Substitution and Flip BDDs

Transcription

1 Substitution and Flip BDDs Rune M. Jensen and Henrik R. Andersen IT Universit Technical Report Series TR ISSN December 2003

2 Copright c 2003, Rune M. Jensen and Henrik R. Andersen IT Universit of Copenhagen All rights reserved. Reproduction of all or part of this work is permitted for educational or research use on condition that this copright notice is included in an cop. ISSN ISBN Copies ma be obtained b contacting: IT Universit of Copenhagen Glentevej 67 DK-2400 Copenhagen NV Denmark Telephone: Telefa: Web

3 Substitution and Flip BDDs Rune M. Jensen and Henrik R. Andersen Abstract This report introduces two novel approaches for representing transition functions of finite transition sstems encoded as Binar Decision Diagrams (BDDs). The first approach is substition BDDs where each transition is represented b a corresponding substitution on state variables. The second is flip BDDs where each transition is defined b the set of state variables with flipped value. We show that substitution BDDs can be used to find and propagate write conflicts in snchronous and asnchronous compositions. Furthermore, our eperimental evaluation suggest that the compleit of image computations based on flip BDDs ma compare positivel to the usual relational product computation. Introduction Binar Decision Diagrams (BDDs,[2]) have been successfull applied to implicitl search large transition sstems in a wide range of fields including formal verification, planning, control, and game theor (e.g., [3, 4,, 9, ]). Two major approaches for representing the transition function have been developed. The first represents the transition function as a vector of Boolean functions where each function defines the value in the net state of a single state variable (e.g.,[8]). The approach, however, is limited to deterministic transition functions. The second approach is probabl the most popular. It represents the transition function as the characteristic function of the transition relation [7]. It can represent deterministic as well as nondeterministic transition functions. In this report, we introduce two novel transition function representations. Both can represent deterministic as well as nondeterministic transition functions. The first is called substitution BDDs and is based on representing each transition b a substitution on state variables. Since this representation is redundant, it allows write conflicts on state variables to be detected and propagated. The second approach is called flip BDDs. The idea is to represent each transition b the set of state variables it changes. This set is uniquel defined. Thus, flip BDDs are non-redundant. Our preliminar eperimental evaluation indicates that image computations based on flip BDDs ma have lower compleit than the relational product operation used to compute the image when the transition function is represented b the characteristic function of the transition relation. The remainder of the report is organized as follows. In Section 2, we introduce a guarded command language and substitution BDDs for representing its semantics. We also define specialized BDD operators for making snchronous and asnchronous compositions of guarded commands and computing the image of a set of states given a transition sstem represented as a substitution BDD. In Section 3, we introduce flip BDDs. We show how to build a flip BDD from a transition sstem definition. In addition, we define the image operation for a transition sstems represented b a flip BDD and present preliminar eperimental results comparing the performance of fied point computations based on flip BDDs and fied point computations based on the usual relational product. Finall, we draw conclusions and discuss directions for future work in Section 4. 2 Substitution BDDs Substitution BDDs represent snchronous and asnchronous compositions of guarded commands. The abstract snta of the guarded command language is given b COM "#$&'

