Submodule construction for systems of I/O automata*

Transcription

1 Sbmodle constrction for systems of I/O atomata* J. Drissi 1, G. v. Bochmann 2 1 Dept. d'iro, Université de Montréal, CP. 6128, Scc. Centre-Ville, Montréal, H3C 3J7, Canada, Phone: (514) , Fax: (514) , drissi@iro.montreal.ca 2 School of Information Technology & Engineering, University of Ottawa, Colonnel By Hall (A510), P.O.Box 450 Stn A,Ottawa,Ont.,K1N 6N5, Canada, Phone : (613) ext. 6205, Fax , bochmann@site.ottawa.ca Abstract. This paper addresses the problem of designing a sbmodle of a given system of commnicating I/O atomata. The problem may be formlated mathematically by the eqation (C X)r A nder the constraint I X =In, where C represents the specification of the known part of the system, called the context, A represents the specification of the whole system, X represents the specification of the sbmodle to be constrcted, is a composition operator, r is a conformance relation and In is the reqired set of inpts for X. As conformance relation, we consider the safe realization and the sbtype relation. The sbtype relation is a generalization of the well known criteria of trace eqivalence, complete trace eqivalence, qasi eqivalence and redction, while the weaker safe realization relation is implied by all those criteria. We propose two algorithms for solving the problem with respect to the safe realization and the sbtype relation and we characterize the set of soltions in each case. 1 Introdction One common problem, encontered in the hierarchical design of complex systems, in the synthesis of controllers and in the rese of components, is the sbmodle constrction problem, also called factorization problem or eqation solving problem. The sbmodle constrction problem (SCP) is to constrct the specification of a sbmodle X when the specification of the system and all sbmodles bt X are given. Sch a problem may be formlated mathematically by the eqation (C X)rA, where C represents the specification of the known part of the system, A represent the specification of the whole system, is a composition operator and r is a conformance relation. The SCP was first formlated and treated in [13], where specifications are expressed in terms of exection seqences, and trace eqivalence was sed as conformance relation. In [19], the athor ses Milner's Calcls of Commnicating Systems to model the same problem. Many other works [7, 18] have been done sing labelled transition systems as a model for the specifications and the * This work was partially spported by the NSERC Strategic grant SRTGP200 "Methods for the systematic testing of distribted software systems" and an NSERC Research grant.

2 strong and/or the observational eqivalences as conformance relations. In [4], we consider this problem in the context of the inpt/otpt Finite State Machine model (I/O FSM) [5]. The direct application of an approach based on the LTS model is not possible since the soltions obtained are not in general I/O FSMs. We have to add constraints on the environment behavior to obtain the system's behavior in the form of an I/O Finite State Machine. We have developed a method for constrcting all the soltions when the specifications are given in the form of deterministic completely specified inpt/otpt Finite State Machines and the trace eqivalence relation is sed as conformance relation. This work was generalized in [16] to the case where the specifications are given in the form of nondeterministic completely specified inpt/otpt Finite State Machines and the redction relation is sed as conformance relation. We will generalize or previos work by dealing with nondeterministic partially specified inpt/otpt Finite State Machines and by sing other criteria sch as complete trace eqivalence, qasi-eqivalence and redction of nondeterminism. For this prpose, we consider partial I/O atomata for systems specification, which is more general than inpt/otpt Finite State Machines. An I/O atomata corresponding to a given inpt/otpt Finite State Machine can always be obtained by nfolding each atomic inpt/otpt transition s-x/y->s' into two consective transitions s-x->s and s -y->s' of the corresponding I/O atomaton. A fndamental property of the model of I/O atomata is that there is a very clear distinction between those actions that are performed nder the control of the atomaton and those actions that are performed nder the control of its environment. An atomaton's transitions are classified as either "inpt" or "otpt". In typed object-oriented langages the notion of sbtype, that is, a conformity relation between types, is defined. A type P conforms to another type Q if P provides at least the operations of Q (P may also provide additional operations). Moreover, the types of the reslts of P's operations mst conform to the types of the reslts of the corresponding operations of Q. Finally, the types of the argments of Q's operations mst conform to those of P's operations [2]. The idea behind the notion of sbtype is the ability to se an instance of a sbtype of a type T whenever an instance of type T is reqired to do a job. While the sbtyping relation of object-oriented langages are mainly concerned with the available operations and the types of their parameters, we are concerned in this paper with the dynamic behavior of objects, that is, of I/O atomata, considering the allowed seqences of inpt and otpt operations. We will define a sbtype criterion, denoted s, for the same prpose as in object-oriented langages, i.e. the possibility to replace any sbsystem by an instance of its sbtypes withot changing the system's behavior. 2

3 When composing a collection of partial I/O atomata, problems de to nspecified reception may appear when a receiving I/O atomaton does not have an inpt transition originating from the present state when the sending IOA exectes a corresponding otpt transition. A composition of a collection of I/O atomata is said to be safe if it does not contains nspecified receptions [8, 14]. We define the safe realization of an I/O atomaton A by a composite IOA B=B 1 B 2... B n, denoted B S A as follows: for any environment modeled by an I/O atomaton E, if the composition of A and E is safe then the composition of B 1, B 2,..., B n and E is also safe. The safe realization criterion does not allow s to enforce mandatory otpt behaviors in certain given states, i.e. an IOA B which is a safe realization of an IOA A, will accept all the inpts accepted from the initial state of A and may prodce no otpt. In the paper "Modal Specifications" [9], the athor presents a theory of Modal Specifications which imposes restrictions on the transitions of possible implementations by telling which transitions are mandatory and which are admissible. This allows a refinement ordering between Modal Specifications to be defined. To deal with the problem of mandatory otpt behaviors and also to be able to represent the set of soltions to the eqation (C X)sA as the set of sbtypes of a particlar type (or model) in the same modelling framework, we enhance the model of I/O atomata by allowing the imposing of conditions on the set of traces from a given state. We call sch a model an "I/O atomata with optional complete traces". With each state s we associate two sets: the first set contains sets of traces from s sch that at least one trace in each set mst be present in any implementation of this atomaton; the second set is a sbset of the traces from s and each time an exection, starting in s, is a prefix of an element of this set, the exection shold progress to complete a trace in this set. We assme that an implementation is a normal (partial) I/O atomaton. We will introdce a progress property which formalizes the preceding notion. Moreover, by reqiring safe realization and realization of the progress property, we obtain the sbtype relation. We show in this paper that the sbtype relation is a generalization of the well known criteria trace eqivalence, complete trace eqivalence, qasi eqivalence and redction. Since in a composition of a collection of IOAs the sets of inpts are not disjoint, we generalize the architectre by allowing the component that will be designed, to observe some interactions between the environment and the context. This is done by adding to the eqation a constraint on the reqired set of inpts of the soltion. For the two criteria, safe realization and sbtype, we propose for each an algorithm that prodces an I/O atomaton soltion to the eqation (C X) ra nder the constraint I X =In if sch a soltion exists. We prove that the set of possible soltions is then either the set of safe realizations or the set of sbtypes of the obtained soltion, depending on which criterion was in the eqation. 3

