WO2000013113A1 - A data structure and its use - Google Patents
A data structure and its use Download PDFInfo
- Publication number
- WO2000013113A1 WO2000013113A1 PCT/DK1999/000456 DK9900456W WO0013113A1 WO 2000013113 A1 WO2000013113 A1 WO 2000013113A1 DK 9900456 W DK9900456 W DK 9900456W WO 0013113 A1 WO0013113 A1 WO 0013113A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- node
- data structure
- expression
- new
- generating
- Prior art date
Links
- 230000014509 gene expression Effects 0.000 claims description 321
- 238000000034 method Methods 0.000 claims description 203
- 230000007704 transition Effects 0.000 claims description 105
- 239000011159 matrix material Substances 0.000 claims description 37
- 230000009471 action Effects 0.000 claims description 14
- 230000001268 conjugating effect Effects 0.000 claims description 12
- 239000000203 mixture Substances 0.000 claims description 9
- 238000004590 computer program Methods 0.000 claims description 8
- 125000002015 acyclic group Chemical group 0.000 claims description 5
- 238000010276 construction Methods 0.000 claims description 4
- 230000009467 reduction Effects 0.000 claims description 3
- 238000011160 research Methods 0.000 claims description 2
- 238000006467 substitution reaction Methods 0.000 claims description 2
- 230000021615 conjugation Effects 0.000 claims 2
- 230000004075 alteration Effects 0.000 claims 1
- 238000004458 analytical method Methods 0.000 abstract description 19
- 238000010586 diagram Methods 0.000 abstract description 11
- 238000005457 optimization Methods 0.000 abstract description 4
- 238000012795 verification Methods 0.000 abstract description 4
- 230000006870 function Effects 0.000 description 65
- 238000011002 quantification Methods 0.000 description 19
- 238000012360 testing method Methods 0.000 description 12
- 230000008859 change Effects 0.000 description 9
- 238000010304 firing Methods 0.000 description 6
- 230000006399 behavior Effects 0.000 description 5
- 230000002040 relaxant effect Effects 0.000 description 5
- 230000003247 decreasing effect Effects 0.000 description 3
- 238000013459 approach Methods 0.000 description 2
- 230000008901 benefit Effects 0.000 description 2
- 230000007423 decrease Effects 0.000 description 2
- 238000013461 design Methods 0.000 description 2
- 238000002474 experimental method Methods 0.000 description 2
- 230000006872 improvement Effects 0.000 description 2
- 238000003780 insertion Methods 0.000 description 2
- 230000037431 insertion Effects 0.000 description 2
- 238000007726 management method Methods 0.000 description 2
- 238000013178 mathematical model Methods 0.000 description 2
- 230000002123 temporal effect Effects 0.000 description 2
- GWEVSGVZZGPLCZ-UHFFFAOYSA-N Titan oxide Chemical compound O=[Ti]=O GWEVSGVZZGPLCZ-UHFFFAOYSA-N 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 238000010420 art technique Methods 0.000 description 1
- 201000003231 brachydactyly type D Diseases 0.000 description 1
- 230000001934 delay Effects 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 230000008030 elimination Effects 0.000 description 1
- 238000003379 elimination reaction Methods 0.000 description 1
- 230000004907 flux Effects 0.000 description 1
- 238000007429 general method Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000008569 process Effects 0.000 description 1
- 238000009877 rendering Methods 0.000 description 1
- 239000007787 solid Substances 0.000 description 1
- 238000010561 standard procedure Methods 0.000 description 1
- 238000010200 validation analysis Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N5/00—Computing arrangements using knowledge-based models
- G06N5/01—Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
Definitions
- the present invention relates to a data structure and its use in for example representation, analysis and verification of systems containing continuous variables.
- the data strucure can be used for example to analyse real-time controllers, software, digital circuits, embedded systems, concurrent protocols, and solve configuration, optimisation and planning problems.
- a difference decision diagram or DDD is a data structure for symbolically representing logical combinations of difference constraints (i.e., inequalities between a difference of two real-valued variables and a constant).
- the invention is embodied as a computer program implementing the data structure.
- the core of the invention is not the computer program in itself which is just one of many possible embodiments of the invention, but a description of the data structure and a number of effective algorithms and methods for manipulating the data structure.
- Embedded systems are computer programs embedded in larger systems and are often used to control the behavior of the system as for example in airbags, anti-blocking brakes or railroad safety systems. These methods are based on a technique called model checking which uses exhaustive testing of all possible states in the system to ensure that only certain good states are reachable. Until recently, exhaustive testing was considered infeasible because of the extremely large number of states. But new technological breakthroughs has changed this viewpoint. Real industrial problems with considerable complexity can be formally verified today. This has become possible by using compact data structures for representing large state spaces and efficient algorithms for manipulating them.
- Model checking has proved successful on systems with only Boolean variables, but it is still an open problem how to efficiently verify systems with (non-Boolean) discrete or continuous variables.
- integer or real valued variables play a crucial role in the correctness of the system. Examples are timing aspects of a digital circuit or temperature in an embedded system. It is contemplated that the data structure can extend the positive results from Boolean systems to systems with non-Boolean variables.
- Difference constraints can model timing constraints, and by using logical connectives such as disjunction and existential quantification, difference constraints can also be used to represent and solve a number of planning problems such as optimal usage of a production plant, scheduling problems, economic planning problems and transport planning.
- Difference constraints can also express interval constraints on variables which combined with the logical connectives is useful in configuration tools.
- Configuration tools are used to assist in the assembly of complex products or safety critical systems such as cars, railroad safety systems, vending machines, trains or PCs specialized to solve a specific task.
- the market for configuration tools is in strong growth and estimated to be at least 3 billion dollars per year.
- Experiments with industrial examples show that an approach based on the data structure results in a considerable improvement in performance.
- the data structure can extend the application areas of configuration tools to, for instance, online configuration on the Internet in connection with e-commerce.
- the invention relates to an acyclic data structure comprising:
- the expressions being ordered according to predetermined criteria, the pointers of a first node comprising an expression of a first, lower order pointing to nodes comprising expressions of second orders, the second orders being higher than the first order.
- expression will mean a mathematical expression comprising at least one variable, optionally one or more constants, possibly arithmetic operators, such as +, — , *, and /, and at least one comparison operator, such as ⁇ , >, ⁇ , or >.
- One advantage of the ordering of the expressions may be seen when performing operations on one or more structures.
- a search for nodes having a given representation is quick, as the ordering of the expressions will define where in the structure such a node could appear.
- “disjoint” preferably means that the expression, no matter the value(s) of the at least one variable, will always provide a unique outcome so that it is clear which pointer represents the outcome.
