ACC, 2016, pp. 782 789. [4] L. Lamport, Specifying Systems: The TLA + language and tools for hardware and software engineers. Addison-Wesley, 2002. 15

2024 © DocPlayer.gr Πολιτική Απορρήτου | Όροι Χρήσης | Σχόλια