4 < The operators & and " denote snchronous and asnchronous composition. The variables and are Boolean epressions on a nonempt set of Boolean state variables, ' given b " " where #" An atomic command is eecutable in a state that satisfies the epression on the current state variables. If it eecutes, the $ state variables in & (') +* #')-, */. change value to one of the assignments of 0 ') +* ')-, *. satisfing such that (') * ') +* ')-, * ')-, * in the resulting state. We regard the set of possible assignments of the $ state variables in as substitutions. Eample shows four atomic commands. Eample Four atomic commands are shown below ( ( ( # : ' 2. ; # 2. 2 In an asnchronous composition "#=2 of two guarded commands and =2 at most one transition (or substitution) takes place in each time step. Thus, the substitutions of each state in the resulting command is equal to the union of substitutions for that state of and =2. Snchronous composition & =2 is more complicated, since a substitution in both and 2 happens simultaneousl. For a given state this means that an combination of substitutions of and 2 can happen. In addition, substitutions ma conflict b writing to the same state variable. We assume that a conflict occur even when the two substitutions agree on the new value of the variable. Obviousl other models of snchronous composition could be used. In order to define the semantics of a guarded command formall, we first define a substitution as a partial mapping from variables to truth values or the error substitution, >?@ACB+D E GFIH.4J > A command denotes a domain K LL 6MM D, where D is a mapping from states to sets of substitutions D H9NOP/QN SRUT=VWXZY H SR T=VWXZY The semantic function K9LL 6MM is defined b structural induction on the abstract snta K LL MM\[ L ] ^ #, ] ^, M `_ LL 8MM\[Ga_ LL MMbc[ ^. K LL ed 2 MM\[ K LL fmm\[ J K LL 3MMZ[ K LL & 2 MM\[ g 9hig 2 jg " K LL 3MM\[ g 2 " K LL 2 MM\[U lk`mn n g hogc2 qqp r sqq > ut8vwlg.:z t{vw g2.} ~ > ug > > ug 2 > g( J g 2 D mn k` B n The function K LL ƒ MM defines the usual semantics of a Boolean epression ƒ. Eample 2 shows various compositions of the four atomic commands introduced in Eample. Eample 2 The semantics of the four atomic substitutions presented in Eample and a few compositions are illustrated below 2

5 H ƒ 2 7 > ) H H R H > < L ] M L 2 ] M L : ] # 2 ] =M L 2 ] M L ] M 0 L ] # 2 ] M 0 L L ] M ] #(2] =M 0 2. &87 & 2. Domain Embedding In order to use BDDs to represent the substitution domain of a guarded command, we embed D in a pair of Boolean functions D H NO P3QN SR TVWXZY H SR OP3Q H SR OP/Q D H H H9NO P3QN H * H H NOP3QN H9NOP/QN The first function encodes all the non-conflicting substitutions, while second encodes all the error substitutions. To define these functions, we introduce some auiliar notation For a pair E #., let. " and #$. ", For a Boolean function ƒ '&., let the variable names and domain of ƒ be simultaneousl defined b (*) +-,-,-, + (./ H, For a Boolean function ƒ ( ) + (*0) +-,-,-, + (. + (*0. H and an assignment of the arguments ^ '3^ 3^ & 6^ &. " 2&, let 2 '. ^ ', 2 '. ^ ', 43 ( ^ 6^ &., and 43 ( 0 ^ 6^ &.. A domain embedding is defined b the function D H O'687 H. H OP/Q H. where :9<; # # ' " U. Given a domain ta" D, a substitution transition ^ 6^ 6^ 3^ 6^ 3^., and a state [ ^ 3^f., we have = t.+. >g > CED*F G H g. CED g. =#8$ t.+. [ > "#t([. k`mn n CED*F G H g. K " g.. g9. CED= g. K ". " g. 3

6 2 Thus, =#8$ t./. and t./. encode a state with the variables. In addition, = t.+. encodes the value of a substitution with the variables (see CED*F G H ) and the set of variables in the substitution with the variables (see CED= ). 2.2 The BDD Representation of the Embedding and assume without loss of generalit that the variables are ordered ascend- Let the set of BDD variables equal 9 ; ingl The BDD representation of a command is given b the function. a H O 687 H. H OP3Q H. defined b. :..,,. d #$.+. #8$ 2./.+. & 2.. & 2. where :. and `. are BDD representations of and using to encode the state and to encode the substitution values. The & operation is defined b structural induction on the BDD representation. To simplif the definition, we assume that the BDD is non-reduced such that all nodes are present in the decision tree. Let U. and 2.. Base Case ( Inductive Case Let " H ) &.. =. #$. =#8$. =. #$. #$. L = a b c d e f, g h and R = A B C D E F, G H We then have L * R = aa bb cc dd, ee ff gg hh 4