- the structure being acyclic, one or more roots are preferably present, the root(s) normally being a node not being pointed to.
- a root may be chosen within the structure, when that part of the structure pointed to by the root represents the interesting part of the structure.
- the root may actually be a terminal node — such as in the situation where the structure — or the interesting part thereof — has been reduced to only that terminal node.
- a terminal node is a node not pointing to any other nodes.
- the terminal nodes may be adapted to represent constant expressions, such as the constants "false”, “true”, or "17".
- a number of "local” incidents are preferably avoided in order to save space and in order to optimize the operation of the generation of the structure or the use thereof.
- the data structure is at least substantially free from incidents of nodes where: the first and second pointers of a first node point to a second and a third node, respectively, the second pointer of the second node points to the third node, the expressions of the first and second nodes relate to the same variables, and the variable values fulfilling or not fulfilling the expression of the first node being comprised in the variable values fulfilling or not fulfilling the expression of the second node.
- the data structure is preferably at least substantially free from incidents of nodes where all pointers of a node point to the same node.
- the data structure is preferably at least substantially free from incidents of nodes where two nodes exist having identical expressions and having pointers pointing to the same nodes, where the first pointers of the two nodes point to the same node, and where the second pointers of the two nodes point to the same node. Normally, this would be the situation pair-wise for all pointers of the nodes.
- the terminal nodes are adapted to represent Boolean values "true” and "false”. This greatly simplifies the structure and the operation thereof. This provides a very versatile method and structure in that it provides the possible use of characteristic functions for representing sets and relations, and quite complicated operations, such as comparisons, unions, etc. may be performed without requiring enumeration of the elements of the sets.
- the expressions in the nodes except the terminal nodes all contain at least one inequality.
- the disjoint outcomes of the expressions constitute "true” or "false", and wherein each node comprises two pointers.
- all nodes except for the terminal nodes have the same type of information rendering the representation of the structure compact as well as simplifying the operations performed on the structure.
- the at least one inequality is a linear inequality
- a large versatility is obtained within a large number of applications, such as economic models, optimization problems, and planning problems.
- the inequalities are difference constraints, which are useful when analyzing concurrent software, embedded systems, real-time systems, hardware, and in timing analysis.
- the data structure is preferably at least substantially free from incidents of nodes where, when following a path from one node via one or more pointers to a second node, there exists no set of 5 variable values fulfilling a combined expression obtained by, for each node entered, the expression therein having to provide the outcome corresponding to the pointer of the node pointing to the next node.
- the data structure is preferably at least substantially free from incidents of pairs of paths, starting in the same starting node and ending in the same ending node, where, a single path may be generated starting in the starting node and ending in the ending node, the same variables values fulfill the combined expression obtained when following the single path from the starting node to the ending s node as fulfill a disjunction of the pair of paths.
- the structure fulfills this criterion, the same structure will emerge independently on how the structure has been built from e.g. an analysis of a system — i.e. the structure will be a canonical representation of the system.
- the invention relates to a method of generating a data structure as described above o and representing a system having a number of variables, the method comprising:
- a "variable" of the system is a part thereof which may vary — typically over time. This may be values of timers, delays of gates, or values of variables of software, values repres- enting a physical phenomenon or measure, such as temperature, flux or the like.
- the entities will be parts of the system through which variables may interact, such as gates in a circuit', statements in a program, or the like. It has been found that the selected criteria for ordering of the expressions has significance on the final size of the structure as well as the simplicity and computational load of the operations performed thereon.
- the combination of the entity data structures comprises a number of steps in each of which a number of entity data structures are combined, each step comprising:
- One advantage of this manner of combining the structure is that the operator nodes need not be converted into "normal" nodes, as they may be optimized out of the structure.
- a set of predetermined reduction rules are repeatedly applied to the operator nodes in order to remove operator nodes from the data structure so as to simplify the structure at a point in time before converting the operator nodes into "normal" nodes.
- the pointers of the nodes would point pairwise to the same nodes so that the function of the two nodes is identical, and the first node may be omitted when all pointers pointing thereto are redirected to the second node.
- the method preferably further comprising the step of:
- the preferred manner of converting an operator node into "normal" nodes is one comprising the steps of: a) identifying an operator node having pointers pointing to two data structures comprising only terminal nodes or nodes the expressions of which represent inequalities, b) replacing the identified operator node and the data structures pointed to thereby by a new data structure generated by performing the following procedure relating to the two data structures:
- the structures may be combined directly without the use of special-purpose nodes.
- One manner of combining two structures is one wherein the combination of the entity data structures comprises:
- step b) - generating a first new data structure from the data structures pointed to by the first pointer of the node having the lowest order and that node not having the lowest order by performing step b), - having the new node's first pointer point at the first new data structure, - generating a second new data structure from the data structures pointed to by the second pointer of the node having the lowest order and that node not having the lowest order by performing step b),
- this method of generating a structure or combining two data structures using a mathematical operation is a basic operation which may be used for other purposes than merely generation of data structures.
- the method is also useful for altering structures in order to prepare them for analysis/test.
- this more basic operation may comprise:
- step a) - generating a first new data structure from the data structures pointed to by the first pointers of the two lowest order nodes by performing step a), - having the new node's first pointer point at the first new data structure, - generating a second new data structure from the data structures pointed to by the second pointers of the two lowest order nodes by performing step a),
- the mathematical operations are chosen from the group consisting of Boolean operators or combinators, such as AND, OR, NOT, and XOR, where the terminal nodes are given one of the values "true” and "false”.
- the mathematical operations are preferably binary operations
- the nodes comprising expressions are preferably generated with a first and a second pointer so as to be able to point at two other nodes, the second pointer being used, if the expression, given a set of variable values, is true, and the first pointer if the expression is false.
- a first such method to existentially quantify out a variable is one comprising the steps of
- variable may be removed from the system in order to remove the constraints thereon. This may be interesting for use in e.g. an assignment.
- a path is obtained from each matrix by a method where the construction step comprises, for each entry in the matrix, generating a node having a difference constraint corresponding to the variables of the row and column and the constant of the entry, and subsequently combining the resulting nodes by conjunction.
- the solving step comprises, for each matrix, solving the difference bound matrix by the algorithm of Floyd- Warshall performing only relaxation steps involving the predetermined variable.
- Another, often more efficient, method for existentially quantifying out a variable comprises the steps of:
- a new data structure can then be obtained and used for further analysis.
