SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf ·...

108
SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY OF QUEENSLAND Queensland 4072 Australia TECHNICAL REPORT Phone: +61 7 365 1003 Fax: +61 7 365 1533 No. 94-3 Peter Lindsay and Erik van Keulen Case studies in the verification of specifications in VDM and Z March 1994

Transcript of SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf ·...

Page 1: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

SOFTWARE VERIFICATION RESEARCH CENTRE

DEPARTMENT OF COMPUTER SCIENCE

THE UNIVERSITY OF QUEENSLAND

Queensland 4072Australia

TECHNICAL REPORT

Phone: +61 7 365 1003Fax: +61 7 365 1533

No. 94-3

Peter Lindsay and Erik van Keulen

Case studies in the verification of specifications in VDM and Z

March 1994

Page 2: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

�������������� ����� �������������� ��������� ������ !�#"$�%�& '�(������ ������) ��+*,�-���/.1032

465#785#9;:=<�>�?�@BADC1A�>�?1EF9G<IHKJLA�>1MN5�OQP'5#>

R/A�9BSBTVUDWXWXY

Z\[^]`_babcDdB_

egfDhji(eXkblmfonDhjlqpbr�stkquwvBxzy(uDx{kbi�kqn�y|i�p!i�k}x{h~k�i=vG��lqpBi�k�i�y{�&�#h~kbi�h�n�y{fDk6��v8x{�!pbr����!pby{fDk}�!pGyzhjlqpbr��kqxzh���lqpby{h�vBnvG�g��v8x{�!pbr�i�uwkbl�h���lqpGyzh~vBn&i=vG��i�kb��Dkqn�y{h�pGr-i�vG��y���pGx{k�i��Di�y{kq��i��(��pBl|f�vG��y{fDk6�w�k�lqpBi�k\i�y{�w��h~kbi=h�i���vBxz�!pGr�r~�i�uwkbl�h��wkb��h~n���pGnw���(�����LpGnw���8pGx{h�vB�wi(hjizi��Dkbi�h�n���vBx{��pGr�i�u�k�l�h���l}pGy{h�vBn)pbx{k �#hjizl��wi{i�kb���F¡�nwpGr��Di�hji�pbnw��kqx{h���lqpGyzh~v8n�y{kbl|fDnDh��¢�Dk�i���x{v8�+y{fDk�y��gv!�\kqyzfDv��Di�pbx{k!pbuDuDr~h�kb��y{v;y{fDk lqp8i�k i�y{�&�#h~kbi`��pGnw�Nh�i{i��Dkbi�h~n)y{fDk�wi�kFvb��i��&lmf�yzkblmfonDhj��Dkbi�pGxzk\�#h�i{l��&i{i�k����F£^h�nwpGr�r~���i��D¤8¤Bkbi�y{h�vBnwi(pGxzk¥��pB�#k�pG¦wvB�Dy$�tpq�oi=y{v;l�v8�¥¦Dh�nDk(y{fDkh~nw�#h��#h��#�wpbrXi�yzx{kqno¤By{f&i�vb�g�§pGnw�!�(���+y{v��!pG¨k�y{fok��k}x{h���lqpGyzh~vBn y|pBi�¨;i�y{xzvBnD¤8kqx©pGnw�!i�h��\uDr�kqxq�

Page 3: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY
Page 4: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� �����������

� �� _�a�������dB_���� � �� � � � pBl|¨#¤8x{vB�onw� ����������������������������������������������������������������������������� �� �! ��vBy{h��8pGy{h�vBn"������������������������������������������������������������������������������� � �!# $�l�vBuwk ����������������������������������������������������������������������������������� #� �&% '=�k}x{��h~kq�(��������������������������������������������������������������������������������� #� �!) ¡�lm¨�nDvb�tr~k��#¤Bkq� kqn#y i*��������������������������������������������������������������������� %

+ , a�-/.��10�� � cDa���-�] 2 �� � s�kbp8i�v8nDh~nD¤ pG¦wv8�Dy(i�uwkbl`h���lqpby{h�vBnwi���������������������������������������������������������� )

#� � � � £DvBxz�!pGrLi�uwkbl�h���lqpby{h~v8nwi3����������������������������������������������������������� ) #� � �! ��kqxzh���lqpby{h�vBn\vb��i�uwkbl�h���lqpby{h~v8nwi4��������������������������������������������������� 5 #� � �!# eXvvBr-i��Duou�v8x{y=��v8xt�kqx{h���lqpby{h~v8n6��������������������������������������������������� 5

��! $uwkbl�h���lqpGyzh~vBn;pbnw� �kqxzh���l}pGy{h�vBn\h�n!�(��� ������������������������������������������������� 7 #�! �� � egfDk$�(���+i�u�k�l�h���l}pGy{h�vBn!rjpbnD¤B�&pG¤Bk ��������������������������������������������� 7 #�! ��! ¡=n!k98opG� uDr~k©i�uwkbl�h���lqpby{h~v8n3������������������������������������������������������� : #�! ��!# egfDk<;�vB¤8hjl�vG�>=-pGx{yzhjpbr�£&�onwl�y{h�vBnwi?������������������������������������������������� ��@ #�! ��&% egfDk�ACBEDCFHG�i��ouDuwvBx{y©kqn#��h~xzvBnD� kqn#y ��������������������������������������������� �

��!# $uwkbl�h���lqpGyzh~vBn;pbnw� �kqxzh���l}pGy{h�vBn\h�n������������������������������������������������������� � ) #�!#�� � egfDk�����pby{fDk}�!pGyzhjlqpbr�eXvvBr�¨#h�yI��������������������������������������������������� � ) #�!#��! $�oi�yzkq� i�u�k�l�h���l}pGy{h�vBn ����������������������������������������������������������� � 5 #�!#��!# $�l|fDkq��p6lqpbrjl��Dr��wi������������������������������������������������������������������ � 7 #�!#��&% stkbpBi�vBnDh�nD¤ pG¦wvB�Dy$��i�u�k�l�h���l}pGy{h�vBnwi ��������������������������������������������� � 7

��&% J�vB�\uwpbx{h�i�vBn;vG�-�!pGyzfDkq�!pby{h�lqpGrDr�pGnD¤8�wpG¤8kbiK����������������������������������������������� � : #�&%o� � ��pby{fDkq��pGy{h�lqpGrw��x|pb�\kq�gv8x{¨(������������������������������������������������������� � : #�&%o�! e��#uwkbi ��������������������������������������������������������������������������� ��L #�&%o�!# £D�Dnwl`y{h~v8nwi�pGnw�\�8pGr��Dkbi3����������������������������������������������������������� @

h

Page 5: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

h~h �������������

� ��aq_����^c�� ����� + +#�� � s�kb��Dh�x{kq�\k}n#y i ��������������������������������������������������������������������������� #��! egfDk � h�x{y{f&�Dpq� � vv8¨\h~n�� ��������������������������������������������������������������� #��!# egfDk � h�x{y{f&�Dpq� � vv8¨\h~n!�(��� ����������������������������������������������������������� ##��&% $uwkbl�h���lqpGyzh~vBn!h�i{i��okbi*��������������������������������������������������������������������� �%

##�&%o� � $h��\h~r�pGxzh~y{h�kbi�pbnw���#h���kqx{kqn&l�kbi ����������������������������������������������������� �%##�&%o�! ��pGr�hj�Dpby{h�vBn;lmfokblm¨oi ��������������������������������������������������������������� )##�&%o�!# stkb�#�Dn&�DpGnwl`�\h~n;i�uwkbl`h���lqpby{h�vBnwi ��������������������������������������������������� )##�&%o�&% �=h�i�yzh~nD¤8�Dhji�fDh~nD¤ �#h���k}x{kqn�yg¨�h~nw�oigvG��i�u�k�l�h���l}pGy{h�vBn;l�v8�\uwvBnDkqn�y ������������������� 5##�&%o�!) £^h�kqrj� i�kqr�kbl�y{v8x|ig�oiti�y pGy{k$�8pGx{h�pG¦Dr�kbi ����������������������������������������������� 5##�&%o�!5 ¡��opGuDyzh~nD¤�y{fDk(�(�©� i�u�k�l�h���l}pGy{h�vBn\��vBx AEBED F/G ����������������������������������� 7

#��!) = xzvvG��vB¦or~h~¤ pGyzh~vBn&i������������������������������������������������������������������������ :##�!)�� � � kqr~r�� ��v8x{�\k��#nDkbiziQuDxzvvG��v8¦Dr~h�¤pGyzh~v8nwiK��������������������������������������������� :##�!)��! $�pby{h�i'��pb¦Dh~r�h~y��¥uox{vvG��v8¦Dr~h�¤pGyzh~v8nwi ������������������������������������������������� # @

#��!5 �Qk}x{h���lqpGyzh~vBn hji{i��DkbiI����������������������������������������������������������������������� # ##�!5�� � ¡=�oy{vB��pGy{k��¥y��#uwk��Ilmfokblm¨�h~no¤ ����������������������������������������������������� # ##�!5��! ��pGr�hj�Dpby{h�vBn;lmfokblm¨oi ��������������������������������������������������������������� # ##�!5��!# $�pby{h�i'��pb¦Dh~r�h~y�� ��v8x=���Dr�y{h~uor~kth~noh~y{h�pGrLi�y|pby{kbi ����������������������������������������� # ###�!5��&% � kqr~r�� ��v8x{�\k��#nDkbiziQvG�-uwvi�y|l�v8nw�#h~yzh~v8nwi ��������������������������������������������� # ###�!5��!) ¡ �\v8x{k�h�n#yzkqr~r�h~¤Bk}n#y�uDxzvvG��v8¦Dr~h�¤pGyzh~v8n�¤Bk}nDkqx|pby{v8x ��������������������������������� # #

� � abc���d��1c � c! -/0 - � _#"$��]�_�-/0 � 2%o� � s�kb��Dh�x{kq�\k}n#y i ��������������������������������������������������������������������������� # )%o�! egfDkFeXx|p�%!l(��pGn&pG¤Bk}�\kqn�y $�oi�yzkq� h�n�� ������������������������������������������������� # )%o�!# egfDkFeXx|p�%!l(��pGn&pG¤Bk}�\kqn�y $�oi�yzkq� h�n!�(��� ��������������������������������������������� # 5%o�&% $uwkbl�h���lqpGyzh~vBn!h�i{i��okbi*��������������������������������������������������������������������� # 7

%D�&%o� � =�pbx{yzhjpGr����onwl�y{h�vBnwit�kqx i��wi��Dnw�#kqx&����kqy{kqxz�\h~n&pBl�������������������������������������� # 7%D�&%o�! '�i�k(vG��pb�C8#h�r~h�pGx{�F���Dnwl`y{h~v8nwi ����������������������������������������������������� # :%D�&%o�!# � fDk}n�i�fovB�Dr���yzfDk$i�y pGy{k$h~n��8pGx{h�pGn�ygfDv8rj�)( ��������������������������������������� # :%D�&%o�&% � 8�uDr~h�l�h~y�uDx{kbl`vBnw�#h�y{h�vBnwi ��������������������������������������������������������� # L%D�&%o�!) ¡��opGuDyzh~nD¤�y{fDk$i�u�k�l�h���l}pGy{h�vBn\��vBx AEBED F/G ����������������������������������������� # L

%o�!) = xzvvG��vB¦or~h~¤ pGyzh~vBn&i������������������������������������������������������������������������ % @%D�!)�� � J�pbrjl��Dr�pGyzh~nD¤�y{fDk(��kbpG¨kbi�yguDxzkbl�v8nw�#h~yzh~v8n ����������������������������������������� % @

Page 6: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

��� � ��� � �� h~h�h

%D�!)��! �(�©� uDxzvvG��v8¦Dr~h�¤pby{h~v8nwi ��������������������������������������������������������� % #%o�!5 �Qk}x{h���lqpGyzh~vBn hji{i��DkbiI����������������������������������������������������������������������� %/7

%D�!5�� � eXx{kbpby{�\k}n#y�vG�-uwpGxzy{hjpbr%���onwl�y{h�vBnwi ������������������������������������������������� %/7%D�!5��! e��#uwk��Ilmfokblm¨�h~no¤ ������������������������������������������������������������������� % L%D�!5��!# ¡=�oy{vB��pGy{k��\�#hjizlmf&pGx{¤8k(vG����kqr~r�� ��v8x{�\kb��nDkbi{i�uDxzvvG��v8¦Dr~h�¤pby{h~v8nwi ������������������� % L%D�!5��&% � kbpG¨k�i�ytuDxzkbl�vBn&�#h~yzh~vBn ����������������������������������������������������������� ) @%D�!5��!) =�pbuwkqx � � � uwkqnwl`h~rX�oi��!p8lmfoh~nDk��IpBizi�h�i�y{k�� uDxzvvG�Ii ����������������������������������� ) @

2 �3-�]q]qc! - � aGc � ]90��j_q_�-�a 2 �)�� � s�kb��Dh�x{kq�\k}n#y i ��������������������������������������������������������������������������� ) �)��! egfDkFeXx|pbnwi��\h�y{yzkqx�h~n���������������������������������������������������������������������� ) )��!# egfDkFeXx|pbnwi��\h�y{yzkqx�h~n!�(��� ������������������������������������������������������������� ) #)��&% $uwkbl�h���lqpGyzh~vBn!h�i{i��okbi*��������������������������������������������������������������������� )�%

)#�&%o� � egfDk$x{v8r~k�vb��i�uwkbl�h���lqpby{h~v8n;l�vB�\uwv8nDkqn�y|i ����������������������������������������� )�%)#�&%o�! egfDk$x{v8r~k�vb��uDx{k�l�vBnw��h~y{h�vBnwi ������������������������������������������������������� ) ))#�&%o�!# $y pGyzh~nD¤�¦wkqfwpq�#h�vB�Dx pGrXuDxzvBuwkqxzy{h~k�i ������������������������������������������������� ) ))#�&%o�&% ¡��opGuDyzh~nD¤�y{fDk(�(�©� i�u�k�l�h���l}pGy{h�vBn\��vBx AEBED F/G ����������������������������������� ) 5

)��!) = xzvvG��vB¦or~h~¤ pGyzh~vBn&i������������������������������������������������������������������������ ) 7)#�!)�� � � kqr~r�� ��v8x{�\k��#nDkbizi ����������������������������������������������������������������� ) 7)#�!)��! $�pby{h�i'��pb¦Dh~r�h~y��K��������������������������������������������������������������������� ) 7)#�!)��!# ��pGr�hj�Dpby{h�vBn!vG��yzfDk(uDx{v8y{v�l�v8r����������������������������������������������������� 5 @

)��!5 �'n&�#�wl�yzh~�k�uDxzvBuwkqxzy{h~k�igvG� i�uwkbl�h���lqpGyzh~v8nwi ������������������������������������������������� 5 �)#�!5�� � stkbpBi�vBnDh�nD¤ pG¦wvB�Dy©¦�k}fwpq�#h�vB�Dx ��������������������������������������������������� 5 �)#�!5��! egfDk�i�uwkbl�h���lqpby{h~v8n!x{kq��hji�h~y{k�� ����������������������������������������������������� 5 )#�!5��!# $y pGyzk6h~n��8pGxzhjpGn�yg�oith~nw�#�&l�y{h��k=uDxzvBuwkqxzy{h~k�i ��������������������������������������� 5 #

� � -�� - � � - � d�� �1c � c -/0�- � _#" ��]`_�-H0 ���

5�� � s�kb��Dh�x{kq�\k}n#y i ��������������������������������������������������������������������������� 5�%5#� � � � ��v8y{h~�8pby{h~v8nI����������������������������������������������������������������������� 5�%5#� � �! eXkqx{� h~nDv8r~vB¤8�K��������������������������������������������������������������������� 5�%5#� � �!# £D�Dnwl`y{h~v8nwpGrXxzkb��Dh~xzkq�\kqn�y|i ������������������������������������������������������� 5 )

5��! egfDkF�=k}u�k}nw�#kqnwl`�\��pbnwpG¤8kq�\kqn�y $�oi�yzkq��h�n � ������������������������������������������� 5 55#�! �� � ��pby|p¥� v��#kqr ��������������������������������������������������������������������� 5 55#�! ��! ���Dkqxz�#h�nD¤Fy{fok6i�y|pby{k ������������������������������������������������������������� 5 7

Page 7: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

h~� �������������

5#�! ��!# $y pGyzk���l|fwpbnD¤Bh�nD¤¥v8uwkqx|pby{h~v8nwi ����������������������������������������������������� 5 :5#�! ��&% ��pGr�hj�Dpby{h�vBn ����������������������������������������������������������������������� 5 :

5��!# egfDkF�=k}u�k}nw�#kqnwl`�\��pbnwpG¤8kq�\kqn�y $�oi�yzkq��h�n � ��� ������������������������������������� 5 L5#�!#�� � egfDk��DpGy p � v��#kqr������������������������������������������������������������������ 5 L5#�!#��! ���Dkqxz�\vBuwkqx pGyzh~vBn&i ��������������������������������������������������������������� 7 @5#�!#��!# $y pGyzk���l|fwpbnD¤Bh�nD¤¥v8uwkqx|pby{h~v8nwi ����������������������������������������������������� 7 �5#�!#��&% ��pGr�hj�Dpby{h�vBnwi ��������������������������������������������������������������������� 7

5��&% $uwkbl�h���lqpGyzh~vBn ��i{i��Dkbi ��������������������������������������������������������������������� 7 5#�&%o� � �=k�i�h~¤8n��#k�l�hji�h~vBn&ig�!pB�#k©h~n;p6x{kb��Dh�x{kq�\k}n#y i�i�uwkbl�h���lqpby{h~v8n ����������������������� 7 5#�&%o�! '�y{fokqx��#h ��kqxzkqnwl�k�ig¦�k}y���kqkqn\yzfDk(y��gv�i�uwkbl`h���lqpby{h�vBnwi3����������������������������� 7 #5#�&%o�!# ��pGr�hj�Dpby{h�vBnwi ��������������������������������������������������������������������� 7�%

5��!) $�Di�y{kq� �'n�y{k}¤Bx|pby{h�vBn ��������������������������������������������������������������������� 7�%5#�!)�� � ¡=r�¤Bv8x{h~yzfD� i�u�k�l�h���l}pGy{h�vBn!h~n!�(�©��� $/;4������������������������������������������� 7�%5#�!)��! ¡��o�#h~nD¤F���Dr�y{h~uor~k��#kquwkqn&�#kqnwl�h�kbi ������������������������������������������������� 7 )5#�!)��!# J�fDk�lm¨�h~nD¤F�tfokqy{fDk}x�pF�#kquwkqnw�#k}nwl��!lqpbn!¦�k�pB�D��kb�*������������������������������� 7 75#�!)��&% stkq�\vb��h~nD¤�pGr~rL�#kquwkqnw��kqnwl��\v8n�v8y{fDkqxtnov��#kbi ������������������������������������� 7 7

5��!5 $uwkbl�h���lqpGyzh~vBn;pbnw� �kqxzh���l}pGy{h�vBn\h�i{i��Dkbi4��������������������������������������������������� 7 :5#�!5�� � ¡=r�¤Bv8x{h~yzfD� i�u�k�l�h���l}pGy{h�vBn;pGn&� �kqxzh���lqpby{h�vBn���������������������������������������� 7 :5#�!5��! $�oi�yzkq��h�n#yzkq¤Bx pGy{h�vBn ������������������������������������������������������������� 7 :

� Z " ��0 ��.�-���abcC0�0 coa ���

7 � � s�kb��Dh�x{kq�\k}n#y i ��������������������������������������������������������������������������� : @7 �! egfDk���x|pb�\�!pbxQh�n�� ��������������������������������������������������������������������� : �7 �!# egfDk���x|pb�\�!pbxQh�n!�(��� ����������������������������������������������������������������� : 7 �&% $uwkbl�h���lqpGyzh~vBn!h�i{i��okbi*��������������������������������������������������������������������� : #

7�&%o� � =�x{k��#hjlqpby{kbitp8i=i�kqy|ig�oi � vvBr~k�pGn!���8pGr~�okb�¥���Dnwl�yzh~vBn&i ������������������������������� : #7�&%o�! £Dx{k}k�y���uwkbig�Dig���Dyz�wpGr�x{kbl��ox|i�h�vBn ������������������������������������������������� : #7�&%o�!# =�pby{yzkqx{nwi�pGn&���#k��&nDh~yzh~vBn ¦#�!l}pBi�k�i ����������������������������������������������� :�%

7 �!) �Qk}x{h���lqpGyzh~vBn hji{i��DkbiI����������������������������������������������������������������������� :�%7�!)�� � stkbpBi�vBnDh�nD¤ pG¦wvB�Dy©x{kbl��ox|i�h��k=y���uwk6��k��wnDh�y{h~v8nwi ����������������������������������� :�%7�!)��! $�pby{h�i'��pb¦Dh~r�h~y��¥vb��x{k�l��Dx|i�h~�k�y��#uwk$�#k��wnoh~y{h�vBnwi ������������������������������������� : )7�!)��!# '�y{fokqxtx{kbl`�Dx|i�h~�k(�#k`�wnDh~yzh~v8nwi ����������������������������������������������������� : )7�!)��&% �=k`�wnDh~yzh~v8n ¦��!lqp8i�kbi6������������������������������������������������������������� : 5

Page 8: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

��� � ��� � �� �

7�!)��!) $�pby{h�i'��pb¦Dh~r�h~y��¥vb��h~n��8pGxzhjpGn�y|i ����������������������������������������������������� : 5

� ��� � d .���]9�1� � ]�c � �����^aq_���-#a�� �wa�� ���

:�� � � pBi�h�l��!pGyzfDkq�!pby{hjl}pGrDnDv8y|pby{h~v8n ����������������������������������������������������������� : ::��! '�i�k(vG�QpFl�vBxzk�yzfDkqv8x{� ��������������������������������������������������������������������� : L:��!# '=nw�#kqxzr~��h~nD¤$r~v8¤Bhjl ������������������������������������������������������������������������� : L:��&% '�i�k(vG� x{kbl��ox|i�h�vBn3������������������������������������������������������������������������� : L:��!) � pBi�h�l(i�uwkbl�h���lqpGyzh~v8n novBy|pby{h�vBn ����������������������������������������������������������� L @:��!5 s�v8r~kbigvb��i�uwkbl�h���lqpby{h~v8n;l�vB�\uwv8nDkqn�y|i3����������������������������������������������������� L @:�� 7 ¡�i{i�kqx{yzh~vBn&igh~n;i�uwkbl�h���lqpby{h~v8nwi ������������������������������������������������������������� L/�:��!: = xzvvG��vB¦or~h~¤ pGyzh~vBn&i������������������������������������������������������������������������ L/�:�� L $uwkbl�h���lqpGyzh~vBn;�#k�l�hji�h~vBn&itp ��kbl�ytyzfDk(�kqx{h���lqpGyzh~v8n\y|p8i�¨ ����������������������������������� L :�� ��@ ¡=�Dy{v8�!pGyzkb�\pbnwpGr��Di�hjity{kbl|fDnDh��¢�Dk�i ������������������������������������������������������� L

Z , a������ �w[�.�� wc#_��1� � ]�� �wa� � � �

� [�.��1�� waGc � ��� �

Page 9: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY
Page 10: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� � ��� ����� �

� ����� � � � �� ���

����� ���������������! #"

� fDkqn�i�vG��y���pGx{k��¢�wpbr~h�y��;hji(uwpGx pG�\v8�Dn#y}����vBx6k�8Dpb�\uDr~k$h~n�l`x{h~yzhjlqpbr�vBx(r�h���k���y{fDxzkbpGyzkqnDh�nD¤;i�h~yz�wpGyzh~v8nwi���h~y(hjih~�\uwvBxzy|pbn#y(y{f&pGy�pGr�rguwvizi�h�¦Dr~k;lqpbx{k\¦wk\y pG¨kqn�yzv�kqnwi��Dx{k\yzfwpGy�i�vG��y��tpbx{k\¦wkqf&p��k�i6l�v8x{x{k�l�y{r����¡�l�r�kbpGxzr~��#k��wnDk����#��kqr~r�� �Dn&�#kqx|i�y{vv��;�#kq�kqr�vBuD�\k}n#y�uox{v�l�kbizi�vb��xzkb��Dh~xzkq�\kqn�y|i�pbnwpGr��Di�hji`�wi�uwkbl�h���lqpGyzh~v8nX�w�#kbi�h~¤BnL�Dh~�#�uDr~kq� kqn#y pGyzh~vBn§pGnw�)y{kbi�y{h~no¤�hji��th��#kqr~�;x{kq¤ pGx �#kb��p8i6p nokbl�kbizi{pGxz��uDx{k}x{kb��Dhji�h~yzk6��vBx(y{fDk �#kq�k}r~vBuo�\kqn�y=vb�y{x{�&i�y{k���i�vb��y���pGxzk�)£&v8x{�!pbr%$ �!pby{fDkq��pGy{h�lqpGr�r�� ¦&pBi�k��'&(�\kqyzfDv��Di�vb�©i�vb��y���pGxzk k}nD¤Bh�nDkqkqxzh~nD¤!�wi�k uox{kbl�h�i�k��DnwpG��¦Dh�¤B�Dv8�wiFi�uwkbl�h���lqpby{h~v8nwi6h~n �#h ��kqxzkqn#yFu&pGx{y i6vG�(yzfDk!�#k}�kqr~v8uD�\kqn�y�uDxzv�l�kbi{iF�tfDh�lmfX��yzvB¤8kqy{fDk}xF�th~y{f�!pGyzfDkq�!pby{hjl}pGrDuDxzvvG�Ii=vb��l�v8x{x{k�l�y{nDk�i{i��wp8�D��pFfDh�¤Bf;�#kq¤8x{kqk(vG� x{h~¤8vB�Dx�y{v�y{fok�uox{v�l�kbizi=pbnw� ¤8h~�k$p��#kq¤BxzkqkvG� pBi{i��Dx|pbnwl�k�i�h~¤Bnoh���lqpbn#yzr~� �#h ��kqxzkqn�ygy{v�y{f&pGyt�tfDh�lmf;l�v8�Drj�\¦wk(uDx{vb��hj�#kb�\¦��\y{k�i�y{h�nD¤�pGr�vBnDk �£&v8x{�!pbrw�\kqy{fov��Di�pGx{k©h~nwl�xzkbpBi�h~nD¤8r~�F¦wkqh�nD¤6�wi�kb�¥h�n\h~nw���wi�yzx{hjpbr�i�kqyzy{h~no¤igvBn x{kbpbr ��r~h���k �Brjpbx{¤Bk ��izlqpGr�k(pGuDuor~hjl}p �y{h~v8nwi���¡ xzkbl�kqn�y�i��Dxz�kq�¥vb��y���kqr~�kth�nw�#�wi�y{x{h�pGr�pbuDuDr~h�lqpGyzh~v8nwiQvb�^��v8x{�!pbr��\kqyzfDv��Di�h~n)(=vBxzy{f!¡��\kqx{h�lqp�pbnw�� �ox{vBuwk+* J �©s L #-,�� $kbl�yzh~vBn ��@ �!#.$ uouX� 5 7 � 5 L &g��v8�Dnw�0/

1 egfDk$uDx{h��!pGxz�F�wi�k�i�vb�^��v8x{�!pbr��\kqyzfDv��Digh�n yzfDk$lqpBi�kbiti�yz�w�#h�kb�!pGx{k2/Z\]q]9��abc � d -'3 stkb��Dh~xzh~nD¤�p6fDh�¤Bf§�#kq¤Bxzkqk(vG��l`vBn#����kqnwl�k(h~n;i��Di�y{kq�!i��th~yzf�pG�&�#h~y pG¦Dr�k�h�n#��vBx&�

�!pby{h~v8nX��� 8�uDr~h�l�h~y�y|pbx{¤Bk}y|itvG�-r~vb�Kv8x54}kqx{vFkqxzx{v8xtx|pGyzk�Z � cC. ��]�� ].6 ��� � � 0�cC� �87 3 � fokqx{k(��vBx{��pGr��\kqy{fov��Di=pbx{k$�wi�kb��yzv¥���Dxzy{fDkqx��Dnw��kqx|i�y|pGn&�#h~nD¤

vG� y{fDk$�#v8�!pGh�n vb��h~n�y{k}x{kbi�y9$ ��v8x=k�8Dpb�\uDr~k �#l`vB�\uD�oy{kqx�i�kbl��ox{h~y��!p8i=pbuDuDr�h~kb�\y{v l�v8�\�¥� �nDh�lqpGyzh~vBn!nDk}y���vBxz¨Di:&|�

��� 0 0 � � ��dc#_��1� � 3 � fDkqxzk\l`vB�\���DnDh�lqpGyzh~vBn;¦wkqy��gkqkqn i��oi�y{k}� i�y|pb¨kqfDv8rj�#kqx i�h�i�y{fok\uDx{h���!pbx{�FnDkqk���� ��n\y{fDh�iQ�wi�k(vG����vBx{��pGrw�\kqyzfDv��DiQyzfDkqxzk�hji`�#uwkqx{f&pGuwi`�DnDvBy�p8ig�¥�wl|fF�!pby{fDk���!pby{hjl}pGr8pGnwpbr~�oi�h�i��b¦D�DyXy{fokQxzkquDr�pBl�kq� kqn#yovG�oh~n#��v8x{�!pbrBnDv8y|pGyzh~v8nwi%�th�y{f���vBxz�!pGrbnDv8y|pby{h~v8nwi��

;5<��1� - � d - ���©[ -�]�_ �^abcDdB_���d -=3 � fDkqxzk$pFl�vB�\uwkqyzh~yzh~�ktkb�#¤8k(hjigp8lq��Dh~xzkb�¥vBx��tfDkqxzk�Dp8igh~n1 ¡©i{i��ox|pGn&l�k�>�pG¦wvb�k�#��vBxz�!pGr��\kqy{fov��DitpGxzk���h~k}�gkb�\p8i=p6nokbl�kbizi{pGxz�!lqpbuwpG¦Dh�r~h�y�� �

? -A@ - � � � -/-#a�� � B3 � fokqx{k©p�uDxzv��#�wl�y�hji��Dnw��kqx{¤8vBh~no¤6r~v8nD¤���y{k}x{� �DuD¤Bx pB�#k�igpGn&�¥x{kb��Dh�x{h~no¤x{k�l�vb�kqx{��vG� i�yzx{�wl�yz�Dx{k(v8x=kqnofwpGnwl`kq�\kqn�y�vG�����Dnwl�yzh~vBnL�

���

Page 11: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

������� ��������� ����� �� ������������

¡�it�gvB�orj� ¦wk$k98#uwkbl`y{kb���Dnov\i�h~nD¤8r~k���v8x{�!pbr��\k}y{fDv��#$ ��h~kq��kb�\pBi©p nDv8y|pby{h~v8n)pGnw��p8lql�v8�\uwp �n#��h~no¤ yzkbl|fDnDhj��Dkbi:&gh�i(i���%�l�h~k}n#yzr~�!¤Bkqnokqx|pbrQyzv�l�vb�kqx pGr~r-vG��y{fok\i�h~¤Bnoh���lqpbn#y lmfwpbx|p8l�y{kqxzhji�y{hjl}ivG��yzfDk(pGuouDr~h�lqpGyzh~vBn&iQy{f&pGygyzfDkq��p8�D�#x{k�i{i���egfDkqxzk�pbx{k���pGn��6��vBx{��pGr~h�i��!iXy{v�lmfovvi�k���xzvB�VpGnw�l��Dxzx{kqn�y{r��¥�\v8x{k�y{fwpbn�v8nDk6���wi�y�¦wk��&i�kb�\y{v l�vb�kqx�pGr~r�l|fwpbx|pBl`y{kqxzhji�yzhjlqi`� >

egfDhji�e%k�lmfDnohjlqpbrXstkquwvBx{y�i�y|pbx{y|i�y{vFrjpq�\yzfDk6¤8x{v8�Dnw�#��vBx{¨\��v8x=yzfDk(h~n�y{kq¤8x|pGyzh~v8n vb��y{fok6l}pGuwpb¦Dh~r�h~y{h�kbiQvb��y��gvvG�tyzfDk��\vi�y��thj�#k}r~� � �wi�kb� ��vBxz�!pGr-�\kqy{fov��Di�vG��i�vG��y��tpbx{k �#kq�kqr�vBuD� kqn#y /=� *���pq�C: 7� $ uDh : :D� $uDh : L ,�pbnw��(��� *��BvBn : 5D����� ;X� LH� � � £ ;�� L %A,I���(��� h�i�l��Dxzx{kqn�y{r��!�Dnw�#kqxz¤Bv8h~nD¤!i�y|pbnw�DpGx �#h 4�pGy{h�vBn)�Dnw�#k}x�y{fDk�pb�wi �uDhjl�k�igvG��yzfDk � x{h~yzhji�f $ y|pGn&�DpGx �Di ��nwi�yzh~yz�Dy{k�$ � $ � & * � xzh L #�,��t��h�i=l`�Dx{xzkqn#yzr~���Dnw�#k}x{¤Bv8h~nD¤ i�y pGnw�opGx|��h 4bpby{h~v8npBituwpGxzy=vb��yzfDkF� � =�uDx{v��kbl�y * � ( L ,��¡=r~yzfDvB�D¤8f!l�r�kbpGxzr~�6foh~¤Bfor~�Fh~n��w�Dkqn�y{h�pGrwvBn\v8nDk(pbnDvByzfDkqxq�w�;pGnw���(��� �gk}x{k©�#kq�kqr�vBuwkb�F¦#��i�kquwpGx pGyzk(l�vB� ��¥�Dnoh~y{h�kbi��w�th~yzf���h ��kqx{k}n#y(l`vBnwl�k}x{nwi�h~n)�\h�nw�0/=� ���,�tpBi(h~n�y{kqn&�#kb��y{v;l�vb�kqx©y{fDk��tfDvBr�k\��kq�kqr~v8uD�\kqn�yr~h���k ��l��ol�r�k���tfDh�r~k!��rjpGxz¤Bkqr��)l�vBn&l�kqn�y{x|pby{kb��vBn�yzfDk\i�uwkbl�h���lqpGyzh~vBn�uDfwpBi�k;pGr~v8nDk�)(=kq�kqxzy{fDk}r~kbizi���yzfDk\y��gv�\kqy{fov��Di�fwpq�k p�r~v8y6h~n l�vB�\� vBnX�X¦wvByzf ¦wkqh�nD¤��\v��#k}r ��vBx{h�kqn�y{kb���\k}y{fDv��Di(h~n��tfohjl|f�pG¦wi�y{x pBl�yF�!pby{fDk ��!pGyzhjlqpbrX�\v��#kqr�igvG��i�vb��y���pGxzk�i��oi�y{k}�!itpGxzk��#k��wnDk���pGn&� xzkbpBi�vBnDkb��pb¦wvB�Dy}�(egfDhji=yzkbl|fDnDhjl}pGrXx{k}u�v8x{y�h�i=¦��nDv!�\kbpGn&i�yzfDk6�wx|i�y(y{v;l�vB� uwpGxzk6y{fokFy���v!�\kqy{fov��Di��$¡ x{kbl`kqn#y�uwpbu�k}x�¦����©p��k�i����BvBnDkbi(pbnw�!(�hjl|fDvBr�rji��*����A( L # ,�v ��kqx i�pbnN�onw�#kqx i�y|pbnw�#h�nD¤!vG� 1 y{fDkFh�n#yzkqx{k�i�y{h�nD¤!�#h���kqx{kqn&l�kbi >F¦wkqy��gkqk}n�y{fDkF�(�©� pbnw����i�uwkbl �h���lqpby{h�vBn�rjpbnD¤B�wpb¤BkbiFh~n p�r~h��kqr~��XxzkbpB�Dpb¦Dr~k\��v8x{� pbnw� h�i6�gkqr�rQxzkbl�v8�\�\kqnw��kb��y{v)x{kbp8�#kqx i��gfDvb��kq�kqxq��h�yx{kbi�y{x{h�l�y|i�h~y|i�kqr�� y{v!k98�uDx{kbizi�h�¦Dh~r�h~y��\vG��i�u�k�l�h���l}pGy{h�vBnwi(pbnw� v8nDr~�;r~h�¤Bf�y{r~�!yzvB�wl|fDkbi=v8nN�k}x{h���lqpGyzh~vBnL�6��pGxzr~h�kqxl�vB�\u&pGx{h�i�v8nwi6vG�©�(��� pGnw��� * � $ LH� ����pq� L ,�i�h~�\h�rjpGxzr~�!��v�l��wiF�!pGh�nDr~��v8n nDv8y|pGyzh~v8nwpGr�vBx�i�y{x{�&l�y{�Dx pGr�#h ��kqxzkqnwl�kbig¦wkqy���kqkqn!y{fDk$y��gvF�\kqyzfDv��Di`�tegfDhjitx{k}u�v8x{y�fDvb�gkq�k}xg��v�l��wi�k�i�v8n��kqx{h���lqpGyzh~v8n\y{kbl|fDnDh��¢�okbiQ��vBxi�uwkbl�h���lqpGyzh~v8nwi��

��� � ! �#"%$'& �("%$ ��

egfDhjiteXkbl|fDnDhjl}pGrwstkquwvBxzytuDx{kbi�kqn�y|igpFi�kqx{h�kbiQvb��l}pBi�k i�y{�&�#h~kbigh�n\y{fok��!pGyzfDkq�!pby{h�lqpGr��kqx{h���lqpby{h~v8n¥vb�^��v8x{�!pbri�uwkbl�h���lqpGyzh~v8nwi¥vG� i�kb��Dkqn�y{h�pGr©i�vb��y���pGxzk)i��oi�y{k}�!i��1egfDk)l}pBi�k�i�yz�w�#h�kbi\pGxzk�uwpGxzy!vG��p�uDx{v)��k�l�y\kqn�y{h�y{r~k��1 ��n#yzkq¤Bx pGyzh~vBn vG�$�3pGn&� �(��� >��tfohjl|f pbh~�!i(y{v�l�vB��¦Dh�nDk\y{fok h�nw�#h��#h��#�wpGr�i�yzx{kqnD¤8y{fwiFvG����pbnw� �(���pGnw� yzv�uDx{vb��hj�#k§p�i�k}�!pGn�y{h�l ��x pG�\k}�gvBxz¨��th~yzfDh~n �tfDhjl|f yzfDkq� lqpbn�vBuwkqx|pby{k�1egfok�vG�k}x|pGr�rt¤Bv pGr�h�i¥y{v�#kq�kqr�vBu$p=i�y{xzvBnD¤8kqx�pGn&�6i�h��\uDr�kqx��\k}y{fDv���vG��i�vG��y���pGx{k�i�uwkbl�h���lqpby{h~v8nX�bfwpq�#h�nD¤�pt¦DxzvpB��kqx�pGxzx|pq�(vG��pbnwpGr��Di�hjiy{kbl|fDnDh��¢�Dk�i��Xpbnw�N��vBx(�tfDhjl|f)uDx{vvb�IiFlqpGn�¦wk!l|fDkbl|¨kb�!¦#���!p8lmfoh~nDk� J�p8i�k!i�y{�w�#h�kbi�uDrjpq�)p!�#h�y|pGr�xzvBr~k�h~ny{fDh�i=�gv8x{¨���¦wkqh~nD¤ �wi�kb��yzv!l�v8�\uwpGxzkFpbnw��l�vBn�y{x pBi�y ��pbnw���(�����wy{kbi�y�y{fokF¤BkqnDk}x|pGr�h~y��\vb�gyzfDk�i�k}�!pGn�y{h�l��x|pG� kq�gv8x{¨ pGnw�\�wnDk���y{�Dnok�yzfDk���vBxz�!pGr�hji��§�Bh~n;pB�o�#h~yzh~vBn!yzv¥yzfDkqh~x�x{v8r~k$pBit�\vByzh~�8pGyzh~nD¤$k98opG�\uDr�kbi��egfDk6�wx|i�y$i�y|pb¤Bk�vG��y{fDkFuDxzv)��kbl�y©fwpBi�¦wkqkqn)l�v8nwl�kqxznDkb���th�y{f)l�xzkbpGyzh~nD¤!p!l�v8�\uwkqnw�#h��D��vb��i�uwkbl`h���lqpby{h�vBnwikquDh~yzvB�\h 4qh~no¤¥yzfDk!l�v8�\uwpGx pGyzh~�k�i�yzx{kqno¤By{f&iFpGnw�N��kbpG¨�nDkbizi�kbi(vG��yzfDk\y��gv;�\kqy{fov��Di����th~y{f)y{fok\kq�\uDf&pBi�h�ivBn i�kq��pGn�y{hjl6k�8#uDxzkbi{i�h~¦Dh�r~h�y�� ��pbnwpGr��Di�hji6y{k�lmfDnohj��Dkbi���pbnw��kbpBi�k\vG���kqxzh���l}pGy{h�vBnX� � kqr~r�� ¨�nDvb�tnX� 1 y��#uDh�lqpGr >pGuDuDr�hjlqpby{h�vBnwigvb��kbpBl|f!�\kqyzfDv��\�gkqxzk�xzk��Ii�uwkbl�h��wkb�\h~n!y{fok6i�y��#r�k6pbnw� novBy|pby{h�vBn�vb��y{fok�v8y{fDk}x=�\k}y{fDv��*��y{fDkuD�Dx{uwv i�k�fovG��kq�kqxF��pBiFy{v�l�vB�\u&pGx{k y{fDk!kbp8i�k�pbnw� ��kq¤Bxzkqk!vG�(nwpby{�Dx pGr�nDkbi{iF�th~yzf��tfDhjl|f�y{fDk;�\kqy{fov��Dik98#uox{kbiziFi�uwkbl�h���lqpGyzh~v8nwiFpGnw� i��Duou�v8x{y\xzkbpBi�vBnDh�nD¤�pG¦wvB�Dy y{fDv i�k�i�uwkbl�h���lqpGyzh~vBn&i���x|pGyzfDkqxFyzfwpGn i�h~� uDr~�)y{vy{x|pbnwi�r�pGyzk�v8nDk6novBy|pby{h�vBn�h�n#yzvFy{fDk(v8y{fDkqx}�£&xzvB�/yzfDk�k98�uwkqx{h�kqnwl�k�y{f��wiQ¤ pGh~nokb���¢�&�ktuDx{v8y{vBy���uDhjl}pGrwk98opG�\uDr�k�lqpBi�k�i�y{�w��h~kbi��gkqxzk�l|fDvi�kqnF��vBxgh�nwl�r��wi�h�vBnh~n!y{fDh�ig�#v�l`�D�\kqn�yq�-egfDk$lqpBi�k6i�y{�w��h~kbig��kqx{k(i�y{xzh~uDuwkb�!�#vb�tn!y{vFyzfDkqh~xtk�i{i�k}n#yzhjpGrLl�vBxzkbiQh�n!vBx|��kqxty{vF¦wkqyzy{kqxfDh~¤8fDr~h�¤Bf�ygy{fok��!pGh�n¥uwv8h~n�y|itpGn&��yzvF�!pG¨ktyzfDkq� �\vBxzk=��pGnwpb¤Bkbpb¦Dr~k��¡©iQ�th~r�rw¦�k$i�kqkqnX��y{fDk�xzkbi��or~ygh�igi�y{h~r�r�kqx{��rjpbx{¤Bk +�¦D�DytyzfDhjigh�igy��#uDh�lqpGr�vG��yzfDk(nwpGyz�Dx{k(vb��i�vb��y���pGxzk��k}x{h���lqpGyzh~vBnL�

Page 12: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

�)�� ������ #����� ���%�����

egfDhji=yzkbl|fDnDhjl}pGrXx{k}u�v8x{y�r�h~�\h�y|i�h~y|i�kqr�� y{v!l�v8�\uwpbx{h~no¤ �)pbnw���(��� i�i��ouDuwvBx{y���v8x��kqx{h���lqpby{h~v8n!vG��i�uwkbl�h����lqpGyzh~vBn&i�� � fDkqyzfDkqx�y{fDk(i�uwkbl�h���lqpGyzh~vBn&iQh~n��¢�Dk�i�y{h�vBn!pbx{k�yzvBu!��r~k}�kqrD���Dnwl�yzh~vBn&pGr�i�uwkbl�h���lqpby{h~v8nwigvBx�r~vb����r~kq�kqr�#kbi�h�¤Bn§i�uwkbl�h���lqpGyzh~v8nwi=hjitnDv8y=uwpbx{yzhjl��Dr�pGxzr~�!h~�\uwv8x{y|pbn#y}�wi�h�nwl�k(y{fDk$y{kbl|fDnDh��¢�okbit�#kbizl�x{h�¦�k���pGxzkFpbuDuDr~h�lqpG¦or~kpGy�pGr�rDr~kq�k}rji�� ��nFuDx pBl�yzhjl�k�8fDvb�gkq�kqx}�By{fokt�\vi�yQk ��k�l�y{h��kQ�&i�k�vG�XyzfDkbi�k=yzkblmfonDhj��DkbiXhji�r~h�¨kqr~�©y{v(¦wk=h�n¥kbpbx{r��i�y|pb¤Bkbi`�wi�h�nwl�k�kqxzx{v8x|igh~n�y{xzv��#�wl�k��¥y{fDk}n!pGxzk�vb��y{kqn y{fDk(�\v i�yt��h %�l��Dr~y�yzv��#kqy{k�l�y�pGnw�\y{fok�� vi�y�k98�u�k}nwi�h��ky{v�l�v8x{x{k�l�yq����pbn#��vG�-y{fDk(�kqxzh���l}pGy{h�vBn\yzkbl|fDnDhj��Dkbi��#h�i{l��&i{i�k���¦wkqr�vb� lqpbn!¦�k$pbuDuDr~h�kb�\y{vFuwpbx{yzhjpGrI�#h�nwl�vB� �uDr~kqyzk(i�uwkbl`h���lqpby{h�vBnwi`�wpGnw�;i�v pGx{k$�wi�k`���DrXy{vv8rjitkq�kqn\h�n�uDxzk���i�uwkbl�h���lqpGyzh~vBn!uDf&pBi�k�i=i��wlmf;p8i�xzkb�¢�oh~x{k}�\kqn�y|ipGnwpbr~�oi�hji �wi�v8�\k�vG� y{fDk(y{k�lmfDnohj��Dkbi�pGxzk6fDvb�gk}�kqxgv8nDr~�!pbuDuDr�hjlqpb¦Dr~k�yzv\l`vB�\uDr�kqy{k©i�uwkbl`h���lqpby{h�vBnwi`�e%v$p�r�pGxz¤Bk©�#kq¤Bxzkqk�Bh�i{i��Dkbi�vG�%i�uwkbl�h���lqpGyzh~v8n 1 h~n�y{fDktr�pGx{¤8k�>�f&p��kt¦wkqk}n¥h�¤BnDv8x{kb�6��vBx�nDvb� +�yzfDk��!pGh�n6hjizi��Dk¦�k}h~nD¤\yzv!l�v8�\uwpGxzk(y{fDk$�\kqy{fov��� i�i��Duou�v8x{y���vBx©�kqx{h���lqpGyzh~v8n�pby(p �wnok�� ¤8x|pbh~nDkb��r�kq�kqr �Dy{fDkqxzkFpbx{k6k}nDvB�D¤8fhji{i��Dkbi\y{v�¦wk)k98#uor~vBxzkb��pGy;y{fwpby!r~kq�kqr�¦wk���vBxzkNh�n#yzx{v��#�&l�h~nD¤�y{fDk)k98�y{x|p�l�v8�\uDr�k98#h�y��NyzfwpGy§l�vB�\k�i���xzvB�rjpGxz¤Bk��Ii{l}pGr~k©i�yzx{�wl`y{�Dxzh~nD¤o� � k�nDvByzk�h~n�uwp8i{i�h�nD¤Fy{f&pGyg� ��� fwp8igi��DuDuwvBxzyg��vBxgxzk��wnDk}�\kqn�y�$ ���wi�yzh���lqpby{h�vBn\vb�r~vb��� r�kq�kqr�i�u�k�l�h���l}pGy{h�vBnwi-pG¤pbh~nwi�yg�\v8x{k�pG¦wi�y{x|p8l�y�vBnDk�i &�pbnw����v8x�h~�\uDr�kq��kqny|pby{h~v8n�$ ��hjp�p �=v pGx{k � r�h~¨kgr�vB¤8hjlvG��uDxzvB¤Bx pG�Vl�vBxzx{kbl`y{nDkbizi & �¢yzfDkbi�k���kbpby{�Dxzkbigpbx{k©pGr�i�v��&nw�#h~no¤6y{fokqh~x��tpq�Fh�n#yzv�yzfDk(�!�\kqy{fov��6�#h�p���v8x{¤ pGn� is�k��&nDkq�\kqn�y J�pGr�l��Dr~�&i * ��vBx L @ ,��¡ xzkqrjpby{kb�!y{kbl|fDnDh�lqpGr�x{kquwv8x{y *&;�h~n L %B¦=,-�#hjizl��wizi�kbi�i�v8�\k(vG��yzfDk6nDk�l�kbi{izpGxz�\uDx{k}x{kb��Dhji�h~yzkbiQ��vBx�y{x pGnwi���kqx{xzh~nD¤�(���+�kqx{h���lqpGyzh~v8n\y{v\���

���� � &�� � & $����

J�fwpGuDyzkqx N¤8h~�kbi�pN¦Dxzh~k���i��D�\��pGx{��vG��i�uwkbl�h���lqpby{h~v8n�pbnw� �kqx{h���lqpby{h~v8n yzkblmfonDhj��Dkbi6h�n �(��� pGnw� ���pGnw� l�vB�\u&pGx{k�i�y{fokqh~xF�!pby{fDk}�!pGyzhjlqpbr�nDvBy pGyzh~vBn&i���egfDk;lqp8i�k;i�yz�w�#h�kbi¥pbx{k!uDxzkbi�kqn�y{k��Nh~n J�fwpbuDy{kqx i #��C7 �J�fwpGuDyzkqx :F�#kbi{l`x{h~¦wkbigv8�Dx©l�vBnwl`r~�wi�h~vBn&i��egfDk$lqpBi�k6i�y{�w��h~kbi�pGxzkA/ � aq_����^c�� ����� 3,pF�kqxz�!i�h��\uDr~k lqpBi�kFi�yz�w�#�;i�fovG�th�nD¤\yzfDk(kbi{i�kqn#yzhjpbr�i�h~� h~rjpbx{h�y��Fvb��y{fok¥�)pbnw���(���

pGuDuox{vp8lmfokbi�yzv�i��oi�yzkq� i�uwkbl`h���lqpby{h�vBnX�

� abc���d � c � c! -/0�- � _�"$��]�_�-/0 3 p�i��oi�yzkq���th~yzf;pFi{p���k}y�� �Il�x{h�y{hjl}pGr�xzkb��Dh~xzkq�\kqny}�

� -�]q]qc - � abc � ]90�� _}_�-#aA3+k98�uDr~v8x{h�nD¤Fy{fDk©¨#h�nw�\vG�-h~nw�#�&l�y{h��k=xzkbpBi�vBnDh�nD¤¥�tfohjl|f\hjigxzkb�¢�oh~x{k��¥�tfDkqn!�kqx&�h�����h~nD¤$¦wkqfwpq�#h�vB�Dx�vG� i�vb��y��tpGxzk$i��oi�y{k}�!i��

� -�� - � ��- � d�� �1c � c! -H0�- � _#"$��]�_�-/0 3 k98#uor~vBxzh~nD¤�y{fokth~n�y{kq¤8x|pGyzh~v8n6vG�Lp���v8x{�!pbr~r���i�u�k�l�h��wk����\v��#�or~kh~n�y{v�p6r�pGx{¤8kqx©i��oi�y{k}���

Z " ��0 ��.�- �!abcC0�0�cDaA3 p8�D�#xzkbi{i�h~nD¤$rjpGno¤B�wpb¤Bk�uDx{v�l�k�i{i�h�nD¤6xzkb��Dh~xzkq�\kqn�y|iXi��wlmf�p8iQyzfDk=xzkquDxzkbi�kqn�y|pby{h�vBnvG� pG¦wi�y{x pBl�y©i���n#y p�8!pbnw� yzfDk$�#k��wnoh~y{h�vBn!vG�Qi���n#y p�8 � xzkqrjpby{kb� ���onwl�y{h�vBnwi`�

�Qp8lmf;lqp8i�k$i�yz�w�#�!hjiti�y{xz�wl�y{�ox{kb�!pBig��vBr�r~vb��i /? -�������a�-/0�- � _b] 3 ¡�¦Dx{h�k��z�bh~n#��v8x{�!pbr�#h�i{l��wizi�h�vBnFvG��yzfDkQ���Dn&l�y{h�vBnwpbr~h~y���vb��y{fDk�x{kb��Dh~xzkb�(i�vb��y���pGxzk�i��oi�y{k}�

$ 1 y{fDk$pGuouDr~h�lqpGyzh~vBn > &|�Dh�nwl�r��w�#h~no¤�pGn��\y{xz�wi�yzkb�\uDx{v8u�k}x{y{h�kbi��

Page 13: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

% ������� ��������� ����� �� ������������

����a�0�cC.�] � -#d ����dc�_���� � ]-3 £DvBx(kbpBl|f�pGuDuDr�hjlqpby{h�vBnX��p!i�uwkbl�h���lqpby{h~v8nNh�i=¤Bh��kqn)h~n���pbnw��h~n)�(�����XegfDki���n#y p�8�vb� * $uDh : L ,ghji��wi�kb� ��v8x¥��pbnw�Nvb� * ��pq� LH� ,���v8x6�(������egfDk!� i�uwkbl`h���lqpby{h�vBnwi��gk}x{k�y���uwk��lmfokblm¨k�� �wi�h~nD¤�� B���� * $ uDh ,��

" � -�d ���-dc#_��1� � ��]q]9��-�]-3 �=hjizl��wizi�h~v8n\vG�Lhjizi��Dkbi��tfDhjl|f�pGxzhji�k=��x{v8�/y{fDk©lqpBi�k(i�yz�w�#h�kbi�l�vBnwl`kqx{nDh�nD¤$i�uwkbl�h����lqpGyzh~v8nX�h~nwl�r��w�#h�nD¤=� kqy{fDv���vBr~v8¤Bh�lqpGrwpbnw�FnDvBy pGy{h�vBnwpbr�i��DuDuwv8x{ytl`�Dx{xzkqn#yzr~�(�\h�i{i�h�nD¤t��x{vB�/v8nDktvBx�¦wvByzf�\kqyzfDv��Di��

, a������ ��[�.1� wc#_��1� � ] 3,�=h�i{l��wizi�h�vBn)vG��y{fok¥�kqxzh���l}pGy{h�vBn�y pBi�¨��^�tfokqx{k�h~y(hji(�#k`�wnDkb�N¦���vBnok¥�\k}y{fDv���vBxy{fDk!v8y{fDkqx}�gvBxF�tfokqx{k;h~yFhjiFi��D¤B¤8kbi�yzkb� ¦���yzfDk!uwpGxzy{hjl`�Drjpbx\pbuDuDr~h�lqpGyzh~v8nX�Qh�nwl�r��w�#h~no¤��8pGr�hj�Dpby{h~v8n vb�uD�Dxzu�v8x{yzkb� uDxzvBuwkqxzy{h~k�igvG��yzfDk$pGuDuDr�hjlqpby{h�vBnX�£DvBx�kbpBl|f�vb�gyzfDk��&x|i�y©y{fDxzkqkFlqp8i�k�i�y{�&�#h~kbi`��yzfDk6� ���,i�uwkbl`h���lqpby{h�vBn��tp8i�k}n#yzkqx{kb�!h~n�y{v�y{fDk�ACBEDCFHG��vBxz�!pGr��#kq�k}r~vBuo�\kqn�y�i��DuDuwvBxzy¥kqn���h~x{v8nD�\kqn�y�*���� ;X� LH� , $�i�kqk $kbl`y{h~v8n� #� #� %�¦�k}r~vb�9&|�#(=v8yFpGr�rgvb��(��� h�iFl��Dx{xzkqn�y{r~�)i��DuDuwvBxzy{kb��¦#�IAEBCDCFHG���i�v�uwpGxzy|iFvG� i�vB� k\vG�©y{fDk �(��� i�uwkbl�h���lqpGyzh~v8nwi�fwp8�y{v\¦wkFfwpbnw����y{x pGnwi�rjpGyzkb�Nh�n#yzv\pbnNkb��Dh��Bpbr~kqn�yg��vBxz� ¦wk���v8x{kFuDxzvvG�tv8¦Dr~h�¤pby{h~v8nN¤8kqnDkqx pGyzh~vBn)l`vB�Dr���¦�klqpGxzx{h�kb� v8�Dyq�(£DvBx©y{fDkFxzkq�#h�i�kb�!i�u�k�l�h���l}pGy{h�vBnwi`��y{fokFuDx{vvb�gv8¦Dr~h�¤pby{h~v8nwi�¤Bkqnokqx|pby{kb��¦�� ACBED F/G��gk}x{k�#hjizlmf&pGx{¤8kb�6�wi�h~nD¤�yzfDk AEBCDCFHG;h~n�y{k}x|pBl`y{h~�k-uDx{vvb�-pBi{i�hji�y|pGn�yq� '�nDr~�$y{fDkt�\v8x{k�h~n�y{kqxzkbi�yzh~nD¤�uDx{vvb�Ii�pGx{k¤Bh��kqn!h~n�yzfDk6¦wv��#�;vG��kbp8lmf;l|fwpGuDyzkqxq��£D�Dr�rXy{x|pbnwi{l`x{h~uoy|i=vb��y{fDk$uDx{vvb�Ii(pGx{k$¤Bh��kqn!h~n�p l�vB�\u&pGnDh�vBnx{kquwv8x{y *��; L % ,��

��-#a�����dc�_���� � � ]q]�� -�]-3 �=h�i{l��wizi�h�vBn6vb��hji{i��DkbiX�tfDhjl|f$pGxzhji�k�h~n$y{fDk�l�vB�Dx i�k�vG���kqx{h���lqpby{h~v8nX�qh~n&l�r~�w��h~nD¤ /�y{fDkuwvi{i�h~¦Dh�r~h�y��;vG�©pb�Dy{v8�!pGyzkb�Ni��DuDuwvBxzy ���\k}y{fDv��#v8r~v8¤Bhjl}pGr�hjizi��Dkbi�nDv8yFl��ox{x{k}n#yzr~�;l�vb�kqx{k���¦#��k98�hji�y{h�nD¤uDx{vvb��y{fokqvBxzh~kbiQ��v8x��§pGnw��qvBx��(��� �Duox|pBl`y{hjl}pGrX��h %�l��Dr~yzh~kbi��th�y{f!�kqx{h���lqpby{h~v8nX�

��� � � ��� � ����� " ����� � "��

egfDk\pb�Dy{fovBx|i�¤8x|pGyzk����Dr�r~��p8lm¨�nDvb�tr~k��#¤BkFyzfDk¥fokqr~u#���or�l�v8�\�\kqn�y|igxzkbl�kqh��kb�¥��x{v8� ��pq�#h�� J�pGx{xzh~nD¤8y{v8nX� ��pGn��pq�kbi�� J�r�h � �BvBnokbi�������(p 4}�\h~kqx l 4bpb¨�� ��vBx �#vBn s�v i�k�pGnw�F��pbx{¨ '=y{yzh~nD¤tv8nFkbpGxzr~h�kqx��#x|pq��y|i^vb�wy{fohjiXx{kquwvBxzyq�

Page 14: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� � ��� ����� �

� ����� �� � � � ��

¡���y{kqx-p=¦Dxzh~k��&h~n�y{x{v����wl�y{h�vBnFyzv�y{fDkt�k}x{h���lqpGyzh~vBn(vb��i�uwkbl`h���lqpby{h�vBnwi $ $k�l�y{h�vBn #� � & �By{fDh�i�l|fwpGuDyzkqx�h~n�y{x{v����wl�kbiy{fDk(x{k�pB�#kqx�y{vF� ��� $ $kbl�yzh~v8n ��! A&tpbnw� ��$ $kbl�yzh~v8n ��!#A&�pGnw��¦Dxzh~k��&�\i�¨kqy|l|fDkbi�y{fDkqh�xt�!pGh�n\�kqxzh���lqpby{h�vBny{kbl|fDnDh��¢�Dk�i��FegfDk i�y���r~k�pbnw�Ni�y{xz�wl�y{�ox{k�vG�tyzfDk�y���v!�\kqy{fov��Di(pGx{k�¦DxzvpB��r~�)i�h��\h~r�pGx'��uwkqx{fwpbuwi�yzfDkF�!pbh~n$�i��ou�k}x���l�h�pGr &��#h ��kqxzkqnwl�k�h�igh~n!y{fok���pGy{fokq�!pGyzhjlqpbrDnDv8y|pGyzh~v8n�y{fokq�\�wi�k�$ $kbl�yzh~v8n ��&% &|�

� ��� � � � � �� $� � ������� "�� ��� ��$��%�("%$ �+ �

� ������� � �����������������! #"$�%��&� '�)(*�����a�0�cC.�0�-¢_�������]gpGxzk=v8nDkbi�y{f&pGytpbx{kt¦wp8i�kb��vBn�y{fDk��wi�k�vG�L�!pGyzfDkq�!pby{h�lqi�y{v$�tx{h~yzktuDx{k�l�hji�k�B�Dnwpb�¥¦oh~¤B� �vB�wi(�#k��&nDh~yzh~vBn&i=vG��l�vB�\uo�Dy{kqx©i��oi�yzkq�!i`��yzvB¤Bk}y{fDkqx©�th~y{f)y{fokF�wi�kFvb�t�!pby{fDkq��pGy{h�lqpGrLpGnwpbr~�oi�h�i yzkbl|fDnDhj��Dkbiy{v�lmfDk�lm¨�yzfDk�l�v8x{xzkbl�y{nokbi{i6vb�(y{fDk;�#k`�wnDh~yzh~v8nwi�� � kqh�nD¤��!pby{fDkq��pGy{h�lqpGr�r~�;¦wpBi�kb���Q��v8x{�!pbrti�uwkbl`h���lqpby{h�vBnwilqpGn�¦wk;pGnwpbr~�oi�kb����vBx�d � � ]�� ]�_ - � d�� $ hI� k���^y{f&pGy�y{fDkqxzk\k98�hji�yF�!pGyzfDkq�!pby{hjl}pGr��8pGr��Dkbi6�tfDh�lmf i{pGyzhji�����y{fDk�#k��wnDh�y{h�vBnwi:&�pGnw�;d � 0 ��.�-_�- � -�]q] $ hI� k���¢yzfwpGy©�#k��&nDh~yzh~vBn&itl�vb�kqx�pGr�r�lqpBi�kbig�tfDhjl|f!�\h~¤8f#y�uwvi{i�h~¦Dr��;pGx{h�i�k-& �$y|pby{hjl©pGnwpbr~�oi�hjigyzvvBr�iti��wl|f;pBiti���n�y|p�8 l|fDkbl|¨kqx|i�pGn&��y���uwk(lmfokblm¨k}x|i�lqpbn!¦�k$pbuDuDr~h�kb�¥yzvFy{fDkq�§�pGnw�!y{fDk}�lqpGnF¦wk%<wcC.1����c#_�-/�\¦#�$i�fovG�th�nD¤(y{fwpby�uDx{v8u�k}x{y{h�kbi^vb�Xh~n�y{k}x{kbi�y%��v8r~r~vb����x{v8� yzfDkq�/p8i^r~v8¤Bh�lqpGrwl`vBnwi�kb�¢�okqnwl�kbi`�(=vByzk=fDvb��kq�kqx�yzfwpGy�y{fDk(izl�vBuwk�vb�X�!pby{fDk}�!pGyzhjlqpbr#�kqxzh���l}pGy{h�vBnFh�i r�h~�\h�y{kb�(y{v$y{fDv i�k�uwpbx{y iQvG��yzfDk©i�vG��y���pGx{k�#kq�kqr�vBuD�\k}n#y�uDx{v�l`kbi{i��tfDhjl|f\l}pGn\¦wk=��v8x{�!pbr~h 4}kb���bnwpG�\k}r~� /^i�uwkbl�h���lqpGyzh~vBnL�#��kbi�h�¤BnX�opGnw�¥h��\uDr�kq�¥k}n#y pGy{h�vBnh~n $�p�i��D¦wi�kqy6vb� & p uDxzvB¤8x|pG� �\h~nD¤ rjpGno¤B�wpb¤Bk!�tfDhjl|f�fwp8iFp���kqr~r�����k��wnDkb�)i�k}�!pGn�y{h�lqi�� ���waba�-�dB_ � -#]}] vb�i�uwkbl�h���lqpGyzh~v8nwi $ hI� k���Dy{fDk6�Ip8l�y�y{fwpby�yzfDkq�!�\kqk}y�l��wi�yzvB�\k}xtx{kb��Dh~xzkq�\kqn�y|i:&�lqpbnDnDv8y�¦wkFuDxzvb�kqnX�wk98Dl`kquDyth~ny{fDk$lqp8i�k(�tfDkqxzk�yzfDvi�k6xzkb�¢�oh~x{k}�\kqny|i�lqpbn!¦�k�i�y pGy{k�� ��v8x{�!pbr~r���£&v8x{�!pbr�\kqyzfDv��Di^¤8h~�kgxzhji�kgy{v �^a������ �w[�.�� wc#_��1� � ] + �!pGyzfDkq�!pby{h�l�pbri�y pGyzkq�\kqn�y|i��tfDh�lmf$�¥�&i�y�¦�ktuox{vb�kqnh~n�vBx �#kqx�yzv;i�fDvb� yzfwpGy(yzfDkF�\kqyzfDv���hji=¦wkqh�nD¤!p8�#fDkqxzkb� yzv\uDxzvBuwkqx{r��� $�&lmf�v8¦Dr~h�¤pGyzh~v8nwi(lqpGn�¦wk i�y|pby{kb���vBx{��pGr~r��\pbnw����hji{l|fwpbx{¤Bk���¦��!¤Bh��#h�nD¤F�!pGyzfDkq�!pby{h�lqpGrwuDxzvvG�Ii�� � �Dy=uox{vvG�Ii©�#v¥� vBx{k©y{fwpbn�i�h��\uDr�� ���wi�y{h����l�vBxzx{kbl�yznDkbizi /^yzfDkq�$u�k}x���vBxz� p6l�xzvizi �IlmfDk�lm¨$vBn!�#k}y|pGh�rwpGn&�¥uDx{vb��hj�#k�p(uwvG��kqx����orw�#kq¦D�o¤B¤Bh�nD¤Fpbhj� * � ��� L @ ,I�pBi=��kqr~r�p8i=r~kbp8�#h~no¤¥yzv\p\��kqkquwkqx��Dnw�#kqx i�y pGnw�#h�nD¤\vb�gyzfDkFi��Di�y{kq�V¦�k}h~nD¤!i�uwkbl�h��&kb���D�tfDh�lmf;h~n�yz�Dx{n;¦D�Dh�rj�Dil�vBn#���#kqnwl�k(h�n�pFi�uwkbl�h���lqpGyzh~vBn itl�v8x{x{k�l�y{nDk�i{i���(��� *��BvBn L @ p-,©pGnw� � *��©p��E: 7 � $ uDh : L ,©pGx{k�� v��#kqr ��vBxzh~kqn�y{k�� i�uwkbl�h���lqpGyzh~vBn �\kqyzfDv��Di����\kbpGnoh~nD¤)y{fDk}�h~n��vBr~�k�l`vBnwi�y{x{�&l�y{h�nD¤)pGn pG¦&i�y{x pBl�y��!pby{fDkq��pGy{h�lqpGr��\v��#k}r9$�p�]`_bc#_�-(0 cod ��� � - &�vG�©y{fDk;i��oi�yzkq� ¦�k}h~nD¤i�uwkbl�h��wkb��� =�pGxzyQvb�XyzfDk=� v��#kqro�#k��wnDk�iQpbn\pb¦wi�yzx|p8l�y{h�vBn\vb�Xy{fok�]�_�c#_�-�vb�XyzfDk�i��Di�y{kq� h~n�y{kqxz�!iXvG��y{foktx{kqr�p �

)

Page 15: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

5 ��� ��� ���%��� ���� ��������� ����� � �

y{h~v8nwi�foh~uF¦wkqy��gkqk}nF]�_bc�_�- <wcDa���cD[ .1-�]B�Gh�nwl�r��w�#h~no¤�l�v8nwi�yzx|pbh~n�y|i^v8nFy{fDkt�8pGr��DkbiXy{fDkt�8pbx{hjpb¦Dr~k�i�lqpGnFy pG¨k��egfDk�^c#_�c 0���� -/.#vb��y{fDk�i��Di�y{kq� + x{kquox{kbi�kqn#yzh~nD¤ $�pb¦wi�yzx|p8l�y{h�vBnwi�vG� &�yzfDkt�!pGh�n��DpGy p�y���u�k�i vb�XyzfDk�i��Di�y{kq�#+�hji�#k��wnDk�� h~n;pbn�k98�uDx{k�i{i�h��kqr~��x{h�lmf!k98�y{k}nwi�h�vBn!vG���&x|i�y�vBx �#kqx�r~v8¤Bhjl8�t£D�Dnwl�yzh~vBn&pGrXuDxzvBuwkqx{yzh~kbitvG� y{fDk�i��oi�y{k}�pGx{k$i�u�k�l�h��wk���h�n�yzkqx{�!i�vb��i�y pGy{k$y{x pGnwi�h~y{h�vBnwi $�l}pGr~r�kb� � � -#abc#_ ��� � ] &��tfDhjl|f;lqpGn;l|fwpGno¤Bk6yzfDk$i�y pGy{k$vG�-y{fDki��oi�y{k}����pGnw�!�tfDhjl|f;lqpGn!y|pb¨k(h~nDuD�oy|itpGn&� qv8x�x{kqyz�Dx{n!v8�Dy{uD�oy|i��egfDk6�!pby{fDk}�!pGyzhjlqpbr�¦wp8i�hjitvG��yzfDkFi�u�k�l�h���l}pGy{h�vBn;rjpGno¤B�wpb¤BkFkqnwpb¦Dr~k�i�p¥l`vBx{xzkbi�uwv8nw�#h~no¤ r�vB¤8hjlqpbrX_�� -/�wa���y{v¦�k�l�vBn&i�y{xz�wl�yzkb�6uD�Dxzkqr~��� kblmf&pGnDh�lqpGr�r~� /w�#k��wnDh�y{h�vBnwiXvG��y{fokti�uwkbl`h���lqpby{h�vBn6¦wkbl`vB�\k�p�8�h~v8�!iXpGn&�F�#k��wnDh�y{h�vBnwivG�tyzfDk l�vBxzx{kbi�u�v8nw�#h�nD¤�r�vB¤Bh�lqpGr-y{fDkqv8x{���pbnw�Ny{fokqvBxzkq�!i=vb�ty{fok¥yzfDkqvBxz��k98�uDxzkbi{i�r~v8¤Bh�lqpGr�l�v8nwi�kb��Dkqn&l�kbi=vb�y{fDk$i�uwkbl`h���lqpby{h�vBnX�

� ����� � � ���� #"$�%�!& '�)( ��� � ������ #"$� ��&� '� ( �¡�i^p=�wk}rj��vb��x{kbi�kbpGx lmfX�8i�uwkbl`h���lqpby{h�vBn6�k}x{h���lqpGyzh~vBn$hji�i�yzh~r~r�h~n$h~y i^kbpGxzr~�$i�y pG¤8kbi�� � �9< -�a����-dc#_��1� � ��kg�\k�pGny{fDkF�wi�k¥vb�t�!pby{fDk}�!pGyzhjlqpbrXpGn&pGr~�oi�h�i�y{kbl|fDnDh��¢�Dk�i $�h~nwl�r��w�#h�nD¤\uDxzvvG�z�^¦o�Dy(nDvBy(r~h��\h~yzkb�\y{v!h~y &g��vBx(¤ pGh~noh~nD¤l�vBn#���#kqnwl�k(h�n yzfDkFl`vBx{xzkbl�yznDkbi{igvb��pFi�uwkbl`h���lqpby{h�vBnX� ��n�¤Bk}nDkqx|pbr��wl�v8x{xzkbl�y{nokbi{igh�nwl�r~�&�#kbigpbuDy{nokbi{i`��h�n#yzkqx{nwpbrl�vBnwi�hji�y{kqnwl`��Dl�v8�\uDr�kqy{kqnokbi{i`�¢h��\uDr�kq�¥k}ny|pG¦oh~r~h�y���BxzvB¦D�&i�y{nokbi{i`�wpGnw�!�\vBxzk�^��kqxzh���lqpby{h�vBn\y pBi�¨oith~nwl�r��w�#kA/

<wcC.1����c#_��1� � �8¦#��i�fDvb�th~nD¤FyzfwpGy�l�kqx{y pGh�n¥uDxzvBuwkqxzy{h~k�igpGxzk�r~v8¤Bh�lqpGr�l�v8nwi�kb��Dkqn&l�kbi�vG��yzfDk�i�uwkbl�h���lqpGyzh~vBn$ h�nwl�r~�&�#h~nD¤�i{pq��kqy��!pGnw�!r~h��kqnDkbiziQuDxzvBuwkqx{yzh~kbi:& � ] � � _�c�B@�pbnw�6_ � � - @ d�� -�d���� � X�qh~nwl�r��w�#h�nD¤t�wi�k�vG���8pGxzhjpG¦or~kbiX�th~yzfDh~n$y{fDk�i{l�v8u�ktvb�wy{fokqh~x-�#k��wnoh~y{h�vBnwi � � -H.1. @ � �wa�0 -/� � -�]q]gd���-#d���� � X�Bh�nwl�r��w�#h~no¤�pb¦wi�kqn&l�ktvG��uwpbx{y{h�pGr�r~� ���#k`�wnDkb�(y{kqxz�!iXpGnw�Fl}pBi�k�i^�\hjizi�h�nD¤��x{v8� �#k��wnoh~y{h�vBnwi`�wpGnw�\yzkqx{�\h�nwpGyzh~v8n\vG��xzkbl��Dx i�h�vBn��

�^a������ ��� 0�c#_���-H0�c#_���dcC.�d � � ]9��]�_�- � d��4�wa��]qc#_ � ] �-cD[���.1�j_ ���^�=h�nwl�r��w�#h~no¤ yzfDk)k98#h�i�yzkqnwl�k�vb�i�y pGy{k�i��y��#uwkbi`�B�8pGr~�okbi�pGn&�����Dn&l�y{h�vBnwi^�tfovi�k©�#k��&nDh~yzh~vBn&i�pGxzkt¤Bh~�k}nFh~�\uDr�hjl�h�yzr~��h~nFy{fok�i�uwkbl�h���lqpGyzh~v8n��

dcC.�d � .�c#_��1� � ��� � -#c!� -�]�_ �^a�-�d � � ��� _��1� � ]� uDx{vvb��y{f&pGy©pGr~¤8vBxzh~y{fo�!iQ�\k}kqygyzfDkqh~x�uDx{k�l�vBnw��h~y{h�vBn }uwvi�y l�vBn&�#h~yzh~vBn§i�uwkbl�h���lqpby{h~v8nwi��

uDx{vvb��y{f&pGy�uDx{v8y{v�l�v8rji�pBl|fDh~kq�k©y{fDkqh�xgv8¦ ��kbl�y{h��kbi��

egfDkbi�k(yzkblmfonDhj��Dkbi�pGx{k(h�r~r~�&i�y{x pGyzkb�¥h~n!yzfDk$lqpBi�kFi�yz�w�#h�kbig¦wkqr~vb�(�

� ������� ��� � � ���*� ����� &������� ���� #"$�%�!& '�)(=^kqx{f&pGuwi�y{fDk���pGh~n�uDx pBl�yzhjlqpbr�¦wkqnDk��&y|iQvb�^��v8x{�!pbr�i�uwkbl�h���lqpGyzh~v8n!l�vB� k���xzvB� h~y|i��wi�k pBitp6�\kqn�y|pbrDy{vv8r���vBxl�rjpbx{h�����h~no¤¥xzkb�¢�oh~x{k}�\kqn�y|itpGn&�Np8i�p\r�pGnD¤8�wpG¤8k ��v8x�k�8#uDxzkbi{i�h~nD¤ y{fDkq� /�yzf#�&i h�y�hji�nDvBy(nDkbl`kbi{izpGx{�;y{v!fwpq�k�\kbl|fwpGnDh�lqpGr i��DuDuwv8x{y�y{v)�#kqxzh~�k��¥�&lmf)vG�©y{fDk ¦�k}nDk��wyFvb�=��v8x{�!pbrg�\kqyzfDv��Di`� � �oy6�tfDh�r~k\h�y6hji6uwv i{i�h�¦Dr~ky{v��wi�k�h~n#��v8x{�!pbr�pGxz¤B�D�\k}n#y i6y{v�¦D�oh~rj��l`vBn#����kqnwl�k;h~n�p�i�uwkbl�h���lqpGyzh~v8n� i�l�vBxzx{kbl`y{nDkbizi��t¦wkblqpb�wi�k;vG�$y{fDkuDx{kbl`hji�h�vBn�y{fwpbyg��vBxz�!pGr�i�uwkbl`h���lqpby{h�vBnwi�v ��kqxth~y�h�igpGr�i�vFuwvizi�h�¦Dr~k�yzvFuDx{vb��hj�#k©p�foh~¤Bf;�#k}¤Bx{k}k=vb���\k�lmfwpbnDhjl}pGri��DuDuwv8x{yQ��v8x�y{fDkqh�x��wi�k�+ h~nFuwpbx{yzhjl��Dr�pGx /�i���n�y|p�8 ��pGn&�¥y��#uwk��Ilmfokblm¨k}x|i��qr�pGnD¤8�wpG¤8k��I�#h~xzkbl�y{k�� kb��h~y{v8x|i`�¢r�h~¦Dx pGxz��!pGnwpb¤Bkqx i��DuDxzvvG��v8¦Dr~h�¤pby{h~v8n�¤8kqnDkqx pGy{v8x|i`�wpGnw�!y{fDkqv8x{kq�VuDx{vb�kqx i��¡ ��vBxz�!pGr�i�uwkbl�h���lqpGyzh~vBn(¤8h~�kbi�p=l`r~kbpbxq�buDx{kbl`hji�k�¦wp8i�h�iL��v8x�x{kbp8i�v8nDh~nD¤o� ��n#��v8x{�!pbruDx{vvb�Ii^¦D�Dh�rj�6l`vBn#����kqnwl�k�h~np�i�uwkbl�h���lqpGyzh~vBn i�l�v8x{xzkbl�y{nokbi{i`�B¦D�Dy^��v8x��!p�8�h~���D� l�vBn#���#kqnwl�k �BuDx{vvb�Iigi�fDvB�Dr��6¦wk�l|fDkbl|¨kb���\kbl|fwpGnohjlqpbr~r~� �

Page 16: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� �� ��� ����� ����� ������� � � ����� ��� ����� ������� � ���� � 7�tfDhjl|f��\kbpbnwi=l`vBnwi�y{x{�&l�y{h�nD¤\y{fokq� h�n����Dr~r^��v8x{�!pbr���kqy|pbh~r�� (�vBy{kFyzfwpGy(nDv8y$pGr~r-vG��y{fDkF�k}x{h���lqpGyzh~vBn;y|p8i�¨oi�#hjizl��wi{i�kb�6pb¦wvG�k�lqpGn$¦wkt�#v8nDktuD�Dxzkqr~��� kblmf&pGnDh�lqpGr�r~�8��egfDh�i%h�i%��pGh~nor~��¦�k�lqpG�wi�kgyzfDkg�!pby{fDk}�!pGyzhjlqpbrGyzfDkqv8x{�h~n��tfohjl|f�y{fok�pBi{i�kqx{yzh~v8nwi�pGn&��uDx{vvb�tvB¦or~h~¤ pGyzh~vBn&i=vG��pGn)pb¦wi�yzx|p8l�y(i�uwkbl`h���lqpby{h�vBn)pGxzk�i�y pGy{k���nDkqkb�Dity{v ¦�k�kqx{�)x{h�lmf *���� : L ,���i�vN���wl|f�i�v�y{fwpby¥�!pby{fDk}�!pGyzhjlqpbr~r���h�yF�th~r~r�¦wk �onw�#kbl�h��DpG¦or~k�)¡=�DyzvB�!pby{h�l¥y{fDk}vBx{k}�uDx{vb�kqx i^�th~r�rDnDkq�kqx-¦�k©u�vb��kqx����DrokqnDvB�o¤Bf\yzvF�#kqyzkqx{� h~nDk�y{fok=�8pGr�hj�#h�y��6vG�Ly{fDk�uDxzvvG��vB¦or~h~¤ pGyzh~vBn&iQy{f&pGy�pGxzhji�kh~n!i��wlmf!xzhjl|f¥yzfDkqvBxzh~kbi �#f��D�!pbn\h~nDuo�Dygh�n#yzvFy{fDk��k}x{h���lqpGyzh~vBn�y|p8i�¨\�th�r~rLpGr~��pq�Di�¦�k(xzkb�¢�oh~x{k�����egfDh�iti�fDv8�Drj�nDvBy�¦wktxzkq¤pbx|�#kb�$pBi�ptuDx{v8¦Dr~kq�§�GfDvb��kq�kqx �bvBnFyzfDktl`vBn�y{x|pbx{�� �#kqkqu$h~nwi�h~¤Bf�y|iXh~n�y{v©p�i�u�k�l�h���l}pGy{h�vBn�pGx{ktvb��y{kqn�#h�kqrj�#k��¥h~n!y{fok6l`vB�Dx i�k6vb��pGyzy{kq� uDy{h�nD¤6yzv\�#h�i{l|fwpGxz¤Bk(uDxzvvG��v8¦Dr~h�¤pGyzh~v8nwi�� ��n * � £ ;�� L %-,��#��v8x=k�8Dpb�\uDr~k �¢h�yhji�i�fDvb�tn�y{f&pGy=�Ipbh~r~�ox{k(y{v!l`vB�\uDr�kqy{k p uDxzvvG��vG��y{k}n�h~n&�#hjlqpby{kbig�tfokqx{k $�pGn&��fDvb�9&th~�\uox{vb�kq��k�n�y|i�lqpGn;¦�k�!pB�#k©h~n;p¥i�uwkbl�h���lqpGyzh~vBnL�� �Dy=h�n#yzkqx|p8l�y{h��kqr~� ��¤BkqnDk}x|pGyzkb�¥uDxzvvG�Ii(lqpbn�¤Bx{vb�1�kqxz�\rjpbx{¤Bk +�vG��yzkqn�vBx �#kqx i�vb�g��pG¤Bnoh~y{�&�#k6¤8x{kbpby{kqx�yzfwpGny{fDk$pBizi�kqxzy{h�vBnwi=yzfDkq�\uo�Dx{uwvBxzy�y{v�uDxzvG�k +3pGn&���D¦wkblqpG�&i�k6vb��y{fokFi�fokqkqx�pG� vB�Dn�ytvG����kqy|pbh~rXy{fokq�\�!pq�!l�v8n!�y|pGh�nX��uDxzvvG�Ii(lqpbn�¦wkFy{kb��h~vB�&i=y{v!l`vBnwi�y{x{�&l�y(pGn&���#h %�l��Dr�yty{v\xzkbpB���(egfokbi�k(�IpBl�yzvBx|i�y{vB¤8kqy{fokqx��\kbpbn�yzfwpGyuDx{vvb�Ii�pGxzk ���wi�y�p8i�kqxzx{v8x ��uDx{v8nDkFp8i�uDxzvB¤8x|pG��i��w�DnDr~h�¨k�uDxzvB¤Bx pG�!i`�DfDvb�gkq�k}xq�#h���pFuDxzvvG��hjit¤Bh��kqn!h~n;i���% �l�h~kqn�y��#kqy pGh�r^h�y|i�l�v8x{xzkbl�y{nokbi{i�lqpGn�¦wk�l|fDkbl|¨kb�¥uD�ox{kqr�� � kblmf&pGnDh�lqpGr�r~�8� ��n�l�v8n#yzx|pBi�y�y{v�p l`vB�\uDh�r~kqx��tfDhjl|flmfDk�lm¨oigy{fDk 1 i�y|pGyzhjlFl�v8x{xzkbl�y{nokbi{i >¥vG��p¥uDxzvB¤8x|pG� $ �tfDh�lmf;�wi��&pGr~r����\k�pGnwigr�h~y{yzr~k(�\v8x{k6yzfwpGn)i��#n�y|p�8���pbnw�y���uwk��IlmfDk�lm¨�h~nD¤ &|�p6uox{vvG�QlmfDk�lm¨kqx lmfDk�lm¨oi�y{fDk(l`vBx{xzkbl�yznDkbi{i�vG�-x{kbp8i�v8nDh~nD¤ pG¦wv8�DytuDx{v8uwkqx{yzh~kbigvb��yzfDk(i�uwkbl`h ���lqpGyzh~v8nX��pbnw��fDkqn&l�k$pG¦wvB�Dy©h~y|ith~n�y{k}nw�#kb�\�\kbpbnDh~no¤D� =�x{vvb��lmfDk�lm¨�h~nD¤$y{f��wi=¤8vkbi=���wlmf����Dx{yzfDkqxty{vb��pGx|�oilmfDk�lm¨�h~nD¤ l�vBxzx{kbl�yznDkbiziQy{f&pGn!l�v8�\uDh�r~h~no¤(pGnw�\yzkbi�yzh~nD¤�p�uDxzvB¤Bx pG������v8x{k�h��\uwvBxzy|pGn�y{r���i�u�k�l�h���l}pGy{h�vBnwi�lqpGn¦�k$�#k}¦D�D¤B¤8kb� k�pGx{r��\h~n!yzfDk$�#kq�kqr�vBuD�\k}n#y�r�h���k��Il��ol�r~k �B¦wk���vBxzk6��kbi�h�¤Bn;pGnw�!h~�\uor~kq��kqn�y|pGyzh~v8n¥y pG¨kbi�uDrjp8l�k��'n uwpGxzyq�#yzfDhji�yzkblmfonDhjlqpbrwx{kquwvBxzygh�r~r~�&i�y{x pGyzkbi�i�vB� k�l�v8�\�\v8nDr~� � �&i�kb�F�;pGnw�\�(��� �kqx{h���lqpby{h~v8n¥yzkbl|fDnDhj��DkbipGnw��h�n#�kbi�y{h�¤pGyzkbiQfovG�1��kqr~r�y{fDkq�!yzx|pGn&i'��kqx�y{v��!pBl|fDh�nDkbi�� ��y�pGr�i�v\k98�uDr�vBx{k�ignDkq�1i�u�k�l�h���l}pGy{h�vBn§pGnw�!�kqx{h����lqpGyzh~v8n yzkbl|fDnDhj��Dkbi`�#nDv8y�l��Dxzx{kqn�y{r��¥uwpbx{y�vG����v8x=� �����

� � � � ��� ��$��%�("�$ �� �� #" &�� � $ ��%�("%$ �� $� ��� !

egfDk!h~n�y{x{v����wl�y{h�vBn y{v)�(��� ¤Bh~�k}n�fDkqxzk h�i6nDkbl�k�i{i{pbx{h�r~��i�fDvBxzyq�ti�¨kqy|l|fDh~no¤�vBnor~��p8i ���wl|f��#k}y|pGh�r�pBiFhjinDkbl�kbizi{pbx{����vBx$x{kbp8�#h~no¤�y{fok¥xzkbi�y$vG��y{fohji�y{kbl|fDnDh�lqpGr-x{kquwvBxzyq�;egfDk�x{kbp8�#kqx6h�i�x{k���kqxzx{kb��yzv�*��BvBn L @ pA, ��v8xFp���Dr~r�kqxgk98�uDr�pGnwpby{h~v8nX�

� � �)��� �*� ���� �������! #"$�%��&� '�)( �'� (�� � ������(����hji�p��\v��#kqr�� v8x{h�kqn#yzkb�(i�uwkbl�h���lqpby{h~v8n¥yzkbl|fDnDhj��Dk�h~nF�tfDh�lmf�i�vG��y��tpbx{k�i��oi�yzkq�!i�pbx{k©i�uwkbl�h��wkb�6¦��F�#k`�wn!�h~nD¤;y{fDk\uwv i{i�h�¦Dr~k;i�y|pGyzkbi6vG� $�pbn�pG¦&i�y{x pBl�yzh~v8n vG� &(yzfDk!�#kbi�h~xzkb�Ni��Di�y{kq�§�^y{v8¤BkqyzfDkqx$�th~y{f p;i�kqyFvb��h~nDh�y{hjpbri�y|pby{kbi©pGnw��vBuwkqx pGy{h�vBnwit��vBx(l|fwpGno¤Bh~no¤���xzvB� vBnok�i�y|pby{kFyzv!pGnDv8y{fDk}xq�$egfDkFi�y|pGyzkFhji=�&i��wpbr~r~�!k98�uDxzkbi{i�kb��p8ip¥i�kqy=vb��i�y pGyzkF�Bpbx{h�pG¦Dr�kbi��D�th�y{f�l`vBnwi�y{x|pbh~n�y|itvBn;y{fDk$�Bpbr~�Dk�i�yzfDkq�;lqpGn;y|pb¨k� J�v8nwi�yzx|pbh~n�y|i�pbx{k6�txzh~yzy{kqn!h~npGn�k98�y{k}nwi�h�vBn�vG��y���uwkb��$��!pGn�� ��i�vBx{yzkb�'&tuox{kb�#h�lqpGyzk�lqpGr�l��Dr��wi��tfDhjl|f�fwpBi$i��Duou�v8x{y6��v8x �&nDh~yzk\i�kqy|i`�^�!pbuwi$ �wnDh�y{k(uwpbx{y{h�pGr����Dn&l�y{h�vBnwi:&|�#�wnDh�y{k(i�kb��Dkqnwl�k�i�� J�pbx{yzkbi�h�pGn�uox{v��#�wl`y|i�pGnw�!�\vBxzk�� � � @ "�� * � xzh L # ,�hji�y{fwpbyFuwpGxzy6vb��y{fDk\� ��� r�pGnD¤8�wpG¤8k �&i�kb� ��v8xFi�u�k�l�h���l}pGy{h�vBnX�I$v8�\k¥vb��y{fDk��!pbh~n��kbpGyz�Dx{kbigvb���(����� $/;N�th�r~r�¦�k$h~r�r~�wi�y{x|pby{kb��vBn�p�i�h��\uDr�k=k98opG� uDr~k�¦wkqr�vb�(�D�wi�h�nD¤Fy{fDk(��vBr�r~vb�th~nD¤F� ����� $ ;nDvBy pGy{h�vBnB/

�� �������ghjigyzfDk(y��#uwk(l�v8nwi�h�i�yzh~nD¤�vG� pGr�r��wnDh~yzk$i�kqy igvG��kqr�kq�\kqn�y|iX��x{vB� � �

Page 17: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

: ��� ��� ���%��� ���� ��������� ����� � �

���� hjigyzfDk(y��#uwk$l�vBn&i�hji�y{h�nD¤FvG��pbr~r��wnoh~y{k i�kb��Dkqnwl`kbigvG�-kqr~k}�\kqn�y|i^��x{v8� � �

�� ���� � x{kquox{kbi�kqn#y igpbr~rX�!pbuwi9$ �wnoh~y{k©uwpGxzy{hjpbr����Dnwl�yzh~v8nwi &���x{v8� � y{v � �

�� x{k}uDx{kbi�kqn�y|ignwpby{�Dx pGrXn��D�¥¦wkqx i��

�� xzkquDx{k�i�kqn�y|igyzfDk(kq�\uDy���i�k}yq�Dpbnw� * ,Xy{fDk(kq�\uoy���i�kb��Dkqnwl�k � ¤Bh��kqn!p�i�kb��Dkqnwl`k� ��� ���� �$ ��� ��� �� -&�h�igy{fDk(r~k}nD¤Byzf!$Ii�kqytvb��kqr�kq�\kqn�y|i:&XvG�� � ¤Bh��kqn!pF�!pGu��!��������� $���� �!��&�hjity{fok6i�kqytvG�-kqr�kq�\kqn�y|i�h~n!yzfDk$�#vB�!pbh~n $�x|pbnD¤Bk-&�vG�"���

�$# �&%('*)*� $,+�-/.0 &�hjitp�l�vB�\uwv i�h~yzk��8pGr��Dk(vG��y���u�k1%('*)*� �th~yzf\�wkqrj�\�8pGr��Dkbi2+)pbnw�3.4 �

�(����� $/;�pGr�i�vFh�nwl�r~�&�#kbignDv8y|pGyzh~v8n ��vBx���k��wnDh�nD¤�pGr�¤BvBxzh~yzfD�!i /�i�kqk $kbl�yzh~v8n 5#� )#� � ¦wkqr~vb�(�

� � �)� � 5 ( �76 ����� �'� �������! #"$�%��&� '�)($�DuDuwvi�k�%��v8x�y{fok\izpG¨kFvG��h�r~r~�&i�y{x pGyzh~vBnL��y{fwpby(h~y�h�i uox{vBuwv i�kb��y{v;i�uwkbl`h�����p!i�h~�\uDr�k$i�kb��Dkqn�y{h�pGr-i�y{v8x{kF��vBxy{kqxz�!i�vG�-pFl�kqxzy|pbh~n\¤8x|pG� �!pGx}�^eXkqxz�!i�vG�-y{fDk�¤8x|pb�\�!pGx pGx{k(yzv6¦wk$pG¦wi�y{x|p8l�y�i���n�y|p�8�y{xzkqkbi`�#�tfDv i�k(r~kbpq�kbipGx{k©l�v8nwi�yzx{�wl�yzvBx�i�����¦�v8rji`� J�v8nwi�yzx{�wl`y{vBx igpbx{k�y{v(h~nwl`r~�w�#ktyzkqx{� h~nwpbrji $�l`vBnwi�y|pGn�y|i:&�pbnw�����onwl�y{h�vBn i����¥¦wv8rji��egfDkFpbx{h~y��\vb��l�vBnwi�y{xz�wl�y{v8x�i��#��¦wvBr�i +�yzfDk(n#�o�¥¦wkqx�vG��pbx{¤B�o�\kqn�y|igy{fokq�!k98#uwkbl`y +�h�igy{v�¦wk�� 8�kb� v8�Dy|i�hj�#ky{fDk�i��Di�y{kq� pGnw�6�th�r~r�¦�k�¤Bh��kqn6¦��Fpt���Dnwl�yzh~vBn98:)*;<.>=&� $�DuDuwv i�k©pGrji�v(y{fwpbyq��pGy�pGn��6u&pGx{yzhjl��orjpGx�y{h��\k�bvBnDr��Fpi��D¦wi�kqygvb�XyzfDk�l`vBnwi�y{x{�&l�y{v8xti�����¦�v8rji^�th�r~rwp8l�y{�&pGr~r��F¦wk=uwkqxz�\h~yzy{kb���8pGn&�¥y{fwpbygyzfDkqx{kth�i�y{v6¦wk©pGn\v8uwkqx|pby{h~v8n��vBx�pB�o�#h~nD¤�nDkq� i����¥¦wvBr�iQyzvFy{fDk$i�k}yq�£^h~¤o� #� � ¤Bh��kbiFpGn3pb¦wi�yzx|p8l�y\i�uwkbl�h���lqpGyzh~vBn vG�$i��wl|f�p)i��oi�y{k}�,h~n �(������egfDk;y���uwk�?�@:AB *.�)*CEDF.�@:)�pbnw�y{fDk$�Bpbr~�DkG8:)*;<.�=\pbx{k$uwpGx pG�\kqyzkqx|igyzv¥yzfDk$i�uwkbl�h���lqpby{h~v8nX�t¡=n§pG�C8�h~r�hjpbx{�\y���u�k�%�'*)*� $�x{kquDxzkbi�k}n#yzh~nD¤Fyzkqx{�!ivG��y{fDkF¤8x|pb�\�!pGx &�pGnw��pbn�pb�C8�h~r~h�pGxz�¥���Dnwl�yzh~v8nH /=��JIK@�LM &N(+ $��tfDhjl|f�k98�y{x pBl�y i=y{fokFi�k}y�vG��pGr�r�l�v8nwi�yzx{�wl�yzvBxi����¥¦wvBr�i��&i�kb��h~n)p\y{k}x{��&�pbx{k �#k��wnDk���¦#�;x{kbl��ox|i�h�vBnX��%�'*)F� hji(p!d � 0 � �w]9�j_�- _ � � -!$IpGnwpbr~v8¤BvB�&i�y{v;p=�pBizlqpGr�x{k�l�vBx � y���u�k &t�th~yzf�]9-/.1-#dB_��wa � � � dB_ ��� � ]O+/CEA�DF.>;4@:A $�x{kquox{kbi�kqn#yzh~nD¤ y{fDk l�vBn&i�y{xz�wl�yzvBx$i����¥¦wv8r�pGyy{fDkFxzvvBy6vb�tyzfDk�pG¦wi�y{x pBl�y$y{x{k}k-&�pGn&�P8:)RQ� .$ xzkquDxzkbi�kqn�y{h�nD¤�h~y|i(pbx{¤B�o�\kqn�y|i &���vBx(p8lql�kbizi�h~no¤ h�y|i=y���v��&kqrj�Di`�egfDkF�#k`�wnDh~yzh~v8n�vG�S%('*)*��h~nwl�r��w�#kbitp l�vBnwi�y{x pGh~n�y + �tx{h�y{y{k}n�p8i�pGn � � <&cDa�� c � _6h�n�y{fokUTV� W�l�rjpb�wi�k�+ �tfDhjl|fkqnwi��ox{kbi�y{f&pGy����Dnwl�yzh~v8nwi�pGxzk¥�&i�kb���th~yzf�y{fDkqh�x(l�v8x{x{k�l�y(pGxzh~yzh~kbi`����pGr��Dkbi=vb�ty���u�k�%�'*)*�+pGx{k�l`vBnwi�y{x{�&l�y{kb��wi�h�nD¤\p6u&pGx{yzhjpbr����Dnwl�yzh~vBn

XZY&[ \E]F^�XJ_�`7acb:dKe4^gf&hFe4ac^�iH\E]*^gX �kj \E]*^gX�tfDvi�kF�#v8�!pGh�n\hjit�#k`�wnDkb�\¦��\y{fDkJTV� W�l�rjpb�wi�k �egfDk(]�_bc�_�-¥hji�¤Bh��kqn!pBitpFl`vB�\uwvi�h~yzk=y���u�k1%('*)*�$l�.>@:)m'8�#�th�y{f!i�kqr~kbl`y{vBx����Dnwl�yzh~v8nwiZ /=��JIK@�LM $ xzkquDx{k�i�kqn�y{h�nD¤y{fDk�i�kqy�vb��uwkqx{� h~y{yzkb�!i����¥¦wv8rji &�pbnw�H.n'*)F�$ +$ ��vBx©y{fDk�i�kb��Dkqnwl`k�vb��y{kqxz�!itpGr�x{kbp8�#�;pBlql�k}uDy{kb�=&|��¡/]�_bc#_ -� � <wcDa�� c � _ $I�#k��wnDk��Nh~n�y{fokoTp� W§l�rjpb�wi�k &(i{pq�oi�yzfwpGyFyzfDk!u�k}x{�\h�y{y{k���i����¥¦wvBr�i�fwpq�k\¨#novG�tn pbx{h~yzh~kbi(pbnw�y{fwpbygy{fok=yzkqx{�!i��wi�k�v8nDr~�Fuwkqxz�\h~yzy{kb�Fi��#��¦wvBr�i��y{fDk�h~n��8pGxzhjpGn�y�hji�¤Bh��kqn pBigp � vvBr�kbpGn!���8pGr��Dkb� ���Dn&l�y{h�vBn\vb�y{fDk$i�y pGyzk6�8pGxzhjpG¦or~kbi`� (=vByzk�yzfwpGy�h~n!uDx pBl�yzhjl�k©h~ythjitl`vB�\�\v8n ��v8x=yzfDk$i{pb�\k�nwpb�\kbigy{v�¦wk(�wi�kb�¥��v8x=�8pGr��DkbivG��i�y|pby{kF�8pGxzhjpG¦or~kbi $�k� ¤o��h�n)£^h~¤ #� � Dm c'q.(pGnw��.0 &�pGn&�Ni�kqr~kbl`y{vBx i $r /=&�JIK@�LM �pbnw�s.n'*)*�$ -& ��¦D�Dy�yzfwpGy(yzfDhjihjignDv8yt�!pGnw�opGy{v8x{�\h�n;pGn��!i�kqn&i�k�opGnw�!y{fwpbyth~n!�!pGn���lqp8i�kbity{fDk}x{k(pbx{k(¤Bvv���xzkbpBi�vBnwig��vBx��wi�h�nD¤��#h���k}x{kqn�ynwpG�\k�i���¡�n � � � _���cC.1�utc�_���� � ��a�-H����dc#_�-�$���k��wnDkb�\h�n\y{fDkJTV��T ��l`rjpG�&i�k-& i{pq�DigyzfwpGytyzfDk$i��oi�yzkq��i�y|pbx{y|ith~n;pi�y|pby{k(�tfDkqxzk(y{fDkqxzk$pGx{k(nDv l�v8nwi�yzx{�wl�yzvBx©i����¥¦wv8rjigpbnw� novFy{kqxz�!i��egfDkFrjp8i�y�uwpbx{y(vG��y{fDk�i�uwkbl�h���lqpby{h~v8n�h~n)£^h�¤B�Dxzk #� � �#k��wnokbi=y{fok � � -�abc#_��1� � ��v8x6p8�D�#h�nD¤;p¥nDkq� i�����¦�v8ry{vFy{fok6i�kqytvG�-uwkqx{� h~y{yzkb��l�vBnwi�y{xz�wl�y{v8x�i����¥¦wv8rji��-egfDk(vBuwkqx pGy{h�vBn§lqpGr�r �!v:v�w '*xyl(=��JIK@�L $n -&�pB�o�DiO (yzvFy{fDk

Page 18: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� �� ��� ����� ����� ������� � � ����� ��� ����� ������� � ���� � L

� � � - � - � � � _ ��� � ]%�'*)*� / /�+/C A�D*.�;4@:A�/ ?�@:AB *.�)*CEDF.�@:)

8:)RQ� / %('*)*� �TV� W �$# �&%�'*)F�.$ + - .4 -& � +�� ����� 8:)F;<.>=���8:)*;<.�= $,+B&�� � ��� .4

"�_�c#_�- � - � � � _��1� �� �� � �o%�'*)*�$l�.�@:)K' ��

/=��JIK@�L / ?�@:AB *.>)*C DF.>@:)�� � � �.r'*)*�$ / %�'*)*� �

Tp� W �$# ��%�'*)*�$l�.>@:)m' $KDm c'K.*- .4 -& � Dm c'q. � ��� ��8:)*;<.�=�����.�� ��� ��� � .4 ��� /=��JIK@�LM &N(+ $g.:&�� Dm c'K.Tp��T � �$# �&%('*)*�$l�.>@:)m' $KDm c'q.F- .4 -& � Dm c'K. � �� ��.4 �� * ,

���c��(cC.1� - � - � � �j_���� � ]

8:)*;<.�= /:?�@:A: *.�)*C D*.�@:) ���� ���� � dB_��1� � � - � � �j_��1� � ]

/=&�JIK@�LM &N(+ / %('*)*� � ?�@:AB *.�)*CEDF.�@:)������ � /=&�JIK@�LM &N(+ $K�$# �&%('m)F�.$ + - .0 & & � + � ���Z /=��JIK@�L &N(+ $�. &�� . � ��� �&� � .0 �

� � -#abc#_ ��� � � - � � �j_���� � ]�!v:v�w '*xyl(=��JIK@�L�$n A/:?�@:A: *.�)*C D*.�@:)-&��� ���!�� /=��JIK@�LM / ?�@:AB *.>)FCEDF.>@:) ����� � � �$ "!�3 /=��JIK@�L � � � /=��JIK@�LM #�%$ �����2� /=��JIK@�LM �1 �

£^h�¤B�Dxzk� #� � /�¡ �(��� i�uwkbl�h���lqpGyzh~v8n vb��y{fok6i�h~�\uor~k�y{kqxz��i�y{vBxzk6k98opG� uDr~k�

Page 19: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

�9@ ��� ��� ���%��� ���� ��������� ����� � �

i�kqyFvb��uwkqxz�\h~yzy{kb�)i����¥¦wv8rji��)egfDk ��� ��r�h~nDk vG�©y{fDk!vBuwkqx pGyzh~vBn i�i�uwkbl�h���lqpGyzh~v8n�k98�uDx{kbizi�kbi6yzfDk ��abcC0�� � d � � ]�_babcC� � _;vBn�yzfDk�v8u�k}x|pGyzh~v8nB/�h~y�fwpBi¥�txzh~yzk�+3pbnw� ¦���h~�\uDr�hjlqpby{h�vBn�xzkbpB� + uwkqx{�\h�i{i�h~vBn $ �Z� &Fy{v)y{fDk /=��JIK@�LM �l�vB�\uwv8nDkqn�y�vb��yzfDk!i�y|pGyzk\¦D�Dy�lqpGnonDvBy�p���k�l�y�pGn��Nv8y{fDk}xFi�y pGyzk\�8pGx{h�pG¦Dr�kbi��§egfDk!uDx{kbl`vBnw�#h�y{h�vBn$ � � &Li{pq�oi th�i%novBy-pGr~xzkbpB����v8nDktvG�&y{fDk�u�k}x{�\h�y{y{k���i����¥¦wv8rji /�y{fDk�k ��kbl�y�vG�wyzfDkgv8u�k}x|pGyzh~v8nFhjiXnDvBy���k��wnDkb�(h��y{fDh�i�l�vBn&�#h~yzh~vBn$hji^novBy�izpGy{h�i'�wk�����egfDktuwv i�y|l`vBnw�#h�y{h�vBn)$ � � �:&�izpq�Di^yzfwpGy}�B�tfDkqnFyzfDktvBuwkqx pGyzh~vBnFxzkqy{�ox{nwi`�By{fDk�Bpbr~�Dk�vG�7 /=��JIK@�L �i�fDv8�Drj�6¦wk $ �����7� /=&�JIK@�LM � � �b�tfDkqxzk $ �����2� /=��JIK@�LM �hji^yzfDkg�8pbr~�Dktvb��yzfDkti�y|pby{kt�8pGxzhjpG¦or~kt�tfDkqn$y{fDkvBuwkqx|pby{h�vBnF�tp8i%h�n#�v8¨kb���B(�vBy{k�y{fwpby^yzfDkti�y|pby{kgh�n#�8pbx{hjpbn#yXh�i%h��\uDr�hjl�h�y{r��tl�v8n)��vBh�nDkb�(�th~y{f�pGn��$l�vBnw��h~y{h�vBnwiXvBny{fDk(i�y|pby{k��egf#�&iQ��vBxgk�8Dpb�\uDr~k�h~y���vBr�r~vb��itpBitpFl�v8nwi�k��¢�Dk}nwl�k�vb��yzfDk�uDxzkbl�vBn&�#h~yzh~vBn vG� �!v:v�w '*xyl =&�JIK@�L $r &y{fwpby$ "!�3 /=&�JIK@�LM &N(+ $g.:&���vBx©pGr�r�yzkqx{�!i!.gh~n!yzfDk(y{kqxz�#��i�y{v8x{k(pby=yzfDk(y{h~� k=yzfDk(vBuwkqx|pby{h�vBn�h�igh~n��vB¨kb���

� � �)��� �*� � � �) '� � ��� � � &� '����� � (*� & '�)(*�¡ i�uwkbl`hjpGr�r~v8¤Bh�lB�Bl}pGr~r�kb��y{fDk �>�� ��d���� , cDaq_���cC. ��� � dB_���� � ]5$ � , �5&�* � J�� :�%D� J�fDk�: 5-,��bfwpBi^¦wkqk}nFpB��vBuDyzkb�¦#�F�(�©� y{v$fwpGn&�#r~k�y{fDk�¨�h~nw�Di�vb���Dnw�#k��&nDkb�#nDk�i{iQyzfwpGy��!pq�$v�lql��Dx�h~n i�uwkbl�h���lqpGyzh~v8nwi%* � J�� :�%A,I��¡=n&pGr~�oi�h�ivG��p\i�uwkbl`h���lqpby{h�vBn���vBx pG¦wi�kqnwl�kFvb�g�onw�#k��wnokb��y{kqxz�!ighji©pGn)h~�\uwvBxzy|pbn#y�y{kbl|fDnDh��¢�ok ��v8x�x{k}�kbpGr�h~nD¤Fh�nwl�vB� �uDr~kqyzkqnDkbizi�h~n�p�i�uwkbl`h���lqpby{h�vBnX�;eQ��uDhjl}pGr~r����h�y�h�n#�v8r~�kbi©lmfDk�lm¨�h~nD¤ y{fwpby����Dnwl`y{h~v8nwi�$IpGnw�)vBuwkqx|pby{h�vBnwi:&$pGx{kvBnDr�� k}�kqx�pGuDuor~h~k�� y{v pGxz¤B�D� kqn#y ig�th~yzfDh~n;y{fDkqh�x���vB�!pbh~n#$ hI� k���#y{v �Bpbr~�Dk�i��tfDh�lmf§i{pby{hji����!y{fDkqh�xtuDx{k�l�vBnw��h �y{h~v8nwi & �gegfohji�l�vb�kqx|itpF�kqx{��rjpbx{¤8k6l`rjpBizi�vb��kqxzx{vBx i��tfohjl|f ��p�� pGxzhji�k�h�n;i�uwkbl�h���lqpGyzh~v8nwi /�k� ¤o�g��h~��hji�h�vBn!¦��4qkqx{vo��pby{y{k}�\uDy|i�yzv�pBl}l�kbi{i$i�kb��Dkqn&l�kbi=v8�Dy|i�hj�#k!i�kb��Dkqnwl�k�¦wvB�Dn&�Di���y|pb¨#h�nD¤�yzfDk¥fokbpB�Nvb�©pGn�kq�\uoy��!r�hji�y}��wnw�#h�nD¤6yzfDk=��p�8�h~���D� vG�-pbn!kq�\uDy��(r~h�i�y�vG��n��D��¦�k}x|i�� '�y{fokqxQ��v8x{�!i^vb���Dnw�#k`�wnDkb�#nokbi{i�l�vb�kqx{kb�6¦�� ;�=Q£h~nwl�r��w�#k�y���uwk�k}x{x{v8x|i`�DnDvBn!��y{k}x{�\h�nwpGyzh~vBn vG��xzkbl��Dx i�h~v8n;pGnw�!lqp8i�kbit�\hjizi�h�nD¤���xzvB� �#k`�wnDh~yzh~v8nwi���'n�y{�oh~y{h��kqr~� �By{fDk$i�kq�!pGn�y{h�lqi�vG�-y{fDk(�wi��wpGr�uDxzvBuwvi�h~y{h�vBnwpbr�l`vBnDnDk�l�y{h��kbiQh�n ;�=�£ pGx{k(¤8h~�kqn\¦�� /

����� � _��� �� ����� ��� �� _ ��� �� ��� �� ����� ��� �

����� ��� ����� ��������� ��������� ���� � ����� ��� �

� � � � _ ��� �������� ��� �� _ !�� �� ��� �������� ��� �

����� ��� ��� �� !�� �� ��� ��� ��� �� � �

�tfDkqx{k#" xzkquDxzkbi�kqn�y|i(p!uDx{v8u�v i�h�y{h~v8n��tfDvi�k yzx{�Dyzf!���Bpbr~�Dk hji�nDvBy���k��wnDkb���.(=vByzk\y{fwpby$" hji�h~n�y{xzv��#�wl�kb�i�vBr�kqr~�$y{v(k98�uDrjpbh~nFyzfDk=� v��#kqrDyzfDkqvBxz�FvG� ;�=Q£�/¢h�y�nDkq�k}x�pGuDuwkbpbx|i�h~n�h~n#��kqxzkqnwl�k�x{�Dr�kbi���p�8#h�vB�!i`��#k��wnoh~y{h�vBnwi`�vBx�uDx{vvb�Ii��wh~yt��vkbi � �D_F�#k}nDvByzk6pF�8pGr��Dk�;�=Q£ �#h ��kqx iQ��x{v8���\vi�y 1 l�r�pBizi�hjl}pGr >6yzx{kbpby{�\k}n#y i vb��r~v8¤Bh�l h�n!y{fDxzkqk��!pbh~n\��p��oi /� ��£DvBx{���Dr�pBi $ uDxzvBuwvi�h~y{h�vBnwi:&©pGx{kFyzx{kbpby{kb��p8i%���wi�y6pbnDvByzfDkqx�¨�h~n&��vG��y{kqxz� $�nwpG�\k}r~�� � vv8r~kbpbn!� �8pbr~�Dkb�y{kqxz�!i & � =�x{k��#hjlqpby{kbi�pGxzk6y{xzkbpGyzkb�!pBi � vv8r~kbpbn!� �8pbr~�Dkb�\���Dnwl�yzh~v8nwi��

#� $vB� kFy{kqxz�!i=��v�nDv8y6��kqnDvByzk¥�8pbr~�Dkbi $�h�� k �~��yzkqx{�!i��!pq� ¦wk��Dnw�#k`�wnDkb�'& �\egf��wi�uDx{v8uwvi�h�y{h�vBnwi6�!pq�pGr�i�v�¦�k(�Dn&�#k��wnDk�� $�h�� k�~�nDkqh�y{fDk}x&% y{xz�Dk �nDvBx&% �IpGrji�k & �

##��¡=n�p8i{i�kqx{yzh~vBn %08'/ � ��\kbpbnwi6y{f&pGy\yzfDk�yzkqx{� 8��#kqnDv8y{kbi\p��8pGr��Dk�vG�(y���uwk � � (=v)y��#uwk�h�i k}�kqxpBizi�h~¤8nDkb�!y{v�pFy{kqxz���tfDhjl|f!�#vk�i�nDv8y���kqnDvByzk$p �8pGr��Dk�

¡Ky{kqxz� h�igizpGhj�\yzvF¦�k � -/.�. @ � �wa�0�-H�!h���h�yt�#kqnovBy{k�itp6�Bpbr~�Dk � ��ygh�itlqpGr�r~kb��p � -H.1. @ � �wa�0 -/� � �wa�0 � .�c¥h���h�y�#kqnDv8y{kbitp � vvBr�kbpGn;�Bpbr~�Dk ��'yX��vBr�r~vb��i%��xzvB�1uwvBh~n�y $ &�pb¦�vb�ktyzfwpGy�novBy�pbr~r�vG�XyzfDkgr�pq��i^vG�Ll�r�pBi{i�hjlqpbr#r�vB¤8hjlQfovBrj����v8x ;�=�£g�egfDk�l�vBn��kqx i�k�#vkbi�fDvBr�� fDvb��kq�kqx /tyzfwpGy�h�i�� 8�L<L�.>8:CB.>@�L,@KQ:;u'g S@r+('*),+ 8:)K'JD*L,8� K /;4DK8�L2.>8:C:.�@�L,@KQ:;u'� `�6£^h�¤D� #� \i�fDvb��i(i�v8�\k

Page 20: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� �� ��� ����� ����� ������� � � ����� ��� ����� ������� � ���� � � �

��� ��

��� ��

� � ������

���� �

���� �

� ��� � ������ � � �

� �� ��

� � � � ��

£^h~¤8�Dx{k� #� / ;Xpq��i�l�vB�\� vBn�y{v ;�=Q£ pGnw�;l�rjp8i{i�hjlqpbr�r~v8¤Bh�lB�vG��y{fok�rjpq��ig�tfDh�lmf pGxzk6l`vB�\�\v8nFy{v$¦�v8y{f!r~v8¤Bh�lqi����tx{h~yzy{kqn h~n.(�pby{�Dx pGrL�=kb�#�wl`y{h~v8n!i�y���r~k�-¡=n\k98opG� uDr~ktvb�p r�p��3�tfDh�lmf\h�ignDvBy��8pGr�hj�\h~n ;�=�£�hjity{fDk$l�r�pBi{i�hjlqpbr�r�p��3vG� 1 � 8Dl`r~�w�#k��\��hj�D��r~k�>�� � �

�tfDhjl|f;�#vkbitnDvBy�fovBrj�\h�nI;�=�£ �tfDk}n )1hjitpbn��Dnw�#k`�wnDkb�\uDxzvBuwvi�h~y{h�vBn�$�k� ¤o���c�%* , � �� @ &|� $v8�\k�vb��y{fDkrjpq��i�vG�-l�r�pBi{i�hjlqpbrDr~v8¤Bh�l�xzkb�¢�oh~x{ktk�8#yzx|p�f#��uwvByzfDkbi�k�iQy{v$�!pG¨k�y{fDk}�/�Bpbr~h�� h�n ;�=�£g��£DvBx�k98opG�\uor~k�ByzfDk ;�=Q£�kqx|i�h~vBn!vb� 1 � 8ol�r��w�#kb�!��hj�o�#r~k�>(hji /

� _���� � �

$ ��n!vBy{fokqxt�gv8x|�Di`� )���� )1h�igy{x{�ok�uox{vb�#h��#kb� ) ��kqnDvByzkbigy{fok��8pbr~�Dk �*��� �=v8x ��� ���B� &�'n!uDx pBl�yzhjl�k �Dh~y�pGr�i�v��\kbpbnwigy{fwpby ;�=�£�fwpBi�p n��D��¦wkqxgvb���#h ��kqxzkqn�ytrjpq��i��tfokqx{k$l�r�pBi{i�hjlqpbr~r��\p�i�h�nD¤Br�k�r�pq��gvB�orj��i���%�l�k�)£DvBxFk�8Dpb�\uDr~k �%h�n�pB�o�#h~yzh~vBn�yzv�y{fDk!rjpq� ��v8x 1 ����h~n�y{xzv��#�wl�yzh~v8n=>�¤Bh��kqn�h~n £^h~¤o� #�! ���y{fDk��vBr~r�vb�th~nD¤F�8pGxzhjpbn#yth�itp r�p��3vG� ;�=�£�/

� ���� _�� � _��� ������� _��

�'y$izp��oi�yzfwpGy ) ��� h�i(p �gk}r~r �j��vBxz�\kb�\��vBx{���Dr�p¥h�� ) h�i(p �gk}r~r �j��vBxz�\kb�\��vBx{���Dr�p\pGnw����pBi{i��D�\h�nD¤ )/hjiy{x{�ok��� hjitpF�gk}r~r �j��vBxz�\kb����v8x{���Drjp���egfDh�igx{�Dr�k6p8lql�v8�Dn#y iQ��vBxtyzfDk(�gkqr�r �j��vBx{� kb�#nDkbizi�vG�z�#��vBxtk�8Dpb�\uDr~k �By{fDky{kqxz�

d�� � � �"!$# d&%(� � �$' ��d¡ � vBx{k i��D¦Dyzr~k(k98opG�\uor~k�hjigy{fok 1 �=kb�#�&l�y{h�vBn;egfDkqv8x{kq�.>��#�tfDh�lmf!h�iti�y|pby{kb�!l�r�pBizi�hjl}pGr~r��\p8i���v8r~r�vG��i /

� ����

� � �

Page 21: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� ��� ��� ���%��� ���� ��������� ����� � �

egfDk�i�kq��pGn�y{hjl}igvG� ;�=�£�i{pq��yzfwpGy(h~y�hji�u�v i{i�h~¦Dr�kFy{v!�#k��#�wl�k�pGn��#yzfDh~nD¤���x{vB� pGn��Dn&�#k��wnDk���uDx{v8u�v i�h�y{h~v8n)6�D¦o�DygyzfwpGy ) � � h�ig�Dnw�#k`�wnDkb�¥h�� )3h�ig�Dnw�#k��&nDkb�!pGnw��� hji��IpGr�i�k��egf��wi��DyzfDk�;�=�£��kqx|i�h~v8n\vG�-y{fDk�=kb�#�wl`y{h~v8n;egfDkqvBxzkq��nDk}kb�DitpGn;k98�y{x|p6f���u�v8y{fDk�i�hjigyzv¥k}nwi��Dxzk(y{fwpby&)1hjitp��#k��wnDk���uox{vBuwv i�h~yzh~v8nB/

� ���� _�� �� � �

�'n kbi{i�kqnwl�k � ;�=�£ �#h���kqx|i6��x{v8� l�r�pBi{i�hjlqpbr=r�vB¤8hjl ¦���x{kbl`vB¤Bnoh 4qh�nD¤NyzfwpGy!nDv8n!�I�#kqnDv8y{h~no¤�y{kqxz�!iFk98#h�i�y�pbnw�y|pG¨�h~no¤Fk98#yzx{kq� k�lqpbx{k�yzv¥k}nwi��Dxzk(y{fwpbytnDvByzfDh~nD¤ lqpbn ¦wk��#kb�#�wl`kb�\pG¦wv8�Dy=yzfDkq���-egfwpGy��tpq���y{fDk(uDxzkbi�k}nwl�kh~n i�uwkbl�h���lqpGyzh~v8nwi�vG�XnovBn!�I�#kqnDv8y{h�nD¤6yzkqx{�!iXhji�xzkq�kbpGr�kb�6¦��6y{fok=h�nwpG¦Dh�r~h�y��(yzv6l`vB�\uDr�kqy{k�p�uDx{vvb�z�gegfDk�uwvBh�n#y�tfDkqx{k�y{fok¥uDxzvvG� i�y pGr~r�i�hji�y���uDhjl}pGr~r��!y{fDk�uwvBh~n�y6�tfokqx{k�y{fDk��Dnw��k��wnDkb��nDkbi{i(v�lql��Dx i��-pGnw��l`vBnwi�hj�#kqx pGyzh~vBnvG�(fDvb��yzv��!pb¨k¥uDxzvB¤8x{kbizi¥h~n y{fDk!uDxzvvG�$vG��yzkqn�i�fDvb��i¥fDvb��y{v�� 8�y{fok�i�uwkbl`h���lqpby{h�vBnX� egfDhjiFuwvBh�n#y�hjih~r~r��wi�yzx|pby{kb�¥h�n!n#�D� kqx{v8�wiQk98opG� uDr~kbi�vBn;p�i�h 4}kbpG¦Dr�k(lqp8i�k$i�yz�w�#�!h~nIJ�fwpbuDy{kqx � vb� * � £ ;�� L %A,I�egfDk(rjpq��i���v8x��¢�&pGn�y{h��&kqx|igh�n ;�=�£�pGxzk6yzfDk$i{pG� k(pBig��vBxt�!pbn#� �Ii�vBxzy{kb�!l�r�pBizi�hjl}pGr�r�vB¤8hjl-/

��� _�� �� ��� �

��� _�� � � � �

� _����� � _�� � ��� �� � � �

¡=r~yzfDvB�D¤8f�h~y�hjitvG��yzkqn)i{pbhj��y{f&pGy��(�©� hji=¦&pBi�k���vBn��wx i�y�v8x|�#kqx©uDx{kb��hjlqpby{kFl}pGrjl`�Dr~�wi`��h�y=��vB�Dr���¦wk6�\v8x{kpBlql��ox|pGyzk6yzv\izp��;y{fwpby=yzfDk6r�vB¤8hjl��onw�#kqxzr~��h~nD¤F�(�©� hji�p���v8x{� vG����kbpG¨;i�k�l�vBnw�!vBx �#kqx�r~vB¤8hjl�$�lm�z� * � pGx 7 7�,uX�&% # &|�-i�h�nwl�k���wpGn�y{h���lqpGyzh~v8nNh�i�pbr~r�vG��kb��vb�kqx=�wnoh~y{k i�k}y|i��Xkqy lB��$Iegf#�&i©��v8x(k98Dpb�\uDr�k��y{x pGnwi�h~yzh~�kFl`r~vi��Dx{klqpGn�¦wk!�#k��&nDkb��h~n�yzfDk\r�vB¤Bh�lB��kq�kqn)y{fovB�D¤8f h~y$hji(nDvByFv8x|�#h�nwpGxzh~r~���wx i�yFvBx �#kqx��#k`�wnwpG¦or~k� &3egfDk ACBEDCFHGp�8�h~vB��pGy{h 4bpGyzh~v8n\vG�-�(��� �#vkbitnDvBy©pGr�r~vb� �¢�wpbn#yzh���l}pGy{h�vBn!vb�kqxgh�n#�wnDh�y{k�v8¦ ��kbl�y iti��wl|f;pBig���Dnwl�yzh~vBn&i��¡ 8#h�vB�!i©pGx{kF��vBxz�¥�orjpGyzkb� ��vBx$�\vi�y(vG��y{fok¥�(�©��� $/; uox{h~� h~y{h��kbi /t��vBx$k98Dpb�\uDr�k��y{fok\p�8#h�vB�!i=��vBx(�wnDh�y{ki�kqy itpGx{k$¤Bh��kqn\h~n;£^h�¤D�E #�!#����tfokqx{k����� � ���md � � d��������

egfDkFx{kbp8�#kqx�h�i=x{k`��kqx{xzkb� yzv * � £ ;�� L %-,^��v8x�y{fokFvBy{fokqx(rjpq��i=vG� ;�=�£g� � kFnDv8y{k�h~n�u&pBi{i�h~nD¤;y{fwpby�y{fok6�IpBl�yy{fwpby�y{fDk�p8i{i�kqx{yzh~vBn�8=/ � h��\uDr�h~kbi�y{fwpby 8��#kqnovBy{k�i�p¥�8pGr��Dk6vb�ty��#uwk � �\kbpbnwity{fwpby 8�pGr�i�v!izpGyzhji'�&kbi�pGn��h~n��Bpbx{h�pGn�y|i=yzfwpGy(�\h�¤Bf�y=¦wk pBi{i�v�l�hjpby{kb���th~yzf � �FegfDh�i��kqx{�;i�yzx{h�l�y�h~n�y{k}x{uDxzkqy|pby{h~v8n�vb�ty��#uoh~nD¤!p8i{i�kqx{yzh~vBn&i�\kbpGn&iQy{f&pGy�y���uwk��IlmfDk�lm¨�h~nD¤(h�ig�Dnw�#kbl`hj�Dpb¦Dr~k�$uwkbl�hjpbrDl}pGx{k�hjiXy|pb¨kqnX�b�tfDkqn���v8x{���Drjpby{h�nD¤?;�=�£�p�8�h~vB��i��by{v�kqnwi��ox{kgyzfwpGy-kbpBl|f6h�n#��kqx{k}nwl�k�x{�Dr�k�fwpBi^k}nDvB�D¤8ff#��uwvBy{fokbi�kbity{v��!pb¨k�h~y i=l�v8nwl�r��wi�h�vBn;p ��kqr~r�� ��v8x{�\k�� ��vBxz�¥�Dr�p /�k� ¤D��y{fDk(��vBxz�!pGyzh~vBn!xz�Dr~k���vBxt�wnw��h~nD¤�y{fDkfDkbpB�\vb��p¥i�kb��Dkqnwl�k©hji

d&_� � �Hd�� � �! # d&_��

*��� L #�,X¤Bh��kbigpbn�h~n�y{k}x{uDxzkqy|pby{h~v8n\vG� ;�=Q£�h~n;l�r�pBi{i�hjlqpbr�h�n#�wnDh�y|pGxz�\r~v8¤Bh�lB�

� � �)��� �*�����! #"%$ ���*� ����� & � (�� '� �)( ��� (�&egfDk AEBCDCFHG i��DuDuwvBxzy¥kqn���h~x{v8nD�\kqn�y *���� ;X� LH� ,�hji$p���vBxz�!pGr��#kq�kqr�vBuD� kqn#y©i��ouDuwvBx{y i��oi�yzkq� ��vBxF� �����egfDk ACBEDCFHG1yzvvBr �Ii�k}y h�nwl�r��w�#kbi�i�uwkbl�h���lqpby{h~v8n�pbnw� xzk��wnDk}�\kqn�y6kb�#h�y{v8x|i��©p�8�h~v8� pbnw��uDx{vvb�FvB¦or~h~¤ pGyzh~vBn¤BkqnDk}x|pGyzvBx i���pGnw�;p¥¤Bkqnokqx{h�l $ r�vB¤Bh�l ��h~nw�#k}u�k}nw�#kqn�y &�h�n#yzkqx|p8l�y{h��k=uDxzvvG��pBizi�h�i�y|pbn#y��tfDh�lmf!fwp8i=¦wkqkqn!y|pbh~r~v8x{kb�

Page 22: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� �� ��� ����� ����� ������� � � ����� ��� ����� ������� � ���� � � #

������������ �&_��k[ ��� � �� � ����������������

� _������c_�&� d&_��k[ ��� ��% � ��� � � �Kd ��� � � � � % d� ��

������������� �E_�&� d&_��k[ ��� � ��� � � �Kd � _��[ ��� ��

! ��"#�%$&�'�(�

� � � � � �� _�����d�_��k[ ��� � � �% d �� � d �*),+.-0/ � � ����� � ���md ���

� d&_��[ ��� � � � d � ��

�����0$ ! �%�1�32�"04 � _��� �% � �� ��

£^h�¤B�Dxzk� #�!# / ;�=�£�rjpq��ig��vBxg�wnoh~y{k$i�kqy|i`�

y{v�y{fDk�r�vB¤8hjl�vG�F� �����Q�th�y{f p�rjpGxz¤Bk�i�yzx{�wl�yz�Dx{k���i�y{v8x{k)vG� pGr~xzkbpB����uDx{vb�kqn�xzkbi��Dr�y|i`� ��n�y{fDkIACBEDCFHGpGuDuDxzvp8lmf�yzv!�kqx{h���lqpGyzh~v8nX��y{fok\i�u�k�l�h���l}pGy{h�vBn)hji�y{x pGnwi�rjpby{kb��h~n�y{v#$�p�8#h�vB�!i�vG� &(p\�!pby{fDkq��pGy{h�lqpGrXyzfDkqv8x{�pGnw�!uDx{vvb��vB¦Dr�h~¤ pGy{h�vBnwi�pGxzk$�#hjizlmfwpbx{¤8kb�\¦#�\uox{vb�#h�nD¤Fy{f&pGy�y{fDkq��pGx{k(yzfDkqvBxzkq�!i�vG�-y{fwpby=yzfDkqvBxz��£^h~¤8�Dx{k� #� %�i�fDvb��i�pGn;k98Dpb�\uDr�k AEBCDCF/G�uDxzvvG��vb��y{fDk���v8r~r~vb�th�nD¤Fy{fDk}vBx{k}� /5 �6���������� A/ � � � � �

7 �&�4�k A/ ��'nIAEBCDCFHG��0(©pGy{�ox|pGr��=k��#�wl�yzh~vBn)fwp8i ¦wkqk}nNk98�y{k}nw�#kb��yzv�pbr~r�vG�1��vBx$i{l`vBuDh�nD¤!vG���8pGxzhjpG¦or~kbi=yzfDx{v8�D¤Bf i��D¦!�uDx{vvb�Ii /���v8x�k98opG�\uor~k� $�D¦DuDxzvvG� ¥vG��£�h~¤D� #� % + l�vBxzx{kbi�u�v8nw�#h�nD¤!y{v\yzfDk6h�nw�#�wl�yzh~v8n�i�yzkqu�vb��y{fDk$uDx{vvb� +fwpBitr~v�lqpbrX�8pGx{h�pG¦Dr�kbi 8\pGn&�3.`��'n AEBCDCF/GNnovBy|pby{h�vBnX�wy{fDk(xz�Dr~k���vBxth�n#yzx{v��#�&l�h~nD¤�pF�DnDh��kqx|izpGrL�¢�wpbn#yzh��wk}xt�gvB�orj�\¦wk��txzh~yzy{kqn;pBi8 �%$&��"��� 9 / �;:=< ) $ 9 &�k= / � � ) $K= &

y{v\h�nw�#hjl}pGy{k(yzfwpGy�yzfDk6�8pbx{hjpb¦Dr~k 9 hjitr~v�lqpbr^yzv\y{fokFi��o¦DuDx{vvb�t�tfDh�lmf!kbi�y|pb¦Dr~h�i�fDkbi&) $ 9 &|� (=vByzk6yzfwpGy : h�i=pi����¥¦wvBr�vG�-y{fDk(r�vB¤Bh�lqpGr���x pG�\k}�gvBxz¨¥xzkquDxzkbi�kqn�y{h�nD¤F��kb�#�wl�h�¦Dh~r�h~y��F��hjpFpFi��o¦DuDx{vvb� /gh~yth�ignDvBy�uwpbx{ytvG� ;�=Q£��egfDk AEBCDCF/G y{fokqvBxz� i�y{v8x{k�h�i6uwvBuD�Dr�pGyzkb� �th~yzf�p�8�h~v8�!i�����k��wnDh�y{h~v8nwi�pGnw� �#kqx{h��kb��x{�Dr�kbi���vBx ;�=�£ pbnw��(����� $/;�uDx{h��\h~yzh~�kbi`�tegfDkFr~v8¤Bh�lqpGr�y{fDk}vBx{�§l�vBxzx{kbi�uwvBnw�#h�nD¤!y{v!p i�uwkbl�h���lqpGyzh~v8n�fwpBi(p�8�h~v8�!iti�uwkbl`h���lqpbr~r��¤BkqnDk}x|pGyzkb�N¦�� AEBED F/G���x{vB� y{fok!i�uwkbl�h���lqpby{h~v8nB/ ��v8x6k98opG� uDr~k�XyzfDk¥��vBxz�!pGyzh~v8n�x{�Dr�k¥��vBx$�8pGr~�okbi6vG�©y��#uwk%('*)*�$l�.>@:)m'�h�n;£^h~¤o�C #� � h�i

>@?�A1BDC�E�F6A�? ��������DK c'K. / ?�@:AB *.�)*CEDF.�@:)������ � � .4 A/�%�'*)*� � �;4AHG �&%�'*)F�$l .�@:)K'-$qDm c'K.*- .0 &�$# �&%�'*)F�$l .�@:)K'-$qDm c'K.*- .0 &:/�%�'*)*�$l�.>@:)m' ��

pGnw�!vBnDk(vG� y{fDk$l�v8x{x{k�i�uwvBnw��h~nD¤�kqr~h��\h~n&pGy{h�vBn�x{�Dr�kbighji

Page 23: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� % ��� ��� ���%��� ���� ��������� ����� � �

����� '��� d�_ � �k[ ��� �� � _�� � [����� [��� � � � # � � � ��� ����[ ���� � � � # � � _�� [�������K[�� � � ����� �n[�! �"�� � ��# � �

���$� '%�& ��� �E_��%�& � � � � � # eg_��%�& � � � � � % e �%�& � % e�_ � ��[ ��� �%�& � � � � # � ��� � � �*e � � ���'� � � # e ��� �"��[ � �(� � %�& ���)# %*& � % # %�& � � �%�&+� � ���,� � � # eg_�� -�. ��� [����� [�� � %�& � � �

/10 � � � � � � # ����� � ���*e � _�� [���2�*�K[�� � � ����� �n[�! �"�3� � %�&+� # %�& � �4(& �65 _��[ ��� � � � # 5 _�� -����n[�� ����� � � # % �

/+0 � � � � � � # d&_�� � [�"!7� '� � � ��� �� � ����# 4 �

£^h�¤B�Dxzk� ��&% /g¡=n!k98opG� uDr~k�uDx{vvb��h~n AEBCDCF/Gt�

>@?�A1B �0��8&$&�3$&�'�."�$ ��� �$# �&%('*)*� $,+�-/.0 &:/�%�'*)*�;4AHG���%�'*)*� $ + - .4 -& ��

��vBx{k �#kqy|pbh~r�igpGxzk�¤Bh��kqn�h~n!¡=uou�k}nw�#h 8 ¡6��$ (=v8y{k�yzfwpGytyzfDk=��vBxz� vb��i�vB�\k�vG�-y{fok�uDx{vvb��v8¦Dr~h�¤pby{h~v8nwigfwpq�klmfwpbnD¤Bk�� i�h~nwl`k AEBED F/G)�tpBith~� uDr~kq��kqn�y{k}��� &egfDk!uDx{vvb�(vB¦Dr�h~¤ pGy{h�vBnwiF¤Bk}nDkqx|pby{kb��¦�� AEBCDCFHG l�v8nwi�h�i�y�vG�©�gkqr�r �j��vBxz�\kb�#nDk�i{i(lmfokblm¨oi�v8n�k98#uox{kbizi�h~v8nwi6h~ny{fDk©i�uwkbl�h���lqpby{h~v8n�pGnw� i{pGyzhji���pG¦Dh�r~h�y���lmfokblm¨oiXvBn\v8u�k}x|pGyzh~v8nwigpbnw�����onwl�y{h�vBnwi��tfDh�lmf�pbx{k©�#k��wnokb� h��\uDr�hjl�h�y{r��$ ��hjp6uwvi�y|l�v8nw�#h~yzh~v8nwi & �=egf��wi`�&��v8x=k98opG� uDr~k�h�n#�8pGxzhjpbn#y i=pbnw� uDxzk���pGnw�!uwvi�y&��l`vBnw�#h�y{h�vBnwi�pbx{k$x{kb��Dh~xzkb�\y{v¦�k©�gkqr�r �j��vBx{� kb����vBxz�¥�Dr�pGk� pGnw�¥���Dnwl`y{h~v8n!�#k��&nDh~yzh~vBn&iQ���wi�y�pG¤8x{kqk©�th~y{f y{fDkqh�xti�h~¤Bn&pGy{�ox{kbi`��£&v8xtk98opG�\uDr�k�y{fDk(�gk}r~r �j��vBxz�\kb�#nokbi{i�vB¦or~h~¤ pGyzh~vBn!��vBx /=&�JIK@�LM &N(+�h�i /

9;: B=<�F�> 9@?(A �������� . /�%�'*)F� /=��JIK@�LM &N�+ $�. & /:?�@:AB *.>)FCEDF.>@:) ����� �

(=vByzk6y{f&pGy©i��wl|f�p¥xz�Dr~k(¤8vkbi=�gk}r~rX¦wkq�vBn&��i�h��\uDr�k�y��#uwk��Ilmfokblm¨�h~no¤6¦�� xzkb��Dh~xzh~nD¤.$IpBi=uwpbx{y�vb�>;�=�£ &tyzfwpGyy{fDk(x{k�l��Dx|i�h~v8n h�n#�v8r~�kb�Fh~n!yzfDk$�#k��wnDh�y{h�vBn!vG� /=��JIK@�LM &N�+�¦wk6i�fDvb�tn�yzv¥¦wk(�gkqr�r �j��vB�Dn&�#kb���egfDk$i{pGyzhji���pG¦Dh�r~h�y���uDxzvvG��vB¦Dr�h~¤ pGy{h�vBn\��vBx �!v:v�w '*xyl(=��JIK@�L^h�i

BDCEC"F ?HGHC : B=<�F�> � ! �."�$ !

A/:?�@:AB *.>)*C DF.>@:)�� �$# ��%�'*)*�$l�.>@:)m' $ $ �g�Dm c'K./- .0 &:/�%�'*)*�$l�.>@:)m'� "!� $ ���DK c'K.

I Dm c'q. /:?�@:A: *.�)*C D*.�@:)�� � � � �EDK c'K. � $ �g�Dm c'K. �1 � �s;4AHG �&%('*)*�$l�.>@:)m' $KDm c'q.F- .4 -&

Page 24: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� �� ��� ����� ����� ������� � � ����� ��� ����� ������� � ��� � )

�=h��kqn�p!i�y|pGyzk9�$# �&%('*)*�$l�.>@:)m' $ $ �K�Dm c'q. - .4 -&th�n��tfDhjl|f�y{fDkFuox{kbl�v8nw�#h�y{h~v8n�fDv8rj�Di`�Xy{fDkqxzkFhji�pbn�vB¦Dr�h~¤ pGy{h�vBn)y{vuDx{vb�k�yzfwpGy�y{fDk}x{k(k98�hji�y igp�i�y pGy{k$h~n\�tfohjl|f yzfDk(uwvi�y l�vBn&�#h~yzh~vBn;fDvBr��Di��egfDk(x{kbp8�#kqxthjigxzk���kqxzx{kb�¥yzv\¡�uDuwkqnw�#h 8!¡ ��vBx��\v8x{k(�#k}y|pGh�rji`�

� ��� � ��� ��$��%�("�$ �� �� #" &�� � $ ��%�("%$ �� $� �

egfDhji�i�kbl`y{h~v8n�uDx{kbi�kqn�y|i�p ¦Dxzh~k�� i��o�\�!pGxz�Nvb�$i�v8�\k;i{pbr~h~k}n#y6��kbpby{�Dxzkbi6vG����� � k!uDx{kbi�kqn�y¥v8nDr~��k}nDvB�D¤8f�#kqy|pbh~r^��v8x(x{kbp8�#h~nD¤!yzfDhji(stkquwvBx{y'�^yzfDk¥xzkbpB��kqx(hji�x{k���k}x{x{k�� y{v;vBnDk�vG��y{fDk��!pbn#�!¤Bvv���¦wvvB¨oi6vBn�� $�k� ¤o�*���pq� L ##� $uDh : L , &���v8xt�\vBxzk(�#kqy pGh�rji��

� ���)��� �*��� �!& � � ��&� '�%��� � � � ��� #&�'n;�!pGn��!�tpq�oi �)hjit�kqxz��i�h~�\h�rjpbxgy{v �(��� /wh~n�u&pGx{yzhjl��orjpGx}��h~y�hji�p\�\v��#kqr�� v8x{h�kqn#yzkb�\i�u�k�l�h���l}pGy{h�vBn�yzkblmf �nDhj��Dk(¦wpBi�kb� v8n��!pbn#� �Ii�vBxzy{kb�\uDxzkb�#h�lqpGyzk(lqpGr�l��Dr��wi���egfDk(�!pGh�n!�#h���k}x{kqnwl`kbig¦wkqy��gkqkqn!yzfDk(�!pGyzfDkq�!pby{hjl}pGrrjpGno¤B�wpb¤BkbitvG�t�§pGn&� �(��� pGxzk$i��D�\��pGx{h 4qkb�6h�n $ kbl�y{h�vBn #� %F¦wkqr~vb�(�� it�Dpby|p6�\v��#k}r~r~h�nD¤6h�ig¦wpBi�kb�\vBn � < - � _ � � -�] $ hI� k���DnwpGn&pGr~�oi�k�� y��#uwkbi:&|��h~n�y{kq¤8kqx|i`�#uwvb�gkqx�i�kqy|i`� J�pGx{yzk��i�hjpbn�uDxzv��#�wl�y i���pGn&��]qd�� -/0�c _ � � -�] $�h~r~r��wi�yzx|pby{kb��¦wkqr~vb�9&|�!¡�r~r�vByzfDkqx(y��#uwkbi$pGx{k��#k��wnDk�� h�n�y{kqxz�!i=vb�y{fDkbi�k��egf��wiQ��vBx�k98opG�\uDr�k�B¦Dh�nwpGxz�!x{kqr�pGy{h�vBnwitl}pGn!¦wk�xzkq¤pbx|�#k���pBi�i�k}y|igvG� uwpGh�x|i����� ��� � ��i� �

pGnw�Nu&pGx{yzhjpbr ���onwl�y{h�vBnwi$lqpGn)¦wk\x{k}¤pGx �#kb��p8i�xzkqrjpby{h~v8nwi(i��wl|f)y{fwpby6kq�kqxz��kqr�kq�\kqn�ytvG��yzfDk �#vB�!pbh~n)y��#uwkfwpBi�pGy��\vi�ygv8nDk$l�vBxzx{kbi�u�v8nw�#h�nD¤\kqr�kq�\kqn�y�vG�-y{fok�x pGnD¤8k6y���u�k �wi�vFy{f&pGyt��vBx�k98Dpb�\uDr�k� �j �� � ��� _������� � � � � ���E_��� � � � � � %�� � ��� ��� � %�� � � ���

� iQ��pGy{fokq�!pGyzhjlqpbr#y���uwkbigx{kb���wl�k�y{v�i�k}y|igvG��yz�DuDr�kbiQvb�kqx�¦wpBi�hjl=y���u�k�i��Dizlmfokq�!p�y��#uwkbi�¤Bh~�k©x{hji�k�y{v�[ � � � @� � w]B�¡ i�y|pbnw�DpGx �I0�c#_���-H0�c#_���dcC.X_���� . ���j_�*!$uDh : L ,Xh�ig�wi�kb�!�th~yzfN���Degfok6nDv8y|pGyzh~v8n ��x{v8� y{fDk(y{vv8r~¨�h~y��tfDhjl|f�th~r~r�¦wk��&i�kb�!¦�k}r~vb�Kh�nwl�r��w�#kbi /

�� � h�igy{fDk$i�kqy�l�vBn&i�hji�y{h�nD¤¥vb��pbr~r�i�kqy|igvb��kqr~k}�\kqn�y|i%��xzvB� �

�� � h�igy{fDk$i�kqy�l�vBn&i�hji�y{h�nD¤¥vb��pbr~r��wnoh~y{k$i�kqy|igvb��kqr~k}�\kqn�y|i%��xzvB� �

�� � � xzkquDx{k�i�kqn�y|itpbr~rXy{v8y|pbr����Dnwl�yzh~vBn&iQ��x{vB� � yzv ��� � � $ � � � &�x{k}uDx{kbi�kqn�y|igpbr~rXuwpbx{yzhjpGr $j�wnDh�y{k-&����Dn&l�y{h�vBnwiQ��xzvB� � yzv ���"! � xzkquDx{k�i�kqn�y|itpbr~rXx{k}rjpGyzh~v8nwigvBn �$# � i�kb� � hjigyzfDk$i�kqy�l`vBnwi�hji�yzh~nD¤�vG� pGr�r��wnDh�y{k$i�kb��Dkqn&l�kbiQvb��kqr�kq�\kqn�y|i%��xzvB� �

¤Bh��kqn!p6�wnDh~yzk$i�kqy l��&% l�hjigyzfDk$lqpGx �#h~n&pGr~h�y��¥vb��l ¤Bh��kqn!pFuwpGxzy{hjpbr����Dnwl�yzh~v8nH�!�D�#v8� � hjigyzfDk$�#vB�!pbh~n\vb� ����x|pbnJ� h�igy{fDk(x|pbnD¤Bk$vG�"�

Page 25: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� 5 ��� ��� ���%��� ���� ��������� ����� � �

� ���)� � ���*� & � � � ������ #" �%��&� '�)(�'n;y{fDh�i=i�kbl�yzh~vBn;�gk$h~r~r��wi�yzx|pby{k(y{fDk\�§nDvBy pGy{h�vBn�v8n�uwpGxzy|i=vb��y{fDkFk�8Dpb�\uDr~k©�wi�kb�!h~n $kbl�yzh~vBn #� ##� � pG¦wvb�k�= xzh~�\h�y{h��k $ �DnwpbnwpGr��Di�kb�'&�y���u�k�itpGx{k�lqpGr�r~kb� � < - � _ � � -#]�pbnw��pbx{k$�#kbl`rjpGxzkb�\y{f��wi /� `7a�b:dKe4^�f�h*e4ac^ �

¡ _ � � -;]qd�� -/0�c���l�vBxzx{kbi�u�v8nw�#h�nD¤\x{v8�D¤Bfor~�\yzv¥�(�©� igl`vB�\uwvi�h~yzk�y���uwk�#h�ig�tx{h~yzy{kqn /\E]F^�X�� e4a�^>]d � X �na��Md&_�� `7acbBdqe4^gf�h*e4ac^e4]F^�XZd&_"-����Z\E]*^gXd � X �na��Md ��� �c^��<e �� e�_Fe4]*^gX!d ��d � X �na��Md� � � e � 3d � X �na�� d

�'n)¤Bk}nDkqx|pbr���p�]}d ��-/0 c�l`vBnwi�hji�y i�vb�©p�n&pG�\k.$�k� ¤o�P%�'*)F�$l .�@:)K'�pG¦wvb�k-&|�-]qd�� -/0�c <&cDa�� cD[�.1-#]6�th�y{f�i�kqy�#kbl�r�pGx|pby{h�vBnwi%$r /=��JIK@�L A/ � ?�@:AB *.>)*C DF.>@:)��.n'*)F�$ 2/|i�k��U%�'*)F�/h~n\yzfDk�k98opG� uDr~k�pb¦�vb�k-& ��pGnw�!pF[ ��� �;�tfDhjl|fhji�p�uDxzkb�#h�lqpGyzk=k98�uDxzkbi{i�h~nD¤$l�v8nwi�yzx|pGh�n#y i�vBn\yzfDkbi�k��8pGxzhjpG¦or~kbi`���Qk}x{y{h�lqpGr ���C8�y|pbu�v i�h�y{h~v8n!�\kbpGn&i�l�vBn���Dnwl�yzh~vBnh~n�� /¢��v8x=k98opG� uDr~k�yzfDk(¦�v���� vb�J%�'*)*�$l�.>@:)m'(l�v8�Drj�\h�nwi�yzkbpB�!¦�k(�txzh~y{yzkqn

d � X �ra��Md� ��� �c^�� e � � � eg_*e4]F^�XZd �!d � X �na��Md� � � e � d � X �na�� d$�lmfokq�!pBi�lqpbnN¦wk�h~nwl�r��w�#kb��h�nNv8y{fDk}x(i{l|fDkq�!p8i /�h�nwl�r~�&�#h~nD¤ p xzk���kqxzkqnwl�k$y{v!vBnDk i{l|fDkq��p h�nwi�h��#k�pGnDv8y{fDk}xhji=kb��Dh��Bpbr~kqn�yty{v;p8�D�#h~no¤\y{fDk6�&x|i�y i{l|fDkq�!p ig�8pGxzhjpG¦or~kbi�pbnw��¦�v�����y{v\yzfDk�i�kbl`vBnw�� i�� (=vByzk6yzfwpGy}�%�onDr~h�¨k�(��� i 1 l�v8�\uwvi�h~y{k(y���u�k�i >#�DyzfDk��wkqr��Digh~n��§i{l|fDkq�!p i�pGxzk6nDv8ytvBx|��kqx{kb����¡ [�� � ��� � � ��d � X �ra��Md�� hKd��Fe4]*^gX!d�� e�� � �

x{kquDxzkbi�k}n#y igpFy{kqxz� i�yzvBx{k(�th�y{f;i����¥¦wv8rXi�k}y Dm Fpbnw� yzkqx{�Vi�k��¢�Dk}nwl�kJ.RL��£&�onwl�y{h�vBnwitl}pGn�¦wk$�#k��&nDkb�\�#h�pFc���1� 0�c#_ � d � - � � �j_��1� � ](i��wl|f;pBi

d��*f �c^�]�_�� j �� b _�� �Zd��Ff��c^�] � b � b�� b

$�lmfokq�!pBi�pGxzk6pbrji�v¥�wi�kb�\y{v�k98�uDx{kbizi � � -�abc#_��1� � ]-/X��vBxtk98opG� uDr~k� ������] 5 � � X �ra��\E]F^�X���e4ac^�]\E]F^�X���e4ac^�]��d��/_c`2acb:dKe4^�f�h*e4a�^d��&�% d � X �ra��Mdd � X �na��Md�� d � X �ra��Md%� ��d�� �e4]F^�XZd�� e4]F^�XZd

= xzh~�\k����8pbx{hjpb¦Dr~k�i=i�y|pGn&�§��v8x�y{fDk$�8pGr~�okFvG��y{fDk�i�y pGy{kF�8pbx{hjpb¦Dr~k�pq��y{kqx©kq�8pGr~�&pGy{h�vBn;vG��y{fDkFv8uwkqx|pby{h~v8nX�Xpbnw��DnDuDxzh~�\kb���8pbx{hjpb¦Dr~k�i©��v8x6yzfDk\�8pGr��Dk¥¦wk���v8x{k\k}�Bpbr~�wpby{h�vBnX� $ � �)l�vBn�y{x pBi�y}��h~n)uwvi�y l�vBn&�#h~yzh~vBn&i6�(��� �&i�kbi

Page 26: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� �� ��� ����� ����� ������� � � ����� ��� ����� ������� � ��� � 7y{fDk��DnwpbnDnDvBy pGyzkb�\�Bpbx{h�pG¦Dr�k=yzvFi�y pGnw�F��vBxgyzfDk�u�v i�yz�Bpbr~�Dk pGnw�¥yzfDk©pGnDnDv8y|pby{kb�\�8pGxzhjpG¦or~kt��vBxgyzfDk�uDx{kq�8pbr~�Dk� &= xzh~�\h�nD¤tptizlmfokq�!pgl`vBx{xzkbi�uwv8nw�DiXy{v�uDx{h��\h~nD¤�pbr~rv�lql��ox{x{k}nwl�kbi�vb�wizlmfDk}�!pQ�8pGxzhjpb¦Dr~kbi�yzfDx{v8�D¤Bf$y{fwpby�izlmfokq�!p#�

\E]F^�X�� e4a�^>] �d � X �na��Md � _��J`7acbBdqe4^gf&hFe4ac^e4]F^�XZd � _�-����O\E]*^gXd � X �na��Md�� ��� �c^�� e �� e�_Fe4]*^gX!d � �!d � X �ra��Md� � � e � Hd � X �na��Md��

� �\l�v8n#�k}n#yzh~vBnL�#y{fok�n&pG�\kbi�vG��h�nDuD�Dy $�vB�DyzuD�Dy &g�8pGxzhjpb¦Dr~kbigk}nw�\�th~y{f ( $ � & �

� ���)��� � ��*� ����� ���'� � � �*�¡ ]qd���-H0�c dcC.�d ��.���]\fwpBi\¦wkqkqn �#kq�kqr�vBuwkb���tfDhjl|f�pbr~r�vG��i�i{l|fDkq��pBi6y{v�¦�k;�!pGnoh~uD�Dr�pGyzkb��r~h~¨k!yzkqx{�!ih~n�yzfDk =�x{kb��hjlqpby{k J�pGrjl`�Dr~�wi`�)£&v8x6k98opG� uDr~k�Xh�� l D���'*�J8 � pGnw�Pl D���'m�J8H �pGxzk\_ � � - d � 0 �^c�_�� [�.1-!$ hI� k�i{l|fDkq�!p!�Bpbx{h�pG¦Dr�kbi6�tfDhjl|f pGxzk�l`vB�\�\v8nNyzvN¦wv8y{f f&p��k!yzfDk;i{pG� k\y��#uwk-& �QyzfDkqn l D���'*�J8 � � l D���'*�J8/ i�y|pbnw�Di���v8x�p�i{l|fDkq��p��tfovi�k�i{l|fDkq�!p\�8pGxzhjpG¦or~kbi$pGx{k y{fDk\�onDh~v8n�vG�©y{fDv i�k\vb��l(D���'*�J8 � pbnw�Pl D���'*�J8/ #�pGnw�!�tfDvi�kF¦�v���� h�i�yzfDk$l�vBn���Dnwl�yzh~vBn;vG��yzfDkqh�xt¦�v���h~kbi`� $h~� h~rjpbx{r��� I l D���'*�J8 � l D���'m�J8H ¥h�i=p�i{l|fDkq�!p�tfDvi�k�¦oh~nw�#h�nD¤i�pGxzk�y{fDv i�k�vb� l(D���'*�J8H 6�th�y{f\yzfDvi�k�vG� l D���'m�J8 � x{k}�\vb�kb���8pGnw�\�tfDv i�k�¦wv��#�\h�iQyzfwpGytvb�l D���'*�J8/ �k�8#h�i�y{k}n#yzhjpGr�r~�!��wpbn#yzh��wkb��vb�kqx�y{fokF¦Dh~nw��h~nD¤ i vb�!l D���'*�J8 � ��i��Dh~y pG¦Dr�����wpGr�h��wk��0/g��vBx(k98opG�\uDr�k�I %�'*)*�$l�.�@:)K' � �!v:v�w '*xyl =&�JIK@�L^k98�uwpbnw�Dity{v

\E]F^�X���e4ac^�]d��/_c`2acb:dKe4^�f�h*e4a�^� d � X �na�� d � _ ��`7acb:dKe4^gf&hFe4ac^��Fe4]*^gXZd � _"-���� \E]F^�X$�

d � X �na��Md�� ��� �c^�� e �� e�_Fe4]*^gXZd � �!d � X �na��Md� � � e � d � X �na�� d � �d��&�% d � X �na��Mdd � X �ra��Md � d � X �ra��Md%� �cd�� �e4]*^gXZd�� e4]*^gX!d

� ���)��� � ��� � �)( (�� ����� � &$� � ��� �! #"$�%�!& '�)(*�¡ n��D��¦�k}x�vG� �#h ��kqxzkqn�y�pGuDuox{vp8lmfokbigy{v$uDx{vvb��v8¦Dr~h�¤pGyzh~v8n\¤Bkqnokqx|pby{h~v8n!pGn&��xzkbpBi�vBnDh�nD¤Fpb¦wvB�Dy��;i�u�k�l�h���l}p �y{h~v8nwigfwpq�k(¦wkqkqn!uDx{v8uwvi�k�� * � vv : L � � � L #� � vBx L -,X¦D�DytyzfDk$�¢�okbi�yzh~vBn!vb��yzfDk(�\vi�y�pGuDuDxzvBuDxzhjpby{k6¦&pBi�kr~vB¤8hjlFi�y{h~r�r�i�kqkq�!ity{v!¦wkFvBuwkqn / ��v8x�k98opG�\uDr�k�wy{fDkqxzkF�#vk�i�nDv8y��k}y�i�kqkq� yzv\¦wk\pbn�pb¤Bxzkqkb�)pGuDuDxzvp8lmf)y{vx{kbp8i�vBnoh~nD¤ pG¦wvB�oy��Dnw�#k`�wnDkb�#nokbi{i *��BvBn L @ ¦=,��egfDk�uDxzvvG��v8¦Dr~h�¤pGyzh~v8n\�tfDhjl|f\fwp8igx{kbl`kqh~�kb�6� vi�y�pGyzy{kqn�y{h�vBn\h�n\y{fDk©r~h~yzkqx|pby{�Dxzk $�k� ¤o�%* � vv : L , &�h�iQyzfwpGytvb�i�fDvb�th~no¤�pbnNv8uwkqx|pby{h~v8nNh�i�h~n��vB¨8pG¦Dr�k�w¦#�;uDx{vb��h~nD¤\yzfwpGy(h�y|i�uDx{k�l�vBnw��h~y{h�vBn�h�i=nDvBy(�Dnoh���vBxz�\r~���IpGrji�k�FegfDk� -�c!� -�]�_ ��a�-#d � � � �j_��1� � vb��pGn!vBuwkqx pGyzh~vBn

Page 27: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� : ��� ��� ���%��� ���� ��������� ����� � �

�� ��e �ce4]���h��&]FX �� �/_���� _������

�tfDkqx{k�Jl�.>8�.n'gl D���'*�J8 �� l�.>8�.r'�l D���'*�J8�� l�.>8�.r'�l D���'*�J8 � �Dh�it�#k��wnokb�\y{v�¦�k� ��� _���� � � e ��e4]�� h��&]*X � � �� �

�'n§p¥y{v8u!��r~kq�kqr-i�uwkbl`h���lqpby{h�vBnX�wy{fDk$�gkbpb¨kbi�y�uDxzkbl�vBn&�#h~yzh~vBn§i�y pGy{k�i yzfDk6� h~nDh��F�D� uox{vBuwkqxzy{h�kbi�vb��y{fDk.$��Dn!�uDx{h��\kb�'&-i�y pGyzk6izlmfokq�!p6pbnw� 9 ((i��&lmf!y{f&pGy�y{fDk�v8uwkqx|pby{h~v8n�lqpbn!¦�k(h�n#�v8¨kb����$ ��n\vByzfDkqx��gvBx �Di��Dh�yt�#k`�wnDkbiy{fDk(��vB�!pbh~n\vb���#k`�wnDh~yzh~v8n\vG�-y{fDk©vBuwkqx|pby{h�vBnX� &FegfDk$izlmfDk}�!p(i�fDv8�Drj�\¦wk(k98#u&pGnw�#k��\pGnw�\h�y|ig¦wv��#�!i�h~�\uDr�h ��wkb��y{v;pbn�kb��Dh~�8pGr�kqn�y=¦D�oy(i�h��\uDr~k}x�i�y|pGyzkq�\kqn�y��tfDhjl|f�hji 1 kbpBi�h~r���i�k}kqnNyzv!¦�kFnovBy��IpGr�i�k�>��¥¡�n�k98Dpb�\uDr�klqpGr�l��Drjpby{h�vBn!vG� p uox{kbl�v8nw�#h�y{h~v8n!hjiti�¨k}y|l|fDkb�Fh~nI$kbl�yzh~v8n %o�!)�� � �s�h�¤BvBxzvB�wituDxzvvG�Ii=h�n �§pGxzk$i�vB� kqy{h��\kbi^�txzh~y{yzkqn!h~n!y{x pGnwi���vBxz�!pGyzh~vBn&pGr�i�y���r~kA/� � b ] � � �<bE] � � ^>]� dKacb � � �<bE] � � ^>]� dKacb �

�tfDkqx{k$kbpBl|f!r~h�nDk(hjitvB¦Dy pGh~nokb����xzvB� h~y i�uDxzkb�#kbl`kbi{i�vBxt¦���pbuDuDr�hjlqpby{h~v8n!vG��pGn 1 pGr�¤Bkq¦ox|pGh�l >¥h��#kqn�y{h~y���y{v�vBnDkvG�(h�y|i�i��D¦Dyzkqx{��i /\k� ¤D� yzvNyzx|pGn&i'��vBxz� 9 � = � h�n#yzv 9 � =Nv8x¥yzvNyzx|pGn&i'��vBxz� � 9 / � � ) � h~n�y{v� 9 / � ) � �6��eXv)�!pG¨k\yzfDk�uox{vvG�Ii�r~kbizi6y{kb�#h�vB�wiFy{v)x{k�pB���ti�kq�kqx pGrty{x pGnwi���vBxz�!pGyzh~vBn&i¥pbx{k�vb��y{kqnpGuDuDr�h~kb�!h~n§p¥i�h~nD¤8r~kFi�y{kquL��yzvB¤Bk}y{fDkqx©�th~y{f;kqnDv8�D¤Bf�h�n#��vBxz�!pGyzh~vBn\��v8x�x{kbp8�#kqx i�yzv\l�v8n#��h~n&l�k(y{fDkq��i�kqr��kbiQvb�y{fDk(�8pGr�hj�#h�y���vG�-y{fok6i�y{kquL�

� �� � � � �#� � $ � �� ��� � �("�� ��� �("%$��%� � � �� ��� � �����

egfDhjiFi�kbl�y{h�vBn l�v8�\uwpGxzkbi6y{fok � vBx{k�l�vB�\� vBnDr����wi�kb� p8i�uwkbl�y i vb��yzfDk!�(����� $/; pGn&� � �!pGyzfDkq�!pby{hjl}pGrrjpGno¤B�wpb¤Bkbi`���th�y{f;pGn;kq�\uDfwp8i�h�iQvBn;fDvb�K� ����� $ ;�l�vBn&i�y{xz�wl�y i�yzx|pGn&i�rjpby{k(y{v�y{fokqh~x���l�v8�Dn�y{kqxzuwpGxzy|i��

� ���*��� �!& � � ��&� '�%��� �� ��� ��� ��� �¡�y(�wx|i�y�i�h~¤8f#y}��y{fDk;��pbnw���(����� $/; novBy|pby{h�vBnwi�pGuDuwkbpbx\��Dh�y{k �#h ��kqxzkqn#y}��¦D�Dy6��v8xFy{fDk\� vi�y$uwpGxzyFy{fDk�#h ��kqxzkqnwl�k�h�iQ�IpGh�x{r~� i��ou�k}x���l�h�pGrI��egfDk6y��gvF��pGh~n��#h ��kqxzkqnwl�kbi�pGxzkA/

eQ��uwkbi��#���Dn&l�y{h�vBnwitpbnw� �8pGr��Dkbitpbx{k$�#hji�y{h�nD¤B�Dh�i�fDk���h�n!�(����� $/;�� eQ��uwkbitpGnw�\���Dnwl�yzh~v8nwitlqpGnonDvBy�¦wk�u&pBi{i�kb��p8i��8pbr~�DkbitvBxtxzkqy{�ox{nDkb�!p8i�xzkbi��Dr�y|igh�n � �����

egfDk��!pbh~n fDhji�y{vBxzhjlqpbrtx{kbp8i�v8n ��v8x¥yzfDkbi�k)��h ��kqx{k}nwl�kbi6h�i h�n#yzh~�!pby{kqr��Nr�h~nD¨kb���th�y{f yzfDk��&i�k�vG� �(��� p8ip ��kq�kqr~v8uD�\kqn�y $ novBy ���wi�y$i�u�k�l�h���l}pGy{h�vBn0&��\kqy{fov����XpGn&�Nhji=¦wkq�v8nw��y{fDk�izl�vBuwk\vb�ty{fohji=xzkquwvBx{y}��£&xzvB� px{kbp8i�vBnoh~nD¤��#h�kq�tuwvBh�n#y}�qfDvb�gkq�kqx}�qy{fDk}x{k�hjiXp�i�kbl`vBnw��x{k�pBi�v8nB/ . ��'�� )g@c@r+�. ��'�@:)*=ZCEA v '*)KL,=�;4A&Q������ D CE)*)m'*A .RL,=

Page 28: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� �� ��� ���*��� � ��� � � ��� ��� ����� ������� � ��� ���(����� � ��L@:A L,=� /C � � @:)K.0 �� A ;<.r' G 8�L C 'g $ k� ¤D�%�&nDh~yzk(i�kqy igpbnw�¥�wnDh~yzk����onwl�y{h�vBnwi:&�pbnw� ��pGyty���u�k�i�� =-pGx{yzr~��y{fDk©x{kbp8i�vBn&i��vBx�y{fDh�i\pGxzk ��vB�onw�DpGyzh~v8nwpGrI�=pbnw� ��vBx�k98opG�\uor~k!l�v8nwl�kqxzn yzfDk�yzx{kbpby{�\kqn�yFvG� kb�¢�&pGr~h�y���¦wkqy��gkqkqn�h�n#�wnDh�y{k�Bpbr~�Dk�i���� � �Dy�uwpGxzy{r~� pGr�i�vFyzfDkq� pGx{k(uDx pBl�yzhjlqpbr /X��vBxtk98opG�\uor~k�Bh�ygh�iQ���wlmfFk�pBi�h�kqxty{v$x{kbp8i�v8n�h~n y{fDk�yzfDkqv8x{�vG���wnDh~yzk(i�k}y|iQyzfwpGn;h~nX��izp�� ���wkqx{�\k}r~v��I£Dx|pbnD¨kqr $kqytegfokqvBxz��wi�h�nwl�kt��vBxtk98opG�\uor~k�y{fDk=��v8x{�\k}xQf&pBitpFi�h��\uDr�k�'n&�#�wl�yzh~vBn =�x{h�nwl�h�uDr~k $�i�kqk$£^h~¤8�Dx{k� #� # & �¡�i�h�y6fwpbuDuwkqnwi���yzfDk\xzkbi�yzx{hjl`y{h~v8nNyzv��wnDh�y{k��Bpbr~�Dk�i�hji(vG��yzkqn�nDv8yFvG�k}x{r~�§l�vBn&i�y{x pGh�nDh~nD¤���v8x6yzfDk!i�uwkbl`h��wkqx}��'n)�IpBl�y}�^y{fokqx{k\h�i�kq��hj��kqnwl�k)*��=v�� LH� ,�yzfwpGyF�!pbn#�)i�uwkbl�h���lqpGyzh~vBn&i��tfDh�lmf)�wi�k h~n#�wnoh~y{k�i�kqy i +�k � ¤D��pbr~r�y{fDki�uwkbl�h���lqpGyzh~v8nwi6h~n *���pq�E: 7 , + lqpGn�¦wk�xzkq�tx{h�y{y{k}n�i�v)y{fwpby¥yzfDkq���&i�k $�fDkqxzkb�#h~y pGxzh~r~�=&t�wnDh�y{k;i�kqy i v8nDr~� � �'nuDx|p8l�y{h�l�k�Dh~y�vG��yzkqn)i�h��\uDr��¥�\k�pGnwit�wi�h�nD¤F�wnDh~yzk6uwvb�gkqx i�kqy i $ � &�x|pby{fDkqx©y{fwpbn)pGx{¦oh~y{x pGxz� uwvb�gk}x(i�kqy i $ � & �pGnw�\�wnDh~yzk=���Dnwl`y{h~v8nwi $ � &�x|pby{fDk}xty{fwpbn�y{v8y|pbr $ � &�vBx�uwpbx{y{h�pGr $ � &����Dnwl�yzh~vBn&i��¡=uwpGxzy^��x{v8� yzfDktk98ol�kquDyzh~vBn&i^nDvByzkb�FpG¦wvb�k�y{fok�l�vBnwi�y{xz�wl�y|i-pGnw�FuDx{h��\h~yzh~�kbiD��x{v8� vBnok=�\k}y{fDv��$lqpGn�kbpBi�h~r��¦�k��\v��#k}r~r~k���h�n�y{fDk�vByzfDkqx�� kqy{fDv������egfDk�x{k�i�y�vb�ty{fohji�i�kbl�y{h�vBn)l�v8�\uwpbx{kbi=yzfDkF�\v8x{kFl`vB�\�\v8nDr~� �wi�kb�pBi�uwkbl`y|i^vb�wy{fDk��(����� $/;!pGnw�¥���!pGyzfDkq�!pby{hjl}pGrbrjpbnD¤B�wpb¤Bkbi`��th~y{f�pGnFkq� uDfwpBi�hji�v8n6fDvb���(����l`vBnwi�y{x{�&l�y|iy{x|pbnwi�r�pGyzk�yzvFy{fDk}h~x=�;l`vB�Dn�y{kqxzuwpGxzy|i`�gegfDk©�!pGh�n\uD�Dxzu�v i�k(vG�-y{fok6l`vB�\uwpbx{h�i�vBn hjigy{vF��pG¨kty{fok6��hji{l`�wi{i�h~vBnvG�-uDx{vvb��y{fDk}vBx{��pGnw�\uDxzvvG��v8¦Dr~h�¤pGyzh~v8nwi�h�n#* � £ ;�� L %A,��\vBxzk(pBl}l�kbi{i�h~¦Dr�k�y{vFxzkbpB��kqx|iQ�Ipb�\h~r�hjpGx-�th~y{f��;¦D�DynDvBy(i�v¥�IpG� h~r~h�pGxt�th�y{f��(�����wegf��wi`��uwpGxzy{h�l��Drjpbx�nDv8y{kFhjity|pb¨kqn�vb��pBi�uwkbl`y|i�vG���(����� $/;��tfDh�lmf;fwpq�k6nDv�#h~xzkbl�ytl`vB�Dn�y{kqxzuwpGxzyth~n����D¦D�Dyt�tfohjl|f�pbx{k(h~� u�v8x{y pGn�yQ��vBx�y{fok6��hji{l`�wi{i�h~vBn!vb���kqx{h���lqpby{h~v8n\y{k�lmfDnohj��Dkbi��

