TU/e
Technische Universiteit
Eindhoven
University of Technology
Examination cover sheet
Course name: Automotive software engineering
Course Code: Final exam 2IWA0
Date: Wednesday, January 26, 2022
Start time: 13:30
End time : 16:30
Number of pages: 10 (including 2 frontpages, and a 6 page appendix)
Number of questions: 6
Maximum number of points/distribution of points over questions: 90
Method of determining final grade: 10 + total points, divided by 10
Answering style: open questions
Exam inspection: Thursday, February 10, 17:00-18:00, MF12
Other remarks:
Instructions for students and invigilators
It is not allowed to use study material or a computer during
the exam.
Important:
• examinees are only permitted to visit the toilets under supervision
• it is not permitted to leave the examination room within 15
minutes of the start and within the final 15 minutes of the
examination, unless stated otherwise
During written examinations, the following actions will be
deemed to constitute fraud or attempted fraud:
• using another person’s proof of identity/campus card (student
identity card)
• having a mobile telephone or any other type of media-carrying
device on your desk or in your clothes
• examination scripts (fully completed examination paper, stating name, student number, etc.) must always be handed in
• using, or attempting to use, unauthorized resources and aids,
such as the internet, a mobile telephone, etc.
• the house rules must be observed during the examination
• using a clicker that does not belong to you
• the instructions of examiners and invigilators must be followed
• having any paper at hand other than that provided by TU/e,
unless stated otherwise
• no pencil cases are permitted on desks
• examinees are not permitted to share examination aids or lend
them to each other
• visiting the toilet (or going outside) without permission or
supervision
Associated with the Central Examination Regulations
2
Exam Automotive Software Engineering (2IWA0)
Wednesday, January 26, 2022, 13:30-16:30
It is not allowed to use the study material. The axioms formulated in the book are given
as an appendix to this exam. The answers to the questions can be formulated in English or
Dutch. This exam consists of 6 questions. Good luck!
1. Consider the following two pairs of processes. Indicate for each pair whether they are
strongly bisimilar, branching bisimilar, rooted branching bisimilar, trace and weak trace
equivalent. Give explicit yes/no answers for each situation.
a
a
b b
a a
c c
a
b
a
τ
c
a
c
b
τ
a
c
c
b
2. Computers can crash, or be disconnected from a network. It can be useful for a central
computer to determine which surrounding computers are still up and running. For
this purpose heart-beat protocols have been designed. In a simple variant the central
computer regularly sends out a hai(id) message to remote computers using a natural
number id as identifier. If this computer is alive and connected this message is answered
with a message present(id). Otherwise, a timeout indication timeout(id) is generated
which we model as a message, too. A remote computer with identifier id can also
spontaneously indicate that it is alive by sending an unsolicited alive(id) message.
(a) Specify a data type HeartBeatMessage containing the messages described above.
(b) Prove that data elements hai(id1 ) and present(id2 ) are different in any model of
the data type. A precise proof is requested. If the data type specification under
(a) does not imply that the elements are different, extend the specification such
that they are.
(c) The central computer maintains a list of identifiers of type List(N) of remote computers that did not respond and are apparently dead. Specify the functions
insert, delete : N × List(N) → List(N)
that respectively insert and remove a number to/from the list.
(d) Describe a heartbeat process HB with a list l of numbers as parameter containing
the identifiers of remote computers that are presumed to be dead. The process
HB regularly sends out a hai(id) messages to all processes id, receives timeout(id),
present(id) and alive(id) messages. Moreover, HB maintains in list l all identifiers
of remote computers that are not alive.
3
P
3. Consider
the
processes
defined
by
the
equations
P
=
b:B r1 (b)·s2 (b)·P and Q =
P
b:B r2 (b)·s3 (b)·Q. (a) Draw the transition system of the process S defined by
S = τ{c2 } ∇{r1 ,c2 ,s3 } Γ{r2 |s2 →c2 } (P k Q).
(b) Draw the minimal transition system that isPbranching bisimilar to that of process
S. (c) Also draw the transition system for R = b:B r1 (b)·s3 (b)·R. (d) Is the behaviour
of R branching bisimilar to that of S? Motivate your answer.