4 This paper is strctred as follows. In Section 2, we define basic notions. In Section 3, we introdce the safe realization and the sbtype relations and we compare them with the trace eqivalence, complete trace eqivalence, qasi eqivalence and redction criteria. Section 4 presents the sbmodle constrction problem and the architectre in which this problem will be solved. In Section 5, we propose an algorithm for solving the problem with respect to the safe realization relation and we characterize the set of soltions. In Section 6, we propose an algorithm to solve the problem with respect to the sbtype relation and we characterize the set of soltions. In Section 7, we show that the sbmodle constrction problem for non-deterministic partially specified inpt/otpt Finite State Machines is a particlar case of the reslts in Section 6 for the trace eqivalence, qasi eqivalence and redction criteria. Finally, in Section 8 we conclde the paper. The proofs of the theorems are in the annex. 2 Inpt-Otpt Atomata 2.1 Basic notions and definitions In this paper, an I/O atomaton (briefly IOA) A, is a 5-tple (S A, I A, O A, T A, s oa ) where S A is a finite set of states with s oa as the initial state, I A is a non-empty, finite set of inpts, O A is a nonempty, finite set of otpts with I A O A =Ø and T A S A (I A O A ) S A is a transition set. An element (s,, s')[t A is denoted by s-.s'. If for each s[s A and all x[i A there exists s'[s A sch that s-x.s', then A is said to be completely specified or inpt-enabled; otherwise A is partially specified. An IOA A is said to be nondeterministic if there exist s-.s', s-.s" and s' s" for some s and ; otherwise A is deterministic. For a deterministic IOA A, the otgoing transitions of each state are niqely labeled. For each state s[s A, we denote inp(s)={x[i A s'[s A s-x.s'}, ot(s)={y[o A s'[s A s-y.s'}, entering(s)={[(i A O A ) s'[s A s'-.s}, and leaving(s)=inp(s) ot(s). The inpt-enabled form of an IOA A, denoted by Ief(A), is obtained by adding to each state s transitions for the non-specified inpts (I A \inp(s)) leading to the special state Fail, i.e., Ief(A)=(S A, I A, O A, T A ( s[ SA ({s} (I A \inp(s)){fail})), s oa ). If there exist states s 1,..., s k+1 S A sch that (s i, a i, s i+1 ) T A, for each i =1,...,k, then the k-tple ((s 1, a 1, s 2 ), (s 2, a 2, s 3 ),...,(s k, a k, s k+1 )) is said to be an exection starting in s 1. The seqence σ=a 1...a k (I A O A )* is said to be a trace from the state s 1. The set of traces from the state s is denoted Tr A (s) and we denote it Tr A if s=s oa. For a deterministic IOA A, a state s and a seqence σ Tr A (s) niqely determine the final state of the trace σ which we denote s σ. A state s' of an IOA A is reachable from a state s if there exists σ Tr A (s) sch that s σ =s'. If s is the initial state of A then s' is said to be reachable. The set {s 1, s 2,..., s k, s k+1 }, denoted by S(s 1, σ), represents the set of states reachable from s 1 by a prefix of σ. For each seqence σ Σ* and a 4

5 sbset Σ' of Σ, the Σ'-projection of σ, denoted Pr Σ' (σ), is obtained by deleting from σ each symbol which is not in Σ'. For simplicity, we denote also by Pr Α (σ), the projection of σ over the alphabet (I A O A ) of the IOA A. For a set of traces Y, we denote by Pr Σ' (Y), the set containing the Σ'-projection of the elements in Y. For a set X containing sets of traces, we denote by Pr Σ' (X), the set {Pr Σ' (Y) Y[X}. The connected component of A containing the initial state is the IOA CC(A)=(S C, I C, O C, T C, s oc ) sch that S C ={s S A s reachable}, I C =I A, O C =O A, T C ={(s,, s')[t A s S C } and s oc =s oa. If A=CC(A) then A is said to be initially connected. We define a chaos IOA, whose traces contain all the words over the alphabet, by Ch=({ch}, I, O, H, ch), where H={(ch, t, ch) t[i"o}. 2.2 The composition of I/O atomata A system can be considered as a finite collection of IOAs commnicating with one another and with the environment. The composition of IOAs is defined in the case of complete IOAs in [12], and in the case of partial IOAs in [8, 14]. In the second case problems de to nspecified reception may appear when a receiving IOA does not have an inpt transition originating from the present state when the sending IOA exectes a corresponding otpt transition. Definition 1 : Given a collection of IOAs (A i =(S A i, I Ai, O Ai, T Ai, s oi)) 1 i n, sch that the sets (O A i ) 1 i n are pairwise disjoint. The composition of (A i ) 1 i n, denoted A 1 A 2... A n, is defined as the connected component of the IOA A=(S A, I A, O A, T A, s oa ) where : - S A =S A 1 S A2... S An, - I A =(I A 1 I A2... I An )\(O A1 O A2... O An ), - O A =O A 1 O A2... O An, - ((s 1, s 2,...,s n ),, (s 1 ', s 2 ',...,s n '))[T A iff for all i[{1, 2,..., n}, if [(I A i O Ai ) then (s i,, s i ')[T A i, else s i=s i ', - s oa =(s o1, s o2,...,s on ). The composition of IOAs is commtative and associative. This composition allows a nmber of IOAs to accept the same inpt simltaneosly. Following the work of [14], we define a safety property which formalizes the nonoccrrence of an nspecified reception in the composition A of a collection of IOA (A i =(S A i, I Ai, O A i, T Ai, s oi)) 1 i n. We denote by ε the empty word. 5

