Compositional Nonblocking Verification with Always Enabled Events and Selfloop-Only Events

Abstract

This report proposes to improve compositional nonblocking verification through the use of two special event types: always enabled and selfloop-only events. Compositional verification involves abstraction to simplify parts of a system during verification. Normally, this abstraction is based on the set of events not used in the remainder of the system. Here, it is proposed to exploit more knowledge about the system and abstract events even though they are used in the remainder of the system. This can lead to more simplification than was previously possible. Abstraction rules from previous work are extended to respect the new special events and proofs show these rules still preserve nonblocking. The rules have been implemented in Waters and experimental results demonstrate that these extended simplification rules help verify several industrial-scale discrete event system models while achieving better state-space reduction than before.2

An algorithm for compositional nonblocking verification using special events

“…The Enabled Continuation Rule [15] is a generalisation of the Silent Continuation Rule [8], which allows incoming equivalent states in a τ -loop free automaton to be merged provided that they both have an outgoing τ -transition. The reason for this is that, if a state has an outgoing τ -transition, then the other outgoing transitions are "optional" [8] for a test that is to be nonblocking with this automaton.…”

“…[15] In a τ -loop free automaton, two states that are incoming equivalent and both have an outgoing always enabled or τ -transition are conflict equivalent and can be merged.…”

“…[15] If a τ -loop free automaton has a state q with only τ -transitions entering it, and an always enabled or τ -transition outgoing from state q, then all transitions q σ → y outgoing from state q can be replaced with new transitions x σ → y outgoing from all the τ -predecessors x of q, which have the same event σ and target state y as the original transition. Afterwards, the τ -transitions to q can be removed.…”

“…[15] If an automaton contains an always enabled or τ -transition to a blocking state, then the source state of this transition is a state of certain conflicts, and all its outgoing transitions can be deleted.…”

“…The requirement for always enabled events can be further relaxed by considering conditionally always enabled events [15], where the remaining automata of the system are examined more closely using an incremental controllability check [24]. Then an event η is considered as always enabled when simplifying an automaton G, if the environment T enables η in all states (x G , x T ) of G T where η is enabled in the state x G of G. This approach allows for more events to be considered as always enabled, but repeatedly checking such conditions of all the automata not being abstracted is time-consuming [15].…”