Skip to content

CIF to CIF transformation to eliminate state invariants incorrect for synchronizing events

Consider the following CIF model in which automata A anb B synchronize over event a, thereby update their own local variables A.x and B.x, and a state plant invariant to keep the local variables equal:

event a;

automaton A:
  disc bool x = false;

  location:
    initial;
    edge a do x := true;
end

automaton B:
  disc bool x = false;

  location:
    initial;
    edge a do x := not x;
end

plant invariant A.x = B.x;

The state space of this CIF model is

event a;
automaton statespace:
  alphabet a;
  @state(A: "*", A.x: false, B: "*", B.x: false)
  location loc1:
    initial;
    edge a goto loc2;
  @state(A: "*", A.x: true, B: "*", B.x: true)
  location loc2;
end

Now, if we apply the CIF to CIF transformation to eliminate state invariants, we obtain the model

event a;
automaton A:
  disc bool x = false;
  location:
    initial;
    edge a when true = B.x do x := true;
end
automaton B:
  disc bool x = false;
  location:
    initial;
    edge a when A.x = not x do x := not x;
end

which has the following different state space:

event a;
automaton statespace:
  alphabet a;
  @state(A: "*", A.x: false, B: "*", B.x: false)
  location loc1:
    initial;
end

As you can see, the transformed model where the state invariant has been eliminated does not consider the update of 'other' local variable: for edge a in A, the invariant A.x = B.x is translated to true = B.x where the update on A.x has been considered, but the update of B.x is not.

Edited by Dennis Hendriks