6 Definition 2 : Given a collection of IOA (A i =(S A i, I Ai, O Ai, T Ai, s oi)) 1 i n, the composition A = A 1 A 2... A n is safe, written S (A ), iff any word t in (I A O A )* sch that Pr A i (t) Tr Ai.(I Ai {ε}) for all i, is a trace of A (i.e. t Tr A). We illstrate the preceding concepts with the following example (Figre 1, 2, 3). We consider the IOAs A 1 and A 2 with I A 1 ={x, x', z}, O A1 ={, y}, I A2 ={} and O A2 ={z}. For the composition A=A 1 A 2 we have I A ={x, x'} and O A ={, z, y}. x' z x a b c d z y e f g Figre 1 : The IOA A 1 Figre 2 : The IOA A 2 (a, e) x (b, e) (c, f) z y y (c, g) (d, g) (d, f) x' x' Figre 3 : The IOA A 1 A 2 We define now a hiding operator which allows s, for example, to hide actions considered to be internal in a composition. Given an IOA A and a sbset Σ of (I A O A ), we define H Σ (A) to be the IOA obtained from A by first replacing all the actions in Σ by the internal action τ and then determinizing the obtained atomaton. In Figre 4, we have D=H {, z} (A 1 A 2 ), I D ={x, x'} and O D ={y}. x x' {(a, e)} {(b, e), (c, f), {(d, g)} (d,g)} y y x' x' {(d, g)} {(c, g)} {(c, f), (d, g)} y y Figre 4 : The IOA H {, z} (A 1 A 2 ) 3 The conformance relations 3.1 The safe realization relation Definition 3 : For an IOA A and a composite IOA B=B 1 B 2... B n, with I A =I B, we say that B realizes A with safety, written B S A, iff for every IOA E, with I E =O A and O E =I A, S(E A) implies S(E B 1 B 2... B n ). 6

7 Definition 3 means that for any environment E over the alphabet of A if the composition of A and E is safe then the composition of B 1, B 2,..., B n and E mst also be safe, i.e. in any reachable state of the composition E B 1 B 2... B n, there is no nspecified reception. Definition 4 : The reflection of an IOA A=(S A, I A, O A, T A, s oa ) is the IOA Ã=(S A, I Ã, O Ã, T A, s oa ) where I à =O A, O à =I A. If for any state of A, we add some otpts then the composition of the obtained IOA with à will be non safe. Also, if we add some otpts for any state of Ã, the composition of the obtained IOA with A will be non safe. Intitively, à represents the most liberal environment in with A is safe. Lemma 1: For an IOA A and a composite IOA B=B 1 B 2... B n, with I A =I B, the following propositions are eqivalent : i - S(à B 1 B 2... B n ), ii - for every IOA E, with I E =O A and O E =I A, S(E A) S(E B 1 B 2... B n ). In the example in Figre 3, the IOA A=A 1 A 2 is not safe since for the trace t=xx'z in (I A O A )* we have Pr A 1 (t) Tr A1.(I A1 ) and Pr A2 (t) Tr A2, bt we do not have t Tr A. However, for the IOA S given in Figre 5, we have that the I/O atomaton A=A 1 A 2 realizes S with safety, since S does not allow for the visible trace xx' corresponding to the above trace t. y x x' a x x' z b c d y Figre 5 : The I/O atomaton S Figre 6 : The I/O atomaton A 3 If we consider the IOA A 3 in Figre 6 with I A 3 =I A1 and O A3 =O A1, we remark that A 3 A 2 =A 1 A 2 bt A 3 A 2 does not realize S with safety since for the trace t'=xzyx' in (I A O A )* we have Pr A 3 (t') Tr A3, Pr A2 (t') Tr A2.(I A2 ) and Pr S(t') Tr S, bt t' is not a trace of the composition S A 3 A The sbtype relation The safe realization relation is a weak criterion since it allows an IOA B which is a safe realization of an IOA A, to accept all the inpts accepted from the initial state of A and to prodce no otpt. To deal with the notion of task completion, which imposes conditions on the set of otpts prodced after a given exection and also to be able to represent the set of soltions to the 7

8 eqation (C X)sA as the set of sbtypes of an element in the same model, we need to enhance the definition of an IOA to take into accont these conditions. This leads to the definition of I/O atomata with optional complete traces. Definition 5 : An I/O atomaton with optional complete traces A (briefly IOAWOCT), is a 3- tple (IOA A, MT A, OCT A ) where IOA A is an IOA, MT A ={(s, MT A (s)) s S A } with MT A (s) 2 Tr IOA A (s) and OCT A ={(s, OCT A (s)) s S A } with OCT A (s) Tr IOAA (s). An IOAWOCT A can be considered to be a specification. The sets MT A (s) and OCT A (s) impose constraints on the traces of valid implementations of A. We consider implementations in the form of IOA. An element Y of MT A (s) imposes that at least one trace of Y, is a possible trace of the implementation in the state corresponding to s. Moreover, each time, an exection starting in the state corresponding to s in the implementation has a trace whose projection over the alphabet of IOA A is a prefix of an element of OCT A (s), this exection shold progress to complete some trace whose projection over the alphabet of IOA A is in OCT A (s). We note that if OCT A (s) contains only elements of length eqal to one, it does not impose any constraint on the implementations having the same alphabet as IOA A. In the case where the implementation has a different alphabet from the alphabet of IOA A, the elements of length eqal to one in OCT A (s) prohibit traces withot external otpt. An IOA A can be viewed as an IOAWOCT, which we call A woct, and which is constrcted as follow : IOA A woct=a and for each state s of A MT A woct(s)={{y} y ot(s)}and OCT A woct(s)=ø. With this consideration, the set of IOAs is inclded in the set of IOAWOCTs. Consider an IOAWOCT A and an environment E sch that S(E IOA A ). If we want to replace A in the environment E by an IOA B which is a sbtype of A, then B mst be a safe realization of IOA A, i.e. B S IOA A, moreover, since in each state s of IOA A, there are some conditions on the set Tr IOAA (s), then B mst realize these conditions. In the following definition, we formalize this notion by what we call the progress property. We note Pref(X) the set of all nonempty prefixes of elements of a set of traces X. Definition 6 : Given a deterministic IOAWOCT A, we say that the deterministic IOA B with I B =I IOAA realizes the progress property with respect to the IOAWOCT A, written B P A, iff If MT A (s oioaa ) Ø then i - for every X of MT A (s oioaa ), Pr IOAA (Tr B (s ob )) X Ø, ii - for every σ 1 Tr B (s ob ), if Pr IOAA (σ 1 ) Pref(OCT A (s oioaa )) then there exists σ 2 Tr B ((s ob ) σ1 ) sch that Pr IOAA (σ 1 σ 2 ) OCT A (s oioaa ). 8