7 $ where where aa #. &. bb ^. &. cc '#. &. dd = t. &. ee. &. ff. &. gg #$ #. &. #8$ #. &. #8$ #. &. hh #$ ^. &. #$ ^. &. #$ ^. &. >.. &. c^. &.. &. c^. &. #8$ '. &. #8$ #. &. '.. #.. '.. #.. #$ t. &. #$. &. t.... t.... #8$. >. #8$. The definition of snchronous composition is comple due to the induction on a pair of BDDs instead of just a single BDD. The first BDD in the pair is easiest to understand. There are two smmetricall distinct cases aa #. &. cc '#. &. = #. &. The BDD aa represents the continuation of non-conflicting substitutions where no value is substituted for, and is false in the current state. This BDD is the first element of the snchronous composition of the subsstems represented b. and. of and since the substitutions represented b these sstems are the onl continuations of substitutions not containing, when is false. Similarl, cc represents the continuation of non-conflicting substitutions where is assigned false. This can happen in two was: does not substitute on and assigns it to false, or assigns to false and does not substitute on it. The second BDD represents the error states. There is one smmetricall distinct case gg =#8$. &. #$ '. &. #$ #. &. #$. &. '.. #.. #$. &. '.. #.. The five epressions on the form #$ &/. are the conflicts happening in the previous or remaining levels, while the four epressions on the form are conflicts happening at the current level: assigns to true and assigns to true, assigns to true and assigns to false, assigns to false and assigns to true, and assigns to false and assigns to false. Due to the snchronous composition, is the intersection of all the possible states reachable b and (notice that this includes error states). The correctness of the BDD implementation is proven in Appendi A. Theorem (Correctness) For an command, ", K LL 6MM... Proof: See Appendi A. 2.3 Image Computation The operation computes the image of a domain represented b the embedding D of a set of states represented in the usual wa b a BDD. The image operation is undefined if has a conflict substitution (> ) for some state in. The operation is defined b structural induction on and. Base Case ( " 2 H " H ) #"$ t&')( t*.,+ =. -/. {02 3 can also be defined inductivel in the same wa as 4.

8 Inductive Case Let D = a b c d e f, g h and R = G H We then have gg hh where gg t hh ^ The preimage computation can be defined in a similar wa. 3 Flip BDDs Flip BDDs are related to substitution BDDs ecept that there is a one-to-one correspondence between a flip BDD and the transition sstem it represents. The flip BDD representation has been developed to investigate the computational efficienc of the image computation based on this representation compared to the usual image computation based on the characteristic function of the transition relation. As usual let U : #(( define a nonempt set of Boolean state variables. A possibl nondeterministic transition sstem on is defined b the pair where H is the finite state space spanned b and SR is a transition function. A flip BDD is a BDD on the ordered set of variables defined b #. >[ " #. K " [8.e} [{.+. Thus, an assignment to ' # uniquel defines a transition where the primed variables encode the set of variables that have their truth value flipped b the transition. 6

9 3. Image calculation The operation computes the image of a set of states. The set of states is represented b a BDD in the usual wa, while the transition sstem is given as a flip BDD. The ordering of the variables in ordering of the pairs in. is the same as the Base Case ( E"l ) Inductive Case = 3.2 Eperimental Results The following eperiments are based on an implementation of in the Budd package [6]. The first eperiment compares the CPU time of 0 fied point calculations using flip BDDs and the relational product operator 2. The Budd package was initialized with 0000 BDD nodes and an operator cache varing from 0 to 00 percent of the number of BDD nodes. The transition sstem and the set of initial states are randoml generated using 0 state variables and 000 transitions. The results are shown in table. As depicted in the table, the flip BDD image computations seem to Cache size () (sec) (sec) Table : CPU time of 0 fied point calculations as a function of operator cache size for flip BDD image computations ( ) and image computations based on relational products ( ). be less cache dependent than image computations based on the relational product. This is an encouraging result since cache efficienc is essential for keeping the compleit of BDD operations low. Moreover, these results were obtained with a naive eperimental implementation of that actuall unfolds the BDDs on the fl to perform the computation. It is, however, surprising that the relational product operation has highest performance at 80 rather than As most other BDD packages, Budd emplos a highl optimized version of the relational product operation. 7