� ���*� � � �*�����

� ��� y���uwk6l`vBnwi�y{x{�&l�y{v8x l�v8x{x{k�i�uwvBnw��h~nD¤!��yzkqx{�y{kqxz�\h~nDv8r~v8¤B� nDvBy pGy{h�vBn y{kqxz�\h~novBr~v8¤B� nDv8y|pby{h~v8ni�kqy i � � � � �wnDh�y{k$i�kqy i � �!pGuwi ���� � �wnDh�y{k�$ uwpbx{yzhjpGr &����Dnwl�yzh~v8nwi � �h~n)��kbl`y{h~�k��!pbuwi �� � � �wnDh�y{k(h~n)��k�l�y{h��k����Dn&l�y{h�vBnwi �i�kb��Dkqnwl`kbi � i�kb��Dkqn&l�kbi � ����

e�pG¦Dr�k� �� � / $vB�\k �#h ��kqxzkqnwl�kbiQ��v8xty��#uwk$l�vBn&i�y{xz�wl�yzvBx|i`��(����y��#uwkbi�l`vBx{xzkbi�uwv8nw� yzv6� i-�#kbl�r�pGx{k��6i�k}y|i��'�nDr~h�¨kQyzfDk�� pGuDuox{vp8lmfL�¢fovG��kq�kqx}�G�(�©� ��pG¨kbiXp(i�yzx{h�l�y�#hji�y{h~n&l�y{h�vBn\¦wkqy��gk}kqn!y���uwkbi /�k � ¤D�-i�kqy i=pbnw��i�kb��Dkqnwl�k�igpGxzk$�#hji ��vBh~n�yty��#uwkbi`��(���,pbnw�N�)¦�v8y{f)fwpq�k(h~n�y{kq¤8kqx|i $�� &-p8i�p�¦wpBi�hjl�y���uwk�pGnw���#k`�wnDk6n&pGy{�ox|pGr-n#�D��¦wkqx|i $ � &�h~n�y{k}x{�!igvb�y{fDkq�§� � vByzf�fwpq�k J�pGxzy{kbi�hjpbn�uDxzv��#�wl�y i $ # &|��eQ��u�k$l�v8nwi�yzx{�wl`y{vBx i��tfohjl|f f&p��k(kbizi�kqn�y{h�pGr�r~��y{fDk$i{pb�\k�\kbpGnoh~nD¤�h~n;y{fDkFy��gv��\kqyzfDv��Di`��¦D�oy=��vBx��tfohjl|f)�#h ��kqxzkqn#ytyzkqx{� h~nDv8r~vB¤8�;pGnw� }vBx(nDv8y|pGyzh~v8n)pGx{kF�&i�kb���LpGx{ki�fDvb�tn�h�n;e^pb¦Dr~k� #� � ��(��� i&%�l`vB�\uwvi�h~yzk�y���uwkbi �l�vBxzx{kbi�uwvBnw��x{v8�D¤BfDr���yzv��)y���uwkFizlmfDk}�!pBi`��k98ol�kquoyty{fwpby=�wkqr��Di�pGxzkFvBx �#kqx{k����£&v8xtk98opG�\uDr�k�y{fDk(y���u�k

% / / 8 / �I / �

TV� W �$# �&%9$ 9 -c= & � %7;4AHG $ 9 -c= &��� �������'�62�"�������D�.��� �!#"%$#&('*)+ �-, .�,/�10 $782&3�4) ��� !�5 �$�5 � ! � �3� 5 �'�.��$ 5 ��8 "���6� ! 8 �6"�$&���3����� � 8 �66.� !87 5 ! ��" �6�:9 "��<;>=@? � � ":,

Page 29: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

@ ��� ��� ���%��� ���� ��������� ����� � �

l�vBxzx{kbi�u�v8nw�Dity{v�y{fDk���v8r~r~vb�th�nD¤\��y���uwk6izlmfokq�!p /

\�E_���_�\ �<b�� � ����� �

$IegfDk %R�$# �&% #���Dnwl`y{h~v8n!hjigk98�uDrjpbh~nDk��¥¦wkqr~vb�(� &�(��� ��vkbignDvBytf&p��k©p�novBy{h�vBn!vG��xzkqrjpby{h�vBnwi /��tfDkqn\nDk}kb�#kb���yzfDkq��lqpbn\¦wk�xzkquDxzkbi�kqn�y{k��FpBiti�k}y|iQvb��y{�Duor~kbivBxq��uDxzvG��hj��kb�Ny{fokq��pbx{k\novByFuwp8i{i�k�� pBi6�8pbr~�Dkbi`��pBi � vvBr�kbpGn!���8pGr��Dkb�N���Dnwl�yzh~v8nwi����(��� ��vkbi novByFfwpq�kh~n)��kbl`y{h~�k©i�k��¢�Dk}nwl�kbi`�#¦wpb¤itvBx�h~y{k}x|pGyzh~v8n $ � & �'=n y{fDk(vByzfDkqx�fwpGnw���D�(���+�#vkbigf&p��k p6y���uwk���vG� � vvBr�kbpGn!�8pGr��Dkbi���y��#uwk��Dnoh~vBn&i9$ � &|�wpbnw�\vBuDyzh~v8nwpGry���uwkbi����t�tfDhjl|f;pGxzk�novBy�h~n!y{fDkF�;�!pGyzfDkq�!pby{h�lqpGrDyzvvBr�¨#h�yq�

� ���*��� � � ( � &� '� ( � ��(�� � ��� �*������� � ��������������������� �!� �#"$"��&%��(')�*"+�&, �)-.�#���&-/�102�����3�!45�76��)������ ��8� �)9:�;�����=<>��"�"��*4?���%79&�*"����@'1�& �!��-��A'B�/���C'1�&6�6���D0�4?�����E6��&-����F��- �>"��*���G�����3���#6��H6��I�#����%:� / �� 0 �J0 �=0 � 0DKL0 � 0NM�0DO�0���� �P02Q 0 RH0 �Q 0 � RHS$ (8�����=��� �#�T0DUV�I')�#� �!�3�#<LWHX�YZ�G�![�, �@ ��(�!����A'B�����& �10V�����(�?��&�H, �)-�6��(���\��U�"��:0:<>�&-��)]��#6^,�"��:0����7�#,�,�"�[_�\�)��&, �)-/�*����-/�?�\�A'`�7��� 7 �&�4�����@�!�*a:���) 'B�I�BS &HbJ�� �\��-�� 'B�.�54?�������*���!�)����(�*"�"�[=�����H���*6��?6��*�*����%HU����? ��dce�T-��)����&�.�#�����&_�#-��;�!��6�67�*-�� 4T�* f��7gh�#U�"��3i�SZi�SbJ�&6�, �:�!�����C�\[�, �C ��1j ��������� ��%&��9:�C-��k�\�l���m'B�& �!��-�� 'B����-7�#A n�!�)"��*'1���&-@<>�� 'B�����&A�BSpoA��-��)]��#6�,�"��:0J����� ��Bj ��������& %q�#U �*9:�������-��� �� '1�*���r'B�&A�\��-�� 'B���&-s<>�� 'B�����& �$#:t&%u4?���k'`�v�k���w,A�#-����(�*"x<>�� 'B�����&y<>-��&6��# � ��� %n4?������ ���67�#��� ��Bj ��* lU�[ %7;4AHG�S3g5���39��#"����3�#<$�$#:t�% $ 9 -c= &?����� �H'B��-�-��I�\, �& ��x����������zU��� ����%E{ � 88| 9 -cIJ| = � }/S5z_�# 7WHX�Y~� �\�H�����;���#6^����&�.�#�����&7<>�&-��\�)"��*'B���&-�<>�� 'B�����& � /

�$#:t&%9$ 9 -c= &.�48�� 9 - �$#:t&%9$ 9 -c= &/� I � =g5���H�\4L�36��)������ ��5� �!�= ���cN�)-��T��?����/�*������s<>��-��\�)��'B��6�,�-��)���) �!���� � /+WHX�Yu4?-������*�

+ $ 9 &�� 9 / � � ) $ 9 & �4?���)-��3zE4?-������*�

9 / � � ) $ 9 & + $ 9 & �$ (8�����?���A�#�5�����)-��?45�&��"( 3UV����,�-��:�*<h�&U�"���%��#�����&@��3WHX�Y����;�!���*4y���A�#�?�*�J6��:�!�2j ������)"�[�6��#�[=9��#"����*� 9�#<h�![�, � � ���#���(�<>[ ) $ 9 &/S &;g5���)��-5����/�#������ ��<>�&-L67�#,^�# ^�\�*a:���) '1��'B��6�,�-��)���) �!���� �+�#-��H�#"k�\�� ���cN�)-��)��T0��E�#_�# �*"��&%��&� �?<��&�\�����&�S� �� '1�8WHX�Y~ ��:�*�5������\��,�, ��-��?-��T"(�#������ �B0����?�*"(�!�3 ��:�*�5��&���\��,�, �&-��?��&�����& �?�!� '/�7�&�5-��)"(�*������ �#"N��67�*%&�:0��-/�* �\������9:�3'B"��:�\��-��:0 �)�/'�S � ��6���"k�#-�"�[����� ��:�*����&���A�I9:�;�&, �)-.�#����-/�H�&CU �*%:�BS;g5���3,�-��:�#<������)��-�[7�#<�WHX�Y ��:�*�?��&��'B��-�-��)���"�[@�\��,�, ��-��=��t>�)]�,�-��*���\���� �BS� � > ) $ ! "8� � "04�2 � >7� $&"8� ������$&"�$&�� ��8&���8 7 �J�/���

Page 30: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� �� ���� ������� ������� � ������������������� � ���������������� i��

'B�& �!��-�� 'B� WHX�Y z�\�)��')�*-/ ��� �#"����![ 7 �&�4� % j �������, �*45�)-��\�)� � � ���6@U �)-J-/�*�%&� ;g-)�)�T� - � � ;D�)�!��)6�,��![367�*, � � ��67�#,�-.�#�%�� ��� �"� -/�*J�67�#,��*9:�)-�4?-������ � �#" � � �%$ � �)6�,��![@�\�Ia ���T 'B� &!' {2}�)���6��)-/�*���* @�\�Ia ���T 'B� & 9 -c=�-)(*' { 9 -c=�-)(�}�\�*a:���) '1�����*�� �c� ��'�8 v �\�*a:���) '1���/�*��" �K�K .�8:;<L: 'B�& 'T�#���T �#�����& �#+�, �%- ��(�!��-���U������* �'B�� ')�#���) �*������ 7 ��� 7 K - K �\�*a:���) '1���� ��('B�*� TV�c� �� �����3 �\�*a:���) '1���)"��T6��)��/� �c� ��� �( -/�*$ �\�*a:���) '1��"��)�%&��� � ���� %

g2�*U�"��;i�SZi/.LX8��cN�)-��) 'B�I����7����/�*������ �5<>�&-�9&�*"����;'B�� �\��-�� '1���&-.�BS

WHX�Y~� �&��05�:�&"��*�#7���T-�67���F� � ���# ��� � �&0 �# E�=, �&"�[�6���-�,����k'�'B�� ��������� �#"h'B�� �\��-�� '1�

/ � ! � 0 � � ��� _�� i �si � j �

Page 31: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� � ��� ����

� � � ��� � ��� � �����

g5���fjA-/�\��')�&�!���!��� �[��k���79:�)-�[_�\��6�,�"��3����@��� �*�=4?��"�"+U ��<��#6^��"��k�#-����E67�#�[l-��*�& ��T-/�).;������� 05��-����A ��)[05�:�����=�)]��*6�,�"��G<>-��&6 ��������������-��k�#"D�����-��� �� 'B����������3�����=z����B< �"!#�%$'&(��Y*)+$-,')+. & �0/214365 '�S87:9 14; , ; �+<>=2�"!#�9#? ; =2?+@A9#=2�B� ;C; �%$D9 1 )E. ;F1HG>1 .I)E! 1 9![J?+KL9C=2�3z*)+$'<sWHX�YM) /2/ !#?N)�&O=2� ; 9#? ; [ ; 9C� GP;Q/ �+& 1 jR&%)E9 1 ?�$�S

SUT+V WYX[Z]\_^"`aX[b XJcedgfgh=2� / !#?�U2.i� Gj1I; 9#? ;F/ �+& 1 K>[U) ; [ ; 9#� G K ?�!k!#�+&l?6!O< 1 $2m�U 1 !#9C='<2))[ ; SJn / �"!O)E9 1 ?6$ ; )E!#�o!C�*a0, 1 !C�+<pK ?�!B)6<2< 1 $�m$2�%@ 1 $-K ?6! G )+9 1 ?�$rq2K ?�!8js$'< 1 $�m>9#=2�;U 1 !C9#='<�)I[]?EKt)pm 1iu �%$ / �"! ; ?6$rqv)E$'<wK ?6!8j'$'< 1 $2me9#=�? ; � / �%? / .i�x@y=2? ; �U 1 !C9#='<2))[ ; Kz)E.H.r?�$]){m 1iu �%$|<2)E9C�:S

SUT(} ~��*X ��^%`adg���*�B� ���e��� ^+c �gh=2�3z ;Q/ ��& 1 j�&")E9 1 ?�$ 14; )6<2) / 9#�+<>K !#? G & �0/21I3�5 '�S

���8�y�p�k�������'�h� �L�0�o�����D�(  �8������¡%¢D£¤�����'��¡�¥ �x¦�§©¨E� ¢ ���6�-�( Oª¥ �O� ¥ �( �� ¢ �:§ ¢ ¦«�D�O¬E��­©�+®¯  ¢D¡%° �(  ¡%¢D£±£0¡ �Q�( p§ ¢ �Q�0��+� ¡�¥8¥ �( ��-�(²#��§³¨+�#­³�+´

µ8¶i·C¸i¹�º+»+¼lµ8½(½%¾¿ ·#¶HÀlÁDº%Â�ÃQÄ �8�y�p�Å ¶i·C¸i¹6ºE»+¼�Æ ¿ à �Ç����� ÈÉ ���Ê�'�¿ ·#¶HÀlÁDº%ÂhË £ ¬ ° Å ¶i·C¸i¹�º+»+¼�Æ ¿

�L�0�� :� ¡ �Q�J� ¡  ���ÌL¬�¨ ¡%¥ § ¡%Í ­³�(  à ¿ ·#¶HÀlÁDº% §H ��Q�0�� :�O�¬%Î ¢D¡%° �( �§ ¢ �Q�0� Í § ¥ �F� £0¡ � Í ¬�¬+Ï ¡�¢D£ Å ¶H·#¸i¹6º+»+¼�Æ ¿§H  ¡ � ¡%¥ ��§ ¡ ­ÐÎIÑ ¢ ²#��§³¬ ¢*¥ �#­ ¡ ��§ ¢ ¦e�D�O¬+��­³�+®Ò  ¢D¡%° �( Ó�Q¬�Q�0�#§ ¥JÍ § ¥ �Q� £0¡ �N �´��L�0�� �� ¡ �Q�B§ ¢ ¨ ¡%¥ § ¡�¢ � ¿ ·#¶iÀ(ÁDº�ÂeË£ ¬ ° Å ¶H·#¸i¹6º+»E¼6Æ ¿   ¡ �0 v�0¬%Ì��Q�0�y¨ ¡ ­³Ñ0�( L¬%Î��Q�0�Ô :� ¡ �Q�¨ ¡%¥ § ¡%Í ­³�(  ¡�¥ � ¥ �#­ ¡ �Q� £ ´

µ8¶i·C¸i¹�º+»+¼lµ8½(½%¾OÕ4ÖOׯصǶi·#¸i¹6º+»+¼lµ8½(½%¾¿ ·#¶HÀlÁDº%ÂhËÚÙ �

Û ¢ §©�:§ ¡ ­Ü­³�+ªo�F�0� Í § ¥ �Q� £0¡ � Í ¬�¬+Ï«§H e� ° �0���+´�Ý��L� ¡ �Å ¶H·#¸i¹6º+»+¼�Æ ¿ §H B� ° �0���wÎI¬�­Ü­³¬%Ìa ÊÎ ¥ ¬ ° �Q�0�Þ �� ¡ �Q�ߧ ¢0ਠ¡%¥ § ¡%¢ �OáC´

â6â

Page 32: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

������� �������!������� ��� � ��� �� ���� â��� º+º�µÇ¶i·#¸i¹6º+»+¼� µ8¶i·C¸i¹�º+»+¼lµ8½(½%¾ÁD»���À��"à �8�����º+»+¸4À��"à �L���'�ÁD»���À����� ¿ ·#¶HÀlÁDº%ÂÅ ¶i·C¸i¹6ºE»+¼�Æ ¿�� Ë Å ¶i·#¸i¹6º+»+¼�Æ ¿�� Ù6Á-»���À�� ÈÉ º+»+¸4À�� �

�R¬ ¡E£0£Þ¡ßÍ § ¥ �Q� £0¡ ���F¬x�Q�0� Í § ¥ �Q� £0¡ � Í ¬�¬+Ï�ª2ÌL� ¥ � à� Ñ�§ ¥ � ¡%¢ § ¢ �0Ñ0� Á-»���À ¡%¢D£�¡ ºE»+¸4À ´Ð�L�0� Á-»���À ° ÑD ��¢ ¬+� ¡ ­ ¥ � ¡+£ � Í �B§ ¢ �Q�0� Í § ¥ �Q� £0¡ � Í ¬�¬+Ï2´��L�0� ¢ �OÌ¢D¡%° � ¡%¢D£�£0¡ �F� ¡%¥ �Ô  § ° ��­³� ¡E£0£ � £ �Q¬ Å ¶i·#¸i¹6º+»+¼�Æ ¿! Í �B§ ° ��­�§H² ¡ ��§³¬ ¢ ª ¿ ·#¶HÀlÁDº%Â"� Ë ¿ ·#¶iÀ(ÁDº� � Ù6ÁD»��kÀ�� � ´

@y=2�%!#� � µÇ¶i·#¸i¹6º+»+¼lµ8½(½%¾$#Ë�µÇ¶i·#¸i¹6º+»+¼lµ8½(½%¾�%eµ8¶i·C¸i¹�º+»+¼lµ8½(½%¾ �&v¶iÁDº�µÇ¶i·#¸i¹6º+»+¼'rµÇ¶i·#¸i¹6º+»+¼lµ8½(½%¾ÁD»���À��"à �8�����º+»+¸4À)(³Ã ���Ê�'�ÁD»���À�� � ¿ ·#¶HÀlÁDº%º+»+¸4À)(0Ë Å ¶H·#¸i¹6º+»+¼�Æ ¿ Ý ÁD»��kÀ�� á

�L��§H  ¥ � ¡+£�à ¬ ¢ ­³� ¬+�-� ¥C¡ ��§³¬ ¢ ÌL§�­�­e¦%§³¨+�Ú�Q�0�Ú²#¬ ¥F¥ � à ��-¬ ¢D£ § ¢ ¦ Í § ¥ �Q� à £0¡ �F�UÎI¬ ¥>¡_¢D¡%° �+ªy� ¥ ¬%¨E§ £ � £ �Q�0�¢D¡%° �h§  Ç§ ¢ �Q�0� Í § ¥ �F� £0¡ � Í ¬6¬EÏ�´

@y=2�%!#� 'rµ8¶H·#¸i¹6º+»+¼lµ8½(½�¾*#Ë & � µ8¶H·#¸i¹6º+»E¼(µ8½l½%¾�+ Å ¶H·#¸i¹6º+»+¼�Æ ¿ �DË Å ¶i·C¸i¹6ºE»+¼�Æ ¿ ',LÀ"��¶iÁDº'rµÇ¶i·#¸i¹6º+»+¼lµ8½(½%¾º+»+¼��%à ���Ê�'�Å ½+·#Á'Æ8Á-(³ÃFÄ �Ç�����Å ½+·#Á'Æ8Á-(EËÚÙ6Á à ¿ ·C¶iÀ(Á-º%Â/. Å ¶H·#¸i¹6º+»E¼6Æ ¿ Ý Á á Ë º+»+¼0� �

�L��§H  ¥ � ¡+£�à ¬ ¢ ­³�>¬+�D� ¥#¡ ��§³¬ ¢ ÌL§�­�­!1 ¢D£ �Q�0� ¢D¡%° �( y¬�Î�-�O¬+��­³�kÌg�0¬6 �� Í § ¥ �Q� £0¡ �ßÎ ¡ ­�­H g¬ ¢�¡ ¦%§³¨+� ¢>£0¡ �Q�+´

SUTOS ~��*X ��^%`adg���*�B� ���e��� ^+c 243 5

687!9�:<;*:0=?>!@BA�@DCE>GFH8IKJ<L )+$'<NM8IPO-L�)+!#�*Q 9SR / �)T / )+!O) G �%9#�%! ; 9C?e9#=2� ;Q/ ��& 1�U &")E9 1 ?�$rq�!#� / !C� ; �"$-9 1 $2m / �%? / .H� ;WV $') G � ; )+$'<<2)E9C� ;Ð1 $x9#=2�XR0�+)E!"q�!#� ;F/ �+&l9 1iu �%.YR�ZGQ\[Ó?�9C�h9C=')E9�]8^ 7`_DaPb�c�<-?0� ; $2?698&l,2!C!#�%$D9#.YR / !C? uD1 <D�y)Ó@t)dRB?+Kr<D�+&l.4)+! 1 $2m/ )E! ) G �%9C�%!h9SR / � ; ZeTf-A�ghA�:<;*:�=i>!@BAd@jCE>kh=2� ; 9O)+9#�]=') ; 9Q@h? U �%.4< ;Wlnmpo"qjr"sut�v]14; 9#=�� ; �%9�?EKB$') G � ;B1 $Ú9#=2�xw 1 !C9#='<�)dRwR?0?6� )E$'<zy q{o}|{~�t������Em 14;) / )E!#9 1 )+.ÇK ,�$'&l9 1 ?�$�!#�%.I)E9 1 $2m / �%? / .i� ;WV $') G � ; 9#?e9C=2� 1 !�w 1 !C9#='<2)�R ; Z�kh=2� ; 9 )E9#� 1 $ u )+! 1 )E$D9 ; )�R ; =�?E@�9#=2�u )+.i,2� ; ?EK89C=2� ; 9O)+9#� u )E! 1 )�w�.i� ; )+!#�J!C�%.4)+9#�+<�ZL7�$ 1 9 1 )+.i.�RNq 9C=2�Pw 1 !C9#='<�)dR�wR?0?6� 14; � G>/ 9�R�Z����������� q{o�|{~�t���� �K���������

mpoWqjr}sut�v�l HKI8JxL�_ ���W�y q{o�|{~�t�������m�l HKI8JxL ��-� M8I�O-L

���� x¡ � _ � q{o}|{~�t���� �/����� Q su��¡¢r�v�£�q{s}m � T ¤ s���¡¢r�vn¥§¦ ��¨ q{s}m ����)� �K© ¤ ©�ª mpo"qjr"sut�vP¥¬«�­

� ��¦®�9�:�¯�g�A�@DCE>°;*:�=i>!@BAd@jCE>!Fk ?k)�<2<x)8w 1 !#9#=s<2)�R�9#?Ô9#=2��w 1 !#9C='<2)�RPwR?0?6� q6@h�8!#��±0, 1 !#�a)E$ 1 $ / ,�9 su��¡¢r )E$'<o) t��)|�r Zikh=�� s���¡¢rgG , ; 9r$2?�9)E.i!C�+)�<hR¢w'� 1 $>9C=2��w 1 !#9C='<2)�R¢w'?0?6�-ZXkh=2�B&O=')E$�m�� 14; �W²��+&l9#��<¢w�RÞ)ÊK ,�$'&l9 1 ?�$>? u �%!C@y! 1 9#��Z?[Ó?�9C��9#=')+9y@y! 1 9#�/ �"! G>1I;#;F1 ?�$>9C? mpo"qjr"sut�vB1I; $2�%�+<D�+<³wR��&%)E, ; � 1 9Ô&O=')E$2m6� ;h1iGÞ/ . 1 & 1 9C.�R6q)w'� 1 $2mo9C=2�x<-? G ) 1 $e?+KKy q{o�|{~�t�������m Z

Page 33: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� ����������� ��� � � ���� � � �������

I t�t � q{o�|B~�t���� Q su��¡¢r�l HKI8JxL £�t��)|Sr)l M8IPO-L T��������� mpo"qjr"sut�v l H8IKJ<L�_ � �W�

��� y q{o}|{~�t�������m l H8IKJ<L �� � MKIPO-L��� � su��¡¢r��� mpo"qjr"sut�v���)��� y q{o�|B~�t����h��m<¥�� �u�E�E�u�E���y q{o}|{~�t�������m�� «hs���¡¢r�� � t��)|Sr�­

kh=2�B$2�! D9y? / �%!O)+9 1 ?�$U.H?0?�� ; , / 9C=2�Pw 1 !C9#='<�)E9#�[&l?�!C!#� ;Q/ ?�$'< 1 $2m�9#?�)om 1iu �"$pK ! 1 �%$'< VÜ; $') G ��Z" q{s�t � q{o�|B~�t���� Q su��¡¢r�l HKI8JxLnT t��)|�r�l MKIPO-L�����#� ¦8mpo"qjr"sut�v l H8IKJ<L�_ � �W�

� ¦ y q{o�|B~�t����h��m�l H8IKJ<L �� � M8IPO-L��� � su��¡¢r � mpo"qjr"sut�v���)��� t��)|�r�¥ y q{o}|{~�t������Em Q su��¡¢r T

kh=2�B9#= 1 !O<>? / �%! )E9 1 ?�$ U $'< ; 9#=2�B$') G � ; ?EKa)+.i. K ! 1 �%$'< ; @y=2? ; �nw 1 !#9C='<2)�RpKz)E.H. ; ?6$*)Jm 1Hu �%$]<2)E9C��Z$ r"¡�q{sut Q t����ul MKIPO-LnT�y � o"s-� s l HKI8JxL�_ ���W������#� ¦8mpo"qjr"sut�v l H8IKJ<L�_ � �W�

� ¦ y q{o�|B~�t����h��m�l H8IKJ<L �� � M8IPO-L���)��� y � oWs�� s$¥ «hs l H8IKJ<L + s � mpo"qjr"sut�v % y q{o�|{~�t�������m Q s T ¥ t����u­

SUT&% ')(ÚX�*�^,+-*Ô�od8^%�>c ^+f8f8\*XJfkh= 14;B; ��&l9 1 ?�$ < 14; &l, ;#; � ;J; ? G � 1I;#; ,2� ; @y= 1 &O= )E! 1I; � 1 $ &l?�$�$2�+&l9 1 ?�$�@ 1 9C=_9C=2�Þ&%) ; � ; 9#,'<�R�Z*c*)E$hR / ? 1 $D9 ;?EKx&l? G>/ )+! 14; ?�$Ú=') u �])E.H!#�+)6<�RNw'�%�%$ &l? u �%!#�+< 1 $ ^N�+&l9 1 ?�$ ; â Z â!.Dâ Z � )�w'? u �0q 1 $'&(.i,'< 1 $2m ;F1HG>1 .I)E! 1 9 1 � ; )+$'<< 1 ²��%!C�%$'&l� ; w'�%9Q@h�%�"$*9#=2�o9Q@h? G �%9#=�?D< V�;yG )E9C=2� G )+9 1 &%)E. )E$'< ;F/ �+& 1eU &%)+9 1 ?6$*$2?�9 )E9 1 ?�$ ; Z0/2,2!C9#=2�%! / ? 1 $D9 ;?EKÇ&l? G>/ )E! 1I; ?6$w@ 1 .i.�wR� G )�<D�B) ; 9#=2�x&%) ; � ; 9C,'< 1 � ; )E!C� / !#� ; �%$-9C�+<-Z

1�2��#243 57698:69;&<�=>6@?A6CBEDF<HG#IJI�6@K�BE=LBMG#NOBPD

Q�;�G �%$D9 1 ?6$2�+< 1 $SR8=') / 9#�%! â qL)E.H9#=2?6,2m�= 9#=2��R], ; ��±0, 1 9C��< 1 ²��%!C�%$-9k$2?�9 )E9 1 ?�$*K ?�! ;F/ �+& 1eU &%)E9 1 ?6$ ; qr9#=��UT)E$'<¢a�b�c ) /2/ !C?0)6&�=2� ; )E!C��)+. G ? ; 9 1 <-�%$D9 1 &%)E. 1 $ G )E$hRß@t)�R ; Z Q 9#!O)+$ ; .I)E9C?�!gK !C? G )B.4)E!Cm�� ; ,uw ; �%98?EK�TÞ9#?aPb�c<_S^WV 14; <D� ; &l! 1 w'�+< 1 $YX[Z 1 . 5W\^] Z�kh=�� G ) 1 $e< 1 ²��%!#�%$s&l� 1 $ G �+)+$ 1 $2m 1 $e9#=��ß9Q@a? ;Q/ ��& 1�U &")E9 1 ?�$ ; )�w'? u �14;g1 $>9#=��B<-�+&l.I)E! )E9 1 ?�$>?+KL9C=2� mpo"qjr"sut�v _ U �".4< lD1 $<^0��&l9 1 ?�$ � Z â 1 9y&%)+$³w'�x)E$hR ; �%9h?+KL$') G � ; q @y=��%!#�+) ;g1 $>9#=2�aPb�c ;F/ �+& 1eU &%)E9 1 ?6$ 1 9 1I; &(?�$ ; 9#!O) 1 $2��<w9#?�w'�o) U $ 1 9#� ; �%9y?EKÇ$') G � ; Za7zKÇ@h�x&l?�$ ;F1 <D�%!Ó9C=')E9Ô9#=��nw 1 !#9#=s<2)�RwR?0?6� 14;L1 $ 1 9 1 )E.H.�Rx� G>/ 9SRx)E$'<>?6$2.�Ro?6$2��$') G �Ô&%)E$�wR�Ê)�<2<-��<>)E9t)ß9 1HG �0q+9#=2�"!#�Ô@ 1 .i.'?6$2.�Ro� u �"! w'� U $ 1 9#�%.YRG )E$hRo$') G � ;g1 $>9#=2��wR?0?6� q ; ?o9C=2��9Q@h? ;F/ �+& 1eU &%)+9 1 ?6$ ; )E!C��� ;C; �%$D9 1 )E.i.YRo��±0, 1iu )E.H�%$D9�ZL7�$>?69#=2�"!y@h?�! < ; qD9#=2�T ;Q/ �+& 1�U &%)E9 1 ?�$]@h?6,2.4<U=') u �x� ;#; �%$-9 1 )+.i.�RÞ9#=2� ; ) G � G �+)+$ 1 $�m 1 Ka)E.H.Ð, ; � ; ?+K _�@a�%!#�x!#� / .I)�&l��<$whRa`Ú)+$'<, ; � ; ?+K �� !#� / .I)�&l��<¢w�R � �� Z Q�^0�%�x)+. ; ?*^0�+&(9 1 ?6$ â Z � ZeT[Ó?�9C�B)E. ; ?�9#=')+9%quw'�+&%)+, ; �B?EK?aPb�c VÜ; 9SR / �Ê< 14; & 1i/ . 1 $2�Nq 1 9 1I; $2�+&l� ;C; )+!�R>9C?o, ; � G ) / ? u �%!#@y! 1 9#� Q � T8!O)E9C=2�%!9#=')+$ ; �"9y,2$ 1 ?6$ Qcb�T 1 $e9#=2� ;F/ �+& 1�U &%)+9 1 ?�$e?EKXI t�t � q{o}|{~�t���� Z

Page 34: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

���������W���� ���E� ���7� �!����� ��� �� â �1�2��#2�� �F<H;96&I�<E?>6�� G N���BPN���D

[Ó� 1 9C=2�%! G �%9#=�?D<�&(,2!#!C�%$-9C.�R / !#? uD1 <-� ; 9#=2�])�w 1 . 1 9SR_9C? ; 9O)E9C�«� u )+. 1 <2)E9 1 ?�$ &�=��+&�� ; �Dq 1 $Ú9#=��wK ?�! G ?EKß) ; _; �%!C9 1 ?6$ ; @y= 1 &O=_9C=2� ;F/ �+& 1�U �%!B@y! 1 9#�"!�w'�%. 1 � u � ; )+!#��.i?6m 1 &")E.y&(?�$ ; ��± ,��%$'&l� ; ?+KÔ9#=2�pK ?6! G )+. ;F/ �+& 1eU &%)E9 1 ?6$ Z/s?6!J�! �) GÞ/ .i�0q'9#=�� 1 $ 1 9 1 )E. u )E.H,2��?EK y q{o�|B~�t����h��mÚG , ; 9�w'�>9C=2��� G>/ 9SR G ) / q ;F1 $'&l��9#=2� ; 9 )E9C� 1 $ u )E! 1 )E$D9&l?�$ ; 9#! ) 1 $ ; y q{o�|B~�t����h��m�; ?J9C=')E9 mpo"qjr"sut�vP¥ <-? G y q{o}|{~�t�������m )+$'< 1 $ 1 9 1 )E.i.YR mpoWqjr"s�t�v�¥ « ­ Z Q $-, G w'�%!L?+K?�9#=��%!y�! �) G>/ .H� ; )+!#�Bm 1Hu �%$ 1 $ ^N�+&l9 1 ?�$ � Z���Z â wR�".i?+@PZ7zKrK ?6! G ,2.4)+9#�+<�) /�/ !#? / ! 1 )E9#�".�R0q ; ,'&O= u )E. 1 <2)+9 1 ?6$]&�=2��&�� ; @h?�,�.4<³w'�+&l? G � / !C?0?EK�?)w2. 1 mN)E9 1 ?�$ ;y1 $Þ9#=2��9C=2�%?6!�R&l?�!C!#� ;Q/ ?6$'< 1 $2mo9#?�) ;F/ �+& 1eU &%)E9 1 ?6$ Z�_�Ê&l?�$D9#�%$s<{9C=')E9y9C=2� ;F/ �+& 1�U &%)+9 1 ?�$ 1I; 9#=�� G ? ; 9a) /2/ !C? / ! 1 )+9#� / .4)6&l�9#?�!#�+&l?6!O< u )E. 1 <2)+9 1 ?6$]&�=2��&�� ; Z

1�2��#2C1 � BEI���G�I�<HG#N�� 69G D��0BENE6� NO<E?>6�� G�D

[Ó?�9C�p9C=')E9 1 9 1I; &l? GÞG ?�$ ; 9SR-.H� 1 $ w'?�9#= T�)+$'< aPb�c 9#? ;Q/ ��& 1 KDR]?�$2.YR*9#=2��w')E!C�p� ;#; �"$-9 1 )E. ; qr? GÞ1 9#9 1 $2m�#!#��<-,2$'<2)+$-9 �$Q 9O)+,29#?6.i?�m6?�, ; T 1 $DK ?�! G )E9 1 ?�$ ZP/2?�!Ô�! 2) G>/ .H� l\ ZÔ7�9y@h?�,�.4<$w'�x!#�+<-,�$'<2)E$D9Ô9#? 1 $'&l.H,'<-��y q{o�|B~�t����h��m ¥ «E�� ­x1 $e9#=2� 1 $ 1 9 1 )E. 1"! )E9 1 ?6$rq ;Q1 $'&l�B9C= 14; &l?6,2.4<w'�J<D�%! 1Hu �+<{K !#? G 9#=�� ; 9O)+9#� G �"$-9a9#=')+9 1 9 ; <D? G ) 1 $rq mpoWqjr"s�t�v q 14; � G>/ 9SR�Z

â ZÔ7�9 14; ,�$2$2�+&l� ;#; )+!�R�9#?��! / . 1 & 1 9C.�RB@y! 1 9#� mpoWqjr}sut�vP¥ � �E�E���mpo"qjr"sut�v b «hsu��¡¢r�­ß1 $>9#=�� / ? ; 9O&(?�$'< 1 9 1 ?�$e?EK�9#=2�aPb�c ;Q/ �+& 1�U &%)E9 1 ?�$*?+KKI t�t � q{o�|{~�t���� ZP^ 1iGÞ1 .4)+!#.YR0q 1 9 1I; )>&l?6$ ; ��±0,2�%$s&l�J?+Kh9C=2�UT ;Q/ ��& 1�U &")E9 1 ?�$*?+KI t�t � q{o}|{~�t���� 9C=')E9 mpoWqjr}sut�v � ¥Nmpo"qjr"sut�v b «hsu��¡¢r$#�­ Z�Q [Ô?�9#�Ô=2?+@h� u �%!%q�9C=')E9 1 9 q�v $2�+&l� ;#; )+!�Ro9C?ß$�?�9#�9#=')+9y9#=2�PaPb�c ? / �"!O)E9 1 ?6$U=') ; @y! 1 9C� / �"! G>1I;#;F1 ?�$>9C?o9#=2� mpo"qjr"sut�v�U �".4< q ;F1 $s&l� 1 9 ;hu )+.i,2�B&O=')+$2m�� ; Z�T

7:$BKz)�&l9"q�9#=�� ;F/ �+& 1eU &%)E9 1 ?6$�&l?�,2.I<�w'� G )6<-�h� u �"$ G ?�!#�t&l?�$s& 14; ��whRß? G>1 9C9 1 $2mÓ9C=2� mpo"qjr"sut�vXU �%.4<x)E.H9#?�m6�%9#=��%! l��Z¯m�Z����������� q{o�|{~�t���� �K���������

y q{o�|{~�t�������m�l HKI8JxL ��-� M8I�O-L���)� � ¡ � _ � q{o�|B~�t���� �K����� Q y q{o}|{~�t������Em T ¤ y q{o}|{~�t������Em<¥ «E�� ­

� ��¦I t�t � q{o�|B~�t���� Q su��¡¢r�l HKI8JxL £�t��)|Sr)l M8IPO-L T��������� y q{o}|{~�t�������m l H8IKJ<L �� � MKIPO-L��� � su��¡¢r��� ¦ ��¨ y q{o�|B~�t����h��m���)��� y q{o�|B~�t����h��m<¥ � �u�E�E�u�E���y q{o}|{~�t�������m�� «hs���¡¢r�� � t��)|Sr�­

7:$]m��%$��%!O)+.�q29#=�� G ?6!#�x&l?�$s& 14; �J) ;F/ �+& 1�U &%)+9 1 ?�$rq'9#=2�B.H� ;#; @h?6!#�e9#=2�"!#�B@ 1 .H. wR� 1 $ u �%! 1 KDR 1 $2m 1 9�Z&%Ó?+@a� u �%!%q9#= 1I; $2�%��< ; 9#?nw'��ws)E.4)+$'&l�+<Þ)Em0) 1 $ ; 9y9#=2�Ô!#��)�<2)�w 1 . 1 9SRJ?+Kv9#=2� ;Q/ �+& 1�U &%)E9 1 ?�$ q @y= 1 &O= 1I; m��"$2�%!O)+.i.YR 1 $'&l!C�+) ; �+<w�R³w'� 1 $2m�)�w�.i�B9#?Þ)�<2<]<-� U $��+<e&l?�$'&(� / 9 ; Z^ 1 $'&(�ß9C=2� G ) 1 $ / ,2! / ? ; �J?+Ka) ;F/ �+& 1eU &%)E9 1 ?6$ 14; 9C? ; 9O)+9#�J!C��±0, 1 !C� G �%$D9 ; &l.H�+)E!C.�RÞ)E$'<]&l? G>/ !#�%=2�"$ ;F1 w2.�R�9#?9#=2�>!C�+)�<D�%!%qL@a�pK �%�%. 1 9 14;J1HG>/ ?�!#9 )E$D9B9#? w'�])�w2.H�>9#?�<-� U $2�e)+.i.h9C=2? ; �]&l?�$'&(� / 9 ; 9#=2�e!C�+)�<-�"! G )�R U $'<, ; �lK ,�.�q ; ,'&O=�) ;8mpoWqjr"s�t�v )�w'? u ��Z'�_�Þ&l?6$-9C�%$'<_9C=')E9[) / !C?0?EKk�%$2m 1 $2�%�%! ; =2?�,2.I< w'�e)�w�.i�>9C?*)E$�$2?�9 )E9#�]);F/ �+& 1eU &%)E9 1 ?6$�9C? 1 <-�%$D9 1 KDR 1 9 ; �#� ;#; �"$-9 1 )E.Ô&(?�!#���_)+$'<�9C? ; � / )E! )E9C�U9#=s)E9Þ&l?�!C�|K !C? G 9C=2? ; � / )+!#9 ; ?+KB9#=2�;F/ �+& 1eU &%)E9 1 ?6$p@y= 1 &�=Þ)E!C�Ó.H?�m 1 &%)+. &(?�$ ; ��± ,��%$'&l� ; ?EKv9#=���&l?6!#�0q 1 $ G ,'&O=J9#=�� ; ) G �y@t)dR�) ; ) G )E9C=2� G )+9 1 &")E.

Page 35: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

â � ����������� ��� � � ���� � � �������

9#=2�%?6!�R 14;B; � / )E!O)+9#�+< 1 $D9#?|)� 1 ? G|; )E$'<*9#=��%?�!C� Ge; Z�� ; 9 )�w2. 14; = 1 $2me9#=s)E9B9#=2�o!C�+<-,2$s<2)E$D9 / )E!C9 ; !#�+)+.i.YR*<-?K ?�.i.H?+@¤K !C? G 9C=2�Ô&l?�!C�Ó@a?�,2.I<nw'�+&l? G �Ô)E$ 1iG>/ ?�!C9O)+$-9 / )E!C9h?+Kr9#=�� u )+. 1 <2)E9 1 ?�$ / !C?D&l� ;#; )+$'<{@a?�,2.I< / !#? u-1 <-�){, ; �lK ,2. ; �%9Ô?EK�.i� GÞG ) ; K ?�! ; ,uw ; ��± ,��%$-9 u �"! 1�U &%)E9 1 ?�$Þ@h?�!C�-ZcU?�!#�x@h?6!#� 14; $2�%�+<D�+<w9C? 1 $ u � ; 9 1 mN)E9#�B, ; �lK ,2.v@y)�R ; ?+K8$2?�9 1 $2mÞ!#�+<-,�$'<2)E$s&WR 1 $ ;Q/ �+& 1�U &%)E9 1 ?�$ ; Z ���J$�?�9#�1 $ / ) ;C;F1 $2mp9C=2�B, ; �(K ,2.i$2� ;#; ?EKtn8w��Q��&l9 T VÜ;y; �+&l?6$'<2)+!�Re)+9#9#! 1 w2,�9#� ;y1 $>9C= 14; !#� ;F/ �+&l9�Q ; �"�UX b��n^ 5 \ q��0� 5 � ] T Z

1�2��#2�� � 6&DW?>69G ��6&D ��69G I�6@K�BE=LBMG�? ��69G�I�D ���aD��0BENE6� NO<E?>6�� G:N � 8 � � G#BMG�?

nÓ$��J?EKa9C=2�o9#=2� G � ; 9#=s)E9�@ 1 .i.v�0�%� / &l? GÞ1 $2m�, /*1 $]9#= 1I; !#� / ?6!#9 1I; 9C=')E9 1 9 1I;�1HG>/ ?�!#9 )E$D9Ó9C?e< 1I; 9 1 $2m�, 14; =wR�"9F@a�%�%$A< 1 ²��%!#�%$D9>� 1 $'< ; ?EK ;F/ �+& 1eU &%)E9 1 ?6$A&l? G>/ ?6$2�%$D9�Z aPb�c G )E�0� ; )_K ?�! G )E.B< 1I; 9 1 $'&l9 1 ?6$ Q , ;Q1 $2m�0��R-@a?�! < ; T w'�%9Q@a�%�%$ ; 9 )E9C�><-� U $ 1 9 1 ?6$ ; q 9SR / � ; )E$'<*? / �%! )E9 1 ?�$ ; qÐ@y=2�"!#�+) ; T�!C�%. 1 � ; ?�$�9#=�� ; ,2!C!#?�,�$'< 1 $�m9#�! D9�9#? G )E�0�x9#=2��< 1 ²��%!#�%$s&l� ; ) /2/ )+!#�%$D9�Z ]h,29�< 1 ²��%!#�"$-9�� 1 $s< ; ?EKt)+$')E.YR ;Q14; 9#�+&O=2$ 1 ± ,�� ; )+!#��) /2/ . 1 &%)�w�.i�9#?>9C=2�o< 1 ²��%!#�%$D9Ô� 1 $'< ; ?EK ;F/ �+& 1eU &%)+9 1 ?6$*&l? G>/ ?�$2�"$-9 ; q�)E$'<U9C=2� / !C?0?EKa?)w�. 1 mN)E9 1 ?�$ ; m��%$��%!O)+9#�+<wK ?6!�9#=2� G<-� / �%$'<>?�$]9#=2� 1 ! 1 $D9#�"$'<-�+<p!C?�.H� ; q ; ?�9#=2�x< 1I; 9 1 $'&l9 1 ?�$ 1I;h1iG>/ ?�!C9O)+$-9pZ[Ó� 1 9C=2�%! G �"9#=2?D<ßK ?6! G )+.i.�RÊ< 14; 9 1 $�m�, 1I; =2� ; 9#=2? ; � / )+!#9 ; ?+Kr) ;Q/ ��& 1�U &")E9 1 ?�$x@y= 1 &O=�)E!C�K9Ggu¯�g� :�A�:h¯�FL9C?�9#=2�;F/ �+& 1eU &%)E9 1 ?6$ Z87�$p9C=2� ;F/ �+& 1�U &%)+9 1 ?�$ ; )�w'? u �0q�HKI8JxL )+$'<<M8IPO-L )E!C� / )E! ) G �"9#�%! ; 9C?o9#=2� ;F/ �+& 1eU &%)E9 1 ?6$��9#=2��R�)E!C�p.H�lK 9Ó,�$ 1 $ ; 9O)+$-9 1 )E9C�+< 1 $*9#=���)�w ; 9#!O)6&l9 ;Q/ �+& 1�U &%)E9 1 ?�$�)+$'<�)E!#��9#?*w'� 1 $ ; 9O)+$-9 1 )+9#�+<*@ 1 9C=�)�&l9C,')E.9�R / � ; .4)+9#�%! 1 $Ú9#=��U<D� ;F1 m�$Ú?EKk9#=2�e@y=2?6.i� ; R ; 9C� G Z ]8^D7 _DaPb�c <-?0� ; $�?�9Þ&l,2!#!C�%$D9#.�R*=s) u �|)E$hR�@y)�R�?+K<-�+&l.I)E! 1 $2m / )+!O) G �%9#�%!o9SR / � ;p; ,'&O= ) ; HKI8JxL�)+$'< M8I�O-L lU1 $ / !O)�&(9 1 &(�w?6$2� G , ; 9�<-�+&l.I)E!#�e9C=2� G ) ;k ?6�0�%$_9SR / � ; Q�&(?�$ ;Q14; 9 1 $2m]?EK 1 $ U $ 1 9#�".�R G )E$hRU,�$')E$')+.�R ; �+< �#9C?��0�%$ ; �0T Z>7�$STvqGH8IKJ<L�)+$'< MKIPO-L�)E!#��#m 1Hu �%$e9SR / � ; ��ZcU?�!#�Þm��%$2�"!O)E.H.�R0q 1 9x@h?�,�.4<Nw'�w, ; �lK ,2.a9#?xwR�])�w2.i�>9C?�<-�+&l.I)E!C�>9SR / �e)+$'< u )+.i,2� / )E! ) G �%9C�%! ;B1 $Ú) ;Q/ �+&W_1�U &%)+9 1 ?�$rqv9#?�m6�%9#=��%!o@ 1 9C=Ú) ;C; , G>/ 9 1 ?6$ ; )�w'?�,29o9C=2� 1 ! / !#? / �%!#9 1 � ; Z /2?�!J� 2) G>/ .i�Nq 9C=2� / )+!O) G �%9#�"! ; 9#?�)m��%$2�"! 1 & ; ?�!C9 1 $2m ; ,uw ; R ; 9#� G�G>1 m6=-9Pw'�])<w') ; �U9SR / � ?EKk�%.i� G �%$-9 ; )E$s<«)<w 1 $')E!�R_!C�%.4)+9 1 ?6$�� ?�$ 9#?�m6�%9#=��%!�@ 1 9C=U9C=2�o) ;#; , G>/ 9 1 ?�$]9#=')+9�� 14; ) / !C��_ ?6!O<-�"!�?�$ Z�7�$ Tvq ; ,'&O=*) ;#; , G>/ 9 1 ?�$ ; )+!#� ; 9 )E9C�+<U) ;�O&l?6$ ; 9C!O) 1 $-9 ; �hZ�Q [Ó?69#�J9C=')E9 ; ,'&O=*) ;#; , G>/ 9 1 ?�$ ;ÔG , ; 9 w'��< 14; 9 1 $�m�, 1I; =2�+<>K !#? Gju )+. 1 <�)E9 1 ?�$�&O=2�+&O� ; q ;F1 $'&l�9#=2��K ?�! G �%!Ô&l?6!#!C� ;F/ ?�$s<w9#?Þ)� 1 ? Ge; ?EKÇ9#=2�x9#=2�%?6!�Re&(?�!#!C� ;F/ ?6$'< 1 $�m>9#?�9#=2� ;F/ �+& 1eU &%)+9 1 ?6$rq')E$s<w9#=��J.4)+9#9C�%!9#?�9#=2�%?6!#� G|; Z�T � =2�%$]9#=2� ; ,uw ; R ; 9C� G 14;y1 $D9#�%m6!O)+9#�+< 1 $D9#?Þ)o.4)E!Cm��%! ; R ; 9C� G qD9#=2� / )+!O) G �%9#�%! ; @h?6,2.4<em��%91 $ ; 9O)E$D9 1 )E9C�+<³w�R])�&(9#,')+. u )E.H,2� ; q')E$'< 1 9y@h?�,�.4<$w'�[) / !C?0?EKa?)w�. 1 mN)E9 1 ?�$eK ?�!Ô9#=2� 1 $D9#�%m6!O)+9#?�!Ô9#? ; =�?E@ 9C=')E99#=2�x) ;C; �%!C9 1 ?�$ ; )E!C�ß9C!#,2�B?+K89#=2� 1 $ ; 9 )E$D9 1 )+9 1 $2m u )E.i,�� ; ZnÓ9C=2�%!y!C��± , 1 !#� G �%$09 ; K ?6!Ô< 14; 9 1 $�m�, 1I; = 1 $2m�w'�%9Q@h�%�%$Þ9#=2�x< 1 ² �"!#�%$D9h9SR / � ; )E$'<e!#?�.H� ; ?EK ;F/ �+& 1�U &%)+9 1 ?�$]&l? G _/ ?6$2�%$D9 ; )E!C�ßm 1iu �%$ 1 $ ; ? G �B?EK�9#=2�B?�9C=2�%!Ô&%) ; � ; 9#,s< 1 � ; w'�%.H?+@ l8; �%��^0�+&(9 1 ?6$ 3 Z �ßK ?6!�) ; , G>G )+!�R�Z

1�2��#2�� � 6&B�;&I D BM;&BPN ? ��=LD��#D D ?L<E?LB�� <M=>6&<���;&BED

[Ó?�9C��9#=')+9�� w�Re&(?�$D9#!O) ; 9y@ 1 9#= T���aPb�c ; 9O)+9#�x<-� U $ 1 9 1 ?�$ ; )E.H.i?+@ < 1 ²��%!C�%$-9a$') G � ; 9C?�wR�B, ; �+<pK ?�! U �".4<; �%.H�+&l9#?6! ; q ; ,s&�=e) ;GmpoWqjr}sut�v )E$'< y q{o�|{~�t�������m q2)+$'< Q 9#=�� u )+.i,2� ; ?EK"T ; 9O)+9#� u )+! 1 )�w2.i� ; q ; ,s&�=e) ;Psu��¡¢r�v )+$'<q{s}m � 1 $*9C=2��aPb�c ;Q/ ��& 1�U &")E9 1 ?�$ 1 $N^0�+&l9 1 ?�$ � Z � )�w'? u ��Z /2?�! G )E.i.YR0q'9#=2�o9Q@h?Þ!#?�.H� ; )+!#��± , 1 9#�[< 1 ²��%!C�%$-9"q)E$'< 1 $ G )+$�R*.H?�m 1 &%)E.LK ! ) G �%@a?�!C� ; 9#=���R_@a?�,2.I< w'�e< 1 ² �"!#�%$D9B� 1 $'< ; ?+KÔ?)w��Q�+&(9�Z Q $'< 1 $ / !O)6&l9 1 &l� 1 9 14;?EK 9#�"$p, ; �lK ,2.'9#? w'��)�w2.i�Ô9#?x, ; �k< 1 ²��%!C�%$D9g$s) G>1 $2mB&l?6$ u �%$D9 1 ?�$ ; K ?�!gK ,�$'&l9 1 ?�$ ; )+$'< u )E.H,2� ; ZhnÔ$�9#=2�Ô?�9C=2�%!=')E$'<�q G )+$�R / �"? / .H��&O=2?0? ; �Ó9C?J, ; �Ó9C=2� ; ) G �y$') G �hK ?6!h9C=2�Ó9Q@a?2q ;F1 $'&l�Ô9#=2��R[&l.i��)E!#.YRJ!C�%.4)+9#�Ô9#?B9#=2� ; ) G �&l?�$'&(� / 9�Z87�$])E$ 1 $-9C�%m�! )E9#��< G �%9#=2?D<>@a��@h?6,2.4<e. 1 �0�Ô9#?�w'�x)�w2.H�ß9C?p, ; �Pw'?�9#=�) /2/ !#?0)6&�=�� ; Z^0,'&O=�)>< 14; 9 1 $'&l9 1 ?�$�&l?�,2.I<U, ; �(K ,2.i.YR$w'�o�! D9#�"$'<-�+<U9C?>? / �%! )E9 1 ?�$ ;F/ �+& 1eU &%)+9 1 ?6$ ; Z0R8?�$ ;F1 <D�%!ÓK ?�!k�! 2) G>/ .H�

Page 36: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

���������W���� ���E� ���7� �!����� ��� �� â��9#=2�*aPb�c ;Q/ �+& 1�U &%)E9 1 ?�$Ú?+KnI t�t � q{o�|B~�t���� )�w'? u ��Z �_�e9#= 1 $2� 1 9o@a?�,2.I< w'� G ?6!#�Þ) /2/ !C? / ! 1 )+9#�U9C?*, ; �; 9O)+9#� u )+! 1 )�w2.i� ;g1 $�9#=�� / !#�p_L)+$'< / ? ; 9O&l?6$'< 1 9 1 ?6$ ; !O)+9#=2�%!a9#=')+$ ; �%.H�+&l9#?6!LK ,2$'&l9 1 ?�$ ; q2) ;g1I; &l,2!C!#�%$D9#.YRo<-?6$2��ZQ kh=2�%!C� 14; )+. ; ? ; ? G ��±0,2� ; 9 1 ?�$x) ; 9#?y@y=2�"9#=2�%!r9C=2�L9SR /21 $2m 1 $-K ?�! G )E9 1 ?6$�?�$x9#=2�L� -9C�%!#$')+. u )E! 1 )�w2.i� ; 1I; !#�+)+.i.YR!#��±0, 1 !C�+< q ;Q1 $'&(� 1 9B&%)+$ w'�oK ?�,2$s< ;F1HG>/ .�R�w�R*.H?0?�� 1 $2me, / 9#=2� ; 9 )E9C�><-� U $ 1 9 1 ?6$ Z�T QG ?6!#�o) /2/ !C? / ! 1 )E9C�$2?�9 )E9 1 ?�$ G>1 m6=-9XwR� ; ? G �%9C= 1 $�mJ. 1 �0��9#=��ÊK ?6.i.H?E@ 1 $2m lI t�t � q{o�|B~�t���� Q su��¡¢r�l HKI8JxL £�t��)|Sr)l M8IPO-L T��������� mpo"qjr"sut�v l�l Q ��� t�su��¡¢r�v�£�s�r��is���¡¢r�v T

��� y q{o}|{~�t�������m l�l Q ��� t�q{s}m � £�s�r��?q{s}m � T��� � su��¡¢r��� ��� t�s���¡¢r�v���)��� s�r��iq{s�m � ¥ ��� t�q{s}m � �X«hsu��¡¢r�� � t��)|Sr�­

7:$]9#= 1I; $2�%@ $2?�9 )E9 1 ?�$rqr9C=2� / !C��_y)+$'< / ? ; 9�_ u )+.i,2� ; ?+Ka9#=2� mpoWqjr"s�t�vnU �%.I<U)E!C�o!#� / !#� ; �%$-9C�+<³w�R]9#=2�x$') G � ;��� t�su��¡¢r�v )E$'< s�r��is���¡¢r�v q !C� ;F/ �+&(9 1iu �".�R�Z Q ;Q1iG>1 .4)E!a&l?6$ u �"$-9 1 ?�$|) /2/ . 1 � ; 9C?p9C=2��y q{o�|B~�t����h��m$U �%.4<-ZQ�; ) ; �+&(?�$'<>�! �) G>/ .i� 1 .i.H, ; 9C!O)+9 1 $�mJ9#=�� / !#? / ? ; ��<w$2�%@A$2?69O)E9 1 ?6$rqR=��%!#� 1I; 9#=2� ;F/ �+& 1eU &%)E9 1 ?6$w?+K8)+$e? / �%!�_)E9 1 ?�$eK ?�! G ?D< 1 KDR 1 $2mJ9C=2� 1 $-K ?6! G )+9 1 ?�$>!C�+&l?�! <-�+<e)EmN) 1 $ ; 9k) / )E!#9 1 &l,�.4)E!y$s) G � 1 $e9#=2�Pw 1 !#9#=s<2)�R³w'?0?�� lJ � t�q mp���"s}m � Q su��¡¢r)l H8IKJ<L £�t��)|�r�l MKIPO-LnT�����#� ¦8mpo"qjr"sut�v l�lKsu��¡¢r�v

��� y q{o}|{~�t�������m l�l Q ��� t�q{s}m � £�s�r��?q{s}m � T��� � su��¡¢r � su��¡¢r�v���)��� s�r��iq{s�m � ¥ ��� t�q{s}m � �X«hsu��¡¢r�� � t��)|Sr�­

[Ó?�9C�ß9C=')E9y9C=2� / !#? / ? ; ��<U$2�%@A$2?�9 )E9 1 ?�$�<-?0� ; )�@t)�R>@ 1 9C=w9C=2�B, ; �x?EK�=2?0?�� ; QDaPb�c T8)+$'< / ! 1iG � ; Q@T T�ZQ 9x9#= 1I;ß/ ? 1 $-9o9C=2�>$2�%@$�?�9O)+9 1 ?�$ 1I; $2? G ?�!#��9#=s)E$ )E$ 1 $ 1 9 1 )E. / !C? / ? ; )E.Ô@y= 1 &O=�@ 1 .H.8$2?�9�w'� / ,2! ; ,2�+<K ,2!#9C=2�%! 1 $e9C= 14; !C� / ?�!#9pZ

1�2��#2� �I�< ��?>69G ? ��B � ��� D��0BENE6� �N�<E?>6�� G � ��=� ��������

^0? G �Ê&�=')+$2m�� ; @h�%!C� G )�<-��9C?p9C=2�PaPb�c ;Q/ ��& 1�U &")E9 1 ?�$ 1 $e?6!O<-�%!Ô9#? 1 $ / ,29 1 9y9#?���������� l\ Z����������]< 1 ²��%! ; K !#? G ]8^D7 _DaPb�c Q ; �"��X bk)�@ 5W\!] T 1 $x9#=')+9 1 9v!#��±0, 1 !#� ; )Ó,2$ 1 ± ,��0qE� / . 1 & 1 9 1 $ 1 9 1 )E. ; 9O)+9#��Z7�$w9C= 14; &") ; �Nq29#=2� 1 $ 1 9 1 )E. ; 9O)+9#� 14;P¡ � _ � q{o}|{~�t���� �/����� Q «�­�£�«E�� ­ T�Zâ ZKkh=2� / ? ; 9O&l?6$'< 1 9 1 ?6$e?EK�$ r}¡�q{sut @t) ; !#�"@h?�! <-�+<JK ?�!a�+) ; ��?EK G )E$ 1i/ ,2.I)E9 1 ?�$ 1 $ ���������tq ;F1 $'&l�!���������<-?0� ; $2?�9KR0�%9a=')E$'<D.i� ; �%9Ô&(? G>/ !C�%=2�%$ ;F1 ?6$>@h�".i. Z?kh=-, ;h1 $ ; 9#�+)6<w?EK�@y! 1 9 1 $2m

Å ½E·CÁRÆ8ÁoËÚÙ6Á³.�Á � ¿ ·#¶iÀ(ÁDº�Â#" Å ¶i·C¸i¹6ºE»+¼�Æ ¿ Ý Á á Ë º+»E¼�$9#=2�B.H?�m 1 &%)E.H.�R���±0, 1iu )E.H�%$D9gK ?�! G% Á�à �Ç�����'& Á � Å ½+·#Á'Æ8Á)( Á � ¿ ·#¶iÀ(ÁDº�Â!* Å ¶i·C¸i¹�º+»+¼�Æ ¿ Ý Á á Ë ºE»+¼

@y) ; , ; �+<-Z� ZKk R / � / )E! ) G �"9#�%! ;RG , ; 9�wR�a<-��&l.4)+!#�+<Ó� / . 1 & 1 9#.YR 1 $+�����,�-� Z kh=2��Rk)E!#� 1 $'< 1 &")E9#��<8w�Rk9#=2��. � �)�0/��W� ¦ �21 � � ¦uV�0��RD@h?�! <<Q $�?�9 / )E!C9Ó?+K�]8^D7 _DaPb�c T Z

Page 37: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

â 3 ����������� ��� � � ���� � � �������

nÓ9C=2�%!C@ 14; �x9#=2��a�b�c ;F/ �+& 1eU &%)E9 1 ?6$*&%)+$ w'� / ,29 1 $D9#? �������-� u-1 !#9#,s)E.i.YR u �%!�w')+9 1HG ZKkh=2�JK ?�.H.i?+@ 1 $2m 14; )<-, G>/ ?EKv9C=2� ;Q/ �+& 1�U &%)E9 1 ?�$|) ;g/ ,29 1 $-9C? �����,�-� Z�Q Qk; )ß@t)E!C$ 1 $2mx9#?x9#=2��!C�+)�<D�%!%q0$2?69#��9C=')E9 �����,�-�*9C�%$'< ;9#?�wR�B? u �%!C�%$-9C=-, ;F1 ) ; 9 1 & 1 $ 1 9 ; , ; �B?EK / )E!C�%$-9C=2� ; � ; � Tf-A�ghA�:<;*:�=i>!@BAd@jCE>� q{o�|{~�t���� �K����� l�l mpo"qjr"sut�v�l HKI8JxL�_ ���W�

y q{o}|{~�t�������m�l HKI8JxL ��-� MKIPO-L� ��  Q mpo"qjr"sut�v�l HKI8JxL�_ ���W� £ y q{o}|{~�t������Em!l H8IKJ<L �� � M8IPO-L T ¤ mpo"qjr"sut�vP¥ Q ¦ �u¨ y q{o}|{~�t�������m T� �)� � ¡ � _ � q{o�|{~�t���� �K����� Q «�­�£�«E�� ­ T

687!9�:<;*:0=?>!@BA�@DCE>GFHKI8JxL ¥z� � � ����/p�W� ¦ �21 � � ¦

MKIPO-L ¥ � � � ����/p�W� ¦ � 1 � � ¦

®�9�:�¯�g�A�@DCE>GFI t�t � q{o�|B~�t���� Q su��¡¢r�l HKI8JxL £�t��)|Sr)l M8IPO-L T��������� mpo"qjr"sut�v�l HKI8JxL�_ ���W� £ � � y q{o�|{~�t�������m!l HKIKJ<L �� � MKIPO-L��� � su��¡¢r��� mpo"qjr"sut�v���)��� y q{o�|B~�t����h��m<¥ Q � �u�E�E�u�E�)�y q{o�|B~�t����h��m � «hsu��¡¢r��� t��)|�r�­ T

" q{s�t � q{o�|B~�t���� Q su��¡¢r�l HKI8JxLnT t��)|�r�l MKIPO-L�����#� ¦8mpo"qjr"sut�v�l H8IKJ<L�_ � �W� £ � ¦ y q{o}|{~�t������Em!l H8IKJ<L ��-� M8IPO-L��� � su��¡¢r � mpo"qjr"sut�v���)��� t��)|�r�¥ y q{o}|{~�t������Em Q su��¡¢r T

$ r"¡�q{sut Q t����ul MKIPO-LnT�y � o"s-� s l HKI8JxL�_ ���W������#� ¦8mpo"qjr"sut�v�l H8IKJ<L�_ � �W� £ � ¦ y q{o}|{~�t������Em!l H8IKJ<L ��-� M8IPO-L���)����� s l HKI8JxL�� s � y � o"s-� s�� Q s � mpo"qjr"sut�v T % y q{o}|{~�t�������m Q s T ¥ t����

SUT� `h�e��� �� ��+^����odg^"�|c�fkh= 14;�; �+&l9 1 ?�$�&(?�$D9O) 1 $ ; ) ; �".i�+&l9 1 ?6$U?EK ; ? G �x?EKy9C=2� / !C?0?EKy?�w2. 1 m0)+9 1 ?6$ ; m��%$��%!O)+9#�+<<whR �����,�-�yq'9#?6m��%9C=2�%!@ 1 9#= ; ? G ��?+K89#=�� 1 ! / !#?0?+K ; Z Q K ,2.H. . 1I; 9y?+KL9C=2� / !#?0?+Kh?�w2. 1 m0)+9 1 ?6$ ; )E$s< / !C?0?EK ; &%)+$*wR�BK ?�,2$s< 1 $YX ��V 5 � ] Z

1�2�� 243 � BM;9;�� � ��= 8 BEI�G#BED D � = � � � � ��;96 H<E?>6�� G#D

Z6��!:�FWA�g�A�: @j>��Egu¯�@Dgu>�A���kh= 14; ?)w2. 1 m0)+9 1 ?�$ 14; 9#? ; =�?E@Ú9C=')E9L9C=2� ; 9O)+9#� 1 $ u )+! 1 )+$-9 14; )y@h�%.H.�_4K ?�! G �+<�K ?�! G ,�.4)�Z

�����! #"��%$#&('*),+.-,"0/�/!13254 mpo"qjr"sut�v�l H8IKJ<L�_ � �W� £ y q{o�|B~�t����h��m!l HKI8JxL ��-� MKIPO-LQ mpo"qjr"sut�vP¥§¦ ��¨ y q{o�|B~�t����h��m T l76

Page 38: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

������� �� ��� � ����� ��� ��� �!� � � â 5cU? ; 9x@h�%.H.�_4K ?�! G �+<-$2� ;#;y/ !#?0?+K�?�w2. 1 m0)E9 1 ?6$ ; &l? G ��<-?+@y$�9#? ;Q1iG>/ .i�o9SR / ��_z&O=2�+&O� 1 $2m2q�)E$'<�9#= 1I; ?�$�� 1I; $2?�! 2&(� / 9 1 ?�$ Z?kh=2� / !#?0?+K 14; m 1Hu �%$ 1 $a/ 1 m�,�!#� � Z \ Z

������� ¿ ·C¶iÀ(Á-º%Â6Ã Ý �Ç�����hà������ á��� Å ¶H·#¸i¹6º+»+¼�Æ ¿ Ã Ý �8����� �� É ���Ê�'� á � �� Å ¶H·#¸i¹6º+»+¼�Æ ¿ Ã Ý �8�����aà������ á £ ¬ °Bà Î4¬ ¥Q° Ý ���Ná

����� � � Ý ¿ ·#¶iÀ(ÁDº�ÂaË � �� Å ¶H·#¸i¹6º+»E¼6Æ ¿ á Ã�� Ë à ÎI¬ ¥F° Ý �� +ª� %á

/ 1 m6,2!#� � Z \)l�Q / !C?0?EKa?EK�@h�%.H.�_4K ?�! G �+<-$2� ;#; K ?�! ����  _ � q{o�|B~�t���� �K����� Z

6��!:�@j>!@BAd@jg� FWA�g�Ad:0� kh=��U�! / !#� ;#;F1 ?�$Ú!#� / !#� ; �%$D9 1 $�m*9#=2� 1 $ 1 9 1 )E. ; 9O)+9#� G , ; 9�w'� ; =2?+@y$ 9#? wR�]?EKk9#=2�&l?�!C!#�+&l9y9SR / � l��� ��& "0�%$#&('*),+.-,"�/�/!13254 ¡ � _ � q{o}|{~�t���� �/����� Q «�­�£�«E�� ­ T l � q{o}|{~�t���� �/�����

kh=2� / !C?0?EK 1 $ u ?�. u � ; ; =�?E@ 1 $2m�9C=')E9L9C=2� 1 $ 1 9 1 )E. u )E.H,2� ; )E9 14;`U � ; 9#=�� ; 9 )E9C� 1 $ u )+! 1 )E$D9 l 1 Z¯��ZHq « ­P¥§¦ �u¨ « �� ­ Zkh=2��K ,2.i. / !#?0?+K 1I; m 1Hu �%$ 1 $ / 1 m�,2!C� � Z â ZXkh=2��K ?�.H.i?+@ 1 $2mo.H� G>G )B&%)E$e�+) ;F1 .YR¢w'� / !#? u �%$pK !C? G 9C=2�x)� 1 ? Ge;?EK�9#=2�B9#=��%?�!�RU&(?�!#!C� ;F/ ?6$'< 1 $�mp9C? � q{o�|B~�t���� �K�����

�����! #"��%$#&('*),+.-,"0/�/!1! �%��&#$(/

mpo"qjr"sut�v�l Q�HKI8JxL�_ ���W� T £ y q{o�|B~�t����h��m!l QSH8IKJ<L ��-� MKIPO-L T £mpoWqjr}sut�vP¥§¦ �u¨ y q{o}|{~�t�������m

q{s"! _ � q{o}|{~�t���� �/����� Q mpo"qjr"sut�v�£ y q{o�|B~�t����h��m T

^0�%��^0�+&(9 1 ?6$ � Z �hZ � K ?�!a)B< 14; &l, ;C;F1 ?6$p?+Kr9C=2��K ?6! G ?+Kr9#= 14;L/ !#?0?+Kv?)w2. 1 mN)E9 1 ?�$�@y=2�%!C�y9#=2� ; �%98?+K 1 $ 1 9 1 )E. ; 9O)+9#� ;14;h1 $ ; 9#��)�<e<-� U $��+<³w�Re) / !C�+< 1 &")E9#��Z6��!:³9G¯�:�#�CE>%$!@BAd@jCE> C'&KI t�t � q{o}|{~�t���� � Q $p? / �%!O)+9 1 ?6$ V�;8/ !#��&l?�$'< 1 9 1 ?�$ 14; !#�d± , 1 !#�+<J9C?PwR�Ê)Ê@a�%.i.Y_ K ?6! G ��<K ?�! G ,2.I)�Zikh=��ÊK ,�.i. �����,�-� / !C?0?EK8?�w2. 1 m0)+9 1 ?6$ 1I;

( $*) �+ ) ),"��%$(&#'*),+.- 254

s���¡¢r)l HKIKJ<L £dt��)|�r�l MKIPO-L £mpoWqjr}sut�v�l HKIKJ<L�_ ���"� £ y q{o�|B~�t����h��m!l HKI8JxL �� � MKIPO-L £

q{s�! _ � q{o�|{~�t���� �K����� Q mpoWqjr}sut�v�£ y q{o}|{~�t�������m T, o�r _SI t�t � q{o}|{~�t���� Q su��¡¢r�£jmpo"qjr"sut�v T l.6

kh=2� / !C?0?EK{&l? G � ; <-?+@y$ 9#? ; =2?+@ 1 $�m�Q su��¡¢r �� mpoWqjr"s�t�v T l76 qß@y= 1 &�= )+m0) 1 $ !#�+<D,'&l� ; 9#? ;F1HG>/ .i�Þ9�R / ��_&�=2��&�� 1 $2m�Z6��!: 9�CEFWA-#�CE>.$G@{A�@DC�> C�&<I t�t � q{o�|B~�t���� � Q $Ú? / �%! )E9 1 ?�$ V�;p/ ? ; 9O&l?6$'< 1 9 1 ?6$ 1I; !C��± , 1 !#��<¤9C? w'��) @a�%.i.Y_K ?�! G �+<{K ?�! G ,�.4)�Z?kh=2��K ,2.i. ��������� / !#?0?+K8?)w2. 1 mN)E9 1 ?�$ 14;

Page 39: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

��� ����������� ��� � � ���� � � �������

� � ��

Ù�$6Ã Ý �Ç�����hà�� ��� á Ù $ à Î4¬ ¥ á� Ù ÈÉ $6Ã Ý �Ç����� �� É ���Ê�'� á Ù $ °Bà Î4¬ ¥ á� Ù�$aË � �� Ù ÈÉ $ Ë à ²#¬ °ß° Ý Í áQÝ Eª £ ¬ °Bà £ �#Î ¢0à Ù $ áQá� ¶iÁ�� à µ8¶H·#¸i¹6º+»+¼lµ8½(½�¾ Ý Ù�$ � Ù ÈÉ $ á § ¢ ¨ à�� § ¥ �F� £0¡ � � ¬6¬EÏ à § ¢ � ¥ ¬0Ý Eª��0ª � á

����� � � �Ó¾ à µÇ¶i·#¸i¹6º+»+¼lµ8½(½%¾ Ý Ù $ � Ù ÈÉ $ á ÃOµ8¶i·C¸i¹�º+»+¼lµ8½(½%¾ � § ¥ �Q� £0¡ � � ¬6¬+Ï à Î4¬ ¥Q°x¡ �:§©¬ ¢ Ý +ª��0ª � á

/ 1 m6,2!#� � Z â l�Q / !C?0?EKa?EK�@h�".i.�_4K ?�! G �+<-$�� ;#; K ?�! � �)� � _ � q{o�|B~�t���� �K����� Z

( /�#& �+ ) ),"��%$(&#'*),+.- 254

su��¡¢r�l H8IKJ<L £�t��)|Sr)l MKIPO-L £� �u�E���mpoWqjr}sut�v�l HKIKJ<L�_ ���"� £ � �����E�u�E���y q{o�|B~�t����h��m!l HKI8JxL �� � MKIPO-L £mpoWqjr}sut�v�l HKIKJ<L�_ ���"� £ y q{o�|B~�t����h��m!l HKI8JxL �� � MKIPO-L £

q{s�! _ � q{o�|{~�t���� �K����� Q � �E�E���mpoWqjr}sut�vh£ � ���������E���y q{o�|B~�t����h��m T, � v"| _SI t�t � q{o}|{~�t���� Q su��¡¢r�£�t��)|Sr)£ � ���E���mpo"qjr"sut�v�£ � �u�u�E�E�u���y q{o}|{~�t�������m!£DmpoWqjr"s�t�v�£ y q{o�|{~�t�������m T l.6

kh=2� / !#?0?+Kh!C�+<-,'&(� ; 9C? ; =2?+@ 1 $2mÝ Å ¶H·#¸i¹6º+»+¼�Æ ¿ Ë� �����������-�Å ¶i·C¸i¹�º+»+¼�Æ ¿ � Ù6ÁD»��kÀ ÈÉ ºE»+¸4À $ á à �

@y= 1 &O=*)+m0) 1 $*!#�+<D,'&l� ; 9C? ;F1HG>/ .i�k9�R / ��_z&�=2��&�� 1 $2m�Z/^N�%�¢^0��&l9 1 ?�$ � Z �hZ � wR�".i?+@±K ?�!Ê)>< 14; &l, ;C;F1 ?6$U?+Ky) G ?6!#�) /2/ !C? / ! 1 )+9#�ßK ?6! G ?+K ; ,'&O=*) / !C?0?EKa?)w2. 1 mN)E9 1 ?�$ Z®�A,�!:�¯�F � kh=2�B@h�%.H.�_4K ?�! G �+<-$2� ;#;Ð/ !C?0?EK8?�w2. 1 m0)+9 1 ?6$>K ?�!h9C=2� / !#��&l?�$'< 1 9 1 ?�$>?+KH" q{sut � q{o�|B~�t����J1I;y; 9#! ) 1 m�=D9�_K ?�!#@t)E! <-Z ^ 1 $'&l� $ r}¡�q{sut =') ; $2? / !#�+&(?�$'< 1 9 1 ?�$�Q G ?6!#�a&l?6!#!#��&l9#.YR0q%9#=2� / !#��&l?�$'< 1 9 1 ?�$ 14;v;F1HG>/ .YR �^����� T q�9#=2�"!#�14; $2?�@h�".i.�_4K ?�! G �+<-$�� ;#; / !C?0?EK�?)w�. 1 mN)E9 1 ?�$ Z�kh=2�h@a�%.i.Y_ K ?6! G �+<D$2� ;#; / !#?0?EK�?�w2. 1 m0)E9 1 ?6$JK ?�!L9C=2� / ? ; 9O&l?6$'< 1 9 1 ?6$?EK�" q{sut � q{o�|B~�t���� &%)+$2$2?�9Pw'�Þ< 14; &�=')+!#m6�+<*) ;B1 9 ; 9O)E$s< ;WlB; �%�$^N�+&l9 1 ?�$ � Z ��Z � w'�%.i?+@ K ?�!x< 14; &l, ;C;F1 ?6$ Z�kh=2�@h�%.H.�_4K ?�! G �+<-$2� ;C; / !#?0?EKv?�w2. 1 m0)+9 1 ?6$pK ?�!a9#=2� / ? ; 9O&l?6$'< 1 9 1 ?6$>?EKP$ r"¡�q{sut &%)E$�wR�k< 1I; &O=')E!Cm��+<*Q ; �%�0X ��V 5 � ] T l$2?�9C�w9C=')E9�9#=��w@a�%.i.Y_ K ?6! G ��<-$2� ;C; ?+K�y q{o�|B~�t����h��m Q s Tx<-� / �%$s< ; ?6$«9C=2�]) ;#; , G>/ 9 1 ?6$�9#=')+9p9C=2�]&l?�$ �Q,2$'&l9s � mpoWqjr}sut�v =2?�.I< ;Wla; �"�UX ��V 5 � ] )+$'< ^N�+&l9 1 ?�$ � Z���Z � wR�".i?+@±K ?�!Ô< 14; &(, ;#;Q1 ?�$ Z

1�2�� 2�� 5 <E?>6&D �<���69;96@? � ��= � ��� � ��;96 H<E?>6�� G#D

f g�Ad@jFW=?g��!@ D@{A�7³C�&iI t�t � q{o}|{~�t���� �ikh=2� / !C?0?EK'?�w2. 1 m0)+9 1 ?6$Jm6�%$2�%! )E9#��<8w�R+�����,�-�oK ?�! ; =2?+@ 1 $2m ; )+9 14; U )�w 1 . 1 9SR?EK�9#=2� ;F/ �+& 1�U &%)+9 1 ?�$U?+KL9C=2�B? / �%! )E9 1 ?�$ I t�t � q{o�|{~�t����{14;"l

Page 40: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

������� �� ��� � ����� ��� ��� �!� � � � \

+ ),),"0�%$#&('*),+.- � + &(� �

su��¡¢r�l HKI8JxL £�t��)|Sr)l M8IPO-L £� �������mpo"qjr"sut�v�l HKI8JxL�_ ���W� £ � �u�E�E�u�E���y q{o}|{~�t������Em!l H8IKJ<L �� � M8IPO-L £

q{s"! _ � q{o}|{~�t���� �/����� Q � ���u���mpo"qjr"sut�vh£ � �u�E�E�u�E���y q{o}|{~�t�������m T £, o}r _SI t�t � q{o�|{~�t���� Q su��¡¢r�£^� �u�E���mpoWqjr}sut�v T

��mpo"qjr"sut�v�l H8IKJ<L�_ � �W� � � y q{o}|{~�t������Em!l H8IKJ<L ��-� M8IPO-L �Q , � v"| _�I t�t � q{o�|B~�t���� Q s���¡¢r)£�t��)|Sr�£ � �u�u���mpoWqjr}sut�v�£ � �u�E�E�u�E���y q{o�|B~�t����h��m!£jmpo"qjr"sut�v�£ y q{o}|{~�t������Em T %

q{s�! _ � q{o�|B~�t���� �K����� Q mpo"qjr"sut�v�£ y q{o�|B~�t����h��m T�T

kh=2� / !#?0?+Kh!C�+<-,'&(� ; 9#? ; =2?+@ 1 $2mp9C=')E9Ô9#=�� ; 9O)+9#� 1 $ u )+! 1 )+$-9y=�?�.4< ; K ?6!y@ 1 9#$�� ;#;yu )E.i,�� ; � �E�E���mpoWqjr}sut�v b «hsu��¡¢r�­)E$'< � �E�u�E�E�u���y q{o�|B~�t����h��mU�X«hsu��¡¢r��� t��)|Sr�­ Z Q K ,�.i. / !C?0?EKÔ?+Ky9#=�� ; )E9 14; U )�w 1 . 1 9�R]?EK�I t�t � q{o�|{~�t����|1I;Ê/ !#� ; �%$-9C�+<1 $ / 1 m6,2!#� � Z � w'�%.i?+@PZ

�������' � ���������������' � ��� �!���#"$�&%'�' ( )�*+*�*�*,�-�./�#� � 0���12�3����� 547698�:'�; )�*+*�*�*<*�*+*=�.>-?�/@����BA+CD,'��12�3�E�F�HG*DI "$�&%'�J:' K .L��M. ?N�.L-?�O@P���BAQNSRQRQTU1V)S* *�*�*,�-�.O��� � 0XW?)�*�*U*�*�*�*+*=�.>-?�/@����BA+CD,<:

)�*+*�*�*,�-�./�#� � 03Y[Z����\)E*�*�*�*U*�*+*=#.L-?�O@P����A+C], �%���! #"��%$(&#'*),+.-,"0/�/1! )#^���_`1 ' (Ua 'U;�a '<K�:� 1�b+� �����dcI ���Q���Be :#��12�3����� G*DI "$�f%'�J: b +gcIih e� Oj /$2_k1 ''�a ' ��:( Z��U�lbX� �B�m�ncI ��� �!�BeJYo1�bX�<������e�: )�/�_kb +�cIph e )�)9j �]1V��:; Z��U�l1 )�*U*�*�*�*�*+*=#.L-?�O@P���BA+C],&qr1�b+� �����dcI ���Q���Be :2:sYt15Z��U� )�*�*�*U*�*�*+*=�.L-9�/@�����A+C],guFZB���l12bX� �B�m�ncI ��� �!�Be�:�:

)�/�_ )�)9j �� vq 1 '�;<a ��:K 1V)E*X*<*�*�*U*X*=#.L-?�O@P����A+C],&qr1�b+� �����ncI ��� �!�Be :2:��#1�������� G* I "$�&%'�J: q( Oj /!$�_k1 '�; aw��:x 1�b+� �����Be :��#1�������� 5476?8�: b ++e /j /!$�_`1 'Q:y 1V)S*+*�*�*,�-#./���<�Q0suk12bX� �B�m�Be�:�:��#1�������� 5476?8�: u /j /$�_`1 ' (Ua x :z 1 )E*X*<*�*�*U*X*=#.L-?�O@P����A+C],&qr1�b+� �����ncI ��� �!�Be :2:sY{1 )�*U*�*�*�*�*+*=#.L-?�O@P���BA+C],|q}1�b+� �����dcI ��� �!�Be�:�: Y �*)�^~j 5�?1VK�:� � R 0?� !����� N3.>-?�/@����BA�1?� ������W ���Q����W?)�*+*�*U*�* *+*=#.L-?�O@P���BA+C],W?)�*+*�*�*�*U*X*=�.L-9�/@�����A+C],&qr12bX� �B�m�ncI ���Q����e�:�: j /�^ )��%����1 z :�� 1V)S*+*�*�*,�-#./���<�Q0suk12bX� �B�m�Be�:�:sY[Z��U�l1V)�*U*�*�*�*�*+*=#.L-?�O@P���BA+C],|q}1�b+� ������cI ��� �!�Be�:�:

Y ��� h � V^ )?j &�1 +�:?1 ' (�a��awY ��� h � $(���'�&�1 h :?1 x aw(�awY !� /�_�_�1 +�:91 )�/�_ /j / $2_�1VK�:�a ;�:�:2:� .L��M. ?N�.L-?�O@P���BAQNSRQRQTU1V)S* *�*�*,�-�.O��� � 03u`1�b+� �����Be :#W7)E*X*U*�*�*�*�*=#.L-?�O@P����A+C],&qr1�b+� �����ncI ��� �!�Be :2:

�%��� #"0��$(&#'*) +.- "0/�/1! ����&($#/�1 y awK�a�Q��:

�~���V6 �v��,#-�./�#� �Q0��#�3�E�F� V4?6?8��Q�=#.L-?�O@P���BA+C],�#�3����� G* I "$�&%'�|�� R 0?� !����� N3.>-?�/@����BA�1?� ������W ���Q����W )�*U*�*�*�*�*+*=#.L-?�O@P���BA+C],W�=�.L-9�/@�����A+C],<:s�i.>��M. ?N3.L-9�/@�����AQNdRQRQT�1�,�-�./�#� �Q0�W�=#.L-?�O@P���BA+C],:

���! 5�?1 y awKUa � V�?1 � a��Q:�:

/ 1 m6,2!#� � Z � lHQ / !C?0?EK8?+K ; )+9 1I;`U )�w 1 . 1 9SR{K ?6!�I t�t � q{o}|{~�t���� Z

Page 41: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

��â ����������� ��� � � ���� � � �������

SUT�� 2XB`y^^+S*�odg^"�>c ^Ef8f8\�X[f

1�2� 243 ��? � 8 <E?LBEI ? � �0B � N��#BEN �769G

Q .i9C=2?�,2m6=Ú9�R / ��_z&�=2��&�� 1 $2m 1 $ ��������� 14; m6�%$2�%! )E.H.�R*,2$'<D�+& 1 <�)�w2.H�0q8)*&l�%!C9O) 1 $Ú) G ?�,2$D9J?+K ; , /2/ ?�!C9>&l?6,2.4<, ; �lK ,�.i.�RKw'� / !#? uD1 <-�+<�whRÓ9 )�&l9 1 & ; Z Q @ 1 <-�a&l.4) ;#; ?+K29SR /21 $2mÔ) ;#; �%!#9 1 ?�$ ; &%)+$PwR�8� ; 9O)�w2. 1I; =2�+< ;Q1iG>/ .YRy9#=2!C?�,2m6=9#=2�], ; �*?+KB,2$ 1eU &%)E9 1 ?6$A)E$'< w')�&O�-@t)E! < ; &O=') 1 $ 1 $2m�@ 1 9C= ) / !#��_z<-� U $��+< ; �%9p?+KBK ?�! G )E9 1 ?�$ !#,2.H� ; Z /2?�!�! 2) G>/ .H�0ql9C=2�gK ?6.i.i?+@ 1 $2m ; �%9v?EK'!C,2.i� ;r14;v; ,��e& 1 �%$D9r9#?Ô� ; 9 )�w2. 14; =x9#=2�a9SR /21 $2mk) ;#; �%!#9 1 ?6$ ; K !#? G ^0�+&l9 1 ?�$ � Z � Z \)lY Oj /!$�_ »Dà � Å Ã �Ý »BË Å á Ã�� )�/�_3 Oj /$2_ �oà � �� É µ

� �� �oà �g� ���

�� /j /$�_ »Dà � Â6à �8à������Ý »���  á à � q( Oj /!$�_ »Dà � ÚÅ ÃOµ �oà � �� É µÝ � � Ù6» ÈÉ Å $ á à �^0�%��^0�+&l9 1 ?6$ � Z���Z � K ?�! G ?�!#�Ê< 14; &l, ;#;Q1 ?6$ Z

1�2� 2�� �F<H;96&I�<E?>6�� G N���BPN���D

7:$*9C= 14;k; �+&l9 1 ?6$*@h�o$2?69#� ; ? G �J?+Ky9C=2��&l?�$ ; ��±0,2�%$'&(� ; ?+Ky9C=2� ;F/ �+& 1eU &%)+9 1 ?6$ ; m 1iu �%$ 1 $N^0�+&(9 1 ?6$ ; � Z â )+$'<� Z � Z Q�; < 1I; &l, ;C; �+< 1 $ ^0�+&l9 1 ?�$ � Z � Z � )�w'? u �0q ; ,'&O= u )+. 1 <�)E9 1 ?�$�&�=2��&�� ; @h?6,2.4<*wR��&l? G � / !C?0?EKa?)w�. 1 mN)E9 1 ?�$ ;1 K�9#=2� ;F/ �+& 1�U &%)+9 1 ?�$e.4)+$2m�,')+m��x@h�%!C��9#?�w'�ß� -9C�%$'<-�+<>9C? 1 $'&l.H,'<-��9C=2� G Z��� kh=2�"!#� 14; )�,2$ 1 ± ,�� 1 $ 1 9 1 )+. ; 9 )E9C�0q0=') u-1 $2m « ­ ) ;81 9 ;-mpo"qjr"sut�v _ U �".4<o)E$s< «E�� ­ ) ;81 9 ; y q{o�|{~�t�������m _ U �%.I<-Z7:$*aPb�c�q-9#= 14; &l?6,2.4<³w'� ; 9O)E9C�+<e) ; 9#=2��K ?6.i.i?+@ 1 $2mo.i� GÞG ) l

��� ��&(� +�^��#& + &*)�^ )�_�_ +¡ � _ � q{o�|{~�t���� �K����� Q mpoWqjr}sut�v�£ y q{o}|{~�t�������m T l � q{o�|{~�t���� �K����� £

mpoWqjr"s�t�v�¥z«�­y q{o�|B~�t����h��m ¥¬«E�� ­

7:$e9C=2�0T ; &�=2� G )J&%)+.4&l,�.i, ; q 1 9t&l?�,�.4<$w'�B@y! 1 9#9C�%$]) ; K ?�.H.i?+@ ;Wl% µ8¶i·C¸i¹6ºE»+¼lµÇ½l½%¾ Õ ÖO×ÒØ & Å ¶H·#¸i¹6º+»E¼6Æ ¿ ËÚÙ ÈÉ $

��� Q�; )�!#� ; ,2.i9�?EKv) ; ,'&%&l� ;C; K ,2.s&%)E.H.-9C? I t�t � q{o�|B~�t���� q�9C=2� mpo"qjr"sut�v _ U �%.I<{?+K�9#=2� ; 9 )E9#�y=s) ; 9C=2�y$2�%@Ú$') G �)�<2<-��<w9#? 1 9�Z87�$*aPb�c�qD9#= 1I; @h?�,�.4<$w'�B@y! 1 9#9C�%$ l

�J���QN�.L-?�O@P���BA�^ )�_�_ +

s���¡¢r)l HKIKJ<L £dt��)|�r�l MKIPO-L £¡ � _ � q{o�|{~�t���� �K����� Q � �E�E���mpoWqjr}sut�vh£^� ���u�E�������y q{o�|B~�t����h��m T l � q{o�|B~�t���� �K����� £¡ � _ � q{o�|{~�t���� �K����� Q mpoWqjr}sut�v�£ y q{o}|{~�t�������m T l � q{o�|B~�t���� �K����� £

, � v"| _SI t�t � q{o�|{~�t���� Q su��¡¢r�£�t��)|�r�£ � �h�E���mpo"qjr"sut�v�£ � �u�u�E�E�u���y q{o�|{~�t�������m!£jmpo"qjr"sut�v�£ y q{o�|B~�t����h��m Tmpo"qjr"sut�vP¥ � �E�E���mpoWqjr}sut�v b «hsu��¡¢r�­

7:$e9C=2�0T ; &�=2� G )J&%)+.4&l,�.i, ; q 1 9t&l?�,�.4<$w'�B@y! 1 9#9C�%$% � º+º%µ8¶i·C¸i¹�º+»+¼ & ¿ ·#¶HÀlÁDº% � Ë ¿ ·#¶HÀlÁDº% � Ù6Á-»���À�� $

Page 42: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

������� � � �P� ����� �!��� � ��� � � ���

��� kÐ)+�0�%$>? u �%!a)E.H.�<2)E9C� ;h1 $>9C=2��R0�+)+!%q09#=��B< 14; 9#! 1 w2,29C�+<o,2$ 1 ?6$e?EKv9#=���!#� ; ,2.i9 ; !C�%9#,2!C$2�+<¢whRo9#=���$ r"¡�q{s�t? / �%!O)+9 1 ?�$ 1I; �! �)�&l9C.�R mpoWqjr"s�t�v Z ^0,'&O=e)E$�) ;#; �%!#9 1 ?6$ 14; )%@y�D@y)+!O<w9C? ; 9 )E9#� 1 $e� 1 9#=2�%! G �%9C=2?D<-Z[Ó?�9C�p=2?+@a� u �%!B9#=')+9%qv@y=2�%$Ú) u )+. 1 <2)E9 1 ?�$¤&�=2��&���&%)E$Nw'� ; 9O)+9#�+< qv9#=2� T u �%! ;F1 ?6$ 1I; m6�%$2�%! )E.i.YRwKz)+! G ?6!#�&l?�$'& 14; ��Z_nÔ$�9C= 14;B/ ? 1 $D9%q�X ] Z ] &l?6$-9 ) 1 $ ;J; ? G �>�! �&l�%.H.i�%$D9 1 .i.H, ; 9C!O)+9 1 ?6$ ; ?+K�=�?E@ 9#=�� ; &O=2� G )>$2?69O)+9 1 ?6$=2�%. /s;y; 9#!C,'&l9C,2!#�x)E$s<w= 1 <-� G )+9#=2� G )E9 1 &%)E.s<-�%9O) 1 .\Z

1�2� 2C1 5 <E?>6&D �<���69;96@? � � �H=�8 ��;@?>6���;&B�69G�6@?>6&<H; D ?L<E?LBED

7:$ �����,�-�yqy9#=�� 1 $ 1 9 1 )+. ; 9O)+9#� G , ; 9¢w'� <-� U $��+< � / . 1 & 1 9#.YR0q w�,29 G ?6!#�*m��"$2�%!O)+.i.YR w'?69#= T )E$s< aPb�c; , /2/ ?6!#9B9#=2� / ? ;#;F1 w 1 . 1 9SRe?EK G ,2.H9 1H/ .i� 1 $ 1 9 1 )+. ; 9O)E9C� ;Ó1 $�)E$ )�w ; 9#!O)6&l9 ;Q/ ��& 1�U &")E9 1 ?�$ whR ;Q1iG>/ .YR>!#�d± , 1 ! 1 $2m) / !C�+< 1 &")E9#�o@y= 1 &O=�<-� U $2� ; @y= 1 &�= ; 9O)E9C� ; &")E$ wR� 1 $ 1 9 1 )+. ; 9 )E9C� ; Z�kh=-, ;BG ?�!C�om��%$��%!O)+.i.�R]9#=2�"!#��@ 1 .i.?wR�9F@a? / !#?0?EKa?�w2. 1 m0)E9 1 ?6$ ; ) ;C; ?D& 1 )E9C�+<U@ 1 9C=*9#=2� 1 $ 1 9 1 )+. ; 9O)E9C� / !#��< 1 &%)+9#� l ?�$��o9#? ; =2?+@ 1 9 14; ){@a�%.i.Y_ K ?6! G ��<K ?�! G ,2.I)-q6)E$'<J9C=2�h?69#=2�%!�9#? ; =2?+@Ú9#=s)E9 1 9 1I;L; )+9 14; U )�w�.i�PQ 1 Z¯��ZHq%9#=2�"!#� 14; )E9�.i�+) ; 9L?6$2� / ? ;#;Q1 w2.H� 1 $ 1 9 1 )E. ; 9 )E9C�)T�Z/s?6!y9#=2�PaPb�c ;Q/ ��& 1�U &")E9 1 ?�$em 1Hu �%$ 1 $ ^N�+&l9 1 ?�$ � Z � )�w'? u �Nq-9#=�� / !#?0?EKa?�w2. 1 m0)E9 1 ?6$ ; @a?�,2.I<³wR�

��� ��&5254 © l � q{o�|B~�t���� �K�����Q ©�ª mpo"qjr"sut�vP¥¬«�­ T l.6

��� ��& � + &#� � � © l � q{o}|{~�t���� �/����� � ©-ª mpo"qjr"sut�v�¥ « ­

1�2� 2�� � BM;9;�� � ��= 8 BEI�G#BED D � � � �HDW?LN � G#I 6@? 6�� G#D

�_�JK �%�".Ð9C=')E9B9#=��o@h�%.H.�_4K ?�! G �+<-$2� ;C;h/ !#?0?+KÔ?)w2. 1 mN)E9 1 ?�$UK ?6!ß? / �%!O)+9 1 ?6$ / ? ; 9O&(?�$'< 1 9 1 ?�$ ;B14; 9C?0?w!C� ; 9C! 1 &l9 1Hu �) ;Ó1 9�&l,�!#!#�"$-9C.�R ; 9O)E$s< ;�1 $ �����,�-�yq ;F1 $s&l� 1 9 1I; $2?�9 / ? ;C;F1 w�.i�o9#?|) ;#; , G �x9#=')+9�9#=2� ; 9 )E9#� 1 $ u )+! 1 )+$-9Ô=2?6.4< ;K ?�!y9#=�� / ? ; 9�_ ; 9 )E9C�0q $2?6!Ó9C=')E9y9C=2�B? / �%!O)+9 1 ?�$ VÜ;�/ !C�+&l?6$'< 1 9 1 ?6$w=�?�.4< ; ZR8?�$ ;Q1 <-�%! K ?6!r�! �) G>/ .H�Ð9C=2�L? / �"!O)E9 1 ?6$ " q{sut � q{o}|{~�t���� Z!kh=2� / ? ; 9 &l?�$'< 1 9 1 ?�$ 14;it��)|Sr�¥ y q{o�|{~�t�������m Q su��¡¢r T Z^ 1 $'&(��y q{o�|B~�t����h��m*14; ) / )E!#9 1 )+. K ,2$'&l9 1 ?�$ q 1 9 1I; $2�+&l� ;#; )+!�R>9C? ; =2?+@ 9C=')E9 su��¡¢r � ¦ ��¨ y q{o�|B~�t����h��m Z�]h,29wR?69#=�9#=2� / !#��&l?�$'< 1 9 1 ?�$Q su��¡¢r � mpo"qjr"sut�v TÔ)E$s< 9C=2� ; 9O)E9C� 1 $ u )E! 1 )E$D9nQ mpoWqjr}sut�v¢¥ ¦ �u¨ y q{o}|{~�t�������m T�)E!#�$2�%�+<-��< 1 $Ú?�! <-�%!o9C?�&l? G>/ .H�%9#�o9C= 14;J/ !C?0?EK�Z 7�9o@h?�,�.4<Nw'�w$��+&l� ;C; )E!�R�9#?�)6<2<«)*&(?�$ �Q,2$s&l9o?EKk9#=2�>K ?6! Gsu��¡¢r � ¦ �u¨ y q{o}|{~�t������Em 9C?o9#=2� / ? ; 9O&(?�$'< 1 9 1 ?�$ 1 $>?�! <-�%!y9C?�wR�Ê)�w2.H�ß9C?�< 14; =')E!Cm��B9#=�� / !#?0?+K8?)w�. 1 mN)E9 1 ?�$) ;h1 9 ; 9 )E$'< ; Z�kh=��ß? u �%! ;F1 m�=D9h=') ; wR�"�%$]&l?�!C!#�+&l9C�+< 1 $YX ] /EV�� 5 � ] Z�^0�%� ^0�+&l9 1 ?�$ 3 Z 3 K ?6!y9#=2�k!#� uD14; �+< / !C?0?EK?)w2. 1 m0)+9 1 ?�$ ; Z

1�2� 2�� 8 ��=LB 69G�?LBM;9;96 �BMG�? ��= � � � ����;96 H<E?>6�� G �BMG#BE=L<E? �H=

c*)E$hRp?+Kv9#=2� / !C?0?EK ; )�w'? u �x)E!C� ; 9C!O) 1 m�=D9FK ?6!#@y)+!O<³w2,29y9C�+< 1 ?�, ; Z ^0? G ��?EKv9C=2��9C�+< 1 , G @a?�,2.I<¢w'��!#�%. 1 � u ��<1 K�9#=2� ����������L!#?0?+KÔn8w�. 1 mN)E9 1 ?�$ ZÔ�%$2�"!O)E9C?�!y@a�%!#�x)o. 1 9C9#.H� G ?6!#� ; ? / = 14; 9 1 &%)+9#�+<�Z/s?6!>�! �) G>/ .i�0q89#=2� ��������� K ?6! G ?+Kx9#=2�*@a�%.i.Y_ K ?6! G �+<D$2� ;#;J/ !#?0?EK[?)w2. 1 mN)E9 1 ?�$«K ?6!>9#=2� / !#��&l?�$'< 1 9 1 ?�$ ?+KI t�t � q{o�|{~�t����[1I;Wl

( $*) �+ ) ),"��%$(&#'*),+.- 254

s���¡¢r)l HKIKJ<L £dt��)|�r�l MKIPO-L £mpoWqjr}sut�v�l HKIKJ<L�_ ���"� £ y q{o�|B~�t����h��m!l HKI8JxL �� � MKIPO-L £

q{s�! _ � q{o�|{~�t���� �K����� Q mpoWqjr}sut�v�£ y q{o}|{~�t�������m T, o�r _SI t�t � q{o}|{~�t���� Q su��¡¢r�£jmpo"qjr"sut�v T l.6

Page 43: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

��� ����������� ��� � � ���� � � �������

Q $e��± , 1iu )E.H�%$-9Xw2,29 G ?6!#� ; ,'&%& 1 $'&l9 u �%! ;Q1 ?�$ 1I;Wl

( $*) �+ ) ),"��%$(&#'*),+.- 254

su��¡¢r�l H8IKJ<L £�t��)|Sr)l MKIPO-L £¡ � _ � q{o�|B~�t���� �K����� Q mpo"qjr"sut�v�£ y q{o�|B~�t����h��m T l � q{o}|{~�t���� �/�����

su��¡¢r��� mpo"qjr"sut�v�l.6

^ 1iG>1 .4)+!#.�RNqE9C=2�%!#� 14; $2?o$2�%��<{9C?J!#�d± , 1 !#�Ô9#=2� 1 $ u )+! 1 )E$D9g9C?�w'��!#��_ � ; 9O)�w�. 14; =2�+< 1 $ ; =2?+@ 1 $2m ; )E9 14;`U )�w 1 . 1 9SRo?+K!#�+)6<�_ ?6$2.�R*? / �%!O)+9 1 ?6$ ; Z kh=2�{K ?6! G ?EKy9C=2� ; )+9 1I;`U )�w 1 . 1 9SR / !#?0?+KÔ?)w2. 1 m0)+9 1 ?�$*K ?�!�" q{s�t � q{o�|B~�t���� &(,2!#!C�%$-9C.�Rm 1iu �"$³w�R �����,�-� 1I;Wl

� �%�*) "��%$#&('*),+.- � + &#� �

su��¡¢r�l H8IKJ<L £jmpo"qjr"sut�v�l H8IKJ<L�_ � �W� £y q{o�|B~�t����h��m?l H8IKJ<L ��-� M8IPO-L £

q{s"! _ � q{o}|{~�t���� �/����� Q mpo"qjr"sut�v�£ y q{o�|B~�t����h��m T £, o}r _c" q{sut � q{o�|B~�t���� Q su��¡¢r)£DmpoWqjr"s�t�v T

� t��)|Sr�l M8I�O-L���Q , � v"| _c" q{sut � q{o�|B~�t���� Q su��¡¢r)£dt��)|�r�£ y q{o�|B~�t����h��m T %q{s�! _ � q{o}|{~�t���� �/����� Q mpo"qjr"sut�v�£ y q{o}|{~�t������Em T�T

Q G ?�!#� ; ,'&%& 1 $'&l9 u �%! ;Q1 ?6$w@a?�,2.I<³wR� l

� �%�*) "��%$#&('*),+.- � + &#� �

su��¡¢r�l HKI8JxL £¡ � _ � q{o}|{~�t���� �/����� Q mpo"qjr"sut�v�£ y q{o�|B~�t����h��m T l � q{o�|{~�t���� �K����� £

su��¡¢r � mpoWqjr"s�t�v� t��)|Sr)l MKIPO-L � t��)|�r�¥ y q{o}|{~�t�������m Q su��¡¢r T

/ 1 $')+.i.YR0q%, ;F1 $2mÔ)E$x�! D9#�%$'<D�+<�$2?�9 )E9 1 ?�$ 1 $B@y= 1 &O= / )E9C9#�%!C$ ; )E!#�t)E.H.i?+@h�+< 1 $B9#=2�Xw 1 $s< 1 $2m / .4)�&(�g?+K�±0,')E$D9 1eU �+<�! / !#� ;C;F1 ?6$ ; q09C=2� ; )+9 14; U )�w 1 . 1 9SR / !C?0?EKv?)w�. 1 mN)E9 1 ?�$�K ?�!a) ; 9O)+9#��_z&O=')E$2m 1 $2mx? / �%! )E9 1 ?�$ ; ,'&O=�) ; I t�t � q{o�|B~�t����&l?�,2.I<³wR� ; 9O)E9C�+< 1 $e9#=2� G ?6!#� ; ,'&%& 1 $'&l9gK ?6! G l

+ ),),"0�%$#&('*),+.- � + &(� �

s���¡¢r)l HKIKJ<L £dt��)|�r�l MKIPO-L £¡ � _ � q{o�|{~�t���� �K����� Q mpoWqjr}sut�v�£ y q{o}|{~�t�������m T l � q{o�|B~�t���� �K����� £

s���¡¢r��� mpoWqjr}sut�v� ¡ � _ � q{o}|{~�t���� �/����� Q mpo"qjr"sut�v�£ y q{o�|B~�t����h��m T l � q{o�|{~�t���� �K����� �

� q{o�|B~�t����h��m<¥ � �E�u�E�E�u���y q{o�|B~�t����h��mU�X«hsu��¡¢r��� t��)|�r�­

Q �L)+9#9#�"!#$ ; )+!#�J$�?�9Ô&l,2!C!#�%$D9#.YR ; , /2/ ?�!C9#�+<*w�R �����,�-� 1 $e9#=���w 1 $'< 1 $2m / .4)6&l��?EK ± ,')+$-9 1�U �"! ; ZeT7:$ ; , G>G )E!�R0qEw�R / )�R 1 $2m G ?�!C��)E9#9C�%$D9 1 ?6$_9C?e9#=2�oK ?�! G ?EK / !#?0?EKk?)w�. 1 mN)E9 1 ?�$ ; q ; ? G �o?EKÔ9C=2�p9C�+< 1 , G ?+Ku �%! 1eU &%)E9 1 ?6$�&%)E$�w'�Ó!C�%. 1 � u �+< �+9#=2�y!C� ; ,�.i9 1 $2m / !#?0?+Kv?)w2. 1 mN)E9 1 ?�$ ; )+!#� G ?�!C�y. 1 �0�".�R�9C?nw'�Ó!C�%, ; �+<o) ; .i� G>G ) ;; , /2/ ?6!#9 1 $2m ; ,uw ; ��±0,2�%$D9 u �%! 1eU &%)E9 1 ?6$ ; Z

Page 44: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� � ��� ���� �

� �Ú��� � ��� ����� ��� � � �*�¤��

kh= 14; &") ; � ; 9C,'<�RU=s) ; )E$�) /2/ !#��& 1 )�w2.i� ; )%K �%9SR�_z&l! 1 9 1 &%)E.v) ;F/ �+&l9"qr)E$s< 1 .i.i, ; 9#! )E9C� ; 9#=2��)+$')E.YR ;Q14; 9C�+&O=2$ 1 ±0,2� ;/ !#? uD1 <-�+<nwhRJ9C=2�Ô9F@a? G �%9#=�?D<-?�.H?�m 1 � ; Z?kh=2��Te)+$'<¢aPb�c ;Q/ �+& 1�U &%)E9 1 ?�$ ; )+!#�Ô@y! 1 9#9#�"$ 1 $�< 1 ² �"!#�%$D9 ; 9SRD.i� ; q9#?�= 1 m6=2. 1 m�=D9y)o$-, G w'�%!8?EK / ? 1 $D9 ; Z

% T+V WYX[Z]\_^"`aX[b XJcedgfkh=2� / !#?�w2.i� GY14; 9#?�<D� ;F1 m�$ ) ;Q1iG>/ .i��k ! ) �|&$c*)+$')Em6� G �%$D9¢^�R ; 9#� G Q\k c ^uTB@y= 1 &�= ; )+9 1I;`U � ; )*m 1Hu �%$; )�K �"9�R / !#? / �%!C9SR�Zikh=2�Ô9#! ) �|&�!C�%m 1 ?�$�9#?Pw'��&(? u �"!#�+<nwhRo9#=2�Kk c ^ 14; < 1Hu-1 <-�+< 1 $-9C? ! ?�$2� ; Z �8)�&O= ! ?�$2�Ô=') ;)J<-� U $2�+<p. 1iG>1 9Ð9C?o9#=2��$D, G w'�%!L?EK u �"= 1 &l.H� ;Ð1 9y&%)+$e&l?�$D9O) 1 $ Q 1 9 ;���� , ����q�|\� T�Z�kh=2�"!#��@ 1 .i.Ew'�B)E$>? / �%!O)+9 1 ?6$K ?�! G ? uD1 $�mB) u �%= 1 &l.H�gK !#? G ?�$2� ! ?�$2�Ô9#?[)E$2?69#=2�"!%q ; ,uw��Q�+&l989C?J9#=��PF�g &S:�A�79G¯�CE9�:�¯�A�7U9C=')E9a9#=2�k&%) / )�& 1 9SR?EK�$2? ! ?�$2� 14; � u �%!h�! �&l�%��<-�+<-Zkh= 14; &%) ; � ; 9#,s<�R>@y) ; )6<2) / 9#�+<>K !#? G )J.4)E!Cm��%! QÓ1 !�_\k ! ) �|& R8?�$D9#!C?�.�&%) ; � ; 9#,'<hR 1 $YX ] /PV � 5 � ] Z

% T(} ~��*X ~ `a��� * 5 �pc*� ��XJb XJced 'w�*f�dLXJb ^Ec �

��� ½EÁDÀ ��� À�¹6¶�����À � � ½EÁDÀ ¥ �O� ¥ �( �� ¢ �C h�Q�0�����6�-�k¬�Î ¡ ­�­v�D¬6 Q z§ Í ­³�pÝ4§ £ � ¢ �:§ à1D� ¥   Î4¬ ¥ á��O¬ ¢ �(  ¡%¢D£�� ÀO¹6¶�����À �Q�0�y���6�-�a¬�Î ¡ ­�­'�D¬6 Q z§ àÍ ­³�BÝ § £ � ¢ ��§�1D� ¥  gÎ4¬ ¥ ár¨+�O��§H²F­³�( O´

� �

Page 45: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� � ����������� ��� �� � � �E� � � � � � � � � � � � �� �

�R���� ½+Á-ÀOÂ6ÃFÄ � ½+Á-À�(ÀO¹�¶ � �ÜÀ�Â6ÃQÄ � ÀO¹�¶ � �ÜÀ�ܽ �C»E¸4¶H½+Á à � ÀO¹6¶�����À É � ½+Á-À�C½+Á-¸4À(Á-¸Cà � ½+ÁDÀ É���C»��0» �(¶i¸4¼Dà � ½+Á-À É���ܽ �C»E¸4¶H½+Á Ý .��(À�¹6¶ � ��ÀOÂ�. á� � ½+ÁDÀ�Â% � à � ½EÁDÀO & �C½+Á-¸4À(Á-¸ Ý � á Ë

Ù �DÃ�(À�¹6¶ � ��ÀO . �ܽ �C»E¸4¶H½+Á Ý � á Ë � $% � à � ½EÁDÀO & �C½+Á-¸4À(Á-¸ Ý � á�� �#»��N» �(¶i¸4¼ Ý � á

�L�0�* ��O�p¬%Î �O¬ ¢ �( p¬%Î�§ ¢ �Q� ¥ �( :�o§H  ¥ �O� ¥ �( �� ¢ �Q� £�Í �� ½+ÁDÀ� ª ¡%¢D£ �Q�0�e ��O�o¬%ÎÔ¨E�O��§ ²F­³�( p¬%ÎÓ§ ¢ �Q� ¥ �( :�>Ý4§ ´ �+´³ª¡ ­�­�¨E�O��§ ²F­³�( hÌL§³�Q��§ ¢ �Q��§H  ¡ �0��­�§H² ¡ ��§³¬ ¢ á Í � �(ÀO¹�¶ � �ÜÀ� ´�L�0� ­³¬0² ¡ ��§³¬ ¢  R¬%Î0¨+�O��§H²F­©�( R§ ¢ �O¬ ¢ �(  ¡�¥ �r¦%§³¨+� ¢ÔÍ �h�Q�0�Î4Ñ ¢ ²#��§³¬ ¢ �ܽ �C»E¸4¶H½+Á ªr²#¬ ¢  �� ¥#¡ § ¢ � £  �¬>�Q� ¡ �Ô�Q�0�B¨E�O��§ à²F­³�(  ¬%Î0§ ¢ �Q� ¥ �( ��r¬0²O²#Ñ ¥ ¬ ¢ ­©��§ ¢ �F�0� �O¬ ¢ �(  ¬%Î0§ ¢ �Q� ¥ �( ��(´ ¥ ¬ ° �F�0� �ܽ �C»E¸4¶H½+Á § ¢ ÎI¬ ¥Q°x¡ ��§³¬ ¢ ªÓ�Q�0� �C½EÁD¸4À(Á-¸ ¬�Î� ¡ ²F� �O¬ ¢ �J§H  £ ��1 ¢ � £ �Q¬ Í �o�Q�0� ¢ Ñ °�Í � ¥ ¬%Îa¨E�O��§ à²F­³�( g¬%Î�§ ¢ �Q� ¥ �( ��ǧ ¢ �Q� ¡ � �O¬ ¢ �+´�L�0� °x¡�� § ° Ñ °   ¡ Î4��² ¡ � ¡ ²F§©���Ó¬%ÎD� ¡ ²F� �O¬ ¢ �v§H  ¦%§³¨+� ¢Í � �#»��0» �(¶i¸4¼ ´�L�0��  ¡ Î4�O���B� ¥ ¬+�-� ¥ ���J§  g� � � ¥ �( Q �� £p¡   ¡ ²#¬ ¢  �� ¥C¡ § ¢ �§ ¢ �F�0�Ô �� ¡ �Q�h§ ¢ ¨ ¡%¥ § ¡�¢ �(´

[Ó?�9C�p9C=')E9x9#=2� �e� ���)| q � s K ,2$'&l9 1 ?�$ 14; &l?6$ ;F1 <-�%!C�+< 9C?<w'�>,2$s<-�%!�_z<-�%9C�%! GÞ1 $2�+<e?�$ u )+.i,2� ; ?6,29 ;Q1 <-�>9C=2� ; �%9!�r�~�q � � r�v"l 9C=')E9 14; q�K ?�! !�l���r�~�q � � r q �e� ���)|\q � s Q ! T�<-�%$2?69#� ;a; ? G � ! ?6$2�0q�w2,298$2?69#= 1 $2mo&")E$�wR�k<-�+<D,'&l�+<�)�w'?�,�99#=2� ! ?�$2�e?�9C=2�%!o9C=')E$Ú@y=')+9{K ?6.i.i?+@ ; K !#? G 9#=2� / !#�+< 1 &%)E9C�>?EK�k c ^EZ�[Ó?69#�e)+. ; ?*9#=')+9%q8?�$Ú9#=2� ! ?6$2� ; ?+K1 $D9#�%!C� ; 9"q 9C=2� u )+.i,2��?EK � � sh|�r"sh|J14; <-� U $2�+< 1iG>/ . 1 & 1 9#.eR 1 $�9#�%! Ge; ?+K�� � s�r�v q !�r�~�q � � r�v )+$'< �e� ���)|\q � s �v9#=2�;F/ �+& 1eU &%)E9 1 ?6$ ; )�R ; $�?�9#= 1 $2m )�w'?�,�9>9#=2� u )E.H,2�U?+K � � s�|Sr"s�| ?�$«?69#=2�"! ! ?6$2� ; qh$2?�!Þ<-?0� ;�1 9�&l?6,2$-9�9#=�? ; �u �%= 1 &(.i� ; @y= 1 &�=])E!C�B$2?�9k) G ?6$2m !�r�~�q � � r�v Z

�R��� Õ ÖO×ÒØ�'���

� ½+Á-ÀOÂhËÚÙ $Û ¢ §©�:§ ¡ ­Ü­³���Q�0�� ��0 ��Q� ° §  ß� ° �0���+´�Ý Û �BÎ4¬%­�­³¬%Ìa ÓÎ ¥ ¬ °�Q�0�Ô :� ¡ �Q�h§ ¢ ¨ ¡%¥ § ¡%¢ �8�Q� ¡ � �(À�¹6¶ � ��ÀOÂhËÚÙ $ ´©á

� �'������� Ö�����#Ë X��R��� % �'��� � + � ½+Á-ÀO � Ë � ½EÁDÀOÂ�* �#»��N» �(¶i¸4¼ � Ë �C»��N» �l¶H¸4¼ ]� O-J������ Ö���� 14; , ; �+<pK ?�!y? / �%!O)+9 1 ?6$ ; @y= 1 &O=><D?p$2?69Ô&�=s)E$2m6��9#=2� ; �%9y?+K ! ?6$2� ; ?EK 1 $D9#�%!C� ; 9a?�!y9#=�� 1 !t&%) / )6&W_1 9 1 � ; Z

� ½ �(À � À�¹6¶ � ��À� �R��� ��� Ö�������"à � À�¹6¶ � ��À� �"à � ½+ÁDÀ��� � �lÀO¹6¶�����À�Â�(ÀO¹�¶ � �ÜÀ� � Ë �lÀO¹6¶�����À�Â�ܽ �C»E¸4¶H½+Á��-Ë ��½ �C»+¸4¶i½+Á"!�Ù �0� ÈÉ � � $

�L�0� � ½ �(À � ÀO¹�¶ � �ÜÀ ¬E�D� ¥C¡ �:§©¬ ¢ ° ¬%¨+�( w¨+�O��§H²F­©� ���§ ¢ �Q¬ �O¬ ¢ � � � ª Ì8�0� ¥ � �0� §H  ¡ Ï ¢ ¬%Ì ¢ ¨+�O��§H²F­³�+´�Ý Û �Î4¬%­�­³¬"Ìh 2Î ¥ ¬ ° �Q�0�� :� ¡ �Q� § ¢ ¨ ¡�¥ § ¡%¢ �r�F� ¡ � � � � � ½+Á-ÀO ´�á�L�0�y  ¡ Î4�O���Ô� ¥ ¬E�D� ¥ ���B¬ ¢ �Q�0� ¢ �OÌÚ �� ¡ �Q�L§H Ð� ¢ ÎI¬ ¥ ²#� £§ ¢Ú�R��� � ´

% TOS ~��*X ~ `a��� * 5 �pc*� ��XJb XJced 'w�*f�dLXJb ^Ec 243 5

687!9�:<;*:0=?>!@BA�@DCE>GF# � s�r )E$'< ��r�~�q � � r )E!C� / )E! ) G �"9#�%! ; 9#?Ú9#=�� ;F/ �+& 1eU &%)E9 1 ?6$rqÓ!C� / !#� ; �%$D9 1 $2m�9#! ) �|& ! ?�$�� ; )E$'< u �%= 1 &l.i� ;!#� ;Q/ ��&l9 1Hu �%.�R�Z

Page 46: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

���������W���� ���E� ���7� �!����� ��� �� ���

f-A�ghA�:<;*:�=i>!@BAd@jCE>kh=2�%!#�t)E!C�h9Q@h? ; 9 )E9#� u )+! 1 )�w2.i� ;Wl ��� , ����q�| �Ó1I; ) U $ 1 9C� / )+!#9 1 )E.0K ,2$'&(9 1 ?6$J!C�%.4)+9 1 $�m ! ?6$2� ; 9#?�9C=2� 1 !v&%) / )6& 1 9 1 � ; q)E$'< �e� ���)| q � sw1I; ) G ) / !C�%.4)+9 1 $�m u �%= 1 &(.i� ; 9#?�9#=�� ! ?�$2� ; 9C=2��R>?D&"&l, / R�Z��������� O-J�� ������ , ����q�|\� l # � s�r �� � �

� � ���)|\q � s l ��r�~�q � � r ��-� # � s�r���� x¡ � _)O-J ��Q ��� , £ �e� � T ¤ � ��� �e� ����¦ ��¨ ��� , % � � � � ��� �e� � � � � s�|Sr"s�| Q � £ �e� � T�� ��� , Q �hT���)� � ¡ � _�O-J��XQ ��� , £ � � � T ¤ ��� , ¥ «E�� ­

� ��¦kh=2� ; )%K �%9SR / !#? / �%!C9SR 14; �! / !#� ;C; �+<]) ;�/ )E!C9�?EKt9#=2� ; 9 )E9#� 1 $ u )+! 1 )+$-9pZB7�$*?�!O<D�%!ÓK ?�!k9#=2� ; )�K �%9SR / !#? / �%!#9SR9#?�wR�x@h�%.H.�_4K ?�! G �+< qD=2?+@h� u �%!"q2)�&l?�$ ; 9#! ) 1 $-9 14; )�<2<D�+<w9C=')E9 ; )�R ; 9#=')+9�)+.i.v?D&%&l, /�1 �+< ! ?6$2� ; =') u �J<D� U $2�+<&%) / )6& 1 9 1 � ; Q � ��� �e� ���§¦ �u¨ ��� , T Z��G>.#)A�@DC�>�;*:�=i>!@{A�@jCE>!FQ $>)+, 1 . 1 )E!�RJK ,2$'&l9 1 ?�$ � � s�|�r}s�|h14; , ; �+<p9C? U $'<�9#=2��$D, G w'�%!L?EK u �"= 1 &l.H� ;r1 $e)Bm 1iu �"$ ! ?6$2� l m 1iu �"$>) ! ?�$2���)E$'<e)J.H?D&%)E9 1 ?�$ G ) /�/21 $2m �e� � q � � s�|Sr"s�| Q � £ �e� � T U $'< ; 9#=���$-, G w'�%!8?EK u �%= 1 &l.i� ; !o1 $>9C=2�x<-? G ) 1 $Þ?EK �e� �; ,'&O=e9#=')+9 �e� � Q ! T ¥ �uZ

� � s�|Sr"s�|Kl # � s�r� Q ��r�~�q � � r �� � # � s�r T � �� � s�|Sr"s�| Q�� £ �e� � T ¤ � ��� ¦ Q ¦ ��¨ Q �e� � �« � ­ TST

®�9�:�¯�g�A�@DCE>°;*:�=i>!@BAd@jCE>!FJ � !�r���r�~�q � � r Q !�l ��r�~�q � � r�£ � l # � s�r T�����#� ¦ ��� , ����q�|\� l # � s�r ��-� �

��� � � ���)|\q � s l ��r�~�q � � r �� � # � s�r��� � ! � ¦ ��¨ �e� ���)| q � s % � � ¦ ��¨ ��� , ����q�| � % � � s�|Sr"s�| Q � £ �e� ���)| q � s T � ��� , ����q�|\� Q���T���)��� �e� ���)| q � s$¥ � �u�E�E����e� ���)| q � s�� «�!�� � � ­

kh=2�J? / �"!O)E9 1 ?6$ J � !�r���r�~�q � � r Q !�£ �hT G ? u � ;Lu �%= 1 &l.i� ! 9#? ! ?6$2� ��Z�kh=�� ����� . 1 $2� ; )�R ; 9#=��ß? / �%!O)+9 1 ?6$�&%)E$!#�+)6< Q � ¦ TKw2,29B$2?69J@y! 1 9#�o9C?e9#=2� ��� , ����q�| �¢U �%.I< qv)E$'<�&%)+$_!C�+)�<��"@y! 1 9#��9#? �e� ���)| q � s Z�kh=2� / !#�+&(?�$'< 1 9 1 ?�$; )�R ; 9#=')+9 ! )E$'< � G , ; 9�w'���D$2?+@y$w9C?J9C=2� ; R ; 9C� G )E$s<|9C=')E9 � G , ; 9iw'�Pw'�%.i?+@ 1 9 ;LG )� 1iG , G &%) / )�& 1 9SRwR�(K ?�!#� ! &%)+$�wR��)6<2<-�+<«9C? 1 9�Z kh=�� / ? ; 9 &l?�$'< 1 9 1 ?�$ ;Q1iG>/ .YR ; )�R ; 9#=s)E9e9#=2�*? / �%!O)+9 1 ?6$ , / <2)E9C� ; 9#=2��e� ���)| q � sw1 $-K ?�! G )E9 1 ?6$pK ?�! ! Z

% T&% ')(ÚX�*�^,+-*Ô�od8^%�>c ^+f8f8\*XJf

��2��#243 � <M= ?>6&<H; � ��G#N ?>6�� G#D � BP=AD ��D ��G#I BP= � I�BO?LBP= 8:69G#<�N��

kh=2� G ) 1 $ ; 9SR-. 14; 9 1 &8< 1 ²��%!#�%$s&l��wR�"9F@a�%�%$x9#=2�y9Q@h? ;F/ �+& 1�U &%)+9 1 ?�$ ; m 1iu �%$[)�w'? u � 1I; w'�%9Q@h�%�%$x9#=2�a, ; �y?+K�9#?�9 )E.K ,2$'&l9 1 ?�$ ;Ð1 $x9#=2��T ;F/ �+& 1�U &%)+9 1 ?�$o)+$'< U $ 1 9C� / )+!#9 1 )E.DK ,2$'&l9 1 ?�$ ;Ð1 $o9C=2��aPb�c ;Q/ �+& 1�U &%)E9 1 ?�$ Zikh= 1I;Ð14; $2?�9a)K ,2$'<2) G �%$D9O)E. < 1 ²��%!C�%$'&l��wR�"9F@a�%�%$>9C=2�B9Q@h? G �%9C=2?D< ;h1 $ / ! 1 $s& 1i/ .H�0q ;F1 $'&l�Pw'?�9#= G �%9C=2?D< ; )�&"&l? G>G ?D<2)E9C�

Page 47: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� 3 ����������� ��� �� � � �E� � � � � � � � � � � � �� �

9#=2�>9Q@a? ; 9SRD.i� ; �L=2?+@h� u �"!%qÐ9C=2� �������-� / !#?0?EKk9#=��%?�!�R K ?6!�aPb�c X ] /PV � 5 � ] <-?0� ; $2?69 ; , /2/ ?�!C9 1 $ U $ 1 9#�K ,2$'&l9 1 ?�$ ; ZQ &l? G>G ?�$Ú)+!#m�, G �%$D9 1 $«Kz) u ?6,2!>?+K U $ 1 9C� / )E!C9 1 )+.ÓK ,2$'&(9 1 ?6$ ;p1I; 9#=')+9 1 $ U $ 1 9C�wK ,2$s&l9 1 ?�$ ; &")E$2$2?69*wR�< 1 !C�+&l9#.YR 1HG>/ .i� G �%$D9#�"<-Z�kh=2��R�)E. ; ?�)6<2<�&l?6$ ;F1 <-�%!O)�w2.i�|&l? G>/ .i�! 1 9SR>9C?*9#=2� / !#?0?+K�9C=2�%?6!�R�Z'�_��wR�". 1 � u �9#=2�%!C� 14; )�9C= 1 ! <Jm�?0?D<>!#�+) ; ?6${K ?6!g$�?�9a)E.H.i?+@ 1 $2mk9#=2� G l $') G �%.�R0q+9#=s)E989#=2�y, ; �y?EK / )E!C9 1 )E.2K ,2$'&l9 1 ?6$ ; K ?�! &l� ;9#=2� ;F/ �+& 1eU �%!y9#?Þ&l?6$-K !#?6$-9Ô9#=2� 14;C; ,2�B?EKa,2$s<-�%!�_z<-� U $2�+<-$2� ;#; Zt7:$e9C= 14; &%) ; �0q�)E$')+.�R ;F14; ?EK / )E!C9 1 )+. 1 9�R 1 $e9#=2�aPb�c ; 9O)+9#� 1 $ u )E! 1 )E$D9y.i��)�<>9#?o9C=2�x)�<2< 1 9 1 ?�$')+.L&l?6$ ; 9C!O) 1 $D9

�*��� �ܽ � � � �� �#»��;F1 $s&l� 1 9 14; !#��±0, 1 !C�+<*9#=')+9 ��� , Q���T�w'�U<D� U $2�+<*K ?�!o)+.i.a?D&%&l, /21 �+< ! ?6$2� ; Q 1 Z¯��Ziq K ?�!�)+.i. � � � ��� � � � T Z ]�R&l?�$D9#! ) ; 9"qÐ9C=2� ;F/ �+& 1�U &%)+9 1 ?�$�m 1iu �"$ 1 $ ^0��&l9 1 ?�$ � Z â ; @a�%� /'; 9#=2��@y=2?�.H� / !#?)w�.i� G ,2$s<-�%!J9C=2�Þ&%)E! / �"9%qiwhRG ) � 1 $2m ��� , ����q�| � ){9C?�9 )E. K ,2$'&(9 1 ?6$ Z^ 1 $'&(�y?�$2�Ô?EK 9#=2� G ) 1 $o!#?6.i� ; ?EK )�9#? / _ .H� u �%. ;Q/ ��& 1�U &")E9 1 ?�$ 1I; 9C? G ) �0�y,2$s<-�%!#.YR 1 $2mB) ;#; , G>/ 9 1 ?�$ ; �! / . 1 & 1 9%q9#= 1I;ß; ,2m�m6� ; 9 ; 9C=')E9x) / )E!C9 1 )E.LK ,2$'&l9 1 ?6$ ;�; 9SRD.i�0q &l?�, / .i�+<U@ 1 9#= / )E!C9 1 )+. 1 9�R�)E$')+.�R ;F1I; 9#�+&O=2$ 1 ± ,�� ; q 1I;ÓG ?6!#�) /2/ !C? / ! 1 )+9#��Z

��2��#2�� ��D B � � < ����69;96&<M=�� � � G#N ?>6�� G#D

Q $2?�9C=2�%! ; 9SRD. 1I; 9 1 &U< 1 ²��%!#�%$s&l� w'�%9Q@h�%�%$ 9C=2��9F@a? ;F/ �+& 1eU &%)E9 1 ?6$ ; )�w'? u � 1I; 9C=')E9"q�9#=2� ;F/ �+& 1�U &%)+9 1 ?�$ 1 $^0�+&l9 1 ?�$ � Z â 1 $D9#!C?D<-,'&l� ; ) ; 9O)E9C� u )+! 1 )�w2.i�JK ?6!B9#=2�Þ&l?�$D9#�"$-9 1 $-K ?�! G )E9 1 ?6$�)E$'<*, ; � ; )e&l?6$ ; 9C!O) 1 $D9 1 $*9#=2�; 9O)+9#� 1 $ u )E! 1 )+$-9�9#?Ú<D� U $2� 1 9 1 $«9#�"! Ge; ?EKx9#=��U?�9C=2�%! ; 9O)+9#� u )E! 1 )�w�.i� ; q�@y=��%!#�+) ; 9#=�� ;F/ �+& 1eU &%)E9 1 ?6$ 1 $^0�+&l9 1 ?�$ � Z � 1 $-9C!#?D<-,'&(� ; )+$ )+, 1 . 1 )E!�R�K ,2$'&l9 1 ?�$ )E$'< ) /2/ . 1 � ;o1 9o9C?�9#=2��) /2/ !#? / ! 1 )+9#� ; 9O)+9#� u )E! 1 )�w2.i� ; ZQ m0) 1 $rq29C=2� ; 9SR-.H� ; )+!#� 1 $D9#�"!O&O=')E$2m6�+)�w�.i� l � 1 9C=2�%!h9C�+&O=2$ 1 ±0,2�B&")E$*w'�J� G>/ .i?�R0�+< 1 $ T]?�!KaPb�cNZkh=2�e)�< u )+$-9 )Em6�w?+K 1 $-9C!#?D<-,s& 1 $2m]$2�%@ ; 9O)E9C� u )E! 1 )�w�.i� ;B14; 9C=')E9o9C=2��R G ) �0�o9#=2� ;F/ �+& 1eU &%)E9 1 ?6$��+) ;Q1 �%!x9#?,2$'<-�%! ; 9 )E$'< q ;F1 $'&l�>9C=2��R )E.H.i?+@ 9C=2� ;Q/ ��& 1�U �"!J9#?�<D!O)%@P< 1 !#��&l9#.YR*?�$ G ?�!C�p$�?�9O)+9 1 ?�$ )+$'<�9#�%! G>1 $�?�.i?6m)R�Zkh=2�x< 14; )�< u )E$D9O)+m�� 14; 9#=s)E9Ô9#=2��RÞ&%)+$<w'�x) w2,�!O<-�%$e@y=2�"$U< 14; &O=')+!#m 1 $2m / !C?0?EKa?)w2. 1 mN)E9 1 ?�$ ; Qz&l? GÞ/ )E!C��9#=2�< 14; &l, ;#;Q1 ?6$w?+K8!#��<-,2$'<2)+$'&WR 1 $ ^0�+&l9 1 ?�$ � Z � Z � T Z�^0? G � � 1 $'<>?EK�w')+.4)+$'&l� 14; !C��± , 1 !#��<-Z

��2��#2C1 � �#BMG D � � ��;&I ?��#B D ?L<E?LB 69G���<�=>6&<HGH? � � ;&I��

7:$wR?69#=Na�b�c )E$'<STvqÐ? / �%! )E9 1 ?�$ ; )E!#�Þ) ;C; , G �+<_9#?xw'�e)E9C? G>1 &)Z*kh=2� 1HG>/ .i� G �%$09C?�!�?+Kk)E$�? / �%!O)+9 1 ?6$&%)E$xw2!#�+) �])E$ 1 $ u )E! 1 )E$D9y@ 1 9C= 1 $e9C=2�nw'?D<�R]?EKt) / !#?D&l�+<D,2!#�0q / !C? uD1 <D�+< 1 9 14; !#�p_ � ; 9O)�w2. 1I; =2�+<*w�RÞ9#=2�x9 1iG �9#=2� / !#?D&l��<-,2!#�o!C�%9#,�!#$ ; Z�]h,29"q ) ; R8. 1 ² ��?�$2� ;Ô/ ? 1 $D9#�+<U?6,29�9C?>, ; q�9#=2� ; )�K �"9�R / !C? / �%!C9�Re9C=')E9�$�? ! ?�$�� V�;&%) / )6& 1 9SR 1I; � u �%!8�! �&l�%�+<-��< ; =2?6,2.4<>=2?6.4<e)E9 � � � 9 1iG � ; Z Q $2?69#=2�%!y� 2) G>/ .i�y@a?�,2.I<¢w'�B9#=2��, ; ��?+K 1 $-9C�%m��%! ;?EK w'?6,2$'<-�+< ;F1"! ��Z?[Ó� 1 9C=2�%! G �%9C=2?D<J)+.i.i?+@ ; , ; 9#?B�! / !C� ;#; 9C=2� ; 9C!#?6$2m��%!a&l?6$'< 1 9 1 ?6$p9C=')E9 ; ,'&�=�&(?�$ ; 9#!O) 1 $D9 ;G , ; 9 w'� G ) 1 $D9O) 1 $2�+<Ó9C=2!#?6,2m�=o9C? 1iGÞ/ .i� G �%$09 )E9 1 ?�$rq(!#�%mN)E! <-.i� ;C; ?EKs9#=2�t)E9#? G>1 & 1 9SRÓ?+K'9#=�� G ?D<-�".i. 1 $2muZ kh= 14;; �%� G|; 9C?$w'�Þ)>. 1iGÞ1 9O)+9 1 ?�$U?+Ky9C=2� G ?D<-�%.�_ ?�! 1 �%$D9#��<w) /2/ !C?0)�&O= 1 $*m��%$2�"!O)E.zqv<-,2��9#?e9#=2�JKz)6&l9B9#=')+9B?�$2� 14;G ?D<-�%.H. 1 $�mB)J9#! )E$ ;Q1 9 1 ?�$ ; R ; 9#� G @ 1 9C=e&l�%!C9O) 1 $>?�w ; �%! u )E9 1 ?�$ / ? 1 $-9 ; @y= 1 &�= GÞ1 m�=D9L$2?69 w'�B) ; U $���_ m6!O) 1 $2�+<) ; ?�w ; �%! u )E9 1 ?�$ ; ?+K 9C=2�y!#��)E. ; R ; 9#� G Zv7:9 ; ,�m�m�� ; 9 ; 9C=')E98&(�%!#9 ) 1 $[&l?�$ ; 9#! ) 1 $-9 ; w'�Ô< 14; 9 1 $�m�, 1I; =2�+<�K !#? G ?�9C=2�%!&l?�$ ; 9#! ) 1 $D9 ;y1 $e9C=2�B9#? / _ .H� u �%. ;Q/ �+& 1�U &%)E9 1 ?�$�)E$'<e!#��_ � ; 9O)�w�. 14; =2�+< 1 $e�+)6&�= ; ,uw ; �d± ,2�"$-9k<-� ;Q1 m�$ ; 9#� / q2! 1 m6=-9<-?+@y$U9#? 1HG>/ .H� G �"$-9 )E9 1 ?�$ Z

Page 48: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

���������W���� ���E� ���7� �!����� ��� �� � 5��2��#2�� � � ��;96&NE6@? ��=ABPN � G�I�6@?>6�� G#D

kh=2� / !C�+&l?�$s< 1 9 1 ?�$ ?EKk)E$Ú? / �"!O)E9 1 ?6$ Q ?�!BK ,2$'&l9 1 ?�$�T 14; )E$ 1HG>/ ?�!C9O)E$D9 / )E!C9o?EKÔ9C=2� 1 $D9#�"!FKz)�&(�><-� ; &l! 1 w'�+<w�RÞ)J9#? / _ .H� u �%. ;F/ �+& 1eU &%)E9 1 ?6$ ZhnÔ$>9#=2�B?6$2�B=')E$'<�q 1 9 ; 9O)+9#� ; 9#=2�Ê&l?�$'< 1 9 1 ?�$ ; ,�$'<-�%!y@y= 1 &�=Þ9#=2��? / �%!O)+9 1 ?6$&%)E$xwR� 1 $ u ? �0�+< l , ; �%! ; ?EK ; ,'&O=*)+$*? / �%! )E9 1 ?�$ G , ; 9y�"$ ; ,2!C�J9C=2�o&l?6$'< 1 9 1 ?6$ ; =2?�.I<U@y=2�%$U9C=2�J? / �%!O)+9 1 ?6$14; &%)E.H.i�+<-ZynÔ$U9C=2�B?�9#=��%!Ó=s)E$'< q�9#=2� / !C�+&l?�$s< 1 9 1 ?�$]9#�%.H. ; 9C=2� 1iG>/ .H� G �($-9C?�!8@y=')+9�=2�B?�! ; =2�o&")E$*) ;#; , G �)�w'?�,29�9#=�� ; 9O)+9#�e?EKk9#=2� ; R ; 9#� G )+$'<�9#=2� 1 $ / ,29 u )E! 1 )�w2.i� ; @y=2�%$ 1iGÞ/ .i� G �l$D9 1 $2m>9#=��w? / �%!O)+9 1 ?6$ ZS/2?�!�! 2) G>/ .H�0q0m 1iu �"$>9#=2��K ?6.i.i?+@ 1 $2m�aPb�c ;F/ �+& 1eU &%)+9 1 ?6$>K ?�!Ô) ; �+)+!O&O= 1 $2mJK ,�$'&l9 1 ?�$" q{s�t �"sut�r�� Q ��l�� £Wv�l���� T q�l ������ � � � � �)¨K� v���)��� v Q q T ¥��

9#=2� 1HG>/ .i� G �%$D9#?6!y&%)+$�) ;#; , G �J9C=')E9 � )6&l9#,s)E.i.YRe?D&%&l,2! ;Ê1 $*9#=2� ; ��±0,2�%$'&l� v )E$s<_&%)+$ �Q, ; 9 ; �+)E! &�=*,2$D9 1 .; ? G � Qz)E$hR�Tx?D&%&l,�!#!#�"$'&l� 1I; K ?6,2$'<-Z � =2�"$2� u �%!U" q{s�t �"sut�r�� Q �-£"v T 14; &%)E.H.i�+<�qg9C=2�%!#�]@h?6,2.4< wR��) / !C?0?EK?)w2. 1 m0)+9 1 ?�$U9C? ; =2?+@ 9C=')E9 1 9 ;h/ !#��&l?�$'< 1 9 1 ?�$e=2?6.4< ; Z�_� ; ,�m�m�� ; 9v9#=')+9%q ;Q1 $'&l� 1 9 14; )+$ 1HG>/ ?�!#9 )E$D9 / )E!C9Ð?+K29C=2� 1 $D9#�%!QKz)�&l��?EK�) ; R ; 9C� G V�; <-� ;F1 m6$rq+9#=2� / !#�+&(?�$'< 1 9 1 ?�$?EKÇ)[K ,2$s&l9 1 ?�$e?�!Ô? / �%! )E9 1 ?�$ ; =2?6,2.4<*wR� ; 9O)E9C�+<w� / . 1 & 1 9#.YRo) ;y/ )+!#9Ô?EK�9#=2� ; R ; 9C� G VÜ;h;F/ �+& 1�U &%)+9 1 ?�$ Z�� -K ?������� ��������R0q������������������� "!#��$&%'���� (���)��$* +!#,)�+��$*�.-0/1��!2/�-3�4,�����56/� �78 +�� +/� 9 :$;�+ "�����+�<!#/����#���=�� >�����$*�������!#�� ?�@/-@�����3%'��/��"�A$B,=��56 U 5���� +/1 l ��Z¯m�Zq{s0v"|\��s�|\q{�)|�r�l O r"oW¡ �}s0v"|\��s�| q{�)|\q � s � O r"oW¡

C suq mp� Q | � l O r"o"¡$£�|"DWl O r"o"¡ T q�l �}s0v"|\��s�| q{�)|\q � s��� � � q�l �"s0v"|\��s�|\q{�)| q � s � q{s0v"| ��sh| q{�)|Sr Q | � £�q T ¥ q{s0v"| ��sh| q{�)|Sr Q |+D�£�q T���)��� q{s0v"|\��s�| q{�)|Sr Q | � £�q T ¥ q{s0v"|\��s�| q{�)|Sr Q | D £�q T

� yFE r �"| lYl¬q{t l H ��¡¢r�����

G r |�� y:E r �W| Q s l H ��¡¢r)£Wv�l�� yFE r �"| _ ���W� T � l�� y:E r �W|��� � � � � v � �uª q{t ¥ s���)����� � v % �uª q{t¢¥ s

^H����^H��56�� +/1 � Z � Z \ -0/��I�<78 :$�56�=$�$* +/1 �/-J�����3��/1�+�3/-K� �/1,=�������� +/1 V $',�����56/� �78 +�� +/� � " ��L��/1,u_0�+��MH���N$B,=��56 U _5���� +/� Z

��2��#2�� �I�< ��?>69G ? ��B D��0BENE6� NO<E?>6�� G � �H=� ������ �

kO/���7)�,��A�����P$B,=��56 U 5����� +/1 Q-0/1� �����,�-�'R=�! ?,��+ S56 +�I�SR8,=��$&!<�=$B��wT�P��7)78��7�-0/��3M1��� S��w��"��$& + ?����/?78�=56��7 whR±U�=�� 8�� U ����$'� �7V���)�W " � +�� :���TM1���+����$'/-X���)�;$*�������;M1���� :��w��+�Y$Z![�=$*��w=�3\� "MH�� #�! ?,��+ S56 +����R l

Page 49: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� � ����������� ��� �� � � �E� � � � � � � � � � � � �� �

f-A�ghA�:<;*:�=i>!@BAd@jCE>O-J�� l�l ��� , ����q�| �§l # � H8L ��-� �

� � ���)|\q � s l�� L�� ����� L �� � # � HKL� ��  Q ��� , l # � H8L ��-� � £ �e� �)l�� L�� ����� L �� � # � HKLnT ¤

Q � ��� �e� ����¦ ��¨ ��� , T % � � l # � HKL�� � � � ��� �e� ��� Q � � s�|Sr"s�| Q � £ �e� � T � ��� , Q �hT�T� �)� � ¡ � _�O-J��XQ « �� ­�£�«E�� ­ T

687!9�:<;*:0=?>!@BA�@DCE>GF� L� ����� L ¥ s � |n��r�|Pt�r� s�r�t# � HKL ¥ s � |P��r�| t�r�Xs�r�t

��G>.#)A�@DC�>�;*:�=i>!@{A�@jCE>!F

� � s�|Sr"s�|Kl # � HKL Q � L�� ����� L ��-� # � H8L T � �� � s�|Sr"s�| Q�� £ �e� � T ¤ � ��� ¦�¦ �u¨ Q �e� � °« � ­ T

®�9�:�¯�g�A�@DCE>GFJ � !�r���r�~�q � � r Q !�l � L�� ����� L £ � l # � HKLnT�����#� ¦ ��� , ����q�|\� l # � H8L �� � � £ ��� �e� ���)|\q � s l�� L�� ����� L ��-� # � H8L��� � Q�Q ! � ¦ ��¨'�e� ���)| q � s T % Q�� � ¦ �u¨ ��� , ����q�|\� T�T % Q � � s�|�r}s�| Q�� £ �e� ���)| q � s T�� ��� , ����q�| � Q���T�T���)��� �e� ���)| q � s$¥ Q � �u�E�E�S��e� ���)|\q � s � «�! �� � ­ T

%� � ����������� �����������������

��2�� 243 �S< ;&N��;&<E?>69G ?��#B! BE< �HBEDW? ��=LBEN � G#I 6@? 6�� G

kZ�� :$#$*��56�� +/� >��$B��$$J � !�r���r�~�q � � r ��/ "�+�+��$B��� ��������)� 5���S56���:���� "/� /�-A�����4%���� �H��$*�[,)����56/1 =78 "�� +/1 /�-<� /�,=�������� "/� 4$�5 �)��!���Z?kZ���3%Z��� �H��$B��,����Y56/� =7? +�� "/� �/-J�����3/�,=��� ��� +/� J � !�r ��r�~�q � � r :$'78� U ���7³whR l" � �$#&%(' �*) � )$+-, � �.) ¤ /10 %��32�&4%5' �*) � )$+6,����7)

Page 50: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

������� �� ��� � ����� ��� ��� �!� � � � \

Q ,������ :��� �! 8,�� =$* +/� �/�-@���� S$'$�5�����!��3\� "MH��$ l" � �$#&%(' �*) � ) +6, � �7)0 %������� � )$+-, � �.)� �� �3'� )/ � '� )� 2 ��� � '� )�� �*) +6,����7)� 2 ��� � ) +6, � �7)�� � ' ����� , '� 2 � � )$+-, � �.)�� �3'� )��� '� � ) � 2 � �3'� )�� � � ������� �*,���� 2 � �3'� )�� ���� ' ����� , '� 2! � �*) +6, � �7)� 2 � " � � '� )� 2% � � � '� )# 2 & � '� � ) � 2 � "%$ '& �!� �*) +6,����7)� 2 � � ' ����� , '� 2 � "($ � $% � � � '� )# 2 & � '� � ) � 2 � " � ������� � ,)��� 2 � "&

���+* �*) +6,����7)� � '� )# 2 $ � '� )# � )$+6,����7)� 2 $ �*) +6,����7)� � ' ����� , '� 2 $ � ' ����� , '� ! & ���-,� � ��$������� �*,���� 2 $ ������� � ,)���

Q/. �' :$Z/1 ���R��;,������ :��� �! ?,=�� =$B "/� �$B " =56� O-J��9�=��$' �/��Kw=���� ��! ?,=� �78��7-ZeTR���:5 ���:���� +/1 �/-X�����&,)����56/1 =78 "�� +/1 �,���/?56����7�$�whR#$* +!#,��" -DR? + �\ �����3,�����78 :5����� �=$B " �\L�����A��M1� "�:��w)�+�356/1 8���! h_���=���T " 8-0/���!���� +/1 ³Q $*�=5��<��$K�����Z- ��5 ��$� + L����� w=/?7�R[/�-PO-J � T Z Q -0������!#/�M? + �\I���)�K±U�=���+ U ��� + ?��/3����� w=/?7�R/-X�����3�! ? :$*���� ?�� S�� ±H�=�� 8�� U 5����� "/� R?�=$B " �\[�����&- ��56�'���=�� /1032�4 &'5 " ( /60 &7 4 * 5 "

�����Pw=/?7�R�/-@�����A$�5�����!���w=��56/1!#��$ l/ � '� )# 2 ��� �3'� )�� �*)$+-, � �.)# 2 ��� � )$+6,����7)�� � ' ����� , '� 2 � � ) +6, � �7)�� �3'� )��� '� � ) � 2 � � '� )8� � � ������� �*,���� 2 � �3'� )�� � &� ' ����� , '� 2 � � )$+6,����7)# 2 � " � � '� )# 2% � � � '� )� 2 & � '� � ) � 29 � ":$ ;& �<��*)$+-, � �.)# 2 � � ' ����� , '� 2= � "($ � $% � � � '� )� 2 & � '� � ) � 2 � " � ������� �*,���� 2 � "���>* � )$+6,����7)� � '� )� 2 $ � '� )# � )$+6,����7)# 2 $ � )$+6,����7)� � ' ����� , '� 2 $ � ' ����� , '� ! & ���6,� � ��$������� �*,���� 2 $ ������� � ,)���

Q ,�,��YR8 " �\;�����3/� ���_0,=/� " 8�I�����"� /1? ��@ & 4 ? " * ? $ ) " * 5A ? "�" ( )B*C@ * 4 ) " * 5A ) "

-0/�� � � s�r�v 2 \1 +MH��$ l/ � )$+6,����7)� 2 ��� � )$+-, � �.)�DFEGEFE�D ������� � ,)��� 2 � �3'� )�� � &

� '� )� �*H� �3'� )� ' ����� , '� 2 � � )$+6,����7)# 2 � " � � '� )# % � � � '� )� & � '� � ) � 2 � ":$ '& �<��*) +6, � �7)� 2 � � ' ����� , '� 2 � "($ � $% � � � '� )� & � '� � ) � 2= � " � ������� �*,���� 2� � "���>* � )$+6,����7)� � )$+6,����7)# 2 $ � )$+6,����7)� � ' ����� , '� 2 $ � ' ����� , '� ! & ���6,� � ��$������� �*,���� 2 $ ������� � ,)���

Page 51: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

��� ����������� ��� �� � � �E� ��� � � � � �� � � ����� ����

kZ���[- ��5 �W���=�� � � sEr�v � _ # � sEr -0/1�+�+/�%I$&-0��/�! ���)�#78�Y56�:������� +MH�L " 8-0/���!���� +/� ,���/M? :7?��7Q " O-J �XZ��'��_,T�Y��� " �\<�����A��w=/�MH�A$B����,=$Z�*%' :56� !#/����&��/<���+ "!# + ����� !�r�~�q � � r�v 2 � =7 �e� ���)| q � s 2 %Z/1���:7³R? +���S7 l/ � '� � ) � 2 � �3'� )�� � D ������� �*,���� 2 � �3'� )�� � & � ' ����� , '� ! & ���6,� � ��$ " � �*)$+-, � �.)# � " � � '� )#

% � � � '� )� & � '� � ) � 2= � ":$ '& �<��*) +6, � �7)� � � ' ����� , '� ! & ����,� � � $ " � ":$ � $% � � � '� )� & � '� � ) � 2 � " � ������� �*,���� 2 � "���>* � )$+6,����7)� ������� �*,���� 2 $ ������� � ,)���

kZ���A56/� �*�) =56� � ' ����� , '� ! & ���6,� � ��$ " � � )$+6,����7)� � " � � '� )�

5�� �w=�3$B "!#,��+ U ��73��/ � # � � � sEr�v �=$* + �\3�����&��M1� "�:��w��+� 56/� ?��� 8���=��= + ?-0/���! ��� "/� R1 =�!#����R l ! # � !�r�~�q � � r�vQ /� )�W/�-@���)�;�15�56/1!#,=� hR? + �\ 56/� �*�) =56��$�T � �e� ���)|\q � s Q 2 !�r�~�q � � r�v 2 T � � � s�r�v �=� =7������&-0/��"�+/�%' + )\L�+��!#! ��$

� * �� ! & �',�� �$ " � � " � � � � "�� & �$

� & $ � � ( � � *� 7* �

kZ���A5���S56���:���� "/� �%Z/1���:7#���)�� �,���/?56����7³w�R# " 8����/?78��56 + �\<�L%' +�� ���$�$ZM����+���&-0/1� � � s�|Sr"s�| 2 $*�=5����1$ )���� '� � ) � $�� � � �3'� ) & '& �<� � )$+6,����7)# � � ' ����� , '� ! & ����,� � ��$ " � " $ � $

� =7 ,)��/�M8 " �\����=�� s�r�� � � sh|�r"sh| � # � s�r � � Z Q -0�����;$* +!#,)�+ U 5���� +/� NR �����<%Z�Y� �H��$*�W,)����56/1 =78 "�� +/1 Nw=��_56/�!#�Y$

/ ������� �*,���� 2 � �3'� )�� � &� ��* � '� )� % � � � '� )� &A )���� '� � ) � � " � ������� �*,���� 2� � "���>* � )$+6,����7)� ������� �*,���� 2 $ ������� � ,)���

Q ,�,��YR8 " �\;�����3/� ���_0,=/� " 8�I�����"�&-0/�� ������� � ,)��� 2 �� =7�$* +!#,)�+ -DR? �\PR8 "���:7)$� �+* � '� )� �* % � � � '� )� &B )���� '� � ) � � " � ������� �*,���� � "�" * ����* � )$+6,����7)�

. �I5�� *w=�L$B�)/%' ����=���% � � � '� )� �� & � � $ &B )���� '� � ) � � " � � '� � ) � � "

� ' ����� , '� ��� "($ � �� )���� '� � ) � � � "%$ � '� � ) � � � "� =7

� ' ����� , '� ��� "��$ � �� )���� '� � ) � � � "%$ � '� � ) � � � "��

Page 52: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

������� �� ��� � ����� ��� ��� �!� � � ����Z�8�=$ R $* + =5 �W-0��/1! �����(%Z� �8 )/%����=��� � ��� ���� ���� � ����� ������������ ��� , ����� �! "� �#��R=�����3%���� �H��$*��,)����56/1 "$78 +�� +/� �$* +!#,��" &%=�Y$J��/

� �+* � '� )� �* � '(' ��� , '� ��� "��$ � �� ' '� � ) � � � "*) ' ����� ' ,)��� � � "�" * ���>* �*)$+-, ' �.)# �Z���#%Z�Y� �H��$*�W,)����56/1 =78 "�� +/1 ���8��$;$���+)$&���=���<�VMH���� S56�+�A!���+-,=�#!#/�MH��7� + ?��/ �V ���% ! /� ��</� ��.+ -'���=��! /� ��3 S$Z�� =78����$ 5��,=�156 +�/+�0�J����$B�� 8����7V%' "���4���)�;���Y$B���"�&/-����) :$I5���S56���:���� "/� R=�����<$*,=��56 &%T5���� +/� 4%'�� +������!P +\��?�'%Z���+� 78��5 :78�A���=���&�����/�,=�������� "/� �$*��/����S71,=� -0�)�����)����56/� =$*��� � + )��7#$B/A���=���@ +�@ :$� �/1�'�,),��+ "��7 ���� "M8 S��+�.+3��/-2�!#/�MH�43&�&MH���� S56�+�� + ?��/����� ! /1 ��3%'�������3 "�' :$'��"�����17�+#�"/?5������7���������I :$6R?�����3%'�� +�����'!# +\1�8��%Z���"� 78��5 :78�&��/<��7�7� '(' ��� , '� ��� "��$ � �

��/������<,�����78 :5�����A/- �����5�6 ! � 87 � � � P/�,=�������� "/� *09�:�Z�� S$� :$3� ��;)�!#,)�+�;/�-'��/�% 56�+/ $B���35 /H/���7? + =���� +/1 ,T���B%����� �$B,=��5 &% 5����� "/� 4�� =7�MH���� &% 5����� "/� �5�� 4����$B�)�+�I + � "!#,���/MH�Y7[78�Y$B +\1 *0&�<�Z���;%���� �H�Y$B�I,�����5 /� =78 "�� "/� %Z/��)�:7#������ =,=��5 /�!#�3$* +!#,)�>+����* � )$+6, ' �7)� �* � �+* � '� )� �* � '(' ��� , '� ��� "��$ � � * ' '� � ) � � � "*) ' ����� ' ,)��� � � "

�@?��A?CB DFEHG IKJMLNLPOQLPRTS�U�VXWZY[U�LA\�]^ +\1������$ � 0._�` � 0baL$*��/�%>,���/H/�- $'78 :$�5 �=����\1 + �\A�����&%����+�.$F-0/1��!#�Y78 ���$�$ ,���/H/�-�/c,��+ "\H���� +/1 =$J-0/1�'�����NdKe@f $*,=��5�$ &% 5����� "/� *0�Z���A$���� :$:% �g,� "�+ "��+<,���/H/-�/h,��" +\ ��� "/� #-0/��K�6�i4 � 87 � ��j ; :$(�

kml�npoCqsrbtNu4vsw

i�� � 87 � ��j cx ��� #y��� cx����z � #y��� |{}�~ � x�� }j � � � 87 � ��j {}*~ #y��� hx

� �"ig$c�����X� ����z x � }j � ��xz[� �$/�6�i4 h�pi�x ��x ����z x � }j � �

��j g�h� � 87 � � j �{}*~ #y��M �� z g�(��$/�6�ig c��i#x �"x(� }j 4��x j g�g�y� � �"ig$c�����X��� ��z x j g�g�� ,���/H/�-I/-'���� :$I������/1����! :$&$*��/�%' + 6^ +\��)��� � 0���0H. /������+ " ��HR �����L!�� " �,=�����3/- �����L,)��/H/-I " 8MH/1�+MH��$$B��/�%' + )\[���=��I�����3 ���% $*������3,�����$*����MH�Y$K���)�;$��Y-0���/+#,)��/�,=�����/+�0��Z���L5 ���";</-@�����3,���/H/�-@ :$Z " �$B��/�%' + )\� ��� � '� )�� � *���� � /�(�� '('��( &h� ,� ��� "�" ' '� � ) � ��D �(�� '�'�� &h� ,��� � " � ' �8� � "

-0/�����"��/?5�56��,) +��7T��/1 ���$��N0��Z�� :$@56/1!#��$ 78/�%' [��/356/� �$B :7?���� " �\&�*%Z/A5��1$B��$(���¡  �A� =79�£¢¥¤:¦ � � }j 4� }-§h¨�© 0�Z���@%=��$*�&5��1$B�&-0/��"�+/�%I$K-0��/1! ���)�.- �156�'������

' '� � ) � �<D �(�� '('�� &c� ,��� � "«ª ' '� � ) � �<D �(�� '�' "��­¬� =7������3,�����56/� �78 +�� +/� ­������/ (���(� ¨ x�� }j 4�h�X®¯� ��z � ¨ ��0��Z�)�;$*��56/1 =7�5��1$B�&-0/��"�+/�%I$K-0��/1! ���)�.- �156�I���=���

' '� � ) � ��D �(�� '('°� &c� ,��� � "%$ ' '� � ) � ��D �(�� '(' "�ª ' �p� � ",�+#�����3 + ?M1��� S� ?�Z/1 ����)�W,)����$ $B� �����0

Page 53: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

�h� ������������������� ����������������������������������������

���! #"$&% ')()*,+.- l0/co2135476$58 9 l ':+<; o>=@? 'A9 oB13C4 - l:/co% �EDGF�9 l ':+A- l:/ho:qIHKJ>L M�N#O�qEPEQRM�tTS $58RU8 V: W"X'K(>*Y+ S - l0/coCqZH)J)L U [ Q�t�q\PEQ]M t^S $_%`Ua S �\D`F�9 l '�bcV0 #"X')()*dU.+fe b qEPEQRM�tTS %]gh8RU

���! #"icw $&% �\D`Fj9 l 'jbcV0 #"X')()*

�k�l W"icw % w $&% m<+A- l:/coicw % w % S 9 l ' n�o@mWpqUA+5; o>=@? '.9 or1354 - l:/ho n qEP\Q]M�tTS $58Wg#o:s�p qEPEQRM�tTSEicw % w $&%GU�Uicw % w 8 V0 #" S 9 l ' nto@mWpqU)+<; o>=@? 'A9 oCqIHKJ)L [ Q(tAqEPEQRM�t�S\icw % w %`Uicw % wha uAv �wVxV: W" S 9 l ' n�o@mWpqU.+ 6 y s M [ qEP\Q]M�tTSEihw % w 8]Uicw % w i ' l0/�z oA/�z.S m5{G9 l '.U,| u.v �}V~V: W" S 9 l ' nXo�m#p:U y Q]N����AN@� [ �)�5Ngrl� r!Q]NdS\icw % w $&%Rg:$58#g ihw % wha Uicw % wh� S m����\D`F�9 l '.UA+Ie � q\PEQ]M t^S\icw % w $&%Rg@%GU

�k�l W"icw % wh�4w $&% m����\D`F�9 l 'icw % wh�4w % ' l:/�z�oA/�z.S m<{G9 l '.U.+ 6 | qI�I��u5�:qsr!N $ �.M r!�sqsvl�>PE�.S\icw % wha g ihw % w i Uicw % wh�4w 8 m���V: W"X')()* b q��~SEihw % w $&%]g!%]gh8Wg ihw % w �gw $&%Rg i4w $_%`Uicw % wh�4wha ')()* S m�U.+ 6 s � qEP\Q]M�tTSEihw % w $&%]gG$&%Rg icw % wh�4w 8RU

��DA� J � S ' l:/�z�o./�z.S m<{`9 l 'AU~��'K(>* S m@UkU.+fe � q\PEQ]M t^S 6 U SEihw % wh��w %]g icw % wh��wha U��DA� J � S�S m����\D`F�9 l '.U�� S ' l:/�z�o./�z.S m<{`9 l 'AU~��'K(>* S m@UkU�UA+Ie � q\PEQRM�t^S\icw % wh� g ihw % wh� U

��D.� J � Sw�&� +A- l:/coj�0S�� ���\D`F�9 l 'GU�� S ' l:/�z�o./�z.S�� {G9 l '.U~��')()* S�� U�UkU.+fe �gqEPEQRM�tTSEicw %GU��D.� J � SkS �\D`F�9 l 'jb�V: W"X')()*dUx� S��&� +.- l0/coj�:Sk� ���EDGF�9 l '.Ut� S ' l0/�z oA/�z.Sk� {`9 l 'AU~��')(>* Sk� UkU�UkU.+fe � qEPEQRM�tTSZa g i U

^j�\�5�,�G� � 0._h� ��� �`�d�W �¡G¢x£#¡¤¡G¢,��¥.¡:£W¡`���E¦_§5£W�`�I£#¦_¡¤�Z¥�¨���©E©>$I ��<�GªX�#«�0

Page 54: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

������ ���������� ��� �������������^� � a

���! #"

% o4 p�+ S - l:/co 13C4�6 U oRp q\PEQ]M t8 o4 p�+ S ; o>=@? 'A9 o 1354 - l0/co U oRp q\PEQ]M ta �EDGF�o4 p]+ S - l:/coCqIHKJ)L U M�N#O�qEPEQRM�tTS 8]Ui �EDGF�o4 p |�oxp M�N#O�q [ �>PEN�q o]p� V: #"�o�4 p]+ S - l0/coCqZH)J)L U [ Q(t�q\PEQRM�t^S %.U� oxp�bcV0 #"�o 4 p o]p q r �sq����������.�ASZ� U� �EDGF�o4 p�b�V: W"�o4 p | q�������� q v!�)PE�AS sRU SZa g i g � U

���l W"�gw $&% m<+.- l0/co�gw % � S m¤��oxpqU o]p q r �sqI�/t�u#�I�<S��4w $&%GU�gw 8 � S m¤���EDGF�o4 p`U | q��������sqsvl�>PE�.S�� U S o]p q\PEQRM�t g i g �gw %`U

��D.� J � S m����\D`Fjo 4 p.Ut� S ' l:/�z�oA/�z.S m<{Ao 4 p:U,� S o4 p S m@UkU�U� q��>qZM r!O $ �sq�� s y S��4w 8]U

� �&� +.- l0/coj�:S�� ���EDGF�o4 p`U �S ' l:/�z�oA/�z.S�� {Ao 4 pqU � S o4 p S�� UkU�U �gq��)S�� U

%�� S �\D`F�o 4 p�bcV0 #"�o4 p`U,� �_� +A- l:/ho��GS�� ���\D`Fjo 4 p>Ut�' l0/�z�o./�zAS�� {.o�4 p:Ux� o4 p Sk� U � q��)S�� g � U

%R% ?w/4n8q ��k"!xS o4 p@{Ao4 pqU r!N#��q�$&%�'�r!N���MkQ [ � y � rlQRNdS %Rg#8#gd%��]U��D.� J �)(+* q,��k"!xS o4 p@{Ao4 p:U.+ ��k"! $&%�'qEPEQRM�t s ��r!QRNdS %Rg]8#gd%R%`U

^j�\�5�,�G� � 0 � � � � �`�d�W �¡G¢ £W¡¤¡G¢Y�T�E¦,�\¡`�I£#©�¥A¡q£W¡`���I¥�¨���©\©.$f ��5�Gªt��«�00

Page 55: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� � ������������������� ����������������������������������������

�k�l W"$&% � +A- l:/co$58 9 l '0+5; o)=�? '.9 o 13C4 - l0/co% o � p@+A- l:/coCqIHKJ)L o:s�p qEPEQRM�tTS $&%GU8 9 l ' n o � p@+<; o)=�? 'A9 o 13C4 - l0/co n qEP\Q]M�tTS $58Wg#%`Ua V0 #" S 9 l ' nto � p:U)+5; o>=@? '.9 o:qIHKJ>L [ Q�t�q\PEQ]M t�S 8RU

��DA� J � u.v �}VxV0 #" S 9 l ' n o � p:U.+ 6 y s M [ q\PEQ]M t^SZa U

^��\�<�Y�G� � 0 � � � � �G�d�W  ¡G¢x£#¡ ¡`¢,��«_��%x¦,�E¡G�E�<¦t�# �������/ (���¤�I¥�¨���©\©.$f ��5�Gªt�#«[00

���! #"$&% n +<; o)=�? 'A9 o$58 � +.- l0/co$ a ')()*#(]' ?!z m<+A- l:/co21354�6$ i 9 l ')( zI?.l:/ +5; o>=@? '.9 or13d4 - l:/ho$ � ?w/4n8q ��k"!xS ')(>*�(R' ?!z m<{`9 l ')( zI?.l0/ U% V: W"X'K(>*�(R' ?}z m<+.- l0/coCqZH)J)L [ Q�t�q\PEQ]M t^S $ a U8 V: W" 9 l 'K( zZ?>l:/ +<; o>=@? 'A9 oCqIHKJ)L [ Q�t�q\PEQ]M t^S $ i Ua u.v �}VxV0 #" S 9 l ')( zI?.l:/ n o � pqU.+ 6 y QRN@�k�.N������YS $58#g $ i Ui ' l:/�z�o./�z.S�� {G9 l 'K( zZ?>l:/ U | u.v �}V~V: W" S 9 l ')( zI?.l:/ n�o � pqU y Q]N����.N�� [ �)�5N4r!� rlQRNdS $<8#g $ i g a U� S!n �^V: W" 9 l 'K( zZ?>l:/ UA+Ie � qEP\Q]M�tTS $&%Rgh8]U� S�� ��V0 #"X')()*#(]' ?!z m@UA+Ie � qEP\Q]M�tTS $58Wg!%`U� S�S:n � V0 #" 9 l ')( zI?.l:/ U,� S�� � V0 #"X')()*#(]' ?!z m@UkU.+fe � q\PEQ]M t�q 8 SZ� g � U

