The Parameterized Symbolic Transition System

Given anfsm orfsm-skA, which has the formA_,hL,l₀,I,O,R,F_As,F_Awi, which itself could possibly be the composition of two or more fsms or fsm-sks, we now outline how 5_{IfAis required to satisfy multiple}ltl_{formulas, then these can be expressed as a single}ltl_{formula which is}

to representAas a symbolic transition system. We denote the symbolic transition system corresponding toAasAe , D e V,el0,eR,Fe_As,Fe_Aw E , where:

• Veis the set of variables in the symbolic transition system and we useVe0to represent the

primedversion of the variables inVe. The primed version of a variable denotes the value of the variable in thenextstate. We require them to distinguish between the current and next

values of variables in a symbolic representation.

•el0is the symbolic representation of the set of initial states of the symbolic transition system. • Reis the symbolic transition relation that relates the values in thenextstate, represented by

the primed version of the variables,i.e.,Ve0, to their values in thecurrentstate, represented by the unprimed version of the variables,i.e.,Ve.

• Fe_Asis a set of pairs of predicates overVe, with one pair encoding each setF∈F_As. • Fe_Awis a set of predicates overVe, with one predicate encoding each setF∈F_As.

We will use BDDs to representel0,Re,Fe_AsandFe_Awin our presentation. It will be convenient to partitionRinto the setsR_fixedandR_synth, whereR_fixedconsists of the transitions with “fixed” interpretations,i.e., whereguardis the Boolean constanttrue, andRsynthconsists of the set of transitions whose interpretations are to be synthesized,i.e., whereguardis a Boolean valued

variable whose value needs to be determined. The usual determinism constraints outlined in Chapter 2 are implicitly assumed in the rest of this chapter. We note that these can also be specified using suitable constraints onR_synthand fit well into the BDD based algorithms described in this chapter.

We define the set of variables ofAe asVe ,{loc,lastt}∪Ge, wherelocandlastt, represent the location of thefsmA, and the identity of the transition that was taken to arrive at the current state, respectively. The set of variablesGe ={g1,g2, . . . ,g_k}, wherek=|R|, consists of Boolean valued variables, where g_i represents the guard of the transitiont_i, for eacht_i ∈ R. The lasttvariables are necessary because symbolic model checking algorithms are more naturally suited to handle handlestate-basedfairness requirements, rather thantransition-basedfairness

requirements. By adding the variablelastt, we are essentially enabling the translation of transition-based fairness into state-based fairness.

We now describe how each of the symbolic representations forel0,eR,Fe_Aw, andFe_Asare constructed, starting from a definition ofA. We present the predicates over the set of variables Vas well as the primed variablesV0 that correspond to the definition of each of these. It is straightforward to use BDD operations, using a BDD library like CUDD [SB00], for example, to

construct BDDs corresponding to these predicates. The set of initial states ofAe, can be encoded as follows: el0≡  (loc=l₀) ∧ ^ ti∈Rfixed g_i  

Each transitionti∈Rof the formti,

li,mi,guardi,li0

is encoded symbolically as: (loc=li)∧gi∧ loc0=li0

∧ lastt0=ti

∧g_i0=gi

The constraintg_i0 =giensures that theinterpretationremains constant across transitions. The

complete symbolic transition relationeRis then simply the disjunction of the above encoding over all the transitionst∈R:

e

R≡ _

ti∈R

(loc=l_i)∧g_i∧ loc0 =l_i0∧ lastt0=t_i

Consider a fairness assumptionFw∈Fw, whereFw={t1,t2, . . . ,tn}, we symbolically encode

Fw, denotedeF_w, using a single predicate of the form:

e

Fw≡¬enabled(Fw)∨taken(Fw)

whereenabled(Fw)≡Wti∈Fw(loc=li∧gi), withliandgireferring to the initial location and the Boolean variable corresponding to the guard of the transitiont_i, and the predicate taken(Fw)≡W_ti∈Fwlastt=ti. The predicateenabled(Fw)encodes whetheranytransition inFwcanbe executed, andtaken(Fw)encodes whether the current state has been reached by

executing any transition in the setF_w.

For strong fairness assumptions F_s ∈ F_s, whereF_s = {t₁,t₂, . . . ,t_n}, we symbolically encodeFs, denotedeF_s, using a pair of Boolean valued formulaspandq, wherep,enabled(F_s) andq_,taken(Fs), whereenabledandtakenare as defined above. The predicate encodings

of fairness assumptions will be used to characterize if a non-empty terminal strongly connected component is fair. We refer the reader to earlier work [KPRS06] for a more detailed explanation.