- the relaxing step with a given variable and a constraining expression which is either a lower or an upper bound on the variable is preferably carried out by a method generating a new data structure by:
- step a) - generating a second new data structure from the data structure pointed to by the second pointer of the node by performing step a), - if the constraining expression is an upper bound on the variable and the expression of the node is also an upper bound on the variable,
- Another method for removing a variable from the data structure comprises
- variable can be universally quantified away from the data structure resulting in a data structure representing possible solutions to the remaining variables that are independent of the values of the chosen variable. This allows for the analysis of dependencies among variables in the data structure.
- a method which is especially useful when using the data structure to represent relations and predicates which must be applied on different expressions is a method for replacing, in the data structure, a first variable x with the sum of a second, different variable y and a constant c comprising: • constructing a second data structure by conjugating the initial data structure with a data structure comprising a conjunction of a first node comprising a difference constraint relating to x — V ⁇ c > an d a second node comprising a difference constraint relating to x — y > c,
- a method for achieving this comprises:
- minimum and maximum delay times can be computed in for instance timed systems.
- one such method for removing infeasible paths from a data structure comprises:
- the determining step is performed according to the Bellman-Ford algorithm where, for each node in the path, information relating to the nodes already visited is stored and re-used in subsequent nodes.
- a preferred method for removing infeasible paths from a data comprises:
- variable values fulfilling the combination h) and the combination i) are identical, replacing the actual node by the disjunction between the data structures pointed at by the two pointers of the actual node.
- this method it can be determined for instance whether a data structure has no solutions or contains all assignments of values for the variables as a solution.
- this method makes it possible to decide whether two systems are equivalent or a given system satisfies a given property. In analyzing any of the earlier mentioned application areas, this is an essential and highly useful method.
- An example of an assignment of values to variables leading to a given terminal node can be obtained automatically on a data structure with no infeasible paths by a method comprising:
- Another useful method to analyze a data structure assesses whether a given set of values for the variables when starting in a root of the structure, would result in a path ending in a predetermined terminal node, the method comprising:
- Timed automata is a popular model of timed systems. These can be advantageously analyzed using the data structure of this document by generating a data structure for analyzing a system modeled by timed automaton having a number states and clocks, wherein:
- step a) comprises: - determining a first set of variables to be used for the encoding of the states,
- step b) comprises:
- a transition comprising a starting state, an ending state, a requirement to be fulfilled in order to enable the transition to take place, an action (updating the variables, advancing time, etc.) to be performed when the transition takes place, and a requirement of the clocks to be fulfilled after the transition has taken place,
- step d) comprises:
- step e) comprises:
- step a) comprises: - determining a first set of variables to be used for the encoding of the individual states of the automata,
- step b) comprises:
- non-idling transition comprising a starting state, an ending state, a requirement to be fulfilled in order to enable the transition to take place, an action to be performed when the transition takes place, and a requirement of the clocks to be fulfilled after the transition has taken place
- step d) comprises: - for each transition, generating a data structure over the four set of variables, representing a relation expressing the requirement to be fulfilled in order for the transition to be enabled using the first two set of variables, expressing the action to be performed when the transition takes place using the third and fourth set of variables, and expressing the
- step e) comprises:
- Timed Petri nets is another popular model of timed concurrent systems. These systems can be analyzed by a data structure using a method that from a timed Petri net, which has a number of transitions o and states, each state having a clock and an associated time delay interval, constructs the data structure with a method comprising the steps of: step a) comprises:
- step b) comprises:
- identifying transitions between states a transition comprising a starting state, an ending state, and a requirement to be fulfilled in order to enable the transition to take place, the identified transitions possibly including a transition that advances time,
- step d) comprises:
- step e) comprises:
- a third popular model for analyzing a system uses min/max/linear constraints, the model having a number of nodes, each either being a "max" node, a "min” node or a “linear” node, and a number of constraints each pointing from one node to another, each constraint representing a time interval.
- This model can be analyzed by building a data structure with a method comprising the steps of: step a) comprises:
- step b) comprises:
- step d) comprises:
- step e) comprises:
- Embedded systems, fault-tolerant systems, safety-critical systems, and concurrent compositions of any such systems can be advantageously analyzed by making a model using timed automata, timed Petri nets, or min max/linear constraints models and proceed with one of the above methods for constructing a data structure from the model. Furthermore, a range of other important problems can be addressed with the data structure.
- One example is the interface timing between two components which can be verified using a method comprising:
- Another example is in the analysis of economical systems, operations research systems, transport systems, or planning problems, with a method comprising:
- a third example is for the analysis of the timing behavior of a combinational circuit, with a method comprising:
- a fourth example is the analysis of the timing behavior of combinational parts of a sequential circuit, with a method comprising:
- a fifth example is the analysis of the timing behavior of an asynchronous circuit, the method com- prising:
- a sixth example is for analyzing a sequential or concurrent computer program, the method comprising • modeling statements, such as assignments or conditional guards, as expressions containing inequalities in a data structure as defined earlier,
- the preferred embodiment of the invention is a program for a computer, the program performing any of the methods above and storing the data structure in its memory or on its disk.
- Figure 1 shows Milner's scheduler — a small example of a protocol for starting and detecting termination of JV tasks.
- Figure 5 shows an example of a timed automaton (used in Example 3).
- Figure 6 shows a DDD for the expression x 2 — x ⁇ ⁇ 0.
- Figure 7 shows a DDD for the expression a_ 2 - x ⁇ ⁇ 0.
- Figure 9 shows a DDD for the expression — x ⁇ > 0.
- Figure 10 shows a DDD for the expression 2 — x ⁇ > 0.
- Figure 11 shows a DDD for the expression x 2 — x ⁇ ⁇ 0.
- Figure 12 shows a graph with a negative-weight cycle.
- Figure 14 shows a DDD for 3x. ⁇ (for the expression ⁇ in Figure 2).
- Algorithm 1 MK. Create a node corresponding to the ITE expression x — y ⁇ c - h, l.
- Algorithm 2 MKNORM. Crete a node where the variables not necessarily are normalized.
- Algorithm 5 NOT. Negate a DDD.
- Algorithm 6 FEASIBLE. Determine whether a constraint system has a feasible solution using the Floyd-Warshall algorithm.
- Algorithm 7 REDUCE. Path-reduce a DDD.
- Algorithm 8 FEASIBLE' . Determine whether a constraint system has a feasible solution using an incremental version of Bellman-Ford's algorithm.
- Algorithm 9 INSERTCSTR. Insert a constraint in list keeping it squeezed.
- Algorithm 10 UNSATISFIABLE, TAUTOLOGY, SATISFIABLE, FALSIFIABLE, EQUIVALENT, CONSEQUENCE. Determine functional properties of a DDD based on REDUCE.
- Algorithm 11 ALLINFEASIBLE. Determine whether all 0- or 1-path in a DDD are infeasible.
