El mundo de OpenGL

We define the set of successor states post(A) of a set A ⊆ S as the set post(A) = {s ∈ S | ∃s⁰ ∈ A.Qs⁰s> 0}.

This way, given a CTMC model, a subset of the state space C0, and a CSL formula of the form

Φ = P./p(Φ1U^IΦ2),

we want to compute a finite truncation sufficient to evaluateJs, ΦK, that is, whether formula Φ holds in state s, for all states s∈ C0.

Definition 30: Finite Truncation

Definition 30

Let C = (S, Q, π(0)) be a CTMC with initial state sinit and la-beling L, C ⊆ S with sinit ∈ C a finite subset of S, and let C = post(C) \ C. The finite truncation of C is the finite state˙ CTMC C|C = (C ∪ ˙C, Q^C, π(0)) with labeling L^C where for all a ∈ AP, L^C(s, a) = L(s, a) if s ∈ C and L^C(s, a) =? otherwise.

4.2. Model Checking CSL Based on Truncation 95 4.2. Model Checking CSL based on Truncation

C0

C C˙

S

Definition 31: Finite Truncation ⇤Definition 31

Let C = (S, Q, ⇡(0)) be a CTMC with initial state sinit and la-belling L, C ✓ S with sinit 2 C a finite subset of S, and let C = post(C) \ C. The finite truncation of C is the finite state˙ CTMC C|C = (C [ ˙C, Q^C, ⇡(0)) with labelling L^C where for all a 2 AP, L^C(s, a) = L(s, a) if s 2 C and L^C(s, a) =? otherwise.

The infinitesimal generator is defined by Q^C_ss0 = Q_ss0 if s2 C and Q^C_ss0 = 0 otherwise as well as Q^C_ss= P

s⁰6=sQ^C_ss0.

We build the truncation of a model iteratively, using a high-level de-scription of the model as for example given by transition classes. We explore the model until for all s2 C0 the probability to reach states in C is below an accuracy ✏, which we may choose as a fixed value or due˙ to the probability bound p.

Algorithm 8 describes how we can obtain a sufficiently large state set C. For s 2 S, s⁰ 2 ˙C and t 2 R⁺0 [ {1} we use ⇡s⁰(t)^s to denote the probability that at time t 2 R⁺0, the CTMC is in state s⁰, under the condition that it was in s initially. For t = 1, we let ⇡ denote the limit for t ! 1. As s⁰ is absorbing, this value exists. Further, for a set of absorbing states A, we let ⇠(s, t, A) :=P

s⁰2A⇡_s⁰(t)^s denote the 95 4.2. Model Checking CSL based on Truncation

C⁰

C C˙

S

Definition 31: Finite Truncation ⇤Definition 31

Let C = (S, Q, ⇡(0)) be a CTMC with initial state s^init and la-belling L, C ✓ S with s^init 2 C a finite subset of S, and let C = post(C) \ C. The finite truncation of C is the finite state˙ CTMC C|C = (C [ ˙C, Q^C, ⇡(0)) with labelling L^C where for all a 2 AP, L^C(s, a) = L(s, a) if s 2 C and L^C(s, a) =? otherwise.

The infinitesimal generator is defined by Q^C_ss0 = Qss⁰ if s2 C and Q^C_ss0 = 0 otherwise as well as Q^C_ss= P

s⁰6=sQ^C_ss0.

We build the truncation of a model iteratively, using a high-level de-scription of the model as for example given by transition classes. We explore the model until for all s2 C0 the probability to reach states in C is below an accuracy ✏, which we may choose as a fixed value or due˙ to the probability bound p.

