On improving efficiency of model checking through systematically ...

in their domain (B = {T,F} for Booleans and N for Integers). If an
assertion constrains their values, they may take non-deterministically
any values satisfying the constraint.
In the example, init,ok,x,y,b0,b1 are state variables; p1,p2 are input
variables.
2.1.2 Dataflow equation (transition part)
The transition part Transdefines a set of parallel equations b ′ i = φ i( ⃗ b,⃗c, ⃗x, ⃗y),
i =1...m and x ′ k = ψ k( ⃗ b,⃗c, ⃗x, ⃗y), k =1...p giving the value of each state variable
at the next execution step, as a function of the current values of state
and input variables. In these equations, expressions φ i and ψ k are wellformed
expressions of suitable types, possibly mixing Boolean expressions
and linear numerical expressions. Atoms of Boolean expressions can be either
Boolean variables or linear constraints. A conditional if-then-else
statement can be used in a dataflow equation.
In the example, init is set to true once at the initial state of the system
(described in the initial part). In the transition part, init is set to false
for all subsequent executions because it specifies whether or not the system
is in the initial state. The Boolean variable ok models the status in which
the system still satisfies the condition x ≥ y. Variables b0,b1,x,y model
the behavior of the M.
2.1.3 Assertion
An assertion a allows to constrain the values of input variables depending on
the current state. It is defined by a Boolean expression Assert on variables,
which give for each state the possible values for input variables:
a = Assert( ⃗ b,⃗c, ⃗x, ⃗y)
In the example, there is an assertion to constrain the values of two input
variables p1 and p2:
p1 and not p2 or not p1 and p2;
This assertion means that p1,p2 can be either true or false but they never
take the same value.
11