- Algorithm 12 EXISTSFEASIBLE. Determine whether some 0- or 1-path in a DDD is feasible.
- Algorithm 15 ANYSAT. Create a satisfying variable value assignment for a DDD if it is not unsatisfiable.
- Algorithm 16 EXISTS. Existential quantification of a variable in a DDD.
- Algorithm 17 RELAX. Relaxation of a DDD with a difference constraint.
- Algorithm 19 ASSIGN. Assignment operator
- Algorithm 20 INCREMENT. Increment operator Algorithm 21: REPLACEMENT. Replacement operator
- Algorithm 22 HULL. Convex hull of a DDD.
- Algorithm 23 Merge all disjunctive vertices in a DDD.
- Timed guarded commands is an example of a mathematical notation used to model concurrent systems.
- a timed guarded command program consists of a number of timed guarded commands which have the form
- Timed guarded com- mands are a powerful notation for modeling concurrent systems which contain non-Boolean domains.
- Popular models such as timed Petri nets and timed automata can be represented in a straightforward manner by a timed guarded command program.
- the example is a model of a concurrent system called Milner's scheduler.
- the scheduler consists of N cyclers, connected in a ring, cooperating on starting and detecting termination of iV tasks (these tasks are not further described).
- the scheduler must make sure that the N tasks are always started in order but they are allowed to terminate in any order. This is one of the properties that has to be shown to hold for the model.
- the cyclers attempt at fulfilling this by passing a token: the holder of the token is the only process allowed to start its task. All cyclers are similar except that one of them has the token in the initial state of the system.
- the second command expresses that if the cycler has the token (h — true) and the clock H is within the interval [H l , H u ], then the token is passed on to the next cycler in the ring.
- the third guarded command expresses that the task may terminate at any point if it is running. To complete the model of the scheduler, a timed guarded command for advancing time is needed. Such a command increments the clock H with some arbitrary positive amount ⁇ :
- a single state is a pair (s, v) where s is a discrete state and ⁇ is the associated timing information (a clock assignment).
- R the set of all states reachable from the initial state of the system. This set is denoted R. Observe that R is not a finite set since the clock H is modeled using a real-valued variable: for example R may contain infinitely many states (s, v) where H is between 0.1 and 0.2.
- clock valuations are grouped into sets. This allows the state space of a timed system to be represented as a finite set of pairs (s, V) of discrete states and their associated set of clock valuations.
- a set of clock valuations can be represented as V — 0.1 ⁇ H ⁇ 0.2. It turns out that when constructing the set of reachable states, all groups of clock valuations can be expressed using the following grammar:
- the states of a timed system can be further grouped by combining the discrete state s with the group of clock valuations V. This is done by expanding the above grammar to also include Boolean variables:
- ⁇ :: x — y ⁇ d
- the discrete state is combined with the timing information by expressing the discrete state using the Boolean variables and combine the information using conjunction:
- the formula ⁇ V ⁇ ' is then a formula that represents the set of states ⁇ (s, V), (s 1 , V') ⁇ . This way of representing sets of states using formulas makes it possible to construct the set of reachable states by manipulations of formulas.
- the set of reachable states R is computed using the following algorithm (a standard fixed-point iteration):
- the initial state of the system is represented by the formula ⁇ Q.
- the formula Q represents the "frontier" of the states, i.e., the set of newly discovered states.
- the formula R represents the set of reachable states of the system.
- the procedure SATISFIABLE determines whether a given formula is satisfiable, i.e., whether there exists values for the variables which makes the formula true.
- the procedure NEXT( ⁇ ) determines a formula representing the set of states reachable by executing any timed guarded command or advancing time from a state satisfying ⁇ . This procedure is described in detail in the following.
- the efficiency of the above algorithm is determined by how efficiently one can represent the formulas Q and R and how efficiently one can implement the procedures SATISFIABLE(Q) and NEXT(Q).
- the invention described herein provides a compact data structure for representing formulas of the above form and provides efficient algorithms for implementing the procedures SATISFIABLE(Q) and NEXT( ) - Thus, in an embodiment the invention enables a highly efficient analysis of timed systems.
- the data structure "difference decision diagrams" (DDDs) is an example of an embodiment of the invention.
- a DDD is a directed acyclic graph with two terminals 0 and 1 and a set of non-terminal nodes.
- Each non-terminal node in a DDD comprises a test expression (a difference constraint) and has two outgoing pointers called the high- and low-branch which are drawn with solid and dashed lines, respectively.
- the high-branch is followed when the test expression evaluates to true; the low-branch when the test expression evaluates to false.
- Figure 2 shows a DDD for the formula ⁇
- Fig. 3 shows the values of x and y for which ⁇ is true.
- the invention provides methods for performing the operations needed in the procedures SATIS- FIABLE((3) and NEXT(Q) .
- One method describes how to construct the DDD for the formula ⁇ 0 ⁇ 2 where ⁇ is an arbitrary binary Boolean operator and given DDDs for the formulas ⁇ and ⁇ 2 .
- Another method describes how to construct the DDD for the formula 3x. ⁇ given the variable x and a DDD representing the formula ⁇ .
- the invention provides methods for determining whether a given DDD represents a satisfiable formula. These methods are all described in detail in the following.
- the set of reachable states has been constructed for an increasing increasing number of cyclers, N, using the above algorithm. The results are shown in the Fig.
- the first column shows the number of cyclers, and the following three columns show the CPU time (in seconds) to build the reachable state space using the current tools KRONOS and UPPAAL.
- the last column shows the CPU time for constructing the set of reachable states when using an embodiment of the invention (for example DDDs).
- the results were obtained on a Pentium II PC with 64 MB of memory.
- a ' - ' denotes that the analysis did not complete within an hour.
- the invention enables a dramatic improvement in the size of systems that can be analyzed compared with current state-of-the-art tools.
- the DDD for the formula R ⁇ hi ⁇ h j is construct. If and only if this formula is satisfiable does there exists reachable states in which both cyclers have the token.
- the DDD for the formula R ⁇ ->P is constructed. If and only if this formula is satisfiable does there exists a state in which P does not hold. More general properties can also be determined with the methods described by this invention — this is further explained in the following. Analyzing Timed Systems (Detailed Description)
- a timed guarded command program G comprises a tuple (B, C, T, I), where B is a set of Boolean variables, C is a set of continuous variables called clocks, T is a set of timed guarded commands, and / is a state invariant.
- Guards and state invariants are expressions ⁇ constructed from the following grammar:
- a state of the program G (B, C, T, I) is an interpretation (i.e., a value assignment) of the Boolean variables and the clocks.
