Counterexample-Guided Abstraction Refinement

Transcription

1 Counterexample-Guided Abstraction Refinement Edmund Clarke Orna Grumberg Somesh Jha Yuan Lu Helmut Veith Seminal Papers in Verification (Reading Group) June 2012 O. Rezine () Verification Reading Group 1 / 33

2 Motivations: Apply model checking to industrial problems. Main challenge: State explosion. How to tackle that: Use BDD (10 20 states), Symmetry Reductions, POR,... Abstraction Techniques. O. Rezine () Verification Reading Group 2 / 33

3 Abstraction Techniques: Idea: Remove details, simplify components that are irrelevant. Concrete model Abstract model. The abstract model is smaller Easier to verify. It comes with an information loss: Over-approximation comes with False negatives. Under-approximation comes with False positives. O. Rezine () Verification Reading Group 3 / 33

4 CounterExample Guided Abstraction Refinement: Integrates: Symbolic model checking. Over-approximation abstraction. It comes with false negatives. Fully automatic, including abstraction refinement. O. Rezine () Verification Reading Group 4 / 33

5 CEGAR general scheme Model extraction: Initial abstraction. Model-Check the Abstract Model. If no bug is found: The concrete Model is safe. If a counterexample is found: Is it a concrete one? Yes. Happy end. No. Refine the abstraction and model-check again. O. Rezine () Verification Reading Group 5 / 33

6 Summary: We talked so far about: Motivations behind CEGAR. General scheme of the approach. Now we will talk about: Abstraction validity. Initial (abstract) model extraction. Algorithms used to: Check validity of the counterexample. Refine the abstraction. Later we will present extensions and use of CEGAR approach. O. Rezine () Verification Reading Group 6 / 33

7 Existential abstraction definition: Formally, a program P can be modeled as a Kripke structure (S, I, R, L) where: S is the set of states. I S is the set of initial states. R S S is the transition relation. L : S 2 Atoms(P) is the state labeling function. Atoms(P) being the set of atomic propositions of the the program P. O. Rezine () Verification Reading Group 7 / 33

8 Existential abstraction definition: An abstraction is a surjection h : D D that induces an equivalence relation: d e iff h(d) = h(e) The corresponding abstract Kripke tructure (Ŝ, Î, R, L) is: Ŝ = h(s). Î ( d) iff d I such that h(d) = d R( d 1, d 2 ) iff d 1, d 2 S such that (h(d 1 ) = d 1 h(d 2 ) = d 2 R(d 1, d 2 )) L( d) = h(d)= d L(d) This is called the Existential Abstraction. O. Rezine () Verification Reading Group 8 / 33

9 Abstraction Validity: An atomic formula f respects an abstraction h iff: d 1, d 2 D we have: d 1 d 2 (d 1 = f d 2 = f ) For an abstract state d we say that L( d) is consistent iff: d D such that h(d) = d we have: d = f L( d) f O. Rezine () Verification Reading Group 9 / 33

10 Abstraction Validity: ACTL is the fragment of CTL that: Contains only A as path operator (no E). The only negations it contains concerns the atomic propositions. Exmaple: A F p. Theorem Let h be an abstraction and ϕ be an ACTL specification where the atomic subformulas respect h. then the following holds: L( d) is consistent for all abstract state d in M. M = ϕ M = ϕ O. Rezine () Verification Reading Group 10 / 33

11 CEGAR general scheme Model extraction: Initial abstraction. Model-Check the Abstract Model. If no bug is found: The concrete Model is safe. If a counterexample is found: Is it a concrete one? Yes. Happy end. No. Refine the abstraction and model-check again. O. Rezine () Verification Reading Group 11 / 33

12 Example: We will model a program P using transition blocks associated to its variables. 1 init (x) := 0; next (x) := case 3 reset = TRUE : 0; x<y : x +1; 5 x=y : 0; else : x; 7 esac ; init (y) := 1; 9 next (y) := case reset = TRUE : 0; 11 (x=y) &&!(y=2) : x +1; x=y : 0; 13 else : y; esac ; O. Rezine () Verification Reading Group 12 / 33

13 Model Extraction: We construct the initial abstraction such that: How to: d 1, d 2 such that d 1 d 2 we have f Atoms(P) d 1 = f d 2 = f Define formula clusters FC i of formulas dealing with the same variable set. Define the corresponding variable clusters VC i. For each variable cluster, define an abstraction whose abstract states are consistent with the cluster formulas. Cross-product all the cluster abstractions to obtain The abstraction. O. Rezine () Verification Reading Group 13 / 33

14 Example: We will model a program P using transition blocks associated to its variables. 1 init (x) := 0; next (x) := case 3 reset = TRUE : 0; x<y : x +1; 5 x=y : 0; else : x; 7 esac ; init (y) := 1; 9 next (y) := case reset = TRUE : 0; 11 (x=y) &&!(y=2) : x +1; x=y : 0; 13 else : y; esac ; O. Rezine () Verification Reading Group 14 / 33

15 Model Extraction: Atoms(P) = {(reset=true), (x=y), (x<y), (y=2)} = FC 1 FC 2. VC 1 = {reset}, VC 2 ={x,y}. FC 1 equivalence classes: FC 2 equivalence classes: {0} {} {1} {reset} {(0, 0), (1, 1)} {(x = y)} {(0, 1)} {(x < y), } {(0, 2), (1, 2)} {(x < y), (y = 2)} {(1, 0), (2, 0), (2, 1)} {} {(2, 2)} {(x = y), (y = 2)} O. Rezine () Verification Reading Group 15 / 33