���! #"�4w $&% S:n ��V: W" 9 l 'K( zZ?>l:/ U � Sk� ��V: W"X'K(>*�(R' ?}z m�U�4w % � �^V: #"X')(>*�(R' ?!z m � q���q v!�)P\�.S��gw $&%`U�4w 8 ' l0/�z oA/�z.Sk� {`9 l ')( zI?.l0/ U.+ 6 | qZ�I��u<�:q r!N $ �.M�r!�sqsv!�)PE�ASZa g i U�4wha ')(>*�(R' ?!z m S�� U.+ 6 s �sq\PEQRM�t^S $58#gR$ a g �4w %`U

��D.� J � S ' l:/�z oA/�z.Sk� {G9 l ')( zI?.l:/ U���'K(>*�(R' ?}z m S�� U�UA+Ie � q\PEQ]M t^S��gw 8#g ��wha U� S!n �^V: W" 9 l 'K( zZ?>l:/ U � Sk� �^V: W"X'K(>*�(R' ?}z m�Ux� S ' l:/�z�oA/�z.S�� {G9 l ')( zI?.l:/ U���')(>*�(R' ?!z m S�� U�UA+Ie � qEPEQRM�tTS�� g � U

��D.� J �Y*�� oCq!k l�npo ; o>=@? 'A9 o0S!n { � {:'K(>*�(R' ?}z m<{`9 l ')( zZ?.l0/ UA+Ie PEQ�v [ r!N#O¤S�� U

^j�E�<�,�`� � 0 � � � � �G�d�# ¡G¢x£#¡ ¡`¢,� � �G���R�<¦x«&�\¡G�E�<¦��W X�6�i4 � 87 � � j ��I¥�¨��@©\©>$I ��<�`ªt�#«�00

Page 56: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

���������� �A�����������������G�,������� ���

�k�l W"$&% n +5; o>=@? '.9 o$58 � +A- l:/co$ a ')(>*�(R' ?!z m<+.- l0/co2135476$ i � 3�3#3W3�39 l ')( zZ?.l0/ +<; o>=@? 'A9 o 13C4 - l:/co$ � 9 l ')( zZ?.l0/ +<; o>=@? 'A9 o 13C4 - l:/co$ � ?�/4n8q ��k ! S ')()*#(]' ?!z m5{ � 3�3#353k39 l ')( zI?.l:/ U% o n 4 � p�+5; o)=�? '.9 or1354 - l0/co o 4 p qEPEQRM�tTS $&%Rg:$58]U8 S � 3�3#3#3)39 l ')( zI?.l:/~S o n 4 � p:U�U.+<; o>=@? 'A9 oB1354 - l:/co q\PEQRM�t^S $ i g<%`Ua 9 l ')( zZ?.l0/ | S � 3#3#3#3k39 l 'K( zZ?>l:/� S o n 4 � pqUkU.+fe | qEP\Q]M�tTS $ � g]8]U

��DA� J �,* l �)zsq!k l�npo ; o>=@? 'A9 o0S!n { � { � 3@3W3#3�39 l 'K( zZ?>l:/ {G9 l ')( zI?.l:/ U.+fe PEQ(v [ r!N#O SZa U

^j�E�<�,�`� � 0ba#� ��� �G�d�W �¡`¢x£W¡¤¡`¢,� � �C¥A¡ �R�<¦x«&�\¡G�E�<¦��# P� �ig � 87 � � j ��I¥�¨���©\©.$f ��5�Gªt�#«[00

����� �������������! "�$#&% �('')*�+'

,@?.-A?0/ 1�J32�W�Y5462 \PY LPO9ImW�J"Y�U�WPS O87K\:9*Y�U�L�\@]��¢,��¡`�G�#£#¡Gªt�@¦_¡¤�#  � £#�G¡G�Z£W©¡G�@�Gª�¥K�)¥.� �0¢�£5¥<;��>=�� ¨¤¢,�@�G�&=@?¢BADCFEG; � �I¥�¦,�<¡K+d��¡�¥A�@¡G¡G©E�#« �\¦IHKJ £W¡^©\�#£5¥A¡¦,�<¡t�E¦MLON � �QPDRTS ¦Y�<�ULWV�X:RZY8S:0[NC�<ªt�\H £#�,¡G¢Y�<�:¥Q� �0 �0�L]N � �QPZP(S�� £W©E©\�#¨ ¦,�5¦x«_��¦,�5¡G�E¦,� ¡G���`ª�¥T,,�,¡t�E¦x¥A�Z¥A¡¡G¢x£#¡ � �G��«_� ��£#¡G�#¥�£W©\¨ £�+,¥ «_��¦,�5¡G�^J ¥A��¡G¢x£#¡8J  ��5����;Y£Wª � ©\�^JD;��>=��N _;y�`=M�¤�I¥�acbed f�g�¨¤¢Y��¦I=h?¢�ADCiE¥�j;*��0 � ¦£W©\¡`���G¦ £W¡G�E§d��£ �Y� �G�C£��:¢ �Z¥�¡G� ¥G£�+ ¡`¢x£W¡:;y�`=M��£W©E¨¤£�+Y¥�¢x£<¥ £ §5£W©\�Y� £#¦x« ¡`�Q,x� �@£W�G�] ��,©¤¡G���5¦,©>+ � �G�#§_�Z«_�£g;&�\�<ªc¥�¨¤¢,� �:¢ £W©\©E�#¨ ¡G¢,� §5£W©\�Y� ¡G�6,x� ��£#© �R�Y©I£W¡`�#« ¨¤¢,��¦k=H¢�ADCiEl;����\¦B¥A� �:¢ £ ��£<¥.�G;y�`=M�5 m;y�`=M�¨��<�Y©I«¥,x�&n(¤poTgg0�q¤  ¡G¢,� ¥A�@§d���:£#© � �G� � �C¥G£W©Z¥�¨��X¢x£�§d��¥A���@¦ � �,¡� ��5�G¨¤£#�:«5J¢,�#¨��@§d���8J��#£��:¢ ¢x£5¥�¥A¡G�q£W¦,�5�ª�£W¡`¢,��ª�£#¡G� �@£W©x£#¦,�<ª�£#©\�E�#¥���¥A���rLWs<�5¦3RDt4,3S~ ��<� £�©\�I¥.¡¤�W ��I¥`¥A�,�#¥(0q ¦ ¡G¢,�t�5¡G¢,�@��¢x£#¦x«5J£<¥�¥.¢,�#¨¤¦ �\¦kLuV�^wvyx5R � SpJ�£W¦x£#©>+Y¥A�Z¥T ��<��£4,x¥A�@¦ �R�t�#  � £W�`¡G�I£#©\�E¡�+ ��¨���©E©>$I ��<�`ªt�#«_¦,��¥G¥��� ©I£�+Y¥�£W¦X�\ª � �<�`¡:£#¦_¡�G�5©\���E¦t�G�@§d�#£W©E�\¦,���E¦ �R�5ª � ©\�@¡G��¦,��¥G¥j�E¦�£�¥ � ���R�&% �@£W¡G�E�<¦*0�vyz�^ ¥.����ª�¥�¡`�T,x��¡G¢Y��ªt�d¥.¡£ �,� �`� � �`�I£#¡G�t©E�<�<� �T ��<� ��£W�`�8+&�\¦,���<�Y¡�¥.� �:¢ £#¦x£W©.+,¥.�I¥�0 ^,�<�^��;Y£Wª � ©E�^J�£5¥ ¦Y�<¡G��«��\¦�Nd� �R¡`�\�5¦ � 0 � 0>_X£g,x�#§d�^J£W¦x£#©>+Y¥A�I¥�W �¡`¢,� ¨���©\©.$f ��5�Gªt��«_¦,�#¥`¥j�W �¡`¢,��¥.¡:£#¡G��ªt�@¦_¡�¡`¢x£W¡�¦,�T�@�<¦,�^{l¥ ��£ � £��]�\¡/+T,x����; �R����«_�#«��G�@§d�#£W©E�#«�¡G¢,�¢,�I«,«&��¦t�G�}| �,�E�G��ªX��¦_¡�¡G¢x£#¡����<¦,��¥�{ �@£ � £ �R�\¡`�\�#¥�, ��~&¦,�#¨¤¦*0<Nd�Eªt�\©Z£W�£#¦x£W©.+,¥.�#¥�¨��5�,©I«t�G�@§d�#£W©cJC ��5�¤��;Y£Wª � ©E�^J�\¦&¡G���5��� �#§d���>�x�#¨�J~£#¡G¡`��ª � ¡q¥ ¡`��£�� �]�#¥G¥ £W¦ £W�`�:£�+ �5�,¡:¥.�I«_� £W�G�q£�+-,x�<�,¦ «,¥�J�«_�E§_�Z¥A�\�5¦-,#+-���@�G�iJx� � ���q£W¡`�\�<¦ ¥, �@�\¦,� ��£#©\©E�#«t¨¤¢,��¦�¡G¢,�@�\� � �G� �R�5¦x«_�E¡G�\�5¦x¥¤£W�`��¦,�5¡ ¥G£#¡G�I¥:%x�#«5J £W¦ « ¥.���5¦*0q ¦�¡`¢,��ªt�E¦_�x¥ ¥A�Z«_�^J~¢Y�W¨���§d���$J5vyz�^ ©\�#£5«,¥ ¡G��©E�<¦,�5��� � �`�d�W K¥�J�¥A�E¦ �R���E¡��I¥ �W �¡G�@¦�¦,���R�#¥G¥`£W��+ ¡G�X�#¥A¡q£g,,©E�I¥A¢¡G¢x£#¡�¥.�",,¡G�@�Gª�¥�£W�G�^¨���©\©.$f ��5�Gªt�#«[0��k  � �d¥G¥.�>,,©E�^J,�\¡�¨��5�,©I«5, �K,x�#¥.¡ ¡`���I¥A�5©I£#¡G�^¨���©E©>$I ��<�`ªt�#«_¦,��¥G¥£W¦x£#©>+Y¥A�Z¥

Page 57: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� P ������������������� ����������������������������������������

�k�l W"

$&% n +5; o>=@? '.9 o$58 � +A- l:/co$ a ')(>*Y+A- l:/co21354�6$ i � 39 l '0+5; o)=�? '.9 or1354 - l0/co$ � ?�/4n8q ��k ! S ')()*,{ � 39 l 'AU.{k* � o:q:k l�n�o0S!n { � {q')()*,{ � 39 l '.U% n �^V: W" � 39 l '�� � �^V: W"X'K(>*�� S ' l:/�z oA/�z.Sk� { � 39 l '.U ��')()* S�� UkU �#N�PEQ�v [ rlNWO S $ � U8 S �EDGF � 39 l 'jb�V: W"X'K(>*CU � S��&� +.- l0/coj�:S�� ���EDGF � 39 l '.Ut� ' l0/�z oA/�z.Sk� { � 39 l 'GU ��')(>* Sk� UkU r!N#��q�$&%�'¤��v�rbtTS $ a g $ i g $ � Ua SQ� 39 l ' o n 4 � p:U.+ S ; o>=@? '.9 o 1354 - l:/ho U q\PEQ]M t^S $&%]g $ a g $ i Ui �\D`F S � 39 l ' S o n 4 � pqUkU~b�(���� Sk� {.�\D`F � 39 l '.U M�NWO#S.t: oqs 4 � pqU~b�s][#[ S � g M�NWO�t U S $ i gR$&%Rg�$58]U� V0 #"X')()*,+A- l:/coCqIHKJ)L V: W" q\PEQ]M t^S $ a U� �\D`F5� 39 l ':+A- l:/coCqIHKJ)L �\D`F q\PEQ]M t^S $ i U� � ��V: #"X')(>* M�Q(u<Q � r!��r!Q]N s v��M s y v!�:S %`U� �\D`F � 39 l 'jbcV0 #"X')()* M�Q(u<Q � r!��r!Q]N s v��M s y v!�:S 8]U� (���� Sk� {A�\D`F � 39 l '.U~bXV0 #"X')()* sR[#[ qsvl��tNt s S $&%Rg � g � g � g � U%�� �\D`F S � 39 l ' S o n 4 � pqUkU~b�V: #"X')(>*

b qZ�kM s N��.S\M�N#O�qEPEQRM�tTSZa UAg#s][#[ qEPEQRM�tTS $58Wg M�N#O�qEP\Q]M�tTS $ i U�UAg@[ Q�t�q\PEQ]M t�S $ a U.g i g � U%R% �� +A- l:/ho��0S� ���\D`F � 39 l '.U � S ' l0/�z�o./�zAS� { � 39 l 'GU � S ')()* S� U�UkU � q���qsv!�)PE�.S 8]U%G8�� �k�l W" +.- l0/co { ���EDGF S � 39 l ' ~S o n 4 � pqU�U%G8 w % S� | � U�� S � S� | � U�Ux� S� ���\D`F � 39 l '.U�U MkN#O�v!�/tNt s�% S $ i g $&%Rg $58Wg %`8 w $58Wg!%`8 w $&%`U%G8 w 8 ���! #" | �%G8 w 8 w % ' l:/�z�oA/�z.S�� { � 39 l ' ~S o n 4 � pqUkU~� S ' l0/�z oA/�z.Sk� { � 39 l 'GU�� %`U y Q]N����.N�� vl��tNt sR8 S $58Wg:$&%Rg�$ i U%G8 w 8 w 8 ' l:/�z�oA/�z.S�� { � 39 l '.U�� S ')()* S�� U�U M�Q(u<Q � r!��r!Q]N s v��M s y v!�:S %`U%G8 w 8 wha ' l:/�z�oA/�z.S�� { � 39 l ' ~S o n 4 � pqUkU~� S ')(>* Sk� UkU � q v!�/t�t s S %`8 w 8 w %]g!%.8 w 8 w 8]U

��D.� J � ' l0/�z oA/�z.S� { � 39 l ' ~S o n 4 � p:U�U~� S ')()* S� U�U | q�������� q v!�)P\�.S %G8 w 8 wha gd%`8 w 8 w $_%`U%G8 wha ���! #" � S� | � Ux� S� ���\D`F � 39 l '.U%G8 wha4w % � S� | � U � q���qZM r!O $ �.S %`8 whagw $_%`U%G8 wha4w 8 ' l:/�z�oA/�z.S� { � 39 l ' ~S o n 4 � pqUkU~� ' l:/�z�oA/�z.S� { � 39 l 'GU

y Q]N��k�.N���v!�/tNt s#% S $58Wg@%G8 w $58Wg5%G8 wha4w %]gR$&%Rg�$ i U%G8 wha4wha ���EDGF � 39 l ' � q���qsvl�>PE�.S %`8 whagw $_%`U%G8 wha4w i ' l:/�z�oA/�z.S� { � 39 l '.U~� S ')()* S� U�U � qf��qsv!�)PE�ASw�4q��~S %R%]gd%G8 w $58]UAgd%`8 w agwha U

��D.� J � ' l0/�z oA/�z.S� { � 39 l ' ~S o n 4 � p:U�U~� S ')()* S� U�U � qZ�kM s N��.S %`8 whagw 8Wgd%`8 w agw i U��DA� J � ' l0/�z oA/�z.S� {c� 39 l ' xS o n 4 � pqU�U � S ')()* S� UkU � q��~S %G8 w %]g<%`8 w 8#g<%`8 wha U

% a ?�/4n8q ��k ! S ')()*,{ � 39 l ' S o n 4 � p:U�U r!N#��q�$&%�'�r!N���MkQ#S $ a g a gd% �#gd%G8]U% i � 9 l ':+<; o)=�? 'A9 or1354 - l0/coj�:S 9 l '�| S � 39 l ' ~S o n 4 � pqUkU�Ux� ?w/4n8q ��k"!xS ')(>*Y{G9 l '.U Q]N#��u<Q(r!N�� M��4v!�:SZa gl% a U

��DA� J � � 9 l ':+<; o>=@? 'A9 oB1354 - l:/co � * l �Kz q!k l�n�o0S!n { � { � 39 l 'R{G9 l '.U,� ?w/4n8q ��k"!xS ')()*,{G9 l '.U PEQ�v [ r!N#O¤S % i U

^j�\�5�,�G� � 0���� ��� �`�d�W �¡G¢x£#¡@�6�ig � 87 � � j ��Z¥¤¥G£#¡G�I¥:% £g,Y©\��00

Page 58: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

���� ����� �A�����������������G�,������� � R�k�x¥.�\¦,� vyz�^ �� ��`�<ª �<¡`¢,����§d�@�G�&% ��£W¡`�\�<¦ ¡:£5¥`~Y¥�J�£W¦x«�¡G� ��£W�`�8+ �5�,¡^¡G¢,��©Z£W¡`¡G�����E¦ �R©I£5¥G¥.� ��£#©j©E�<�<� �h0 ���¤� ��£W©E©¡G¢x£#¡�vyz ^ �I¥�£�¥.�",x¥A�@¡¤�W  �R©I£5¥G¥A� ��£W© ©\�5�<� �ZJ_�\¦�¡`¢x£W¡ £#©\©~�# �\¡q¥ ¡`¢,���<�`��ª�¥�£W�G�^§5£W©E�I« �]©I£<¥`¥A� ��£W©E©>+�0 �K��¢,�Z¥��I¥¤£W¦�I¥G¥.�,�^¨�� � ©Z£W¦�¡G� ��; � ©\�5�G�  ��,�`¡G¢,�@��0

,@?.-A?CB 1���I!2��Z9�� 2w9 U�\�VX �<¡`��¡`¢x£W¡ £ ~_�E¦x«��#  ¡/+ � ��$ �0¢Y� � ~&�\¦Y�t¨¤£5¥T�x¥.�#« £W¡ ¥A��§d�@�:£W© � �<�E¦_¡q¥T�E¦ ¡G¢,� ��£#© �R�,©Z£W¡`�\�<¦��W  ¡`¢,�t¨��#£(~d�#¥.¡� �G� �]�<¦x«_�E¡G�E�<¦��\¦ Nd� �]¡G�\�5¦ � 0ba#0>_ZJ,¡G� �#¥A¡q£g,,©E�I¥A¢ ¡G¢x£#¡�£��5�\§d��¦�¡`���Gª �`� � �`�#¥A��¦&¡:¥�£W¦ ��©\��ªX��¦_¡�# �£��5�\§d��¦c¥A��¡�k��0 �"0,�#£ �0¢ ¡G�\ªX��¡G¢,���<¦,�$ � �<�E¦_¡��G�,©E�T¨ £<¥�£ �,� ©E�\�#«��p0 � ¥ �`��ª�£#�0~d�#«��E¦ Nd� �R¡`�\�<¦ � 0���0>_ £g,x�#§d�^J ªc£W¦#+t¥.� �0¢�0¢,��� ~Y¥ �R�5�,©I«t�#£5¥A�E©>+ , ��£#�,¡G�5ª�£W¡`�#«�0� ¥��G��ª�£#�0~d�#«��\¦INd���R¡G�E�<¦UY�0 � 0>_ZJ HM$�¡/+ � �#¥^£#�G� ,,�,�\©E¡�� �  ��G�5ª ,x£<¥.� ��¡�+ � �#¥^¥A� �:¢ £<¥�� £W¦x«��<�E§d��¦�¡/+ � �#¥�x¥A�E¦,� � �#¨����¥A�@¡:¥P�s%x¦,�\¡`� £W¦x«��\¦#%x¦,�\¡`�h��J#¡G� � ©\�#¥�£W¦x« ¥ �:¢,��ª�£¤¡/+ � �#¥(0� ¢,�E©\��¡G¢,�Z¥j�I¥j� ¥A�R ��,©& ��<���©\�Eªt�\¦ £W¡G�E¦,��<�G�C¥G¥ �@�G�G�5�:¥¤�W ¡/+ � �\¦Y�iJ,�\¡ ¨¤�\©E©~¦,�5¡ � � � ~ � � ªX�I¥A¡q£(~d�#¥�¥A� �:¢�£5¥ ;���� ¨¤¢,���`��;���� ~ �7£#¦x«��M����� �N0dKe@fI{!¥~¡/+ � ��$ �:¢,� ��~&�\¦,�K�K£<¥�¥A� �,� �5�G¡G��« ,#+�vyz�^ ���5�d�#¥j¡G��¡G¢,��� �,� �d¥.�\¡`�¤��;_¡`�G��ªX���x£ ¡G�@�Gª ��£#¦T,x� £<¥`¥A���`¡G�#«¡G��,x���W  £��<�E§d��¦t¡/+ � ���<¦,©.+��w ��\¡��Z¥ ¨���©\©.$f ��5�Gªt�#«�£#¦x«�£��R¡`�x£W©E©>+X«_��¦,�5¡G�#¥¤£�§5£#©\�,���# �¡`¢,��¡/+ � ��0<Nd�\¦ �]� ¡`¢,�I¥ª�£�+ �\¦&§d�<©E§d��¥.¢,�#¨¤�\¦,� ¡G¢x£#¡�¡G¢Y��§5£W©E�,��¥`£W¡G�Z¥C%x��¥T�\¦&§5£W�`�I£W¦&¡:¥^£5¥G¥A��]�I£W¡`�#«�¨¤�E¡G¢ ¡`¢,��¡/+ � �^J�¡�+ � ��$ �0¢,��� ~&�\¦,�, ���R�<ªt��¥�£�¡:£<¥>~� ��<� ¡G¢Y�T¡`¢,���5�G��ª�$ � �`�W§d�@��0� ¦t£5«_§5£W¦&¡:£#�<� �W �¡G¢Y�:H�£ �Y� �G�C£��:¢t�I¥j¡`¢x£W¡��\¡¥.� �,� �<�`¡:¥�¥A�",,¡/+ � �\¦Y�T�E¦�¡`¢x£W¡$J< ��<���;Y£Wª � ©E�^J5£� ��Y¦ �R¡G�E�<¦ ��£W¦, ���G���C£W�q«_�#«�£<¥�£ �`��©I£#¡G�\�5¦yJ#�<�£5¥j£�¥.��¡8J5£W¦ «�¥A���5¦*0"Nd� �0¢ � �5©>+&ªt�<� � ¢,�Z¥Aª ��£#¦T,x� £¤§d���8+�§5£#©\�x£4,,©\��ªt��¦&¡:£W©¡G�d�<©~ ��5�¤¡G¢,��¥ � ���R�&% �@£W¡G�E�<¦t¨¤�`�\¡`���8JY¥A�\¦ �R���\¡ ¥A�,�5�<�#¥.¡:¥ £W©E©5~&�\¦x«,¥�W  �R�<¦Y¦,� �R¡`�\�<¦ ¥�¡G¢x£#¡¤ª�£�+�¦,�<¡¤�5�G�\�5�\¦x£#©\©.+¢x£�§d�P,x����¦��c,_§&�\�5�x¥�0�)¡�¥A¢,�5�,©I«�¢,�#¨���§d�@� ,x�¤�G�@ª�£W� ~d�#«�¡G¢x£#¡¥A�5ªt� H ¨¤�G�E¡G���q¥j¡:£T~d��¡`¢,� �R�<¦ �R�I¥.�\�<¦ � �C¥G¥A�.,,©\� ��G�<ª ¥A� �:¢ � �5©>+&ªt�<� � ¢,�I¥.ª ¡G����;&¡G�`��ªt�#¥ J�¨¤�\¡`¢��G�#¥.�,©\¡q¥ ¡`¢x£W¡£#�G�¤ª�£#¡G¢,�@ª�£W¡`� ��£#©\©>+ ¥.� � ¢Y�I¥A¡`� ��£#¡G�#«T,Y�,¡�§d����+«_��� �R�,©E¡  ��<��¡G¢,��£�§d���q£W�5���`�#£<«_�@�T¡`���,¦x«_�@�:¥A¡q£W¦x«[0�� �\§d�@¦�¡`¢x£W¡��<¦,�t�#  ¡G¢,� � �`�\ª�£#�8+ � ¥A�#¥^�W �£c ��5�Gª�£#©¥ � � �R� % ��£W¡`�\�5¦ �Z¥�¡G� �R�<ªXª��,¦Y� �@£W¡G�¤�Z«_�#£5¥�J,¨��� ����@©�¥A� �0¢ ¥A� � ¢,�Z¥A¡G� ��£W¡`�\�5¦ �Z¥��W �¡`��¦ �R�5�,¦&¡G��� � �G�&«_� �R¡G�E§d��0

,@?.-A?�� �[7NYML 4 W�Y32����TU�]i9 �@W�JMV<2 LXO"!h2 S�S#�cO(LPJ5462��T\:2y]"]¥IKJML�LXOQLPRTS�U�VPW�Y�U�L�\@]� ¥ ¥.����¦� ��G�<ª £4, �#§d�^J «_�Z¥ �:¢x£W�`�<�\¦Y��¨���©\©.$f ��5�Gªt�#«&¦,�#¥G¥ � �G�d�# ��h,,©E�\�d£#¡G�E�<¦x¥ �# �¡G��¦ �G�#«&� �R�#¥¤¡G�X¥A�Eª � ©\��¡�+ � ��$�0¢,��� ~&�\¦,��0���¢,�Z¥��<�\§d��¥ � ¥�¥A�5ªt� ¢,� � �t¡`¢x£W¡ £ ¡/+ � ��$ �:¢,� ��~_�E¦,�t¡G�d�5© �R�5�,©I«6, � �x¥.�#«�¡G� «_�I¥ �0¢ £W�G�5�tª�£#¦�+¨���©E©>$I ��<�GªX�#«_¦,�#¥`¥��h,,©E�\�d£#¡G�E�<¦x¥ £W�,¡`�<ª�£#¡G� ��£W©E©>+�0y��¢,���G�^¨¤�E©\©~¢Y�W¨���§d��� £#©\¨¤£�+Y¥P,x��¥.�<ªt� � £#�G¡q¥ ¨¤¢,� �0¢Xª��x¥.¡, � � �`�#§d�#«�ª�£#¦_�x£#©\©.+^Jd¥A� �0¢ £<¥�¡`¢,�d¥.�^�\¦&§d�<©\§&�\¦Y�T¡`¢,�^�x¥A�^�#  � £#�G¡`�I£W©x ��,¦ �R¡`�\�5¦x¥@�k�E¦ �R©\� «_�\¦,� ¥A�T|d�,��¦ �R� � �G�h$�R�#¥G¥.�\¦,� £#¦x« ªc£ � £ �,� ©\� ��£W¡`�\�5¦���J,¡/+ � ��¥�¨¤�\¡G¢��E¦_§5£W�`�I£#¦_¡q¥�J,£#¦x« £#�";&�\©\�Z£W��+� ��,¦ �R¡G�E�<¦x¥¤¨¤�\¡`¢ � �G� �R�5¦x«_�E¡G�\�5¦x¥�0�>¦�ªt�C¥A¡ ��£5¥A�#¥ J�¨���©E©>$I ��<�GªX�#«_¦,�#¥`¥ �:¢,� ��~&�\¦,� ��£W¦ � �G��R�@�#« ,#+ �5�d£#©>$K«_�\�`� �R¡G��«�£ �,� ©\� ��£W¡`�\�5¦��W  ¡G¢Y�� ��5�Gª�£4$¡G�\�5¦r�`�,©\�t ��<� ¡G¢Y� �<�Y¡G���`ªt�d¥.¡�� � ���:£#¡G�5���  ��<� ��;Y£Wª � ©E�^JwADCFE%$=�'&P$ f�g�n^ ��<©E©\�#¨ ¥  ��`�<ª $=�'& {}�~ ( ,#+) ADCiE�$j; � $ {>0* ¢,��¦ ¡`¢,���5�,¡G���`ªt�d¥.¡¤� � ���q£W¡G�5� �Z¥¤£�©E�<�5� ��£#©��R�5¦,¦,� �R¡`�\§d�^¥.� �:¢�£<¥@� �<�,+ J,¡G¢Y� �0¢Y�<� �]���I¥¢x£W�q«_�����j ��5� �;,£#ª � ©\�eJ

� qEP\Q]M�tAq 8 #-��/.Xxh #0h�/.�� �-A�£ #0��p�/.

¨¤�\©\© ¥A�1� �R�^�\¦�ªt�C¥A¡ ��£<¥.�#¥�J",,�Y¡ ¡`¢,���G� £W�G�^¡`�\ªt�#¥¨¤¢,��¦�¡G¢Y�TªX�<�G���<��¦,�@�:£W©~ ��5�Gª

� qEP\Q]M�t - �/.

-32 0 �/.�� #-��£ #0����4.

Page 59: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

aDt ������������������� ����������������������������������������

�I¥��G�T|d�,�E�G�#«���¦x£WªX��©>+�¨¤¢,��¦ ¡G¢,��¨���©\©.$f ��5�Gªt��«_¦,�#¥`¥j�W �¡`¢,��¥.� �R�5¦x« �R�5¦��.�,¦ �R¡ «_� � ��¦x«Y¥ �<¦X¡G¢,� ¡G�`�,¡G¢t�# �¡G¢,�%x�:¥.¡T�K¥A� �:¢ £<¥¤�\¦Q� ? ML>S°���TA � ?  � �p0 NC�\¦ �R��� �Z¥ �R�<ªtª �,¡q£W¡G�E§<�¤�E¦ vyz�^<J,¡G¢Y���G�^�I¥��@§d��¦ £�¡`¢,�\�q« �:¢,�5� �R���¨¤¢,���G�^¡`¢,�^¨���©E©>$I ��<�GªX�#«_¦,�#¥`¥��W �¡G¢,�@%x�q¥A¡ �R�<¦��.�Y¦ �R¡ «_� � ��¦ «,¥ �5¦ ¡`¢,�^¡G�G�Y¡G¢��W �¡G¢,��¥.� �R�<¦ «�0��¢,� ,x�#¥.¡ ¢,�@�,�G�Z¥A¡G� � ¨��<�,©Z« ,x��¡`� � ¥A��¡G¢,�� ��<�`ª �W  �G�Y©\�#¥ �]�<�G�`�#¥ � �5¦x«_�\¦Y� ¡G� ) ��$I ��<�Gª*{�J £W¦x« ¡G� £<«�$§_�Z¥A��¥ � � �R�&% ��£W¡`�\�<¦ ¨¤�`�\¡`���:¥�¡G� � £�+ ¥ � � �R�Z£W©^£#¡G¡`��¦_¡`�\�5¦r¡G� ¡`¢,� �5�:«_���X�\¦ ¨¤¢,� �0¢ ¡G¢,��+ ¨¤�G�E¡G� �]�<¦��.�,¦ �R¡:¥¥A� ¡`¢x£W¡t��£W�G©E�\��� �R�5¦��.�,¦ �R¡q¥ ��£#¦£, � £<¥`¥A�,ªt��«r¡G� ¢,�5©I« ¨¤¢,��¦ � �`�W§&�\¦Y� ¨���©E©>$I ��<�`ªt�#«_¦,��¥G¥T�# �©I£W¡`��� �R�5¦"$�.�,¦ �R¡q¥�0\�)¦ ¡G¢,� ��£5¥A��¥.¡G�x«#+ £g,x�#§d�^J�¡G¢Y�I¥T¨��<�,©Z« ªt�#£W¦� ��<���;,£#ª � ©\��¨¤�`�\¡`�\¦,� ����� ��� '�� ��� '�� � , �] ��<�G�� ����� ��� ��� ' � ' ������������� ��� ��� ' � ª '�� � � � ���E¦ ¡`¢,��¥A¡q£W¡G���\¦&§5£W�G�Z£W¦&¡�0

,@?.-A? , 2�W <2�]�Y IKJ32w9�LA\ �TU/Y�U�LA\! §d�@¦ ¨¤�E¡G¢,�5�,¡ �R�5ª � ©\�@¡G��©.+T ��<�`ª�£W©E�>���E¦,��¡`¢,� ��£W© �R�,©Z£W¡G�E�<¦t�E¦ Nd� �R¡`�\�<¦#"�0ba�0._DJ,�E¡ ¥A¢,�5�,©I«5, ��£ �,� £W�`��¦&¡ ¡`¢x£W¡�\¡��Z¥T�5��¦,���q£W©\©.+�ª � �:¢��#£<¥.�\����¡G� � �d¥.�\¡ £ � �G� �]�<¦x«_�E¡G�E�<¦ £#¦x« ¥A¢,�#¨ �\¡��Z¥�¥A¡`�G�<¦Y����¦,�<�Y�<¢ ¡G����¦ ¥A�,�`�t¡G¢,�� �C¥A¡ �R�<¦x«&�\¡G�E�<¦ ��£W¦£,x� £��:¢,�\�@§d�#« ¡G¢x£#¦��E¡t�I¥�¡`� ��£W© �R�,©I£#¡G� ¡G¢,��¨��#£(~d�#¥.¡ � �G� �R�5¦x«_�E¡G�\�5¦£,�+ ��; � £W¦x«&�\¦,��<�,¡���;&�I¥.¡G��¦&¡G�Z£W© | �x£#¦_¡`�&%x�@�:¥�0 �� �R�<¦&¡G�@¦x«2¡`¢x£W¡�¡`¢,���`�<©E���W  ¡G¢Y� � �G� �]�<¦x«_�E¡G�E�<¦ �I¥t¥.�r�\ª � �5�G¡q£W¦&¡t¡G�¡G¢,�t�E¦_¡`��� � �G��¡q£W¡G�E�<¦ �# �£�¥�+Y¥A¡`��ª ¥ � � �R�&% ��£W¡`�\�<¦ �)¥A�@� Nd� �R¡`�\�5¦ a�0���0>_4�^¡G¢x£#¡��\¡ ¥A¢,�5�,©I« £W©E¨¤£�+Y¥m,x� ¥A¡:£#¡G�#«��; � ©\� �]�\¡G©.+�0%$�£W© �R�,©Z£W¡G�E�<¦ �W ^¡`¢,� ¨��#£(~d�#¥.¡ � �G� �R�5¦x«_�E¡G�\�5¦ �I¥ £W¦ ��; �R��©E©\��¦&¡�ªt�@¦_¡q£W©�¡`�d�<©¤ ��<��£#�G�`�\§&�\¦,� £W¡£ � �`� �R�<¦ «_�\¡`�\�<¦ ¨¤¢,� �:¢��Z¥^£<¥��<�@¦,���:£#©�£<¥ � �d¥`¥A�>,Y©\�'&B¡G¢,���`��,#+���¦x¥A�Y�G�\¦Y� ¡G¢Y��� � �@�:£W¡`�\�5¦ �Z¥�£ �,� ©\� ��£g,Y©\���\¦£<¥�ª�£#¦�+ ��£<¥.�#¥�£<¥ � �d¥`¥A�>,Y©\��0UV��,¡�¨��=,x��©E�\��§d� �\¡��I¥�¡`¢,��¥ � � �]�&%x���${!¥^�G�#¥ � �5¦x¥A�.,,�\©E�\¡/+�¡G��«_��¡`���GªX�\¦,� £#¦x«¥A¡:£#¡G���#£ �0¢�� � ���:£#¡G�\�5¦y{!¥ � �G� �]�<¦x«_�E¡G�E�<¦yJ�£#¦x« ¡G¢Y���G�#£� �¡G��� ¡G¢Y��§d���G� %x��� ¥A¢Y�<�,©Z« ,x�� ��G�@��¡G� �0¢,�C¥A��¡`¢,��ªt�d¥.¡£ �,� �`� � �`�I£#¡G��¡`� �:¢,¦,�Q|d�,�¤ ��<��¥A¢,�#¨¤�E¦,��¡`¢x£W¡¤¡`¢,� � �G���R�<¦x«&�\¡G�E�<¦x¥¤£#�G� ¥A¡G�`�<¦,� ��¦,�5�,�<¢«0�>¦�¡G¢Y�I¥^¥A��¦ ¥A�^J�¨��X¥A�@� ��£W© �R�,©I£#¡G�E�<¦��W ¤¨��#£(~d��¥A¡ � �G���R�<¦x«&�\¡G�E�<¦x¥�£<¥m,x���E¦,��£#¦ £#¦x£W©.+,¥.�I¥�¡G���0¢,¦Y�Q|d�,��¨¤¢,� �:¢�R�<�,©Z«¥, � £ �,� ©\�\��«�¡G���\¦ �]�<ª � ©E��¡G� � � ���q£W¡`�\�<¦B¥ � � �R� % ��£#¡G�\�5¦x¥(&B¦x£WªX��©>+^J��<¦,��¥�¨¤¢,� �0¢ «_��¦Y�<¡ ��; � ©\� �]�\¡G©.+ªt��¦&¡G�\�5¦ ¡`¢,��� � ���q£W¡G�E�<¦y{l¥ � �`� �R�5¦x«_�\¡`�\�5¦*)�¡G¢,� ��£#© �R�Y©I£W¡`�\�5¦ �R�<�,©Z«�¥.�",x¥.�T| �Y��¦_¡`©>+5,x��� ¥A�#«�¡G�+�.�x¥.¡G�� �+ ¡G¢,�¥G£W¡`�I¥:% £g,,�E©\�E¡�+ � �`�d�W ��h,,©E�\�C£W¡G�E�<¦t ��<� ¡G¢Y� �]�<ª � ©E��¡G��«�¥ � ���R�&% �@£W¡G�E�<¦*0

,@?.-A?(, -9W I!2yJ �/. �cI!2 \ 9ZU�S10�] 4 W9 �mU�\ 2��cW�]"]�U�]#Y32�� IKJMLNLPO(]2�¢,� ��£W© �R�,©Z£W¡G�E�<¦��# ~¡`¢,�¤¨���£(~d�#¥.¡ � �`� �R�5¦x«_�\¡`�\�5¦��\¦&Nd� �]¡G�\�5¦3"�0ba�0._ £g,x�#§d�¤�:£W�Z¥A�#¥�ª�£W¦#+��I¥`¥A�,��¥� ��5��ª�£ �0¢,�E¦,��$£<¥G¥.�I¥.¡G�#« £W¦x«�ª�£��:¢,�\¦Y��$ �:¢,� �0~d�@« � �G�d�# K¥�04$�5¦x¥A�Z«_���¤ ��<�¤��;Y£Wª � ©\��¡`¢,��£ �,� ©E� ��£#¡G�E�<¦��W ¡`¢,�^�<¦,�$ � �<�E¦_¡ �G�Y©\�¡G�t��©E�\ªt�E¦x£W¡`� ¨ ��� 8� 5 0 �)¦ �5�:«_�@�T¡`�t�x¥.��¡G¢,�� ��5�Gª �# �¡G¢,���5¦,��$ � �5�\¦&¡^�G�,©E���<�E§d��¦yJx�\¡�¨��<�,©Z«-,x��¦,� �R�#¥`¥G£#�8+%x�:¥.¡¤¡G� ��; � £W¦x«t�<�Y¡ ¡`¢,�^��;_�Z¥A¡`��¦_¡`�I£#©5|d�x£#¦_¡`�&%x���q¥�Jx¥.��¡`¢x£W¡6 � �����87 5:9�;4< �����>= ���@?�A ' �B�87 5C9D;FE �@?>A ' ����=��B� '�� ��AC��� 5C9�E �8?>A ' ���HG < �I����=' �������'��� 5C9@< �����JGLKM= '�� � �g' AN��O 5C98< �����HGLKQPR�R�R

, ���R�<ªt��¥6 '�� � �g' AN��O 5 98< �����HGLKQPH6 ' �I��������� 5 9@< �I���HGSKTPH6X��� '�� ��AC�I� 5 9�E �@?>A ' ���UG < �����JP6X�'�@?>A ' ���87 5:9�;#E �@?>A ' ���UP6 � �����@7 5:9D;< �����4PR�R'R

¡G¢,��¦ ¦,��;&¡�¡G��£ �Y� ©>+�¡G¢,�X�G�,©E�t¡G��¡`¢,���\¦,¦,�@�Gªt�C¥A¡ | � £W¦&¡G�&% �#«���; � �G��¥G¥A�E�<¦yJ£#¦x« ¡G¢,�@¦ ¡`���G��$Q� £#¡G¡G�@¦ ¡G¢,�| �x£#¦_¡`�&%x�@�:¥�0V2�¢,�^¨¤£�+t¡`¢x£W¡@� £<¥G¥.��R�I£#¡G�#¥¤¨��5�,©I« � �`�h,x£4,,©>+c£W©I¥.��¦,���#« ª�£<¥`¥G£W�5�\¦,��¡`�1,Y�G�\¦Y��¡G¢Y�m,x�&«�+��# ¡G¢,� |d�x£W¦&¡G� %x�#«t��; � �G�#¥`¥A�E�<¦t�E¦_¡`��¡G¢,��£ �Y� �G� � �G�Z£W¡G�^ ��<�`ªQ02�¢,�I¥^�I¥^£ ��£5¥A� ¨¤¢,���`� � ��¦ �]�\©>$K£W¦ «�$ � £ � ��� � �G�d�W �¡G���0¢,¦Y�Q|d�,�#¥ ¨��<�,©Z«�¦,�@�#«�¡`�-,x� ��£#�G�R ��Y©\©>+ £<«,£ � ¡G��«� ��<�ª�£��:¢,�\¦Y��$ �:¢,� �0~d�@« � �G�d�# K¥�0

Page 60: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� � ��� ����

����� ����� � ����� ��� ���������

2�¢,�I¥ ��£5¥A� ¥A¡`�x«�� ��� � ©E�<�`�#¥T¡`¢,� ~_�E¦x« �W ��\¦x«_� �R¡G�E§d���`�#£<¥.�<¦,�E¦,��¨¤¢Y� �:¢ �I¥��`�T| �Y�\�G��«�¨¤¢,�@¦ §d�@�G�� ��&�\¦Y� �x�"!¢x£�§_�E�<�,�¤�# �¥A�# �¡A¨ £W�`��¥#�,¥.¡G��ªc¥%$

& �(' ) �+* ) �$���+, � % "'

2�¢,� � �G�-�,©\��ª7�I¥�¡G��¥ � � �R�w ���£¤¡G�q£W¦x¥.ªt�\¡`¡G��� ¨¤¢,� �:¢^�G��©Z£.�Y¥~ªt�#¥`¥G£#�<�#¥  ��`�<ª �5¦,�¤£#�<��¦&¡�¡G��£W¦,�5¡G¢,�@�0/!^j�\�1$4a�$>_(2�J�x¥A�E¦,��¡G¢,�t ��5©\©\�#¨¤�E¦,��¥A�Eª � ©\��3:¥.��¦x« £W¦ « ¨¤£#�\¡54 � �G�5¡G��R�5©76 £� �¡G�@��¡G�:£#¦x¥AªX�\¡G¡`�\¦,� £ ªt�#¥`¥G£W�5�^J�¨¤£#�\¡��,¦&¡G�E©£���~_¦,�#¨¤©E�#«_�<�@ªt��¦&¡��I¥�G� �R�@�\§d�#«8�x�R ��<�`��¡G�q£W¦x¥.ªt�\¡`¡G�\¦Y��¡G¢Y��¦,�"�&¡¤ªt�#¥`¥G£W�5�^J9�,��: ���`�\¦,� £#¦��t�5¡G¢,�@�¤ªt�#¥G¥`£W�5�#¥¡G¢x£#¡�£#�G�`�\§d���\¦�¡`¢,� ªt�#£W¦&¡G�Eª��;$�2�¢,��¡`�:£#¦x¥Aªt�E¡G¡`��� ¨¤�E©\©�¡G¢&�x¥�¢x£�§d��¡.¨���ªt�&«_�#¥ �W ¤� � ���:£#¡G�\�5¦�6^�G�#£5«���¡G�¡G�:£#¦x¥AªX�\¡8J�£W¦x«�¨¤£W�E¡G�E¦,� ¡`���G� �R�@�\§d� £���~&¦,�#¨¤©\�#«_�5��ªt��¦&¡ ¡G¢x£#¡�¡G¢,�t©Z£<¥.¡�ªt�#¥`¥G£#�<� ¡G�:£#¦x¥AªX�\¡G¡`�#«�¢x£<¥<�x����¦�G� �R�@�\§d�#«=$ 2�¢,�Z¥ ��£<¥.��¥A¡G� «���¨¤£<¥¤�\¦ ¥ � �E�G�#«>�?�\L eA@ ��PDP(SB$2�¢,��ªc£W�\¦��x��¢x£�§&�\�<�Y�:£W©�`�T| �Y�\�G�@ªt��¦&¡¤�W  ¡G¢Y��¡`�:£W¦ ¥Aªt�E¡G¡G�@���I¥^¡G� �@¦x¥A�,�`��¡`¢x£W¡�ªt�#¥`¥G£W�5�#¥^£W�`���5�,¡ � �Y¡��\¦¡G¢,��¥G£#ªt���5�:«_��� �\¦X¨¤¢,� �:¢�¡G¢,�"�c£W�G�`�\§d�^Jd¨¤�E¡G¢ ¦Y��©\�d¥`¥ �# ªt�#¥`¥G£#�<�#¥C/:^j�E�D$Ma�$ YE25$

Transmitter

message

TransmitMSG

NewMSG

ReceiveMSG

message

acknowledgement

^j�E�<�,�`� a�$>_-6 � ªt�#¥G¥`£W�5�T¡`�:£#¦x¥Aªt�E¡G¡`����¨¤�E¡G¢F�,��: ���`�\¦,�1$

a#_

Page 61: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

aDY ������������ � � �����,�&����� ��� ���T� �����¤����

m3

index index

wait ready

mode:

wait ready

mode:

m1 m2 m4 m5

m1 m2

a)

m1 m2 m3 m4 m5

m1 m2 m3

b)

receivedreceived

sentsent

^j�\�5�,�G� a�$]Y?6�2�¢,���\¦&¡G�@�G¦x£#©�¥.¡:£W¡`���W �¡G¢Y��¡G�:£#¦x¥AªX�\¡G¡`���"6 £E2 £� �¡G���^¥.��¦x«_�E¦,��ªt�#¥`¥G£W�5��ª���J ¡`¢,��¡G�q£W¦x¥.ªt�\¡`¡G����I¥¤£�¨¤£#�\¡G�E¦,��£ � ~&¦,�#¨¤©\��«_�<��ªX��¦_¡�$=�=2�£� �¡G��� £ � ~&¦,�#¨¤©\�#«&�<��ªt�@¦_¡�¡`¢x£W¡¤ªX�#¥G¥`£W�<��ª��T¢x£5¥ �x���@¦t�G� �]���\§d�#« J<¡G¢,�¡G�:£#¦x¥AªX�\¡G¡`�����Z¥��G�#£5«��t¡`��¡G�:£#¦x¥AªX�\¡¤ªt�#¥`¥G£#�<��ª "1$& ��� ��� � �h���G% ' , �$ w �� � �T% �

���� ��������������� ��� ������ ���"!#���$&%('*),+ %('*).-0/213-0/�45/268794:7<;3/�7>=?1@/�ACBED�F&F31@A84<4HGJI?FK/,LM/�404<DCN�/�4

70;@D�7�LOD�=OI@/70-9DC6@45LPGJ7070/�QOI?=R70;3/S7<-9DC6@4>LPGJ707</2-�T

% ��U�� 9�92VXW � � U�OZY?[ � AN� \ ;3/]70-^DC6@4>LPGJ7070/2-.;@D_4�7a`bAdc^LMA3Q?/�40e 9 -0/�D�Q?=f70A70-^DC6@4>LPGJ7 � W � � U�O �9g3DC6@Qh457>G&FiFj`�D�GJ7>GJ63NM70AP-0/�k^/^GJl�/PD�k^mn 63AC`bFJ/�Q?N�/2LM/26?7 �9[ � AN� �^T

o W � ��7qp AN����� WW �^r���A>���^U � 7@���/� 93s>t�u %Z'*)AC��U��2v 9 K -p ��U�� 9 % ��U��AC��U��2v ªxw W �9r���A>���^Uy ¬p ��U�� V [ � AN� + AC��U��2v ª]w W �9r���A>���^U

\ ;3/S7<-9DC6@4>LPGJ707</2-�;@D�4�B A�z3-{4>7^DC70/,l|DC->G}DCI?FJ/�4 9P W �9r���A>���^U -0/�k^A_-9Q34,70;3/~45/���z3/26@k^/MA�B�LM/�404<DCN�/�4

-0/�k^/^GJl�/�Q�B�A�-�70-9DC6@4>L�G�4<4HGJA�6 =P 7@����� -0/�k^A�-9Q34�70;3/{4>/��_z3/26@k^/,ACB�LM/�4<40DCN�/�4�4>z@k^m

k^/�404HB z?F&FJ=Z70-9D�6@4>LPGJ7070/�Q =P AN�@U���v G}4�D,1�ACGJ687</2-�GJ6@Q_G}k2DC7>GJ63NP70;3/�63/^�37�L�/�4>m

40DCN_/�70A�I�/b70-9DC6@4>L�GK7<70/�Q � G&B�DC6?=�DC6@Q�GiB W � � UIO �A�-.70;3/�LM/�4040DCN_/�7<A�I@/�D�k n 63AC`bFJ/�Q?N�/�Q � G&B[ � AN� � =

P�p ��U�� GJ6@Q_G}k2DC70/�4�70;3/Pk^z3-0-0/26?7�LMA3Q?/�T\ ;3/O4>79DC70/�GJ68lCDC->G}DC6?7�13z3794DOI@A�z36@Q�A_6�70;3/Pl|D�FJz3/�4AN�@U���v k2DC6(79D n /�T

o W � ��7qp AN����� W>� �2���o W � �/72p AN����� WW �^r���A>���^U V 7@����� V����

� 6?GK75G�D|FiFJ=�gSI�A�70;]4>/���z3/26@k^/�4hD�-0/Z/2LM137>=�T � 7MB ACF&FJA|`,4B -0A�L�70;3/.4>79DC7</�GJ6?l|DC->G}DC6?7�70;@D�7 AN�@U���v V ¬ DC6@Qp ��UI� V�W � � U�O T

Page 62: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

����� � ����� ��� ���^� �����¤��� � �.� ��� � a8�

���� �!#�� ��������"!#���� o W � �/72p AC����� W,V o W � �/72p AC����� W � o W � �/72p AC����� W 5

��[ %('*)� o W � ��7qp AN����� Wp7��� 9 %('*)W �^r���A>���^U 5?V�W �9r���A>���^U� � p47��� �7 �'��� 5 V 7@�����AC��U��2v 5@V AN�@UI�2vp ��U��'5 V p ��U��

\ ;3/��@-9457RA�1�/2-9DC7>GJA�6]D�k2k^/213794hD 63/2` LM/�4040D�N�/hB A�-70-^DC6@4>LPG}404HGJA�6#g�I3z��#/2->GJ63N�GK7Oz36?7>G&FSGK7^4M70z3-<6xk^A_LM/�42T\ ;3/ 63/2` LM/�4040DCN_/ZG}4(DC131@/26@Q?/�Q�70A�70;3/ W �^r��'A.�'�9U�_z3/2z3/�T

o W � ��7qp AN� %Z':)� o W � ��7qp AN����� Wp7��� 9 %Z':)AC��U��2v ªxw W �9r���A>���^Up ��U�� V�W � � U�Op7��� V�W �9r���A>���^U ��AN�@U���v �W �^r���A>���^U 5 V�W �9r���A>���^U7 �'��� 5 V 7@�����AC��U��2v 5 V AN�@UI�2vp ��U�� 5 V [ � AC�

\ ;3/�45/�k^A�6@QhA�1�/2-9DC7>GJA�6h7<-9DC6@4>LPGJ794�DPLM/�4040D�N�/�T \ ;3/LM/�4<40DCN�/�DC7 AN�@U���v N_/2794�70-9D�6@4>LPGJ7070/�Q�gCDC6@QS7<;3/�LMA3Q?/k<;@DC63N�/�4�B -0A�L W � � U�O 70A [ � AN� T

� �9r���A>���������� o W � ��7qp AN����� Wp ��U�� V [ � AN�W �^r���A>���^U 5 V�W �9r���A>���^U7 �'��� 53V 7@������ �0W �^r��'A.�'�9U ��AC��U��2v � �AC��U��2v 5@V AN�@UI�2v�y ¬p ��U�� 5@V�W � � U�O

\ ;3/(70;?GJ-9Q.A_1@/2-9DC75GKA_6 63A�70/�4�D�k n 63AC`bFJ/�Q?N�/2LM/26?7RA�B4>z@k2k^/�4<4HB�z?F�7<-9DC6@4>LPG}404aGKA_6#T \ ;3/(GJ6@Q?/^�xN_/2794PGJ6@k^-0/2mLM/26?70/�Q�I?= ¬ g:DZk^A�1?=�ACBb70;3/OLM/�4040DCN_/M`�;?G}k0;�`�D�470-^DC6@4>LPGJ7070/�Q N�/2794]DC131�/26@Q?/�Q 70A 7 �'��� g�DC6@Q 70;3/LMA3Q?/�k<;@DC63N�/�4 B�-0A_L [ � AC� 70A W � � U�O T

�M���"�H�������"!#���2�¢,�^¡G�:£#¦x¥AªX�\¡G¡`���¡G�q£W¦x¥.ªt�\¡q¥ ªt�#¥`¥G£#�<�#¥��E¦t¡G¢,��¥`£Wªt���5�:«_�@�¤�\¦�¨¤¢,� �:¢t�E¡��G���R���\§d��¥ ¡`¢,��ª $yf �<�`� � �G���R�I¥.��© �^J� ¬ R�R AN�@U���v � ¬ �! W �9r���A>���^U V 7 �'���

�\¦ £W©E© 3G�G��£��:¢x£ �,©E�(4�¥A¡q£W¡`�#¥ �# �¡`¢,��¥ �Y¥A¡`��ª /)¥.���!Nd� �R¡`�\�5¦5a�$�a�$&�8�x��©\�#¨A25$

& �#" ��� � �h���G% ' , �$ w �� � �T% �%$ &

2�¢,�TdKe�f ¥ � � �R�(' ��£#¡G�\�5¦��I¥ £W©\ªX�d¥A¡¤�Z«_��¦&¡G� ��£W©�¡`��¡`¢,�GH�¥ � � �R��' ��£W¡`�\�<¦ J,�"� �]� � ¡¤¡G¢ £W¡^£lV��d�<©E�#£W¦ §<£#©\�,���I¥�x¥A�#«t¡`���E¦x«_� �@£W¡G��¡G¢,�^ªt�&«_�;$

Page 63: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

aI" ������������ � � �����,�&����� ��� ���T� �����¤����

���� ��� ������ ���"!#�������� �I¥�£ � £W�q£Wªt�@¡G���¡G��¡`¢,��¥ � � �R�(' ��£#¡G�\�5¦yJ_�`� � �`�#¥A��¦&¡G�E¦,�^¡G¢,�^¡#� � ���W  £W©\© � �d¥G¥.� �,©E�^ªt�#¥G¥`£W�5�#¥ ¡`¢x£W¡¤ª�£"�� �^¡`�:£W¦ ¥Aªt�E¡G¡G��«>���X¡G¢,�^¡G�q£W¦x¥.ªt�\¡`¡G����$�:���@�� ��� 3�b��� ���H!#�f0n b8n g�� ��� � $�������� � C(a

� �������si���� 6��������� � � 6��������� ��� = 6 � -� � � ��� 6 .

� ¦! $#";!$� ��� � $������%� � / � �������si&����x � � �(x&� ���0=[x � � � ����2 '� ���0=�( d gh¦ � �������si����*)£_@� /�+ � � � ��� + � ���0=�( d gc¦ � �������si���� 2

� ¦ � n $#"9!,� ���� � $�������� � / � �������si�����x � � ��x-� ���0=[x � � � ����2 ' � �������si�����  � � �P [L`Sgh¦TA

.Z�� ��������"!#�/�� 3�b��� ���H!#���01�(�2����� / $ � � 6����2� 2g43Tn65N¤ � �������si���� 67�������8 CDf0n � �������si&���<  � }M}"}M}/}� �������si����*9;:iL $ � � S

� ��� � $����<���2� /#2 $ � � 6������g43Tn�¤QA � �����4�si���� 6=���2���

¤QA>� ���0= 6 � -5N¤ � � � ��� 6 .

8 ¤ g � � � ���T�?� ���0=�( d gh¦ � �����4�si����8 CDf0n@+ � � � ��� � $ � �<  � �������si&���=/A� ���0= 2

B;�������si��/&1CED / 2g43Tn�¤QA � �����4�si���� 6=���2���

5N¤ � � � 6=���2���5N¤F� ���0= 6 � -5N¤ � � � ��� 6 .

8 ¤ g#+ � � � ���8 CDf0n � � ��  � }(}� � �G9�:FL � �������si����=/�� }#}�}� ���0= 2pS*�?� ���0=  ¯� }�}�}� ���0=�) _m� � � � ���

& � � H>I�� �:� � ���! �8#&% �T'') � '

,@J ,;J0/ 1 � 2LKNMPO 2QMFR�SUT!2w9GV%W 9�XGYZV�M\[ 9EM�4]T�M\[ 2^[6Y_S

�>¡ �I¥ �\ª � �<�`¡:£#¦_¡ ¡G��«&�I¥A¡`�\¦,�5�,�I¥.¢�¡G¢,� «&� : ���G�@¦_¡ �G�5©\�#¥¤�W �¡G¢Y� «_� : ���`��¦_¡�¥ � � �]��' ��£#¡G�E�<¦ �R�5ª � �<¦,��¦&¡:¥¤�\¦ ¡G¢,���£<¥.��¥.¡G�x«?� £(�x�W§d�eJ_�#¥ � ���R�I£#©\© � ¨¤¢,��¦��E¡ �R�<ªt��¥ ¡G�X£W¦ £W© �Y¥A�E¦,� £W¦ « «_��§d�@©\� � �\¦,��¡G¢,��¥ � � �]��' ��£#¡G�E�<¦�$

Page 64: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

���� ���&������.������� ������� �G�,�w� � � ���

�j�\�q¥A¡ ¦,�<¡`��¡G¢x£#¡ ¡`¢,��¡G�q£W¦x¥.ªt�\¡`¡G���¤¢x£5¥ ¡.¨�� �"�&¡G���`¦x£W©��\¦&¡G���. K£��R��¥%6�\¡ �G�#£5«,¥ ªt�#¥`¥G£#�<�#¥¤¡G� �x��¡G�:£#¦x¥AªX�\¡G¡`�#« ��G�<ª �<¦,�^£#¦x« ¨¤�`�\¡`��ªt�#¥`¥G£W�5�#¥ ¡`�8�x�T¡`�:£#¦x¥Aªt�E¡G¡`�#«�¡`�iJx£#¦x«t�G�#£5«,¥¤£���~_¦Y�W¨¤©E�#«_�5��ªt��¦&¡:¥j ��G�5ª Jd¡G¢,���<¡G¢Y���"$2�¢,��«,£W¡q£�¡#� � ���������Z¥��\¦&§d�<©\§d��«��E¦ �x�5¡G¢ �E¦_¡`���A K£ �R�#¥ $0/p�)¡��I¥ £W©I¥.� £ � £W�:£#ªt��¡`����¡`��¡`¢,��¥ � � �R�(' ��£W¡`�\�5¦�$ 22�¢,��¡G�q£W¦x¥.ªt�\¡`¡G��� �\¡q¥A��©w �I¥�£t§d��� � ¥A�\ª � ©\��«_��§&� �]�96��\¡ ¥A�\ª � © �t¢ £<¥�¡.¨��tªt�&«&�#¥</k�`�#£<«?��£W¦ «�¨ £W�\¡ 2 £W¦ «�£�,��: ���� ��<� ªt�#¥`¥G£#�<�#¥¤£�¨¤£#�\¡`�\¦,��¡`�:£W¦ ¥Aªt�Z¥G¥A�E�<¦�$V2�¢,�<�Y��: ��� �R�<�Y©I« �x��«_� ' ¦,�#« �������� � WSV ��Mp47� 7 9<s>t�u %('*) Y�7@������ �p47� 7 V�W �9r���A���^U �

2�¢,� �A�������������5J � � ��£W¦ «>� ���0= ¥.¡:£W¡`��§5£W�`�I£(�,©\�#¥�¨����`� �E¦_¡`�G�&«_� �R�#«T¡`��ªt�&«_�@©d¡G¢,� �x��¢x£�§&�\�5�,�j�#  ¡G¢,� «_��§&� �R�^J£W¦x«��E¦ � £#�G¡G� �R�,©Z£W��¡`�^£W©E©\�#¨ ¡G¢Y�¤¥A�@�G§&� �R� � �`� � ���G¡#� /k¡G¢ £W¡�ªt��¥G¥G£#�<�#¥�£W�`��¡`�:£W¦ ¥Aªt�E¡G¡G��«T�\¦�¡G¢,� ¥G£#ªt���5�:«_�����\¦¨¤¢,� �:¢�¡`¢,�"��£#�G�¤�`� �R���E§d�#« 2,¡`� � � ¥.¡:£#¡G�#«�£#¦x« � �G�#§d�#«>/>Nd� �R¡`�\�5¦ � $ � $i� �x��©\�#¨A2 $�)¦�¡G¢,�Z¥�¥A��¦ ¥A�^J<¡`¢,���4�����4�������5J� � �¤£#¦x« � ���0= ¥A¡q£W¡`�T§5£#�G�I£(�,©\��¥�£W�`��£W�D�&�\©E�I£W� � �R�<¦ �R� � ¡q¥�J_�E¦_¡`�G�&«_� �R�#«� ��5�¤§d���G�w ��_�E¦,� � �@¢x£�§_�E�<�,� £W¦x«�¦,�<¡�\¦&¡G��¦x«&�#«  ��5���\ª � ©\��ª ��¦&¡:£W¡`�\�5¦�$ ��X¨��<�Y©I« ©\� ~d��¡`��¢x£�§d�t¥.�<ªt�t¨ £"���# ��`� �R�<�q«_�\¦Y� ¡G¢Y�I¥  K£ �R¡� ��<�`ª�£W©E© ��\¦ ¡G¢,� ¥ � ���R��' �@£W¡G�E�<¦yJ¥.�\¦ �]� �E¡��Z¥�� �&§_�E�<�x¥.© � �Eª � �<�G¡q£W¦&¡��E¦r¥.�D�x¥.�T| �Y��¦_¡ «_��§d��©E� � ªX��¦_¡�$ q ¦ ¡G¢,���<¡`¢,���¢x£W¦x« J ¡`¢,�C�,��: ����¥A¢,�5�,©I«��G��£W©\© � � ��«_� ' ¦,�#«��"� � ©\� �R�\¡`© �^J#£#¦x«��\¡:¥��G�<©E��£5¥£W¦ �\ª � ©E��ª ��¦d¡:£#¡G�\�5¦^�G�T|d�,�\�`��ªt��¦&¡¥A¢,�5�,©I«F� �^�`� �R�<�q«_�#«� ��<�`ª�£W©E© �9$

,@J ,;J�� 1 � 2LKNMPO 2QMFR�T#K32w9�M\[ �*V%YZV�MP[�S

�>¦�¡`���Gªc¥ �# �¡G¢Y� ©Z£W�G�5���¥#�,¥.¡G��ª �E¦�¨¤¢,� �:¢�¡G¢,�¤¡`�:£#¦x¥Aªt�E¡G¡`���j� � ���:£#¡G�#¥ J_¡G¢Y��0*��� ������� � ���:£#¡G�\�5¦t�I¥�£W©\¨ £"�,¥��¦x£ �Y©\�#«=6 ¡G¢x£#¡��I¥ J�¡G¢,��«&��§_� �R� ��£#¦ £�� �R� � ¡�£ ¦,�@¨ ªt��¥G¥G£#�<�� ��5��¡G�q£W¦x¥.ªt�I¥`¥A�\�5¦ £W¡ £#¦�� ¥A¡q£W�5�9$Bq ¦ ¡G¢,��<¡G¢Y���¤¢x£W¦ «5J~£#¡ ªX�d¥A¡��<¦,���W  ��� ���� $���� ����� £W¦x«�B������4�����/&1CED �I¥¤��¦x£ �Y©\�#«�£W¡ £�¡G�Eªt�9$ ��� �� � $����<������I¥¤��¦x£ �Y©\�#«�¨¤¢,��¦�/K£W¦x«��<¦,© ��¨¤¢,��¦=2�¡G¢,��¡G�q£W¦x¥.ªt�\¡`¡G���¤�Z¥ �E¦��A� � ����ªt�&«&��£W¦ « ¡G¢Y���G���I¥ £�ªt��¥G¥G£#�<�^¡G� � �¡G�:£#¦x¥AªX�\¡G¡`�#«=$ B������������4&1CED �Z¥���¦x£ �Y©\�#«t¨¤¢,��¦�/K£W¦x«��<¦,© �t¨¤¢,��¦=2¡`¢,�^¡G�q£W¦x¥.ªt�\¡`¡G�����I¥��\¦�� � ����ªt�&«_�9$X �<¡`��¡G¢ £W¡ � £W�`¡��W �¡`¢,���G�5©\���#  £#¦�� � ���:£#¡G�E�<¦y{l¥ � �G���R�<¦x«&�\¡G�E�<¦��Z¥ ¡G�t�E¦x«_� ��£W¡`��¡G¢Y� �R�E� �R�,ªc¥A¡:£#¦ �R�#¥��Y¦x«_���¨¤¢,� �:¢�¡`¢,�t� � �@�:£W¡`�\�5¦ �Z¥T��¦ £ �,©E�#«=$ 2�¢,���G�X£W�`�t�<¡`¢,��� ��£<¥.�#¥�¨¤¢,��¦ ¡`¢,� � �G� �]�<¦x«_�E¡G�E�<¦ ¡q£(~d�#¥�£ «_� :~�@�G��¦&¡�G�<©E�96j�;$��D$��E¦\L�� N RDYDS��]���G¡q£W�\¦ � �G� �]�<¦x«_�E¡G�E�<¦x¥�£��R¡ £5¥<3G¡G�`�\�5�<���54 �R�5¦x«_�E¡G�\�5¦x¥�J&ªt�#£#¦,�\¦,��¡G¢x£#¡¤�� �¡`¢,��¥ �Y¥A¡G�@ª�G�#£ �0¢,��¥�£�¥.¡:£#¡G�^�\¦t¨¤¢Y� �:¢��5¦,�^�W �¡G¢,��ª �Z¥ ¡`�G�,��¡`¢,��¦�¡G¢Y� �R�<�`�G�#¥ � �<¦x«_�E¦,��� � ���q£W¡`�\�<¦ ¥.¢,�<�,©Z« � ���\¦&§d�D~d�#«=$/ 2�¢,�Z¥ ~&�\¦ «��W  ¥A�E¡G�x£#¡G�\�5¦t£#�G�Z¥A�#¥j ��G�}| �,�@¦_¡`© ��¨¤¢,�@¦t¥ � ���R�� ��&�\¦,��� � ���:£#¡G�E�<¦x¥�¨¤¢,� �0¢ ¥.��¡� : £#©I£W�`ª�¥�J5�<�¨¤¢,� �:¢�G� �R�5�:« £W�x«_�E¡ ¡`�:£#�\©I¥ J �@¡ � $ 2 2�¢,� «_� :~�@�G��¦&¡�~_�E¦x«,¥¤�W �`�<©E��¥A¢Y�<�,©Z« � �^ ��<�`ª�£W©E© �X«_�I¥.¡G�\¦Y�<�,�Z¥A¢,�#« J~¥.�\¦ �R��¡G¢,����R©\�#£#�G© �t£":~���R¡¤¡G¢,��«_�@§d��©\� � �@�8{!¥�\¦&¡G��� � �G�@¡:£W¡`�\�5¦t�W ¡`¢,��¥ � � �R�(' ��£#¡G�\�5¦�$ �\¦,� L �\¦ RDt(S «_�I¥ �R�x¥`¥A�#¥¡G¢,���`�<©E���W  £<¥`¥A�,ª � ¡G�\�5¦x¥�£(�x�<�,¡¤¡`¢,����¦&§_�E�G�5¦,ªt��¦&¡��\¦X£�¥ �Y¥A¡`��ª ¥ � � �R�(' ��£W¡`�\�5¦�$Nd¢,� ªt��¦&¡G�\�5¦x¥�¡G¢,� � �`� �,©E��ª ¡G¢ £W¡8Jd¨¤¢,�@¦�¡`¢,�¤��¦&§_�E�G�<¦Yªt��¦&¡~ K£W�\©Z¥�¡G��¥G£#¡G�I¥) �� £ � �G� �]�<¦x«_�E¡G�E�<¦yJ�3G¡`¢,��¥ �Y¥A¡G�@ª�I¥� ��G��� ¡G��� �@¢x£�§d� �\¦B£W¦?� ¨¤£"�D4 / � $ YDtE25$ �� �R�5¦_¡`��¦x« ¡G¢x£#¡t�\¡��Z¥�¡G¢,� �G�#¥ � �<¦x¥.� �,�E©\�\¡#� �# ^¡G¢Y��¥ �Y¥A¡G�@ª�\¦&¡G���5�:£W¡`�<�¤¡`����¦ ¥A�,�`�T¡`¢x£W¡ ¡G¢Y�T�@¦_§&�\�`�<¦,ªt�@¦_¡�<¦Y© �t��§d�@� ��£#©\©I¥�� � ���:£#¡G�\�5¦x¥� ��G�<ª ¡`¢,��¥A�D�x¥#�,¥.¡G��ª /k�\¦�¡`¢,�I¥��£<¥.�^J�¡G¢,� ªt�#¥`¥G£W�5��¡`�:£#¦x¥Aªt�E¡G¡`���%2�¨¤¢,��¦ ¡`¢,���E� � �G���R�<¦x«&�\¡G�E�<¦x¥�¢,�5©I«=$ /`Nd�@� Nd���R¡G�E�<¦���$ � �x��©E�W¨  ��<�^ªt�5�G�«_�I¥ �R�x¥G¥.�\�5¦�$ 2

,@J ,;J�� �\Y X Y VA[ �"!!2 �;X 0 V�M 7;K_XFO T K_MFT!2 K Y V 2GS

# ¦,�<¡`¢,�����-�x¥A�@�G§5£W¡`�\�<¦X£ �x�5�,¡¡G¢,�¤¡`�:£W¦ ¥Aªt�E¡G¡G�@�j�Z¥j¡G¢x£#¡@� ���0=%$'&(�4�����4������� )*)��w �£#¦x«��<¦Y© ���w  £W©\©&�G���R���\§d��«ªt�#¥G¥`£W�5�#¥�¢x£�§d� �x����¦c¥A� � �]�#¥G¥) ��,©\© ��¡G�q£W¦x¥.ªt�\¡`¡G�#« $�V��Y¡ ¢Y�W¨ �@£W¦�¥.� �0¢c£ � �`� � ���G¡#�8�x�^¥.¡:£W¡`�#«� ��5�Gª�£#©\© �eJ<¡G�� �^�E¦ �R©\� «_�#« £<¥ £ �R�<¦��.���R¡G�,�`�#«>�x��¢x£�§&�\�5�,�:£#© � �G� � �@�G¡#���# �¡`¢,��¥ � � �R�(' ��£#¡G�\�5¦,+ �)¦�¡G¢Y� H�¥ �0¢Y��ª�£ ��£W© �R�,©E�x¥�\¡ ��£#¦ �x� £ �,� �`�(�_�Eª�£W¡`�#« �?� 6+.-0/ t�1 o W � �/72p AN� %Z':)32>+.-0/ t�1 � �9r���A���������'4 L o W � �/72p AN����� W Y AN�@U���v V w W �^r��'A5'�9Uy�6 S

Page 65: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� � ������������ � � � ��� �������������� ��� ������

2�¢x£W¡^�I¥ J~¡G¢Y��¥A¡q£W¡`�#¥��\¦�¨¤¢,� �0¢ � ���0=�$ &%�A�������������*)')�£#�G� � �`� �R�Z¥A��© �t¡G¢,�C¥A�� ��<��¨¤¢Y� �:¢ ��� �� � $����<�����£W¦x« B������������4&1CED £#�G��«_�I¥`£ �,©E�#«=$ 2�¢,� �R�5�G�`�#¥ � �<¦ «_�\¦,�X¥A¡q£W¡`��ªt��¦&¡��E¦���� � !`N v����! #"%$'&)(*�+� �-,/. �0�1�2(;$N3�)45�6&1"*$7& �eJ98:,%; �-,=<�&1>�;?(��2<A@B@-�).A@-C7& ���DCE"%C+(�C+8�(�F�$+,/FG(B$+C �HC+8G"%C@I"%&)&��JC7,�� � �� � $����<�����K"%.G>�B������������4&1CED"%&)C+(B$7.A"%C7(eJL,/$MC78G"*C�C78�(N. <�4>�G(B$H,* O@B"%&6&1�HC7,L� � �� � $���� �����P���<�Q,=<�.G>R(S>��?�TC78�(N. <�4 �Q(I$�,* H@I"%&)&��UC7,0*��� ����� +\N3,=45(�("� C7(B.A�2�),=.NC7,�C78:(U�DFG(*@-��'Q@B"%C+�),/.N&�"%.�V=<G"%V=(��2(I(B4N�!C+,>�G(O@B"*&)&)(S>W X,/$'8�(B$+(9$

,@J ,;J , � � X^T�YZVA[ � Y�:2�Y[Z�\ SUT�]w9GV%W 9�XGYZV�M\[ R�M6K_^a`LbLced

# X(I;f45�6.�,/$g@98A"%.�V=(*��;�(B$+(H4N"/>R(�C7,�C78:(���� �h�DFG(*@-��'Q@B"%C+�),/.N;�8�(I.�F:<�C7C+�).�VM�)C��6.RC+,Ui�j:kAl m 6) $1� ���0= ( d g/n �4���������&���o;g"/�U$7(IF�&1"=@-(*> ��� � ���0=qp � nTADf �4�����4�������=$\�r.A�2FG(*@-C+�),/.s,% �C78�(NF�$+,3,% �, ��&6� !V3"*C7�),=.G�U$7(It3(*"%&6(*>�C+8G"%C�C+8�(54N"*�).T<A�2(5,* �C+8��1�HFG"%$+C�,% �C78�(5�6.Rt="*$7�1"*.RCO;�"=�U�).T(*�DCE"(��&)���28��6.�Vu;?(B&)& ! X,/$+45(*>R.�(S�7�e,* �4�������������=/ � ���0= 2�J:"%.G>�C78:(vi:j�k�l mL$7<:&)(*�J X,/$?&)�1�DC"/@I@-(*�7�D�).�Vw"%$+(�45,x�2C+& �U(��RF�$+(*�7�D(*>U�).C7(B$+4N�!,* � nTADf"$

Y�$2�8�(��D<G@B@-(S�7�2,=$e X<�.G@0C7�),=.!f8o*yByz;g"/�e<G�D(*>� X,/$��).A@-$7(B4{(B.RC+�).�V?�). C7(BV=(B$E� 6|�7$}(;$~;?(�;�$+,/C7(�f$o*yBy =O$E"%C+8�(B$C78G"*.&=G)%)-$w��.Ui�j:k�lRm JB�)C��1�|(*"/�D�)(B$LC+,�$7(S"/�2,=.M" �G,/<:C!.A"%C7<:$E"%&:.R<�4 �G(B$E�J;��6C78M�D<G@B@-(*�+�2,=$LC78G"*.M" �G,/<:C X<�&)&�"%$+�)C78:45(BC7��@ $

��$2�8�(H�).��6C7��"%&|�DCE"*C7(U;g"/��V=�)t3(B.N("� F�&)��@-�)C+& �O�).5i�j:k�lRm $2�8R<G� J�C78�(�i:j�k�l mTt3(B$��2�),=.5,% �C78�(O�2FG(*@0��'�@B"*C7�6,/.N�1��"=�g X,=&)&),*;'� 6���� ��������������� ��� ������ ���"!#���f0n b8n g���� �� � $�������� � C(a

�A������������� 6������ �� � � 6������ �� ��� = 6 � -�A� � ��� 6 .

� n! $#";!$��� �� � $������%���E/ �4���������&���J� � � �0�&� ���0=�� �A� � ����2 �� ���0=�(_f8o*yBy�/>d g/n �A������������� 2 2 /�+ �A� � ��� + � ���0=Np � nTADf �4������������� 2

� n � n $#"9!,� � �� � $����������9/�L>S��TL`S#�0)/� n-�coTg.2g/nTA

���� �!#�� ��������"!#���01���2����� / $ � � 6����2� 2g43Tn65'� �A������������� 67�������8 CDf0n �4���������&���($��J�G���G�D��4�������������*9;:iL $ � � S

��� �� � $����<���2� /#2 $ � � 6������g43Tn��QA%�4�����4������� 6=���2���B�

�QA>� ���0= 6 � -5'� �A� � ��� 6 .

8 � g �4� � ��� 2?� ���0=�p � nTADf �A�������������8 CDf0n@+%�A� � ��� 2 $ � �($ �4���������&���=/A� ���0= 2

Page 66: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

����� � ������������ � �?��� � ���H ���

B;�����������/&1CED / 2g43Tn��� %�4�����4������� 6=���2���

5'� � � � 6=���2���B�5'�F� ����� 6 � -*�5'� �A� � ��� 6 .