9 And, for every σ t Tr B with t (I IOAA O IOAA ), if σ '= Pr IOAA (σ t) Tr IOAA and MT A ((s oioaa ) σ' ) Ø then iii - for every X of MT A ((s oioaa ) σ' ), Pr IOAA (Tr B ((s ob ) σt )) X Ø, iv - for every σ 1 Tr B ((s ob ) σt ), if Pr IOAA (σ 1 ) Pref(OCT A ((s oioaa ) σ' )) then there exists σ 2 Tr B ((s ob ) σtσ1 ) sch that Pr IOAA (σ 1 σ 2 ) OCT A ((s oioaa ) σ' ). The conditions (i) and (iii) impose that one trace from each element of MT A ((s oioaa ) σ' ) is present in the projection over the alphabet of IOA A of Tr B ((s ob ) σt ). The conditions (ii) and (iv) impose that each trace of Tr B ((s ob ) σt ) whose projection over the alphabet of IOA A is a prefix of an element of OCT A ((s oioaa ) σ' ), can progress to complete a trace in Tr B ((s ob ) σt ) whose projection over the alphabet of IOA A is an element of OCT A ((s oioaa ) σ' ). Now, we give a formal definition for the notion that an IOA is a conforming implementation of an IOAWOCT by reqiring safe realization and realization of the progress property. Definition 7 : Given a deterministic IOA B and a deterministic IOAWOCT A with I B =I IOAA, B is said to be a conforming implementation of A, written B conf A, iff B P A and B S IOA A. We remark that in the case where IOA A is completely specified, B conf A and I B I A implies Pr IOAA (Tr B ) Tr IOAA. We say that an IOAWOCT B is a sbtype of an IOAWOCT A if all conforming implementations of B are also conforming implementations of A. Definition 8 : A deterministic IOAWOCT B is a sbtype of a deterministic IOAWOCT A, written BsA, if for any deterministic IOA C : C conf B implies C conf A. Lemma 2 : Given a deterministic IOA B and a deterministic IOAWOCT A with I B =I IOAA. The following propositions are eqivalent : i - B conf A ii - B woct sa. 3.3 Others conformance relations We will compare some well known conformance relations with the sbtype and the safe realization relations Trace eqivalence 9

10 The IOAs A and B are said to be trace-eqivalent, written B A, iff Tr A =Tr B. Given an IOA A, a trace σ Tr A is said to be a complete trace iff leaving((s oa ) σ )=Ø. The set of complete traces is denoted CTr A. The IOA B is said to be complete trace-eqivalent to the IOA A, written B= cte A, iff Tr A =Tr B and CTr A =CTr B [6]. In the case of deterministic IOAs, the complete traceeqivalence redces to the trace-eqivalence. Lemma 3: Given two deterministic IOAs A and B, with I A =I B and O A =O B. The following propositions are eqivalent : i - B = cte A, ii - B conf A woct and A conf B woct Qasi-eqivalence The IOA B is said to be qasi-eqivalent to the IOA A, written B qe A, iff σ Tr A (σ Tr B ot((s oa ) σ )=ot((s ob ) σ )). The qasi-eqivalence relation reqires that Tr A Tr B and after any trace in Tr A, A and B prodce the same set of otpts [11, 17]. Lemma 4: Given two deterministic IOAs A and B, with I A =I B and O A =O B. The following propositions are eqivalent : i - B qe A, ii - B conf A woct Redction of nondeterminism The IOA B is said to be a redction of the IOA A, written B red A, iff for each trace σ in Tr A if σ is in Tr B then : inp((s oa ) σ ) inp((s ob ) σ ) ot((s ob ) σ ) ot((s oa ) σ ) (ot((s oa ) σ ) Ø ot((s ob ) σ ) Ø). Lemma 5: Given two deterministic IOAs A and B, with I A =I B and O A =O B. We denote by A red the IOAWOCT sch that IOAA red =A and for each state s of A MTA red (s)={ot(s)} andocta red (s)=ø. The following propositions are eqivalent : i - B red A, ii - B conf A red. Lemma 6: Each of the above conformance relations (trace eqivalence, complete trace eqivalence, qasi eqivalence and redction) implies the safe realization criterion, that is, if one of these relations holds between two deterministic IOAs B and A then B is a safe realization of A. 10

11 4 The design of a sbmodle 4.1 The architectre We se the composition of two commnicating components (Figre 7) to discss problems related to the design of a component of a compond system. External inpts of C non-observable by the component External inpts of C I A External inpts which are not in the inpt alphabet of the context observable by the component Context C Internal inpts of C Internal otpts of C Component? External otpts of C observable by the component External otpts of C non-observable by the component O A External otpts which are not prodced by the context Figre 7: The composition of two commnicating components C and Comp We consider the class of systems which can be represented by two deterministic IOA that commnicate with one another and with an environment. One deterministic IOA, called the context C, models the known part of the system, the behavior of which is given, while the other deterministic IOA, called the new component Comp, represents the behavior of a certain component of the system (the sbmodle to be designed). The set of inpts accepted by the system from the environment can be divided into three disjoint sets. The first is the set of inpts of the context C non observable by the component, the second is the set of inpts of the context observable by the component, and the third represents the set of inpts of the system which are not visible by the context. Similarly, the set of otpts delivered by the system to the environment can be divided in three disjoint sets. The first is the set of otpts delivered by the context C to the environment which are not observable by the new component, the second is the set of otpts delivered by the context C to the environment which are observable by the component, and the third represents the set of otpts of the component accepted by the environment and not delivered to the context. 4.2 The problem The problem is known as the problem of sbmodle constrction, redesign or eqation solving, where an appropriate conformity criterion shold hold between a designed system and its 11