10 The second eperiment compares the CPU time of 000 fied point calculations using flip BDDs and the relational product operator. The Budd package was initialized to BDD nodes and the cache to 0000 BDD nodes. The transition sstem and the set of initial states are randoml generated using 0 state variables and 000 to 0000 transitions. The results are shown in table 2. These results show some, but not an overwhelming, advantage of the flip Transitions (sec) (sec) Table 2: CPU time of 000 fied point calculations as a function of number of transitions for flip BDD image computations ( ) and image computations based on relational products ( ). BDD approach. For 000 randoml generated eperiments, it is surprising that the problems with 6000 transitions are so much harder than the ones with 000 transitions. Also, information about the cache miss rates for both approach would be valuable. It seems necessar to conduct further eperiments to get a deeper insight in the performance differences between the two approaches. It is also a problem that the eperiments are based solel on randoml generated transition sstems. It is well known that there often is a significant difference between the performance on random and real-world problems for a particular approach. 4 Conclusion In this report, we have introduced two novel BDD representations of transition sstems called substitution and flip BDDs. The first representation is suitable for tracing variable assignment conflicts in snchronous and asnchronous sstem compositions. The second provides a promising alternative to the relational product operation for state space eploration. Future work includes developing efficient algorithms for manipulating these representations without unfolding the BDDs on the fl. In addition, more eperiments are necessar comparing the efficienc of image computations based on flip BDDs and the relational product. These eperiments should include both real-world and random problems. Acknowledgments Most of the work presented in this rapport was carried out in the summer 2000 and 200 while the first author was visiting the IT Universit of Copenhagen. This work was supported in part b the Danish Research Agenc. References [] E. Asarin, O. Maler, and A. Pnueli. Smbolic controller snthesis for discrete and timed sstems. In Hbrid Sstems, pages 20, 994. [2] R. E. Brant. Graph-based algorithms for boolean function manipulation. IEEE Transactions on Computers, 8:677 69, 986. [3] J. R. Burch, E. Clarke, D. L. Long, K. L McMillan, and D. L. Dill. Smbolic model checking for sequential circuit verification. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Sstems, 3(4):40 424,

11 [4] A. Cimatti, M. Roveri, and P. Traverso. Automatic OBDD-based generation of universal plans in non-deterministic domains. In Proceedings of the th National Conference on Artificial Intelligence (AAAI 98), pages AAAI Press, 998. [] L. De Alfaro, Henzinger T. A., and O. Kupferman. Concurrent reachabilit games. In IEEE Smposium on Foundations of Computer Science, pages 64 7, 998. [6] J. Lind-Nielsen. BuDD - A Binar Decision Diagram Package. Technical Report IT-TR: , Institute of Information Technolog, Technical Universit of Denmark, [7] K. L. McMillan. Smbolic Model Checking. Kluwer Academic Publ., 993. [8] C. Meinel and T. Theobald. Algorithms and Data Structures in VLSI Design. Springer, 998. [9] A. Vahidi, B. Lennartson, D. Arkerd, and M. Fabian. Efficient application of smbolic tools for resource booking problems. In Proceedings of the American Control Conference,

12 A Proof of Correctness First we introduce some auiliar definitions and lemmas. Lemma ( ) K LL MM. K LL MM. [ K LL MM[ ~` } K LL MM\[ } ~ Proof: K LL MM. K LL MM. [ > K LL 3MM.+. [ > K LL =2fMM.+. [ due to def. of K LL 3MM\[ } ~` K LL 6MM\[ } ~ due to def. of #8$ K LL 3MM.+. [ #8$ K LL =2fMM.+. [ Definition (. ). ) ( 0 0 * + ) ( 0 * + ) (=* (*0 0 + (*02+ ( " H VAR.+. J G ( ([ " H Var #8$.+. c[ J 9[82.. Definition 2 ( K LL 6MM. ) K LL 6MM. ) ( 0 0 * + ) ( 0 * + ) (=* (*0 0 + (*0 + ( " H VAR K9LL 6MM.+. J 2./. 4./ ( ([ " H Var #$ K9LL 6MM.+. c[ J c[{.. Definition 3 (aa) K9LL ) ( (* MM ([ " H Var ( = gg " K LL 6MM [ J 9[82.. "] dom g. Lemma 2 (aa) Proof: K LL 6MM. ( ( K LL ) ( (=* MM. K9LL 6MM. ( (. " H VAR.+. J due to def. K LL fmm. >gl" K9LL 3 b) (=* /A > K #" g.. g9./. K #". #" g. 2. (*0 02+ (*02+ ( 0