Algorithm 8 describes how we can obtain a sufficiently large state set C. For s 2 S, s⁰ 2 ˙C and t 2 R⁺0 [ {1} we use ⇡s⁰(t)^s to denote the probability that at time t 2 R⁺0, the CTMC is in state s⁰, under the condition that it was in s initially. For t = 1, we let ⇡ denote the limit for t ! 1. As s⁰ is absorbing, this value exists. Further, for a set of absorbing statesA, we let ⇠(s, t, A) := P

s⁰2A⇡s⁰(t)^s denote the

95 4.2. Model Checking CSL based on Truncation

C0

C C˙

S

Definition 31: Finite Truncation ⇤Definition 31

Let C = (S, Q, ⇡(0)) be a CTMC with initial state sinit and la-belling L, C ✓ S with sinit 2 C a finite subset of S, and let C = post(C) \ C. The finite truncation of C is the finite state˙ CTMC C|C = (C [ ˙C, Q^C, ⇡(0)) with labelling L^C where for all a 2 AP, L^C(s, a) = L(s, a) if s 2 C and L^C(s, a) =? otherwise.

The infinitesimal generator is defined by Q^C_ss0 = Q_ss0 if s2 C and Q^C_ss0 = 0 otherwise as well as Q^C_ss= P

s⁰6=sQ^C_ss0.

We build the truncation of a model iteratively, using a high-level de-scription of the model as for example given by transition classes. We explore the model until for all s2 C0 the probability to reach states in C is below an accuracy ✏, which we may choose as a fixed value or due˙ to the probability bound p.

Algorithm 8 describes how we can obtain a sufficiently large state set C. For s 2 S, s⁰ 2 ˙C and t 2 R⁺0 [ {1} we use ⇡s⁰(t)^s to denote the probability that at time t 2 R⁺0, the CTMC is in state s⁰, under the condition that it was in s initially. For t = 1, we let ⇡ denote the limit for t ! 1. As s⁰ is absorbing, this value exists. Further, for a set of absorbing states A, we let ⇠(s, t, A) :=P

s⁰2A⇡s⁰(t)^s denote the

95 4.2. Model Checking CSL based on Truncation

C⁰

C C˙

S

Definition 31: Finite Truncation ⇤Definition 31

Let C = (S, Q, ⇡(0)) be a CTMC with initial state s^init and la-belling L, C ✓ S with s^init 2 C a finite subset of S, and let C = post(C) \ C. The finite truncation of C is the finite state˙ CTMC C|C = (C [ ˙C, Q^C, ⇡(0)) with labelling L^C where for all a 2 AP, L^C(s, a) = L(s, a) if s 2 C and L^C(s, a) =? otherwise.

The infinitesimal generator is defined by Q^C_ss0 = Qss⁰ if s2 C and Q^C_ss0 = 0 otherwise as well as Q^C_ss= P

s⁰6=sQ^C_ss0.

We build the truncation of a model iteratively, using a high-level de-scription of the model as for example given by transition classes. We explore the model until for all s2 C⁰ the probability to reach states in C is below an accuracy ✏, which we may choose as a fixed value or due˙ to the probability bound p.

Algorithm 8 describes how we can obtain a sufficiently large state set C. For s 2 S, s⁰ 2 ˙C and t 2 R⁺0 [ {1} we use ⇡^s0(t)^s to denote the probability that at time t 2 R⁺0, the CTMC is in state s⁰, under the condition that it was in s initially. For t = 1, we let ⇡ denote the limit for t ! 1. As s⁰ is absorbing, this value exists. Further, for a set of absorbing states A, we let ⇠(s, t, A) :=P

s⁰2A⇡s⁰(t)^s denote the 95 4.2. Model Checking CSL based on Truncation

C0

C C˙

S

Definition 31: Finite Truncation ⇤Definition 31

Let C = (S, Q, ⇡(0)) be a CTMC with initial state sinit and la-belling L, C ✓ S with sinit 2 C a finite subset of S, and let C = post(C) \ C. The finite truncation of C is the finite state˙ CTMC C|C = (C [ ˙C, Q^C, ⇡(0)) with labelling L^C where for all a 2 AP, L^C(s, a) = L(s, a) if s 2 C and L^C(s, a) =? otherwise.