12 given specification A and where the system consists of a given component C and a new component X to be designed. In this paper, we consider this problem as a problem of eqation soltion in the realm of IOA for the eqation (C X)rA nder the constraint I X =In with X being a free variable, r is a conformance relation and In a given set of inpts. In Section 5, we propose an algorithm which takes as inpt two deterministic IOAs, A and C, and a set In sch that (I A \I C ) (O C \O A ) In I A O C, and prodces as otpt an IOA Sol S (if it exists) with I SolS =In and O SolS =(I C \I A ) (O A \O C ), sch that the composition of C with Sol S is a safe realization of A. In Section 6, we propose an algorithm which takes as inpt a deterministic IOA C, a deterministic IOAWOCT A, and a set In sch that (I A \I C ) (O C \O A ) In I A O C, and prodces as otpt an IOAWOCT Sol (if it exists) with I IOASol =In and O IOASol =(I C \I A ) (O A \O C ), sch that the composition of C with IOA Sol is a conforming implementation of A. The existence of a soltion for a given eqation depends on the selected set of inpts for the component. Lemma 7 : If for a given set of inpts In there is no soltion, then for any sbset of In there is no soltion. 5 The soltion for the safe realization criterion 5.1 The proposed method We se a chaos IOA which represents all the traces over the inpt alphabet I A O C and the otpt alphabet (I C \I A ) (O A \O C ); any soltion of (C X) S A is trace inclded in this chaos atomaton. The main idea of or approach is to remove from the chaos atomaton all the traces which combined with traces of the context C in the environment à may case a non-safe behavior. This will allow s to captre the set (if not empty) of the permissible traces of the component to be designed in the form of an IOA Sol S, called the generic safe soltion. A permissible trace is a trace of a soltion of (C X) S A. We give in the next paragraph an algorithm which constrcts the generic safe soltion if it exists. As inpt, the algorithm reqires two deterministic IOAs C and A and a set In sch that (I A \I C ) (O C \O A ) In I A O C. The set In will be sed as the inpt set for the generic soltion. To be able to characterize those traces of the composition of the chaos atomaton and the context C in the environment à which lead to a non conforming behavior with respect to A, we find in Step 1 the inpt-enabled forms of à and C, and then constrct the composed IOA R=Ief(C) Ch Ief(Ã). Since a state of R is a triplet of states of Ief(C), Ch and Ief(Ã), each time we reach a state of R which contains Fail Ief(Ã) or Fail Ief(C), we replace this state by Fail R. The complexity in the worst case of Step 1 is polynomial in the nmber of states of A and C and the 12

13 nmber of elements in the alphabet of A C. In Step 2, we replace in R all the actions that are not in the alphabet of the component to be designed by the internal action τ and we determinize. Since a state of the obtained atomaton, denoted R 1, corresponds to a sbset of states of R, we declare any state of R 1 which contains Fail R as Fail R1. The complexity of Step 2 is in the worst case exponential in the nmber of states of A and C. In the third and last step, we remove recrsively from R 1 all the traces which lead to the Fail R1 state. The complexity of step 3 is in the worst case polynomial in the nmber of states of R 1. Algorithm 1 Inpt : The specification of the context C, the specification of the system A and a set of inpts In. Otpt : An IOA Sol S with I SolS =In (eqal to R 1 ) which satisfies the eqation (C Sol S ) S A if a soltion exists. Step 1 : R:=Ief(C) Ch Ief(Ã). Step 2 : R 1 :=H (IA "O C )\In)(R). Step 3 : (Remove-Fail-state) WHILE exist a transition s - t. Fail R1 DO IF t[(i C \I A ) (O A \O C ) THEN Remove this transition; ELSE IF s=s or1 THEN retrn "NO SOLUTION"; STOP; ELSE Replace each transition c- t'. s by c- t'. Fail R1 ; R 1 :=CC(R 1 ); Theorem 1 : Given two deterministic IOAs A and C, and given a set In sch that (I A \I C ) (O C \O A ) In I A O C, if Algorithm 1 prodces an IOA Sol S then (C Sol S ) S A, else there is no soltion for (C X) S A with the specified inpt alphabet In. Example : d y 1 x 1 z 1 y 2 c b g z 2 f z 2 z 3 a z 4 z 1 x 2 e h z 3 2 x 1 x 2 x C A B y 1 y 2 y 2 z z 2 2 x z 3 y x 3 3 z 3 y 3 z E z 4 D F Figre 8 : the I/O atomata C and the I/O atomata A and the I/O atomata Sol S We consider for the context the IOA C shown in Figre 8 with I C ={x 1, x 2, z 1, z 2, z 3, z 4 }, O C ={, y 1, y 2 }, and for the whole system the IOA A shown in Figre 9 with I A ={x 1, x 2, x 3 }, 13

14 O A ={y 1, y 2, y 3 } and In={x 1, x 3, }. We obtain the soltion Sol S shown in Figre 10 with the otpt set O SolS ={z 1, z 2, z 3, z 4, y 3 }. 5.2 The set of soltions The soltion obtained by the previos method is a generic one, which means that we can derive from it the set of soltions of the eqation (C X) S A. Theorem 2 : Given two deterministic IOAs A and C, and given a set In sch that (I A \I C ) (O C \O A ) In I A O C, an IOA B, with I B =In and O B =O SolS, is a soltion of the eqation (C X) S A iff B S Sol S. Example : Figre 11 shows some other soltions for the example above. C x 1 A x 3 D B C E x 1 z 1 A z 2 x 3 y 3 D B z 2 z 3 C E x 1 A x 3 y 3 D z 3 B F 6 The soltion for the sbtype criterion Figre 11 : Some safe realizations of Sol S As discssed in Section 4.2, we are looking for a soltion to the sbmodle constrction problem when the conforming implementation relation is sed. More formally, for a given IOA C and an IOAWOCT A and a set In sch that (I A \I C ) (O C \O A ) In I A O C we want to find an IOA X sch that (C X) conf A and I X =In. We describe in Sbsection 6.1 an algorithm which retrns a generic soltion in the form of an IOAWOCT. A generic soltion is a soltion from which all the soltions can be derived. We show in Sbsection 6.2 that all the soltions to the eqation (C X) conf A nder the constraint I X =In are the conforming implementations of the generic soltion. We give in the next paragraph an algorithm which constrcts the generic soltion if it exists. As inpt, the algorithm reqires two deterministic IOA C and Sol S, and an IOAWOCT A. To simplify the algorithm, we consider only the case where for each state s of IOA A, OCT A (s)=ot(s) and MT A (s) 2 ot(s). We denote this restricted class IOAWO, for I/O atomaton with options. This means that each otpt of s is optional and at least one otpt of each element of MT A (s) is a mandatory otpt. 6.1 The Algorithm 14

