On improving efficiency of model checking through systematically ...

Note that although it is possible to explicitly specify a control structure
(automaton) in an Nbac input model, we cannot map the automaton in an
XTG model to a control structure in an Nbac model directly one-to-one. The
reason is that a dataflow equation b ′ i = φ i( ⃗ b,⃗c, ⃗x, ⃗y) orx ′ k = ψ k( ⃗ b,⃗c, ⃗x, ⃗y)
must be specified for every state variable in such a way that the equation
expression remains the same for any edge (transition) in the resulting Nbac
model, while it is not the case in an XTG model.
We use Boolean variables to specify locations in Nbac. Every location
loc i will be represented by a Boolean state variable l i . As such, if the system
is in loc j , l j = true ∧ l i,i≠j = false. Boolean variables are used to model
locations for the reason that Booleans are handled exactly while Integers
are abstracted in Nbac.
In our example, lij ∈{l10,l11,l12,l13,l20,l21,l22,l23} is a Boolean
variable representing a location loc j of process p i . This naming rule is just
our convention.
Transitions are modeled implicitly through dataflow equations in Nbac.
The specification of transitions is best explained through a few cases in the
Fischer’s protocol presented in Figure 2.4.
l10’ = if p1
then
if l12 then not lock1
else l13
else l10;
lock1’ = if p1 then
if l11 then true
else if l13 then false
else lock1
else if p2 then
if l21 or l23 then false
else lock1
else lock1;
c1’ = if tick then c1+1
else if p1 and (l10 or l11) then 0
else c1;
Figure 2.4: Using dataflow equations to model transitions
Consider the equation on l10. The purpose of the equation is to give
the value for l10 at the next execution step. According to the external environment
setting specified by the assertion on input variables p1,p2,tick,
there are three possibilites: process 1 takes action (p1), process 2 takes action
(p2), or time action (tick). In the two later cases, the value of l10 does
17