The infinitesimal generator is defined by Q^C_ss0 = Q_ss0 if s2 C and Q^C_ss0 = 0 otherwise as well as Q^C_ss= P

s⁰6=sQ^C_ss0.

We build the truncation of a model iteratively, using a high-level de-scription of the model as for example given by transition classes. We explore the model until for all s2 C⁰ the probability to reach states in C is below an accuracy ✏, which we may choose as a fixed value or due˙ to the probability bound p.

Algorithm 8 describes how we can obtain a sufficiently large state set C. For s 2 S, s⁰ 2 ˙C and t 2 R⁺0 [ {1} we use ⇡^s0(t)^s to denote the probability that at time t 2 R⁺0, the CTMC is in state s⁰, under the condition that it was in s initially. For t = 1, we let ⇡ denote the limit for t! 1. As s⁰ is absorbing, this value exists. Further, for a set of absorbing statesA, we let ⇠(s, t, A) :=P

s⁰2A⇡s⁰(t)^s denote the 95 4.2. Model Checking CSL based on Truncation

C0

C C˙

S

Definition 31: Finite Truncation ⇤Definition 31

Let C = (S, Q, ⇡(0)) be a CTMC with initial state s^init and la-belling L, C ✓ S with sinit 2 C a finite subset of S, and let C = post(C) \ C. The finite truncation of C is the finite state˙ CTMC C|C = (C [ ˙C, Q^C, ⇡(0)) with labelling L^C where for all a 2 AP, L^C(s, a) = L(s, a) if s 2 C and L^C(s, a) =? otherwise.

The infinitesimal generator is defined by Q^C_ss0 = Qss⁰ if s2 C and Q^C_ss0 = 0 otherwise as well as Q^C_ss= P

s⁰6=sQ^C_ss0.

We build the truncation of a model iteratively, using a high-level de-scription of the model as for example given by transition classes. We explore the model until for all s2 C0 the probability to reach states in C is below an accuracy ✏, which we may choose as a fixed value or due˙ to the probability bound p.

Algorithm 8 describes how we can obtain a sufficiently large state set C. For s 2 S, s⁰ 2 ˙C and t 2 R⁺0 [ {1} we use ⇡s⁰(t)^s to denote the probability that at time t 2 R⁺0, the CTMC is in state s⁰, under the condition that it was in s initially. For t = 1, we let ⇡ denote the limit for t ! 1. As s⁰ is absorbing, this value exists. Further, for a set of absorbing statesA, we let ⇠(s, t, A) :=P

s⁰2A⇡s⁰(t)^s denote the 95 4.2. Model Checking CSL based on Truncation

C⁰

C C˙

S

Definition 31: Finite Truncation ⇤Definition 31

Let C = (S, Q, ⇡(0)) be a CTMC with initial state s^init and la-belling L, C ✓ S with s^init 2 C a finite subset of S, and let C = post(C) \ C. The finite truncation of C is the finite state˙ CTMC C|C = (C [ ˙C, Q^C, ⇡(0)) with labelling L^C where for all a 2 AP, L^C(s, a) = L(s, a) if s 2 C and L^C(s, a) =? otherwise.

The infinitesimal generator is defined by Q^C_ss0 = Qss⁰ if s2 C and Q^C_ss0 = 0 otherwise as well as Q^C_ss= P

s⁰6=sQ^C_ss0.

We build the truncation of a model iteratively, using a high-level de-scription of the model as for example given by transition classes. We explore the model until for all s2 C⁰ the probability to reach states in C is below an accuracy ✏, which we may choose as a fixed value or due˙ to the probability bound p.

