Modelling Message Buffers with Binary Decision Diagrams

several di erent messages into one When using the latter two methods one has to be careful to preserve the se mantics of the original model CGL Using these techniques we have been able to verify systems with up to di erent messages Alternative Approaches In GL BG it is suggested to extend the BDD data structure for the representation of message bu ers The new data structures are called QBDDs and QDDs respectively The basic idea is to replace the consecutive testing of bu er variables by a repeated test of one and only one variable Therefore the representation of the transition relation is independent of the bu er size Moreover even systems of which the maximum amount of bu er space is not statically known can be veri ed However as we have shown above the static length of a bu er may not be the most important factor in the representation of the transition relation Moreover bu er over ow errors in the system can only be detected with a bounded bu er Even worse in systems on which a full bu er forces delay of the sender with QBDDs we have to introduce an additional counter variable For these type of systems BDDs seem to be more adequate than QBDDs or QDDs Being able to represent the transition relation is only a necessary prerequisite for the veri cation of a system Equally important is the size of the representa tion of the reachable states R of the system Unfortunately the size of the BDD for R has no predictable connection to the size of the BDD for the transition relation In many systems both the number of reachable states and its representation are linear in the number of iteration steps of the model i the system is cor rect This is due to the fact that on reachable states the transition relation is almost functional yielding either a single or a small number of successor states On the other hand from an impossible state usually many other im possible states are reachable A drastic example is Valmari s elevator for which the reachable state set in any representation explodes as the elevator breaks through the ceiling and skyrockets into the air Thus an exponential increase in the representation of R after some number of steps almost certainly indicates an error In GL it is claimed that there are cases where the QBDD representation is strictly more concise than the BDD representation Assume our bu er in a context where the producer sends one xed sequence of messages x x x That is the reachable bu er content is fhi hx i hx x i hx x x i hx i hx x i hx ig With the top and bottom version of the bu er the repre sentation of this set is quadratic in whereas with the circular representation and also with QBDDs it is linear in On the other hand consider the case that the producer can send an arbi trary sequence of messages In this case the top and bottom versions are of constant size whereas the QBDD implementation is linear in the number of sent messages In practical examples such extreme cases are rare In our experiments we have found no signi cant di erence in the size of the reachability sets of the various alternatives The number of parallel processes and their relative order has a much bigger impact on the size of the BDD for R than the actual implementation of the bu er Typically we can handle systems of up to processes each with approx local states where each process is equipped with a bu er of n w However there still is a need for heuristics which use dependencies between the processes to obtain a good order for the process state variables An important observation is that the content of a message bu er used to coordinate processes shows regular patterns which also depend on the state of the processes E g in a certain process state the bu er might always contain only copies of two di erent messages fromM As another example some speci c message might always be followed by some other speci c message in the bu er Currently we are investigating methods how these regularities can be exploited to further reduce the size of the representation of the reachability set