8 � g#+%�A� � ���8�� f0n � � � $ �a�0�� � � 9 :����A�������������=/2�a� �-�� ����� 2�� 2 �4� � ��� 2 � �����%$��8o*yIy �L���I�� �����

&�� & �������! "�!#%$�&('!)+*,&(�.-0/

1@J21\J�3 4 ]^OAO65,R�M6K87 ]:9*[�]GSUS

; .:& �N�6<3(BCE@E8NF�$7,3,* #��,* C78:(U4N"*�).N;�(B&6& !1 X,/$+45(*>R.�(S�7�!F:$7,3,% g, ��&6�)Vx"%C7�6,/.G��;��)&6&��G(�V/�)t3(I.�8:(B$7(9$ ��<�&6&|F�$7,3,* #�"%$7(HV=�)t3(B.N�).=�?>�@BADC��B$E�8�(N;�(B&6& !1 X,/$74{(*>R.�(*�+��F�$7,3,* H, ��&6�)Vx"%C7�6,/.G�� X,=$ C+8�( X,=&)&),*;��6.�V �2FG(*@-�('�@B"*C7�),=.K@-,/45FG,=.�(B. CE��,* �C+8�(5i�j:k�lRm�2FG(*@-�('�@B"%C+�),=.u"*45,/<:.RC'C7,M&)�6C7C7&6(�45,=$7(�C+8G"%. �D�)45F�&6(�C#� FG("!�@E8�(*@F< �).�V16eC78:(��2C�"%C+(U�). t="%$+�1"%. CHG�C+8�(HF�$7(S@-,/.G> � !C7�),=.G�|,% :C78�(C78:$7(B(,/FG(B$�"%C+�),/.A�IG/C+8�(FQ,x�2C�@-,/.G> �)C7�6,/.�,* Z01���2�����<$:J (B&)& ! X,=$745(*> .�(*�7��,* GC78�(FG,3�DCE@-,=.G>R�6C7�),=.,% � � �� �(K ��� ������@-,/4{(*��>R,*;�.NC7,{�28:,%;��6.�V�� ������p � n� L� �4���������&���MG�;�8���@985����FG"%$+C�,* L�6CE��F�$+(*@-,=.G>R�)C+�),=.�$J (B&6& !1 X,/$+45(*>R.�(S�7�J,% �C+8�(�FG,3�2C�@-,/.A>R�)C+�),/.�,* GB;������������N1CED ���L"�&6�)C7C+&)(45,=$7(�@0,/45F�&6�1@B"*C7(*> $BE�8�('@-$+<D�H,% �C78�(F�$7,3,* ������). �28�,*;��).:V C+8G"%C K#�PO � /2�a���B�� ����� 2�����;�(B&6& !1 X,/$+45(*>QG3,/$'�).�,/C+8�(B$';�,/$�>���C78G"*C��a���0�� ���P�up � n� L� K#�PO � $E�8�(UF�$+(*@-,=.G>R�)C+�),=.��7""�:�vC+8G"%C�C78�(OC7$E"*.G�24{�)C7C+(B$�4M<G�DC �Q(O�). � � ����45, >R( /%+ ���G�E��A� � ���E2?;�8�(B.uC+8�(U,=FG(B$E"*C7�),=.�1��@B"*&)&)(S>QG�"*.G>�8�(I.G@-(��6C� X,/&)&6,*;'�! X$7,/4 C78�(O�2C�"%C+(U�). t="%$+�1"%. C�C+8G"%CH�a���-�� ������p � n� L� K#�PO � GG"/��$7(SR <��6$7(*> $�e�).G"*&)& ��Ge;?(B&)& ! X,=$745(*> .�(*�7��,* HC78�(N�6.��)C+�1"%&g�2C�"%C7(N�6.Rt3,=&)t3(*�H�28:,%;��6.�V C78G"*C�C78�(N�).:�)C7��"%&?t/"*&)<�(S���7"%C+�1�� ��TC78�(�2CE"*C7(H�). t="%$+�1"%. CHG�;�8:�1@E85<�FG,/. �2<D�G�DC7�6C7<�C+�),/.�$7(*> <G@-(*��C+,M�28�,*;��).:V6T s�U(VFV=W6X tHY $0+[ZB\�]_^�/ U�ta` 6_bdc Y(eCs $0+

;�8��1@E85�).NC+<�$7.�$7(*>R<A@-(*�!C+,gf0��h�i($

1@J21\J�� �=XGYZV�S W*X !*VAOAV%Y�j

E�8�(O�7"%C+�1� '�" ���6&)�6C �MF�$+,3,% ?, ��&6�)Vx"%C7�6,/.5 X,/$ 01���2���2�[@B"*. �G(O�2CE"*C7(*>�"/�� X,/&6&),*;'�%6

kmlonqpsrutwv�xFy{z|vK#�PO 6�������} � 6����2���H}�~����%6��������H} � 6����H} K 6���}

� �D�,��� �� �(K ������� �E/ � ��~����0�&�7� K 2� � �G� 6���������� ���G� $L� 9 :�� K#�PO � 2� �D�$��� ����(K ��� �%���9/ ��� � ��~����0�&�7� K 2

�r.M,/C+8�(B$?;�,/$�>��IG V/�6t3(B.M"%.5�6.�F�<�C45(S�7�7"*V/(�"%.G>{"U�2C�"%C+(�GRC+8�(B$7('�1�"H.�(B; t="*&)<�(',% �C+8�( �A��������������� 'G(B&�> �D<G@98C78G"*C�C+8�(HFQ,x�2C�@-,/.G> �)C7�6,/.��1��C7$+<�(O"%.G>NC78�(O�DCE"%C+(H�). t/"*$7��"%. C�8�,/&�>��I���FG,/.�"*F�F�&��R�6.�V�C78�(H,=.�(H�XFQ,=�). C�$+<�&)(�C7,MC78�(O@-,=.G@-&)<A�2�),=.BGRC+8�(HF�$7,3,* ?$7(*>R<A@-(*�!C+,5�D8�,*;��).�V� T sPUHVFV�X tHY�W �[���� $ p��� +�ZQ\ W ] W���� U�� ` � bdc Y(eCsMW ������ $ p��� +�Z�Z

Page 67: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

��� ������������ ����� ��� �������������� ��� ������

���2�6.�V�C78�(� #"=@-C�C78G"*C�� i/n� � 9;:�� �u�� $ �Hh*yBy�� i=n � G�C78�(�'G$��2C'@-,=.��D<�.G@0C�$+(*>R<G@-(S�!C7,{�28:,%;��6.�V� T sPUHVFV�s�U(VFV=X tHY ���

;�8��1@E8 X,/&6&),*;'�� X$7,/4 C78�(H�). t="%$+�1"%. C�,=.uC+8�(HF�$7(H�#�2C�"%C+(�"%.A> C+8�(� #"/@-C'C78A"%C� T � ` � T sPUHVFV �

E�8�(5�D(*@-,=.G>T@-,=.��D<�.G@-C� X,=&)&),*;'�H(*"/�D�)&[�N X$7,=4hC+8�( �6.Rt="*$7�1"*.RCH,=.TC78�(MF�$+(H���DCE"*C7(M<G�2�6.�VuF�$+,/FG,3�D�)C+�),/.A"%&�$7(S"D��2,/.:�).�V{"%.G>NC78�(� X,=&)&),*;��6.�VU #"/@-C��� c YHeCs ��� c YHeCs W �:� � $ v +�Z

v+b � \ � � � ` v+b*�E�8�(O�7"%C+�1� '�"����6&)�6Co�MF�$+,3,% ?,���&6�)Vx"%C7�6,/.5 X,/$���� �� �(K ���<������@B"*.��Q(w�2C�"%C7(S>�"=�g X,=&)&6,%;'��

�����������! #"[p r�twv�xFy z v� ����2���H} ~����� ������;�H} �$ I����} K �� }

� �D�,��� �� �(K ������� �%� � ��~����0�&�7� K } K 2?�!p � n� L��� �8K#�PO ������U� qK �� �&+ �K 2 K#�PO $L� �A�& 2

� ���$��� �� �(K �����%���%� � �S~�� �0�&�7� qK ��FG,/.�"*F�F�&��R�6.�V�C78�(H,=.�(H�XFQ,=�). C�$+<�&)(�C7,MC78�(O@-,=.G@-&)<A�2�),=.BGRC+8�(HF�$7,3,* ?$7(*>R<A@-(*�!C+,5�D8�,*;��).�VMCD;�,�C+8��).�Vx�� �[� W � Z('*),+.-

/ �10 '&2�3H] �40 \ ��� 65�718 � � � 0s�:9;9 � 8 W ���=<�> � 9$<��$<F�10 ZE�8�(�?G$��2C�,* C78:(*�2(H X,/&)&6,*;'�v(*"=�2�6&[�5 X$7,=4 C+8�(UF:$7(*@-,=.G>R�6C7�),=.B� ��,/$'C78�(w�2(*@-,=.G>QGG;�(w�2<@�G�DC7�6C7<�C+(�"BA+;��)C7.:(*�7�t/"*&)<�(DC�E K $GFIH�� � i�C+, V=(BC]�JLK X M�N \ W � T MPUHVFV�X NHY �[� \ W ]�JLK X M�N ` � b.c Y(e�M ��� Z6Z

;�8��1@E85$7(S>R<G@-(*��C+,5�D8�,*;��).�V

� T MPUHVFV�X NHY �[� \ � bdc Y(e�M �[�E�8�(*�2(� X,=&)&),*; X$7,=4zC78�(HF�$+(*@-,=.G>R�)C+�),=.u"*.G>�C+8�(H�). t="%$7��"%. C�,=.uC78:(�F:$7(H�#�2C�"%C7( ��e�).G"*&)&���G3C78�(O�7"*C7���O?�"6���)&6�)C6�5F�$+,3,% ,���&)�6V3"%C+�),=.� X,/$QPSR���R�T���R�NVUXW @B"*.Y�G(w�2CE"*C7(*>N"=�g X,=&)&),*;'��

Z8l�[�l& ]\FlL^!_@` v�x y z vT;Ea �bdcfeSgH}�~��%h� �bicfeQgI}jT$ I���D} K �� }T;E �D��k �(lmE%n K Toh�h�R��m��T;E|��~��mh-�6T7� K F}qp K

� Eq~��mh� �bicfeQg0�6E@T$ I���*�6E K �� �1Eq~��mh $ ~��mhXrSsq�:T;Et�uT&��,2vE K 2wE@T $��(h*yByxT 2T;E �D��k �(lmE%n K TohLh&R��m��T;E|�6Eq~��mh0�6E@T7�6E K

E�8�( @-$7<zy ,* OC78�(�F�$+,3,% w�1���).��28:,%;��6.�VTC+8G"%C5C+8�(��). t="%$+�1"%. CM8�,/&�>��W X,/${C78�(�.�(I;zt="%&)<:(*� ,% OC+8�( �2C�"%C7(t/"*$7��"���&6(*�� Lt �o{���u� T MPUHVFV�X NHY �[� \ W ] �10 ` �u� bdc Y(eDM ��� Z

;�8�(B$7(vEzT $ �(h*yByxT�G|Eq~��mh $ ~��mh r sq�:T;Et�uT&��H"*.G>}E K $ f0��h�i���~3<@�G�DC7�6C7<�C+�).�V C78:(*�2(�.�(I; t="%&6<�(*�5"*.G>�2�)4{F�&)� �R�6.�VHV/�)t3(S�M�U(VFV � T M�U(VFV=X NHY ���

�rCJ X,=&)&6,%;'�J X$7,=4�C78�(F�$+(*@-,/.A>R�)C+�),/.OC78G"*C K $GFIH�� � iLG/"*.G>U8�(B.A@-(L X$7,/4qC78�(g�2CE"*C7(?�). t/"*$7��"%. C|,/.UC+8�(�F:$7(H�#�2C�"%C7(C78G"*C,T��B� n� L�fT;EB� # &)(B454{"� X$+,/4 �2(SR <�(I.G@-(UC+8�(B,=$����R�6(B&1>:��T���� i=n!T;EBG�"%.G>��D,d�Hh*yByvT�� �Hh*yBy�� i=n!T;E�"=�$7(�R3<��)$+(*>Q� E�8�(� X<�&)&|F�$+,3,% ,* �+"%C+�1�O?Q"����6&)�)C6�5,* !PSR���R�T���R�NVUXW �1��F:$7(*�D(B.RC+(*>5�).%���)V/<:$7( � �����

Page 68: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

�m����� ������������ � �?��� � ���H � A

��������� ]�� �{psrut������� ��� "� �{p r�t������� �������� ������ ]��\�!*�����������! #":" l&�"�� ]�# �$� "%#$ �#(�&���' ( ��l)!IZBlI[ � �+*�^!_@`,�I�&�� �� .-0/2143 3�5 6�7 ���98:���<;Q���>= �I @?BAC7$D$/@ ]���E�

F G zIH�z�J xFy F !LK.M�x$J�vEHz|y{y F M�! z�JONP� ��RQ�����QS����QO���PQO�� �� �<;Q���T= �I .?UAC7$D$/1 ]�V� 8W!�X�! G�F�Y y2� � �� ;Q� Z�J Y\["G^] z�J�_&� ��' �� .?`AC74D�/z � =a!�X�! GIF)Y y � ��Q�� � .?b��c� �<�&�ed� f-g5 6�7a ]�Wh4� ZSJ Y\["G^] z�J�_i� � �' � �$� "j�kl�+mC�I �V�I <�E�on\���2 �{p r�t���� jpk ! Y\[ M�H`� ����Q m x�n�! Y\[ MEH`�Lqr! Y\[ M�H�� ��"Q�����QO� �����s /2143 3� ��� � v�Z�t2t Y\[ MEHu�^� � ��� ��� �v w � 146R<� y y�! Y\[ M�Hx w � 146 y�M�Z F !Ly�%z /2143 3� �{|/2143 3� {r! v F GCY !<y��Ls"��"� � �$� " j kl�+mC�I �V�I <�E�on\���.{}� �$� " j kR��m~�� ]�V�� <���on\�E� {r! v F GCY !<y�� ' ��%� �Ec"�V<� � dR��-�5 6�7a ]�Vh$� 2�^� � !</+6)w�� y � [ v F J � � �+� J � -eH��� � !�v F y2� G�F JO! Y\[ M�H`� �� �E��%� .-�5 6�7a ]� ?V!�y � [ v F !�X�� ����QV����Q� �� � /2143 3� f-0/2143 3�5 647 ]� v�Z�t2t�H [ J [ y [ J F�[ N F Mp-�� � ��������� G�F Jl! Y\[ M�H,� �� � Q � �+� �&� �P� � QS�%� ��% �<;�w � 1$6 �>= �o/ 1$3 3� @?BAC7$D$/1 ]�V� =�!<yo!LM{zI_ � y<!<N�x"t��<;&;�!Ly��[y�M�Z F !Ly��E��%' �o/ 14323� .->/ 14323�5 6�7a ]���98:���<;�w � 1$6%�>= �\/ 1$3 3 .?BAC7$D$/@ ]���E� 8�!<y�� �2��QP�% �� s ]��\�!*�����������! #":" l&�"�� ]�# �$� "Vj k �+mC�I �V�I <�E�on\� #E/ 1$3 3! +#Ew � 146�� z�J(yEM [�] Z�t F !LK.M�x$J�vEH_z y y F M<!<y<JON�� ��"Q�'SQ s Q v QV�%' �� v �E��� ��� " j k �+mC�I ]�W�I <���Ln\���9{}� ��� " j k ��mC�I ]�W�I <���Ln��E���98:�\w � 146�8T�o/ 1$3 3� .{>/2143 3� <�E���98

]��\�!*�����������! #":" l&�"�� ]�# �$� " j k �+mC�I �V�I <�E�on\� #E/ 1$3 3! +#Ew � 146�� 8�!Ly��<8�!<y�� �"�RQ 8�!Ly��<x QV�%z ��� QV� s"�� x �m������������E� �$� " j k �+mC�I ]�W�I <���Ln\���.{�� �$� " j k �+mC�� ]�V�� L�E�on\���E�98:�I�6��8:�\/2143 3� �{|/2143 3� <�E���98

]��\�!*�����������! #":" l&�"�� ]�# �$� " j k �+mC�I �V�I <�E�on\� #E/ 1$3 3! +#$�6�&� ��!Ly��Lv QV� v"��"z �m�� +�� � �%�m��������$�E��� ��� "�jpkR�+mC�I ]�W�I <���Ln\���9{}� ��� "jpkO��mC�I ]�W�I <���Ln��E���98:�I����8:�I�6 .{�/ 14323� <�����@8

]��\�!*�����������! #":" l&�"�� ]�# �$� " j kl�+mC�I �V�I <�E�on\� #$�6 �#(����� ��!Ly��Ls QV� x"���� �m� �$� "%op r�t������m�6 �<� � � �m�6��<�������I� �$� "�{�� �$� " j kR�+mC�� ]�V�� L�E�on\���E�98:�I�6��8:�I�6 .{�/ 14323� <�����@8

]��\�!*�����������! #":" l&�"�� ]�#$� ��� "�#(�6 �#$�6�&� ��!Ly�� 'SQ��"z �

AC7 � 6 � �m� �$� "%opsrut � �%�m�6 ��� � � �m�6������ (�� ��"<!�Z8l�[ � �+*&^!_@``�I ]��# ��� "%#( �#$� �$� "%#$�6 �#$�6�&�8 ]��\�!*�����������! #":" l&�"�� ]�#$� ��� "�#(�6 �#$�6�&� Yo["G^] z�J�_&� ��� �

�e�6V/<�$+(`�����4 ��L$7,3,% �,% &� �).��6C���E~$�"%.G�D45�)C+C7(B$;��� 

Page 69: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

��� ����� ������ ����� ��� � ������� � �� ��� ������

1�21��� Y� ����P9� ����������������] ��!"�#�$�&%���

E�8��1���D(*@-C7�6,/.NV/�6t3(*��"%.N�6.R X,/$+4N"%&�F�$7,3,* PG �u�5�).A>R<G@-C+�),/.N,*t3(B$?C78�(O�2C+$7<G@0C7<�$+(�,* LC+8�(O�2FG(*@-�]?�@B"*C7�),=.BG�C78A"%C

�('*)+)1T;E-,4R�� � '��. /�R�0�R�T21�R�,43�n6R�E4h 5�687�9�:<;�=?>@6BA�C�D">8;FE8G"H+=?H

X,/$"*&)& $7(*"=@98G"6��&)(g�2C�"%C7(S�e,% �C78:(��o�:�2C+(B4�� ~3(B( ~3(*@-C+�),=. ��� � �I'!�G(B&),*; X,=$"%.�(�y F�&�"%.G"*C7�),=.�,% �C78:(�t3(B$+� ?�@B"*C7�6,/.C7(*@E8�.�� R <�(S�!�). t3,/&6t3(*>Q��J�.�,/C�"%C7�6,/.�;��)&)&.�G(�<A�2(*>5 X,/$�C78:(�F:$7,3,% #����e�)$��2C�.�,=C7(HC78G"*C�C+8�(H�).G> <G@-C7�6,/.N8u�RFG,/C+8�(*�D�1��"��G,*t3(O@-(B$+CE"%�6.�&[�M8�,=&1>����).�"%.u�5�6.��)C+�1"%&��2C�"%C7( GG�2�).A@-(W�K�LML+KONPK ZRQ SUTWVXSUT

E~,{�28�,*; �6C�����"%&);g"H����F�$7(S�2(B$+t3(*> �u� C+8�(O�o�:�2C7(I4�GR;?(H@-,/.A�2�1> (B$�C78�(HC+8�$7(B(H,=FQ(I$E"%C+�),=.G�v,=.�( �u�5,=.�(��

Y[Z]\_^ RM`abdcfeba ~3<�F:FQ,x�2('C78�(?�).G> <G@-C7�6,/.O8�� FG,/C78:(*�2���~���eC7$+<�(��6.��2,=45(?�2C�"%C7(�;��6C78Ot/"*&)<�(S��/�R�0�R�T21�R�,QG4n6R�E1hIGT;E],4R��w"%.G> K ~c,4RLG="%.G>HC78G"*CL"'C7$E"*.G�2�6C7�6,/. ^ RM`tbicfe CE"�<3(*�JF�&�"/@-(?;��)C78H�6.�F�<�C�45(*�+�7"%V=( K n O$d �p��$+,/4C78�(��2FG(*@0� ?�@B"*C7�6,/.BG C78�(�.:(B; �DCE"%C+(H;��)&)&:8G"Bt3(�t="%&6<�(*�e/*R�0�R�T21�R�,gf�G n6R*E4hhf GaT;E],4R��if�"%.A> K ~c,4R[f:�2<G@E85C+8G"%C

/*R�0�R�T21�R�, f 3 /*R�0�R�T21�R�,bjlk K n O]dcmn6R�E4h f 3 n6R�E4hT;E],4R�� f 3 T;E],4R��K ~c,4R f 3 K ~n,4R

E�8R<A��('*)+)1T;E],4RP� f � '6�. /�R�0�R�T21�R�, f 3 ��'*)+)1T;E],4R�� � '6�. ��/*R�0�R*T21�R�, j k K n O]dcm

3 ��'*)+)1T;E],4R�� � '6�. /*R�0�R�T21�R�,�#�2�).A@-(�G X$+,/4zC+8�(H�). t="%$7��"%. CHG T;E],4R�� � '��poq/�R�0�R�T21�R�, 3 n6R�E1h�L���5C+8�(H�).G> <G@-C7�6,/.58u� FQ,=C78�(S�2�1��

3 n6R�E1h f

"/��$7(�R3<��6$7(*>Q�Ysr"\ k]/(lmE%n�bdcfeta ~3�).G@0( k-/$lmEmn�bdcfe >R,3(*��.�,/Ca@98A"%.�V=(�C78:(!t="*&)<�(*�|,% 8/*R�0�R�T21�R�,QGmn6R�E4h�,/$ T;E],4R�� G/�6CL@-&6(*"%$+&[�

F�$7(S�2(B$+t3(*�!C+8�(H�).G>R<A@-C7�6,/.N8�� FG,/C+8�(*�2���I�Y(u�\ PQR�0�R�T21�RPNVUXWPa ~3<�F�FG,3�D( ��'&)+)�T;E],4R�� � '6�. /�R�0�R�T21�R�,v3 n6R�E4h�GG"%.G>��2<�F�FG,x�2(�C78A"%C�" PQR�0�R�T21�RPNVUXWC7$�"%.G�D�)C7�6,/.NCE"�<3(*��F�&�"/@-(���E�8:(B.5 X$7,/4 C78�(O�2FG(*@0� ?�@B"*C7�6,/.N,% �PSR�0�R�T21�R�NVUXW ;�(�< .�,*;�

K ~c,4R 3 ` lmTohK ~c,4R f 3 /*R(lU,UwT;E],4RP� f 3 T;E],4R��_xy'/�R�0�R�T21�R�, f 3 /*R�0�R�T216R�,

n6R*E4h f 3 n6R�E4h j k�/*R�0�R�T216R�,=��T;E],4R�� m

Page 70: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

�m������������*����� ������ � ������������ ��� ����� ��� � �+������ � ��� � '

~3�).A@-( K ~c,4R&3 ` lmTohIG�;?(�< .�,*; X$7,/4 C78�(O�2C�"%C+(U�). t="%$+�1"%. C�C78A"%CVT;E],4R��i�pov/*R�0�R�T21�R�,Q� E�8R<A�IG�('*) )1T;E],4R�� f � '�@. /*R�0�R�T21�R�, f 3 �('*)+)1T;E],4RP� @. /*R�0�R*T21�R�,

3 �$�('*) )1T;E],4R�� � '��. /�R�0�R�T21�R�, j k�/*R�0�R�T21�R�,=�uT;E],4R�� m3 n6R�E4h j k(/�R�0�R�T21�R�,=��T;E-,4R�� m

���u�5C78�(H�6.G>R<G@-C+�),=.58�� FG,/C+8�(*�2���*3 n6R�E4h f

"/��$7(�R3<��6$7(*>Q�

�r.M@0,/.G@-&6<G�2�6,/.BGx�2�).A@-(�C78�('> (*�2�6$7(*>HF�$7,=FQ(I$7C6�U8�,=&1>��L�6.��)C+�1"%&6&[�H"*.G>��1�eF�$+(*�2(I$7t3(*>����O(*"/@E8�,% �C78:(�,/FG(B$E"*C7�6,/.G��GC78�(B. ��"/�+�2<�4{�).�VNC78:(*�2(N"*$7(5C+8�(5,=.�&[��,=FQ(I$E"%C+�),=.G�UC78G"*CM@B"%.o@98G"*.�V/({C78�(N�DCE"*C7(5,* 'C78�(5C+$E"*.G�245�6C7C+(B$� G~�6C4 <G�DC!�G(HC7$+<�(� X,/$�"%&)&�C78�(O�DCE"%C+(*��C78�(HC7$�"%.G�D45�)C+C7(B$g@B"%.NFG,3�+�2�:��&[�N$7(S"/@E8B�

����� �:- �"! #_*,&%$'& ( ���)(�&���*,&%&�/ �! /*(�&+#s&-,.# )+*,&(�.-0/

1�0/��3 1�]� �2]������43 �5_�76�85�]#�e :9 ����6e!

~<;>=@?BA�CED �����u�#�GF6�HC*t<;'IKJ�;>JLFMNCPORQSCTM4OR;>FPJ�CEDUA�DWVXF��YCEIU?ZJ�?�F>?R;[?RO\FTDYJ�A�?BA�CED]J6�WJ�?R;�Q[J^=�F>_�_`;>acb@d>e>f�gEd>f�eThUijlk�m f�gEd jNnYk � �oMqpr;�FPJRJ�IUQ';�?RsYF>?�?RsW;4Jo�UJ�?B;�QtJ�?\FTOR?\JuA�DZCEDW;�CTMvA�?�JuA`DWA�?BAwFT_KJ�?�F>?R;>J�G<?RsYF>?�A`?�JuCExY;�O\FT?BA�CEDKJ�p�A�_`_�H;Z=%FT_�_`;>aCPDW_[�[IWDKay;�O^=@A`O�=@IUQ[J�?\FTDY=@;zJ�A�DGp�sUAw=�s{?RsU;�A�O�xWOR;z=@CEDYa�A�?RA`CEDYJ4FTOR;|JRF>?RAwJ�?Y;>aQGvFTDYaG?RsYF>?�CEDU_[�[?RsW;VEA)t<;%D'CExY;�O\FT?RA`CEDYJ�p�A�_�_.�Y;L=�F>_�_�;zaQGy?BsW;�D[A�?�A}J�xHC~JRJ�Ao�W_`;+?RCZOR;zFEJ�CPD{A`DYayIY=@?BA)t<;�_��ZF��YCEIU?�?RsW;�J�;�?�CTM�xYC~JRJ�A:�W_�;J�?�F>?R;>JL?RsU;{J6�WJ�?R;�Q�=�FTD]VE;�?ZA�D�?RC>��?RsU;[J�C ��=�F>_�_`;>a�e>��hWg>��hW��iN�cJ�?\FT?R;zJI��E�sWA}J+p�A�_`_�FT_�_`C>p�IYJL?RCXay;>a�IY=@;xWORCPxH;%OR?RA`;>J�CTM�?RsW;�Jo�UJ�?B;�Q�p�sWA}=�s�Q[FH�)DWCP?��Y;LayA`OR;>=@?B_[�Zay;zayIY=@A:�W_�;�MNOBCEQ�?BsW;�J�?\FT?R;�A�D��PFTORA}FTD�?H��KCPORQ[F>_�_���G:?RsW;[J�;�?+C>M�OR;>FP=�sKF��W_`;'J�?�FT?B;>J+AwJ�ay;�?YDU;>a"?RCi�Y;?BsW;'?BO�FTDKJ�A�?BA��<;�=@_�C~J�IWOB;)C>M�?BsW;[J�;�?+C>M�A�DWA`?RAwF>_J�?�F>?R;>J�IWDYa�;�O�?RsW;^?BO�FTDKJ�A�?BA�CPD{OR;%_wFT?BA�CPDYJ�ay;�?YDU;>a ���'?BsW;^CExY;�O\FT?RA`CEDYJ�CTM�?RsW;�J�xY;>=-A ?q=�F>?RA`CEDB����D�?RIWA`?RA��<;%_[��GEA`?AwJ�?RsW;�J�;�?�CTM4J�?\FT?B;>J�p�sWA}=�sX=�F>D��Y;)OB;>FE=�sW;>a{MNORCPQ��PFT_`AwaGA�DWA`?RA}FT_rJ�?\FT?R;zJ��u� FTxWxW_��yA`DWVGF[_�;�V~FT_rJ�;SR�IW;%DY=@;CTM^CPxH;%O�FT?BA�CPDYJY�NA���;���J�IY=�s�?RsYF>?'F>D�CPxH;%O�FT?BA�CPD�AwJLFTxUxW_�A`;>acCEDW_��cp�sW;�D]A�?�J+xUOR;>=@CPDYayA`?RA�CPD�AwJL?RORIU;�F����D� k hW��il� m CExY;�O\FT?BA�CEDGA}J7CPDW;Lp�sWC~J�;+xUOR;>=@CPDYayA`?RA�CPD{sWCP_waWJ�����D jNk�m f�gEd j�� ����e n ���ye�d�� CTM�F)J�xY;>=@A ?H=�FT?BA�CEDAwJ�CPDW;'?BsYFT?�sWCE_}aWJ+A�DXFT_`_�OR;zFE=�sYF��W_`;'J�?�F>?R;>J� �?BsYFT?LA}JIG�A�?^AwJ^CEDW;'?BsYFT?LsUCE_waUJ�A�DUA�?RA}FT_`_[�GF>DYa"A}J�xWOB;>J�;�OB�<;>aIWDYay;�O�F>_�_:;�DKF��W_`;>a'CExY;�O�F>?RA`CEDYJ����CE?B;�?RsKFT?�?RsW;r�PFT_�A}ayA�?6�^CTMq?BsWAwJ�MNCPORQ�CTMqOB;>FEJ�CEDWA`DWV�ay;�xY;�DYaWJ*=@ORA`?RAw=%FT_�_���CEDL?BsW;�FEJBJ�IWQ�xW?RA`CED+?BsYFT?�pr;�<�DWC>pFT_�_*?RsW;|�YFPJ�A}=+CExY;�O�F>?RA`CEDYJ�?RsKFT?^p�A�_`_X�Y;�FTxWxW_`A�;>a G�J�A�DY=@;L?BsW;ZFEaUayA�?BA�CEDGC>M�MNIWOB?RsW;%OQ�YFEJ�Aw=+CPxH;%O�FT?BA�CPDYJ�Q[FH�A�DY=@OB;>FEJ�;^?RsW;�J�;%?�CTM�OB;>FE=�sYF��U_�;�J�?\FT?R;zJ�F>DYaQ[FH�Z?RsW;%OR;@MNCPOR;^ay;z=@OR;>FPJ�;^?RsU;+J�;�?�CTM*xWORCPxH;%OR?RA`;>J�?RsYF>?�sWCP_wa'A�DFT_�_�OR;zFE=�sYF��W_`;�J�?�F>?R;>J�����?�F>_wJ�C�FEJRJ�IWQ';>J�?BsYFT?�FTDGCExY;�O\FT?BA�CEDGp�A`_�_�CEDW_����H;|=�FT_`_�;>a[p�sW;�D�A�?�J�xWOR;>=-CEDYayA`?RA`CEDAwJ�?ROBIW;m uA�� ;���G�?BsW;^CExY;�O\FT?RA`CED�AwJ m�j b�hU��iN� m p�sW;�D[A�?\J�xWOR;>=-CEDYayA`?RA`CED�ayC<;>J�DWCE?�sWCP_waQ��KIUOR?RsU;�O�p�CEOP<LAwJuDW;�;zay;>a+?RC|ay;>JB=@ORA:�H;4F^J�;�Q�FTD�?RAw=uMNO�F>Q';�p�CPO�<�p�A�?RsUA�DZp�sWAw=�sL?RsWA}J�MNCEORQ¡C>M�OR;>FPJ�CPDWA�DWV|=�FTD�H;���IYJ�?RA ?K;>aQG�FTDYa ?RCGa�;��<;�_�CPx F{J�IWA�?\F��W_`;LDWCE?\FT?RA`CEDcMNCEO^;�y�xWOB;>JRJ�A�DWV[A�DKayIY=@?BA��<;+xUORCExY;�OB?RA`;>J+FPJ�xKFTOR?�CTM4FJ�xY;>=@A]?q=�FT?BA�CPDB��E�sUAwJ�OR;�R<IWA`OR;>J��Y;�A�DWV�F6�W_�;L?BC[ay;�?YDU;L?RsW;Z;�yUFE=@?4JR=@CPxY;)C>M�F[J�xY;>=@A]?q=�F>?RA�CPDBG:J�CA`?�AwJ4=@_�;>F>O;�yWFP=@?R_��[p�sYFT?^F>OR;L?BsW;|�YFEJ�Aw=+CPxH;%O�FT?BA�CPDYJ�CTM�?BsYFT?�J�xY;>=@A]?q=�FT?BA�CPDB����?^FT_}J�C'OB;�R�IUA�OR;zJ �Y;�A`DWV[F��U_�;L?RC�ay;�?YDW;;�yWFP=@?R_��)p�sU;�D�FTD{CPxY;�O�F>?RA�CPD{A}J�;�DYF��U_�;>aQ�

Page 71: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

��� ������������������G���W�i��������&�4���1�G�������

1�0/��� �y� 2]���%����b%� ������� ! �9 �B2"� � :9

��F��yA`DWVcJ�;�;�D�sWC>p ?RCcxUORC>�<;[A�DYayIK=@?RA`�<;'xWORCPxY;�OR?BA�;>J)C>M�FcJ�xH;z=@A ?q=%FT?RA`CEDBGr?RsW; R�IW;zJ�?RA`CEDv�H;z=@CEQ';zJ� [sWC>pQ)IY=�sLa�C�pr;�OR;>F>_�_��+DW;�;za+?RC�J�?\FT?R;�;�y�xW_�A}=@A�?B_[�^FPJuxYFTOB?�C>M�?RsW;�J�?�F>?R;�A�D��EF>ORA}FTD�?HG<F>DYa�sUCTp�QZIY=�s�=�FTD,�Y;�_`;@MN?A�Q'xW_`Aw=@A`?HG�?RCS�H;�xUORC>�<;>a�A`DYayIY=-?RA��<;%_[� d ��D+p�sKFT?�MNCP_�_�C>p�J�pr;�J�sWC>p.?BsYFT?�FT_�_�?RsU;�xWOR;>a�Aw=�F>?R;>J�=�FTD|�Y;�ayORCPxWxY;>aMNORCEQ¡?BsW;4J�?�F>?R;�A`Dy�PF>ORAwF>Dy?uMNCPO�?RsUAwJu;�yUFTQ'xW_`;�� ���0DLMoFE=-?�A�?(G�=@CEIW_}a �Y;4FTOBVEIW;>aZ?RsYF>?�F+J�xY;>=@A ?H=�FT?BA�CEDZp�A�?Bs'DWCJ�?�F>?R;�A`Dy�PFTOBAwF>Dy?uA}JuF�Q'CEOB;�F>xWxWORCPxWORA}FT?B;�J�xH;z=@A ?q=%FT?RA`CED+MNCPO�J�IY=�sZF^J�A`Q'xW_�;ray;%�yA}=@;�� 4��CP?R;�?BsYFT?uA`?uAwJ*FT_�p�FH�WJxHC~JRJ�Ao�W_`;L?RC'Q'C>�<;^xWOB;>ayAw=%FT?R;zJ�MNOBCEQ ?BsW;LJ�?�F>?R;LA�D��PFTOBAwFTD�?�?RC[?RsW;�CExY;�O\FT?RA`CEDYJ�G:xWOR;H��FTDYa{xYC~J�?�=-CEDYayA`?RA`CEDYJ�G�WIW?�p�;�F>OR;�FE=�sWA�;%�yA`DWVZJ�CPQ';�?RsUA�DWV�Q'CEOB;�sW;�OB;��E�sW;^OR;>J�IW_�?BA�DWVZJ�xH;z=@A ?q=%FT?RA`CED[AwJ� ��d>h�d>���[��� k�j d jlnYk� f(HHfPidk-/$lmE%n K TohLh&Rs/����6F/�R�0�R�T21�R�, Qbicfe g

n6R*E4hB Qbicfe gT;E],4R��} s� �/�R(lU,Uw �

����� f K�� ��k]/(lmE%n K TohLh&RM/�����T;E ��~��mh!�DT"� K $# T;E�3 ~��mh�3&%�')(wT@3 '*( Ki��,+

-Z���ye>hyd jNnYk �[��� k�j d jlnYk b^ RM`tbicfe.� � K n O �bdcte�i0/�f2143�/�R�0�R�T21�R�, bicfe g

5 � � f /*R�0�R�T216R�,v37698 8:8 8�8/*R�0�R�T21�R�, r s % K n O '

k-/$lmE%n K Toh;bdcte;�Q�� K n O �bicfei0/�f3<+q/*R�0�R*T21�R�,} bdcteQg

3<+�T;E],4R"� ����143�/�R(lU,Uw ��

5 3 i_/*R(lU,Uw=(vT;E],4R"�i� � i���/*R�0�R*T21�R�,5 � � f pq/�R(lU,Uw>( K n O 3 /*R�0�R�T216R�,=��T;E],4R"�

PSR�0�R�T21�R�NVUXW4�V�&i0/�f3<+q/*R�0�R*T21�R�,} bdcteQg

143 n6R*E4h bdcteQg?�143!T;E-,4R"� ����,�143�/�R(lU,Uw ��

5 3 i�pq/�R(lU,Uw>(wT;E],4R"�i��� i���/�R�0�R�T21�R�,5 � � f n6R�E4h*3 6@8A8n6R*E4h rQs % /�R�0�R�T21�R�,=� 6@8B8!8T;E-,4R"� C' ( /*R(lU,Uw�(wT;E],4R"�q3 6@8:8!8T;E],4R"�_xy'

��CE?B;�?BsYFT?

'L��?RsW;�A`DWA�?BAwFT_`Ao{>F>?RA`CED^=@CPDYayA`?RA�CPD^DWC>p�ay;�?YDU;>J�?RsW;�A`DWA�?BAwFT_<�PF>_�IW;>J�C>MY?RsU;�A`DYay;�y�FTDYa^?RsW;�Q'C�ay;*;�yyxU_�Aw=-A�?R_���GFTDYa

Page 72: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

�m������������*����� ��������r���������������������� �����u�+��������r��� � �

� ��?RsW;rxWOR;z=@CEDYa�A�?RA`CED�CTMaPSR�0�R�T21�R�N0 � �usYFEJ�?RsW;VA�FEaUayA�?BA�CEDKFT_;C4FEJRJ�IWQ'xW?BA�CPDT� ����� � T X NHY 8 ���P� �� � �   GEp�sWAw=�sAwJ�OB;�R<IWA�OB;>aA`D{CEO\ay;�O�?BC[xWORC>�<;+pr;�_�_���MNCPORQ';zayDW;>JBJ�CTMr?RsW;LxYC~J�?�=-CEDYayA`?RA`CEDB����_�?BsWCEIUVEs FT?Q?YO\J�?^J�A�VPsy??RsWA}J�Q[FH��FTxWxY;>F>O�?BC��Y;4F^J�?ROB;�DWVP?RsW;�DUA�DWV^CTMv?RsW;�CPORA`VEA�DKFT_WxWOB;>=@CPDYayA�?BA�CPDBG<?RsW;�OB;>FEay;%O�J�sWCPIW_waZOR;>F>_�Ao{%;?RsYF>?�A�?4AwJ�A`DMoFE=-?^F[=@CEDYJ�;�R<IW;�DY=@;�CTMr?RsKFT?^xWOR;z=@CEDYa�A�?RA`CED FTDYaG?RsW;LCPORA`VEA�DKFT_�J�?�FT?B;LA�D��PFTORA}FTD�?� �?Rs�IYJ?RsW;^DW;%p J�xH;z=@A ?q=%FT?RA`CED�JRF>?RA}JO?Y;>J�?RsU;+JBFTQ';�=�FT_`_�A�DUV+xWOBCE?RC�=-CE_wJ4FEJ�?RsW;^CEOBA�VPA�DYF>_��

��CE?B;+?RsKFT?HGY;��<;�D[?BsWCEIWVPsGA�?�sYFEJ�F)QZIY=�s'_wF>ORVE;%O�J�?�FT?B;LJ�xYFE=@;�?RsYF>DG?RsW;�CEOBA�VEA`DYFT_*J�xY;>=-A ?q=�F>?RA`CEDBGW?BsW;+DW;%pJ�xY;>=@A]?q=�FT?BA�CPD{a�;�?YDW;>J�; yWFP=@?R_��)?BsW;�JRFTQ�;^J�;�?�C>M�OR;zFE=�sYF��W_`;^J�?\FT?B;>JI��0?�AwJ�J�?BO�F>A�VEs�?�MNCPORp�FTO�a+?BC^J�sUCTp�?BsYFT?u?BsW;�MNCP_�_`CTp�A`DWV4FTOR;�A`DYayIY=-?RA��<;�xWOBCExY;�OB?RA�;zJ�C>M�?BsW;�OB;���AwJ�;za�J�xY;>=@A ?H=�FT?BA�CEDVEA��<;%D[F��YC>�<;m

'L�Qpq/�R(lU,Uw�� T;E],4R"�i� � i��*/�R�0�R�T21�R�,� �VT;E],4R"�i� � i��*/�R�0�R�T21�R�, xy'�����('*)+)1T;E-,4R"� 8 '��. /�R�0�R�T21�R�,43�n6R�E4h

�0DGxUO�FE=-?RAw=-;�G:F_}FH�<;�OR;>a�FTxWxUORC<FP=�s ?RC[�<;�OBA ?q=%FT?RA`CEDGC>M�J�IK=�s xWORCPxY;�OR?BA�;>J�A}J^ay;>J�A`O�F6�W_�;m �?RsYF>?+A}JIG�A`?�A}J��<;�OP�IYJ�;@MNIU_�?RCV�Y;+F6�W_�;4?RCLFPJRJ�IWQ';^=@;%OR?�F>A�DZA�DYa�IY=@?RA`�<;�xWORCPxY;�OR?BA�;>J�p�sW;%D'xWORC>��A�DWV�CE?BsW;�O�A`DYayIY=-?RA��<;�xWOBCExY;�OR?BA�;>J���KCPO�;�yUFTQ'xW_`;�G<xWORCPxY;�OR?6� � AwJ�IYJ�;>a'A�D[?RsU;�xUORC<CTM�CTM�xWOBCExY;�OB?o� ��A`D ~~;>=@?RA`CED|�u���u�#�ZF��YC>�<;��

1�0/��� ��$ � ���r9O O!F�� �����9�2p��� 9+6�%W����9 ��!"����@!$� ��u2

��CE?B;�?BsYFT?rDWCE?�FT_�_v=@CEDKJ�?RO\FTA`Dy?\J�=%FTD �Y;�OB;�Q'C>�<;>a�MNOBCEQt?RsW;4J�?\FT?B;�A�D��PFTORA}FTD�?�A�D'?BsW;�F6�YCT�<;4p�FH������CPDYJ�A}ay;�OMNCEO�;�yWF>Q'xW_`;�?RsW;|=@CEDKJ�?RO\FTA`Dy?�OB;�_wF>?RA`DWV�� /�T�R*E],�nL?RC���T2/�h��-,mlUw���� A�D�?RsW;���A�OR?BsYaWFH����C<C <{;�yUFTQ'xU_�;�A�DB~~;>=I�?RA�CPD���GUFTDYaZ?RsW;^=-CED���IWDK=@?�p�sWA}=�s�ay;�?KDW;>J�?BsW; 0F~mE4h&R*E4h�MNIWDY=-?RA�CPD'A�D�?RsW; E�O\F! �=�"GFTDKFTVE;%Q';�D�? ~ �WJ�?R;�Q¡C>M~<;>=@?BA�CED�C�� � �E�sW;�ay;>=@A}J�A�CPD�FEJ�?RCLp�sW;�?BsW;�O�?BC)p�OBA�?R;�F+xWOBCExY;�OB?o��FPJ�FL=@CPDYJ�?BO�F>A�D�?�A`D?BsW;�J�?\FT?R;^A`Dy�PFTOBAwF>Dy?�CPO�FEJ�FTD{A`Dq�ayIY=@?BA��<;�xWOBCExY;�OR?6�Z?RCV�H;�xWOBCT�<;za)ay;%xH;%DYaWJ�Q�FTA�DU_[�+CPD'?RsU;�xWIUORxYC<J�;�MNCPO�p�sWA}=�sZ?RsU;�J�xH;z=@A ?q=%FT?RA`CEDZAwJ�H;%A�DWVIYJ�;>a ����J�F)ORCPIWVEsGOBIW_�;�CTMr?Rs�IWQ,�BGyA M�?RsU;LJ�xY;>=-A ?q=�F>?RA`CED{A}J �Y;�A�DUV)IYJ�;>a{?RC�ay;�?YDW;|FTDYaGF>DYFT_��WJ�;+OB;�R�IUA�OR;(�Q';�D�?�J���J�IY=�s�FEJ�A�D[F ~<C>MN?�p�FTOB;$#7;�R<IWA`OR;�Q';%D<?�J�~<xY;>=-A ?q=�F>?RA`CED[CEO�F+E:CExq�N_�;%�<;�_��KIUDY=@?RA`CEDYF>_X~<xY;>=-A ?q=�F>?RA`CED=?RsW;�D[A`?�AwJ�xWOBC��YF6�W_[�[Q'CPOR;^F>xWxWORCPxWORA}FT?B;+?RC�J�?\FT?B;+?RsU;�xUORCExY;�OB?6�[FEJ�F)=-CEDYJ�?RO�F>A�D�?�A�D[?RsU;LJ�?\FT?B;�A`Dy�PF>ORAwF>Dy?(��oMPGqCED ?RsW;LCP?RsW;�O4sYFTDYa G�?RsU;ZJ�xY;>=@A]?q=�FT?BA�CPDGAwJ �Y;�A`DWV'IYJ�;>a ?BC�FTDYF>_[�UJ�;L?RsU;|�H;%sYF��yA`CEIWO\FT_�xWORCPxY;�OR?BA�;>J�C>M�Fay;>J�A`VEDv��FPJ�A`D"?BsWAwJ^=�FPJ�;� G:A�?�A}J�Q�CEOR;|FTxWxUORCExUORAwF>?R;'?BC�J�?�F>?R;�FTDYa xWORC>�<;L?RsU;LxWORCPxH;%OR?6� FEJ�FTD A�DYayIK=@?RA`�<;xWORCPxH;%OR?6�{C>M�?BsW;ZJ�xY;>=-A ?q=�F>?RA`CEDB�%���{?RsU;+?RA`Q';^?RsW;ZJ�xY;>=@A ?H=�FT?BA�CED�AwJ�A`Q'xW_`;�Q);%Dy?�;>aQG�A�D JBFS� F)xWOBC�=@;>ayIWO\FT_xWORCPVEO�F>Q'Q'A`DWV^_wFTDUVEIYF>VE;�GYQ'C<J�?�C>M�?RsW;4xWORCPxH;%OR?RA`;>J�J�sUCEIW_}asYF��<;Q�Y;>=@CPQ'; �H;%sYF��yA`CEIWO\FT_:xWOBCExY;�OR?BA�;>J�GYJ�A`DY=@;Q'C<J�?�xWOBCEVEO\FTQ'Q�A�DWV�_wFTDUVEIYF>VE;>J�;%DyMNCEO\=@;^FT?�Q'C~J�?�?6��xWA�DUVZ=@CEDYJ�?RO\FTA�D�?�J��

Page 73: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� � ��� ����

� ��� � � � ��� �� ������� � �� ��� ������

E�sWAwJ�=�FPJ�;|J�?RIKa��';�y�xW_�CPOR;>J�?BsW;^A�D�?R;�VPO�F>?RA�CPD'CTM�F|MNCPORQ[F>_�_[�ZJ�xY;>=@A ?K;>a'Q'C�ayIW_`;�A�D�?RCZF+_}FTORVP;�O4Jo�UJ�?R;%Q��

����� � &! �!#"%$r&!& &('*),+

/�.-��.- / �#����9O ������*�0�sW;+xWOBC21W_`;�Q AwJ�?RC[a�;>J�A`VEDGF ������ k�m � k gE�43 h k h65Y�87�� k d �q��b@d>�87 9C�*3 �;:rp�sWAw=�s{?BO�FP==<UJ�a�;�xY;�D6>ay;�DY=@A`;>J;1Y;�?�p�;%;�D)C?16@�;>=@?\J�J�?RCPOR;>aLA�D�FTD'; yy?B;�ORDYF>_YaWF>?�FA1KFEJ�;�F>DYa);�DYJ�IWOR;zJ�?BsYFT?rDWCL=-A�O�=-IW_wF>O�ay;�xY;�DYa�;�DY=@A`;>JFTOR;�=@OB;>FT?B;>aCBD0�sWA}J�xWORC?1W_�;%Q�AwJ�FPaWFTxW?B;>a�MNOBCEQ %FE�A�DHG�I<F�'JB0�sW;GOR;�K<IWA`OR;�Q';%Dy?^AwJZ?RC�J�xH;z=@A MML F"Q'C�ayIW_`;{p�sWA}=�s]CS�q;�O\JN1KFEJ�A}=�<;�OBA ?Y;za MNIWDY=-?RA�CPDYFT_`A�?OLQPrFTDYa�?RsU;�D�?RCJ�xY;>=@A MMLLsWC>p8J�IY=�s[F+JOLWJ�?R;�Qtp�CPIW_waR1H;4A�D�?R;�VPO�FT?B;>aLA�D�?RCLF^_wF>ORVE;%O�JSLUJ�?B;�Qtp�sWA�_`;�Q[F>A�D�?�F>A�DWA`DWV�A�?\J��<;�OBA ?Y;za1H;%sYF��yA`CEIWO%B ��FEJ�A}=�MNIWDY=@?BA�CEDKFT_�A`?OL)A`DY=@_�IKay;>J�?BsW;�FA1WA`_�A`?SLZ?RCUT

V A�DWA`?RA}FT_�A:{�;�?RsW;^Q'C�ayIU_�;QWV FEaWa�FTDYa[OR;�Q�CT�<;�C?16@�;>=@?\J�FTDYa�ay;�xY;�DYay;%DY=@A�;zJXWV K�IU;�O.LZ?RsW;�J�?�FT?B;+C>Mu?BsW;�JSLUJ�?R;%Q�A�D[�PFTOBA�CEIKJ7p�FYLUJXB

/�.-���� � �!CZ �����*����3D[\ O\FTxWsU>l?BsW;�CEOB;�?RA}=?B;�ORQ'A`DWCE_`CEV?Lcp�A�_`_]1H;GIKJ�;>a�?RC�ay;zJR=@OBA^1Y;{?BsW;{OB;�K�IUA�OR;%Q';�D�?�JXB40�sW;�C216@�;>=@?\J_1Y;�?�pr;�;�Dp�sWAw=�s[ay;�xY;�DKay;�DY=@A`;>J�=�F>D`1Y;�OR;>=@CPO�ay;za)p�A�_`_a1H;�=�F>_�_`;>a k�n:m ��b2BD0�sW;�OB;�FTOR;^?�p�Cb<�A�DKaWJ�CTMra�;�xY;�DYay;�DK=XLCT'2B4� j e>��gEd m ����� k�m � k gE�DPTp�sU;�OR;�CEDW;4C216@�;>=@?*AwJuIYJ�;zadc�OB;@MN;�OR;%DY=@;>aLayA`OR;>=-?R_^Le1fL|FTDWCP?RsW;%O�C216@�;z=@?gBh0�sWAwJAwJ�J�sWC>p�DGFEJ�FLayA`OR;>=@?B;>a);>a�VE;^A�D[?RsU;+a�;�xY;�DYay;�DK=XL'VEO\FTxWsi9�J�;�;U��A�VPIWOR; � BI'A:jB��C�ay;��[AwJrJRF>Awa?BC m�j e>�ygEdzi�� m ����� k�m.nYk w6PWF>DYa�wLAwJ�JRF>Awa'?RCR1Y;�F m�j e>�ygEdZb�f���� n e�d>��e n6k �lPWA M?RsW;%OR;^AwJ�FLayA`OR;>=-?R;>a);zayVE;�MNORCPQ �[?RC w6B

� B]m k�m�j e>��gEd m �y��� k�m � k gE�DP�p�sU;�OR;[FG=�sYF>A�DcC>M�CPDW;[CEOLQ'CPOR;�ayA�OB;>=@?La�;�xY;�DYay;�DK=@A�;>Jn@�CPA�DYJ+?�p�C�C216>@�;>=@?\JXBpo�DZCE?BsW;�O�prCEO\aWJXP�?RsW;�A�DYa�A�OR;z=@?ray;�xY;�DYay;%DY=XL+OB;�_wF>?RA`CED'A}J�?BsW;�?RO�F>DYJ�A`?RA`�<;�=@_`C<J�IWOR;�CTM�?BsW;�a�A�OR;z=@?ay;�xY;�DYa�;�DY=XLZOR;�_}FT?BA�CEDqB

� I

Page 74: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

�������������L���������G���Zu� � �

ed

a b

c

f

��A�VPIWOR; � BI'2T�� ?OLyxUAw=�F>_:ay;�xY;�DKay;�DY=XL�VEO�F>xWsaB��C�ay; �ZAwJ�JBFTA}a�?BC m �y��� k�mcnYk w6PyF>DYaPw+AwJ�JBFTAwaZ?RC(1Y;4F+b�f���� n e�d>��e n6k �lP<A Mv?RsW;�OB;�A}J�F+ayA`OR;>=@?B;>axYFT?BsMNOBCEQ �[?BC w B

0�sW;R9 m�j e>��gEd2: m �y��� k�m � k d>b�CTM*DWC�ay; EGFTOR;^?BsWC<J�;+DWC�ay;zJ7p�sWA}=�s 9�ayA`OR;>=@?B_^LH:�ay;%xH;%DYa'CEDxEaB�sW;�D�J�CEQ';�DWC�ay; ay;�xY;�DKaWJ�CPD�A`?�J�;%_ M!9lA B�;QB^Pu?BsW;�OB;A}J)FG_�C<CPx�A`D�?RsU;VPO�F>xWsC: P�pr;p�A`_�_�JBFYL�?BsW;�OR;[A}J)Fg j e>g<f�ilhWe j d��DB�� DUC�ay; EAwJ�FLg<h k�m�jlm hyd>��b�f���� n ezdz�ye�CTM2�'A M�?RsW;�FPaWayA�?BA�CPDC>M�FLa�A�OR;z=@?�ay;%xH;%DYay;�DY= L)C>M�[CED E{p�CEIU_wa'DWCE?�A�D�?ROBC�ayIY=@;�F)=@A`O�=@IU_wFTOBA�?OLQB0�syIYJ PyMNCEO�;�yUFTQ'xW_`;QPEA`D���A�VEIUOR; � BI'2T

V h[ayA�OB;>=@?R_ L'a�;�xY;�DYaWJ�CPDG��FTDYa mV h[ay;�xY;�DYaWJ�CED �,PYg6P m FTDYa kV m AwJ�FZJ�IUxWxYCEOR?B;�O�CTMrh[FTDKa{�V �)AwJ�FL=%FTDYayA}aWFT?B;LJ�IWxWxYCEOB?R;�O�CTM�h{F>DYa{�DP61WIW?�DWCP?�C>M�g6P m CEO k

/�.-���� �6���%W�����*�� �� ! ���6���! ,Z #���K2

~<IWxWxYC<J�;+?BsYFT?�OR;�K<IWA`OR;�Q';%Dy?\JuFTDYF>_^LUJ�A}J7sYF��<;�A}ay;�D�?RA]?Y;>a)?BsW;^DW;�;>a)MNCEO�?BsW;�MNCE_`_�C>p�A�DWV+MNIUDY=@?RA`CEDYF>_�A`?SLlT '� jNk�j d j hWi j�� �B�*3 ��a]o�DWA`?RA}FT_�A:{�;�?RsW;�JSLUJ�?B;�Q�P�J�CZ?RsKFT?�?RsW;�OB;^FTOB;+DWCLDUC�ay;>J�A`D'?RsW;���"B~ Bm�b�� n:m �"a ��sU;>==<Zp�sW;�?BsW;�O4�[AwJ�FLDWC�ay;^A`D?BsW;^JOLWJ�?R;�Q�Bho�?�=�F>D`1Y;�FEJBJ�IWQ�;>a)?RsKFT? �'AwJ�F>D[C216@�;>=@?rCTM*?RsW;

=@CEOBOR;>=-?�?OLyxY;QB� m�m � n:m �"a^��aWa'DWC�ay; �[?BC'?RsW;���"B~HBHo�?4=�FTD 1H;|FEJBJ�IWQ';za?RsKFT? �[AwJ�FTDGC216@�;z=@?�CTM�?BsW;L=-CEOROB;>=@?�?OLyxY;

FTDYa[?RsYF>?�A�?�A}J�DWCE?4FT_`OR;>FPafL'xWOB;>J�;�D�?gB '�f7 n<� ��� n:m �"a #�;�Q'C>�<;�DWC�ay;=�+MNOBCEQ¡?BsW;���"B~HBQo�?r=�F>D 1Y;4FEJRJ�IWQ';>a+?BsYFT? �LA}J�F�DUC�ay;�A�DL?BsW;4JSLUJ�?R;%Q

FTDYa[?RsYF>?�DWCE?BsWA�DUV'ay;%xH;%DYaWJ�CED �lBm�b �vf���� n e�d>�yeUa \ A`�<;�DLDWC�ay; �ZCTMv?RsW;���"B~HP<=�sW;>= <^p�sW;�?BsW;�OrFTD8Ly?BsWA�DUV^ay;�xY;�DYaUJ�CED �lP<?RsYF>?�AwJ PEp�sW;�?BsW;�O

��J�IWxUxHCPOR?\J�F>DfL'DUC�ay;QB

Page 75: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

��� ������������ �������������4�����4��� �P���e� �r���G���)"���r�:����

� m�m �[�y��� k�m � k gE�Oa \ A`�<;�DGDWC�ay; �cF>DYac=�F>DYayA}aWFT?B;'J�IWxWxYCEOB?R;�O w6P�=@OR;zFT?R;�F{a�A�OR;z=@?^ay;�xY;�DKay;�DY=XLGC>M �CED w B 0�sW;|ayA�OB;>=@?�ay;�xY;�DYay;%DY=XL[Q[FgL'F>_�OB;>FEafL*1Y;+xUOR;>J�;�Dy?%PWA�D�p�sWAw=�s�=�FEJ�;+?RsU;�CPxY;�O�F>?RA�CPDGp�A�_`_�FE=@?FEJ�F+DWC2>NCExqB

��h k�m�jNm hydz� �vf���� n ezdz�ye>b�a \ A��<;%D'DWC�ay; �'CTM�?RsW;���"B~HP4?KDYa[FT_�_�=%FTDYayA}aWFT?B;�J�IWxWxYCPOR?R;%O�J�C>M��lB '�f7 n<� � �[����� k�m � k gE�@a \ A��<;�D�DWC�ay;��[p�A�?Bs[ayA�OB;>=@?�J�IWxWxYCPOR?R;%O_w6PyOB;�Q'C>�<;�?RsU;+a�A�OR;z=@?�ay;%xH;%DYay;�DY= L)C>M

�[CED w6B������ k�m b - k a \ A��<;�D[DWC�a�;>J*��FTDYa w6PY=�sW;z==<Lp�sW;%?RsW;�O ��a�;�xY;�DYaWJ 9�ayA`OR;>=-?R_^LLCPO�A`DYayA`OR;>=@?B_^LH:�CED w6B� n:m �yb�a���A�DKaF>_�_:DWC�a�;>J7A`D[?RsW;���"B~HB� j e>�ygEd �:f���� n e�d>��eTb a \ A`�<;�D'DWC�ay; �lP4?YDYa{F>_�_�ayA`OR;>=-?�J�IUxWxYCEOR?B;�O�J�CTM �CB� j e>�ygEd ������ k�m � k d>b�a \ A��<;�D'DUC�ay; �lP4?YDYa�FT_`_:ayA`OR;>=@?�ay;�xY;�DYa�;�Dy?\J�CTM �lB

����� ���G& &^(�&!' � &!' #� � '� ��)&(& &('N)��� +h)u&(& "�' �

0�sW;_JGJ�xH;z=@A ?q=%FT?RA`CED[VEA`�<;�D[sW;�OB;�p�FPJ7A`DYJ�xWA`OR;>a 18L % #7C~J.G � ' B

/����.- �p ��" Z ��� #�

����� ��� �"!#�$��%&�"')(*%�( +#�,(&-)!.�0/213/54768��9*(:%<;>=2'?=2@A��BDCE'F( +#�G�HJI?K

L,MONP?Q �AR"S)T*U �� � Q T �WVX�Y T ��V��� � QFZ[P?Q �5R"S�\ P?Q �5R"SY V � � Q)]^ T �`_ Y

a +#��%b(:=2( �c+?=A%d( +#� �"�fe?�*ghB#% T P.Q �5RiS Ch%d( +#�,e?'jCE( ��%b�"(/21d'#/kBj��%lCE'm( +#� G�H�I?n � � Q �$�"!#� ��%&�"'j(:%�( +#�FBACo�$��9*(Bj�"!.�"'?Bj�"'?9*-p�$�*gq=r(&CE/5'ts8%&/ � � Q u Cwv BACE� ��9*(&gE-Bj�"!.�"'?B#%�/A' u7x n =2'?Bzy Y�{ � �"!#� ��%&�"'j(:%fCE(:%,( �:=r'?%|CE(&CE}5�9$gE/)%&~#�$� K�a +#�D%&(:=2($�cCE'j}�=2�&Ch=2'j(,� ���5~jCE� ��%f( +?=2( � � Q Ch%=�%&�"(�/21�!?=�Co�*%�/21c'#/#Bj��%�/21d( +#�>%&-#%&( �"; n ( +?=r( Y Ch%( +#��( �:=2'?%|CE(&CE}5�F9$go/j%&~#� �F/21 � � Q n =2'?B�( +?=2(�'#/O'#/#Bj�CE'O($+#��%&-k%b( �";�Bj�"!?�"'?B#%,/A'FCo(*%&�*g�1 K

L,MON#���"���L0M�NP?Q �AR"S V[�

� 'jCo(bCq=�gwgE-�( +#��%&(*=2( �fCq%f�";�!#(&- K

Page 76: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

����� � ����]�����������4��� ��� �P�4��� �r���G���)c�����v�� �S����� ���

/������ � 6��6[��43� ��¡2� ���

�$S�� Q �5R��L0M�N�� T ����� P?Q �5R"S

� S�� Q �5R Ch%>=2' =2~��jCwg�Ch=2� - !#� ��BACh9"=2( ��~?%&��B ( /m9$+#��9 �! +#�"($+#�"� �� Ch%0= '#/kBj��/21 ($+#� G�H�I?K

��L,MON#" %�$ L,MON&% P?Q �5R"S('�" P?Q �5R"S�) � � Q '�" � � Q '$ L0M�N&" L0M�N ( L,MON '��L,MON Cq% ~?%&��Bl1 /5�.CE'#!#~#(�*�/A~#( !#~#( /A!?�"�:=2(bCo/A'?% ! +jCh9 +Bj/�'#/A(09 +?=r'#@5��( +#��%&(:=r( ��/21 ( +#� G�HJI?K

�$S:N,+�-.- Q./�0 R /��L0M�N�� T ����� �:=2' � � Q

� S*N1+2-.- Q./�0 R / Ch% =2' =2~��jC�g�Cq=r� - !#� ��BACh9"=2( � ~?%&��B ( /9$+#��9 � ! +#�"( +#�"��=2'j-)($+jCo'#@FBj�"!?�"'?B#%,/5' �� K

L�3 / R�4 0 N,+�-5- Q./�0 R / S��L0M�N�� T ��.3 / S�+�-.-.S76ET:U ����� P?Q �5R"S�.3 / S�+�-.-.S76�"98 P T P.Q �5RiS;: �� � � Q P�<

L�3 / R�4 0 N,+�-.- Q./�0 R / S Ch%�=2'�/5!?�"�:=r(&CE/5' ! +jCh9$+�e?'?B#%�= g�g'#/#Bj��%�( +?=2( BACE� ��9*(bgo- %&~#!#!./5� ( =�@2CE}5�"'z'#/#Bj� �� Co'( +#� G�HJI?K

L�3 / R�4 0 L�R=-#R P �5R P�0 S��L0M�N�� T ��.3 / �5R>-?S76ET*U ����� P?Q �5R"S�.3 / �5R>-?S76�"98 P T P?Q �AR"S;: P � � Q �� <

L�3 / R�4 0 L�R=-#R P �AR P�0 S Ch%d=2'F/5!?�"�*=2(&CE/5' ! +jCh9 +�e?'?B#%d= g�g'#/#Bj��%�( +?=2( BACE� ��9*(bgo- Bj�"!?�"'?Bz/A'�=�@2CE}5�"'m'#/#Bj� ��CE'O($+#� G�H�I?K

L�R=-#R P �2S@? P��L0M�N��@A u � T �8 ��BA u � <�Z[P?Q �5R"S�� Y u �

L�R=-#R P �rS@? P Ch% =r' =r~��)C�g�Ch=2� - !#� ��BACh9"=2( �[~?%b��B ( /9$+#��9 � ! +#�"($+#�"� �� Bj�"!.�"'?B#%�/5' u � KDC /5( + �� =2'?Bu � ;D~?%&(d4.��'#/#Bj��%c/21�( +#� G�HJI?K

EGF P �.3 � F 0 RiN1+2-.- Q5/�0 R / S��L0M�N�� T �4 F P SH+2-.-?S�6ET:U ����� P?Q �5R"S4 F P SH+2-.-?S�6."98 P T P?Q �AR"S;: PJIY �� ) P#I" �� <

a +#� /5!?�"�:=r(&CE/5' EKF P �.3 � F 0 R"N,+�-5- Q./�0 R / S e?'?B#% = g�g'#/#Bj��%c($+?=2(l9*/A~jgqB�%&~#!#!?/A� (l=�@2CE}5�"'�'#/kBj� �� ! CE( +�L/5~#(,9*� ��=2(&CE'#@>=�9$CE�:9*~jgh=2�bCo(&- K�M#KON#KQP

� Q �AR"S��L0M�NF.RSR P.Q �5RiS76ET:U �F.RSR P.Q �5RiS76." P?Q �AR"S

a +#��/A!?�"�:=2(bCo/A'UT RVR � Q �5R"S !#� /2}5ChBj��%�( +#�O%&�"(�/21�= g�g'#/#Bj��%c/r1 ( +#� G�HJI?K

Page 77: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

��� ������������ ������������������� ��������������������������

��� �!� " # � %$'&)( � � ��*����*,+.-/$����� �0+���1

2dR 3 P 3 0 3 F5R 343"R"L,MON$ L,MONP?Q65 R"S '�" �

a +#�z/5!.�"�:=2(&CE/5' 2�R(3 P 3 0 3 F.R 373"R"L,MON ;>=B�5��%�( +#�m%b�"(/21�'#/#Bj��%�/21>( +#� G�HJI �";�!#(8- K � (�1 /rgwgE/ ! %�1�� /5;( +#�D%&(:=2($��CE')}2=2�&Ch=2'j(�( +?=2( 5855Q =r'?B Y = gh%&/�4?��9*/A;���";�!#(&- K

T 585 � Q95 R$ L,MON: � T �: � I� P?Q95 R"SP?Q65 R"S ' " P?Q65 R"S<; 8 : � <5855Q ' " 585AQ

a +#��/5!.�"�:=2(&CE/5'9T 585 � Q65 R =5B#B#% : � ( /z( +#� %&�"(�/r1'#/#Bj��%D/210($+#� G�HJI !#� /2}5ChBj��BJCE(DCh%D'#/5(�= gE� ��=5Bj- ='#/#Bj� K

2dR6= Q8> R�� Q65 R$ L,MON: � T �: ��� P?Q95 R"S<? �:=r' 5@55QP?Q65 R"S ' " P?Q65 R"S<? 8 : � <5855Q '�"98 : � <BAC 585AQ

a +#�d/5!.�"�:=2(&CE/5' 2dR6= Q8> R2� Q95 R �$�";�/2}5��% : � 1�� /5;t( +#�%&�"( /21?'#/#Bj��% /21?( +#� G�H�I !#� /2}5ChBj��B CE( Ch%�=c'#/#Bj�c=2'?B'#/5($+jCo'#@�Bj�"!?�"'?B#%f/5'FCE( K

T 585 LlR>-kR PD5 R P 4 u$ L,MON: �@A u � T �8 : �BA u � <�Z[P?Q95 R"SP?Q65 R"S ' " P?Q65 R"S5855Q ' " 585AQ ; 8 s : �BA u � x <

a +#�,/5!.�"�:=2(&CE/5' T 585 L�R=-kR PE5 R P 4 u =5B#B#%d=�BACo�$��9*(0Bj��L!.�"'?Bj�"'?9*�c/21 : � /5' u � ($/0( +#� G�HJIEF !#� /2}5ChBACE'#@�( +#�"-=2�$��4?/A( +�'#/kBj��%,/21 ($+#� %b-k%&($�"; K0a +#��%&(*=2( ��CE'j}�=2�bC L=2'j(d�"'?%&~#� ��%f( +?=2( 5@55Q � �";F= CE'?%c'#/5'�L 9$CE�:9*~jgh=2� K

2dR6= Q8> R"L�R=-kR PE5 R P 4 u$ L,MON: �@A u � T �s : �BA u � x � 5855QP?Q65 R"S ' " P?Q65 R"S5855Q ' " 585AQ ? 8 s : �BA u � x <

a +#��/5!?�"�:=r(&CE/5' 2dR6= Q8> R"L�R=-kR PE5 R P 4 u � �";�/�}A��%,( +#�Bj�"!.�"'?Bj�"'?9*-�4?�"( ! �"�"' : � =2'?B u � !#� /2}5ChBj��BF( +#��Bj��L!.�"'?Bj�"'?9*-�Ch%c�$��9*/5�:Bj��B�CE' 585AQ K

��� �!�HG I �.J�:� �� �0+ �

0.KMLON�P8QSRMLOT8U�VXWZY�U[RMQ\Q^L^]DL`_0L`acbdW\eML8]b1fLf_cKgLhN)P8QSRMLOT@Ujikikl BD0.KERmY.W\eon%P@ac_0WZp9RgQZP@a

q ��L,MON _ Y 'S" Y

Page 78: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

���� ����� ������������f��� ���������������� ���.� � ��� ����� � � G����� ��� �� !'���!'��� � '� ���(& ('N)��� +h)�(& "�' �� �

��� "!�.- � ��$���� ���Z,+��O$�J

�����������! #"�$&%'$)(*",+- WZYBP/nmP@a P@bdL`_0L`a._0T�_0KML Y nmL8p9W/. p`P8_cWST)e acL`nMa0L8Y L eD_0WSe10 _cKMLO_OLDnmLOT@U P@Q\Q�nmTkYcY W^1MQ\LOeMTE]DL8Y B23%'45%'�����6 �"�$&%7$8(*"0.KML�Y _ P8_cL�KmP�Y�_:9�TOY _ P@_0L�N)P@acW PA1MQ\L8YXT<;Ml8i>=@? P@em] ikikl 9[_cKMLBA ]DWSa0L8p9_cQ L/]DL n L em]MY<T�e*COacL`Q P@_0WST�eqP�acL`ngacL8Y L`eD_0L8]P�YOP Y L`_�T8UBnmP8WSa Y=: B!0.KDRmYb9ED3F7GU:IH ikikl W/JKD ]DW\acL8p9_0Q^L ]EL`nmL`em]MY�T�eLG6Bb0.KMLfY _ P@_0L�W\eDN)P8acWZP8eD_ YcPgLMY�_0KmP@_ikikl W YjP�a0L`QZP8_cW\T�e ]DLM.%eML8]oT)eK;gl@i>=N?B9BKMWZp K�p6T�eE_ P@W\emYjeMT p9WSa p9RMQZP8acW\_cWSL YXB o eMWS_0WZP@Q\Q^Ld_0KML/YOLMY _cL`b WZYBL`bdnM_OL9HKmP)Y!eMTfeMTE]DL Y=: BO@PNQRPNSUTWVYX[Z]\

;Ml8i>=@? T^-`> O�SMPikikl�T 9_-a`Y- :J> ObSMP

cedRfYgUh > TWVYX 9�;Ml8i>=@?iF8ikiklf: j9&k�DlF'G6T�-��Q9:DlF'Gf:<H ikikl�m DnH ;Ml8i>=@?�opG�H ;gl@i>=N?2:�o[qsr]? ;Ml tvuxw@ty? 9 ikiklf:

cedzc P gUh > TWV�X 9b;Ml8i>=@?6F8ikiklf: j ;Ml8i>=@?�{}|�~S d'�

���,"��z%'$)(�"K���6 �"�$x%'$8(*"�+0.KML U[T�Q\QST'9BWSe10 P@Rs�DW\QSWZP8a.L�U[Rgemp9_cW\T�emY^P@acL�R%Y L8] WSe�_cKgL�Y _ P@_0L�WSeEN�P8acW P@eE_dP8em]dc`T)a _cKML T�nmL`a P8_cW\T�emY�0�W\NkL`e1 L QST'9 B$8" %'�'41"�+ �6�)(*+R���]�H9:DlF'G1FM� : p KgL8p=<gY�9BKML`_0KML`ab9EDlF'Gf:.W YjWSe _cKML/_0a P@e%Y WS_0WSNkL p9Q\TkY RgacL/T@U P 1gWSemP8a.L acL`Q P@_0WST�e�(Bux; �_wNr6;!? tM�7l]?v�5wy= T�-a`Y-a` 9 9_-a`Y- :J> ObSMP :����ux; �_wNr6;!? tM�7l]?v�5wy=?9:DlF'G1FM� : j

�5� ?QTb-����� S d�� ?�����o� ?Q9N�A:�{�D�o � ?Q9 � S d�� ?2:�{�GBok h H�|6�zFR�R�v�RF � S d�� ?^�K�z~_�Q9 � ?Q9 h :�F � ?Q9 h�� ��:.: H��

¡ 41+ "�( �6$)�'�6+29:� : p KML8p <MYm_cKmP8_'_0KML�_ca P8emY W\_cW\NkL.p6QSTkY RMacL�T8U P 1gWSemP8a.L�a0L`QZP8_cWST)e�� p9T�eE_ P8WSemY�eMT�p9WSa p9RMQZP8acW\_cWSL YXBqsr]? ;Ml tvuxw@ty?eT 9_-a`Y- :J> ObSMP ���qsr]? ;Ml tvuxw@ty? 9:� : j k�DlT�-�¢z£nux; �¤w@r6;6? tM� l]?v�>w�=29ED3F¥D3F¥� :

�641",¦�$)¦,4>%7�d9ED3F7G§F¥� :�p KML8p <gY¨9BKgL`_cKML aB_cKMLOnmP8WSa 9:DlF'Gf:�WZYBPfp`P@e%]DWZ]MP8_cL�U[T�a�P)]M]DW\_cWST)e _0T��(Bt�r6;Mi6uZi6rz�E= T�-a`Y-a` 9_-a`Y-�: > O�SMP ���t�r6;Mi6uZi6rz�E=29EDlF'G1FM� : j Dª©{�G«o[£nux; �¤w@r6;!? tM�7l]?v�5wy=?9�G1FMDlFM� :

Page 79: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

��� ������������ ������������������� ��������������������������

� N)P@QSW ]MP@_0WST)e 1mL`QST'9K9BWSQ\Q Y KMT'9 _cKmP8_�t�r6;Mi6uZi6rz�E=29EDlF'G1FM� :<KMT)QZ]MY.W/J�P)]M]DW\e10 9ED3F7GU:�_0T�� 9.T)RMQZ]feMT�_Ba0L8Y RMQ\_WSe P/p9WSa p9RMQ P@acW\_OL�9 P�YcY RMbdW\e10�� WZYBP@Q\acL8P)]fL P)pXLMp6QSWZp�: B¡ 41+ ¦��>���5",¦��5"�%'+�9:DlFM� :�p KML8p <MY�9BKML`_cKgL`a�P@e8LD_0KMWSes0f]DWSa0L8p9_cQ Ld]EL`nmL`em]MY.T)e D RMem]EL`aW�eBqsr]? i>= � =¥;Mi>=¥;>�x?bTb-a` 9_-a`Y- :J> ObSMP ���qsr]? i>= � =¥;Mi>=¥;>�x?U9:DlFM� : j � G6T�- ¢Q9�G1FMDH:<H �

��� "!� � ����$��6[ +.-/$ � �� �0+���1

0.KML�U[T�QSQ\T'9BWSe10/T)n L a P@_0WST)emY�]DT/eMT)_�p KmP8e10�LO_cKgL Y _ P8_cL T8U<_0KML YSLgY _0L`b�BmR+��Y(�¦,�H9:DH:�p KML8p <MY�9BKML _cKML`aWD W YBP�egTE]DLOT@U�_0KML YSLgY _cL b�B�N?��Ol8i>=b9EDCTb- :2T@�S��'P � ;Ml8i>=@? T�-*> ObSMP�'ZzO@P �� 9:DnH ;Ml8i>=@?2:

mR+]2 ���,��(*�R%'�>�Q9EDd:�p KML8p <gY¨9BKgL`_cKML a�P@e8LD_0KMWSe10^]DL`nmL`e%]MY.T�e�DCBT = � =y;Mi>=0i�� � l6;#9EDlT�- :�2T@�S��'P � ;Ml8i>=@? T�-*> ObSMP

� ikikl T 9¤-a`Y- :J> ObSMP�� S D�H ;Ml8i>=@?�'ZzO@P �� qsr]? i>= � =¥;Mi>=¥;>�x?Q9EDlF8ikiklf:

� $)�'�>�z% 2����,��(*�R%'�5�]+?9�;C:�.me%]MY�P@QSQmeMTE]EL8Y�T)e�9BKMW p KY;d]EWSacL p9_cQ L ]EL`nmL`em]MY PD_cK%P@_�WZY PDP8QSQMW\_ Y�]DW\acL8p9_ Y RMnMnmT)ac_.>L`a Y BT uxw�=NtM� X � �6� l6w��:=ywb?!9�;aT�- :^DR?QTb-`> O�SMPS��'P � ;Ml8i>=@? T�-*> ObSMP

� ikikl T 9¤-a`Y- :J> ObSMP�� S ;�H ;Ml8i>=@?�'ZzO@P DR?�{}|zDlT�- % 9�;�FMDH:�H ikikl§~

� $)�'�>�z%7� �5���>"�¦��>"*%'+29�;C:�.mem]MY�P@Q\Q�eMTE]DL8Y 9BKMW p K ]EWSacL p9_cQ Ld]DL n L em]dT�e ;aBT uxw�=NtM� T = � =¥;Mi>=¥;5�&? 9�;aT�- : Dv?QT�-*> ObSMPS��'P � ;Ml8i>=@? T�-*> ObSMP

� ikikl T 9¤-a`Y- :J> ObSMP�� S ;�H ;Ml8i>=@?�'ZzO@P DR?�{}|zDlT�- % 9:DlF';C:�H ikikl§~

Page 80: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

���� ����� ������������f��� ���������������� ���.� � ��� ����� � � �

� �5���>"�¦�+�� "D9:DlF'Gf:�p KgL8p=<gY�9BKML`_0KML`aWD ]DL`nmL`e%]MY 9 ]DWSa0L8p9_0Q^L/T�a�WSe%]DWSa0L8p9_cQ Ld:�T)e G6BT = � =y;Mi]?�� ;�9:DlT�-�F'G6T�- :�2T@�S��'P � ;Ml8i>=@? T�-*> ObSMP

� ikikl T 9¤-a`Y- :J> ObSMP�� S D�H ;Ml8i>=@?�opG H ;Ml8i>=@?�'ZzO@P �� ux; �_wNr6;!? tM�7l]?v�5wy=?9:DlF'G1F8ikiklf:

��41",¦�$)¦,4>%7�§2 �,����(*�7%7�>�'+29b;q:�.me%]MYjP8QSQ p`P@em]EWZ]MP8_cL/Y RMnMnmT�a0_cL`a Y!T8UI;aB� r6;Mi6uZi6rz�E= X � �6� l6wy�E=¥w@? 9N;aT�- :�;Mi]? T�-`> O�SMPS��'P � ;Ml8i>=@? T�-*> ObSMP

� ikikl T 9¤-a`Y- :J> ObSMP�� S ;�H ;Ml8i>=@?�'ZzO@P ;Mi]?�{}|zD�H ;gl@i>=N? % t�r6;Mi6uZi6rz�E=?9�;�FMDlF8ikiklf:�~

��(�¦��>+ja0L`_cRgacemYB_cKML Y L`_BT@U P@Q\Q�eMTE]DL8YBWSe _cKgL YOLMY _cL`b B� l8i>=@? 9 :^DR?QTb-`> O�SMPS��'P � ;Ml8i>=@? T�-*> ObSMP�'ZzO@P DR?�{�;Ml8i>=@?

��� "!� " # � %$'&)( � � ��*����*,+.-/$����� �0+���1

0.KML�U[T�QSQ\T'9BWSe10/T)n L a P@_0WST)emYjb PgLfp KmP@e10)LO_cKML Y _ P@_0L T@U _cKgL YOLMY _cL`b B ��>$)"�$&%'$)41�)$ � �5�*3 2dWSegWS_cW P@Q\W��`L8Y<_0KML YSLgY _cL b�B�I=¥ux;1u �¤uxrz�/u��'= TWVYX 9S:S��'P ;gl@i>=N? T^-*> ObSMP

ikikl T 9¤-a`Y- : > O�S¥P�'ZzO@P ;Ml8i>=@?�{}|�~

��¦,¦ ��(�¦��H9:DH:�P�]M]gYjP/eMLR9 eMTE]DL _cTf_cKML YSLgY _0L`b�B� iki �Ol8i>=b9EDCTb- :S��'P ;gl@i>=N? T^-*> ObSMP�� S D�©H ;Ml8i>=@?

