Model Checking and Abstraction .
1517
transition systems and the notion of abstraction that we use. Section 4
discusses constructing an approximate abstract transition system directly
from a program. It also discusses the conditions required for exactness.
Section 5 is the heart of our paper; we relate the theory developed in the
previous sections to the temporal logic that we use for specifications. In
particular, we prove that our method is conservative in the case of VCTL*
formulas. We also note that, if the approximation is exact, then all CTL*
formulas are preserved, Section 6 describes a programming language that can
be used for specifying finite-state systems, and describes the verification of
several systems via a variety of abstractions. The paper concludes with a
discussion of some directions for future research.
2. BINARY DECISION DIAGRAMS
Binary decision diagrams (BDDs) are a canonical form representation for
Boolean formulas described by Bryant [1986]. They are often substantially
more compact than traditional normal forms such as conjunctive normal form
and disjunctive normal form, and they can be manipulated very efficiently.
Hence, they have become widely used for a variety of CAD applications,
including symbolic simulation [Beatty et al. 1991], verification of combinat-
ional logic [Fujita et al. 1988], and verification of sequential circuits [Burch
et al. 1990; Coudert and Madre 1990; Touati et al. 1990]. A BDD is similar to
a binary decision tree, except that its structure is a directed acyclic gralph
rather than a tree, and there is a strict total order placed on the occurrence of
variables as one traverses the graph from root to leaf. Consider, for example,
the BDID of Figure 1. It represents the formula (a ~ b) v (c ~ o?), using the
variable ordering a < b < c <
d. Given an assignment of Boolean values to
the varnables a, b, c, and
d, one can decide whether the assignment makes
the formula true by traversing the graph beginning at the root and branching
at each node, based on the value assigned to the variable that labels the node.
For example, the valuation {a = 1, b = O, c = 1,
d = 1} leads to a leaf node
labeled 1; hence, the formula is true for this assignment.
Bryant [ 1986] showed that, given a variable ordering, there is a canonical
BDD for every formula. The size of the BDD depends critically on the variable
ordering. Bryant gave algorithms of linear complexity for computing the BDD
representations of 7 f and f V g given the BDDs for formulas
f and g.
Quantification over Boolean variables and substitution of a variable by a
formula are also straightforward using this representation.
Another way to view BDDs is as deterministic finite automata (DFAs)
[Clarke and Kimura 19901. The initial state of the automata is the root oft he
BDD, and the only accepting state is the terminal 1. From this viewpoint, the
BDD operations correspond to standard constructions such as language
intersection and union for DFAs. The canonical form property of BDDs
corresponds to the uniqueness of the minimal DFA accepting a given lan-
guage.
Given a finite-state program, let
V be its set of Boolean state variables, We
identify a Boolean formula over
V with the set of valuations that make the
ACM TransactIons on Programmmg Langaages and Systems, Vol. 16, No 5, September 1994