- s(b) € denotes the interpretation of b in the state s
- s(x) G denotes the interpretation of x in the state s.
- timed guarded command program G (B, C, T, I) is a transition system (S, ⁇ ), where S is the set of states of the program, and -> is the transition relation.
- the program can either execute a command t € T if its guard is true (a discrete transition) or let time pass ⁇ time units (a timed transition). Executing a command changes the value of some or all of the variables (according to the multi-assignment), and letting time pass uniformly increases the values of all clocks by ⁇ .
- the notation s — s' is used for a discrete transition from the state s to s' obtained by executing the command t, and the notation s — s' for a timed transition obtained by increasing all clocks by ⁇ .
- the timed transition — . for advancing all clocks by ⁇ is defined by the following rule:
- ⁇ 5 , ⁇ ' G K, c denotes a vector of all clocks in C
- c + ⁇ denotes the vector where ⁇ is added to the clocks in c.
- Timed guarded command programs can be used to model popular notations for timed systems such as timed automata.
- a timed automaton over a set of clocks consists of a set of locations, a set of events, and a set of timed transitions.
- Each location is associated with a location invariant over the clocks, and each timed transition from location I to location /' is labeled with an event a and has a guard g over the clocks.
- each of the timed transitions has a set of clocks [c] to be reset when the timed transition is fired:
- a timed automaton can be encoded as a timed guarded command program. Each location is encoded as a Boolean variable.
- the presence of an event from an alphabet ⁇ can be modeled by a global event variable e taking on any of the values in ⁇ . This variable can for instance be encoded using a logarithmic number of Boolean variables.
- Each timed transition in the automaton corresponds to a timed guarded command:
- the guard of the command is the guard of the timed transition g conjoined with the source location I of the timed transition and a condition e a requiring the event variable e to have the value a € ⁇ .
- the multi-assignment assigns false to the source location I and true to the destination location I' of the timed transition and resets the relevant clocks.
- Example 3 Figure 5 shows an automaton over the clocks ⁇ x, y ⁇ with two locations and two timed transitions. Encoding this automaton as a timed guarded command program yields the program G from Example 1 when ignoring the event a and encoding the two locations l ⁇ and l logarithmically using a Boolean variable b.
- the co ⁇ esponding transition system (S, ⁇ ) is analyzed symbolically. That is, given a set of states represented by a formula ⁇ , one determines a formula that represents the set of states reachable by executing timed guarded commands according to the inference rule (3) or by advancing time according to the inference rule (4). In the following it is shown that this formula is obtained by manipulations entirely within o the logic (1).
- Any expression ⁇ generated by the grammar (2) can be represented by a difference constraint expression ⁇ z of the form (1).
- the expression ⁇ z is obtained by introducing a new variable z (denoting "zero") and performing the following three steps: First, encode each Boolean variable b % € B in ⁇ as a difference constraint x ⁇ — x [ ⁇ 0, where x t , x' ⁇ € C are clocks only used in the encoding of b t . 5 Second, replace each occurrence of a constraint of the form x ⁇ d in ⁇ with the difference constraint x — z ⁇ d. Third, express each difference constraint of the form x — y ⁇ d in terms of the relational operator ⁇ .
- the set of states reachable by advancing time by any value ⁇ can be computed by an existential quantification of z.
- an expression representing the set of states reachable from ⁇ j z can be determined.
- the set of states reachable by firing the timed guarded command t from any state in ⁇ z is determined by the function NEXT d1screte ( . t).
- the function restricts ⁇ to the subset where the guard g holds, performs the assignment of the constants d to the variables v, and restricts the resulting set to the subset where the state invariant / holds:
- NEXTdBcrete V NEXT dlscrete (V', «) • (7) teT
- the .--variable plays a central role when determining the set of states that can be reached from by firing a timed transition. Time is advanced by changing the reference-point from z to z' with z' ⁇ z since decreasing the reference-point by ⁇ corresponds to increasing the values of all clocks by ⁇ . Often the system will restrict the valid choices for z' by requiring that the state invariant holds in z' and at all intermediate points in time. This is expressed by the predicate
- the set of states reachable from ⁇ z by advancing time by an arbitrary amount is given by
- time is advanced in a set of states by performing a single existential quantification.
- a timed guarded command t € T is called urgent if it is required to fire instantaneously whenever the guard becomes true. Modifying P next to handle urgent commands is straightforward: Given a set T" C T of urgent timed guarded commands, we let U denote the predicate:
- NEXT( ⁇ ) be a function which determines the set of states which can be reached by firing either a discrete or a timed transition from a state in ⁇ j z :
- NEXT( ⁇ ) NEXT dlscrete ( ⁇ ) V NEXT t ⁇ med ( ⁇ ) .
- the set of states that can reach a given set ⁇ z needs to be determined.
- the set of states that can reach ⁇ z by firing any timed guarded command g — > ⁇ v :— d in T is given by
- the set of states that can reach a state in by firing either a discrete or a timed transitions is:
- TCTL is a timed version of CTL obtained by extending the logic with an auxiliary set of clocks called specification clocks. These clocks do not appear in the model and are used to express timing bounds on the temporal operators.
- the atomic predicates of TCTL are difference constraints over the clocks from the model and the specification clocks. Semantically, the specification clocks become part of the state, they proceed synchronously with the other clocks but are not changed by the model.
- a specification clock u can be bound and reset by a reset quantifier u. ⁇ .
- the set of states satisfying a given TCTL formula ⁇ can be found by a backward computation using a fixed-point iteration for the temporal operators.
- the atomic predicates and the Boolean connectives cor- respond precisely to the corresponding difference constraint expressions.
- the relation R is constructed by combining the transitions of each automaton using disjunctions and then combining the automata using conjunctions.
- the parallel composition of a set of timed automata can be analyzed fully symbolically, i.e., both symbolically with respect to the parallel composition and with respect to the representation of sets of clock valuations and discrete states.
- well-known and very useful tricks from the work on BDDs such as early variable quantification and partitioned representation of the transition relation are immediately applicable.
- the prefe ⁇ ed embodiment of the invention is a data structure called difference decision diagrams or DDDs where the nodes comprise difference constraints such as inequalities of the form x — y ⁇ c or x — y ⁇ c, where x and y are integer or real-valued variables and c is a constant.
- a difference decision diagram (DDD) is a directed acyclic graph. The node set comprises two terminals 0 and 1 with out-degree zero, and a set of non-terminal nodes with out-degree two.
- the symbol ⁇ is used to denote either ⁇ or ⁇ .