13 due to def. of >gl" K9LL 3 b) (=* /A > K #" g.. g9./. K #" A (. #" l] " g. g. >gl" g K9LL 3 b) (=* ] " g. A > K #" g.. g9./. K #" A (. #" g. K9LL ) ( (* MM.+. due to def. aa #$ K LL 6MM. ( (. [ " H Var #$ K LL 6MM.+. [ J 9[82.. due to def. K LL fmm. > " g gl" K9LL 6MMbc[ J 9[{.. due to def. of > " g gl" K9LL 6MMbc[ J 9[{.. l] " g. #$ K LL ) ( (=* MM./. due to def. aa ( Definition 4 (cc) K9LL ) MM ([ " H Var ( ggl" K LL fmm [ J 9[82.. l L C] M " g g >. Lemma 3 (cc) Proof: K LL 6MM. ( ( 0 + ( K LL ) ( ( 0 + (=* MM. K LL 6MM. ( ( 0 + (. " H VAR K LL 6MM.+. J due to def. K LL 6MM. >gl" K LL 3 b) (=* A > K#" g.. g9./. K#" U. #" g.. 2. due to def. of >gl" K LL 3 b) (=* A > K#" g.ba (. g9./. ( (*02+ (

14 K#" U A (. #" " g. g92. g. >gl" g K LL 3 b) (=* L C] M " g A > K#" g.ba (. g9./. K#" U A (. #" g. >gl" g K LL 3 b) (=* l L ] M " g g >. A > K#" g.ba (. g9./. K#" U A (. #" g. K LL ) ( ( 0 + (=* MM.+. due to def. cc #$ K LL fmm. ( ( 0 + (. [ " H Var #$ K LL fmm.+. [ J 9[82.. due to def. K LL 6MM. > " g gl" K LL 6MM [ J 9[82.. due to def. of > " g gl" K LL 6MM [ J 9[82.. L C] M " g g >. #$ K LL ) ( ( 0 + (=* MM./. due to def. cc ( Definition (ee) K LL )2 6. MM [ " H Var ( = ggl" K9LL 6MMbc[ J 9[{.. l L C] M " g g >. Lemma 4 (ee) K LL 6MM. ( ( 0 + ( K LL ) ( ( 0 + (=* MM. Proof: Smmetric to the proof of lemma cc We are now read to prove the main theorem Theorem (Correctness) For an command, ", K LL 6MM... Proof: We prove b structural induction on. Basis In the base case, is an atomic command 2

15 We have K LLUMM.+. >g " L ]' #, ], M j_ LL 3. MM _ LL MMc K #" g.. g9.+. K ". " g. due to def. of and K :. G.,,../. due to def. of and #$ K9LL {MM./. [ > " K LL {MMZ[. [ #$.+. [ due to def. of due to def. of Thus, K LL {MM... Inductive Cases ( 2 and & 2 ) The structural induction hpothesis (IH I) is. K9LL 3MM. =2. K9LL =2fMM. I. Assume 2. We have K LL 2 MM./. >g " K LL J K LL 2 3 A > K #" g.. g9.+. K ". " g. due to def. of and K >g " K LL A > K #" g.. g9.+. 3

16 K ". " g. >g " K LL 3 A > K #" g.. g9.+. K ". " g../. 2./. due to IH I 2.+. due to def. of and #$ K LL " 2 MM.+. [ > " K LL 3MM\[ J K LL 2 MM\[ due to def. of and K > " K LL MM\[ > " K LL =2=MM #$./. [ #$ 2./. [ due to IH I #$ 2.+. [ due to def. of Thus, K LL 2 MM. 2.. II. Assume & 2. Consider the BDD,, representing the command, Without loss of generalit we assume that Since is assumed to be non-reduced, we have Consider the propert We want to prove that. is a non-reduced BDD. Let equal the number of #. levels. $. with the definition $. & 2. K LL & 2 MM. for & 2. $ $. holds for all $. We do this b induction on $.. Basis ($ ) Assume &=2. and U. First we prove & 2.+. K LL & 2 MM./. 4

