Introduction to Hennessy–Milner logic

In the previous chapters we have seen that implementation verification is a natural approach to establishing the correctness of (models of) reactive systems described, for instance, in the language CCS. The reason is that CCS, like all other process algebras, can be used to describe both actual systems and their specifications. However, when establishing the correctness of our system with respect to a specification using a notion of equivalence such as observational equivalence, we are forced to specify in some way the overall behaviour of the system.

Suppose, for instance, that all we want to know about our system is whether it can perform an a-labelled transition ‘now’. Phrasing this correctness requirement in terms of observational equivalence seems at best unnatural and maybe cannot be done at all! (See the paper Boudol and Larsen (1992) for an investigation of this issue.)

We can imagine a whole array of similar properties of a process that we might be interested in specifying and checking. For instance, we may wish to know whether our computer scientist of Chapter 2

• is not willing to drink tea now,

• is willing to drink both coffee and tea now,

• is willing to drink coffee, but not tea, now,

• never drinks alcoholic beverages, or

• always produces a publication after drinking coffee.