Algorithm 8 describes how we can obtain a sufficiently large state set C. For s 2 S, s⁰ 2 ˙C and t 2 R⁺0 [ {1} we use ⇡s⁰(t)^s to denote the probability that at time t 2 R⁺0, the CTMC is in state s⁰, under the condition that it was in s initially. For t = 1, we let ⇡ denote the limit for t ! 1. As s⁰ is absorbing, this value exists. Further, for a set of absorbing states A, we let ⇠(s, t, A) :=P

s⁰2A⇡_s0(t)^s denote the

9595 4.2. Model Checking CSL based on Truncation4.2. Model Checking CSL based on Truncation

C0

C C˙

S

Definition 31: Finite Truncation ⇤Definition 31

Let C = (S, Q, ⇡(0)) be a CTMC with initial state sinit and la-belling L, C ✓ S with s^init 2 C a finite subset of S, and let C = post(C) \ C. The finite truncation of C is the finite state˙ CTMC C|C = (C [ ˙C, Q^C, ⇡(0)) with labelling L^C where for all a2 AP, L^C(s, a) = L(s, a) if s2 C and L^C(s, a) =? otherwise.

The infinitesimal generator is defined by Q^C_ss0= Qss⁰if s2 C and Q^C_ss0= 0 otherwise as well as Q^C_ss= P

s⁰6=sQ^C_ss0.

We build the truncation of a model iteratively, using a high-level de-scription of the model as for example given by transition classes. We explore the model until for all s2 C0the probability to reach states in C is below an accuracy ✏, which we may choose as a fixed value or due˙ to the probability bound p.

Algorithm 8 describes how we can obtain a sufficiently large state set C. For s 2 S, s⁰2 ˙C and t 2 R⁺0 [ {1} we use ⇡s⁰(t)^s to denote the probability that at time t2 R⁺0, the CTMC is in state s⁰, under the condition that it was in s initially. For t = 1, we let ⇡ denote the limit for t! 1. As s⁰ is absorbing, this value exists. Further, for a set of absorbing statesA, we let ⇠(s, t, A) :=P

s⁰2A⇡s⁰(t)^sdenote the 95 4.2. Model Checking CSL based on Truncation

C0

C C˙

S

Definition 31: Finite Truncation ⇤Definition 31

Let C = (S, Q, ⇡(0)) be a CTMC with initial state sinit and la-belling L, C ✓ S with sinit 2 C a finite subset of S, and let C = post(C) \ C. The finite truncation of C is the finite state˙ CTMC C|C = (C [ ˙C, Q^C, ⇡(0)) with labelling L^C where for all a2 AP, L^C(s, a) = L(s, a) if s2 C and L^C(s, a) =? otherwise.

The infinitesimal generator is defined by Q^C_ss0= Qss⁰if s2 C and Q^C_ss0= 0 otherwise as well as Q^C_ss= P

s⁰6=sQ^C_ss0.

We build the truncation of a model iteratively, using a high-level de-scription of the model as for example given by transition classes. We explore the model until for all s2 C⁰the probability to reach states in C is below an accuracy ✏, which we may choose as a fixed value or due˙ to the probability bound p.

Algorithm 8 describes how we can obtain a sufficiently large state set C. For s 2 S, s⁰ 2 ˙C and t 2 R⁺0 [ {1} we use ⇡s⁰(t)^sto denote the probability that at time t2 R⁺0, the CTMC is in state s⁰, under the condition that it was in s initially. For t = 1, we let ⇡ denote the limit for t! 1. As s⁰is absorbing, this value exists. Further, for a set of absorbing statesA, we let ⇠(s, t, A) :=P

s⁰2A⇡s⁰(t)^sdenote the

95 4.2. Model Checking CSL based on Truncation

C0

C C˙

S

Definition 31: Finite Truncation ⇤Definition 31

Let C = (S, Q, ⇡(0)) be a CTMC with initial state sinit and la-belling L, C ✓ S with sinit 2 C a finite subset of S, and let C = post(C) \ C. The finite truncation of C is the finite state˙ CTMC C|C = (C [ ˙C, Q^C, ⇡(0)) with labelling L^C where for all a 2 AP, L^C(s, a) = L(s, a) if s 2 C and L^C(s, a) =? otherwise.