17 Case. &= & =2.+.. due to def. of K LL MM. & K LL =2MM./.. due to IH I K LL 6MM.+.. K LL 2 MM./.. due to base case def. of & >gl" K LL 6MMb.BA > #i] " g.+. >gl" K LL 2 MM.A > "] g./. due to def. of >gl" g( hog 2 g( " K LL 6MMb. 3g 2 " K LL 2 MM. A > i] " g. due to def. of h >gl" K LL 3 A > K #" g.. g9.+. K #". #" g. for. K LL & 2 MM.+.. due to def. of Case.. and. Smmetric to case. Case. & K9LL 6MM. & K LL 2 MM.+.. using the same steps as in case E. K9LL 6MM.+.. K LL 2 MM./. +=. K9LL 6MM.+.?+. K LL 2 MM./.. due to base case def. of & >g " K LL MMb.BA > L ] M:" g. l >gl" K9LL =2fMM. A > "] g.+. >g " K LL MMb.BA > #i] " g.+. l >g " K9LL =2fMM.BA > L :] M" g. due to def. of >g "l g hig2 g " K LL MMb. /gc2 " K LL 2fMM. A > L :] M" g due to def. of h >g " K LL & 2 A > K #" g.. g9./. K " U. #" g. for. K9LL &=2=MM./.. due to def. of Case.. and. Smmetric to case.

18 We then prove Case [. #$ &=2./. #8$ K LL &=2=MM.+. #$ & 2./.. #$ K LL 6MM. & K9LL 2 MM.+.. using the same steps as in case. K9LL MM.+.. =#8$ K LL =2fMM.+.. #$ K LL MM./.. K LL =2=MM.+.. #$ K LL MM./.. #$ K LL =2=MM./.. K9LL MM.+.. #$ K LL =2=MM./.. #$ K LL 6MM./.. K LL 2 MM.+.. #$ K LL 6MM./.. #$ K LL 2 MM./.. K9LL 3MM.+.. #$ K LL 2 MM./.. #$ K LL 6MM./.. K LL 2 MM.+.. #$ K LL 6MM./.. #$ K LL 2 MM./.. K9LL 3MM.+.. =#8$ K LL 2 MM.+.. #$ K LL 6MM./.. K LL 2 MM.+.. #$ K LL MM./.. #$ K LL =2=MM./.. K9LL MM.+.. =#8$ K LL =2fMM.+.. #$ K LL MM./.. K LL =2=MM.+.. #$ K LL MM./.. #$ K LL =2=MM./.. > K9LL 3MM #$ K LL 3MM.+.. > K9LL 2 MM #$ K LL 2 MM.+.. > K9LL MM #$ K LL MM.+.. > K9LL 2 MM #$ K LL 2 MM.+.. > K9LL MM #$ K LL MM.+.. > K9LL 2 MM #$ K LL 2 MM.+.. > K9LL MM #$ K LL MM.+.. > K9LL 2 MM #$ K LL 2 MM.+.. due to base case def. of & >g " K LL fmmb. A > #i] " g.+. > " K9LL 2 MM. > " K LL 3MM. l >gl" K LL 2 MM. A > #i] " g.+. > " K LL 3MM. > " K LL 2 MM. >g " K LL fmmb. A > L ] M:"#g. > " K LL 2 MM. > " K LL MM. l >gl" K LL 2fMM. A > #i] " g.+. > " K LL MM. > " K LL =2fMM. >g " K LL MMb. A > L ] =M:"#g. > " K LL =2=MM. > " K LL MM. l >gl" K LL 2fMM. A > #i] " g.+. > " K LL 3MM. > " K LL 2 MM. >g " K LL fmmb. A > #i] " g.+. > " K9LL 2 MM. 6