�'ZzO@P ;Ml8i>=@?�{ ��1�'�;Ml8i>=@?���|zD3~

Page 81: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

��� ������������ ������������������� ��������������������������

��f7 (��l���Y(�¦,�H9:DH:�acL`b^T@NkL Y�P egTE]DLhU[a0T�b,_0KML YSLgY _cL b�PDnMa0T8NDW ]DL8]�eMT)_cKMW\e10^]DL`nmL`em]MYBT�e W\_gB�I= g l��]= � l8i>=b9:DlT�-�:S��'P ;gl@i>=N? T^-*> ObSMP

ikikl T 9¤-a`Y- : > O�S¥P�� S D�H ;Ml8i>=@?�o[£ qsr]? i>= � =¥;gi>=¥;>�x?Q9:DlF8ikiklf:�'ZzO@P ;Ml8i>=@?�{ �

�1�'�;Ml8i>=@?^�K|zDl~Uo ikikl«{�|Q9bG1F �f:jT�-a`Y- % 9�G1F �8:�H ��ikikl«opGY©{ Dl~

��¦,¦����>���5",¦��5",�z�D9ED3F7GU: P�]g]MY�P�]DWSa0L8p9_ ]DL`nmL`em]EL`empXLOT@U�D T�e�G6P�nMacT8NEWZ]DL ]heMTOp6WSa p6RMQZP8acWS_OLW9�T�RMQ ] acL8Y RMQS_%B� iki T = � =¥;Mi>=¥;stRG 9EDlT�- F'G6T�-�:S��'P � ;Ml8i>=@? T�-*> ObSMP

ikikl T 9¤-a`Y- :J> ObSMP�� S D�H ;Ml8i>=@?�opG H ;Ml8i>=@?�opt�r6;Mi6uZi6rz�E=29EDlF'G1F8ikiklf:�'ZzO@P ikikl«{ �

�ikikl ��|Q9:DlF'Gf:b~0.KMLOnmP@W\aBb PgLdP)p9_cRmP8QSQ L 1mL P8QSa0L8P�]fL^nMacL8Y L`eE_gPDW\e�9BKMWZp K p`P�Y Lh_0KMLOT�nmL`a P@_cW\T�e WZYBP/eMT2>[T�naB ��f7 (��l�>���5� �5"�¦,�5",�z�h9:DlF'Gf:�acL`b^T@NkL Y _0KML ]DWSa0L8p9_ ]DL`nmL`em]DL empXLfT@U D T)e[G6B�I= g l��]= T = � =y;Mi>=¥;1tRG�9:DlT�-�F'G6T�- :S��'P ikikl T 9¤-a`Y- :J> ObSMP�� S 9:DlF'Gf:<H ikikl

�'ZzO@P ikikl«{ ��ikiklU�K|Q9:DlF'Gf:b~

��� "!�HG I �.J�:� �� �0+ ��1

�2B�t�r6;Mi6uZi6rz�E=29ED3F7G§F¥� :�KgT�QZ]gY!W/J P�]g]DWSe10 9:DlF'Gf:�_0T ��9.T�RgQZ]deMT�_�acL Y RMQ\_.WSe Pfp9WSa p9RMQ P@acW\_OLQB����� ��������������� ������

DCTb-#WIG Tb-#W �(T%9_-a`�-�: > O�SMPqsr]? ;Ml tRuxwNty?Q9E� :#opt�r6;Mi6uZi6rz�E=29ED3F7G§F¥� : � qsr]? ;Ml tRuxw@t�?Q9:� �|Q9ED3F7GU:b~2:

� B�ux; �_wNr6;!? t¥�7l]?v�>w�=OWZY._ca P@emY WS_0WSNkLQB����� ��������� �������� ����������� �

ux; �¤w@r6;6? tM� l]?v�>w�=29ED3F7G§F¥� :jWWux; �¤w@r6;!? tM�7l]?v�5wy=?9�G1F �sFM� :ux; �_wNr6;!? t¥�7l]?v�>w�=29EDlF �1F¥� :

�"!$# ��� ��&%�' �� )(*%�+-, .0/*/21�3/

���HG��54 �X$ 1 0* � �O$<(�01 0+ ��176 �c�h$��� � �m$08 ���m$26 $ � m1 1M-/$<(��9 (G�� �0+��

: egLhT8U<_0KMLW.ma Y _jngacT<;gQSL`b Y�PfY nmL8p9W/.mL`a�T@U[_cL e L`emp6T�RMeE_cL`a Y�W Y._cT^]DL8p9W ]DL�T�e _0KMLOWSeE_cL`em]EL8]�acT)QSLOT@U N)P@a0WST�R%YY nmL8p9W/. p`P@_0WST)e p6T�bdnmT�egL`eD_ Y>=@? eO_cKgLBADCFEjngacT<;gQSL`b P�;mT8NkL�G8_cKML�Y _ P8_cL`bdL eD_ T@Ug_cKML<ngacT<;gQSL`b ]ETkL8Y egT�_�b P�HkLWS_�p9QSL8P8aBLR�gP�p9_0QJI�9BKMW p K p9T�e%p9L`nM_ YjP8acL W\eD_0L`em]DL ]^U[T)a�WSb^nMQSL`bfL`ek_ P@_cW\T�e P8em]�9BKMW p K P@a0LfY W\bdnMQJI^P@Rs�DW\QSWZP8a5I�GWSeE_cacTE]ERmp9L8] U[T�aO_cKgL�nMRgacnmTkY L8Y T@U LR�DngQZP@e%P@_cW\T�e@=LK.KMWZYOKmP�YOQSL8P)] _cT P ]DW\NkL`a@0)L`emp9L WSe bdL8P@egWSe10-;mL`_E9�L`L`e

Page 82: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

������ �E����������`��� ��������c�M� � ���

_cKML _:9�T Y nmL8p6W�. p`P8_cW\T�emY�0)WSNkL`e P�; T8NkL�= K.KgL/Y nmL8p6W�. p`P8_cW\T�e�WSe EkL8p9_0WST)e � = � P@eE_cW p9WSn%P@_cL Y!_0KmP@_ �N?��Ol8i>=�9BWSQ\Q; L nMa0T8NDW ]DL8] P�Y/P";mP)Y WZpdT)n L a P@_0WST)e@=� BI p9T)eD_0a P)Y _�G�WSe _cKML Y nmL8p9W�. p`P@_0WST�e WSe7EkL p9_cW\T�e � = � G<_0KML Ycp KML`b P�@?�� l@i>= nMQZP�IgY!_0KML/acT)QSL/T8U�P@e P8R1�EWSQSW P@a$IongacL8]DW p`P@_0LB9BKMWZp K�p KML8pHgY 9BKML _cKML`a�D�� WZY�P egTE]DL�W\e�_cKML A&CFE =K.KML �@?�� l8i>=�Y0p KgL`b P�bdW 0)KD_*;mLORmY L ] G U[T)aBLR�MP8bdnMQ\L�G�_cTf]ELM.meMLOP b^T�acL�acT�;MRmY _BNkL`a Y WST�e^T@U _cKML�T)nmL`a P8_cWST)eU[T�a�P�]g]DWSe10^P/eMTE]DL�G19BKMW p K a0L`nmT�ac_ YjP8e L`a0acT)aBW4U _cKMLOeMTE]DLOW YBP@QSa0L8P�] IongacL8Y L`eD_��

2 Q�� +AS 0 T 585 � Q65 R��" s � S�� Q95 R o�� /�/&Q./Ax�� T 585 � Q65 R

� /�/&Q./R /�/&Q./ 6ETiN 0 / 3 P��R /�/&Q./ 6�"���� � B�!#"�g%$&!'"5B�(*) $&!'+,! �.-�/

.L`WSe10 P�;MQ\LB_cT�W\eD_0acTE]DRmp6L�Ycp KML`b P)Y 9BKMW p Kf]ET�eMT�_�eML p9L8YcY0P@a0WSQJI p9T)aca0L8Y nmT�e%]�_cTOp6T�bdnMRg_ P@_0WST)emP@Qmp6T�emY _cacR%p9_ Yp`P@e�0)acL8P8_cQ I/acL8]DR%p9LB_cKML Y W�� LBT@U P Y nmL8p9W�. p`P@_0WST�e GDP8em]10 nMacT8NEWZ]DL8]/_cKgL`WSa�nMRMa0nmTkY L�WZY�p9QSL P@acQ I/]DL¥.meML8]10 p`P@e_cKML`a0L�; I�0)acL8P8_cQJI^L`eMKmP8emp9LO_cKML p9T)bdnMa0L`KML`emY WJ;MW\QSW\_�I T8U�_cKML Y n L p9W�. p P@_cW\T�e@=K.KMLOp KMT�W p9LBT@U�T)n L a P@_0WST)emY._cT ; L�WSe%p9QSRm]EL8]�W\edPO_cT)n32HQ\L`NkL`QmY nmL8p9W�. p`P@_0WST�e^WZY�P�p9_0RmP@Q\QJIfP ]DL8Y W 0�e ]EL8p9WZY WST)e�T8UY T�a0_ Y�GMY W\emp9LBW\_<WZY<WSb^nMQSW\L8]j_cK%P@_._0KML8Y L�P@acL�_cKgLBT�nmL`a P8_cW\T�emY�9BKMWZp K/b�R%Y _0;mL�WSbdnMQ\L`bfL`ek_cL8] =4�K.KML�p KMT)WZp9LBT8UP@R1�EWSQ\WZP@a$I U[RMemp9_0WST)emY>GET�ed_0KML�T�_0KML`a�KmP@em] GDWZY�Y W\bdnMQJI PhbdTE]EL`QSQ\WSe10 ]DL8p6WZY W\T�e@G69BKMW p K^]DTkL8Y.egT�_.egL8p9L8Y0YcP@a0WSQ IWSbdnMQ I�P8e IE_cKMW\e10�P�;mT�RM_f_cKML 9BP�I�W\e 9BKMWZp K�_0KML Y�IMY _cL`b�9BWSQ\QB;mLdWSb^nMQSL`bfL`eE_cL8] =65jL`e%p9Ld_cKgL P@nMn%P@acL eD_]DRMnMQ\WZp`P8_cWST)emY/WSe�_cKgL87 A&C Y n L p9W�. p P@_cW\T�e@G 9BKML acL T)nmL`a P8_cWST)emY P@em]�P8R1�EWSQSW P@a$I U[Rgemp9_cW\T�emYfKmP`NkL�P@Q\bdTkY _WZ]DL`eE_cW p`P@Q)bdL8P8eMWSe10 Y ;MRM_�]EW�J L`acL eD_�a0T�QSL Y9��L�= 0 = �@? X � �6� l6wy�E=¥wBP@em]Bqsr]? i>= � =¥;Mi>=y;>�&?�: � r6;Mi6uZi6rz�:= X � �6� l6w��:=ywb?P@em]t�r6;gi6uZi6rz�:=�=�; K.KML ;mL8Y _ p KgT�WZp6LBT@U�T�nmL`a P@_0WST�e%Y U[T�a PhbdTE]ERMQSLBb P�I eMT�_ ; L p9T�bdL�P8nMnmP8acL`eE_.RMeE_cW\QMT�_0KML`anmP@a0_ Y�T8U _0KML�Y�IMY _cL`b P@acL�b^T�acLdU[RMQ\QJI[9�T�a$HkL8] T)RM_�=<5jT'9.L NkL`a�G�Y Rmp K>=kRML8Y _cW\T�emYfP@a0L ; L Y _fQSL9U[_f_cT _cKMLacL?=kRMWSa0L`bdL`eE_ Y�L`e10�W\eML`L`a =

���HG�� � @ ���$��>A �Bf$��m$ ��('$ 1DC/$K E $ $ � ���$� E +,1M-/$ ( �9 (K� 0+ ��1

K.KMLOT�_cKgL`ajb P@WSe^]DW/J L acL`emp6L8YB;mL`_E9.L`L`e^_cKMLO_E9.TfY n L p9W�. p P@_cW\T�emY�P@a0L �

�<= K.KML/Y nmL8p9W�. p`P@_0WST�e W\eFEkL8p6_cWST)e � = � RmY L8YjP8e LR�E_ca P�Y _ P8_cL N)P8acWZP�;MQSLfVXU[T�a�_cKMLOW\em]DWSa0L8p9_�]DL n L em]DL`emp�IacL`Q P@_0WST�e G!9BKgL`acL8P)Y<_cKML�Y nmL8p9W/. p`P8_cWST)e�W\e E L8p9_cW\T�e � = � RmY L8Y�P@e P8R1�DW\QSW P@a5IOU[RMemp9_0WST)e�9BKMW p K^p`P8QZp9RMQ P@_0L8Y_ca P@emY WS_cW\NkLOp9Q\TkY RgacL�=FjT�_0L P@QZY T _cK%P@_feMT�_ P@_cW\T�e U[T)a�_0a P@e%Y WS_0WSNkL p9Q\TkY RgacL WZYfY RMngnMQSW\L8] P)Y�nmP8ac_fT@U _cKgLHG b P@_0KML`b P8_cWZp P@Q_cTkT)QJHEWS_ ;MRM_Ba0L?=kRMWSa0L8YB]DLM.megWS_cW\T�edW\e�7 A&C =

� = ? e�_0KMLI7 A&C Y nmL8p9W/. p`P@_0WST)e@G�WS_�9BP)YheML8p6L8YcY0P@a5I�_0T p KMTkT Y L-;mL`_E9�L`L`e�acL nMacL8Y L`eE_cWSes0d_cKML^]DW\acL8p9_ ]DL�2nmL`em]DL`e%p>I a0L`QZP8_cWST)e P�Y PJ .TkT)QSL8P8e32[N�P8QSRML ] U[RMe%p9_cW\T�e�T�a P)Y P Y L`_�T@UBn%P@WSa Y>= � U[_0L`aOY T)bdL _0acW P@Q�P8em]L`aca0T�a GDWS_<9BP)YB]DL8p9W ]DL8]/_cKmP8_B_cKMLOQZP8_c_0L`a.Q\L8]�_0TfP/Y W\bdnMQSL a�Y nmL8p9W/. p`P8_cWST)e@=K BI^p9T�eE_ca P�Y _ G�G p`P@e^bdT8NkLY bdTkT)_cKMQ I-;mL`_E9.L`L edacL`Q P@_0WST�e%YBP@em] Y L`_ Y.T@U�nmP8WSa Y>GmY TfeMTfY Rmp K ]DL p9WZY WST�e eML L8]-; LOb P)]DL�=K.KMWZY Y KMT'9�Y<KMT'9�p KMT�W p9L.T8U�nMa0WSbdW\_cW\N�L8Y�p`P8e U[T�a p9L�POY nmL8p9W/. p`P@_0WST)eB9BacWS_0L`a�_cTOb P�HkL�]DL Y W 0)ed]EL8p9WZY WST)emYL8P@a0QSW\L`a._0KmP@e bdW 0)KD_�T�_0KML`aN9BWZY LOKmP`NkL ;mL`L`e ]DL8Y WSa0L8] =

� =ML'WSe%P@QSQ I�GBP)YobdL`eE_cW\T�eML ] W\e EkL8p9_0WST)e>N =ON =ON P�;mT8NkL�GM7 A&C WSemY WZY _ Y�_0KmP@_ nMa0L8p9T�e%]DWS_0WST�e%Y ;mL�eMT)_cL8]LR�EnMQSW p9WS_0QJI�=QP�T)bdnmP8acLO_cKMLO_E9.TfY nmL8p9W�. p`P@_0WST�e%Y.T@U � iki T = � =¥;Mi>=¥;stRG ;mL`QST'9R�

Page 83: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� N ������������ .���������������������������������������������

T 585 L�R=-#R PD5 R P 4 u$ L�R=-?M F P N u S: �@A u � T��8 : �@A u � <�Z[P?Q95 R"SP.Q65 RiS ' " P.Q65 RiS5@55Q ' " 5855Q ; 8 s : �@A u � x <

� iki T = � =¥;gi>=¥;1tRG84ED �b- F'G3��- ;S��'P � ;gl@i>=N? ��-�2 ObSMP

ikikl3��4¤-a`Y-H;,2 O�S¥P�� xS D�H ;Ml8i>=@?�opG�H ;Ml8i>=@?

opt�r6;Mi6uZi6rz�E=�4ED3F7G§F ikikl ;

�]Z O@P ikikl«{ ��ikikl ��| 4:DlF'G ;�~

? ed_cKML*G�Y n L p9W�. p P@_cW\T�e@GE_cKML�nMacL8p6T�em]DW\_cW\T�ed_0KmP@_�G � ;mL P/p P@em]DW ]MP@_0LOY RgnMnmT�ac_0L`a�T@U�D���W YB]DL8]DRmp6WJ;MQ\LU[acT)b�_cKgL.WSeEN)P@a0WZP@eE_�T�e V ' = .RM_ Y W\emp9L._0KML�p KmP@W\e T@U a0L8P�Y T�eMW\e10OWSeENkT�QSNkL ]jWZY'a0L`QZP8_cW\NkL`QJI�p9T�b^nMQSW p`P@_0L8] GWS_ 9�T�RMQ ] ;mLObdT)acL�KMT)eML8Y _j_0T�W\emp9QSR%]DL�LR�E_ca P/p9T�e� Rgemp9_ Y�D�� ©{ G � P@em]£ 4�G �OV�D��?;=

���HG�� " I �.J� A �� �0+ ��1

� Y!a0L`b P8a5HkL8] Y L NkL`a P8Q�_cWSb^L8YB;mL9U[T�a0L�G WS_^9.T)RMQZ]";mL NkL`a5I RmY L9U[RMQ�_cTdKmP`NkL Y T�b^L�9BP�I T@U�a0L8p9T�a ]DWSes0�LR�EnMQ P 2emP@_0WST�e%Y�P@em]� RmY _0W�. p P@_cW\T�emY�T@U�_0KML/]DL¥.meMWS_0WST)emY.RmY L ] WSe PdY nmL8p6W�. p`P8_cW\T�e@= LMT)ajLR�gP@b^nMQSL�GE_cKML p9T)aca0L8p9_cegL8YcYT@U�_cKgL�U[T�a0b P@Q�]DLM.%eMWS_0WST�e T@U � r6;Mi6uZi6rz�E= X � �6� l6wy�E=¥w@?�0�W\NkL`e WSe7EkL p9_cW\T�e � = � = � P�; T8NkL�9�T�RMQ ]�eMT)_3;mL WSb62bdL8]DW P@_cL QJI T�;DNEWST)RmY _cT bdT Y _ a0L8P�]EL`a Y�= K.KML nmP8WSa�4:DlF'; ; p`P8e Y0P U[L`Q I ;mL P�]M]DL ] _0T ikikl W7U�P@em] T�eMQ I W4UD ©{ ; P@em] ;�]DTkL YjeMT�_ ]DL`nmL`em] T)e[D =���L KmP`NkL W\emp9QSR%]DL8] P�U[T�a0b P@Q�Y _ P8_cL`bdL eD_BT8U._0KMWZYBnMa0T�nmL`ac_�I P�Y�PN�P8QSW ]MP@_0WST�e WSe EkL8p6_cWST)e � = � =ON^P�;mT8NkL�= FjT)_cLOKMT'9.L NkL`aB_cKmP8_jegL`WS_0KML`aB_cKgL 7 A&C Ek_ P@em]MP8a ]� O .acW�� ��� eMT�a�_cKMLGFEk_ P@em]gP@a ]� O F�� ��� p9RgacacL eD_0QJIfY RgnMnmT�ac_ Y Rmp K N�P8QSW ]MP@_0WST�e Y _ P@_0L`bdL`eE_ Y�=

�"!�� ��� /�(��� .0, (�����! )(2% +-,

K.KMWZYdY L8p9_0WST�e�Q\TkT<HgY-; L IkT�em] _0a P�]EWS_cW\T�emP8Q�bdTE]DL Q 2[T�acW\L`eE_cL8] _cL p KMegW =kRML8Y/_cT LR�EnMQST)acL KgT]9 Y Rmp K�P A&CFEbdTE]DRMQ\LdbdW 0)KD_ ;mL RmY L8] P)Y�nmP8ac_fT@U P�QZP8a@0)L`afY IgY _0L`b = K2IEnMW p`P@Q\QJI _cKMW Y�9.T�RgQZ] W\eDNkT)QSNkL�G�U[T�afLR�gP@bdnMQ\L�GWSemY _ P@eE_cW P@_0WSe10�_0KML nmP@a P@bdL`_0L`a Y T8U�_0KML Y nmL8p9W/. p`P8_cWST)e P@em] LR�D_0L`em]DW\e10�WS_B9BW\_cK KMW 0�KML`a 2HQ\L`NkL`Q�T�nmL`a P@_0WST�e%Y9BKMWZp K�P8acL b^T�acL acT�;MRmY _ P@em]#" T�a P@ngnMQSW p`P@_0WST�e 2 Y n L p9W�. p�= ? e EkL8p9_0WST�e%Y � =%$ = �'& � =%$ =ON ;mL`QST'9 9�L�p9T)emY W ]DL`a_cKMa0L`L Y Rmp K T�nmL`a P8_cW\T�emY'� T�eML U[T�a^P�]M]EWSe10 b�RgQS_cW\nMQSLf]EL`nmL`em]DL`e%p9WSL8Y/Y WSbfRMQS_ P@eML T�RmY QJI :<T�eML U[T�a^p KML p�HEWSe109BKML`_cKgL`a/P�]DL n L em]DL`emp�I p`P@e ;mL YcP`U[L`QJI P�]g]DL8] :�P@em] T�eMLdU[T�a acL`b^T@NEWSes0 P8QSQ�]DL`nmL`e%]DL`emp9W\L8YhT)e P�0�W\NkL`eeMTE]DL�=���L Y HkL _ p KoKgT]9 Y Rmp K T�nmL`a P@_cW\T�emY�p9T�RMQ ] ;mL/Y nmL8p9W�.%L8]oW\e87 A&C82�E)( P8em] AcW\bdnMQ\L`bdL6eD_0L8]1C 4 P'0kP@W\eWSe67 ADC82 E)(Q;�W\e _cL`a0b Y<T@U _cKML ;mP)Y WZp�T�nmL`a P8_cW\T�emY 0�W\NkL`edWSe EkL8p9_0WST�e � = � =*? eDU[T)acb P8QmnMacTkT8U Y!T8U�p9T)aca0L8p9_cegL8YcYT@U _cKML�W\bdnMQ\L`b�L6eE_ P@_0WST)emY<P]0 P@W\emY _B_0KML`WSa Y nmL8p9W/. p`P8_cWST)emY.P8acLW0)WSNkL`e =0K.KMLOacL P�Y T)eMWSes0/WSed_0KMWZY�Y L8p9_0WST)edWZY�eMT�_Y RMnMnmT)ac_cL ] ; I+*-,/.-021 =EkL8p9_0WST�e � =%$ = �W0�W\NkL8YBP@e WSeE_ca0TE]DRmp9_0WST)e _cTfP8Q 0)T�acW\_cKMb Y nmL8p9W/. p`P@_0WST)eoW\e�7 A&C82�E)(0=

���43!�54 5 J0*.+ � � 6 1M-/$<(��9 (G�� �0+�� �� I7698 &E#�:

7 A&C82�E)( WSemp6QSRm]DL Y ngacTEp9L8]ERMa P8Q nMa0Tz0�a P@bdb^WSe10.2HQ\WJHkLBp6T�emY _cacR%p9_ Y�9BKMWZp KdL`emP�;MQSL�T�nmL`a P@_0WST�e%Y._cT3;mLO]ELM.meML8]LR�DngQSWZp6WS_cQ I�W\e�_cL`a0b YBT@U P@Q 0�T�a0WS_0KMb Y; A�PR9��>� � =�<�eDU[T�a0_cRMemP8_cL`Q I�G*9.L`Q\Q 2 ]DTEp9RMbdL eD_0L8]dRmY L/T8UBY Rmp K U P�p9W\QSWS_0WSL8YWZYBY n%P@a Y L�GmP@e%] _0KML`a0LOY L`L b Y�_0T); LOQ\WS_c_0QSL^0�L`egL`a P8Q LR�EnmL`acW\L`emp9L^9BWS_0K U[T)acb P8Q a0L8P�Y T�eMW\e10fY RMngn T)ac_BU[T�aB_0KML8Y Lp9T�emY _ca0Rmp9_ Y�= 4=*/,-.-0)1 ]DTkL8YBeMT)_�Y RMnMnmT�a0_j_0KML8Y L p9T)emY _0acRmp6_ Y>= ;

Page 84: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

������ ���.� � ��� �������j�������� � $

K.KMLOnmP@a0_BT@U _cKMLOnMa0TEp9L8]DRMa P@Q�p9T)bdnmT�eML eD_�T@U 7 A&C82�E)(ª9BKgWZp K�9.L Y K%P@QSQ RmY L ;mL`Q\T]9 p`P8e ;mL ]DL8Y0p9acW ;mL8]�WSe� F#L� ��W\a ��� � P�Y.U[T�Q\QST'9�Y9�

����� � ��� 8������������������ <����������������� � ��� ����� �"!#!�$%�&� �('*)&+ �-,.�/�����

: 0 � '*)1+ �325476.89�����: 8:�����<;��&� < ���>= + ���&���@? 8 'A)&+ � <�B: ����� �$%�&�C��� '*)&+ �: D7DED

'*)&+ � � ��� = +�F �&���@? '*)1+ � B: '*)1+ �&) 'A)&+ �: D7DED

? e T)_cKML`a 9�T�a ]MY9�

G � �,�'(<H*�]4JI W YBP�Y L?=kRML`emp9L�T@U �`L`acT/T)ajb^T�acL�+M%'4>%'��I �>"*%'+<=G Ek_ P8_cL`b^L`eD_ Y�W\emp9QSR%]DL �

�<=LK U[T)a�2[QSTkT)nmYR  4 Y L`L ; L QST'9 ;� =�p9T)em]DWS_0WST)emP@Q Y� =BT�nmL`a P@_0WST�e p`P@Q\QZY�G19BWS_cK P)YcY W 0�eMb^L`eD_�T@U acL8Y RMQS_ Y._cTfnMacT 0�a P@b N)P@acW P�;MQ\L8YN =�P�Y0Y W 0�eMbdL eD_�T@U�N)P@Q\RML8Y._0T�nMa0Tz0)a P@b N)P@a0WZP�;MQSL8Y

G K.KML ��M����'�>+R+v$8(*"�+�9BKMWZp K p`P@e P@ngn L P@a/P)Y P8a@0�RgbdL`eE_ Yj_0T T�nmL`a P@_0WST�e p`P@Q\QZY>G p9T�em]EWS_cW\T�emYOT@U!p9T�em]EW 2_cW\T�emP8QZY>G�L`_ p<=mWSemp9Q\Rm]DLfP8QSQ<_0KML/T�a ]DWSemP8a5I 7 ADC Lv�DnMa0L8YcY WST)emYOY Rmp K P�YBD { G�o D�H X G'P)YW9.L`Q\Q<P)YT�nmL`a P@_cW\T�e p`P@Q\QZY�9BWS_0K acL8P)] 2HT)eMQJI P�p`p9L YcY._cTf_cKgL Y _ P8_cL�=

: _0KML`a<Q P@e10)RmP]0)LjU[L8P8_cRMa0L8Y'eMT)_�R%Y L8]/KML`a0LBWSemp9Q\Rm]DL�QSTEp`P8QMN)P@acW P�;MQ\L8Y>GkbfRMQS_0WSnMQ\L�P�Y0Y W 0�eMbdL eD_ Y>GkP8em]�a0L8p9RMa Y W\NkLT�nmL`a P8_cW\T�e�p P@QSQ Y>=K.KML Y WSb^nMQSL�WS_0L`a P8_cWSNkL p9T�emY _ca0Rmp9_LK \)Z �Q � � D�H X � Z � wclON�4ED�;$ MKmP)Y!_0KML�U[T�QSQ\T'9BWSe10/W\eDU[T�a0b P@Q Y L b P@eE_cW p`Y9�

G D WZY.a0LR0kP8a ]DL8] P)YjP/eMLR9 N)P@acW P�;MQ\L�G>9BKgTkY L Ycp9T)nmL WZY._0KMacT)R10�K � wclON�4:D�;

GpX WZY.L`N)P8QSRmP8_cL8]dT�e%p9L�G ;mL9U[T)acL WS_cL a P@_0WST)e ;mLR0)WSemY�=

G K.KML Y _ P@_cL bdL`eE_.WZY�9�L`QSQ 2 U[T)acbdL ]�T)eMQJIdW7U X L`N)P@Q\RmP@_0L8Y._cT^P .%eMWS_0LOY L`_ =G � wclON�4:D�;�WZY.nmL`a U[T�acb^L8]�T�e%p9L 4 P@e%]oT�egQJIdT)emp9L�;<U[T)aBL8P�p K N�P8QSRMLBD W\e X =

G FjTfP�Y0Y RMb^nM_cW\T�emYBp`P8e";mLOb P�]ELOP�;mT�Rg_�_cKMLOT)a ]DL`aBW\e�9BKMWZp K X WZY._0a P`NkL`a Y L8] =

���43!� � 5 ARA ���* 6 �OJ �0- J0$ AO$<-/$ � AO$ ��(�0$<1

P�¦,¦����>���5",¦��5",�6$)�>+.4�;�FMDR?�;�b P�HkL8Y!egTE]DL�; ]DW\acL8p9_0QJI ]DL`nmL`e%]DL`eE_�T�e L8P�p K�L`Q\L`bdL`eE_BT@U!PoY L`_�T8UBeMTE]DL YDR?�GMnMa0T8NDW ]DL8]d_cKMW YB]DTkL8YBeMT�_�WSeE_ca0TE]DRmp9L P�p9W\a p9RgQZP@a0WS_�I �

Page 85: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

�8� ������������ .���������������������������������������������

� iki T = � =¥;Mi>=¥;stRu8=@?�4b; ��-�FMDR?���-J2 O�SMP ;S��'P � ;Ml8i>=@?���-�2 ObSMP

ikikl � 4¤-a`Y-H; 2 ObSMP�� S ;�H ;Ml8i>=@?�o[DR?���;Ml8i>=@?�o[qsr]? ;Ml tRuxw@ty?�4 ikikl �| 4�;�FMD�; % D�H DR?i~�;�'ZzO@P ikikl«{ �

�ikikl ��| 4�;�FMD�; % DYH DR?i~

: egLhnmT YcY W ;MQSLOW\bdnMQSL bdL9eE_ P8_cW\T�efT@U _cKMW Y.T�nmL`a P8_cW\T�e W Y9�\)Z �Q � � D�H DR? � Z � iki T = � =¥;gi>=¥;1tRG34�;�FMD�;

� eOWSeDU[T)acb P8Q�nMa0TkT@U T@Um_0KMLBp6T�aca0L8p9_0eML8YcY T8Um_cKgWZY�WSbdnMQ\L`bfL9eE_ P8_cWST)ejb^W 0�KE_ ngacTEp9L`L ] ; IOp9T�e%Y WZ]EL`acW\e10B_cKML Y _ P@_cLT@U _cKML Y IgY _0L`b P U[_cL a'_0KML.Q\TkT�n);mTE] I/KmP)Y ;mL`L`e Lv�DL8p6RM_cL8]jU[T)a�Y R ;%Y L`_^GR?.T8U�DR? :�Q\L`_ gUh 2 TIV�X 4�;Ml8i>=@?iF8ikikl���� ;; LO_0KMLON�P8QSRMLOT8U�_cKML Y _ P@_0L P@_�_cKMW Y.n T)WSeE_�= � LOnMacT8NkL ; I^WSem]DR%p9_cW\T�edT)e G7?O_0KmP@_��

ikikl ��� { ��ikikl ��| 4�;�F'G ; % G�H GR?6~ ������ ���������������������� ���

� _O_cKgL ;mLR0)WSeMeMW\e10 T8U�_0KMLfQSTkT�n G^G7?�{"! P@e%]�_cKML Y _ P8_cLdK%P�Ydikikl�2x.mL`Q ] ��ikikl G<Y T�_cKML ;mP)Y L p`P�Y L�T8U�_cKML

WSem]DR%p9_cW\T�e KMT�Q ]MY>=FjT'9 Y RMnMnmT Y L�_0KML�WSe%]DRmp9_0WST�efK IDnmT�_0KML8Y WZY�KgT�QZ]gY.P@e%] _0KML�eMLR�E_�L QSL`bdL eD_�_cT ; L�nMacTEp9L YcY L ]�WZY D = � L�b�RmY _.ma Y _�Y KMT'9X_0KmP@_ � iki T = � =y;Mi>=¥;1tRG34b; FMD�;BW Y.L`emP�;MQSL8] �<W�= L =

;�H ;Ml8i>=@?�o[D�H ;Ml8i>=@?�opt�r6;Mi6uZi6rz�E=�4b; FMDlF8ikikl �#� ; ��$%��&(')+*������������� ��

K.KMLdU P�p9_f_cKmP8_;}H ;Ml8i>=@? U[T�QSQ\T'9�YhU[acT�b _0KML nMacL8p6T�em]DW\_cW\T�e T@U � iki T = � =¥;Mi>=y;1tRu8=@?�4�;�FMDR?�; = EkWSbdW\QZP8acQJI GU[acT�b _cKMLfnMa0L8p9T�e%]DWS_0WST�e9�LB0�L`_BDR?,� ;Ml8i>=@?�G�P8em] U[a0T�b _cKMLfQSTkT)n 0)RmP@a ] D[HKDR? G _0KDR%Y D�H�;Ml8i>=@?�=)? _acL`b P8WSemY�_cT Y KMT'9�_0KmP@_It�r6;Mi6uZi6rz�E=�4b; F¥D3F ikikl���� ;�KMT�Q ]MY>=KLMacT)b _cKMLBN)P8QSWZ]gP@_cW\T�efWSe EkL8p9_0WST)e � = � = N GkWS_ Y R.- p9L8Y_cT/nMa0T@NkL�_cKmP8_ ikikl���� �Y| 4�;�FMD�;�~OKmP�YBeMTfp9W\a p9RMQ P@a0WS_cW\L8Y>=�K�T�L Y _ P�;MQSW Y Kd_0KMWZY�G>.ma Y _BeMT�_0LO_cKmP8_�P@e I Y R ;%Y L`_BT8UP�Y L`_BT@U ]DL`nmL`em]EL`emp9W\L8Y�9BWS_0KoegTfp9WSa p9RMQZP8acW\_cWSL Y 9BWSQ\Q�P8QZY T/K%P NkLOeMT^p9W\a p9RMQ P@a0WS_cW\L8Y9�/���I I 4Uk r]?6F�y?���4_- `Y-H; 2 ObSMP ¢zqsr]? ;Ml tRuxwNty? 4 y?�;�opr]?�� y? m qsr]? ;Ml tvuxw@ty?�4�r]?�;

L%a0T�b _cKgL/QSL`bdb^P GE_cKML/ngacL8p9T)em]DW\_cWST)e _0KmP@_�qsr]? ;Ml tRuxw@t�? 4 � �ikikl ��| 4b; F¥D�; % D�H Dv?6~�;�P8em] _0KMLhU P)p9_�_0KmP@_G7?0� Dv?�G W\_!U[T)QSQST'9�YB_cKmP8_�qsr]? ;Ml tvuxw@ty?�4 ikikl���� ��| 4�;�FMD�;�~�; G P)YjacL?=kRMW\acL8] = K.KERmY � iki T = � =¥;Mi>=¥;stRG34�;�FMD�;WZY.L`emP�;MQSL ] = � YBP/acL8Y RMQS_�T@U�_0KMLOT�nmL`a P8_cW\T�e@GM_0KMLOnmP@W\a�4b; FMD�;�0)L`_ Y�P�]M]EL8]d_cTf_cKML^ikikl�2&.%L`QZ] =*K.KERmY

58521 �#��3547698 " 58521 ��� ; 8�:�; A :=< <" > A58521 ; 82:?; AA@ < : @D�B@AC < ; 82:?; A :=< <" > A58521 ; 82:?; AA@ < : @D�B@AC ; 8 :�<.<

P�Yha0L?=kRMWSa0L8] =-K.KgL�W\em]DRmp9_0WST)e K IEnmT�_0KML8Y W Y�_cKERmYhKMT)QZ]MY�U[T�aOL8P)p K WSeE_cL`a0bdL8]DW P@_0L/Y R ;mY L`_nG7? 0�L eML`a P8_cL8]�WSe_cKML�U[T�a 2HQ\TkT�n@GmWSe%]DL`nmL`em]DL eD_�T@U�_0KMLOT�a ]EL`aBT@U�Y L`QSL p9_cW\T�edT8U�L`QSL bdL`ek_ Y'U[a0T�b DR? =L'WSemP8QSQ I�G]9BKgL`e/_cKML acL�P@a0LBeMTOL`QSL bdL`eE_ Y QSL6U[_'_0T ;mLBnMa0TEp9L8Y0Y L8]�4HW�= L�=<G7?I{�DR?�; Gk_cKML�.me%P@QmY _ P@_0LjK%P�Y�ikikl�2&.mL QZ]

58521 " > A585�1 ; 8�:�; AA@ < : @D� : C <P�YBacL?=kRMWSa0L8] = � LOKmP`NkL Y KMT'9Be _0KmP@_ G P)YcY RgbdWSe10/_0KMLOT�nmL`a P@_cW\T�e�  Y!ngacL8p9T)em]DW\_cWST)e KMT�Q ]MY>Gm_cKMLOW\bdnMQSL b�L`ek_ P 2_cWST)e YcP@_0WZY_.mL8YB_cKMLOT�nmL`a P@_0WST�ee  YBn T Y _ p9T�em]EWS_cW\T�e@=ED

Page 86: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

������ ���.� � ��� �������j�������� ���

���43!� " � ��$ (�� ���* E ��$G ���$�� � AO$<-/$ �#AO$ ��(�� (K�;� C/$��KARAh$ A

� r6; � iki 4ED3F7G ;�p KML8pHMYB_cT Y L`LB9BKgL`_cKML ah_0KML^P�]M]DW\_cW\T�e T@UB_0KML^]DL`nmL`em]DL emp>I 4EDlF'G ;�9�T�RMQ ]ª0)WSNkL/a0WZY L/_0T�Pp9WSa p9RMQZP8acW\_ I �� r6; � ikiH4ED ��- F'G3��- ; ��N�S��'P � ;Ml8i>=@?���-�2 ObSMP

� ikikl � 4¤-a`Y-H; 2 ObSMP�� S D�H ;Ml8i>=@?�opG H ;Ml8i>=@?�'ZzO@P �� t�r6;Mi6uZi6rz�E=�4EDlF'G1F8ikikl ;

: egLhnmT YcY W ;MQSLOW\bdnMQSL bdL9eE_ P8_cW\T�efT@U _cKMW Y.T�nmL`a P8_cW\T�e W Y9�

��� "�� : : " @��� - ; 5 C ?+;�: @�A :=< <4 � Q\_cL`a0emP@_0WSNkL`Q I�Gz9.L p9T)RMQZ]dRmY L ��M{�G�H � r6;gi6uZi6rz�:= X � �6� l6w��:=¥w@? 4ED�;=�;� ngacTkT@U T@U�_0KML p9T�a0acL8p9_0eML8Y0Y.T@U _cKMW Y.WSbdnMQ\L`bfL`eD_ P@_0WST�e/R%Y L8YB_cKML�U P)p9_B_cKmP8_

4 F ; 5 3 5 F 0 : : A @�A 58521 <�� � : : " @� 3 ; 0 / F ; C 4 R 1 C + / : @�A : A 5@521 <7<P@em] _cKML�U P�p6_B_cKmP8_

�� - ; 5 C ?+;�: @�A :=<�� 3 ; 0 / F ; C 4 R 1 C + / : @�A : A 58521 <9BKMWZp KhU[T)QSQST'9�Y U[a0T�b _cKML�n T Y _ p9T�em]EWS_cW\T�e/U[T�a T = � =¥;Mi]?�� ;@=*K.KML�p9T)em]DWS_0WST)e U[T�a T = � =y;Mi]?�� ;�_0T&;mLBL`emP�;MQSL8]WZY�D�H ;gl@i>=N?Uo G�H ;Ml8i>=@? G19BKMWZp KdU[T�QSQ\T'9�Y�U[acT�b _cKMLOnMa0L8p9T�e%]DWS_0WST�e T8U � r6; � iki 4:DlF'G ;=

���43!�HG � $26 +�� ���* �.J J AO$<-/$ � AO$ ��(�� + � + ���$�� ��+MAO$<1

�W= g l��]= � � � T = � =y;Mi>=¥;1tRu8=N? 4�; ;ja0L`bdT8NkL8Y�P@Q\Q�]DL n L em]DL`emp�IdT@U ; T�e T�_0KML`a�eMTE]DL8Y'�

�I= g l��]= � � � T = � =¥;Mi>=y;1tRu8=�? 4�; ��-H;S��'P � ;Ml8i>=@?���-�2 ObSMP

ikikl � 4¤-a`Y-H; 2 ObSMP�� S ;�H ;Ml8i>=@?

�'ZzO@P ikikl«{�| 4�;�F'G ;�H ��ikikl % D�©{};�~

K.KMWZY�T�nmL`a P@_0WST�e p9T�RMQ ]";mL�RmY L8] G�U[T�aOLR�gP@bdnMQ\L�G P�Y�nmP@a0_OT@U�PdQZP8a@0�L ahL ]DWS_0WSe10dT)nmL`a P8_cWST)e[9BKMW p K p KmP@es0�L8Y_cKML WSeE_cL`a0emP@Q Y _0acRmp9_0RMacL T@U�_0KML/T<;-� L p9_�p6T�aca0L8Y nmT)em]DWSes0d_cTdegTE]DLY; WSe�_cKgL LR�E_cL`a0emP@Q�]gP@_ P�;mP�Y L�= K.KML�.ma Y _Y _cL n�W\efY Rmp KfP@edT)nmL`a P8_cWST)e�b^W 0�KE_�; L�_cTOa0L`bdT8NkL�P@QSQ%]DL`nmL`em]DL emp>I T8U<;�T)e�T)_cKML`a�eMTE]EL8Y>=*? _ Y�]DL n L em]DL`emp�IT�edT)_cKML`a�T<;-� L8p6_ Y 9�T�RMQ ] ;mL�acL�2HL8Y _ P�;MQSW Y KML8] 9BKML`ed_0KMLjL ]DWS_�WZY,.meMW Y KML8]^P@em]d_cKgLjT�;-� L8p9_.W Y�a0L�2 p6T�bdbdW7_0_cL8]_cTf_cKMLOLR�E_cL`a0emP@Q ]MP@_ P�;mP)Y L�=: egLhnmT YcY W ;MQSLOW\bdnMQSL bdL9eE_ P8_cW\T�efT@U _cKMW Y.T�nmL`a P8_cW\T�e W Y9�

� ��� �"! ! : ��� 3 / 4 0�� +2-.- 15/�0 / C :?; < ,.�/2 = 18> ��� - ; 5 ;�4 @ :�; A :.<

� e WSeDU[T)acb P8Q nMa0TkT@U�T8U�_cKML p9T)aca0L8p9_cegL8YcY�T@U�_0KMWZY.W\bdnMQSL b�L`eE_ P8_cW7T�e/U[T�Q\QST'9�Y9�

Page 87: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

�8� ������������ .���������������������������������������������

L'WSa Y _�G�QSL`_�DR? Y _ P@e%] U[T�a T uxw�=NtM� X � �6� l6w��:=ywb?�4�; ;=<LMacT�b _0KML Y nmL8p9W/. p`P8_cWST)e T8U T uxwy=NtM� X � �6� l6w��E=¥wb?�4�; ;G.W\_U[T�QSQ\T'9�Yh_cK%P@_�DpH DR? W7U�P8em] T�eMQ I�W7UR4�;�FMD�; H �

�ikikl = � L^p9QZP8WSb _cK%P@_fP U[_0L`a/Y R ;mY L`_�GR?dT@U�DR?^KmP�Y3;mL`L`enMacTEp9L YcY L ] GM_cKML A&CFEfW Y!W\e P�Y _ P8_cL gUh 2 TWVYX 4�;Ml8i>=@?iF8ikikl���� ;G59BKML`a0L

ikikl�����{ ��ikiklU�p| 4�;�F'G ; % G H G7?i~ ������ ���������������������� ���

K.KML nMa0TkT@UOU[T�Q\QST'9�Y ; I WSe%]DRmp9_0WST�e T�e�GR?�P)Y ;mL9U[T)acL�=���KML`e�GR?[{ ! G._cKML p9QZP8WSb W Y�T�;DNEWST)RmY Q I _cacRgL�=FjT'9 Y RgnMnmTkY L Y R ;mY L`_�G7? T@U DR? K%P�Y-;mL`L`e nMacTEp9L YcY L ]XP@em]�D WZY�_0KML AceMLR�E_�C L`Q\L`bdL`eE_/WSe}DR? = K.KML`eD�©H GR? P@em]>4�;�FMD�;�H ikikl���� G.Y T �I= g l��]= T = � =¥;Mi>=¥;1tvG 4b; F¥D�; WZY L`emP�;MQSL ] = LMacT)b _cKgL Y nmL8p9W�. p`P@_0WST�e T8U�W= g l��]= T = � =¥;Mi>=¥;stRG34�;�FMD�;G _0KML^ikikl�2x.mL`Q ] ;mL8p9T)bdL8Y

58521 �#� A 82:�; A :.< < " 58521 ���#3 47698P�YBacL?=kRMWSa0L8] = L'WSemP8QSQ I�G69BKML`e _0KMLOQSTkT)n WZY.Lv�DW\_cL8]84bG7?W{�DR?�; GM_cKML`e

58521 6�� " > A58521 A 82:�; A @ < : @ � : C <" 82: : AA@ < :�: : A @ < � > A58521��B:JI" ; <

P�YBacL?=kRMWSa0L8] = D

�"!�� ��� ��&%�' �� )(*%�+-, ,�� ���� %>' �� )(2% +-, %�/*/21�3/

��� �!�54 5 J0*.+ � � 6 1M-/$<(��9 (G�� �0+�� � �#A �B$����9 (K� 0+ �

� Q 0)T�acW\_cKMb Y<P@a0LOP@edL YcY L eD_0WZP@QmnmP8ac_�T@U�_cKgL�]DL Y W 0)edT@U Y T@U[_E9BP8acL�Y IgY _0L`b Y>GEY T/PU0)L`eML`a P@QmnMRMa0nmTkY L Y n L p9W�. p P 2_cWST)e�Q P@e10)RmP]0)LOY KgT�RMQ ]�KmP`NkL�Y T�bdL 9 P I T@U ]DLM.meMW\e10O_cKML b =�K.KMLjngacTEp9L8]ERMa P8Q n%P@ac_�T8U 7 A&C82�E)(�]DL Ycp9a0WJ;mL8]WSe EkL8p9_0WST)e � =%$ = � P�;mT8NkLoW Y/P@e P@_c_0L`bdnM_ _cT ]DT _cKMW Y>G*;MRM_/_cKgL`acL P@a0L�P)Y IkL`_ b P@e I RMeMacL Y T�Q\NkL8]�W YcY RgL8Y>GeMT�_ _cKMLfQSL8P)Y _ ; L WSe10 _cKgL P�;mY L`emp9LfT@U�P Y RMW\_ P�;MQSLfnMacTkT8U�_0KML`T)a5I 4 Y L`L ; L QST'9 ;= K.KML G Ycp KML`b Pdp`P@Q p9RMQ\RmYp`P@e bdT�a0L�2HT)a�2[QSL8Y0Y.KmP@e%]DQSL Y W\bdnMQ\L�Y L?= RgL`emp9W\e10/NDW P�Y0p KgL`b POp9T�b^n T Y W\_cWST)e@G ;MRM_�KmP)Y!eMT^p9T)emY _0acRmp9_ Yjp6T�aca0L�2Y nmT�em]EWSe10 _cTdU[T)a�2[QSTkT�n%Y>G�L`_ p�= : e _cKgL nmTkY WS_cW\NkLfY W ]DL�GmKMT'9.L`NkL`a G _0KML��BLM.meML`b^L`eD_MP�P@Q p9RMQSR%Y C T)a � �� KmP)Y]DL`NkL`Q\T�nmL8] P Y T)nMKMWZY _cW p`P@_0L8] eMT�_ P@_cW\T�e U[T�afP@Q 0�T)acWS_0KMb Y n L p9W�. p P@_cW\T�e@G�_cT 0�L`_0KML`aB9BW\_cK P a0WZp K _cKgL`T�a$I�U[T�aacL8P)Y T�egWSe10^P�;mT�Rg_OP@Q 0�T�a0WS_0KMb Y 9Ba0WS_0_cL`e WSe nMa0TEp9L8]DRga P@Q�ngacTz0)a P8bdbdWSes0 QZP8e10�R%P]0�L Y>=�!L`_0RMacegWSe10B_0T�PB]DW Ycp9R%YcY W\T�e T@U 7 A&C82�E)(0G�PBY L`nmP8a P@_0L.nMa0TkT@Um_0KML`T)a5IOKmP�Y@;mL`L`e ]DL`NkL QST�nmL8]BU[T�a Y KMT'9BWSes0j_0KmP@_P nMacTEp9L ]DRMa P8Q nMa0Tz0)a P@b YcP@_0WZY_.mL8YBP nMa0L"`nmTkY _�Y nmL8p9W/. p`P8_cWST)e@G ;%P�Y L ] T)e P 5jT P@acL�2HQ\WJHkL�QSTz0)WZp�� Y L`L ���T�e � � P � =K.KMWZY'n%P@ac_ T@U�_0KML.ngacTkT@U _cKML T�a5I KmP�Y<eMT)_0IkL`_�;mL`L`efY b^TkT�_cKgQJI W\eD_0LR0�a P@_0L8]U9BW\_cK/_cKgL.acL Y _�� Y L`L EkL8p9_0WST)e � = � =%$T@U ���� (@C �>� � U[T)a�P�]EWZYcp6RmYcY WST�e T8U�Y T)bdL�T@U _cKMLOKERMa ]DQ\L8Y�_0T ;mLOT8NkL`a p6T�bdL�=� Y�P@e�Lv�MP8bdnMQSL�T@U Y T)bdL T8U._0KML/WSeE_ca0WZp`P)p9WSL Y.WSeENkT�QSNkL ] GMp9T)emY W ]DL`aOP/U[T�a�2[QSTkT)n K \)Z �Q � � DH X � Z � wclON�4:D�;$  =EkWSemp6L eMT P�Y0Y RMb^nM_cW\T�emYdp P@e ; L�b P�]DL P�;mT�RM_ _cKML�T)a ]DL adWSeK9BKMW p K X WZYf_ca P`NkL`a Y L8] G!T)eMQJI nMacT)nmL`ac_0WSL8Y9BKMWZp K KMT)QZ]oU[T)a�P8QSQ<nmTkY0Y W ;MQSL L`N)P@QSR%P@_cW\T�e�T)a ]DL`a0WSe10 Y�4HW�= L�=�P8QSQ�n T YcY WJ;MQ\L/_ca P`NkL`a YcP8QZYBT@U�_cKML Y L`_';�Y KgT�RMQ ]"; L]DL8]DRmp6WJ;MQ\L�=

��� �!� � # ��1�m$*6 �� �m$ * ������0+��

EkT�bdL/T8U�_cKMLfWZY0Y RML Yh_cK%P@_/P8acW Y LfWSe _cKMLdW\eD_0LR0�a P@_0WST�e T@U�P bdTE]DRMQ\L/WSeE_cT PoQ P@aN0�L`a Y IgY _cL b P@acL^]DW Ycp9RmY0Y L8]WSe EkL8p9_0WST�e � =%$ P�;mT8NkL�G ;gRM_/p9Q\L8P@a0QJI9�L�KmP`NkLfT�eMQ I � R%Y _3;mLR0)RMe _0T Ycp9a P@_ p K _cKML Y RMa U P)p9L�= EkT�b^L/T@U�T�RManMacL`Q\WSbdW\emP@a$I/p9T)emp9Q\RmY W\T�emY�P@a0L P)Y U[T)QSQ\T]9�Y'�

Page 88: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

��S .� �E����������`��� ������X����������������`���������� �c�M� � � �

�<=&EkT�b^L&HDW\em]dT@U�n%P@a P8bdL`_0L`aBWSemY _ P8eD_0WZP@_0WST)eob^L8p K%P@eMW Y b 9BWSQSQ ;mL eML`L ]DL8] = K.KML`a0LU9BW\QSQ@;mLOnMacTkT8U�T<;MQ\W 20kP8_cWST)emY�_0T Y KMT'9 _0KmP@_^_cKML WSemY _ P@eE_cW P@_0WSe10�N)P@Q\RML8YdP8em] _�IEnmL8Y�Y0P@_0WZY U I P8e I p9T)emY _0a P@W\eD_ Y�_cK%P@_^P@acLP�Y0Y RMbdL ] WSe _cKMLfbdTE]DRMQ\LfY nmL8p9W/. p`P8_cWST)e 4[L�= 0 = _cK%P@_ _0KMLfT�a ]EL`acW\e10 acL`Q P@_cW\T�e Y RMngnMQSW\L8] _cT PoY T�a0_cWSes0bdTE]DRMQ\L�WZY._0a P8emY W\_cWSNkL GDL`_ p<=�; =

� = K.KMLOQZP8a@0�L a�Y�IMY _cL`b 9BW\QSQ _ IEnMW p`P@Q\QJIfeML`L8]d_cTfLR�E_cL`e%] _0KML ;mP�Y WZpOT�nmL`a P8_cW\T�emYBnMacT8NEWZ]DL ] ; Id_0KMLObdTE] 2RMQSLY9BWS_0K bdT)acL P@nMngQSWZp P@_cW\T�e32 Y nmL8p6W�. p T�eML8Y�= EkT)bdL T@U _cKgL8Y L b P�I p9T�a0acL8Y nmT�em] _0T�AcKMW 0�KML a�2[QSL`NkL`QT�nmL`a P@_cW\T�emYNC 9BKMW p K p`P@e ;mLfY nmL8p9W/.mL8] T)e�_cKMLfY0P@bdLf]MP8_ PdbdTE]DL Q<P)Y _0KML/bdTE]DRgQSL/P8em] KML`e%p9Lfp`P@eQSLR0)WS_0WSb P8_cL`Q I";mL p9T�emY WZ]DL acL8]�Lv�D_0L`emY W\T�emY T8U�_0KML bdTE]DRMQ\L�= 4�K.KMacL LdLR�gP@bdnMQ\L8YOP@a0L 0)WSNkL`e P�; T8NkL�= ;: _cKML`a Y�9BWSQ\Q�p`P8QSQ�T�nmL`a P@_0WST�e%Y U[a0T�b,_0KMLObdTE]DRMQ\L�=

� = K T RmY L�_0KMLfbdTE]DRMQ\LfP�YOP A0_cacR%Y _cL ] HkL`a0eML`Q C G _0KML�Q P@aN0�L`a Y IgY _0L`b bfRmY _&;mLd]DL Y W 0)eML8]�Y T _cK%P@_O_cKML_ca0RmY _0L8] U[RMe%p9_cW\T�emP8QSWS_�IdW Y�p9T)e>.meML8] _cTd_0KML b^TE]DRMQSL = : _0KML`a�bdTE]DRMQ\L8Y!bfRmY _�p`P@Q\Q ;mP)Y W phT�nmL`a P@_0WST�e%YU[acT)b _cKML)HkL`a0eML`Q<b^TE]DRMQSL = EkL p9_cW\T�emY � = $ = �'&E� =%$ =ON W\QSQ\RmY _0a P@_0LfY T)bdL T8U�_cKML/nMa0TkT@U�T�;MQSW 0kP@_0WST)emYh_0KmP@_bdW 0)KD_*;mL W\eDNkT)QSNkL8]/WSe NkL`a0W4U IEWSe10 Y Rmp K Pf]DL8Y W 0�e =

Page 89: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� � ��� ����

� � �� � ��� � ����� � ���

K.KMWZY<p P�Y L�Y _cRm] I/P�]g]DacL8Y0Y L8Y<Q P@e10)RmP]0)LjnMa0TEp9L8Y0Y WSes0ha0L?=kRMWSa0L`bdL`ek_ Y Y R%p KfP)Y _0KMLBacL nMacL8Y L`eE_ P@_0WST)e T@U P�;mY _0a P�p6_Y IEeD_ P]� P8em]o_0KML ]DLM.meMW\_cW\T�e T@U Y IEeD_ P]� 2Ha0L`QZP8_cL8]�U[RMe%p9_cW\T�emY�=

� !�� � �� 1F% �< � 3, (2/

K.KML/nMacT�;MQSL b p9T)emp9L`a0emYOPn0)a P8bdb P@aBU[T�a�_cKML^P�;mY _ca P�p9_ Y IEeE_ P]� T@U!PoY WSbdngQSLOQZP8e10�RmP'0�L�=-���EnMacL8Y0Y W\T�emY�WSe_cKMLOQZP8e10�R%P]0�L _ P�HkLhT)eMLOT@U�_0KML�U[T�Q\QST'9BWSe10 U[T)acb Y'�

�<=�P�N)P8acWZP�;MQSL Y IEb ;mT�Q

� =�P�p6T�emY _ P@eE_�P@ngnMQSW\L8]d_cT^P/Y L?=kRML`emp6L�T@U�P8a@0)RMbdL`eE_ YM4H_cKgL`b Y L QSNkL8Y<LR�EnMacL YcY W\T�emY ;GET�a� =�P =kRmP8eD_0W�.mL8]�LR�DngacL8Y0Y WST)eOb P�]DL�RMnOT8U P =kRmP8eD_0W�.mL`a G8P!N)P8acWZP�;MQSL G8P@em]O_cKML*;mTE] I T8UM_0KML = R%P@eE_cW�. p`P@_0WST�e

4HW\_ Y L Q4U P@e Lv�DnMa0L8YcY WST)e ;= K.KgL N)P@a0WZP�;gQSL W YjY0P@W ]o_cT ;mL���(*�,"�¦ ; I _0KML =kRmP@eE_cW/.mL`a 9BW\_cKMW\eo_0KML3;mTE] IT@U _cKML*=kRmP@eE_cW/. p`P8_cWST)e@=

? e �K F L� ��WSa ��� � _0KMWZY�9�T�RMQ ]-; L LR�EnMacL8Y0Y L8]^P�Y.U[T�QSQ\T'9�Y9�'*)&+ � ����� ���&� � $%�&�!� �#"!$:�

% &�' �)( �*� �1�)+ � +�+ $,�-( ���*� �1�% ./' �1���*�10�� �324+ � )1+ �J����� ���&�65

&�' �)( �*� �1�)+ � +�+ $,�-( ���7���1� � 8��1�)� ���&� �:9 'A)&+ � ��� � ���1�*;<5.=' �&���*�>0?� �32)+5� )&+ � ��� ��� �1� � ./' �1���*�10�� ��� $%�&�!���6"!$"� 'A)&+ � ��� ��� �1�@59BKML`acL 9 'A)&+ � ��� � ���1�*; bdL8P8emYBP/Y L�= RML emp9L�T8U �`L`a0T/T�a�bdT�a0L�LR�EnMacL8Y0Y W\T�emY�=K.KML�0)a P8bdb P@a KmP�Y�P A Y L`b P8eD_0WZpBp9T)emY _0a P@W\eD_bCh_0KmP@_�L8P)p K^p9T�e%Y _ P8eD_�KmP�Y�P�.*�EL8] 41�'$&%�� 4HW�= L�= G�_ P�HkL8Y�PI.§�DL8]eDRMb ;mL`a�T8U�P@a@0)RMbdL`eE_ Y ;W9BKMW p K WZY ]DL8p9Q P@a0L8] W\e P)]DN)P@emp6L�= � p9T)emY _ P@eE_/Y KMT�RMQ ] T�eMQ IF;mL P8nMnMQSW\L8]�_cT P@eP@a@0)RMbdL`eE_BY L?=kRML`emp9L�T@U�_0KML p9T�a0acL8p9_�QSL`es0�_cK =� e LR�EnMa0L8YcY WST�eY9BWSQ\Q@; LfY0P@W ]o_cTL; LA��$)",41�R� W4U�W\_jW Y!b P�]DLORMn�T8U.N)P8acWZP�;MQSL YjP8em]";MWSe%P@a5IdU[RMe%p9_cW\T�e�P8nMnMQ\W 2p`P@_0WST�e%Y!T)eMQJI�= 4�K.KERmYBWSe nmP@a0_cW p9RMQZP8a�GgP ;MW\emP@a$IdLR�EnMacL YcY W\T�e p9T)eD_ P@WSe%Y.eMT6=kRmP8eD_0W�.mL`a Y>= ;� e TEp`p9RMa0acL`emp6L�T@U�N)P8acWZP�;MQSLOW\e P8e LR�DngacL8Y0Y WST)e WZYBYcP8WZ] _cT ; LCBE�'�5��W7U<W\_BWZY.eMT)_ ;mT)RMem] ; I P =kRmP@eE_cW/.mL`a =K.KMLOacL?=kRMWSa0L`bdL`eE_ Y P@acL _cT

D �

Page 90: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� ��� ���������� �� �� �������� D �

�<=����������! #"$�&%�;(') +*,%.-/ �'�I�0� ,%'���213�R��4$*#�5'+')67�.0('��589��*� +"$6:'�0;*,%2�<�=%2*�:� =����M.(0>�?%? +�5') �1@�.* 9�">�� #"$�A*��.*�0$�. �%B0.6789��0��R��4$*#�B'#')67�.0=6:'B;>6C0(%5*5I :(%20(�� = 9�*#67 #�&%D1@E$0(-F +6C�;0 9�">6:-,"G*+�� #E>*#0('� +"$�&')�� ��51H1@*#���I8.%5*#6J%�;$�7�5'��21K%50L�R��4$*+�5'#'�6C�.0 =

� !/M NPO�Q R � +� � � %�, S

K�"$�T���������7�C6C0>U?�213 #">�DU;*,%5���=%2*K6C0 GWV�6C�C� ;(�?���.0$�&6C0= #"$*+���&') X%2U.�B'9�

Y =�Z[1@*+����2@ �I�4(�����F\]0$6C +6C�.0^V�67�C� ;(��E(')�B�_ +�^���F\]0$�` +"$�� �I�4(���21a%2�C�(4(�9'+')6 ;$�C�cb# +��*#�='+d`�21� +"$���:%20>U.E(%5U.��=e =^bO�Hf�4$*#�5'+')67�.0('+d_V�67�C� ;(�g���F\(0$�B�h +�);(�? #">�9')�T +��*#�='iV�"$6:-,"W'#%5 #6:'j1 I� #">�?'����=%50� +6:-�-F�.0('� #*X%26C0� �=� =^b �670(%2*$I���f�4$*#�5'+')67�.0('+d?V�6C�C�@;(�&���F\]0$�5�� #� ;(�?%c')E ;(')�� ��51K%2�7�k��f�4$*+�5'#'�6C�.0]'>=

l�m�n5o;p2q 1 ; CXr p5sit.n ; rvu m�n5o#+ - " ��w +yx � $�z�"�$j{ "�|.} ! + (;~�| � }�+���q 1 ; C,r x � $�� �?�9�+ - " �.- +,(;~�| � } +,�?" ��w sit.n ; r x � $��2� " ��- {�� ! $ + (;~�| � }�+��

� o#� � ����� n5o.���5m�n5o2��� �&z�"�$j{ "�|.} !��� ; ���,q 1 ; CXr�� + !/� � o+�?��� �Tx:� � � - { �?� "�) ).}�{7� " - { �?�� � t;n ; r ���,sit;n ; rH� m�n2o � � o+�?��� �g�2� " �.- {�� ! w !#��) $&!'+�+v{ �?�

n5o+� r @ � q 1 ; CXr�� ���� �H� !Tn2o+� r @ x:� � � - { �?� { + " ) "�$ "�~R! - ! $ -&�#- � !M+,) !/�){�� �� " - { � � �

�� �¡ ��¢ � o#�£ � � m�n5o ��� n5o : � <�¤ �¥ �¡£ � � q 1 ; C,r+¦ n C � +,!/� � o+� �� ;�: � pFn C <�¤ �� )¡ � : � ¤ ,.�¨§ n5o#� r @T©

n5o+� r @ : � <¥�«ª n C�© $�" � n C�¬ �� )¡ <£ � � sit;n ; r#¦ � � m�n5o ¦ ��� � o+� �� t.n ; r : � p � p � <!¤ �¥ �¡ � �`¤ �� )¡

�¥ �¡ $&! ) $�!'+,! ��- + - � !M+,! - � x "A}�} !#��) $�!'+&+v{ �?� +,�­ "�$®{�"B|.}%!'+ "�$�! !#� ) $�!'+�+¯{ � � +,�° xJ� � � - { � � "�) ).}�{7� " - { �?� { +K" � !#� ) $�!'+�+v{ �?� {�±<{ - � " +- � !Q$j{³² � - � �9~�| ! $ � x "�$�²5�9~ ! �.- +���" ��w !'"5� � � x - � � +,!"�$)²5�9~R! ��- +a{�+ " � !#� ) $�!'+�+v{ �?� �° �2� " ��- {�� ! w - ! $)~�{ +K" � !#� ) $�!'+�+v{ �?� {�±�{ - +H| �´w (D{ +�?� !5�

µ � ; �¥ �¡ ��¢ �� �¡£ � � m�n5o ��� n5o : � <�¤ µ � ; �� )¡£ � � q 1 ; C,r+¦ n C � +,!/� � o+� �� ;�: � pFn C <�¤ µ � ; �� �¡ �

n5o+� r @ : � <¥�«ª n C �·¶ © $ " � n C�¬ µ � ; �� )¡$ " � � t.n ; rk¸ µ � ; �¥ �¡ � 9�;

µ � ; �� )¡ $�! ) $�!'+,! ��- + - � !M+,! -� x!|.{ � "�$�( !#� ) $�!'+�+v{ �?� +��­ "�$®{�"B|.}%!'+ "�$�!�|.{ � "�$&( !#��) $�!'+&+v{ �?� +,�° xJ� � � - { � � "�) ).}�{7� " - { � � { + "H|.{ � "�$�( !#� ) $�!'+�+v{ �?� {�±T{ -� "?+ -j¹ � "�$�²5�9~R! ��- +,�?" ��w !'"5� � � x - � � +,! "�$�²5�9~R! ��- +{ + "�|.{ � "�$&( !#��) $�!'+&+v{ �?� �° �5� " �.- {�� ! w - ! $�~º{ + � �?- "�|.{ � "�$�( !#� ) $�!'+�+v{ �?� �

Page 91: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

D.e ���� ������i� � � ���� �������K�` �� �� I�

K�"$��1@E$0(-F +6C�.0�1@�;*`��f� #*X%.-F +6C0$U& #"$�&'��� `�51¥1@*+���T8;%2*#6J%�$�7�5' 1@*#�;��%20W��f�4$*#�5'+')67�.0=6:''�� o m�n2o C � � o+� � ¢ m�n2o£ � � m�n5o � � o m�n5o C : � n5o : � <7<(� 9 � ;£ � � q 1 ; C,r pFn C � +,!/� � o#� �� o m�n2o C : � ;�: � pFn C <7<

�� 9 n � $ " � n C � � o m�n5o C : n < ;£ � � sit;n ; r p � � m�n5o.p ��� � o#� �� o m�n2o C : � t.n ; r : � p � p � < <

� � o m�n5o C : � < � 9 � ;

� o m�n5o C !#� - $ "5� - + - � !M+,! -� x x $�! !�z�"�$j{ "�|.} !'+Hx $ � ~ "- ! $)~c�

����� NPO�Q R � +� � ����� ��� �

�������! "�$#&%�')(�'+*,%.-/1032$465�73839;:<4i%50(��=?> 038@:^%5*#��4]%2*,%5���� +��*,'T #�� #">�=')4(�5-F6³\!-�%5 #6C�;0 *#�A4$*#�5'���0� #6C0>UL #">�� BA�4(�5'T�21I8.%5*#6J%�$�7�34-F�.0('� ,%50� C4(%20(�ED¨E(%50� +6 \(�A*�'FA��G�(�.�J'<49*#�B')4(�5-F +6C89���HA3IJ�K�L!MN/OJ�K�L � 5.J�K�L � =�J�K�L

/PJ�K�L '� ,%20]�$' 1@�;*`8;%5*#6:%��$�C�B'�*#��U´%2*,���5�=%.'���f�4>*#�5'+')6C�;0('�6C0= +"$��6C*��5V�0=*#67U."� QI/OJ�KRLTSHS�9CUWVYXZS�/1032

5.J�KRLº'� ,%20]�$' 1@�.* 1@E$0]-F #67�.0�%24>4$�C6J-�%2 +6C�.0]'<I\[`�; #�L">�2V� +"$� ')���h%20� #6:-<-F�.0('� #*X%26C0� �6J' ��f�4$*#�5'+')�5� %.'=%206C0�8.%5*#6J%20� �%2 � #">�D�7��89���(�21]5.J�KRL.I?^`_j �6:'�6C0>"$��*#67 #�5�c #"$*+�.E$U;"$�.E$ I #"$�&���F\]0$6C +6C�.0=�51aJ�K�L�Icb5.J�K�LdSHSe9CUfVYXgSh5�738$9;:

032 N9iS�J�K�LkjlnmQo V]p3qC5.J�K�L�^cr&s�09Wb t r�u�vWwyx�032<z{:`U}|�~ � m 096M\032;z{:`U�^�r�b

=�J�K�L ') X%20(�$'�1@�.*�D9E(%20� #6³\(�5� ��f�4$*+�5'#'�6C�.0]'<I=�J�K�L�S{Se�Q>@038 :�SY=?> 038@:

� 032�S"/1032X�7��3U�S�J�K�L

�6�1�+�.�� "�3#�%�')(�'�*,%�-032<z{:`U_6J'�%_4(%5*,%5���� #�A*� #�^ +"$�&')4(�5-F6³\!-�%5 #6C�;0�I032;z{:�U1S35�738$9;:���O� �

���.%��W(�'+*�%� "�3#�%�'�(�'�*,%�-zc9QqRXQz�81032;U�-�"$�B-��>'HV�"$�� #">��*�%20W��f�4>*#�5'+')6C�;0=6:'a�$670(%2*�AOS

Page 92: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

������� � �i�������H�Q�� �����K�º� �1�a� � D��zc9QqRXQz�81032;UGS<J�K�L �� zc9QqRXQz�81032;U1^���b t �����R�����iS

V]p3q /PJ�K�L�^ � b ������� �V]p3qC5.J�K�L�^cr�s�09fb � ~ � m 096M e |�� 0Yu��~ �Wx���09^¢ zc9Cq�XQz�8y032<U1^�01bV]p3qQ=�J�KRL.^R�$s � s�Xb ��� �W~ ���

� m v

rC2���� /1032 9T��f� #*X%.-F X' #">� 1@*+���T8;%2*#6J%�$�7�5' 1@*#�;��%20W��f�4$*#�5'+')67�.0�I

rC2����$/1032R9eS<J�K�L � /y032�q ��� �rC2����$/1032R9f^��b t ���������!��S

V]p3q3/OJ�K�L�^ � b � " �$#V]p qQ5.J�K�L�^cr s�09Wb �&%'" rC2���� /1032 93^�01b � 0Gu��~ �Wx���09 #V]p qQ=�J�K�L�^R�$s � s�X b � rC2���� /y032R9 ^�Xb �(" �)#

� m v

���+* ,.- Q�/���01/�243���5 � �768689�Q�6

_®0Y�(�; #"<')4(�5-F6³\!-�%2 +6C�;0('¥V���-,"$�´')�� #�T�=%��9��032<z{:`UD%`\(0>6C #��4]%2*# +6:%5��1@E$0(-F +6C�;0^6C0c%20� #6J-F6C4]%2 #67�.0^ +"(%2 H67 HV��;E$�:�� ��67��4$�7��� �A0� +���T%.'i%` X%�$�7���21a-F�.0('� ,%50� X'¥V�6C +"^ #"$��67*i%2*+6C +6C�5';I._j H�<6CU."� �� ���<�.*#� %24$4>*#�.4>*#6:%5 #�� #���h%�9��67 %? #�. X%2�(1@E$0(-F +6C�.0): 6 1�4.1@�;*���f$%5��4$�7�349%D0]%2��670$U^-F�;0�89�A0� +6C�.0cV��A*#��E(')�5�cV�"$��*#�C�@Ac #"$� %2*#67 BA^�21y%^-F�.0('� ,%50� -F�.E$�J� � �&��67*#�5-/ #�{A<���� +��*#�<6C0$�5�?1@*#�;� ^v +"$�T�=%.-,"$670$�`*+��4$*+�5')��0� ,%5 #67�.0��51<bK6C X'�0(%2�<�3I

;=<?>@<BA CEDGFH�I+JLKMGFNOK8NPNQFLMGNORSNUTWV'V=X+FKZY'[7R8KZX�\@FH^]_\`Y@JaMbI+VcY@Nd�"('T-�%.'���'� #E(�@AW6C�7�CE('� #*,%5 #�5'I%20 6C0� #��*+�5') +6C0$U<��6C89�A*#U.�A0(-F�?670 ') BA��C�5'��(�� �VK����0fe·%20(�hg`iSj�V�67 #"�*#�B')4(�5-F #�=E(')�A* q¯���F\(0$�B� 4$*+�5��6J-�%2 +�5'<I _®0� +"$�.e«')4(�5-/6 \!-�%5 #67�.0�4��$670(%2*�A���f�4>*#�5'+')6C�;0('T%2*+�����/\(0$�5� %.'&%G'�E1�('��� ?�51%2�C�K4(�9'#'�6{�$�7����f�4$*#�B'#')67�.0(';4H%50(� #"$�� +�5') &�21IV�"$�� +"$��*T��f�4$*#�5'+')67�.0k�c6:'6�$6C0(%5* A 6:'.��uml z�8$J�K�L�I�_j0 #"$�g`iSj '�4(�5-F6 \ -�%2 +6C�.0P4¨�;0� #">�`�; #"$��*K"(%20]�O4� +"$�` +�5') K6:'HV�*#67 # +��0�%;'�%!n��9�.�C�B%201q@8;%2�CE>�5�_1@E$0(-/ #6C�;0�zc9Cq�XCz�81032<U1I[`�. +�G +"(%2 c #">�oe #�B-�"$0>6�D9E$� 6J'?0$�. <')E>4$4(�.*# +�5�g� A�^@ #"$�qpsrQtQu$v�89��*X')67�.0«�21;b!g`iSj ')6C0]-F��6C ^670�89�;�C89�5'6C0�\(0>6C #�h')�� X'<I1wi�;0�89�A*,')�A�{A34� #"$�.g`iSj +�5-,"$0$6�D9E$��6J'D0$�; �'�E$4$4(�.*+ #�5���@A #">�oe«�h%2 #">���=%2 +6:-�%5�H #�9�;�{��6C ')6C0]-F�`n��9�.�7�5%20]'`%5*#�?0>�. �%�8;%26C�J%�$�7�3I

;=<?>@<yx z�DGFF{M}|S~4F�N1R@N���\�Mb\@K�X�D�F�J�\@DGN�I+VcYd�"$�^ �V��W')4(�5-F6³\!-�%5 #6C�;0('���6��!��*T6C0� #">��6C*�E]')�^�21 *#�5-/E$*,'�6C89�? BA�4(�c���F\(0$67 #67�.0(';I�d�"$�<')4(�5-/6 \!-�%5 #67�.0�6C0f�´�5-<q #6C�;0(�3I e 670� +*#����E]-F�5'^%G1@*#�A�� BA�4(�P����2<V V�"$6:-," 6:'^���F\(0$�5� *+�5-FE$*X')6C89�A�{A34�V�"$��*+�5%.'? +"$�W')4(�5-F6³\!-�%5 #6C�;0 6C0�9�5-F +6C�.0P�3I � ���/\(0$�5'^ #"$�W BA�4(�5' J�K�L�4G5.J�K�L�%50(�d=�J�K�L �@A«�cE$ #E]%2��*+�5-FE$*X')67�.0�I _j0 U;��0$��*X%2��4K� E$ +E(%2�*#�5-FE>*,')67�.0W6:'�% ���.*+�S�(��f�6{�$�7�����5%50(' �51i BA�4(�g���F\(0$67 #67�.0L +"(%20L1@*+���T BA�4(�5';4k%50(�L�C�5%;�$'� #�����;*#�&')E]-�-F6C0]-F ���F\(0$67 #67�.0(';I=n�E$ ��.0� +"$�T�. +"$��*�"(%20(�k4k #"$�A*#�&���9�5'�0$�. %24$4(�5%5*� #�h�(�^%^U.��0$�A*,%2�����5-,"(%50$6:-�%5�(4$*#��-F�B��E$*#�1@�.*^U.�A0$��*,%5 #670$U % -/�.��4$�7�� #�<')�A ^�21I*#E$�7�5' 1@�;* *+�5%.'��.0$670$U %��(�.E$ <%2*��$6C +*,%2*�A *#�B-FE$*,'�6C89�c BA�4(�W���F\(0>6C #67�.0(';I^��9���4�9�B-F #67�.0�� I��@I Y 1@�;*����.*+�T��6J'#-FE('+')67�.0�I�b

Page 93: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

D�� ���� ������i� ��� ������������K�` ����� I�

;=<?>@<�� C K�MsMGFDbY@N(K�Y@H�H`F�4Y`I�MbI+V=Y�=|^JLK8NQFN� "$��0G1@*+���T BA�4(�5'�%2*+�?6C0�89�.�789�5�O4�% e ���F\(0$67 #6C�;0=V�6C�C��E]')E(%5�C�{A="(%�89�&%c')��4(%5*,%5 #�c-F�;0� �E$0(-F �1@�.*��5%;-�" -�%.'��34%20(���21@ +��0� #"$�c-/�.0� �E$0]-F TV�6C�C���(� D9E(%50� +6 \(�5�=�589��*� #">�c-F�.��4(�;0$��0� ` BA�4 �B' 1@�.*T #"]%2 &-�%.'��3I4naAW-F�;0� +*,%.'� Q4g`iSj %5�C�7�2V�'� +"$��E('�� �51cb#4(%5 # #�A*#0('+dL')E]-�"«%;' V]p3qC5.J�K�L�^cr&s�09WbI6C0·���F\(0>6C #67�.0('Y^@�3I UyI 6C0· #"$�c6C0�8;%2*#6J%20� �21�5.J�KRL�%20(�«6C0« #"$� � ����6C�5'^�21 zc9Cq�XCz�81032<U %50(�!rC2���� /y032R9fb�4K%20(� E('��5'_ +"$� ���������g-F�.0]') #*+E(-F ?1@�;* E$0>6C�.0 FA�4(�5'<I d�"$6J' *+�5')E$�7 ,'�6C0W')">�.*# +��*I%20(�=���.*+�D�B%.')67�{A=-/�.��4$*+��"$��0]')6{�>�C�I���F\(0$67 #67�.0(';4$�5')4(�5-F6J%2�7�{AcV�"$��0L�J%2*+U.��*U.*,%5���=%5*,'�%5*#�T6C0�89�.�789�5�OId�"$�T-�%;')�5'�-F�;0(') +*#E(-/ �6:'�'+%B1@�� +�^E(')�IV�"$��0= #"$� ')E$���h%20(�$'H�51i%T FA�4(��E$0$67�.0W%2*+���:%��(���C�5�c FA�4(�5'�^¯')E(-,"=%;'-F�.��4(�´')6C +�T FA�4(�5'�6C0= +"$6:'�-�%.'��Wb �$E$ ��=%QAG�(�? +*#�;E1�$�C�B')�.�<���. +"$��*#V�6J')�3I��$�.*���f>%2��4$�7�3496 1iVK�T"(%.�W-�"$�´')��06C0('� #�5%;�h +� V�*+6C +�

�  )¡ � m�n5oC%�q �  )¡ %�s �  )¡ #"$��0= +"$�6� ��� AG�51�rC2����$/1032R9IV��;E$�:�"� �TV�*+6C # +��0W%.'rC2����$/1032R9eS<J�K�L � /y032�q ��� �rC2����$/1032R9f^��b t ���������!��S

V]p qQ5.J�K�L�^cr s�09Wb � % " rC2���� /1032 93^�01b � 0Gu��~ �Wx���09 #V]p qQ=�J�K�L�^R�$s � s�X b � rC2���� /y032R9 ^�Xb �(" �)#w ��� � � � � " � #� m v

d�"$�6w ��� � � � -F�:%5E(')�T'+%�89�5� E('� #"$6J' +6C���343�$E> �6C �-/�.E$�J�h0>�. ?�(�TE(')�5��6³1��. #">��*�')E$�<�=%20(�>'yVK��*#�IE$0$�:%��(���C�5� FA�4(�5'<I

����� � Q��?��0O/�243�� 5 � � 68689 Q 6

[`� psrQtQu$v«4>*#�9�21¯'�VK��*#�g%2 # +����4$ +�5� 1@�.*� +"$6:'�-�%;')�c') +E(�@AE� �B-�%2E('���pQrstQu$v ���9�B' 0>�. T-FE>*#*#�A0� +�{A='�E$4$4(�.*+ ���F\(0$67 #67�.0('a� A=-�%;')�5';I

;=<��c<BA �PFK8NQVcY`I�Y�� K�4Vc\�MPDGFJ\@D�NGI�R=FmM}|@~4F H`F�4Y`I�MbI+VcY@Nd�"$��1@*#���T BA�4(�T���F\(0$67 #6C�;0��� o#� ��� ��� n5o.���5m�n5o2��� ���! ���,q#" %$ r��'&)( � ��� o#�?��� �;� t;n r ����sit;n rH� m�n5o � ��� o+�?���

-�%20"�(�?��f�4(%50(���5���.E> `670� +�c%20W%2f�6C�;�=%2 +6:-����/\(0$6C +6C�;0L%;' 1@�.�7�C�5V�'<Sl ��� o+� u

Page 94: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

��������� �i�����3���� ������K� � �1����a� � �

� n5o���m�n2o� ��� o+��! �5q#" %$ rk�'&)( � ��� o#�� ��� o#�� t;n r �5sit.n r¥� m�n5o � ��� o+��� ��� o+�� � $� "2� r ������� � n5o.p������ �! p������ � t.n r �£�� � ¢ ��� o+���� n5o�� �km�n5o!� "$# �! � ��q#" $ r¥� &)( � � � "%# � t;n r � �$sit.n r¥� m�n5o � � � " ¬ �

& ��� o#� ¬ �d�"$��'��5-F�.0]�^-F�.0� �E>0(-F 3') ,%5 #�5'� #"$� _®0]��E(-F +6C�.0('H*#6C0]-F6C4$�7�H1@�.*!���;2;Vº6C0?67 ,'����9'� ¥U;��0$��*X%2�91@�.*+��I�^��9���*)��94$6 �,+.-/ � I Y�0 1@�.*����.*+�T���� X%26C�J'<I�bd�"$��*#�T6J'�%20�%50(%2�7�.U;�.E('�_j0(��E(-F #67�.01'H*#670(-F6C4>�C��1@�.*6J�KRLL6C0= +"$�`g`iSj ')4(�5-F6³\!-�%2 +6C�;0�S

24365�798;:,<�=.>@?A8;BC:

�fS<J�K�L� S,/1032ED�F*G ^RV]p3q /PJ�K�L�^ � b b

V]p3qC5.J�K�L�^cr�s�09fb�S35.J�K�L�s�� 0 u���~ �Wx���09!HIG ^R0�bJD KMLONQPG ^�V]p qQ5.J�K�L�^cr s�09Wb�bV]p3qC=�J�K�L�^��3s � s�Xb�S3=aJ�K�L�sRG ^�XWbSDUT LVFWLOX G ^�V]p3qC=�J�K�L�^��3s � s�Xb�b

G ^��b YSZd�"$�W��6��!��*+��0(-F��6J'<4i #"$��_®0]��E(-F +6C�.0['H*#670(-F674$�C�^1@�.*^1@*#���< FA�4(�5'^-�%50g�(�=U.�A0$��*,%5 #�5� 4$E>*#���HA ���B-�"(%50$6:-A%2�C�HA1@*#�.�P #"$�`1@*+���� BA�4 �&���/\(0$6C +6C�;0�4�V�"$�A*#�5%;'?_®0]��E(-F +6C�.0\'y*+6C0(-/6C4$�7�5'¥1@�.*� BA�4(�5'����F\(0$�5� � A�%5* �$67 #*X%2* A<� E$ +E(%2�*#�5-FE>*,')67�.0=�cE(') � �TU;��0$��*X%2 #�B��� A�"(%50(�O4(V�6C +"G�76C + #�C���.*�0$�<%.'+')E$*X%20(-F�g%.'� +� +"$��6C*�8;%5�C6:��6C BA3I

;=<��c<yx ]'KMbI+N���K��I�X�I�M}| V ]�DGFJ\SDGN�I�R�FmM}|@~4F{H`F�4Y`I�MbI+VcY@Nd_^a`�b�`!c9d_eaf U,gihjbkhjeml�`�`!l�^ihjl*hjenhjb �oc�l�bkhjb�AqpAb�`�`*lFAmri`Ist`F\ieacUl�cUf.euc�dSd�hjl�c9d®\4h��av�` SwRf.eid�c�st`xb_pAf.by`�fahMz�ravU`� ¶ � � � ��{ ��$ � {j��� � ¶ � �}|_~R~x��"����

Z�d�c�z�rov�`*w�hjbkstc�eihMv�cUlFA�hjb+U.gaz�`�etl�d�^af5VydSl�^ihMl�eof%d�`�l.� e wRf,gav�s�rif6d�d�c{�ov{Aud�hjl�c9dQp+Aul�^o`Esm`F\ieacUl�c�f,e�IZ�d�gt�uwCc�`�eml�wCf.eistcUl�cUf.e�pAf.b�h�pAb�`�`�lBAmri`�st`/\ieac�l�c�f,e�l�fZ�i`�d�hMl�c�dj\4h�ov�`�c9d\l�^ihjlucUl�g�d�`Md�f.eov{A \ieacUlWhMb AwRf.eid�l�b�giwRlWdJcUe$c�lWd�st`F\ieacUl�cUf.e�S�d�`x`Sr�I � � fMp�)��6rac �,+j- ILd_^o`�pAb�`�`_lBAmr�`ysm`F\ieacUl�c�f,e$c�eq�6`�wRl�cUf.eq�3I e c�dJd�hjl�c9d®\4h��av�`d�c�e�wR`qcUl!gid�`Md�f,eav{Afw�hMb�l�`�d�c�hMe�rab�fmstgiwRlkd$hjeis \�eac�l�`%d�`�D6ga`�eiwC`Md<I.�6c�z�cUv�hMb�wRf,eid�c9st`�bkhjl�cUf.eidIhjrarov{A�l�ful�^a`b�`MwRgobWd�cU�6`�lBAmri`Esm`F\ieacUl�c�f,eid�U.cU�6`�euc�e���`MwRl�cUf.eh�3I � I

;=<��c<�� � M��@FD(DGFJ\SDGN�I�R�F{H`F�4Y`I�MbI+VcY@N���6`xe�f.eiwR`\h�pAb�`�`%lFAmri`%st`F\ieoc�l�cUf.e�^ih.d6�i`�`�e�d�^af5VSe�l�f �i`ud�hjl�c�d®\�h�avU`34�l�^a`�b�`qc9d�eafLU,gihjbkhjeml�`�`%l�^ihMl$hb�`MwRgobWd�cU�6`Ist`F\ieacUl�cUf.e�fMp�h�pAgaeiwRl�c�f,e�f.b!h�d�`�l�fM�6`�bSl�^ihjl!lBAtri`Ic�dyd�hjl�c�dj\4h�avU`3I���^ihMlDU,gihjbkhjeml�`�`$c9d�l�^a`�b�`34pAf.by`�fahMz�ravU`346l�^ihMl�l�^a`Ist`/\ieac�l�c�f,e�fMp=l z�83J�KRL�cUe �6`MwCl�c�f,eh�3I e c�dywRf,eid�c9d�l�`xetlC�hd_^a`(d�^af,b�l*hjeid�V_`�byc�d;4al�^a`z�f.b�`$gaeac�pAf,b�z�l�^a`�d�l�b�giwCl�gab�`qfMp*h�b�`MwRgobWd�cU�6`$st`/\ieac�l�c�f,e�4�l�^a`�z�f,b�`%wW^ihjeiwC`ql�^a`�b�`%c�d�fMp ��`xc�e$Unh�avU`�l�fh.w�wR`xralSc�lCIZd_^mgid�pAf.by`�fohjz�rov�`344) ��z�c +;e�- rob�`Md�`�etlkdSd�f,z�`!l�`MwW^aeac D�ga`�d�pAf.byd�^af5VSc�e$U�l�^ihMl�d�c�z�ravU`�b�`MwRgabkd�cU�6`st`F\ieacUl�cUf.eidShMb�`Id�hMl�c�dj\4h�ov�` ��h.d�`�s\f,e�l�^a`!eaf.l�c�f.e1fjpIb�rab�c�z�cUl�cU�6`�b�`MwRgabkd�c��6`Bd sm`F\ieacUl�c�f,eid<I_Qe�¡�'��a4�rab�fM�tcUe$U�l�^o`�pAf,b�zuhMl�c�f,e�b�gavU`EpAf.bIh�b�`MwCgabWd�c��6`�vHA@q}st`F\ieo`MsqpAgaeiwRl�c�f.e):¢d�g�w£^�h,d rC2���� /1032 9$c�ef��`Mw<ql�c�f,eh�3I � :�c9dSd�gt�\wRc�`xetl�l�f%d�^of2V¤l�^ihMlSl�^a`Ist`F\�eac�l�c�f.euc9dSd�hjl�c�dj\4h�avU`34id�cUeiwR`�l�`�b�z�c�eihMl�c�f,eqc9da�agacUv�lSc�eml�fIl�^a`st`F\ieacUl�cUf.eufjp3V_`�vUv{q�pAf.b�z�`Mstea`�d�d?^@d�`�`4�6`MwRl�c�f.e e I e I � bRI

Page 95: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

��� ������������� ��� ����������� �������������

;=<��c<?> �kF#��Y`I�MbI+V=Y�=| J K8NQFN�6gararif.b�l�pAf,b�l�^a`!����������wRf.e�d�l�b�giwRlSc9d_eaf.l*wRgab�b�`�eml�vHAqcUz�rav�`xzq`�e6l�`MsEc�eqpsrQtQu)v?IJ'�f6d�d�c{�avHAql�^a`!`Mh.d�c�`Md�l�VShQAl�f%c�z�ravU`�z%`RemlJc�l�V�f.gav9s ��`Il�f^U,`�ea`�bkhjl�`(h2fmc�f,zud_wRf,b�b�`Md�rif.e�stc�e$U%l�f%`Mh,w£^�fMpc�lkdSd�lkhjl�`xz�`�emlWd<S�eihjz�`�v{A34

��������������� < ��� :! �#"%$'&)(V]p3q /PJ�K�L�^ � b�S,/OJ�K�L

" �$# S,/y032�q ��� �rC2����$/1032R9 ^�V]p3q /OJ�KRL.^ � b b M " �$# YSZ

��������������� < ��� :! +* "%$'&)(V]p3qC5.J�KRL.^�r�s�09fb�S35.J�K�L

% " rC2���� /1032 93^�01b � 0 u��~ �Wx���09 # S,/1032Qq?�R� �rC2���� /1032 93^RV]p3qQ5.J�K�L�^�r�s�09Wb�b�M % " rC2����$/1032R9 ^�01b � 0Gu��~ �Wx'�P09 # Y�Z

��������������� < ��� :! +, "%$'&)(V]p3qC=�J�K�L�^��3s � s�XbRS3=�J�K;LrC2����$/1032R9 ^�Xb � " �$# S,/1032Qq?�R� �rC2���� /1032 93^RV]p3qC=�J�K�L�^��3s � s�Xb�b?M�rC2���� /y032R9 ^�Xb �(" �$# YSZ

[�f.l�`$^af5V�V_`xv�v{q�pAf.b�z�`Msteo`Md�d_^ Atrif,l�^a`Md�`Md�^ih��6`Y�i`�`�e�c�e�wRv�gism`Ms�l�f�`xeid�gab�`$l�^ihMl!l�^a`�wRf.e�wRv�gid�c�f,e�c�d`V�`�v�vHqpAf.b�z�`MsOI-�`Mwxhjv�v4l�^ihMl�l�^a`Ist`F\ieoc�l�cUf.e�fMp�rC2����$/1032R9!c9d<S

rC2����$/1032R9eS<J�K�L � /y032�q ��� �rC2����$/1032R9f^��b t ���������!��S

V]p3q3/OJ�K�L�^ � b � " �$#V]p qQ5.J�K�L�^cr s�09Wb �&%'" rC2���� /1032 93^�01b � 0Gu��~ �Wx���09 #V]p qQ=�J�K�L�^R�$s � s�X b � rC2���� /y032R9 ^�Xb �(" �)#

� m v

d_^a`TV_`�vUv{q�pAf.b�z�`Mstea`Md�dJrab�f6fMp_ff�av�c7U6hMl�c�f,e�pAf.b�rC2���� /1032 9�c9d_l�^mgid�������.���/��� 7 � B ��0 �fS<J�K�L

rC2����$/1032R9 ^���b�S,/y032�q ��� �d_^ac�dEcUe�l�gab�e��ab�`Mh��ad%stf5VSe c�eml�fnh emgazh��`xb fMp�V�`�v�vHq pAf,b�z�`�stea`Md�d rob�f6fjp fW�avUcCU6hMl�cUf.eid pAf,b$l�^a`1stc���`xb�`�emlw�h.d�`Md_c�em�6f.vU�6`MsO4.pAf.by`�fohjz�ravU`3S

�������.���/��� 721435 �6"%$'&)( V]p3q /OJ�KRL.^ � b�S�/PJ�K�L" �$# S,/1032Qq ��� �

d_^a`�rab�f6fjp*fjp87 pAb�`x`�g�hjbWdBq pAf,b�z�9il�^o`�e�pAf.vUv�f5Vyd]� A�h�d�cUz�ravU`$gid�`�fMp�l�^a` _Qe�stgiwRl�c�f.e '�b�c�eiwCc�ravU`%hjeis d�f,z�`d�c�z�rav�`SpAf.b�zuhjl�c�f.eub�gav�`Md;4ad�giw£^1h,d<S

�������.���/��� 7 � B ��0 �6"%$'&)(V]p3q /OJ�KRL.^ � b�S�/PJ�K�L

rC2����$/1032R9 ^�V]p3q /OJ�KRL.^ � b bRS,/1032Qq?�R� �;=<��c<�� ]'KMbI+N���K��I�X�I�M}| V ]oI�Y R8K8D I+KZY MGNZ�v�l�^af.g$U,^�cUl�c9d�eaf,l�d�l�b�c�wRl�v{Auh g iSj rob�f6fjp�fW�avUcCU�hjl�cUf.e�4il�^o`�b�`!c�dyh b�rab�f6fMpSf.ror�f,b�l�gaeac�lBA>d�l�fud�^of2V l�^ihjlhjv�v4st`/\iea`Ms$lBAtri`Mdhjb�`�eof.e1qA`�z�ralBA34;VS^ac�wW^$c�e%l�gab�e�z�`MhMeidJd�^af5VSc�e$UIl�^ihMl�lBAmri`�cUet�,hjb�c�hMetlkd�hMb�`*d�hMl�c�dj\4h�ov�`3I

