This paper presents a framework for compositional nonblocking verification of discrete event systems modelled as extended finite-state machines (EFSM). Previous results are improved to consider general conflict-equivalence based abstractions of EFSMs communicating both via shared variables and events. Performance issues resulting from the conversion of EFSM systems to finite-state machine systems are avoided by operating directly on EFSMs, deferring the unfolding of variables into state machines as long as possible. Several additional methods to abstract EFSMs and remove events are also presented. The proposed algorithm has been implemented in the discrete event systems tool Supremica, and the paper presents experimental results for several large EFSM models that can be verified faster than by previously used methods.

This paper describes a framework for compositional supervisor synthesis, which is applicable to all discrete event systems modelled as a set of deterministic automata. Compositional synthesis exploits the modular structure of the input model, and therefore works best for models consisting of a large number of small automata. The state-space explosion is mitigated by the use of abstraction to simplify individual components, and the property of synthesis equivalence guarantees that the final synthesis result is the same as it would have been for the non-abstracted model. The paper describes synthesis equivalent abstractions and shows their use in an algorithm to efficiently compute supervisors. The algorithm has been implemented in the DES software tool Supremica and successfully computes nonblocking modular supervisors, even for systems with more than 10 14 reachable states, in less than 30 seconds.

Abstract-This paper proposes a general method to synthesize a least restrictive supervisor for a large discrete event system model, consisting of a large number of arbitrary automata representing the plants and specifications. A new type of abstraction, called synthesis abstraction is introduced and three rules are proposed to calculate an abstraction of a given automaton. Furthermore, a compositional algorithm for synthesizing a supervisor for large-scale systems of composed finite-state automata is proposed. In the proposed algorithm, the synchronous composition is computed step by step and intermediate results are simplified according to synthesis abstraction. Then a supervisor for the abstracted system is calculated, which in combination with the original system gives the least restrictive, nonblocking, and controllable behaviour.

This paper investigates the compositional abstraction-based synthesis of least restrictive, controllable, and nonblocking supervisors for discrete event systems that are given as a large number of finite-state machines. It compares a previous algorithm that synthesises modular supervisors in the form of state machines, with an alternative that records state maps after each abstraction step and uses these to control the system. The state map-based algorithm supports all abstraction methods used previously, and in addition allows for nondeterminism, hiding, and transition removal. It has been implemented in the software tool Supremica and applied to several large industrial models. The experimental results and the complexity analysis show that state maps can be computed efficiently and in many cases require less memory than state machine-based supervisors.

Abstract-For autonomous vehicles correct behavior is of the utmost importance, as unexpected incorrect behavior can have catastrophic outcomes. However, as with any large-scale software development, it is not easy to get the system correct. As the system is made up of multiple sub-modules that interact with each other, unexpected behavior can arise from incorrect interactions when one module may have unfulfilled expectations on the other. This paper describes how formal verification was applied to the lane change module of the decision and control software (under development) for an autonomous vehicle. The module was manually modelled as an extended finite-state machine, as were some of the requirements. When applying the Supremica software to perform the formal verification, some bugs were discovered in the model. Setting up additional unit tests triggering the incorrect behavior showed that this behavior was also present within the actual code. For some of the errors, applied corrections resulted in the absence of the particular error, thus demonstrating the power of true formal verification.