19 Case [. Smmetric to case [. > " K LL 3MM. l >gl" K LL 2 MM. A > L ] M:" g. > " K LL 3MM. > " K LL 2 MM. >g " K LL MMb. A > #i] " g.+. > " K9LL =2fMM. > " K LL MM. l >gl" K LL 2fMM. A > L ] =M:" g. > " K LL MM. > " K LL =2fMM. >gl" K LL MM. L ] M "#g. > " K LL MMb. >gl" K LL 2 MM. L ] M "#g. > " K LL 2 MMb. >gl" K LL MM. L ] =M "#g. > " K LL MMb. >gl" K LL 2 MM. L ] M "#g. > " K LL 2 MMb. >gl" K LL MM. L ] M "#g. > " K LL MMb. >gl" K LL 2 MM. L ] =M "#g. > " K LL 2 MMb. >gl" K LL fmm. L ] =M "#g. > " K LL 3MMb. >gl" K LL =2MM. L ] =M "#g. > " K LL 2fMMb. due to def. of >g " K9LL 6MM. /g 2 " K9LL 2 MM. /g > g 2 > t{vw. g(. z t8vw. g 2. } ~ > " g( hog 2 g " K9LL 3MM. /g 2 " K9LL 2 MM. due to def. of h #$ K LL & 2 MM.+.. due to def. of Thus & 2. K LL & 2 MM. for & 2.. Inductive Step ($ ) The induction hpothesis (IH II) is that. holds. That is $ & 2. K9LL & 2 MM. for & 2. $ First we prove We have & 2.+. =. & 2.+. due to def. of &=2./. K LL &=2fMM.+. fst * a b c d e f, g h A B C D E F, G H 7

20 aa bb cc dd ee ff where aa #. &. bb ^. &. cc '#. &. dd = t. &. ee = #. &. ff. &. qqqqqqp r " H VAR sqqqqqq due to the semantics of BDDs Case aa. &. = c^. &.. &. = c^. &. aa A bb A Z.. cc A dd A ee A ff A We want to prove where " H VAR ( (*0 + (. We have aa K LL &=2=MM./. J aa. ( ( &. ( (. K LL MM. ( ( & K LL =2fMM. ( (. due to IH I K LL ) ( (* MM. & K LL 2 ) ( (=* MM./. due to lem. aa ) ( (=*. & 2 ) ( (=*.+. due t0 IH I ) ( (=* & 2 ) ( (=*.+. due to def. of K LL ) ( (* & 2 ) ( (* MM.+. due to IH II >g " g hogc2 g " K LL ) ( (=* 3 3gC2 " K LL 2 ) ( (=* 3 A > K#" g.. g9.+. K#" U A (. #" g. due to def. of and & >g " g hogc2 g " K LL 3 b) (=* l] " g. g2 " K9LL 3 b) (=* l] " g2. A > K#" g.. g9.+. 8

21 K#" U A (. #" due to lem. aa g. >g " g hogc2 g " K LL 3 b) (=* g2 " K9LL 3 b) (=* A > K#" g.. g9.+. K#" U A (. #" g. ] " g. due to def. of h >g " g hogc2 g " K LL 3 g2 " K9LL 3 U A > K#" g. b. g9./. K#" U. #" g. k`mcn n J 3 ( >g " K LL &=2fMM. A > K#" g. b. g9./. K#" U. #" g. due to def. of & K LL & 2 MM.+. J due to def. of Case bb smmetric to case aa Case cc We want to prove where " H VAR ( ( 0 + (. We have cc K LL & 2 MM.+. J cc K LL ) ( ( 0 + (=* & 2 ) ( (=* MM./. K LL ) ( (* & 2 ) ( ( 0 + (=* MM./. using the same steps as in the proof of case aa gl" g( 4hig 2 g( " K LL ) ( ( 0 + (=* 3 3g 2 " K LL 2 ) ( (* A > K#" g.. g9./. K#" U A (. #" g. gl" g( 4hig 2 g( " K LL ) ( (* /g 2 " K LL 2 ) ( ( 0 + (* A > K#" g.. g9./. K#" U A (. #" g. due to def. of and & gl" g( 4hig 2 9

