We describe an algebra of Edge-Valued Decision Diagrams (EVMDDs) to encode arithmetic functions and its implementation in a model checking library along with state-of-the-art algorithms for building the transition relation and the state space of discrete state systems. We provide efficient algorithms for manipulating EVMDDs and give upper bounds of the theoretical time complexity of these algorithms for all basic arithmetic and relational operators. We also demonstrate that the time complexity of the generic recursive algorithm for applying a binary operator on EVMDDs is no worse than that of Multi-Terminal Decision Diagrams. We have implemented a new symbolic model checker with the intention to represent in one formalism the best techniques available at the moment across a spectrum of existing tools: EVMDDs for encoding arithmetic expressions, identity-reduced MDDs for representing the transition relation, and the saturation algorithm for reachability analysis. We compare our new symbolic model checking EVMDD library with the widely used CUDD package and show that, in many cases, our tool is several orders of magnitude faster than CUDD

Roux, Pierre

Siminiceanu, Radu I.

Abstract. We describe an algebra of Edge-Valued Decision Diagrams (EVMDDs) to encode arithmetic func-tions and its implementation in a model checking library along with state-of-the-art algorithms for building the transition relation and the state space of discrete state systems. We provide efficient algorithms for manipulating EVMDDs and give upper bounds of the theoretical time com-plexity of these algorithms for all basic arithmetic and relational operators. We also demonstrate that the time complexity of the generic recursive algorithm for applying a binary operator on EVMDDs is no worse than that of Multi-Terminal Decision Diagrams. We have implemented a new symbolic model checker with the intention to represent in one formalism the best techniques available at the moment across a spectrum of existing tools: EVMDDs for encoding arithmetic expres-sions, identity-reduced MDDs for representing the transition relation, and the saturation algorithm for reachability analysis. We compare our new symbolic model checking EVMDD library with the widely used CUDD package and show that, in many cases, our tool is several orders of magnitude faster than CUDD

Pierre Roux

Radu I. Siminiceanu

CiteSeerX

Model Checking with Edge-valued Decision Diagrams

NASA Technical Reports Server

Model-Checking with Edge-Valued Decision Diagrams

We describe an algebra of Edge-Valued Decision Diagrams (EVMDDs) to encode arithmetic functions and its implementation in a model checking library. We provide efficient algorithms for manipulating EVMDDs and review the theoretical time complexity of these algorithms for all basic arithmetic and relational operators. We also demonstrate that the time complexity of the generic recursive algorithm for applying a binary operator on EVMDDs is no worse than that of Multi- Terminal Decision Diagrams. We have implemented a new symbolic model checker with the intention to represent in one formalism the best techniques available at the moment across a spectrum of existing tools. Compared to the CUDD package, our tool is several orders of magnitude faste

