Symbolic model checking of timed guarded commands using difference decision diagrams

We describe a novel methodology for analyzing timed systems symbolically. Given a formula representing a set of states, we describe how to determine a new formula that represents the set of states reachable by taking a discrete transition or by advancing time. The symbolic representations are given as formulae expressed in a simple first-order logic over difference constraints of the form x y d which can be combined with Boolean operators and existentially quantied. We also show how to symbolically determine the set of states that can reach a given set of states (i.e., a backward step), thus making it possible to verify timed ctl-formulae symbolically. The main contribution is a way of advancing time symbolically essentially by quantifying out a special variable z which is used to represent the current zero point in time. We also describe a data structure called ddds for representing difference constraint formulae, and we demonstrate the efficiency of the symbolic technique by analyzing two scheduling protocols using a ddd-based model checker