- the edge set comprises the edges ( ⁇ , low( ⁇ )) and ( ⁇ , h ⁇ gh( ⁇ )), where v € V is a non-terminal node.
- a root in a DDD is a node that represents an expression of particular interest. Any node in a DDD can be a root.
- a difference decision diagram represents a formula implicitly: Each non-terminal node co ⁇ esponds to an if-then-else operator.
- the if-then-else operator a -> ⁇ , o is defined as (a A ⁇ ) V (->a A ⁇ o), where a is a Boolean expression.
- the meaning of a node (or a root) is defined recursively by:
- the expressions of the nodes in a DDD are ordered. Such an order can for example be constructed from an ordering of the variables x ⁇ , . . . , x n as follows. Assume that the variables are named so that they are ordered according to their indices:
- Pairs of variables (x ⁇ , x ) of a node in a DDD are conveniently assumed to be normalized; that is, x x X j . This does not restrict what can be represented with DDDs, because
- the two operators are preferably ordered such that LE - LEQ, and the constants are preferably ordered as usually in Z or R.
- the 4-tuples (pos(v), neg(v), op(v), const (v)) of attributes are then for example ordered lexicographically.
- An example is:
- a DDD can be implemented as a data structure in a computer program.
- the nodes and pointers are stored in a global table in the computer's memory.
- Associated with each node is a set of attributes consisting of a mathematical expression comprising at least one inequality with at least one variable, and a number of pointers corresponding to the number of outcomes of the expression. If, for example, the expression is a difference constraint, the attributes of a node comprise at least two variables, an inequality operator, a constant, and two pointers.
- Nodes and edges in a DDD can for example be stored as a graph G.
- G comprises the two terminal nodes 0 and 1.
- a non-terminal node comprises at least six attributes of type
- Attr Var x Var x ⁇ LE, LEQ ⁇ X D X V x V.
- Attributes of a node and the node itself are distinguished.
- the node is merely a unique identifier: an index in a table of attributes.
- the edges of G are not stored explicitly, but implicitly via the attributes in the nodes.
- the following operations on the graph are used (Graph denotes the type of the graph G): insert : Graph x Attr — V, member : Graph x Attr -» B, and lookup : Graph x Attr — >• V .
- the function insert (G, a) creates a new node v in G with attributes a and returns ⁇ .
- the high- and low-branches must be nodes already in G, and the variables must be different.
- the function member (G, a) returns true if G contains a node with attributes a.
- the function lookup(G, a) returns the node in G that has attributes a. If G has no node with attributes a, the function is unspecified.
- Insertion can be done in constant time. In practice, however, memory management must be taken into account: Memory must be allocated for the attributes and garbage collection is performed when memory becomes exhausted. These memory management functions can be implemented using standard techniques known to a person skilled in the art such that the expected cost for an insertion will be 0(1). The two other operations (member and lookup) can be done in expected constant time, using a hash table that maps attributes to nodes.
- the algorithms MK and MKDIFFCSTR create DDDs for basic expressions.
- MK creates a DDD for an ITE expression x — y ⁇ c -» h, l
- the basic operation on the DDD data structure is MK, which creates a node for an ITE expression.
- MK only creates locally reduced nodes. Using MK as the only means for creating nodes in the DDD, will make sure that they are locally reduced.
- the function is preferably implemented as the computer program presented in Algorithm 1.
- a pair of variables (x, y) is said to be normalized if x y, i.e., x is after y in the variable ordering.
- MK the pair of variables (x, y) must be normalized, and the node to be created must be ordered with respect to the high- and low-branches.
- the function MK consists of four steps: (1) if the domain is Z, weak upper bounds are used; (2) if G already contains an identical node, it is returned; (3) if the high- and low-branches are identical, one of them is used; and (4) if the test is obviously redundant, the low-branch is returned.
- MK creates only nodes that are locally reduced, provided that the input is ordered. If a pair of variables is not normalized, the function MKNORM shown in Algorithm 2 can for instance be used to normalize a constraint.
- the function MKDIFFCSTR (X, y, o, c) shown in Algorithm 3 uses MK to create DDDs for the six types of difference constraints, see Fig. 6-11.
- the construction is dependent on the operator o, which is one of ⁇ EQ, NEQ, LEQ, GEQ, LE, GR ⁇ .
- the difference constraint can be expressed using LE or LEQ, or a combination of both.
- APPLY shown in Algorithm 4 is preferably used.
- APPLY is based on five equivalences and uses the well-known technique of dynamic programming to avoid exponential running time. Difference constraint expressions can be combined with conjunction, disjunction, implication and bi-implication, and can be negated.
- the APPLY algorithm allows any Boolean combination of two expressions to be performed. Conn denotes the set of all dyadic Boolean connectives.
- APPLY is a generalization of the version used for reduced order binary decision diagrams, which is based on the fact that any binary Boolean operator op distributes over the if-then-else operator:
- This equivalence provides a method to combine two DDDs with a Boolean connective. Reading the equivalence from left to right, it is seen that the Boolean connective can be moved down one level in the DDD. If this is continued, until both arguments of op are 0 or 1, the Boolean expression can be evaluated and the appropriate result returned.
- ⁇ is the topmost constraint on the right-hand side, but also ⁇ ! could be used:
- a global hash-table H of type H ⁇ shT ⁇ ble can be implemented having the following operations:
- the function insert(H, (op, u, v), r) creates a new entry ((op, u, ⁇ ), r) in H where r is the result of computing APPLY (op, u, v).
- the function member (H, (op, u, v)) returns true if APPLY (op, u, v) has been computed previously.
- the function lookup(H, (op, u, ⁇ )) returns the result r of computing APPLY (op, u, ⁇ ). If the result is not in the hash table, the function is unspecified.
- APPLY efficiency of APPLY can be further improved in the special cases, where one of the operands is true or false, or where the two operands are identical.
- a DDD u can be negated by using Algorithm 5, where NPl is the binary operator that negates its first argument and discards the second.
- the data structure can be path-reduced.
- a path reduced DDD all 0- and I-paths are feasible.
- a path defines a constraint system S as the conjunction of all the constraints occurring when following the high- and low-branches in a path.
- such a constraint system can be represented as a directed weighted graph and a solution found by solving a shortest path problem. Determining feasibility (i.e., the existence of a solution) of S co ⁇ esponds to the non-existence of a negative-weight cycle in the constraint graph Gs induced by S.
- the well-known FLOYD- WARSHALL algorithm can be used to find a negative-weight cycle with the algorithm FEASIBLE shown in Algorithm 6.
- the algorithm calls FLOYD-WARSHALL, and if any diagonal-element is negative, it returns false; otherwise, it returns true.