22 @ g " K9LL ) ( ( 0 + (=* g 2 " K9LL 2 ) ( (=* MM?3 g " K9LL ) ( (=* 3 g 2 " K LL 2 ) ( ( 0 + (=* MM?3 A > K#" g.. g9./. K#" U A (. #" g. gl" g( 4hig 2 g " K9LL 6MM 3 b) (=* /* l L ] M "#g g >. g 2 " K9LL 2 MM 3 b) (=* /* l] " g 2. g " K9LL MM 3 b) (=* /* l] " gc2. g2 " K9LL =2=MM 3 b) (=* /* l L ] M "#g g >. A > K#" g.. g9./. K#" U A (. #" g. due to lem. cc >gl" g hig 2 g( e" K LL 3 b) (=* g2 " K9LL 3 b) (* A > K#" g.. g9./. K#" U A (. #" g. " g. g92. due to def. of h >gl" g hig2 g " K LL 3 g2 " K9LL 3 A > K#" g. b. g9.+. K#" U c. #" g. k`mn n J. 6 3 ( >gl" K LL &2fMM. A > K#" g.. g9.+. K#" U. #" g. due to def. of & K LL & 2 MM./. J due to def. Case dd,ee and ff smmetric to case cc Thus & 2./. K LL & 2 MM.+.. We then prove #$ &=2./. #8$ K LL &=2=MM.+. We have 20

23 #$ & 2./. =#8$. & 2.+. due to def. of snd * a b c d e f, g h A B C D E F, G H gg hh where gg =#8$. &. #$ '#. &. #$. &. #$. &. '#.... #$. &. '#.... hh #$ c^. &. #$ t. &. =#8$. &. #8$ c^. &. t.... #8$ c^. &. t.... [ " H Var gg [ A [8.. 9[82. [ A [8.. [82. hh due to the semantics of BDDs Case gg We want to prove where " H Var we get (. gg #$ K LL &=2fMM.+. J 2.. gg #$ K LL ) ( (=* & 2 ) ( (=* MM.+. [ #$ K LL ) ( ( 0 + (=* & 2 ) ( (=* MM./. [ #$ K LL ) ( ( 0 + (=* & 2 ) ( (=* MM./. [ #$ K LL ) ( (=* & 2 ) ( ( 0 + (=* MM./. [ #$ K LL ) ( (=* & 2 ) ( ( 0 + (=* MM./. [ K LL ) ( ( 0 + (=* MMZ[ ~` } K LL 2 ) ( ( 0 + (=* MMZ[ ~ } K LL ) ( ( 0 + (=* MM\[ } ~` K LL 2 ) ( ( 0 + (=* MM[ } ~ K LL ) ( ( 0 + (=* MMZ[ ~` } K LL 2 ) ( ( 0 + (=* MM[ } ~ K LL ) ( ( 0 + (=* MM\[ } ~` K LL 2 ) ( ( 0 + (=* MM\[ } ~ using the same steps as in the proof of case aa and lemma > " g hog 2 g( " K LL 6MMbc[ J 9[8.. l] " g. gc2 " K LL =2=MMbc[ J 9[8.. l2 ] " gc2. L C] M " gc2 L ] =M " gc2 g2 >. gc2 " K LL =2=MMbc[ J 9[8.. l] " g2. 2

24 g( " K LL 6MMbc[ J 9[8.. l2 ] " g(. L C] M " g( L ] =M " g( g >. g g " K LL MMbc[ J 9[{.. l L C] M " g L ] M " g g >. ~` } g g " K LL 2fMMbc[ J 9[{.. l L C] M " g L ] M " g g >. ~ } and def. of > " g hog 2 g( " K LL 6MMbc[ J 9[8.. l] " g. g 2 " K LL 2 MMbc[ J 9[8.. l2 ] " g 2. L C] M " g 2 L ] =M " g 2 g 2 >. g 2 " K LL 2 MMbc[ J 9[8.. l] " g 2. g( " K LL 6MMbc[ J 9[8.. l2 ] " g(. L C] M " g L ] =M " g g >. > " g hogc2 g " K LL MMbc[ J 9[8.. l L C] M " g gc2 " K LL =2=MMbc[ J 9[8.. l L C] M " g2 L C] M "#g. L C] M "#gc2. > " g hog 2 g( e" K LL 3MM[ /g 2 " K9LL 2 MM D B/@ACB+D D/@D. > " g hog 2 g( e" K LL 3MM[ /g 2 " K9LL 2 MM\[ D B/@ACB+D D/@D. k`mn n [ [ J 9[82. due to def. of h > " g hogc2 g " K LL MM[ /g2 " K9LL =2fMM\[ #$ K LL &=2.+. [ J 9[82.. due to def. of and & Case hh Smmetric to case gg Thus &=2. K LL &=2=MM. for &=2. $. 22