15 We se the IOA Sol S which represent the soltion to the eqation (C X) S IOA A (see Section 5) as a starting point. Any soltion of (C X) conf A is trace inclded in Sol S. The main idea of or approach is to remove from Sol S all those traces which, when combined with traces of the context C in the environment Ã, may case a non-conforming behavior with respect to the mandatory traces MT A or the optional complete traces OCT A. This will allow s to captre the set of the permissible traces of the component to be designed in the form of an IOAWOCT Sol, called the generic soltion (if this set is not empty). A permissible trace is a trace of an IOA which is a soltion of (C X) conf A. The algorithm proceeds in six steps. In Step 1, we constrct the composition of C, Sol S and IOA A then we associate to each state of the composition the mandatory constraints associated to the corresponding state of IOA A. In Step 2, we process the states from which a constraint is not satisfied and the non-controlable transitions which lead to the Fail state, i.e. a transition labelled with an action which is not an otpt of the component to be designed. In Step 3, we associate with each constrained state c an IOA whose set of traces is eqal to the sbset of Tr IOAR (c) which is the nion of the traces that contain no external action and the traces that contain a single external action (an otpt action) as their last element. This IOA will allow s in the next steps to characterize the mandatory and the complete traces of the soltion we are looking for. In Step 4, we hide the actions which are not in the alphabet of the soltion and we associate to each state the corresponding constraints. In Step 5, we remove recrsively all non-conforming traces. Finally, in Step 6 we constrct the generic soltion in the form of an IOAWOCT Sol. x 1 B A y 1 y 2 y 2 y 3 x 3 y 3 D x 2 C d y 1 x 1 a z 1 x 2 e z 1 y 2 c b g z h 2 f z z 2 z 3 3 z 4 l z 3 k j i x 2 x 1 Figre 12 : The IOA IOA A and the IOA C. To illstrate the work done in each step of the algorithm, we se the following example. We consider for the context the IOA C shown in Figre 12 with I C ={x 1, x 2, z 1, z 2, z 3, z 4 }, O C ={, y 1, y 2 }, and for the whole system the IOAWO A corresponding to the IOA A of Figre 12, with I IOAA ={x 1, x 2, x 3 }, O IOAA ={y 1, y 2, y 3 }, and MT A ={(A, Ø), (B, {{y 1 }}), (C, {{y 2 }}), (D, {{y 3 }})}, and OCT A ={(A, Ø), (B, {{y 1, y 2 }}), (C, {{y 2, y 3 }}), (D, {{y 3 }})}, and In={x 1, x 3, }. Since the algorithm reqires as inpt the soltion for the safe realization relation, we se first Algorithm 1 to obtain the IOA Sol S shown in Figre

16 x z z 2 2 z 3 z x 3 y 3 z z z 3 y 3 x 3 x 1 7 Figre 13 : The IOA Sol S. 5 6 Algorithm 2 Inpt : The specification of the context in the form of an IOA C, the specification of the system behavior in the form of an IOAWO A and a set of inpts In. Otpt : An IOAWOCT Sol with I IOASol =In which satisfies the eqation (C IOA Sol ) conf A if a soltion exists. Step 1. In this step, we constrct an IOAWOCT R sch that IOA R is the composition of C, Sol S and IOA A, and we initialize the sets MT R (c) and OCT R (c) with the empty set for each state c of IOA R. If MT A (s oioaa ) is not empty, we assign it to MT R (s or ). For each state c=(s 1, s 2, s 3 ) in S IOAR \{s oioar } sch that entering(c)((i IOAA O IOAA ) and MT A (s 3 ) are not empty, we assign to MT R (c) the set MT A (s 3 ). This means that for a state c of IOA R where MT R (c) is not empty a progress property mst hold. The complexity of this step is in the worst case polynomial in the nmber of states of IOA A and C, and the nmber of elements in the alphabet of IOA A C (i.e. O(nmr 2 ) where n=nmber of states of A, m=nmber of states of C and r=nmber of element in the alphabet of A C). IOA R =C Sol S IOA A ; FOR each state c=(s 1, s 2, s 3 ) in S IOAR DO MT R (c):=ø; OCT R (c):=ø; IF MT A (s oioaa ) Ø THEN MT R (s oioar ):=MT A (s oioaa ); FOR each state c=(s 1, s 2, s 3 ) in S IOAR \{s oioar } sch that entering(c) (I IOAA O IOAA ) Ø and MT A (s 3 ) Ø DO MT R (c):=mt A (s 3 ); y 2 x 1 x z 2 y 2 z x 3 y z y 1 z z 3 y x 2 x 3 z z x 1 y 3 14 Figre 14 : The IOA IOA R 16

17 For the example, we obtain at the end of Step 1 the IOA IOA R shown in Figre 14 and the set of constraints MT R ={(0, Ø), (1, {{y 1 }}), (2, Ø), (3, Ø), (4, Ø), (5, {{y 2 }}), (6, Ø), (7, Ø), (8, Ø), (9, Ø), (10, {{y 1 }}), (11, Ø), (12, Ø), (13, {{y 2 }}), (14, {{y 3 }}), (15, {{y 3 }})}. Step 2. In this step, we remove from IOA R some non-conforming traces. For a state c of IOA R, a state which can be reached from c with an internal trace is said to be an internal sccessor of c; the set containing all external otpts of its internal sccessors is denoted ext-ot-after(c); the state c is said to be a silent state if ext-ot-after(c) is empty. For a state c of IOA R where MT R (c) is not empty, if ext-ot-after(c) does not meet the constraints imposed by MT R (c) then we retrn "NO SOLUTION" in the case where c is the initial state, otherwise all the transitions s- t. c labelled with an external action will be replaced by s- t. Fail R and we replace IOA R by its initially connected component; else for each silent internal sccessor c' of c we retrn "NO SOLUTION" in the case where c' is the initial state, otherwise we replace each transition s- t. c' by s- t. Fail R and we replace IOA R by its connected component. If the intersection of entering(fail R ) and (I IOAA O C ) is not empty, for each transition s- t. Fail R with t in the intersection, we retrn "NO SOLUTION" in the case where s is the initial state, otherwise we replace each transition s'- t. s by s'- t. Fail R and we replace IOA R by its connected component. This processing is repeated ntil the IOA IOA R can not be pdated. At the end of this step, any constrained state satisfies its constraints and may have only Fail R as silent internal sccessor; moreover all the transitions leading to Fail R are labelled with controllable actions, i.e. otpts of the component to be designed. To achieve this, we constrct two sets : the set NonSilentStates containing those states of IOA R where an external otpt occrs; and the set ConstrainedStates which initially contains all states c of IOA R where MT R (c) is not empty. We repeat the following processing ntil the set ConstrainedStates is empty : we remove from ConstrainedStates an element c, and we determine the set of its internal sccessors, denoted Sccint(c); if there exists an element in MT R (c) sch that its intersection with ext-ot-after(c) is empty, then we retrn "NO SOLUTION" in the case where c is the initial state, otherwise we replace each transition s- t. c by s- t. Fail R for each external action t and we assign the empty set to MT R (c) and we replace IOA R by its connected component; now, if all the constraints imposed by MT R (c) are satisfied, i.e. MT R (c) is not empty, we trn or attention to the silent states in Sccint(c); for each sch state c', we retrn "NO SOLUTION" in the case where it is the initial state, otherwise we replace each transition s- t. c' by s- t. Fail R and we replace IOA R by its connected component; if the intersection of entering(fail R ) and (I IOAA O C ) is not empty, for each transition s- t. Fail R with t in the intersection, we retrn "NO SOLUTION" in the case where s is the initial state, otherwise we replace each transition s'- t. s by s'- t. Fail R and we replace IOA R by its connected component, then we pdate the set ConstrainedStates by assigning to it the set containing each state of IOA R where MT R (c) is not 17