- the Bellman-Ford algorithm uses a technique called relaxation. It makes n — 1 passes over the edges in weighted graph Gs with n nodes, and in each pass all edges are relaxed once.
- a relaxation consists of updating a distance array d, where each entry d t is an estimate on the minimal distance from a virtual node XQ to the node x t . Initially all estimates are set to ( ⁇ 0). Each pass monotonically decreases the estimates in d, and if an estimate has not converged after n - 1 passes, the graph has a negative-weight cycle. That is, if we in the 71 th pass can relax any edge, the graph has a negative- weight cycle.
- the used incremental version of the Bellman-Ford algorithm has been modified at two points: (1) the number of passes to make is minimized, and (2) a better initial estimate than ( ⁇ 0) is used.
- the number of passes is minimized by stopping after the first pass that does not change any estimates in the distance array.
- the improved initial estimates are obtained as follows: After having run the Bellman-Ford algorithm on a graph, and having found that it has no negative- weight cycles, the distance array d contains the minimal distances from xo to all other nodes.
- an extra edge e (x t , x 3 ) is added to the graph.
- This edge may or may not change some or all of the estimates in d, but it will not cause any of the estimates to increase. Thus, the estimates can be reused.
- adding an edge to a graph changes only some of the minimal distances, so there is a good chance that only a few extra passes is needed to recalculate d. For example, if the graph already has a path from x ⁇ to x 3 with weight less than or equal to the weight of e (i.e., e is redundant), then d contains the co ⁇ ect minimal distances, and the algorithm stops after one pass.
- the incremental version of Bellman-Ford is used to test for feasibility in the algorithm REDUCE that path-reduces a DDD.
- the algorithm uses a list L in which each element is a pair ((x l , x J ), ( ⁇ c)) denoting an edge from x t to x d with weight ( ⁇ c).
- the length of the list is limited to n(n — 1) by keeping it squeezed (i.e., removing consecutive tests on the same pair of variables).
- the set W contains the variables in the path from u to v, which gives a bound on the number of passes that have to be made. Very often, the number of variables in a path is much less than n.
- Algorithm 12 returns true if and only if there exists a feasible .-path in v. Algorithm 11 and 12 can then be used to 5 test for functional properties as shown in Algorithm 14.
- e is some sufficiently small, positive constant.
- the value e is preferably chosen to be less than the minimal difference between any two different constants c ⁇ and q in d.
- the existential quantification of a variable x in a DDD u consists of removing all nodes comprising x from u, but keeping all the implicit constraints induced by x among the other variables.
- V 3X.RELAX (/, X, XJ — x t ⁇ —c) if x € ⁇ x x , x 3 ⁇ .
- relaxation of a path p with a constraint x t — x 3 ⁇ c consists of adding a new constraint x — x 3 ⁇ c + c' to p for each constraint x — x t ⁇ c' in p.
- INCREMENT shown in Algorithm 20 can recursively create a new DDD with MK. Again the well-known technique of dynamic programming is preferably used in INCREMENT to make it efficient.
- a replacement is performed as:
- the smallest convex set expressible by a difference constraint expression can for example be computed by enumerating all 1-paths, running Floyd- Warshall on each of these paths, and finally combining them into one matrix by element-wise taking the greatest entry in the matrices. This is done by the function HULL shown Algorithm 22.
- a linear inequality expression can be expressed in the following syntax:
- the nodes of the data strucutre comprise expressions of the form ⁇ - ⁇ t y t ⁇ b, which, as usual, is a shorthand for the expression ⁇ ⁇ y ⁇ - ⁇ + ⁇ n y n ⁇ b.
- ⁇ is an integer- or real-valued constant
- the expressions of the nodes are ordered according to a predetermined criteria.
- the basic algorithms for constructing nodes are adapted to linear inequalities in a straightforward manner.
- the algorithm for combining two data structures is only changed such that the co ⁇ ect ordering is obtained by comparing the order of the linear inequality expressions (and not only the two variables and the bound) comprised in the nodes.
- the algorithm for performing feasibility check is substituted by algorithms for solving linear programming problems or integer linear programming problems.
- the algorithms for determining functional properties are straightforward to adapt using the feasibility checking algorithm.
- the algorithm for finding a satisfying variable assignment can also be constructed in a straightforward manner using the algorithms for solving linear programming prob- lems.
- An algorithm for performing existential quantification can be obtained using Fourier-Motzkin variable elimination along the lines of Algorithm 16 for existential quantification for difference decision diagrams.
- V return REDUCE (U) 0 function TAUTOLOGY (U) : V return REDUCE (u) — 1 function SATISFI ABLE (U) : V return REDUCE(U) ⁇ 0 function FALSIFI ABLE (U) : V return REDUCE (U) ⁇ 1 function EQUIVALENT (U,V) : V x V return TAUTOLOGY (APPLY(BIIMP, u, w)) function CONSEQUENCE(U,I>) : V X V return TAUTOLOGY (APPLY(IMP, U, ⁇ )) Algorithm 11
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computing Systems (AREA)
- Data Mining & Analysis (AREA)
- Evolutionary Computation (AREA)
- Physics & Mathematics (AREA)
- Computational Linguistics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Mathematical Physics (AREA)
- Software Systems (AREA)
- Artificial Intelligence (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
Description
Claims
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
AU53699/99A AU5369999A (en) | 1998-08-27 | 1999-08-27 | A data structure and its use |
EP99939374A EP1105821A1 (en) | 1998-08-27 | 1999-08-27 | A data structure and its use |
Applications Claiming Priority (6)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
DKPA199801084 | 1998-08-27 | ||
DKPA199801084 | 1998-08-27 | ||
DKPA199801095 | 1998-08-31 | ||
DKPA199801095 | 1998-08-31 | ||
DKPA199900277 | 1999-03-01 | ||
DKPA199900277 | 1999-03-01 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2000013113A1 true WO2000013113A1 (en) | 2000-03-09 |
Family
ID=27220564
