SMT-based generation of symbolic automata

Abstract

Open pNets are formal models that can express the behaviour of open systems, either synchronous, asynchronous, or heterogeneous. They are endowed with a symbolic operational semantics in terms of open automata, which allows us to check properties of such systems in a compositional manner. We present an algorithm computing these semantics, building predicates expressing the synchronisation conditions between the events of pNet sub-systems. Checking such predicates requires symbolic reasoning about first order logics and application-specific data. We use the Z3 SMT engine to check satisfiability of the predicates. We also propose and implement an optimised algorithm that performs part of the pruning on the fly, and show its correctness with respect to the original one. We illustrate the approach using two use-cases: the first one is a classical process-algebra operator for which we provide several encodings, and prove some basic properties. The second one is industry-oriented and based on the so-called “BIP architectures”, which have been used to specify the control software of a nanosatellite at the EPFL Space Engineering Center. We use pNets to encode a BIP architecture extended with explicit data, compute its semantics and discuss its properties, and then show how our algorithms scale up, using a composition of two such architectures.

Appendix A Semantic rules of pNets

To facilitate the understanding of the two algorithms, we briefly recall the semantic rules of pNets, more details can be found in [28].

We build the semantics of an open pNet as an open automaton where LTSs are the PLTSs at the pNet leaves, and the states of the automaton are structured. To build an open transition we first projects the global state into states of the leaves, then apply PLTS transitions on these states, and compose them with actions of holes using synchronisation vectors.

The semantics regularly instantiates fresh variables, and uses a clone operator that clones a term replacing each variable with a fresh one. The variables in each synchronisation vector are considered local: for a given pNet expression, we must have fresh local variables for each occurrence of a vector. Similarly, the state variables of each copy of a given PLTS in the system must be distinct, and those created for each application of Tr2 have to be fresh and all distinct.

The reader may notice that the structure of OTs produced by these rules is richer than the one from the definitions in Sect. 4, as they contain information about the leaves transitions in each OT. This is also the case in the implementation, and provides us with tracability and debugging features in the tool.

Definition 6

(Operational semantics of open pNets) The semantics of a pNet p is an open automaton $A = \langle Leaves(p),J,\mathcal {S}, s_0, \mathcal {T}\rangle$ where:

• J is the indices of the holes: $Holes(p)= H_j^{j\in J}$.

• $\overline{\mathcal {S}} = States(p)$ and $s_0 = InitState(p)$

• $\mathcal {T}$ is the smallest set of open transitions satisfying the rules below:

The first rule (Tr1) for a PLTS p checks that the guard is verified and transforms assignments into post-conditions:

Tr1::

The second rule (Tr2) deals with pNet nodes: for each possible synchronisation vector applicable to the rule subject, the premisses include one open transition for each sub-pNet involved, one possible action for each hole involved, and the predicate relating these with the resulting action of the vector. A key to understand this rule is that the open transitions are expressed in terms of the leaves and holes of the pNet structure, i.e. a flatten view of the pNet. For example, in the rule, L is the index set of the leaves of the open pNet, $L_k$ is the index set of the leaves of one subnet, thus all $L_k$ are disjoint subsets of L.

Tr2::

In rule TR2, the generated predicate is composed of the conjunction of the predicates of the subnets’ OTs, with the additional part encoding the application of the chosen synchronisation vector. In [28] this last part is defined as:

$$\begin{aligned} {\textit{MkPred}}(SV_k, a_i^{i\in I}, b_j^{j\in J}, v)\Leftrightarrow SV_k={(a_i)}^{i\in I}, {(b_j)}^{j\in J}\rightarrow v \end{aligned}$$

Within Algorithm 1, these subsets have been computed by the Combining method and passed as arguments to the Matching method (cf. Sect. 4)

To have some practical interest, it is important to know when Algorithm 1 terminates. The following theorem shows that if an open pNet has finite synchronisation sets, finitely many leaves and holes, and each PLTS at its leaves has a finite number of states and (symbolic) transitions, then Algorithm 1 terminates and the operational semantics of the open pNet is a finite automaton.

Theorem 4

(Finiteness) [28] Let $pnet=\langle \overline{{\textit{pNet}}},\overline{S}, {\textit{SV}}_k^{k\in K}\rangle$ be an open pNet with leaves $l_i^{i\in I}$ and holes $h_j^{j\in J}$, where the sets I and J are finite. Suppose the synchronisation vectors of all pNets included in pnet are finite, and $l_i$ has a finite number of state variables for each $i\in I$. Then the semantics of pnet is an open automaton with finitely many states and transitions.

Proof

The possible set of states of the open automaton is the cartesian product of the states of the pNet $PLTS_i^{i\in I}$, which is finite by hypothesis. So the top-level residual loop of Algorithm 1 terminates provided each iteration terminates. The enumeration of open-transitions in line 5 of Algorithm 1 is bounded by the number of applications of rule Tr2 on the structure of the pNet tree. Since a finite number of synchronisation vectors are applied at each node, the number of global open transitions is finite. Similarily, if the number of transitions of each PLTS is finite, rule Tr1 is applied a finite number of times. Therefore, each internal loop of Algorithm 1 terminates, and we obtain finitely many deduction trees and open transitions. $\square$