Model Checking with Edge Valued Decision Diagrams
Pierre Roux, E´cole Normale Supe´rieure de Lyon, France. pierre.roux@ens-lyon.fr
Radu I. Siminiceanu, National Institute of Aerospace, Hampton, Virginia, USA. radu@nianet.org
Abstract
We describe an algebra of Edge-Valued Decision Diagrams (EVMDDs) to encode arithmetic
functions and its implementation in a model checking library. We provide efficient algorithms for
manipulating EVMDDs and review the theoretical time complexity of these algorithms for all basic
arithmetic and relational operators. We also demonstrate that the time complexity of the generic
recursive algorithm for applying a binary operator on EVMDDs is no worse than that of Multi-
Terminal Decision Diagrams.
We have implemented a new symbolic model checker with the intention to represent in one
formalism the best techniques available at the moment across a spectrum of existing tools. Compared
to the CUDD package, our tool is several orders of magnitude faster.
1 Introduction
Binary decision diagrams (BDD) [3] have revolutionized the reachability analysis and model checking
technology. Arithmetic decision diagrams [2], also called Multi-Terminal Binary Decision Diagrams
(MTBDD) [8] are the natural extension of regular BDDs to arithmetic functions. They take advantage of
the symbolic encoding scheme of BDDs, but functions with large co-domains do not usually have a very
compact representation because there are less chances for suffixes to be shared.
Edge-valued decision diagrams have been previously introduced, but only scarcely used. An early
version, the edge valued binary decision diagrams (EVBDD) [11], is particularly useful when represent-
ing both arithmetic and logic functions, which is the case for discrete state model checking. However,
EVBDD have only been applied to rather obscure applications: computing the probability spectrum and
the Reed-Muller spectrum of (pseudo)-Boolean functions.
Binary Moment Diagrams [4] were designed to overcome the limitations of BDDs/EVBDDs when
encoding multiplier functions. However, their efficiency seems to be limited only to this particular type of
functions. A new canonization rule for edge-valued decision diagrams enabling them to encode functions
inZ∪{+∞}was introduced in [6] along with EVMDDs, an extension to multi-way diagrams (MDD) [9],
but, again, this was applied to a very specific task, of finding minimum length counterexamples for safety
properties. Later, EVMDDs have been also used for partial reachability analysis.
In this paper we first present a theoretical comparison between EVMDDs and MTMDDs for building
the transition relation of discrete state systems before dealing with an implementation in a model checker
along with state-of-the-art algorithms for state space construction.
2 Background
2.1 Discrete-state Systems
A discrete–state model is a triple (S,S0,T ), where the discrete set S is the potential state space of the
model; the set S0 ⊆ S contains the initial states; and T : S→ 2S is the transition function specifying
which states can be reached from a given state in one step, which we extend to sets: T (X) =
⋃
i∈X
T (i).
We consider structured systems modeled as a collection of K submodels. A (global) system state i is
then a K-tuple (iK , . . . , i1), where ik is the local state for submodel k, for K≥ k≥1, and S is given by
SK ×·· ·× S1, the cross–product of K local state spaces Sk, which we identify with {0, . . . ,nk−1} since
Proceedings of NFM 2010, April 13-15, 2010, Washington D.C., USA. 222
https://ntrs.nasa.gov/search.jsp?R=20100018541 2019-08-29T19:03:33+00:00Z
Model Checking with Edge-valued Decision Diagrams Roux & Siminiceanu
we assume that S is finite. The (reachable) state space R⊆ S is the smallest set containing S0 and closed
with respect to T , i.e. R = S0∪T (S0)∪T (T (S0)∪·· ·= T ∗(S0). Thus, R is the least fixpoint of function
X 7→ S0∪T (X).
2.2 Decision Diagrams
We discuss the extension of BDDs to integer variables, i.e., multi–valued decision diagrams (MDDs)
[9]. We assume that the variables along any path from the root must follow the order xK , . . . ,x1. Or-
dered MDDs can be either reduced (no duplicate nodes and no node with all edges pointing to the same
node, but edges possibly spanning multiple levels) or quasi–reduced (no duplicate nodes, and all edges
spanning exactly one level), either form being canonical.
3 EVMDDs
Definition 1. An EVMDD on a group (G,∗), is a pair A = 〈v,n〉, where v ∈ G is the edge value also
denoted as A.val and n is a node also denoted A.node.
A node n is either the unique terminal node 〈0,e〉 where e is the identity element of G, or a pair 〈k, p〉
where 1 ≤ k ≤ K and p is an array of edges of size nk (cardinality of Sk). The first element of the pair
will be denoted n.level and, when relevant, the i-th element in the array will be denoted by n[i].
Definition 2. For a node n with n.level = k and (ik, . . . , i1) ∈ Sk × ·· · × S1, we define n(ik, . . . , i1) as
n[ik].val if n[ik].node.level = 0 and n[ik].val∗n[ik].node(in[ik].node.level, . . . , i1) otherwise.
The function encoded by an EVMDD A, f : S→G,(iK , . . . , i1) 7→ A.val∗A.node(iA.node.level, . . . , i1) is