4. Express the following properties using the modal µ-calculus.
(a) No action error can be done in the reachable state space.
(b) In any state it is possible that an action alive can happen. Contrary to the action
alive(id) from question (2) this action alive carries no parameter.
(c) After an action hai(id) for all id : N, either an action present(id) or an action
timeout(id) must follow.
(d) The number of actions timeout (for simplicity without a parameter) can never
exceed 10, 000.
5. Consider the following pairs of modal formulas. Give for each pair a labelled transition
system only containing actions a and b for which the first formula is true and the second
is not. Conversely, provide a labelled transition system for which the first formula is
false and the second is true. If no such transition systems exist, clearly indicate why.
(a) ha.bitrue and [a]hbitrue.
(b) µY.([a]Y ∧hbitrue) and νY.([a]Y ∧hbitrue).
6. Consider a process X = a·(X + Y ) and Y = b·(a·Y + X). (a) Draw a labelled transition
system that represents the behaviour of X. (b) Give a linear process that is strongly
bisimilar to X.
END
Score: (10 + n)/10 where n is the cumulative judgement given by the following table:
question
1
2
3
4
5
6
(a)
7
4
10
5
7
10
(b)
7
5
(c)
(d)
6
7
5
7
5
5
4
MA1
MA2
MA3
α|β = β|α
(α|β)|γ = α|(β|γ)
α|τ = α
MD1
MD2
MD3
MD4
MD5
τ \α=τ
α\τ =α
α \ (β|γ) = (α \ β) \ γ
(a(d)|α) \ a(d) = α
(a(d)|α) \ b(e) = a(d)|(α \ b(e))
MS1
MS2
MS3
MS4
τ v α = true
a(d) v τ = false
a(d)|α v a(d)|β = α v β
a(d)|α v b(e)|β = a(d)|(α \ b(e)) v β
MAN1
MAN2
MAN3
τ =τ
a(d) = a
α|β = α|β
if a 6≡ b or d 6≈ e
if a 6≡ b or d 6≈ e
Table 1: Axioms for multi-actions
A1
A2
A3
A4
A5
A6 z
A7
x+y =y+x
x + (y + z) = (x + y) + z
x+x=x
(x + y)·z = x·z + y·z
(x·y)·z = x·(y·z)
x+δ =x
δ·x = δ
Cond1
Cond2
true→x y = x
false→x y = y
THEN z
c→x = c→xδ
SUM1
SUM3
SUM4
SUM5
P
Pd:D x = x
P
d:D X(d)
Pd:D X(d) = X(e) + P
P
(X(d)
+
Y
(d))
=
X(d)
+
d:D
d:D
d:D Y (d)
P
P
( d:D X(d))·y = d:D X(d)·y
Table 2: Axioms for the basic operators
5
M
x k y = x T y + y T x + x|y
LM1z
LM2z
LM3z
LM4
LM5