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/DK1999/000456 WO2000013113A1 (en) | 1998-08-27 | 1999-08-27 | A data structure and its use |
Country Status (3)
Country | Link |
---|---|
EP (1) | EP1105821A1 (en) |
AU (1) | AU5369999A (en) |
WO (1) | WO2000013113A1 (en) |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2002046980A2 (en) * | 2000-12-08 | 2002-06-13 | Configit Software A/S | A method of configuring a product using a directed acyclic graph |
CN105893660A (en) * | 2016-03-30 | 2016-08-24 | 桂林电子科技大学 | CPU design method and calculating system oriented at symbol BDD operation |
-
1999
- 1999-08-27 EP EP99939374A patent/EP1105821A1/en not_active Withdrawn
- 1999-08-27 AU AU53699/99A patent/AU5369999A/en not_active Abandoned
- 1999-08-27 WO PCT/DK1999/000456 patent/WO2000013113A1/en not_active Application Discontinuation
Non-Patent Citations (5)
Title |
---|
BURCH J R ET AL: "SYMBOLIC MODEL CHECKING FOR SEQUENTIAL CIRCUIT VERIFICATION", IEEE TRANSACTIONS ON COMPUTER AIDED DESIGN OF INTEGRATED CIRCUITS AND SYSTEMS,US,IEEE INC. NEW YORK, vol. 13, no. 4, pages 401-424, XP000453301, ISSN: 0278-0070 * |
CHAN W ET AL: "MODEL CHECKING LARGE SOFTWARE SPECIFICATIONS", IEEE TRANSACTIONS ON SOFTWARE ENGINEERING,US,IEEE INC. NEW YORK, vol. 24, no. 7, pages 498-519, XP000781149, ISSN: 0098-5589 * |
JAIN P ET AL: "EFFICIENT SYMBOLIC SIMULATION-BASED VERIFICATION USING THE PARAMETRIC FORM OF BOOLEAN EXPRESSIONS", IEEE TRANSACTIONS ON COMPUTER AIDED DESIGN OF INTEGRATED CIRCUITS AND SYSTEMS,US,IEEE INC. NEW YORK, vol. 13, no. 8, pages 1005-1015, XP000467924, ISSN: 0278-0070 * |
JIN YANG ET AL: "Symbolic model checking for event-driven real-time systems", ACM TRANSACTIONS ON PROGRAMMING LANGUAGES AND SYSTEMS, MARCH 1997, ACM, USA, vol. 19, no. 2, pages 386 - 412, XP002124332, ISSN: 0164-0925 * |
MILLER D M ET AL: "IMPLEMENTING A MULTIPLE-VALUED DECISION DIAGRAM PACKAGE", THE INTERNATIONAL SYMPOSIUM ON MULTIPLE-VALUED LOGIC,US,LOS ALAMITOS, CA: IEEE COMPUTER SOC, PAGE(S) 52-57, ISBN: 0-8186-8372-4, XP000793445 * |
Cited By (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2002046980A2 (en) * | 2000-12-08 | 2002-06-13 | Configit Software A/S | A method of configuring a product using a directed acyclic graph |
WO2002046980A3 (en) * | 2000-12-08 | 2002-09-26 | Configit Software Aps | A method of configuring a product using a directed acyclic graph |
EP1796005A2 (en) * | 2000-12-08 | 2007-06-13 | Configit Software A/S | A method of configuring a product |
EP1796005A3 (en) * | 2000-12-08 | 2007-07-04 | Configit Software A/S | A method of configuring a product |
US7584079B2 (en) | 2000-12-08 | 2009-09-01 | Configit Software A/S | Method of configuring a product |
CN105893660A (en) * | 2016-03-30 | 2016-08-24 | 桂林电子科技大学 | CPU design method and calculating system oriented at symbol BDD operation |
CN105893660B (en) * | 2016-03-30 | 2018-10-19 | 桂林电子科技大学 | A kind of CPU design method and computing system towards symbol BDD operations |
Also Published As
Publication number | Publication date |
---|---|
EP1105821A1 (en) | 2001-06-13 |
AU5369999A (en) | 2000-03-21 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
Bryant et al. | Modeling and verifying systems using a logic of counter arithmetic with lambda expressions and uninterpreted functions | |
Clarke et al. | Counterexample-guided abstraction refinement for symbolic model checking | |
Bryant | Binary decision diagrams | |
Buccafurri et al. | Enhancing model checking in verification by AI techniques | |
Chechik et al. | Model-checking over multi-valued logics | |
Jacobs et al. | Featherweight verifast | |
JP2007528059A (en) | Systems and methods for software modeling, abstraction, and analysis | |
Ravi et al. | Hints to accelerate symbolic traversal | |
Schellhorn et al. | RGITL: A temporal logic framework for compositional reasoning about interleaved programs | |
Bouajjani et al. | Rewriting Systems with Data: A Framework for Reasoning about Systems with Unbounded Structures over Infinite Data Domains | |
Bos et al. | Formal specification and analysis of industrial systems | |
Möller et al. | Predicate abstraction for dense real-time systems | |
Bae et al. | Symbolic state space reduction with guarded terms for rewriting modulo SMT | |
Abrahám et al. | Optimizing bounded model checking for linear hybrid systems | |
Lind-Nielsen et al. | Verification of large state/event systems using compositionality and dependency analysis | |
Liu et al. | From Datalog rules to efficient programs with time and space guarantees | |
Berry et al. | An implementation of constructive synchronous programs in POLIS | |
Lamport et al. | Prophecy made simple | |
WO2000013113A1 (en) | A data structure and its use | |
Boucheneb et al. | Time based deadlock prevention for Petri nets | |
Schellhorn | Completeness of ASM refinement | |
Gurfinkel | Multi-valued symbolic model-checking: Fairness, counter-examples, running time | |
Kuntz | Symbolic semantics and verification of stochastic process algebras | |
Morbé et al. | Fully symbolic TCTL model checking for complete and incomplete real-time systems | |
Tahar et al. | Three approaches to hardware verification: HOL, MDG, and VIS compared |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AK | Designated states |
Kind code of ref document: A1 Designated state(s): AE AL AM AT AT AU AZ BA BB BG BR BY CA CH CN CR CU CZ CZ DE DE DK DK EE EE ES FI FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MD MG MK MN MW MX NO NZ PL PT RO RU SD SE SG SI SK SK SL TJ TM TR TT UA UG US UZ VN YU ZA ZW |
|
AL | Designated countries for regional patents |
Kind code of ref document: A1 Designated state(s): GH GM KE LS MW SD SL SZ UG ZW AM AZ BY KG KZ MD RU TJ TM AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE BF BJ CF CG CI CM GA GN GW ML MR NE SN TD TG |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application | ||
DFPE | Request for preliminary examination filed prior to expiration of 19th month from priority date (pct application filed before 20040101) | ||
WWE | Wipo information: entry into national phase |
Ref document number: 1999939374 Country of ref document: EP |
|
WWE | Wipo information: entry into national phase |
Ref document number: 09763753 Country of ref document: US |
|
WWP | Wipo information: published in national office |
Ref document number: 1999939374 Country of ref document: EP |
|
REG | Reference to national code |
Ref country code: DE Ref legal event code: 8642 |
|
WWW | Wipo information: withdrawn in national office |
Ref document number: 1999939374 Country of ref document: EP |