the repetitive application of law ∗ on the edge values along the path from the root to the terminal node,
corresponding to arcs ik, for K ≥ k ≥ 1:
Definition 3. A canonical node is either the terminal node or a node n such that n[0].val = e.
A canonical EVMDD contains only canonical nodes.
It can be proved that any function f has a unique canonical EVMDD representation [6].
Examples of graph representations of EVMDDs are given in Figure 1.
x2 0 1 2
x1 0 1 x1 0 1
0
0
0
0
0
0 1 0
2
x2 0 1 2
x1 0 1 x1 0 1 x1 0 1
0
0
0
0
0
0
0 0 1 0
2
x2 0 1 2
x1 0 1 x1 0 1 x1 0 1
0
1
−1 −2 0
0
0 1 2 −1
0
Figure 1: EVMDDs on (Z,+) representing the same function f : {0,1,2}×{0,1}→Z,(x2,x1) 7→ x2 ·x1.
The leftmost EVMDD is reduced while the others are quasi–reduced. The rightmost EVMDD is not
canonical.
EVMDDs can be used when even the algebraic structure G is not a group. For example, [6] of-
fers a canonization rule for N∪ {+∞}. Also, (Z,×) that can be handled with the canonization rule
“gcd{n[i].val | i ∈ Sn.level}= 1 and (n[0].val, . . . ,n[nn.level].val)≥lex 0”.
Proceedings of NFM 2010, April 13-15, 2010, Washington D.C., USA. 223
Model Checking with Edge-valued Decision Diagrams Roux & Siminiceanu
4 EVMDDs compared to MTMDDs
MTBDDs are commonly used in model checking to build the transition relation of discrete-state systems.
In this section we show that EVMDDs are at least as suited to that purpose and oftentimes significantly
better. In the following, we choose, without loss of generality, (G,∗) = (Z,+).
4.1 Space Complexity
Theorem 1. For any function f , the number of nodes of the EVMDD representing f is at most the number
of nodes of the MTMDD representing the same function f .1
4.2 Time complexity
Section 2 of [8] gives an algorithm to compute any binary operation on BDDs. The apply algorithm can
be easily generalized to MDDs for any n-ary operator n. It computes its result in time O
(
n
∏
i=1
| fi|
)
,
where | fi| is the size (in nodes) of the MTMDD representing operand i.
Section 2.2 of [10] gives the equivalent apply algorithm for edge-valued decision diagrams.
Theorem 2. The number of recursive calls of the generic apply algorithm for MTMDDs is equal to that
for EVMDDs representing the same function [10].
Hence, EVMDD computations are at least not worse than the MTMDD counterpart. However, par-
ticular operators n may enable much better algorithms on EVMDDs. Below is a synopsis of the basic
algorithms to manipulate EVMDDs.
• Addition of constant ( f + c): O(1).
• Multiplication with scalar ( f × c): O(| f |) [10].
• Addition ( f +g): O(| f | |g|) [10].
• Remainder and Euclidean Division: O(| f |c).
• Minimum and Maximum: O(| f |).
• Relational Operator with constant ( f < c): not better in the worst case,
but in practice the complexity can be improved, by using min and max.
• Relational Operators ( f < g): can be computed as ( f −g < 0).
4.3 Multiplication
As stated in [10], the result of a multiplication can have an EVMDD representation of exponential size in
terms of the operands. For example, let S be {0,1}K , f : (xK , . . . ,x1) 7→
K
∑
k=2
xk2k−2 and g : (xK , . . . ,x1) 7→
x1, f and g both have an EVMDD representation with K + 1 nodes whereas f ·g has 2K nodes. There-
fore, we cannot expect to find an algorithm with better worst-case complexity. However, the following
equation, coming from the decomposition of 〈v,n〉 in v+ 〈0,n〉 and 〈v′,n′〉 in v′+ 〈0,n′〉
〈v,n〉×〈v′,n′〉= vv′+ v〈0,n′〉+ v′〈0,n〉+ 〈0,n〉×〈0,n′〉
1All proofs and algorithms are given in a technical report [12], to appear.
Proceedings of NFM 2010, April 13-15, 2010, Washington D.C., USA. 224
Model Checking with Edge-valued Decision Diagrams Roux & Siminiceanu
suggests an alternative algorithm.
The first product is an integer multiplication done in constant time. The next two are multiplications
by a constant done in O(| f |) and O(|g|), respectively. The last one is done through recursive calls. The
first addition takes constant time, the second one takes O(| f | |g|) and produce a result of size at most
| f | |g|, hence a cost of O(| f | |g| | f g|) for the last addition. The recursive function is called O(| f | |g|)
times, hence a final complexity of O
(| f |2 |g|2 | f g|).
Although we were unable to theoretically compare this algorithm to the generic apply algorithm, it
seems to perform far better on practical cases.
5 Implementation
Model Reachable CUDD SMART EVMDD
size states (in s) (in s) (in s)
Dining philosophers
100 4×1062 11.42 1.49 0.03
200 2×10125 3054.69 3.03 0.07
15000 2×109404 — — 195.29
Round robin mutual exclusion protocol
40 9×1013 4.44 0.44 0.08
100 2×1032 — 2.84 1.17
200 7×1062 — 20.02 9.14
Slotted ring protocol
10 8×109 1.16 0.19 0.01
20 2×1020 — 0.71 0.04
200 8×10211 — 412.27 25.97
Model Reachable CUDD SMART EVMDD
size states (in s) (in s) (in s)
Kanban assembly line
15 4×1010 80.43 3.41 0.01
20 8×1011 2071.58 8.23 0.02
400 6×1025 — — 74.89
Knights problem
5 6×107 1024.42 5.29 0.27
7 1×1015 — 167.41 3.46
9 8×1024 — — 32.20
Randomized leader election protocol
6 2×106 4.22 8.42 0.86
9 5×109 — 954.81 18.89
11 9×1011 — — 109.25
Table 1: Execution times for building state space using our library or CUDD (“—” means “> 1hour”).
Symbolic model checkers, such as (Nu)SMV or SAL, are based on the library CUDD[1] which offers