α T x = α·x
δTx=δ
α·x T y = α·(x k y)
(x
P+ y) T z = x T z +
Py T z
( d:D X(d)) T y = d:D X(d) T y
S1
S2
S3
S4
S5
S6
S7
S8
x|y = y|x
(x|y)|z = x|(y|z)
x|τ = x
α|δ = δ
(α·x)|β = α|β·x
(α·x)|(β·y) = α|β·(x k y)
(x
y|z
P+ y)|z = x|z + P
( d:D X(d))|y = d:D X(d)|y
TC1
TC2
TC3
(x T y) T z = x T (y k z)
x T δ = x·δ
(x|y) T z = x|(y T z)
Table 3: Axioms for the parallel composition operators
C1
C2
C3
ΓC (α) = γC (α)
ΓC (δ) = δ
ΓC (x + y) = ΓC (x) + ΓC (y)
C4
C5
ΓC (x·y)
C (y)
P = ΓC (x)·ΓP
ΓC ( d:D X(d)) = d:D ΓC (X(d))
Table 4: Axioms for the communication operator
V1
V2
V3
∇V (α) = α if α∈V ∪{τ }
∇V (α) = δ if α6∈V ∪{τ }
∇V (δ) = δ
TV1
∇V (∇W (x)) = ∇V ∩W (x)
V4
V5
V6
∇V (x + y) = ∇V (x) + ∇V (y)
∇V (x·y)
P = ∇V (x)·∇
PV (y)
∇V ( d:D X(d)) = d:D ∇V (X(d))
Table 5: Axioms for the allow operator
6
E1
E2
E3
E4
E10
∂B (τ ) = τ
∂B (a(d)) = a(d)
if a 6∈ B
∂B (a(d)) = δ
if a ∈ B
∂B (α|β) = ∂B (α)|∂B (β)
∂H (∂H 0 (x)) = ∂H∪H 0 (x)
E6
E7
E8
E5
∂B (x + y) = ∂B (x) + ∂B (y)
∂B (x·y)
P = ∂B (x)·∂B
P(y)
∂B ( d:D X(d)) = d:D ∂B (X(d))
∂B (δ) = δ
Table 6: Axioms for the blocking operator
R1
R2
R3
R4
R5
R6
R7
R8
ρR (τ ) = τ
ρR (a(d)) = b(d)
ρR (a(d)) = a(d)
ρR (α|β) = ρR (α)|ρR (β)
ρR (δ) = δ
ρR (x + y) = ρR (x) + ρR (y)
ρR (x·y)
P(y)
P = ρR (x)·ρR
ρR ( d:D X(d)) = d:D ρR (X(d))
if a→b ∈ R for some b
if a→b ∈
6 R for all b
Table 7: Axioms for the renaming operator
H1
H2
H3
H4
H10
τI (τ ) = τ
τI (a(d)) = τ
τI (a(d)) = a(d)
τI (α|β) = τI (α)|τI (β)
τI (τI 0 (x)) = τI∪I 0 (x)
H6
H7
H8
H5
if a ∈ I
if a ∈
6 I
τI (x+y) = τI (x) + τI (y)
τI (x·y)
(y)
P = τI (x)·τI P
τI ( d:D X(d)) = d:D τI (X(d))
τI (δ) = δ
Table 8: Axioms for the hiding operator
Wz
BRANCHz
x·τ = x
x·(τ ·(y + z) + y) = x·(y + z)
Table 9: Axioms for τ , valid in rooted branching bisimulation for untimed processes
7
Failures equivalence
Trace equivalence
Language equivalence
Weak trace equivalence
F1z
F2z
RDIS
Lang1
RDIS
RDIS
WT
W
a·(b·x+u) + a·(b·y+v) = a·(b·x+b·y+u) + a·(b·x+b·y+v)
a·x + a·(y + z) = a·x + a·(x + y) + a·(y + z)
x·(y + z) = x·y + x·z
x·δ = δ
x·(y + z) = x·y + x·z
x·(y + z) = x·y + x·z