The infinitesimal generator is defined by Q^C_ss0= Qss⁰if s2 C and Q^C_ss0= 0 otherwise as well as Q^C_ss= P

s⁰6=sQ^C_ss0.

We build the truncation of a model iteratively, using a high-level de-scription of the model as for example given by transition classes. We explore the model until for all s2 C⁰ the probability to reach states in C is below an accuracy ✏, which we may choose as a fixed value or due˙ to the probability bound p.

Algorithm 8 describes how we can obtain a sufficiently large state set C. For s 2 S, s⁰2 ˙C and t 2 R⁺0 [ {1} we use ⇡s⁰(t)^s to denote the probability that at time t2 R⁺0, the CTMC is in state s⁰, under the condition that it was in s initially. For t =1, we let ⇡ denote the limit for t! 1. As s⁰ is absorbing, this value exists. Further, for a set of absorbing statesA, we let ⇠(s, t, A) :=P

s⁰2A⇡s⁰(t)^sdenote the

95 4.2. Model Checking CSL based on Truncation

C0

C C˙

S

Definition 31: Finite Truncation ⇤Definition 31

Let C = (S, Q, ⇡(0)) be a CTMC with initial state sinit and la-belling L, C ✓ S with sinit 2 C a finite subset of S, and let C = post(C) \ C. The finite truncation of C is the finite state˙ CTMC C|C = (C [ ˙C, Q^C, ⇡(0)) with labelling L^C where for all a 2 AP, L^C(s, a) = L(s, a) if s 2 C and L^C(s, a) =? otherwise.

The infinitesimal generator is defined by Q^C_ss0= Qss⁰if s2 C and Q^C_ss0= 0 otherwise as well as Q^C_ss= P

s⁰6=sQ^C_ss0.

We build the truncation of a model iteratively, using a high-level de-scription of the model as for example given by transition classes. We explore the model until for all s2 C0the probability to reach states in C is below an accuracy ✏, which we may choose as a fixed value or due˙ to the probability bound p.

Algorithm 8 describes how we can obtain a sufficiently large state set C. For s 2 S, s⁰2 ˙C and t 2 R⁺0 [ {1} we use ⇡s⁰(t)^s to denote the probability that at time t2 R⁺0, the CTMC is in state s⁰, under the condition that it was in s initially. For t =1, we let ⇡ denote the limit for t! 1. As s⁰ is absorbing, this value exists. Further, for a set of absorbing statesA, we let ⇠(s, t, A) :=P

Definition 31: Finite Truncation ⇤Definition 31

Let C = (S, Q, ⇡(0)) be a CTMC with initial state sinit and la-belling L, C ✓ S with sinit 2 C a finite subset of S, and let C = post(C) \ C. The finite truncation of C is the finite state˙ CTMC C|C = (C [ ˙C, Q^C, ⇡(0)) with labelling L^C where for all a 2 AP, L^C(s, a) = L(s, a) if s 2 C and L^C(s, a) =? otherwise.

The infinitesimal generator is defined by Q^C_ss0= Qss⁰if s2 C and Q^C_ss0= 0 otherwise as well as Q^C_ss= P

s⁰6=sQ^C_ss0.

We build the truncation of a model iteratively, using a high-level de-scription of the model as for example given by transition classes. We explore the model until for all s2 C0 the probability to reach states in C is below an accuracy ✏, which we may choose as a fixed value or due˙ to the probability bound p.

