![](bg2.png)
is the transition relation (s → t is short for (s,t) ∈→),
L : S → 2
AP
specifies which propositions are true in
each state. A path in a Kripke structure is a sequence
q
0
→ q
1
→ q
2
→ ··· such that q
i
→ q
i+1
for all i ≥ 0.
Temporal logics include CTL*, CTL and LTL
(Clarke et al., 1999). LTL and CTL are strict sub-
sets of CTL*. CTL* features two path quantifiers A
and E (for all/some computation paths) and five ba-
sic temporal operators: X “next”, F “eventually”, G
“always” or “globally”, U “until”, and R “releases”;
we have state formulae (that hold in a state) and path
formulae (that hold along a path). In CTL the tempo-
ral operators must be immediately preceded by a path
quantifier. The syntax of CTL formulae can thus be
defined as follows: With a ranging over AP, and f,
f
1
, f
2
ranging over state formulae,
f = ⊤ | ⊥ | a | ¬ f | f
1
∧ f
2
| f
1
∨ f
2
|
AX f | AF f | AG f | A f
1
U f
2
| A f
1
R f
2
|
EX f | EF f | EG f | E f
1
U f
2
| E f
1
R f
2
The semantics of CTL formulae is defined by the
satisfaction operator . The notation K, s f [K, π
f] means that in a Kripke structure K, formula f is
true in state s [along path π]. The meaning of is
defined inductively. f and g are state formulae unless
stated otherwise. We use π
i
to denote the i-th state of
a path π (with the first state being state 0, or π
0
).
1. K, s ⊤ is true and K, s ⊥ is false.
2. K, s a, a ∈ AP iff a ∈ L(s).
3. K, s ¬ f iff ¬(K, s f).
4. K, s f ∧ g iff K, s f and K, s g.
5. K, s f ∨ g iff K, s f or K, s g.
6. K, s E f for some path formula f iff there is a
path π = s → s
1
→ s
2
→ ··· → s
i
s.t. K, π f.
7. K, s A f for some path formula f iff K, π f for
all paths π = s → s
1
→ s
2
→ ··· → s
i
.
8. K, π X f iff K, π
1
f.
9. K, π f U g iff there exists j ≥ 0 such that K, π
k
g for all k ≥ j, and K, π
i
f for all i < j.
10. K, π f R g iff for all j ≥ 0, if K, π
i
6 f for every
i < j then K, π
j
g.
The common model used for system specifica-
tions in model-based testing is the labelled transi-
tion system (LTS), where the labels or formulae are
associated with the transitions instead of states. In
model-based testing (De Nicola and Hennessy, 1984;
Tretmans, 1996) sound and complete test cases are
derived from a model (an LTS) that describes some
functional aspects of the system under test. The sys-
tem under test is also modelled as an LTS.
An LTS is a tuple M = (S, A, →, s
0
). S is a count-
able set of states, s
0
∈ S is the initial state. A is a set
of labels denoting visible (or observable) events (or
actions). →⊆ S × (A∪ {τ}) × S is the transition rela-
tion, where τ 6∈ A is the internal action that cannot be
observed by the external environment. We often use
p
a
−→ q instead of (p, a, q) ∈→; p
a
−→ is a shorthand
for ∃ q : p
a
−→ q. We blur the distinction between an
LTS and a state, calling them both “processes” (since
a state defines completely an LTS under a global →).
A path (or run) π starting from state p is a se-
quence p
0
a
1
−→ p
1
a
2
−→ ··· p
k−1
a
k
−→ p
k
, k ∈ such
that p
0
= p and p
i−1
a
i
−→ p
i
, 0 < i ≤ k; |π| is k, the
length of π. The trace of π is the sequence trace(π) =
(a
i
)
0<i≤|π|,a
i
6=τ
∈ A
∗
. Π(p) denotes the set of all the
paths starting from state p. p
w
=⇒ p
′
states that there
exists a sequence of transitions whose initial state is
p, whose final state is p
′
, and whose visible transi-
tions form the sequence w. The notation p
w
=⇒ stands
for ∃ p
′
: p
w
=⇒ p
′
. The traces of a process p are
traces(p) = {w : p
w
=⇒}. The finite traces of a pro-
cess p are defined as Fin(p) = {w : p
w
=⇒, |w| ∈ }.
A process p which can make no internal progress
(i.e., has no outgoinginternal actions) is said to be sta-
ble (Schneider,2000): p ↓= ¬(∃ p
′
6= p : p
τ
−→ p
′
). If
there is no action a ∈ X to which a process p can react
then p will refuse X: p ref X iff ∀a∈ X : ¬(∃ p
′
: p
ε
=⇒
p
′
∧ p
′
↓ ∧p
′
a
−→). (w, X) is called a stable failure
(Schneider, 2000) of p whenever ∃ p
w
: p
w
=⇒ p
w
∧
p
w
↓ ∧p
w
ref X. The set of stable failures of p is then
SF(p) = {(w, X) : ∃ p
w
: p
w
=⇒ p
w
∧ p
w
↓ ∧p
w
ref X}.
Then p ⊑
SF
q iff Fin(p) ⊆ Fin(q) and SF(p) ⊆ SF(q).
We call ⊑
SF
the stable failure preorder.
Systems and tests can be concisely described us-
ing the testing language TLOTOS (Brinksma et al.,
1987; Langerak, 1989). A is the countable set of ob-
servable actions, ranged over by a and excluding the
three special actions τ, θ, γ 6∈ A. The set of processes
or tests is ranged over by t, t
1
and t
2
; T ranges over
the sets of processes or tests. The syntax of TLOTOS
is then:
t = stop | a;t
1
| i;t
1
| θ;t
1
| pass | t
1
t
2
| ΣT.
The semantics of TLOTOS is defined as follows:
1. inaction (stop): no rules.
2. action prefix: a;t
1
a
−→ t
1
and i;t
1
τ
−→ t
1
3. deadlock detection: θ;t
1
θ
−→ t
1
.
4. successful termination: pass
γ
−→ stop.
5. choice: with g ∈ A∪{γ, θ, τ}, t
1
g
−→ t
′
1
: t
1
t
2
g
−→
t
′
1
, t
2
t
1
g
−→ t
′
1
.
ICSOFT 2010 - 5th International Conference on Software and Data Technologies
174