τ ·x = x
x·τ = x
Table 10: Axioms for some other equivalences for untimed processes
8
Proposition logic
φ∧ψ =ψ∧φ
(φ ∧ ψ) ∧ χ = φ ∧ (ψ ∧ χ)
φ∧φ=φ
¬true = false
φ ∧ true = φ
φ ∧ false = false
φ ∧ (ψ ∨ χ) = (φ ∧ ψ) ∨ (φ ∧ χ)
¬(φ ∧ ψ) = ¬φ ∨ ¬ψ
¬¬φ = φ
φ ⇒ ψ = ¬φ ∨ ψ
φ∨ψ =ψ∨φ
(φ ∨ ψ) ∨ χ = φ ∨ (ψ ∨ χ)
φ∨φ=φ
¬false = true
φ ∨ true = true
φ ∨ true = φ
φ ∨ (ψ ∧ χ) = (φ ∨ ψ) ∧ (φ ∨ χ)
¬(φ ∨ ψ) = ¬φ ∧ ¬ψ
φ → ψ = ¬φ ∨ ψ
φ⇔ψ =φ⇒ψ∧ψ ⇒φ
Predicate logic
∀d:D.φ = φ
¬∀d:D.Φ(d) = ∃d:D.¬Φ(d)
∀d:D.(Φ(d)∧Ψ(d)) = ∀d:D.Φ(d)∧∀d:D.Ψ(d)
∀d:D.(Φ(d)∨ψ) = ∀d:D.Φ(d) ∨ ψ
∀d:D.Φ(d) ⇒ Φ(e)
∃d:D.φ = φ
¬∃d:D.Φ(d) = ∀d:D.¬Φ(d)
∃d:D.(Φ(d)∨Ψ(d)) = ∃d:D.Φ(d)∨∃d:D.Ψ(d)
∃d:D.(Φ(d)∧ψ) = ∃d:D.Φ(d) ∧ ψ
Φ(e) ⇒ ∃d:D.Φ(d)
Action formulas
true = false
α1 ∪ α2 = α1 ∩ α2
∃d:D.A(d) = ∀d:D.A(d)
false = true
α1 ∩ α2 = α1 ∪ α2
∀d:D.A(d) = ∃d:D.A(d)
Hennessy-Milner logic
¬haiφ = [a]¬φ
haifalse = false
hai(φ ∨ ψ) = haiφ ∨ haiψ
haiφ ∧ [a]ψ ⇒ hai(φ ∧ ψ)
¬[a]φ = hai¬φ
[a]true = true
[a](φ ∧ ψ) = [a]φ ∧ [a]ψ
[a](φ ∨ ψ) ⇒ haiφ ∨ [a]ψ
Table 11: Equivalences between modal formulas (part I)
9
Fixed point equations
µX.φ(X) ⇒ νX.φ(X)
µX.φ = φ
µX.X = false
µX.hRiX = false
¬µX.φ(X) = νX.¬φ(¬X)
µX.φ(X) = φ(µX.φ(X))
if φ(ψ) ⇒ ψ then µX.φ(X) ⇒ ψ
νX.φ = φ
νX.X = true
νX.[R]X = true
¬νX.φ(X) = µX.¬φ(¬X)
νX.φ(X) = φ(νX.φ(X))
if ψ ⇒ φ(ψ) then ψ ⇒ νX.φ(X)
Regular formulas
hεiφ = φ
hfalseiφ = false
haf 1 ∪ af 2 iφ = haf 1 iφ ∨ haf 2 iφ
haf 1 ∩ af 2 iφ ⇒ haf 1 iφ ∧ haf 2 iφ
h∃d:D.AF (d)iφ = ∃d:D.hAF (d)iφ
h∀d:D.AF (d)iφ ⇒ ∀d:D.hAF (d)iφ
hR1 + R2 iφ = hR1 iφ ∨ hR2 iφ
hR1 ·R2 iφ = hR1 ihR2 iφ
hR? iφ = µX.(hRiX ∨ φ)
hR+ iφ = hRihR? iφ
¬hRiφ = [R]¬φ
[R]true = true
hRi(φ ∨ ψ) = hRiφ ∨ hRiψ
hRiφ ∧ [R]ψ ⇒ hRi(φ ∧ ψ)
[ε]φ = φ
[false]φ = true
[af 1 ∪ af 2 ]φ = [af 1 ]φ ∧ [af 2 ]φ
[af 1 ∩ af 2 ]φ ⇐ [af 1 ]φ ∨ [af 2 ]φ
[∃d:D.AF (d)]φ = ∀d:D.[AF (d)]φ
[∀d:D.AF (d)]φ ⇐ ∃d:D.[AF (d)]φ
[R1 + R2 ]φ = [R1 ]φ ∧ [R2 ]φ
[R1 ·R2 ]φ = [R1 ][R2 ]φ
[R? ]φ = νX.([R]X ∧ φ)
[R+ ]φ = [R][R? ]φ
¬[R]φ = hRi¬φ
hRifalse = false
[R](φ ∧ ψ) = [R]φ ∧ [R]ψ
[R](φ ∨ ψ) ⇒ hRiφ ∨ [R]ψ
Table 12: Equivalences between modal formulas (part II)
10