18 empty. The complexity of this step in the worst case is polynomial in the nmber of states of IOA A and C, and the nmber of elements in the alphabet of IOA A C (i.e. O(n 3 m 3 r 3 ) where n=nmber of states of A, m=nmber of states of C and r=nmber of element in the alphabet of A C). Procedre Remove-some-non-conforming-traces IntActions :=(I C O C )\(I IOAA O IOAA ); NonSilentStates={s S IOAR ot(s) O IOAA Ø}; ConstrainedStates := {c S IOAR MT R (c) Ø}; WHILE ConstrainedStates Ø DO c := an element of ConstrainedStates ; ConstrainedStates := ConstrainedStates \{c}; Sccint(c)={c' S R \{Fail R } σ IntActions* sch that c'=c σ }; ext-ot-after(c) := c' Sccint(c) ot(c') O IOAA ; TempMT :=MT R (c); WHILE TempMT Ø DO Y := an element of TempMT; TempMT := TempMT\{Y}; IF Y ext-ot-after(c)=ø THEN // the constraints for state c are not satisfied IF c=s oioar THEN retrn "NO SOLUTION"; STOP; ELSE replace s- t. c by s- t. Fail R for each t in entering(c) (I IOAA O IOAA ); MT R (c):=ø; TempMT:=Ø; IOA R :=CC(IOA R ); ENDWHILE TempMT Ø IF MT R (c) Ø THEN WHILE Sccint(c) Ø DO c' := an element of Sccint(c); Sccint(c) := Sccint(c)\{c'}; IF Sccint(c') NonSilentStates=Ø THEN IF c'=s oioar THEN retrn "NO SOLUTION"; STOP; ELSE replace s- t. c' by s- t. Fail R for each t in entering(c'); IOA R :=CC(IOA R ); Sccint(c) := Sccint(c) S IOAR ; ENDWHILE Sccint(c) Ø IF entering(fail R ) (I IOAA O C ) Ø THEN TempTrans :={(s, t, Fail R ) T IOAR t (I IOAA O C )}; WHILE TempTrans Ø DO 18

19 (s', t', Fail R ) := an element of TempTrans; IF s'=s oioar THEN retrn "NO SOLUTION"; STOP; ELSE replace s" - t". s' by s" - t ". Fail R for each t" in entering(s'); IOA R :=CC(IOA R ); TempTrans :={(s, t, Fail R ) T IOAR t (I IOAA O C )}; ENDWHILE TempTrans Ø ConstrainedStates := {c S IOAR MT R (c) Ø}; ENDWHILE ConstrainedStates Ø For or example, the work done in Step 2 is as follow. After state 10, the reqired external otpt y 2 is not possible, then this state is replaced by Fail R. Since now there exists a transition labelled with a non-controllable action leading to Fail R (9-x 1 ->Fail R ) the state 9 is replaced by Fail R. The obtained connected component is shown in Figre 15, and the pdated set of constraints is MT R ={(0, Ø), (1, {{y 1 }}), (2, Ø), (3, Ø), (4, Ø), (5, {{y 2 }}), (6, Ø), (7, Ø), (8, Ø), (15, {{y 3 }})}. y 2 x 1 x z 2 y 2 z x 3 y z 4 y 1 z z 3 y 3 Fail z 1 3 Figre 15 : the obtained IOA IOA R at the end of Step 2 Step 3. In this step, we associate to each state c of IOA R where MT R (c) is not empty, an IOA CONST(c) whose set of traces is eqal to the sbset of Tr IOAR (c) which is the nion of the traces that contain no external action and the traces that contain a single external action (an otpt action) as their last element. This IOA will allow s in the following steps of the algorithm to characterize the mandatory and the complete traces of the soltion we are looking for. To be able to compose CONST(c) with the IOA obtained from IOA R after hiding some actions and to preserve all the possible external otpts after c in CONST(c), we assign the empty set to O CONST(c) and the set containing all the actions present in IOA R to I CONST(c). The complexity in the worst case of this step is polynomial in the nmber of states of IOA R (i.e. O(n 2 m 2 r) where n=nmber of states of A, m=nmber of states of C and r=nmber of element in the alphabet of A C). 19

20 Procedre Updating-information FOR each state c in S IOAR \{Fail R } sch that MT R (c) Ø DO IntActions :=(I C O C )\(I IOAA O IOAA ); TempStates := {c' S IOAR σ IntActions* sch that c'=c σ }; TempTrans := {(s, t, s') Tr IOAR s, s' TempStates and t IntActions}; TempTransFinal := {(s, t, Final) s TempStates and t leaving(s) O IOAA and s t Fail R }; TempTransFail := {(s, t, Fail R ) Tr IOAR s TempStates and t O IOAA }; IF TempTransFinal Ø THEN TempStates := TempStates {Final}; IF TempTransFail Ø THEN TempStates := TempStates {Fail R }; TempTrans := TempTrans TempTransFinal TempTransFail; CONST(c):=(TempStates, I IOAR O IOAR, Ø, TempTrans, c); z 2 z 3 z 4 z 1 y 2 y 1 y 2 z 2 z 3 y 3 y 3 Final Final Fail Final Figre 16 : The IOAs CONST(1), CONST(5) and CONST(15). Step 4. In this step, we hide the actions that are in (I IOAA " O C )\In and constrct H (IIOAA "O C )\In(IOA R ). Since a state of the obtained atomaton, denoted R 1, is a sbset of states of IOA R, we declare any state of R 1 which contains Fail R as Fail R1. Moreover, we assign to TempConstraint(s or1 ) the set of pairs (MT R (c), CONST(c)) for c in s or1 sch that MT R (c) is not empty. For each state s in S R1 \{s or1, Fail R1 }, if entering(s) contains some external actions, we assign to TempConstraint(s) the set of pairs (MT R (c), CONST(c)) for c in s sch that MT R (c) is not empty, otherwise we assign to TempConstraint(s)) the set of pairs (MT R (c), CONST(c)) for c in s sch that MT R (c) is not empty and c is reachable in IOA R from c'' in s with an external action in (I IOAA O C )\I n, i.e. there exists s' in R 1, c' in s' and c'' in s with s=s' t, c''=c' t.σ in IOA R and c=c'' for σ in ((I IOAA O C )\I n )* and in (I IOAA O C )\I n. The complexity in the worst case of this step is exponential in the nmber of states of IOA R. We denote by ε the empty word. Procedre Hide-actions-in-(I IOAA O C )\In ConstrainedStates := {c S IOAR MT R (c) Ø}; S R1 :=Ø; T R1 :=Ø; s or1 :={c S IOAR σ ((I IOAA O C )\In)* sch that c=(s oioar ) σ }; 20