Page 96: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

��������� ��� ��6��������� � �1����a� � �_Qeul�^a`Ih�ifM�6`Ewxh.d�` 4al�^ac9d_z�`Mhje�d�rab�fj�mc�e>U$l�^ihMl lnmQo qC5.J�K�L�c9dSd�hjl�c�dj\4h�avU`34af.byc�euf,l�^a`�b�V�f.bksad�l�^ihjl� r�S35�738$9;:;s�093S;J�KRL j ¢Fr u vWw1x�032;z{:�U |�~ � m 096M 032<z{:`U1^cr�b

[�f.l�`�l�^ihMl$c�p]032<z{:`U�c�d l�^a`�`�z�ralBA�zuhMr�l�^a`xe l mQo qC5.J�K�L c9d eaf,l%d�hjl�c�dj\4h�avU`3I�ZSlEl�^ac�d!r�f,c�emlEl�^a`ud�ri`MwCc{q\i`�bTV_f,gav�s�eo`�`Ms�l�f�wCf.eid�c�st`�bTVS^a`xl�^a`�bId�giw£^ h�w�h,d�`�wRf.gav9s�`��6`�b hjb�c9d�`34�hjeis�c�pSeof.lQ4�h.sas�l�^a`uh,d�d�`�b�l�c�f.evWw1x�032;z{:�U��M " # l�f$l�^a`Id�ri`MwCc \4w�hMl�cUf.e1h.dyhqwCf.eid�l�bWhMc�emlSf.e1l�^a`!�,hjvUga`Md_l�^o` r�hjbWhMzql�`�b6032;z{:`Uqw�hMe�lkh�6`3I_}p�032<z{:`U�c9d�eaf,e1qA`�z�ralBA34al�^a`EcUet�,hjb�c�hMetlyw�hMe��i`$d�hMl�c9d®\i`Ms!� A�lkh�mc�e$UuhMe@AYr u vWw1x�032;z{:�U�hMeis�hje A � S,/1032hjeis1wRf.eid�l�b�giwRl�cUe$U%h%d�`�D6ga`�eiwC`h09!fjpvU`�e$U,l�^ 032<z{:`U1^cr�b�wRf,eid�c9d�l�c�e$U$fMpc�st`xetl�c�w�hMv�l�`�b�z\d�V]p3q /PJ�K�L�^ � b�I

Page 97: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� � ��� ����

� � � ����� ����� � � ��� � � � ����� ��� �����

d_^ac�dIw£^ihMral�`xb$d�goz�zuhjb�c���`�d�l�^a`\wRf.eiwCv�gid�c�f.e�d b�`�h.wW^a`Ms pAb�f.z�l�^a`uwxh.d�`\d�l�g�stc�`MdIhjeis�zuh��6`Md�b�`MwCf.z�z�`xe1qsahjl�c�f.e�d(pAf,b�hMe�c�z�rab�fM�6`Ms�d�ri`MwRc! �w�hjl�c�f.e z�`xl�^afms�"S^ac9w£^w�hjral�gab�`�dEl�^a`E��`�d�l%l�`MwW^aeac D�ga`�d pAb�f,z e�hMeisg`iSj�I

# �%$ & 2 6�� / ' 243)(+*,' 243��7/�2.-0/h5 3243)1 52/

��f,b�l�^o`Ez�f�d�lyrihjb�lQ4�l�^a`EzuhMl�^a`xzuhjl�c�w�hMv�eaf,lWhjl�c�f,eid�`�z�rov�f�A6`Ms.3 A.g`iSj hMeis e�hjb�`I�6`�b A1d�c�z�cUv�hjbC443if.l�^3�`xc�e6573ih.d�`Ms�f.e�lBAmri`Ms ^Azuhje A�d�f.b�l�`Ms�b�rab�`Msmc�w�hMl�`Iw�hjv9wRgavUgid<I=n_f,l�^�z�`xl�^afmsadSh,sas�sahMlWhqz�fmsm`�v�vUc�e65%wRf,e1qwR`�ralkd d�giwW^ h.dId�`�lkdEhje�s l�garavU`Md�l�f�l�^a`23ih,d�c9wqrab�`�stc�w�hMl�`%w�hMv�wRgov�gid98Jl�^a`QA�smc��4`�b$d�v�c:5.^ml�v{A1c�e�l�^a`�cUb `<;ah,wRlw£^af,c�wR`�fjpIwRf,eid�l�b�giwClWd<4=3agalE^@wCf.eiwRb�`�l�`\dFAmetlkh>;[h.d�c�st`Wb!l�^a`1w£^of.c�wC`MdEhMb�`�d�c�z�cUv�hMb cUe eihjl�gab�`3I d_^a`uzuhMc�estc��4`�b�`�eiwR`MdShMb�`(d�gaz�z\hjb�c:��`Ms$c�eE�6`MwRl�c�f.e@? I � ISwf,eid�l�b�giwRlkd�pAb�f,z f.ea`Iz�`�l�^ofms�wxhjeA3i`I`B;trob�`Md�d�`Msuc�eul�^a`f.l�^o`�bSeaf.lkhjl�c�f.e@"Sc�l�^af.galyz%giw£^%l�b�f.g63ov�`34ihMv�l�^of.g65,^�wRf,eiwRc�d�`�ea`Md�d_zuhQAC3i`$d�h,wRb�cD 4wR`MskI'�`�b�^�hjridSl�^a`!z�f�d�l�d�c�5,eac! �w�hjemlystc��4`�b�`�eiwR`�d)3i`�lE"_`�`xe�l�^a`!lE"_f$eaf,lWhjl�c�f,eid�hMb�`3S

F I�d�Amri`Md<4_pAgaeiwCl�c�f,eid�hMeis �,hjv�go`Md�hjb�`�stc�d�l�cUe65.gac9d�^a`�s c�e g iSj�IZd�Atri`Md�hjeis pAgaeiwRl�c�f,eidqwxhjeaeaf,lG3�`rih.d�d�`Ms1h.dS�,hjv�go`Md_f.byb�`�l�gab�eo`Ms�h.dSb�`�d�gavUlWd<I ) / ?@I �.-

?@I=g`iSj b�`�d�l�b�c�wRlkdJsahMlWh z�fmst`�v�vUc�e65yl�fH ieoc�lWhMb A%wRf,eid�l�b�giwClWd<4md�giw£^�h.d� ieoc�l�`*d�`xlWdhjeis, ieacUl�`yd�`�D�go`�eiwR`Md;4"S^a`�b�`Mh.d'enhjvUv�f%"yd�hMbI3acUl�bkhjb A ^ c�eJ ieac�l�`Wbd�`�lWd;I ) / ?@I � 4 / � I � I FR-

� I=g`iSj ^ih.d�h n_f6f,v�`MhMe lBAtri` hje�s l�b�`Mhjlkd�rob�`Mstc9w�hjl�`Md$h.d n_f6f.v�`�hje1qA�,hjv�go`Ms pAgae�wRl�cUf.eid;4K"S^a`�b�`Mh.de�stc9d�l�cUe65.goc�d�^o`MdL3i`�lE"_`�`xe�l�`xb�zudShMeis rob�f.rif�d�c�l�c�f,eid!hjeis�l�b�`MhMlWd�gid�`�b q}st`M �ea`Ms�rab�`Mstc�wxhjl�`�d�h,d�d�`�lkd<I

) / � I � IN?@4 / � I � I FR-

��`C3i`�vUc�`��6`Il�^a`C3i`Md�lEhMrarab�f6h.wW^O"_f.gov�s�wRf,z.3acUea`El�^a`$gid�`$fjpSrob�`Mstc9w�hjl�`Md�h,d n_f6f,v�`MhMe1qA�.hMv�ga`�snpAgae�wRl�cUf.eidpAb�f.z g`iSj�"Sc�l�^ul�^a`Id�`�lkdFq}hjeis@qAl�gorav�`Mdyhjrorab�f�h.wW^�l�f�sahMlWh$z�fmst`�vUv�c�eP5 g�d�`Msuc�ehe�^}d�`�`Q3i`�vUf>"�bRIn_b�f6h,stv{A 4�l�^a`Se�z\hjl�^o`�zuhjl�c�w�hMv6eaf.lkhjl�c�f.e\d�`�`�z\d l�f,3i`�z�f.b�`R"Sc�st`xv{A$h,w�wR`�rol�`MsEl�^ihjeqg iSj 9;d;Id_^a`�g`iSjh>3acUv�c�lBA$l�fqgid�`!rihjl�l�`�b�eid_c�e23oc�eistcUe65$rav9h.wR`MdShMeisust`M ieoc�l�cUf.eidK3 A�w�h.d�`MdSd�^af,gav�sG3i` eof.l�`�sO4a^af%"_`��6`xbQ4md�cUeiwR`c�lyw�hMe�z\h�6`*st`M ieacUl�cUf.eidyd�^af,b�l�`�byhjeisu`Mh.d�c�`�bSl�f$gaeist`xbWd�lkhjeis1hjeis1w£^o`Mw��kI ) / � I � I �j-

�,�

Page 98: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� ���)� ��� � � ���=��� �������S����� �,+#�� 6 * 5��m2 /�5 �K* 3=(+*`5 ���

� eo`_d�c�5,eac! 4wxhjemlJstc��4`�b�`�e�wR`�3i`�lE"_`�`xe l�^a`lE"_f*hjrarab�f6h,w£^a`�d c9d l�^ihjl�l�^a`z�fmsm`�v6l�^a`xf.b A*fjpil�^a`'eIzuhjl�^a`�zuhMl qc�w�hMv�eof.lWhMl�cUf.e�`Md�d�`�eml�c9hjvUv{AE^�h.d�f,eav{A%d�`�lWd�hjeis%l�garavU`Mdhjl�c�lWdwRf,b�`34J"Sc�l�^qf,l�^a`�b�sahjlkh z�fmsm`�v�vUc�e65!wCf.eid�l�b�g�wRlWd3�`xc�e65�cUetl�b�fmstg�wR`Ms$h.dst`9 ieac�l�c�f,eihjva`<;tl�`�eid�cUf.eid;4 "S^a`�b�`Mh.dg`i@j ^�h.dh�v�hjb 5.`�b�etgaz73i`�b�fjp4rab�cUz�c�l�c��6`Md;I � ea`h.st�,hjemlWh%5.`%fjp�l�^o` e�hjrarob�f6h,w£^�c9d�l�^�hjl!h�d�zuhjvUv�`�byd�`�lyfjp�h>;mc�f,zud�c9d�b�`�D6gac�b�`MsO4 "S^ac�wW^�c9d�st`�d�c�bkh>3avU` pAb�f.zhnpAf,gaeisahMl�c�f,eihjvy�mc�`B"Srif.cUetlCI��yeaf.l�^a`�b%h.sm�.hMetlkh>5,`�c�d$l�^o`�g�d�`�fMp!d�g63alBAmrac�e65y4Sd�f�l�^�hjl$pAf.b%`B;ahMz�ravU`34Jhd�`�D6ga`�eiwC`!w�hje@3i` b�`B56hMbWst`�s�h,d�h%d�`xlSfjprihMc�bkd<I ) / � I � IN? -g`iSj 9;dJv9h.w��$fjp �i`B;mc�3acUv�c�lBAIw�hMe�z�`MhMeql�^ihjl�l�^a`!d�ri`MwRc! �`�bJp}h.wR`Mdz�fmst`�vUv�cUe65Ist`MwRc9d�c�f,eidJ`Mhjb�v�cU`�bl�^ihMe�ea`MwR`�dFqd�hjb�AOS`3I 51I�"S^o`�e�st`�wRc�stcUe65,"S^o`�l�^a`xbSl�f%b�`�rab�`Md�`xetl�h�b�`�v�hMl�c�f,euh.dyh%d�`�lSf,b�h,d�h4n_f6f,v�`MhMe1q �,hMv�ga`MsuzuhjrPI

) / � I � I FR-

#�� /��+*�� -��+1%/�� - 5��217/

[�`�c�l�^a`�b�l�^a`4e -�`RpA`xb�`�eiwC``j�hjemgihjv�) ��rac �,+j- eaf,b�l�^a`4e �6lkhjeisohjbWs ) n?[ + ? - d�r�`�wRc�p+A�l�^a`!`B;oh.wRlSvUf 5.c9w�l�f73�`gid�`Ms+"Sc�l�^1e�4 3agalEl�^a`C5.`xea`�bWhMv�wRf.eid�`�eid�gidEd�`�`�zud�l�fG3�`%l�^�hjl$h��kwRv�h,d�d�c9w�hjv �uhjrarab�f6h,w£^�c9d!hjrarab�f.rab�c�hMl�`3Id_^ac�d�sm`MwRc�d�c�f,e�^ih,d vU`Ms�l�fuhqemgaz73�`xb�fMpSsmc��4`�b�`xetlyl�b�`Mhjl�z�`�emlWd_fjp�rihMb�l�c�hjv�l�`�b�zud<4aeaf,ea`$fjpR"S^ac9w£^�d�`�`�zudl�f�^ih��6` 56hjcUea`MsA"Sc9st`Md�rob�`Mh,s�d�gararif,b�lQI!d_^a`$eaf,l�`1)"!.f.e +,0 3 - ^oc�5.^ov�c�5,^tlkd�d�f,z�`!fjp�l�^a`Izuh� �f.b*stc���`xb�`�eiwC`Md3�`xl "�`�`�e�l�^a`�pAf.gabyzuhMc�euhMrarab�f�h.wW^a`Md;S�)��6rac �,�j- 4�) ��rac �,+j- 4�) ��f6f �.+.- 4awRv9h.d�d�c�w�hMv�d�`�lSl�^a`�f,b A3Ig`iSj gid�`�d�hqeaf,e1q@wCv�h.d�d�c9w�hjvv�f 5.c9wE¡�'��aI j�giwW^�wRb�c�l�c9wRc�d�z ^ih,d 3i`�`xe�zuh.st`Ifjp g`iSj 9 d�wW^af,c�wR`Ifjpyh%eaf.e1qwRv�h,d�d�c9w�hjv6vUf 5,c�wW4%3agal�`B;mr�`xb�c�`xeiwR`�"ScUl�^ psrst u)v�^ih,d�d�^af%"Se$l�^ihMlJd�fjpAlE"ShMb�`�`�e65.cUea`�`�bkd "Sc�l�^ �af.b�zuhjv)j�`�l�^afmsad`B;tri`�b�c�`�e�wR`Sgid�g�hjv�vHAq^�h��6`yv�cUl�l�v�`Sl�b�f.g63ov�`!wRf,z�c�eP5 l�f,5,b�c�r�d)"Sc�l�^�c�l�hjeis%gid�cUe65$c�ll�f(stc�d�w£^�hjbI5,`�rab�f6fjp�f 3avUc{q56hjl�c�f,eid<Ihd_^o`�zuhjcUe�robWh.wCl�c�wxhjv�stc��4`�b�`�eiwR`73i`�lE"_`�`xe�¡�'�� hjeis�wRv�h,d�d�c9w�hjvvUf 5.c9wqc�d!l�^ihMl$¡�'�� pAf,bWwR`Md!l�^a`rab�fM�6`�byl�f�`<;travUc�wRcUl�vHA�wRf,eid�c9st`�b�r�hjb�l�c�hMv�l�`�b�zudyhje�s�l�^a`%d�r�`�wRc! i`xb�l�fuwRf.empAb�f.eml�l�^a`$c�d�d�ga`Ifjpysm`M iea`Msmea`Md�d;I¡�' �¢w�hMe 3i`�h "?�J"ShMbWs�l�f1gid�`%hMlEl�cUz�`Md�:03i`Mw�hMgid�`34apAf.b!`B;ohjz�rav�`34il�^o`$v�hB"yd�fjpywCf.eml�bWh,stc�wCl�c�f,e�hMeis�st`QqstgiwRl�c�f.eu^ih��6`�`<;tl�bWh$w�h��6`MhMlWd_l�f%`�eid�gab�`Q"�`�v�vHq pAf,b�z�`Msmea`Md�dJfMpd�f.z�`�fMpl�^o` l�`�b�z\d�c�em�6f.vU�6`Ms : hjeisO4,c�eul�^a`h>3id�`�eiwR`�fMphMrarab�f.rab�c�hjl�`�zuh,w£^acUea`yd�gorarif.b�lC4iwR`�b�lWhjcUeav{A%h,sasad_l�f$l�^a`�l�`MstcUgaz fjp�rab�f6fMp}dy:zuhjcUeav{AC3i`Mw�hMgid�`b�gavU`Md_^ih��6`�zuhMe@A%z�f.b�`�^ Atrif.l�^a`Md�`Md_l�f�stc�d�w£^�hjbI5,`3I ) / ?@IN?@I � 4 / � I � I �j-��`%wRf,etl�`�eis�l�^ihMlIhjeihMv{Aod�c�d�fMpSrihMb�l�c9hjvUc�lBAurav�hQAod�hje�c�z�rif,b�lWhMetl*b�f.vU`$c�e�b�`��6`�hjv�cUe65%c�eiwRf,z�ravU`�l�`�eo`Md�d_cUe�hd�ri`MwRcD 4w�hjl�c�f,e�hMeis�l�^ihMlS¡�'���d�`x`�zud�l�f,3i`�l�^o`�z�f6d�l�hjrarab�f.rab�c�hMl�`�vUf 5.c9w�pAf,bSw�hMb�b�AtcUe65Ef,galSd�giw£^�hje�hjv{Aod�c9d<I��`1c�eml�`�eis l�f�cUet�6`�d�l�c:56hMl�`ul�^a`1rif6d�d�c�3acUv�cUlFA fMp!c�d�f.v�hMl�cUe65�rihMb�l�c9hjvUc�lBA hje�hjv{Aod�c9d�pAb�f,z f,l�^a`�b%�6`�b�c! 4w�hMl�cUf.el�`MwW^aeac D�ga`�d<4.pAf.b "S^ac�wW^uwRv9h.d�d�c�wxhjv�v�f 5.c9w z�c�5.^ml�d�gt�\wR`3I ) / � I � I F 4 / � I � I FR-

# * 6 * 5�� �R*�/S9��=6=1�52/

-�`MwCgabWd�c�f.e�hje�s\b�`MwRgabkd�cU�6`ysahjlkh$d�l�b�giwRl�gab�`MdhMb�`�pAgae�sahjz�`xetlkhjvil�f6f,v�d_fjp�l�^a`*wRf.z�rogal�cUe65!l�bWh,st`3I#��vUl�^af,g65.^c�l�c9d�gid�g�hjv�vHA�rif6d�d�c:3av�`$l�f�h��6f,c�s�l�^o`$gid�`$fMpSb�`�wRgabWd�c�f,e�4�l�^o`$b�`Md�gav�lkd�hjb�`$fjpAl�`xe�v�`Md�d�eihjl�gabWhMv�hjeis�^ihjbkst`�bl�f+"_f,b ��"ScUl�^�4Jr�hjb�l�c�wRgov�hjb�v{A�c�e�l�^a`1hjb�`Mh�fjp*v�hMe65.gih%5.`nst`M ieacUl�cUf.eid;Ig^`[�f.l�`ul�^ihMl$^a`�b�` "_`1hjb�`�lWhMv{�mc�e65h>3if.gal�gid�`yfjp�b�`MwRgabkd�cUf.e%h.d�h�z�fmst`�vUv�c�eP5�l�f6f,v�cUe�d�ri`MwRc! �w�hjl�c�f.e�d�hMv�f,ea`3I8d_^a`�b�`yhjb�`�zuhMe@AIb�gaeyq l�c�z�`�c�d�d�ga`Mdh.d�d�fmwRc�hMl�`MsG"Sc�l�^�b�`MwRgabkd�cU�6`�rab�f 5,bWhjz�z�c�e657: pAf,b�`<;ahMz�rav�` 46d�lkh.w���fM�6`�b��if%"Z: "S^ac�wW^qz�c�l�c:56hMl�`*h>56hMc�eid�l�cUlWdgid�`Ih.dyhje1c�z�rov�`�z%`�e6lWhMl�cUf.e%l�`MwW^aeac D�ga`*c�euwRb�c�l�c�w�hMv�dFAod�l�`�zud;Icbd_^a`zuhjcUe!stc��\wRgavUlBAL"ScUl�^!b�`MwCgabWd�c�f.e!c9d�l�^ihMl�cUlWd�gid�`�z\h�Ayeaf,l�3i`="_`�vUv{q�pAf.gae�st`MsOI#�af.b�`B;ohjz�rav�`34C`��,hjvUgihjl�c�f.e

Page 99: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

+.0 ����������� � � � �=� � ���'�� _� � � � ��� � �������� ��� ����fjp�h b�`�wRgabWd�c��6`SpAgaeiwRl�c�f,eust`M ieoc�l�cUf.e�z\h�A$eof.lSl�`xb�z�cUeihjl�`Sc�euh ieoc�l�`*etgaz73i`�bJfMpd�l�`�rid;I#��b�`�wRgabWd�c��6`ylBAtri`st`M ieacUl�cUf.e�zuhQAueaf.l 3i`�d�hjl�c9d 4h%3av�` 4�hMeis�`��6`�e�c�p�cUl�c�d;4 cUl�zuhQAG3i`�stc �uwCgav�l�l�f1wRf.z�`IgarO"Sc�l�^�h�gid�`RpAgav_Qe�stgiwRl�c�f.e '�b�c�eiwCc�ravU`�pAf.b�cUlQI d_^a`Md�`�rob�f 3ov�`�zudiw�hMeQ3�`�wRf,etl�b�f,v�v�`�s�l�f*d�f,z�`J`B;ml�`�eml 3@A*l�^a`Jz�f.b�`�stc�d�wRc�ravUc�ea`�sgid�`%fjp�pAb�`�`%lBAtri`Md�hMeis ieoc�lWhMb A�wRf,eid�l�b�giwClWd<4�hjeis�st`M �eac�l�c�f.e�fjp�pAgaeiwRl�c�f,eidY^@hje�s�rab�`�stc�w�hMl�`Md�bSfM�6`�b!d�giw£^lFAmri`MdK3 Auw�h.d�`Md<I ) / �3I �@IN?@4 / � I��@I �j-

# � & 2 6=1 / 6 - *�/H1�01/�243=1�52/ / 5 3�243)1 5 /

n_f.l�^Oe�hjeisEg`iSj z�fmst`�v�d�`�D6ga`�eml�c9hjv�dFAod�l�`xzud�h.d!h%3id�l�bWh.wClEc�eoragal�xf.gal�ragalId�lkhjl�`�zuh.wW^acUea`Md<4 "Sc�l�^�f.r1q`�bWhMl�c�f,eid�pAf.b(w£^ihMe65.cUe65ul�^a`�d�lkhjl�`�rav�hQAmc�e65�l�^a`%rihjb�lEfMpSl�^o`�d�lWhjl�`�l�bkhjeid�c�l�c�f.e�b�`xv�hjl�c�f,e�I n_f.l�^�z�`�l�^ofmsad^ih��6`�`B;mrab�`Md�d�c��6`�vHA b�c�wW^$z�`MhMeid�pAf.b�d�ri`MwRc p+AtcUe65!l�^a`*d�lkhjl�`!hjeis�d�lWhMl�`�l�bWhMeid�cUl�c�f,eid<I#�¢wRb�c�l�c9wRc�d�z�"_`y^ih��6`�fMpl�^a`qe�hMrarab�f6h.wW^�4�^af%"_`x�6`�bQ4ac9d�l�^ihMl�c�l stf6`Md�eaf,lIstc�d�l�c�eP5.gac9d�^A3i`�lE"�`�`�e�l�^a`$�,hjvUga`Md�fMpSd�w£^o`�zuhE�,hjb�c�h>3ov�`Mdhjeis l�^a`ueihMz�`MdEfjp d�`xv�`MwRl�f.bEpAgae�wRl�cUf.eid98Zg`iSj hjvUv�f%"ydqd�giwW^ h�smc�d�l�c�eiwCl�c�f,e c�e lBAtri`1st`M ieoc�l�cUf.eid,3ogal�:wRgab�cUf.gid�v{A}:�eaf,lJc�e%f.ri`�bkhjl�c�f.e\st`M ieacUl�cUf.eid;I��`�rab�f.rif6d�`�l�^�hjll�^a`*stc9d�l�cUeiwRl�c�f.eC3i`*hjvUv�f%"_`MsEcUeC3if.l�^\w�h.d�`Md<I

) / � I � I � -g`iSj!q��m¡�c�e�wRv�gism`Md�eaf,lWhMl�c�f,e�pAf,byst`M ieacUe65�hjv�5,f.b�c�l�^ozud<I ) / � I � I FR-n_f.l�^$z�`�l�^afmsodJhjb�`Sv�c�z�c�l�`�sL"S^a`�e$cUlwRf.z�`Md l�f!st`Md�wRb�c:3ac�eP5H3i`�^ih��tcUf.gabkhjvarob�f.ri`�b�l�cU`MdJd�g�w£^%h,d�d�`�D6ga`�eiwR`�d fMpd�lWhMl�`�l�bWhMeid�cUl�cUf.eid�^ ��l�bWh,wR`Md �$b�4,f.b�pAf.b�st`M �eac�e65y^ac:5.^a`�b�q vU`��6`�vMf.ri`�bkhjl�c�f.e�d�c�e!l�`xb�zud�fMparab�c�z�cUl�cU�6`�f.ri`�bWhMl�cUf.eid;I��l�l�^a`_�6`�b�A�v�`�h.d�lC4jl�^a`�b�`�eo`�`Msad�l�f 3i`yh "�h�A!fMp4st`MwRv9hjb�c�e65Sl�^a`Sd�wRf.ri`_fMp h�d�r�`�wRc! 4wxhjl�cUf.e ^ `3I 51I�h.dJhSz�fmstgov�`f.b!h%wRv�h,d�d�b�44d�c�e�wR` pAf,b�`B;ohjz�rav�`H3i`�^�h��mc�f,gabWhMvJrab�f.ri`�b�l�c�`Mdyhjb�`Eeaf,l�rab�`Md�`�b��6`Ms2"S^a`�e1ea`B" f.ri`�bkhjl�cUf.eid*hjb�`h.sast`�s�l�f%h%d�ri`MwCc! 4w�hMl�cUf.e�I ) / �@I � I F 4 / � I � IN? -� l�^a`�b�f 3t�mc�f,gid�v�cUz�c�lkhjl�cUf.eidEcUeiwRvUgist`�g�d�`�fjp(wRf.e�wRgab�b�`�eiw<A 4�f 3 �`MwRl�f,b�cU`�etlkhjl�c�f.eP4�hje�s�d�r�`�wRc! 4wxhjl�cUf.e�fMpb�`MhMv{qAl�c�z�`�h,d�ri`MwRlkd�fMp�3i`�^ih��mc�f,gabQI d_^a`Md�` l�f.rac9w�dShjb�`!l�^a`Id�gP3 �`MwRlSfjp�f.eP5.f.cUe65�b�`Md�`MhMbWwW^�Id_^a`�b�`�c�d�z%giwW^¢hjea`�w�stf.lkhjv$`��mc�sm`�eiwR`�l�fd�g65 5.`Md�l�l�^ihjl�l�^a` wRf,eiwRb�`xl�`�dFAmetlkh>;¢fjp e d�ri`MwRcD 4w�hjl�c�f,eidy:d�ri`MwRcD 4w�hjvUv{A34al�^a`$d�w£^o`�zuh eof.lWhMl�cUf.e$:c�d�z�f,b�`!b�`�h.stcUv{Auh,w�wR`�ral�`Ms23@A1d�r�`�wRc! 4wxhjl�cUf.e@"Sb�c�l�`�bWdSl�^�hjehg`iSj 9 drab�f 5.bWhMz�z�cUe65WqAv�cH�6`$stc9d�rav9h�A�pAf,b�zud;I�d_^o`ud�wW^a`�zuh�eaf,lWhMl�c�f,e�c�dIwR`�b�lWhjcUeav{A�z�f.b�`�wRf,eiwRc�d�`�pAf,bE`B;mrab�`Md�d�c�e65dFAod�l�`xz rab�f,ri`�b�l�c�`Md;I ) / � I � IN? -

# � � 5 -<*�6 5��{6 - *�/H1�01/�243=1�52/ /�52' - 52/+*,/ 3 6

_Qe�l�`�b�z\d�fMpEl�^a`�d�gorarif.b�l1l�^a`CA rob�fM�tc9st`�pAf.b\d�l�b�giwRl�gab�cUe65[hjeis c9st`�eml�c�p+Amc�eP5�stc��4`�b�`�eml�wRf.z�rif,ea`�emlWdqfMpd�ri`MwRcD 4w�hjl�c�f,eid<463if.l�^�z�`xl�^afmsadShMv�vUf>"¢ravU`�etlBA$fMpb�f6f,z pAf,bSc�z�rob�fM�6`�z%`�etlCIg`iSj stc9d�l�c�e65,gac�d�^a`Md 3�`xl "�`�`�end�lWhMl�`344lFAmri`34tpAgaeiwCl�c�f,e�4��,hjvUga`$hMeis�f.ri`�bkhjl�c�f.e�st`M �eac�l�c�f.e�dM8ic�l*hjv�d�f�c�e�d�c�d�lWdl�^ihMl_rab�`MwRf.e�stc�l�c�f.e�d 3i` 5.cU�6`�e$`B;mrav�c9wRc�l�v{A�pAf.bl�^of6d�`ypAgaeiwRl�c�f.e�d�hMeisqf,r�`xbWhjl�c�f,eid)"S^ac9w£^�hjb�`�eof.lSsm`M iea`Ms$f.ehjv�v�c�eoragalWd;IG^ g`iSj hMv�d�f�^�h.d!d�ri`MwRc9hjv�eaf.lkhjl�c�f.e�pAf.b*`B;awC`�ral�cUf.e1^ihjeismv�c�eP51S�d�`�`%d�`�wRl�cUf.e + I ?qfMpI)"!.f.e +,0 h - I�be�z\h�6`Md$d�f.z�`@3agalueaf.l\hjv�v*fjpIl�^a`�h%3ifj�6`�smc�d�l�c�eiwCl�c�f,eid<I\_@e�f,bWst`�b�l�f c�eml�`�b�rab�`xl$l�^a`�z�`�hjeacUe65�fMp%hd�ri`MwRcD 4w�hjl�c�f,e�4ac�l�c�d_�mc�lWhMv�l�f%stc9d�l�c�e65,gac�d�^�l�^o` b�f.vU`Md_fjp�l�^a`!�,hjb�c�f,gid�d�ri`MwRc! �w�hjl�c�f.e1wRf,z�rif.ea`xetlkd<I

) / � I � I � 4 / � I � I � 4 / � I � IN? -d_^a`�pAf.v�vUf%"Sc�e65$b�f.v�`�d�pAf.b*d�ri`MwRcD 4w�hjl�c�f,e�wCf.z�rif.eo`�etlkd_d�^af.gav9s�hMv�d�f73i`�pAf.b�z\hjv�vHA�smc�d�l�c�e65,gac�d�^a`MsOSF ISb�`�D6gacUb�`�z�`xetlkd�fMp�st`�v�cU�6`�b�`�s�dFAod�l�`�zud<4acUeiwRvUgistc�eP5%wRf.eid�l�bkhjc�emlWd "S^ac�wW^1st`M iea`Il�^a`$b�`�v�hMl�cUf.eid�^ac�rid 3i`Qq

lE"_`�`�e�l�^a`Istc���`xb�`�eml_f 3 �`MwRlWd_cUeul�^a`IdFAod�l�`�z+8 ) / � I � I �j-

Page 100: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� �@��� � � � � �y��_� � � � � ��� ����#�������_� � � +JF?@ISrihjbkhjz�`xl�`�bkd\l�f�l�^a` d�ri`MwRcD 4w�hjl�c�f,eT^Ac�eiwCv�gistcUe65 �I3av9h.w�� 3if%; � pAgaeiwRl�c�f.e�d�hjeis l�^o`�c�b1rab�f,r�`xb�l�cU`Md�b 8

) / � I � I �.-� Iyhjg6;mc�vUc�hMb A1st`M ieoc�l�cUf.eidH"S^ac9w£^nhjb�`�hMb�l�c p}h.wRlkd�fjp�l�^a`$z�fmst`�v�vUc�e65%rab�fmwR`Md�d!hMeis�hMb�`%eaf.l*c�eml�`�eism`Ms�pAf.b

c�z�rov�`�z%`�e6lWhMl�cUf.e 8 ) / � I � I FR-� ISl�^a`yeihMl�gab�`�fjp�hMe�f,ri`�bWhMl�c�f,e�9;drab�`�wRf.eismc�l�cUf.e�S�c�IO`3I{4 "S^o`�l�^a`xb_c�lc9d�`xeih>3avUc�e65If.b�l�b�c:5 5,`�b�cUe651I¢) / � I � IN? -

[�f.l�`Sc�e$rihMb�l�c9wRgav9hjbJl�^ihjl�stc���`xb�`�eml.�mc�e�sad�fjp d�ri`MwRcD 4w�hMl�c�f,e%wRf.z�r�f,ea`�eml�5.`xea`�bWhMl�`ystc��4`�b�`�eml��tcUeisad�fMp�rab�f6fjpf 3avUc�56hMl�cUf.eid;I ) / � I � I �.-��`�wRf,etl�`�eis l�^ihjl1h�l�b�ga`�gaeist`xbWd�lkhjeismc�e65 fjp(h d�ri`MwCc! 4w�hMl�cUf.e�9 dqragab�r�f�d�`�hjeis¢d�wCf.ri`�c9dqeaf,l�rif�d�d�c:3av�`"Sc�l�^of.galIzuh�mc�e65�l�^a`�h>3ifM�6`�smc�d�l�c�eiwCl�c�f,eid!wRv�`�hjbIhjeis�l�^ihMl l�^a`$pAf.b�z\hjveaf.lkhjl�c�f.e d�^af,gav�s�d�gararif.b�l$d�giw£^stc�d�l�c�e�wRl�cUf.eid;I

# � � 6 6 *��Z3=1�52/E6�1%/ 6 - *�/H1�0O/�243)1 5 /E6

n_`�lE"_`�`�e%l�^o`�z�4tl�^a`!lE"_f$z�`�l�^afmsad�hjv�vUf%" h,d�d�`xb�l�cUf.eidSc�eul�^a`�pAf.v�vUf%"Sc�e65$rav9h.wR`�d_c�e1hqd�ri`MwRc! �w�hjl�c�f.ePSH sahjlkh�lBAmri` cUet�,hMb�c�hMetlkd�^ cUeiwRv�g�stc�e65Il�^a`Id�lWhjl�`!c�em�.hMb�c9hjeml<b 8H�c�eacUl�c9hjv�c:�Mhjl�c�f,e�wRf,eistcUl�c�f,e 8H�rab�`Cqhjeisurif6d�l�[email protected]�cUf.eid�fMpJf,ri`�bWhMl�c�f,eid�hMeis�c�z�ravUc�wRcUl�pAgaeiwCl�c�f,e1st`M ieacUl�cUf.eid98H�rab�`�wRf.eismc�l�cUf.eid_fMpJ`<;travUc�wRcUl�pAgae�wRl�cUf.e1st`M ieoc�l�cUf.eid;I

n_galSl�^a`xb�`!hMb�`Ez\hje Aqf,l�^a`�bSrov�h.wC`MdK"S^a`�b�`Eh,d�d�`�b�l�c�f.e�d�wRf,gav�s�gid�`RpAgavUv{A73�`!zuh,st`3S�pAf.by`B;ahMz�ravU`F ISv�f 5.c�wxhjv�wRf,eid�`�D6ga`�e�wR`Md�^����,hjvUc�sahMl�cUf.e�wW^a`Mw��od �$b�fjp�hjvUv�fjpl�^a`Ih>3ifM�6`�:¢h,d_f.rarif6d�`Ms�l�f%wCf.eid�l�bWhMc�emlWd98

) / � I � I ? 4 / � I � I �[email protected]�d�gaz�rol�c�f,eidSh>3if,gal�rihMbWhjz�`�l�`�bkdM8 ) / � I � I �.-� ISc�eismgiwRl�cU�6` ^ 3i`�^ih��tcUf.gabkhjv+brab�f,r�`xb�l�cU`MdSfjp�dFAod�l�`xzudM8 ) / �@I � I � 4 / � I � I FR-� ISrab�f,ri`�b�l�c�`Md�"S^ac9w£^%d�^af.gav9sq^af,v�s%hjl�hjvUv�l�c�z�`�d<4Meaf.l �gid�l)3 A$l�^o`�l�c�z�`�hje%f.ri`�bWhMl�cUf.e�b�`�l�gab�eid<I4) / � I � I �j-

d_^a`$�6fmw�h>3ogav�hMb A�fjp�h,d�d�`xb�l�cUf.eid!wRf,gav�s�g�d�`RpAgavUv{AG3i`q`<;tl�`�eist`Msul�f1wRfM�6`�b 3i`�^ih��tcUf.gab*fjp�dFAod�l�`�zud<44d�g�w£^�h,drab�f,r�`xb�l�cU`Md_fjp�d�`�D6ga`�eiwC`Md�fMpf.ri`�bkhjl�cUf.enw�hjvUv�d<I ) / � I � I �j-

# # � �Z5.5��{5�� -%1 � 243)1 5 /E6

d_^a`�pAf.b�z fjp�rab�f6fjp�f 3av�c:56hjl�c�f,eidSst`�l�`�b�z�cUea`Md�`B;oh.wRl�v{A,"S^�hjlSh,d�d�`�b�l�c�f.e�d_l�^a`*d�ri`MwRcD i`�bea`�`�sadJl�fEcUeiwRvUgist`Sc�eh d�ri`MwRc! �w�hjl�c�f.e%c�e%f.bkst`�bJpAf.b�c�lJl�f,3i` "_`�vUv{q�pAf.b�z�`MsOILw�hMb�`RpAgav4hMl�l�`xetl�c�f.e%l�f!l�^a`�pAf,b�z fMp�rab�f6fjp�f 3ov�c�5�hjl�c�f.e�dc�dql�^tgid�b�`�D�goc�b�`�s c�e¢f.bkst`�bul�f `�e�d�gab�`�l�^a`+3i`Md�l 3i`�eo`M ilWdqpAb�f.z hje�hjv{Aod�c9duhjeis��6`�b�cD 4w�hMl�c�f,e�I g_hMb�cUf.gidst`M 4wRcU`�eiwRcU`Md�^ih��6` 3i`�`�e$b�`��6`MhjvU`Ms cUe$l�^a`_pAf,b�z fMp�rob�f6fjp�f 3av�c:56hMl�c�f,eid�5.`�eo`�bWhMl�`Ms,3 A psrQtQu)v?I ��e$c�z�rab�fM�6`Msd�`�lSc9dK5.c��6`xe�c�e ��rari`�e�stc�; � I ) / � I � I � 4 / � I � I � 4 / � I � I � -

Page 101: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

+ ? ����������� � � � �=� � ���'�� _� � � � ��� � �������� ��� ����'�v9h.wR`�dK"S^a`�b�`!z�f,b�`H"�f.b���c�d_ea`x`Mst`Ms�l�fEpAf,b�z%gav�hMl�`!hMrarab�f.rab�c�hjl�`Erab�f6fjpf 3av�c:56hMl�c�f,eidSc�eiwRvUgist`3S

F ISgid�`!fMpc�eismgiwRl�cU�6`�rob�f.ri`�b�l�cU`Md_l�f%rab�fM�6`�f,l�^a`xb�cUeistgiwRl�c��6`yrab�f,ri`�b�l�c�`Md98 ) / � I � IN? -?@Iyhjv:5.f.b�c�l�^az ^ rob�f 5,bWhMz!b�6`�b�cD 4w�hMl�c�f,e+8 ) / � I � I FR-� IydFAod�l�`�z c�eml�`<5.bWhMl�cUf.e 8 ) / � I � IN? -� ISb�`MwCgabWd�c��6`ylFAmri`Ist`M ieacUl�cUf.eidH8 ) / � I��@IN? -�@ISf.l�^a`�bSv�hMe65.g�h>5.`(wRf.e�d�l�b�giwRlkd<4ic�eiwRvUgistcUe65ErihMl�l�`�b�eidyhje�s�sm`M ieacUl�c�f,[email protected]�`�d<I ) / � I��@I �.-

#�� ,.- *�/H1�01/�243=1�52/ � *�/H176)1 52/ 6 2���* /c3 3)( * � * � 1�01/�243=1�52/ 32 6��

d_^a`1d�ri`MwRcD i`�bEc9d fMpAl�`�e�p}h.wC`Ms "Sc�l�^[st`MwRc9d�c�f,eid "S^oc�wW^ h_�4`MwRl$l�^a`��6`�b�c! 4wxhjl�cUf.e�lkh.dB���Jc pyeaf.l%d�g63id�`�ga`xetlst`��6`�vUf.raz�`xetl���`� 5�

F S`B;oh.wRl�v��7"S^ac�wW^qpAgaeiwCl�c�f,eihjvUc�l���d�^af,gav�sG3�`!cUz�rav�`xz�`Reml�`�s 8 ) / � � FR-?� S^af%"�l�fqz�fmst`�v�h$rihMb�l�c9wRgav9hjbywRf,eiwR`�ral<8 ) / � � N? -� S^af%"�z%giwW^�b�`�stgaeisahMeiw���l�f$c�eml�b�fmstgiwR`�� c phMe���� 8 ) / � � �j-� "S^a`�l�^a`�bSl�f$g�d�`$hMeu`B;tl�bWh$d�lWhjl�`E�,hjb�c�h%3av�`!f.b*hje1hMg6;tcUv�c9hjb��$pAgaeiwCl�c�f,e 8 ) / � � ?�� / � � N? -�� "S^a`�l�^a`�byl�f�d�lWhMl�`%hqb�`�6gac�b�`�z�`�e6l�h.dyh�wRf.e�d�l�bkhjcUetlyc�enhje�c�em�,hjb�c�hjemlyf.b*h.d�hMe�c�eistg�wRl�cU�6`�rab�f,ri`�b�l��

l�fC3i`Erob�fM�6`Ms� ) / �� � �j-

w�hjb�`CpAgavJhMl�l�`�etl�c�f,e�l�f�l�^a` "Sh��1h�d�ri`MwRcD 4w�hMl�c�f,e�c9d�d�lWhjl�`Ms�w�hMe�zuh��6`Eh73ac�5�stc��4`�b�`�eiwR`!l�f�`Mh.d�`EfMp_�6`xb�c! ��w�hjl�c�f.e� y) n �J¡! +��6- hjeis�) �j + �M- smc�d�wCgid�dl�^a`�rob�f6dShMeis�wRf,eid_fjp�b�`Mh.d�f.eacUe65%h>3if,galystc��4`�b�`�eml_d�ri`MwRc! �w�hjl�c�f.ev�hjeP5.gih%5.`$wCf.eid�l�b�g�wRlWd" ) / � � � � / �� � � � / � � N? -#Qe@5.`�eo`�bWhMv$�al�^o`Ez�f,b�`IwRf.e�wRc�d�`Eh%d�ri`MwCc! 4w�hMl�cUf.e!�il�^a`!vU`Md�d "_f,b �ul�^a`xb�`Q"Sc�vUv 3�`Ic�e1�6`�b�c p%�tcUe65EcUl� '&�f%"�`��6`�b��l�^ac9d�ea`�`�sadJl�f,3i`H3�hjv�hMeiwR`Ms�h>56hMc�eid�lSl�^a`yb�`�h.sah%3ac�vUc�l��EfMp�l�^a`!d�ri`MwRc! �w�hjl�c�f.e�� "S^oc�wW^qc9d)5.`xea`�bWhMv�v(�$c�eiwRb�`Mh.d�`Ms3���3i`�c�eP5 h>3avU`�l�f h,sas�st`M �ea`Ms wCf.eiwR`xralWd" ) �6z�c + ? - wRf.emlWhMc�eid�pAgob�l�^o`�b�smc�d�wCgid�d�c�f.e�fMpIl�^a`�wRf,e$�ic9wRl�cUe65b�`�6gac�b�`�z�`�emlWd�fjp�d�r�`�wRc! 4wxhjl�cUf.e1hje�s�rab�f6fjp) ) / � � �j-

# $+* � 9 352' 243�* � 2./ 2.- �o6=176 3�*�/ (O/ 1�, 9+*�6

� emgaz73i`�bfjp�hMeihjv(�ad�c�dShje�s��6`�b�c! 4w�hMl�cUf.e�lkh.dF�odywRf.gav9s�gid�`RpAgov�v��73i`Ihjgal�f.zuhMl�`Ms��ihMl�vU`Mh.d�lSc�eurihMb�l��

F Sl��tri`��}w£^o`Mw��mc�eP5-�/.0-120 e!� ) / � � F � / � � N? -?� "_`�vUv���pAf.b�z�`Mstea`�d�dw£^o`Mw��mc�eP5 ) / � � �j-� yw�hjv9wRgav9hjl�cUf.e�fMpl�^o` "�`Mh�6`�d�l_rob�`MwRf,eistcUl�c�f,e ) / � � � -

Page 102: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� � � �� � ��� �

� ��� ��� ��� � ���� ��� � � � �L� � �

�_^ac�dIhjrari`�eismc�;�f.gol�v�cUea`Md�l�^o`qzuhMc�e�hjeihMv��od�c9d hMeis��6`�b�c! 4wxhjl�cUf.e�l�`Mw£^oeac 6ga`Md�pAf,b� ���� ���m¡ l�^ihjl(hjb�`q`B;��rav�hMc�ea`Ms�cUe�)����J¡! +��6- ���c�5,gab�`�d �� F�� �� ��$d� 6`�lkw£^ul�^o`Eh%;tcUf.zudShMeis�rob�f6fjp�f 3av�c:56hjl�c�f,eid�wCf.b�b�`Md�rif,eistc�eP5�l�f`Mh.wW^ufjp�l�^a`!zuhMc�eud�r�`�wRc! 4wxhjl�cUf.e1wRf,eid�l�b�giwRlkd�pAb�f.z! "�#� ����¡ �_^a`yh>;mc�f,zud�hjb�`_pAf.b�z%gav9hjl�`�s cUe%d�giwW^$h "Sh��$h,d�l�f!h,st^a`�b�`Sl�f�l�^a`Sd�l�b�c�wRl�gab�`Md�fjp ¡�'$� �j`xeaf.g65,^q^��mr�f,l�^a`�d�`Mdhjb�`R5.cU�6`�e�l�fy`�eid�gab�`�l�^ihMl�l�^a`�wRf.e�wRv�gid�c�f,eid�hMb�`��.hMv�c9s��B"Sc�l�^af.gal�h.d�d�gaz�c�e65yc�eIh.sm�.hMeiwR`�l�^ihMl�l�^a`�st`M ieacUl�cUf.eidhjb�` "_`�vUv���pAf.b�z�`Ms� $�_^mgid��apAf.by`B;ohjz�rov�`��6l�^o`$h>;mc�f,z "S^ac9w£^uc�eml�b�fmstgiwR`�d�h%stc�b�`MwRl_pAgae�wRl�cUf.e �}d�`�`%��c:5 �� ?��^ih.d!^��mrif.l�^o`Md�`MdQ"S^ac�wW^�`�eid�gob�`%l�^ihMlEl�^o`uhjb 5.gaz�`xetlkd�hjb�`2"_`�vUv���pAf.b�z�`Ms�hMeis�fMpyl�^a`�wRf.b�b�`MwCl l��mri`���l�^ihjll�^a`$rab�`MwRf,eistc�l�c�f,e�^af.v9sad�� 0'&)( l�^�hjl�l�^a` (+*-,�&/.0*1&/('2+3 � 3ifms�� �yfMpSl�^o`%st`M ieacUl�cUf.e�c9dL"_`xv�v���pAf.b�z�`Msuhje�s fMpl�^a`�wRf.b�b�`MwCl�l��tri`� 4�_^a`�b�`�hjb�`�d�`�rihMbWhjl�`�rab�f6fjpyf 3ov�c�5�hjl�c�f.e�d l�f1d�^af%" l�^ihMlEl�^o`qrab�`MwRf,eistc�l�c�f,e�c9d h2"�`�v�v(�pAf.b�z�`Ms(pAf,b�z%gav�h��6hje�s\l�^ihjl�l�^a` (+*-,�&/.0*5&)('2+3 c9d)"�`�v�v(� pAf,b�z�`MsIhjeis�fMp�l�^a`!wCf.b�b�`MwRll��tri`� � eiwC`�l�^a`�rab�f6fjpf 3avUc�56hMl�cUf.eid^ih��6` 3�`x`�eq`�d�lWh%3av�c9d�^a`�s��6c�lc�dJ`Mh,d �$l�f(st`�b�c��6`Sh �I"�f.b6 mc�eP5 �6`xbWd�cUf.e ��fMp�l�^a`yc�eml�b�fmstgiwRl�c�f.e%b�gov�`pAf.bSl�^o` pAgoeiwRl�cUf.e!�acUeul�^a`�pAf.b�z

7 �98�:<; �9=<:?>A@CB * � 7 :D;��> � 7 :�;��FEG> (+* >�� 7 :�;���_^a`�b�f,v�`%fjp "�`�v�v(� pAf,b�z�`Msmea`Md�dSrab�f6fjp*f 3avUc�56hMl�cUf.eid!c�d l�f�wW^a`Mw� ul�^ihMl$st`M �eac�l�c�f.e�dEhjb�`IHKJ+L ¡M HKJ+L�NPO'J/Q0Q-RO'STHKUVQ M L M W�_^a`."�`�v�v(� pAf,b�z�`�stea`Md�d�rab�f6fMpyf 3avUc�5�hjl�cUf.eid pAf,b!l�^a`usmcYX4`�b�`xetlId�ri`MwCc! 4w�hMl�cUf.e�wRf.eid�l�b�giwRlWdIw�hje3�`!rihMbWhMra^abWh,d�`Ms�h,d�pAf,v�vUf>"yd"�

O'STHKU$S[Z\N]L M L�RVU M st`9 ieac�l�c�f,eid��Jl�^a`!c�em�.hMb�c9hjemlSc�dShC"_`�vUv���pAf.b�z�`Ms(pAf,b�z%gav�hJ8^ NP_ M O`L%aAbcVO`L�NPS[c st`9 ieac�l�c�f,eid��Jl�^a`�rab�`MwRf.e�stc�l�c�f.euc9dSh,"_`�vUv���pAf.b�z�`Ms(pAf,b�z%gav�hJ86l�^a` (+*-,�&).0*5&/('2d3 c�dK"�`�v�v(�

pAf.b�z�`Ms�hMeis�fMpJl�^a`IwRf.b�b�`MwRlSl��mri` 8N0c ^ NP_ M O`L%aAbVcO`L�NPS[c st`M ieoc�l�cUf.eid"�Jl�^a`yrab�`��JhMeisqrif6d�l��}wRf.e�stc�l�c�f.e�dShjb�` "_`�vUv���pAf.b�z�`Ms pAf,b�z%gav�hM`+� eaf,l�`�l�^ihjl

l�^a`!rif6d�lWwRf,eistcUl�c�f,e�c9d_f.eav(��b�`�6gacUb�`Msql�f.3i`Q"_`xv�v���pAf.b�z�`Ms$f.e1l�^a`�pAgaeiwCl�c�f,e�9;dSsmf.zuhMc�e�� 8Z9L�J+L M sm`M ieacUl�c�f,eid��Jl�^a`Id�lkhjl�`!cUet�,hjb�c�hMetlyhMeis�cUeac�l�c�hjvUc�d�hjl�cUf.euwCf.eistcUl�cUf.e1hjb�` "�`�v�v(� pAf,b�z�`�s(pAf,b�z%gav�hM` 8STU M _�J+L�NPSTc st`M ieoc�l�cUf.eid"��l�^a`�rab�`�� hjeis!rif6d�l)�@wCf.eistcUl�cUf.eidhjb�`K"�`�v�v(� pAf,b�z�`MsSpAf.b�z%gav9hj` � eaf,l�`�l�^ihMlJl�^a`�d�lkhjl�`

c�em�,hjb�c9hjeml!w�hMe�3i`�h,d�d�goz�`Ms�c�eO3if.l�^ w�h.d�`Md���hMeis�l�^�hjlEl�^a`$rab�`MwRf.e�stc�l�c�f.e�w�hMe 3i`uh,d�d�goz�`MsA"S^a`�est`MhMv�c�eP5C"Sc�l�^ul�^a`!r�f�d�lkwRf.eismc�l�cUf.e��

egf

Page 103: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

e � ��� ��� ��� � ��� ������������ �� � ����� � � ������� ���

�������������� �(� 0 �58

� �9=� ��! 3�" �#� � 7 :�;�� $ � .]&&% � 7 :�;��

')(*� +&,.-/&0�1.2�340657278:9<;4=?>�/&2@3*A

B.C#D�8E>�/&2@3*A�0?8B.C�D�8�>�/�2F3?A�0*8

8:9<;4=?>�/&2@3*AB.C�D�8�>�/�2F3?A�0*8

B.C#D�8E>�/&2@3*A�GIHKJL/B.C#D�8E>�/&2@3*A�0?8

B.C#D�8E>�/&2@3*A�G<MNJO3 PFP@P

�)�<+*+RQS+�T�UV� WX���6� +���-

/�0�1.2�340Y58:9Z;[=*>�/�2F3?A�0�\ ]*/&0^1_2@340Y5`Pa8:9Z;[=*>�/�2F3?A

�cb�5#d�e^f �� F �#�L;4b<g#hjiSkmlonjp�e^g*gRqSg 3�rZb�5Xkms^bZg�loiEqtg�e_k u@g#hvpog*iwbZs^f�s��4pof�n4fM ol�bZs^b<g#lx�

y*z@{t{}|�~t�� 0�1���5O���� >�/�2F3*A $ �Y�R��� >�/&2@3*A� ~<|��t�&��� >�/&2@3*A

����� �*�/�0�1.2�340Y572�t�&��� >�/&2@3*A�2�Y�R��� >�/�2F3?A�0Y�

� >w/&2F3?A)J �Y�R��� >w/&2F3?A

�)�<+*+RQS+�T�UV� WX���6� +���-

/&0^1_2�3[0Y5�}�&��� >w/&2F3?A�0�\

/&0^1_2�3[0Y572 �}�&��� >�/&2@3*A�Y�R��� >�/&2@3*A�06�

��b�5�d&e^f �� ?����L;4b<g#hjiEkRlon�p&e^g*gmq�g 3�rZb�5*kRs^bZg�loiEqtg�e_k n[b<e�fRu@sSqtd�lou@s�b<g�l�n[f9 ol�b<s�b<g#l >�

Page 104: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

e �

�������������

� � 7 �98#:D;��5=���B����� ��� � @CB * � 7 :�;��� +#-^� � @������� 7 :D; :DB �

')(*� +&,/&0^1_2�3[0Y572 ��� � >�/�2F3*A^2

] � 06� P� ���� �� >�/&2@342 � A[>�/&2@3*A�06���� ���� �� >w/&2F3[2�[>�/�2F3?A�A

�)�<+*+RQS+�T�UV� WX���6� +���-

/�0�1.2�34065 �&��� >�/&2@3*A�0w\

/&0^1_2�3[0Y572 � 06�_2 �&��� >w/&2F3?A

���� �� >�/�2F3[2 � A�0�\

/�0�1.2�340Y572 �&��� >�/&2@3*A

] � 0Y� P ���� �� >�/�2F3[2 � A

��b�5�d&e^f �� f �#�L;4b<g�h iNkRlon�p&e^g*gmq�g 3�rZb�5*kRs^bZg�loiEqtg�e kml�b<lon[bZe^fRuFs�qtd&lou@s^bZg�l�n[fM al�b<s�b<g�l �

�������������-��^��������+RQ

0 �98� �9=� ���

� ��! 3�" � � � 7 :D; :��� $ � .]&&% � 7 :�;/:����� ��� � � $ .]&/. �"��� �

�����

')(*� +&,.-/�0�1.2�340Y572! 40�"72# 9<;4=?>�/&2@342� �A

B.C#D # >w/&2F3[2� *A�0 #f sYu �&k�iEqtg�e_u@g#hvpog*iwbZs^f�s��4pofRi

�)�<+*+RQS+�T�UV� WX���6� +���-

/�0�1.2�340Y572! 40�"# 9<;4=?>�/&2@342$ *A 0w\

0 #9<;49 � > A�0�\ ] 0 # PR9<;49 � > A

�cb:5�d�e�f � � � �L;4b<g�h iEkmlan�p�e�g*gmqSg 3�r<b:5*kms�b<g#loi qtg#e_k i�sYkRs^f n[fM ol&b<s^bZg�l �

Page 105: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

e�� ��� ����� ����� ��� ������������ � � �� � ��� � ������� ���

��������������� � . ��� ��B�����6(R� � � 0 �98

� ��� �9=� ��� �9@CB * � . : 0 : � �� +#-^� �9@ ����"� . :DB : 0 :����� : � �

�)�<+*+RQS+�T�UV� WX���6� +���-

9�0��42�B.C#D # >�/&2@342$ *A�0 #�^�&��� >�9�26/&2@3*A�0w\

9^0��42 � 0Y�_2B.C#D # >�/&2����3�2� *A�0 # 2SB.C#D # >�/&2@342� *A^0 # 2

�^�&��� >�9�26/&2 ���3�A�^���� �� >�9^2 � 2Y/�2����372@3*A�0w\

9^0��42EB.C#D # >w/&2 ���3 2$ *A�0 # 2�^��� � >�9^2Y/�2����3KA

] � 06�_2F34065 P # 9<;4=*>w/&2F3[2� *A � �^���� �� >�9^2 � 2Y/�2 ���3�2F3?A

�cb:5�d�e�f � ���#� ;[bZg�hjiSkmlan�p�e�g*gmqSg 3�r<b:5*kms�b<g#loi qtg#e�kRljg�pof�eYkRs^bZg�l`iwpofRuFb! :u�kRs^bZg�l ��

����f g#s���f e# [bZlon gmq p�e^g*gRq_g 3�rZb�5Xkms^bZg�l`b�i�u kmr<rZfRn k Z\J+L�NPZ�� J �VN0QPN L�R p�e^g*gRq_g 3�rZb�5*kRs^bZg�l!��bZs�u���fRu� &i s!�okms kmlb<hvp�rZb�u@bZsSn[fM al�b<s�b<g�l b�i�HKJ+L#" M HKJ+LDN0O'J/QPQ-R O'STcVZ\NPZ9L M cTL �tg�e_hjkms!��f�hjkRs^b u�kmrZr � hvfRkRl�b<l65Rqtd�r � �*b<ljs���f i�f�loiwfs��okRs s!��f�e^f fB;[b iws i k hjkRs���f hjkms�b�u�kRr�g 3 $�fRuFsC"%��b�u��Oi^kms�b�i ofRi�s��&f n4fM ol�bZs^b<g#l! K����f i^kms�b�i :k>3�bZr<bZs �`p�e�g*gmqg 3�rZb�5*kRs^bZg�loiEqtg�e_i�p f u@b! :u kms^bZg�l�u@g#hvpog�l�f�l4sYi�u kmlG3of�pokReYkmp&��eYk#iwfRn�k�iEqtg�r<rZg%"_i��

O'STHKU$S[Z\N]L M L�RVU M n[f9 ol�b<s�b<g#loi���s!��f�e^f7fB;4b�i�s%'#kmr<d&fRi�i^kRs^b�i�q%�[bZl65 s��&f�bZl('#kRe^b�kRl[s+�ts���f7s��4p f b�iEb<l&�ok>3�bZs^fRn�� 8N0c ^ NP_ M O`L%aAbVcO`L�NPS[c n[fM ol&b<s^bZg�loi"�cqtg�e kmrZr)kme 5�d�h f�l[s iEb<lvs!��f n[g�h kmb<ljgRq�s!��f�qtd�lou@s�b<g�l��[s��&f�e^f7b�i�kRs�r<fRk#iws

g�l�f u@g#e^e�fRiwpog�lan[b<l65 e^fRi�d�r<sR"%��b�u���i^kms�b�i ofRi�s���f7pog*i�sYu@g#lon[b<s�b<g#l 8Z9L�J+L M n4fM ol�bZs^b<g#loi���s!��f�e�f�b i�kms�rZfRk�i�s�g�l�f p gXi^i�b�3�rZf�bZl�b<s�b�kRr)iws kms�f ��kRlonvs��4doi�� 0 > �'B�� . �'B . �*s���f i�sYkms�f i�pok�u@f

b�iEl�g#l �tf�hvp�s���� 8STU M _�J+L�NPSTc n[fM ol&b<s^bZg�loi"��bIq�s!��f g#pof�eYkRs^b<g#l b�i�f�lak>3�rZfRn qtg�ejk+5�b)'*f�lLb<l�p�d&s kmlonOiwsYkRs^f�gmq7s!��f i���i�s^f�h �

s���f lvs���f e^f7fB;4b�iws iEk�s�eYkmlaiwb<s�b<g#l�s�g iwg#hvf�g�s!��f�e iwsYkRs^f��6"�bZs���kml�kRp�p�e^g#p�e^b kms�f�g#d�s^p&d�s*'#kRr<d�f��J"%��b�u��i^kRs^b�i ofRi�s���f7g#p f eYkms�b<g#l,+ i�i�p f u@b! :u kms^bZg�l!

� g s���f iwf uFg�d�r n 3of k�n�n[f n k i�kms^b i :k%3�b<rZb<s��vp�e�g*gmqSg 3�r<b:5*kRs^b<g#l s^g i-��g%"�s!�okms_s��&f�e^f b�i�kms_r<f k�iws_g�l&f iwf s.gRqu@b<e u@d�hji�sYkmlau@fRi�d�lon[f e "%��b�u���kml g#pof�eYkRs^b<g#l b iEf�lok>3&r<fRn��

]49^0��42FB.C�D # >�/�2F342$ #A^0 # P �^�&��� >�9^2Y/&2@3*A

� kRb<rZb<l65vs�gjn[b i^u��okme 5�f kji^kRs^b�i :k>3&b<r<bZs���p&e^g*gmq g 3�rZb�5Xkms^bZg�l`gmqts�f�l e^f'*f kmr�i.��b�n�n4f�l`k�i�iwd�hvp&s^b<g#loi�k%3 g#d�s7s���fu@g�lon4b<s^bZg�loiEd&lon[f�e "%��b u��js!��f7g�pof�eYkRs^bZg�lA"�bZr<r 3 f b<l/'*g` *fRn/

Page 106: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� � � � ��� ����� � �

� ��kme������ ! `��kRe���b iwf� �.l bZl[s�e^g4n[dau@s^bZg�l s^g��oe iws)�}g#eYn[f�eSrZg 5�b u �#�l�! '��kme���b�i�f_kmlon�&� �! ���f�b�i�r<f�e��mf n[b<s�g�eYi"�� 0'&)( � ��� " ��>�� 0 ��� *53 0 � . ��0 1 � � �'. � �ou��okRp�s^f e"!� $# ��pok&%�fRi � � � � ('.g#e^s����$&.g#r<r kmlon��)# e ����

� �+*-,/. � � &� /��kRe^e�b<l0%#f�e��1, &� 0*���f�l1% �okmlan2* � 1,�g�l�f i� 3! rZg�%�b u7u@g#'*f�e^bZl0%�d�lan[f4�ol�f n[l�fRi�iEb<lvp�e�g�%#eYkmhp�e^g*gRq i� �8 � � 0 � & > �'B 3 0 � . ��0 �056# �75g�6# � 5 �ge �3# e . �

� ���98! e � �:, ;* �Eb�u�kRe^e^f�%�d�b �&, Y�� �cb<s�<=%�f�e kmr n��&> ?!� =8�bZlon�i^k�����@+ \� g*g�e�f��#kmlon%� =@�b<sYu���bZf� B ����> .]&BA C �ED0 B 0�� � . � . � &T* B0F �HG 2+.](+* C�0!�* #A� �Xf�e^bZfRi� '�*p�e�b<l0%#f�e��P Sf�e^r kI% �1# e`e�� #6�d�"' l&g f � � �KJ ��# e .L# f �NM

� �+OP� , /�Eg&�Ef l kRlon � QO_g�eYn4g�l! +R kmlan &TSU8 $�.e k qts���s�gWVof iwd1V�hvb<s�s^fRn s^gXR(Y#� + e�� � �"' e 5I� �� � C�Ee^bZf�l`kmlanZ, ?[ \'.b�u���g�rZr�i" ]R ��k�iwfI�XsYkmlan�kme n��? �f�e iwb<g#l^# J W� f u���l&b�u�kRr9@�f�pog�e�s �_@+*

� � # f 5��`SPa*qtg�eYnbY.l&b '*f�e iwb<s��c>�e^g�%�e kmhvhvbZl0%d@�fRi�fRkme u��BO_e^g#d�p!�Q'.g#'*f�hcVof�e"# ege 5� � �Ee^b e`f � �Ee^bZs^b�i � �*s kmlon&kmeYn&i�#�loiws�b<s�d�s^f��(e g#e6 4b<l0%BO_e^g#d�p #6�d�+fD�_fK# e A C � � @ *��\. , ��0 � . � &2� 0'& �'2�0��+*

B � � ��g � � 0'&/(�0 B ( D C B 0 >�%�0'_g '*f hWVof�e"# e`egf � *"OU@ egf � �� *SeYkRbh%#f�l!���� O_f�e��okRe^s��okmlon � Q@_kmr iws^g#l! "!.l #�l4s^f�e�lokms�b<g�lakmr?�*d�e!'*f��vgRq #�lon[doi�s^e^b kmri!.p&p�r<b(�

u�kms�b<g#loiEgmq ��g�e^h kmrC� f�s��&g4n�i��/ Sg�rZd�hvfH# �3>�d�e�p gXiwf��(!.p�p&e^g*k#u����0!.lokRr��&iwb i�kmlonj*Sg�lau@r<doi�b<g#loi� � f u���l&b�u�kRr�@�f�pog�e�s Sg�rZd�hvfk# �lY� Y�� "'�kms�b<g#lokmr #�loiws�b<s�d�s^f gRq �*sYkRlon�kme n�i kRlon �)fRu���l�g�rZg�% ���*Sg�hvp&d�s^f�e ���&iws^f hjim8)k&V g#eYkRs^g�e)����O kmbZs���f eYinV&d�e�%��[� �o5 J . e`e �\!.p�e^bZr9# e`e`f

� *���f&. � � , &� 0*���f l0% -!�r<g�%#b�u qtg#e.pakme^s�b�kRr�qtd�lou@s�b<g�lai� $�)fRu��&l�b�u�kRr(@ f�pog#e^s��EfRu��&l�b�u�kRr)@�f�pog�e�sPY#�Z*����. � �n����# �0Y.l�b)'*f�eYi�b<s��_gmq � kmlou���fRi�s^f�e��'�.f�pakme^s�hvf�l4s)gmqi*Sg�h p�d�s^f e �4uFb<f�louFf��6# e . � (> � � ����fRiwb i�

� ��k=� e #�� , /��k=��fRi� � � *bA C �Bg � � � * > * B *5& �9* G 2+.](+* 3>�bZs^hjkRl!� # e`e # � � &�@P.�.&�p@ g�%�f�eW�_d/ *f�� #wkRl &�k��*fRi"�SkmlonqO_g�eYn4g�lr@�g*iwf Sf�e�b;�:u�kRs^bZg�l�gRq ks* �&u@rZb�uX@�f�s^e kmloi�hvb�i�iwbZg�l

>�e^g�s�g4u@g�r � f u���l&b�u�kRr3@ f p g#e^s e 5��3��f��Z*Sf�l4s^e�f qtg#e<�*gmqtst��kRe^f �Ef u���l&g�r<g�% ���V�.f pokme�s^hvf�l4s�gRq*Sg�hvp&d�s^f�e �4u@bZf�lou@flY_l�b '*f�e iwbZs � gmq"u_d�f f�loiwr kmlon/�0!.doi�s^e kmr<b k��Q,�d�r(�B# e .�.�

� ����� e #4� @ g�%�f�e��.d) *f��6O_g�e n[g�lv��b<l0%��L>NkRd�r(@ gXiwf��4kRlonwO_eYkRf�hvf �Xhvb<s!�! [����flS+V $�f u@s��tR �*pofRu@b;� u�kms�b<g�l8)kml0%#dokI%#f� $�)fRu��&l�b�u�kRr(@ f�pog#e^s e #"�x5�� �*gmqtst� kme^f� �f�e^by�:u�kRs^b<g#lb@�fRiwfRkReYu��w*Sf l[s�e^f��)�.f�pokRe^s^h f�l[sgmqP*Sg�h p�d�s^f e �4uFb<f�louFfdY.l�b)'*f�eYi�b<s�� gmq�u_d�f f�loiwr kmlon/�)!.doi�s^eYkRr<b k��9# e`e # <�)fRu��&l�b�u�kRr9@�f�pog�e�s�b<lp�e^f pokme kms^bZg�l!

� �?� egf � , �� V�cbZs�<=%#f�eYkRr�n kmlanZ@+ �� g*g�e�f� X[9a4pof�e^bZf�lou@fRi_b<lG�.f'*f r<g�p&b<l0%jkb>�e^g*gRq�����f�g#e�� qtg�e% ��#��*pofRu@by�:u�kms�b<g#loi� #�l B�� �9*�* ('.]& � � ��> ��� *kz�. B �� � & � * B & 0 � . � &�0 1k{ �'B " �|���9@ � & � *53 0'& � . � ���> � @ *�� . , ��0 � . � &k� 0'& � 2�0��+* �|}j~ � B *�� � ��} � � � � � * Bj���/�/� �9e`g�e6 &i-�&g�poi�bZl�*Sg�hvp&d�s^f�eW�4u@bZf�lou@f� �*p�e�b<l0%#f�e��P Sf�e^r kI% �(# ege`f

e �

Page 107: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

e . � �� � � �*�������

� OlO & e�J � �� 7, LO�kRe^r kmlon��1, LO.d&s^sYk&% �&kmlonX, ?, �&.g#e^l�bZl0% ��_f=V�d0%�%�b<l1%d8)kme u�� � �okRe^fRn 8)kml0%#dokI%#f�i�pofRu��b;�:u kms^bZg�loi" ����� �)B 0'& � 0�� � . � & � � & � ��>��� 0 B * � & �'.]&[*�* B .]& � �"# � � e � �h# J �`��� # J �_��� �*f�p�s�f�hWVof�e# ege�J

� O_b<r e #4� �� �O_b<rZhvg�e�f� � �'B9B *�� � &[* ����g � B .0*5& � * ( 8�@'@CB � 0�� � * ��� � � ��>��� 0 B *HC<*F% *�1 �9@ 3 *5& �% b> � ��s���f iwb�i"�Y.l�b)'*f�eYi�b<s���gRq-[Sn[b<lLV�d�e�%��!�[�.f pokme�s^hvf�l4sSgmq"*Sg#hvp�d�s�f�e �?u@b<f�lau@f�� # e`e #

� &�k��1._�=� #� &�k��*fRi"�[fRn[bZs^g#e� � @ *�� . , ��0 � . � & � 0 � * � � 2d('.0* �" ->�e�f�l4s^b�uFf��$& kmr<r ���oeYi�s�fRn[b<s�b<g#l!�)# e ._�� � &�k�� e 5I� #� &�k��*fRi" ���� kmlon R �-! u@g#hvpokme kms�b '*f�u�k�i�f`iws�don��� z �'B 3 0 1 8 �A@ *�� � � ��> � � 3 @ 2 � .]& � �� ��# ���y� �\�de`e �9# ege 5� � &�k�� e`f � #� &�k��*fRi"�[fRn[bZs^g#e� � @ *�� . , ��0 � . � & � 0 � * � � 2d('.0* �" ->�e�f�l4s^b�uFf��$& kmr<r �4iwfRu@g#lonvfRn[bZs^b<g#l!� # e`egf � &�,/. e � #� 7, �&�k��*fRi_kmlonZ* �� ,�g#l�fRi" ��*pofRu@b;� u�kms�b<g�lai�kme�f l�g�s �tl�fRu@f i^i^kRe^bZr����Sf=a[f u@d�sYk&V�r<f � ����/= � �

� ��>��� 0 B * � & �'.]&T*�* B .]& ��� � 2 B &�0 1 � � � � ��� f`f�JD�dfgf .���'_g '*f hWVof�e"# e . e � &�,/' egf � #� 7, &�k��*fRi��/* � /,�g#l�fRi"�[kRlonc, 7[' /'.b u���g#r<r i� 0Y_lon[f�e iwsYkRlon[bZl0%7s���f_n[b X:f�e^f�lau@fRi�Vof�st�Ef f�l< ��#�

kmlonjR z 8 � � � 2 B �9@ * �(# ��#����y� �df�J �(!.d�s�d�hvlB# e`e`f � &.g4n e #4� e &.g4nL%�fRi" m!.l&g�s��&f�e_iwf�h kml4s^b�u i�qtg�e�R Sn4eYk qts_p�e�f�p�e^bZl[s��0!.d1%�doi�sl# e`e # � ,/,/8�� e #��X* � 1,�g�l�fRi"� � ��� ,�g#l�fRi"� > 7!� 18�b<lon�i�k�����kRlonB@+ [� g*g�e^f +� 2 B 0 1 D�8 z �'B 3 0 1 C *F% *�1 �9@ 3 *1& �

� 2 @'@ �'B�� � ;��� *53 F�*p&e^b<l1%�f�e)�0 Sf�e�r�kI%��)# ege # � ,'� e`f � * � 1,�g�l�fRi kmlonB* 7!� [� b n�n[f�r$V�d�e�%� "! � �[pofRnb8�g�%�b�u�gRq->�kRe^s^b kmr ��d�lou@s�b<g�lai+@�fRu@g#loiws�e^dou@s�fRn

*Sr�k#i^iwb u�kmrZr��/ V� fRu���l�b u�kmr(@�f�pog�e�sP8�g�%�b u]O_e^g#d�pv>�e^f�p�e�b<l4s �*f e^b<f im. e �[�.f�pokRe^s�hvf�l4sNgRq3> ��bZr<gXiwg �p �����0Y.s�e^fRu��4smY_l�b '*f�e iwbZs � �/!.p�e�b<r9# e`egf

� ,�g�l . � � * � 1,�g�l�fRi" � ;��� *53 0 � . � � ��>��� 0 B *�C *F% *�1 �9@ 3 *1& �W~ � .]& � A\C � ->�e�f�l4s^b�uFf+&�kmrZr$�1'.f=���Ng#e6 /��oeYi�s�fRn[bZs^b<g#l!� # e . �

� ,�g�l e�J k&� * � 1,�g�l�fRi" � ;��� *53 0 � . � � ��>��� 0 B *�C *F% *�1 �9@ 3 *1& �W~ � .]& � A\C � ->�e�f�l4s^b�uFf+&�kmrZr$�1'.f=���Ng#e6 /�iwfRuFg�lonvfRn[bZs^bZg�l!�(# e`e�J

� ,�g�l e�J V1� @ �� �,�g�l�fRi" �#�i^i�d�fRi�b<l7s!��f�iwf�hjkRl[s�b�u�i�gRq R kmlon7s���f b<e�bZhvpok#u@s�g#l�p&e^g*gmqae^d�rZfRi qtg�e9R 6S.'*f�e!��fRk#n�iqtg�e_k p�e^f iwf�l4sYkRs^b<g#lb%�b '*f ljkms���kms kW8�g�%�b u�g�l �*f p�s^f�hcVof�e�# � s!�!�)# ege�J

� ,/@ e`f � e f�lon�� ,�g��&loiws�g�l�kmlonjO_g�e n[g�l @ gXiwf� 3O_d�b�n[f r<b<l&fRicqtg�e�s��&f�hjkml4dokRr�uFg�l/'*f�eYi�b<g�l gmq-SPV $�fRu@s)�nRs^gX*���� F�)fRu���l�b u�kmr\@ f�pog#e^s e`f ��# � � �Xgmqtst��kRe^f� f�e^by�:u�kms�b<g#lb@ f iwfRkReYu��j*Sf�l4s^e^f �[�.f�pokRe^s^h f�l[sgmq-*Sg�hvp&d�s^f�e �4u@bZf�lou@f��1Y.l�b)'*f�eYi�b<s���gRq"u_d�f�f�loi�r�kRlon�� �*f�p&s^f�hcVof�eP# e`egf

� �l8 e � � [' '#kml ��f�d&r<f�l�kmlanZ> 8�bZlon�i^k��� Sf�e^by�:u�kms�b<g#l2*�k#iwfI�*s�don[bZfRi.b<l���������� �� f u���l&b�u�kRr)e^f�pog�e�s���*gmqtst� kme^fW Sf�e^by�:u�kRs^b<g#lk@�fRi�fRkme u��^*Sf�l4s^e^f �?�.f�pakme^s�hvf�l4s7gmql*Sg�h p�d�s^f e �?u@b<f�lau@f��iY.l�b)'*f�eYi�b<s��gmq-u_d�f�f�loi�r�kRlon��)# ege � '#�lvp�e^f pokme kms^bZg�l!

� 8�b<l e � k&� > "8�bZlon�i�k� ���&f �.f p f lon[f�lou"� � kmlakI%�f hvf�l4s ���&iws�f�h *�k�i�f �Xs^don�� � f u���l&b�u�kRrl@ f p g#e^s�"@ e � ��# ���*gmqtst� kme^f Sf�e�b;�:u kms^bZg�l @�fRiwfRkReYu�� *Sf�l4s^e�f����.f pokme�s^hvf�l4s gmq:*Sg�hvp�d&s^f�e �4u@bZf�lou@f��Y.l�b)'*f�eYi�b<s���gRq"u_d�f�f�loi�r�kRlon�� # e`e��

� 8�b<l e � V1� > Q8�bZlon�i^k��� @ fRk#iwg#l�b<l0% kIVog�d�sHR �*pofRu@by�:u�kms�b<g#loi���k "�#� >�f�eYi�pofRu@s^b)'*f� $�)fRu��&l�b�u�kRri@ f p g#e^s�"@ e�� ��# J � �*gRqtst��kme�fI Sf�e^by�:u�kRs^b<g#lk@�fRi�fRkme u��^*Sf�l4s^e^f ��_f�pokme�s^hvf l[s7gmql*Sg#hvp�d�s�f�e<�4u@bZf�lou@f��Y.l�b)'*f�eYi�b<s���gRq"u_d�f�f�loi�r�kRlon�� # e`e��

Page 108: SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT …staff.itee.uq.edu.au/pal/SVRC/tr94-03.pdf · SOFTWARE VERIFICATION RESEARCH CENTRE DEPARTMENT OF COMPUTER SCIENCE THE UNIVERSITY

� �� � � �*������� ege� � g�e e�J � * �� g�e�%*kRl! B�� � B 0'3<3<.]& � > B � 3 � @ *��\. ,!��0 � . � & �" c>�e^f l[s�b�u@f�� &�kRr<r$�([�l0%�rZf=�Eg*g4n^*Sr<bYX i"��' 7, ��

# ege�J � � � e #4� � $� g�lok#�okmlxkRlon�@+ F� �ok=�+ � g4n[f�r(� Vak�iwf n iwpofRuFb;�:u�kRs^bZg�loi" #�lq, 7! ?� u\�.f e^hvb n���fRn[bZs^g�e��

� ��>��� 0 B * � & � .]&T*�* B0F � � * > * B *5& �9* = ��� " �7u��akmp�s�f�ev56# ��Ed�s^s�f�e���g�e�s�� � &.f�bZl�f�hjkRl�l!�"8�g#lon[g�l��# ege #

� � � e 5I� 8 Y�� [� kReYi �okmrZr�kRlonj8 ��*b<h g�l! 3Y�i�b<l0%< "�#� s^g iwpofRuFb q%�vhjkRlokI%#fRnvg�V $�fRuFs�e^f�r kms^bZg�loi ��b<pai� # l� `�_b�kI< kmlanW@+ _O_e�g�<��*fRn[bZs^g#eYi�� B � �9*�* ('.]& � � ��> ��� * � z � � ��� � { G������ z�. >��� � & � * B & 0 � . � & 0 1� � & > * B *5& �9* � &2z �'B 3 0 1 C<* � � B . @ � . � & � *�� � &/.��\2/* ��� z � �7� � F ���&} * B5B ����g|G 2d. B *�� } z B 0'& �9* }����g���� � � � � � * Bd���/�� Q[�r�iwf '[bZf�e� Q# ege 5�

� @�g*i e 5I� O 6! 6@�g*i�f� V�.f�pof�lon4f�lou��4� kmlok&%�f�h f�l[s�����i�s^f�h�� SPV $�fRuFs��tRjiwpofRuFb;�:u�kRs^bZg�l! i!*'#kmbZr�k&V�r<fEqte�g�hs���f<�' @+*� [�.f�pokRe^s^h f�l[s�gmq"*Sg#hvp�d�s�f�e#�4u@bZf�lou@f� 0Y.l�b)'*f�eYi�b<s�� gmq"u_d�f�f loiwr kmlon� )# e ��f=V�e�dokme��� # ege 5�

� �*hvb e 5&� !� +�*h b<s��� >�e^g*gRq�gmq ����f g�e^f hjicb<lbR ��)fRu���l�b�u kmrQ@�f�pog�e�s e 5 J�J � [�.f@qtf lou@fU@ fRi�fRkme u��c!P%�f�lou��� � kmr)'*f�e^l� /e`g�e u@fRiws�f�eYi ��b<e�f� /� kReYu�� # e`e 5�

� �*p�b$� , /� �*p&b '*f��� � � *�� �����W� kml4dokmr ? Nf eYiwbZg�lv5� J � �*p�b .�.&� , � �Xp�b '*f�� �~ &/(+* B ��! &/('.]& �#" D$8 � @ *��\. ,!� � . � &k� & � 2 �+* &/( . � � z �'B 3 $ � *13 & � . � �" >�e^f�l4s^b u@f��&%�kmrZr! /'.f�� �Sg�e � (# e .�.� � �*p�b . e � , � [�*p�b '*f'�� 7� � *�")( � �& � . � & D* �� * > * B *5& �9* �# &/2 $ 3>�e�f�l4s^b�uFf��!% kmr<r& L'.f=���Ng#e6 + # e . e � e � e 5&� , ;* ?> e`g*g4n�u@g4u� �kRlon �� � ��Ee�b<f�l� e,�)k�rZg�%#b�u�qtg�edR .-�lk, ?[' )'.b�u���g#r<r�i� f n[b<s�g�e� " ~ � * B

{ �'B " �|���9@0}*/ �'B " ���/�6�� �Xp�e^bZl0%�f�e��0 Sf�e�r�k&%� # e`e 5� 3>�e^g4u@f fRn[b<l1%*iEgmq�s!��f��*b$a[s!�b!.l�l4dokRr�RvY�i�f�e� f�f�s�b<l0%�

� e b<l e�J � , � &e b<l0%� Q! iwpofRu@by�of�e + i)b<l4s^e^g4n4dou@s^bZg�l s�gKqtg#e^hjkRr[h f�s���g4n&i� � � 3 @ 2 � * B0 /5 f21 �Xf�p�s^f hWVof�e�30�7. �5 � )# e`e�J

� e b<e������ '� Qe b<e^s!�! �e �okRs7u�kmlB��f n[gjk&V g#d�s7s���f d&l�l�fRu@f i^i^kRe�� n[b '*f�e iwbZs4� gmq�l�g�s kms�b<g�l qtg�eKi4�4l[s k�u@s�b�un[f4�ol&b<s^bZg�loi05 � � 3<3<2d&/. � � . � & � ��> � � * 8 ���� )#=5 1 #�#630�?.�5�5 � .�5 f i'.g#'*f�hcVof�e"# e ���

� e`g*g/. e � , ;* ?> e`g*g4n�u@g4u� � B*�kmr u@d�r kms^bZl0% p&e^g�pof�e�s^bZfRi�gRq�ROiwpofRuFb;�:u�kRs^bZg�loi" 8 ��� � . � � ��>� � ��>���� 'B *� & �'.]&T*�* B .]& �7( � � * �� )# ��1 ��30� �'fD� � � # e . e

� e`g�e e 5I� , � =e`g�e n�in��g�e^s!�! � ��>���� 'B *-C<*F% * $ �9@ 3 *5& �� . ��� " D8 B� � � . � $'8F@'@CB��6 � � � � z �'B 3 $�� * ���Lg� ( � .]& � ��>���� 'B * � & �'.]&T*�* B .]& � "! n�n[b�i�g�l��Ne`fRiwrZf��� 6e`g` 4b<l1%��okRh9 0[�l0%#r�kmlan� )# ege 5