It is possible to specify arbitrary STSs in Z3 with the PDR strategy. With this subsection we shall show one method of how to use specify an arbitrary STS in the input language of Z3 PDR. Listing D.2 shows the complete template with pseudo code on how to specify a STS in Z3. The following paragraphs explain the complete template part by part.
On lines 1 to 5 (listing 3.13) we define an enumerationNodewhere the values
are the labels of the nodes in the STS.
1 (declare-datatypes () ((Node
2 [foreach node as node]
3 node.label
4 [end foreach]
5 )))
Listing 3.13: Pseudo code on how to specify the nodes of an STS in Z3 PDR input language.
On lines 7 to 9 (listing 3.14) we define the possible enumerations and the values of the enumeration as a separate type.
7 [foreach enumeration as enum]
8 (declare-datatypes () ((enum.label enum.values)))
9 [end foreach]
Listing 3.14: Pseudo code on how to specify the enumerations of an STS in Z3 PDR input language.
On lines 11 to 22 (listing 3.15) we declare the statesand faulty_states
relations and the types of the state variables as their arguments. These relations now contain members of the type tuple and each of the members of the tuple coincide with the type of a state variable. We use these relations to respectively represent the reachable state and the reachable state which violates the safety property.
11 ; The collection of reachable, faulty states
12 (declare-rel faulty_states (Node
13 [foreach state variable as var]
14 var.type
15 [end foreach]
16 ))
17 ; The collection of reachable states
18 (declare-rel states (Node
19 [foreach state variable as var]
20 var.type
21 [end foreach]
22 ))
Listing 3.15: Pseudo code on how to specify the reachable and faulty states of an STS in Z3 PDR input language.
On lines 24 and 25 (listing 3.16) we define the variablesnodeandnext_node
which represent the origin and destination node of the transition being taken.
24 (declare-var node (Node)) 25 (declare-var next_node (Node))
Listing 3.16: Pseudo code on how to specify the variables containing the current and next node of an STS in Z3 PDR input language.
On lines 27 to 30 (listing 3.17) we define for each state variable two variables; a variable representing the current value of the state and a variable representing the next value of the state.
27 [foreach state variable as var]
28 (declare-var var.label (var.type))
29 (declare-var next_var.label (var.type))
30 [end foreach]
Listing 3.17: Pseudo code on how to specify the state variables of an STS in Z3 PDR input language.
On lines 33 and 35 (listing 3.18) we define each transition variable also as a global variable. The name of this variable is the combination of the transition variable label and the transition label.
33 [foreach transition variable as var]
34 (declare-var var.label_var.transition.label_t (var.type))
Listing 3.18: Pseudo code on how to specify the transition variables of an STS in Z3 PDR input language.
On lines 38 to 44 (listing 3.19) we define theinitialfunction which is a dis-
junction of the relations of all start transitions. We also include the destination node as a conjunction with each of the relations.
38 (define-fun initial () Bool 39 (or
40 [foreach start transition as trans]
41 (and (= node trans.destination) (trans.relation))
42 [end foreach]
43 ) 44 )
Listing 3.19: Pseudo code on how to specify the start transitions of an STS in Z3 PDR input language.
On lines 46 to 55 (listing 3.20) we define each transition. We combine the destination node, guard, relation and destination node as a conjunction.
46 [foreach transition as trans]
47 (define-fun trans.label () Bool
48 (and 49 (= node trans.origin) 50 (= next_node trans.destination) 51 (trans.guard) 52 (trans.relation) 53 ) 54 ) 55 [end foreach]
Listing 3.20: Pseudo code on how to specify the transitions of an STS in Z3 PDR input language.
On lines 58 to 64 (listing 3.21) we define a functiontransitionwhich is the
disjunction of all transition functions.
58 (define-fun transition () Bool 59 (or
60 [foreach transition as trans]
61 trans.label
62 [end foreach]
63 ) 64 )
Listing 3.21: Pseudo code on how to specify a function containing all transitions of an STS in Z3 PDR input language.
On lines 66 to 72 (listing 3.22) we define thesafety_propertyfunction as
66 (define-fun safety_property () Bool 67 (and
68 [foreach safety property as prop]
69 prop
70 [end foreach]
71 ) 72 )
Listing 3.22: Pseudo code on how to specify a the safety property for an STS in Z3 PDR input language.
On lines 75 to 79 (listing 3.23) we define a rule stating that each state which
evaluates theinitialfunction as true, should be in thestatesrelation.
75 (rule (=> initial (states node
76 [foreach state variable as var]
77 var.label
78 [end foreach]
79 )))
Listing 3.23: Pseudo code on how to specify what states are reachable states due to a start transition in Z3 PDR input language.
On lines 83 to 99 (listing 3.24) we define a rule stating that for each state in
statesand some next state which evaluates at least one transition function as
true that the next state should also be instates.
83 (rule
84 (=> 85 (and
86 (states node
87 [foreach state variable as var]
88 var.label 89 [end foreach] 90 ) 91 transition 92 ) 93 (states next_node
94 [foreach state variable as var]
95 next_var.label
96 [end foreach]
97 ) 98 ) 99 )
Listing 3.24: Pseudo code on how to specify what states are reachable states due to a path to that state in Z3 PDR input language.
On lines 103 to 119 (listing 3.25) we define that each state instateswhich
103 (rule 104 (=> 105 (and
106 (states node
107 [foreach state variable as var]
108 var.label 109 [end foreach] 110 ) 111 (not safety_property) 112 ) 113 (faulty_states node
114 [foreach state variable as var]
115 var.label
116 [end foreach]
117 ) 118 ) 119 )
Listing 3.25: Pseudo code on how to specify what reachable states are faulty in Z3 PDR input language.
Finally on line 123 (listing 3.26) we query the members of thefaulty_states
relation. This relation contains counterexamples for the safety property which are reachable.
123 (query faulty_states)
Listing 3.26: Pseudo code on how to query the faulty states in Z3 PDR input language.
The complete listing of the previous paragraphs is shown in listing D.2 of appendix D.