an efficient implementation of BDDs and MTBDDs. Our goal was to implement a new symbolic model
checking library featuring EVMDDs for the transition relation construction and saturation[5] for state
space generation. We also developed a basic model checking front-end to test the library and compare it
to CUDD. Binaries and source code for both the EVMDD library and the model checker are available at
http://research.nianet.org/˜radu/evmdd/.
5.1 Encoding the Transition Relation
We represent the transition relation T as a disjunction of events which is well suited for globally–
asynchronous locally–synchronous systems, where each event encodes some local transition. To avoid
the expensive coding of lot of identities, we use the full-identity reduction from [7].
5.2 State Space Construction
For state space construction, we use the Saturation algorithm [5] instead of the classical breadth first
search exploration. This heuristic often gives spectacular improvements when building the state spaces of
globally–asynchronous locally–synchronous systems. This is certainly the major source of improvement
of our implementation over existing BDD libraries.
Proceedings of NFM 2010, April 13-15, 2010, Washington D.C., USA. 225
Model Checking with Edge-valued Decision Diagrams Roux & Siminiceanu
5.3 Experimental Results
Our new tool comprises 7K lines of ANSI-C code for the library and 4K lines for the simple model
checker that provides a common interface to both our library and CUDD. Table 1 shows execution times
for building the state space on a suite of classical models. Programs to generate all models can be found
in the examples folder of our source code distribution.
We collected the results on a Linux machine with Intel Core 2 processor, 1.2GHz, 1.5GB of memory.
Note that using other existing tools, such as NuSMV or SAL on these models, we get execution times
of the same order of magnitude as with the CUDD interface of our tool.
Compared to the first implementation of saturation algorithm [5] in the tool SMART, our new im-
plementation is always several (up to a few dozens) times faster. This is due to both the encoding of the
transition relation and our simple C implementation in comparison to the object-oriented C++ version.
6 Conclusions and Future Work
We have studied the advantages of the EVMDD data structure over the widely used MTBDDs for the
construction of transition relations of finite state systems and implemented them in a library, along with
state-of-the-art algorithms for state space generation. We obtained execution times several orders of
magnitude faster than the CUDD library and classical algorithms, with a reduced memory usage enabling
to handle extremely large systems. Future work should focus primarily on integrating our library into the
SAL model checker.
Our results show that symbolic model checking remains an efficient technique for analyzing globally–
asynchronous locally–synchronous systems and significant improvements are still possible.
References
[1] Colorado University Decision Diagram library. http://vlsi.colorado.edu/˜fabio/CUDD/.
[2] R. I. Bahar, E. A. Frohm, C. M. Gaona, G. D. Hachtel, E. Macii, A. Pardo, and F. Somenzi. Algebraic
decision diagrams and their applications. In ICCAD, pages 188–191, 1993.
[3] R. E. Bryant. Graph-based algorithms for boolean function manipulation. IEEE Transactions on Computers,
35:677–691, 1986.
[4] R. E. Bryant and Y.-A. Chen. Verification of arithmetic functions with binary moment diagrams. Technical
Report CS-94-160, CMU, 1994.
[5] G. Ciardo, G. Lu¨ttgen, and R. Siminiceanu. Saturation: An efficient iteration strategy for symbolic state
space generation. In Proc. TACAS, LNCS 2031, pages 328–342, Genova, Italy, Apr. 2001. Springer.
[6] G. Ciardo and R. Siminiceanu. Using edge-valued decision diagrams for symbolic generation of shortest
paths. In Proc. FMCAD, LNCS 2517, pages 256–273, Portland, OR, USA, Nov. 2002. Springer.
[7] G. Ciardo and J. Yu. Saturation-based symbolic reachability analysis using conjunctive and disjunctive par-
titioning. In Proc. CHARME, October 2005.
[8] E. Clarke, M. Fujita, and X. Zhao. Application of multi-terminal binary decision diagrams. Technical report,
IFIP WG 10.5 Workshop on Applications of the Reed-Muller Expansion in Circuit Design, 1995.
[9] T. Kam, T. Villa, R. Brayton, and A. Sangiovanni-Vincentelli. Multi-valued decision diagrams: theory and
applications. Multiple-Valued Logic, 4(1–2):9–62, 1998.
[10] Y.-T. Lai, M. Pedram, and B. K. Vrudhula. Formal verification using edge-valued binary decision diagrams.
IEEE Trans. Comput., 45:247–255, 1996.
[11] Y.-T. Lai and S. Sastry. Edge-valued binary decision diagrams for multi-level hierarchical verification. In
DAC, pages 608–613, 1992.
[12] P. Roux and R. Siminiceanu. Model checking with edge-valued decision diagrams. CR submitted, NASA,
Langley Research Center, Hampton VA 23681-2199, USA, March 2010.
Proceedings of NFM 2010, April 13-15, 2010, Washington D.C., USA. 226


Model-Checking with Edge-Valued Decision Diagrams

Abstract

Similar works

Full text

Available Versions

CiteSeerX

NASA Technical Reports Server

NASA Technical Reports Server