21 S R1 :=S R1 {s or1 }; TempStates := {s or1 }; L :=In (I C \I IOAA ) (O IOAA \O C ); TempConstraint(s or1 ) :={(MT R (c), CONST(c)) c s or1 ConstrainedStates} WHILE TempStates Ø DO s := an element of TempStates; TempStates:=TempStates\{s}; FOR each t in L DO FOR each c in s DO Scch(c)={c' S IOAR σ ((I IOAA O C )\I n ) + sch that c'=c t.σ }; s':= c s Scch(c); s'':=s' {c t c s}; IF s'' Ø THEN IF Fail R s'' THEN T R1 :=T R1 {(s, t, Fail R1 )}; S R1 :=S R1 {Fail R1 }; ELSE T R1 :=T R1 {(s, t, s'')}; IF s''{s R1 THEN S R1 :=S R1 {s''}; TempStates:=TempStates {s''}; TempConstraint(s''):=Ø; IF t ((O C \O IOAA ) (I C \I IOAA )) THEN TempConstraint(s''):={(MT R (c), CONST(c)) c s' ConstrainedStates} TempConstraint(s''); ELSE TempConstraint(s''):={(MT R (c), CONST(c)) c s'' ConstrainedStates}; ENDWHILE TempStates Ø z 2 O x 1 z 3 z 1 N z 4 M z 2 x 3 y 3 V P z 3 y 3 Q Fail Figre 17 : The IOA R 1 At the end of Step 4 the obtained IOA R 1 for or example is shown in Figre 17 and we have the following constraints : TempConstraint(M)={({{y 2 }}, CONST(5))}, TempConstraint(O)={({{y 1 }}, CONST(1))} and TempConstraint(V)={({{y 3 }}, CONST(15))}. 21

22 Step 5. In this step, we recrsively remove the traces which lead to Fail R1. To achieve this, we initialize the set ConstrainedStates with the set containing each state c of R 1 where TempConstraint(c) is not empty, and we remove all the transitions which lead to Fail R1. We repeat the following processing ntil the set ConstrainedStates is empty : we remove from ConstrainedStates an element s, and we assign TempConstraint(s) to a temporary set Temp; while Temp is not empty, we remove from it an element (MT R (c), CONST(c)); we assign to CONST(c) its composition with the IOA obtained from R 1 where s is considered as the initial state; if there exists an element in MT R (c) sch that its intersection with the set of external otpts present in CONST(c) is empty, then we retrn "NO SOLUTION" in the case where s is the initial state of R 1, otherwise we replace each transition s'-t.s by s'-t.fail R1 and we replace R 1 by its initially connected component and we assign to Temp the empty set; if the intersection of entering(fail R1 ) and In is not empty, for each transition s"-t.fail R1 with t in the intersection, we retrn "NO SOLUTION" in the case where s" is the initial state, otherwise we replace each transition s'-t.s" by s'-t.fail R1 and we replace R 1 by its initially connected component. Then we redefine the set ConstrainedStates by assigning to it the set containing each state c of R 1 where TempConstraint(c) is not empty and we remove all the transitions which lead to Fail R1 ; if s remains in S R1, we trn or attention to those states in CONST(c), different from c and Final, from which we can not reach a state where an external otpt occrs; for each sch state c' in S CONST(c), we replace each transition c"- t. c' by c"- t. Fail CONST(c) ; then we replace CONST(c) by its initially connected component; now for each transition c"- t. Fail CONST(c), we determine a trace σ sch that c σ =c" and we replace the transition s σ -t.s' by s σ -t.fail R1 ; if the intersection of entering(fail R1 ) and In is not empty, for each transition s"- t. Fail R1 with t in the intersection, we retrn "NO SOLUTION" in the case where s" is the initial state, otherwise we replace each transition s'- t. s" by s'- t. Fail R1 and we replace R 1 by its initially connected component. Then we redefine the set ConstrainedStates by assigning to it the set containing each state of R 1 where TempConstraint(c) is not empty and we remove all the transitions which lead to Fail R1. The complexity in the worst case of this step is polynomial in the nmber of states of R 1. Procedre Remove-Fail-state ConstrainedStates := {c S R1 TempConstraint(c) Ø}; I R1 :=In ; O R1 :=(I C \I IOAA ) (O IOAA \O C ); T R1 := T R1 \{(c, t, Fail R1 ) T R1 }; WHILE ConstrainedStates Ø DO s := an element of ConstrainedStates ; ConstrainedStates :=ConstrainedStates \{s}; Temp := TempConstraint(s); 22

23 WHILE Temp Ø DO (MT R (c), CONST(c)) := an element of Temp; Temp :=Temp\{(MT R (c), CONST(c))}; CONST(c) := CONST(c) (S R1, I R1, O R1, T R1, s); Temp1 := c' SCONST(c) ot(c') O IOAA ; Temp2 :=MT R (c); WHILE Temp2 Ø DO Y := an element of Temp2; Temp2 := Temp2\{Y}; IF Y Temp1=Ø THEN IF s=s or1 THEN retrn "NO SOLUTION"; STOP; ELSE replace s'- t. s by s'- t. Fail R1 for each t in entering(s); R 1 :=CC(R 1 ); Temp:=Ø; Temp2:=Ø; IF entering(fail R1 ) In Ø THEN Temp3 :={(s", t, Fail R1 ) T R1 t In}; WHILE Temp3 Ø DO (s", t, Fail R ) := an element of Temp3; IF s"=s or THEN retrn "NO SOLUTION"; STOP; ELSE replace s' - t'. s" by s' - t'. Fail R1 for each t' in entering(s"); R 1 :=CC(R 1 ); Temp3 :={(s', t', Fail R1 ) T R1 t' In}; ENDWHILE Temp3 Ø ConstrainedStates := {p S R TempConstraint(p) Ø}; T R1 := T R1 \{(p, t, Fail R1 ) T R1 }; ENDWHILE Temp2 Ø IF s S R1 THEN NonSilentStates={s' S CONST(c) ot(s') O IOAA Ø}; Temp4=S CONST(c) \{c, Final}; WHILE Temp4 Ø DO c' := an element of Temp4; Temp4 := Temp4\{c'}; IFSccint(c') NonSilentStates=Ø THEN S CONST(c) := S CONST(c) {Fail CONST(c) }; replace c"- t. c' by c"- t. Fail CONST(c) for each t in entering(c'); 23