Algorithm 8 describes how we can obtain a sufficiently large state set C. For s 2 S, s⁰2 ˙C and t 2 R⁺0 [ {1} we use ⇡s⁰(t)^s to denote the probability that at time t2 R⁺0, the CTMC is in state s⁰, under the condition that it was in s initially. For t =1, we let ⇡ denote the limit for t! 1. As s⁰ is absorbing, this value exists. Further, for a set of absorbing statesA, we let ⇠(s, t, A) :=P

Definition 31: Finite Truncation ⇤Definition 31

Let C = (S, Q, ⇡(0)) be a CTMC with initial state sinit and la-belling L, C ✓ S with sinit 2 C a finite subset of S, and let C = post(C) \ C. The finite truncation of C is the finite state˙ CTMC C|C = (C [ ˙C, Q^C, ⇡(0)) with labelling L^C where for all a 2 AP, L^C(s, a) = L(s, a) if s 2 C and L^C(s, a) =? otherwise.

The infinitesimal generator is defined by Q^C_ss0= Qss⁰if s2 C and Q^C_ss0= 0 otherwise as well as Q^C_ss= P

s⁰6=sQ^C_ss0.

We build the truncation of a model iteratively, using a high-level de-scription of the model as for example given by transition classes. We explore the model until for all s2 C0the probability to reach states in C is below an accuracy ✏, which we may choose as a fixed value or due˙ to the probability bound p.

Algorithm 8 describes how we can obtain a sufficiently large state set C. For s 2 S, s⁰2 ˙C and t 2 R⁺0 [ {1} we use ⇡s⁰(t)^sto denote the probability that at time t2 R⁺0, the CTMC is in state s⁰, under the condition that it was in s initially. For t = 1, we let ⇡ denote the limit for t! 1. As s⁰ is absorbing, this value exists. Further, for a set of absorbing statesA, we let ⇠(s, t, A) :=P

s⁰2A⇡s⁰(t)^s denote the 95 4.2. Model Checking CSL based on Truncation

C0

C C˙

S

Definition 31: Finite Truncation ⇤Definition 31

Let C = (S, Q, ⇡(0)) be a CTMC with initial state sinitand la-belling L, C ✓ S with sinit 2 C a finite subset of S, and let C = post(C) \ C. The finite truncation of C is the finite state˙ CTMC C|C = (C [ ˙C, Q^C, ⇡(0)) with labelling L^C where for all a2 AP, L^C(s, a) = L(s, a) if s 2 C and L^C(s, a) =? otherwise.

The infinitesimal generator is defined by Q^C_ss0= Qss⁰if s2 C and Q^C_ss0= 0 otherwise as well as Q^C_ss= P

s⁰6=sQ^C_ss0.

We build the truncation of a model iteratively, using a high-level de-scription of the model as for example given by transition classes. We explore the model until for all s2 C0the probability to reach states in C is below an accuracy ✏, which we may choose as a fixed value or due˙ to the probability bound p.

Algorithm 8 describes how we can obtain a sufficiently large state set C. For s 2 S, s⁰ 2 ˙C and t 2 R⁺0 [ {1} we use ⇡s⁰(t)^s to denote the probability that at time t2 R⁺0, the CTMC is in state s⁰, under the condition that it was in s initially. For t = 1, we let ⇡ denote the limit for t ! 1. As s⁰is absorbing, this value exists. Further, for a set of absorbing statesA, we let ⇠(s, t, A) :=P

s⁰2A⇡s⁰(t)^sdenote the

Figure 4.1: Illustration of the relationship between setsS, C, C0, and ˙C.

Definition 31: Finite Truncation ⇤Definition 31

Let C = (S, Q, ⇡(0)) be a CTMC with initial state sinitand la-belling L, C ✓ S with sinit 2 C a finite subset of S, and let C = post(C) \ C. The finite truncation of C is the finite state˙ CTMC C|C = (C [ ˙C, Q^C, ⇡(0)) with labelling L^C where for all a2 AP, L^C(s, a) = L(s, a) if s 2 C and L^C(s, a) =? otherwise.

The infinitesimal generator is defined by Q^C_ss0= Q_ss0if s2 C and Q^C_ss0= 0 otherwise as well as Q^C_ss= P

s⁰6=sQ^C_ss0.

We build the truncation of a model iteratively, using a high-level de-scription of the model as for example given by transition classes. We explore the model until for all s 2 C0 the probability to reach states in ˙C is below an accuracy ✏, which we may choose as a fixed value or due to the probability bound p. Figure 4.1 illustrates the relationship between the respective sets ✏.

Algorithm 8 describes how we can obtain a sufficiently large state set C. For s 2 S, s⁰ 2 ˙C and t 2 R⁺0 [ {1} we use ⇡s⁰(t)^s to denote the probability that at time t2 R⁺0, the CTMC is in state s⁰, under the

Figure 4.2: Illustration of the relationship between setsS, C, C0, and ˙C.

The infinitesimal generator is defined by Q^C_ss0 = Q_ss0 if s∈ C and Q^C_ss0 = 0 otherwise as well as Q^C_ss=−P

s⁰6=sQ^C_ss0.

Intuitively, C0 is the set of all states for which we want to decide the given formula and set C is the total set of states needed in order to achieve that goal. Figure 4.2 illustrates the relationship between the respective sets. We build the truncation of a model iteratively, using a high-level description of the model as for example given by transition classes. We explore the model until for all s ∈ C0 the probability to reach states in ˙C is below an accuracy  (blue curve in Figure 4.2), which we may choose as a fixed value or due to the probability bound p.

Algorithm 6 describes how we can obtain a sufficiently large state set C. For s ∈ S, s⁰ ∈ ˙C and t ∈ R⁺0 ∪ {∞} we use π^(s)_s0 (t) to denote the probability that at time t ∈ R⁺0, the CTMC is in state s⁰, under the condition that it was in state s initially. For t = ∞, we let π denote the limit for t→ ∞. As s⁰ is absorbing, this value exists. Further, for a set of absorbing states A, we let ξ(s, t, A) :=P

s⁰∈Aπ^(s)_s0 (t) denote the

probability to reach setA within time t ∈ R⁺₀∪{∞}. Given a fixed s and t, we can compute π^(s)_s0 (t) for all s⁰ at once effectively, and givenA and t we can compute ξ(s, t,A) for all s at once effectively [BHHK03]. We use the notation ξ_{C [D]}(s, t,A) to denote that the respective quantity is computed on the CTMC C , where states inD ⊆ S are made absorbing.

The algorithm is started on a CTMC C and a set of states C0, for which we want to decide a given property expressed as a CSL formula.

We also provide the time bound t as well as the accuracy . With eC we denote a set of states for which the exploration algorithm may stop immediately, as further exploration is not needed to decide the given property. For Φ = P_./p(Φ₁U^[0,t]Φ₂) with t∈ R⁺0 ∪{∞}, we could specify C as the states which fulfill Φe 2∨ (¬Φ1∧ ¬Φ2).

Algorithm 6 treachability(C ,C0, eC, t, )

1: C := C0

2: C := post(C) \ C˙

3: while max_s∈C0ξ_{C [ ˙C]}(s, t, ˙C \ eC) ≥  do

4: choose s from arg max_s∈C0ξ_{C [ ˙C]}(s, t, ˙C \ eC)

5: while ξ_{C [ ˙C]}(s, t, ˙C \ eC) ≥  do

6: choose A ⊆ ( ˙C \ ˜C) such that ξ_{C [ ˙C]}(s, t,A) ≥ 

7: C := C ∪ A

8: C := post(C) \ C˙

9: end while

10: end while

11: return C ∪ (post(C) ∩ eC)

Let n be the number of states in the final state set C. In the worst case, the state space resembles a linear structure and we will need n time-bounded reachability computations of length in order to arrive at the final set C. Thus, the time complexity is O(u · n²· t) and the space complexity isO(n) assuming a sparse model as given by an MPM induced by transition classes.

In document Realidad aumentada en interfaces hombre maquina (página 74-79)