16 Model Extraction: Concrete State Space X, reset=false X, reset=true Y 1 start 2 O. Rezine () Verification Reading Group 16 / 33

17 Model Extraction: Concrete Transition Relation X, reset=false X, reset=true Y 1 start 2 O. Rezine () Verification Reading Group 17 / 33

18 Model Extraction: Abstract State Space X, reset=false X, reset=true Y 1 start 2 O. Rezine () Verification Reading Group 18 / 33

19 Model Extraction: Abstract Transition Relation X, reset=false X, reset=true Y 1 start 2 O. Rezine () Verification Reading Group 19 / 33

20 CEGAR general scheme Model extraction: Initial abstraction. Model-Check the Abstract Model. If no bug is found: The concrete Model is safe. If a counterexample is found: Is it a concrete one? Yes. Happy end. No. Refine the abstraction and model-check again. O. Rezine () Verification Reading Group 20 / 33

21 Checking finite counterexample: s i S i. By the definition of h 1 ( T ), s i+1 Img(s i, R) and s i+1 h 1 (ŝ i+1 ). O. Rezine () Verification Reading Group 21 / 33 Counterexample T = ŝ 1,..., ŝ n. Concrete traces are given by: Counterexample-Guided { s 1,..., s n Abstraction n i=1 h(s i) = Refinement ŝ i I (s 1 ) n 1 i=1 R(s i, s i+1 ) } 773 FIG. 6. An abstract counterexample.

22 Checking finite counterexample: SplitPATH: Symbolic algorithm to compute concrete paths: S := h 1 (ŝ 1 ) I j := 1 while ( S and j < n ) { j := j + 1; S prev := S S := Img(S, R) h 1 (ŝ j ) } if S then output counterexample // > Happy end. else output j,s prev // > Move to the refinement step. O. Rezine () Verification Reading Group 22 / 33

23 Checking infinite counterexample: Counterexample T = ŝ 1,..., ŝ i ŝ i+1,..., ŝ n ω. Example: FIG. 7. SplitPATH checks if an abstract path is spurious. ŝ 1 ŝ 2, ŝ 3 ω Unwinding: For one abstractfig. loop 8. we A loop get: counterexample, and its unwinding. Many concrete loops with different sizes. ŝ n. Since this case is more complicated than the path counterexamples, we first present Different an example start in which points. some of the typical situations occur. Example We consider a loop ŝ 1 ŝ 2, ŝ 3 ω as shown in Figure 8. In order to find out if the abstract loop corresponds to concrete loops, we unwind the O. Rezine () Verification Reading Group 23 / 33

24 Checking infinite counterexample: Also, the unwinding become eventually periodic. Question: How many unwindings are necessary to check the abstract loop? Theorem The following are equivalent: T corresponds to a concrete counterexample. h 1 path ( T unwind ) is not empty. Where: T = ŝ 1,..., ŝ i ŝ i+1,..., ŝ n ω T unwind = ŝ 1,..., ŝ i ŝ i+1,..., ŝ n min min = min i+1 j n h 1 (ŝ j ) We can use SplitPATH to check T unwind O. Rezine () Verification Reading Group 24 / 33

25 CEGAR general scheme Model extraction: Initial abstraction. Model-Check the Abstract Model. If no bug is found: The concrete Model is safe. If a counterexample is found: Is it a concrete one? Yes. Happy end. No. Refine the abstraction and model-check again. O. Rezine () Verification Reading Group 25 / 33

26 Abstraction Refinement: We consider here only finite path counterexample. Let s recall SplitPATH algorithm: S := h 1 (ŝ 1 ) I j := 1 while ( S and j < n ) { j := j + 1; S prev := S S := Img(S, R) h 1 (ŝ j ) } if S then output counterexample // > Happy end. else output j,s prev // > Move to the refinement step. O. Rezine () Verification Reading Group 26 / 33

27 Abstraction Refinement: There exist i, such that S i h 1 (ŝ i ), Img(S i, R) h 1 (ŝ i+1 ) = ands i reachable from h 1 (ŝ 1 ) I We partition h 1 (ŝ i ) into three subsets: S i,0 = S i S i,1 = {s h 1 (ŝ i ) s h 1 (ŝ i+1 ).R(s, s )} Counterexample-Guided S i,x = h 1 (ŝ i )\(SAbstraction i,0 S i,1 ) Refinement 773 FIG. 6. An abstract counterexample. O. Rezine () Verification Reading Group 27 / 33

28 Abstraction Refinement: Abstraction defined by h 1 (ŝ) = E 1... E m, m being the number of variable clusters. We need to separate S i,o and S i,1 by refining our abstraction, i.e. refining the equivalence classes j, 1 j m. Objective: Maintain the smallest possible abstraction. Theorem The problem of finding the coarsest refinement is NP-hard. When S i,x =, the problem can be solved in polynomial time. O. Rezine () Verification Reading Group 28 / 33

29 Abstraction Refinement: Abstraction refining algorithm: for j := 1 to m { j := j for every a, b E j { if proj(s i,0, j, a) proj(s i,0, j, b) then j := j \{(a, b)} } } Where proj(s i,0, j, a) proj(s i,0, j, b) means that: (d 1,..., d j, d j+1,..., d m ) such that: (d 1,..., d j, a, d j+1,..., d m ) S i,0 (d 1,..., d j, b, d j+1,..., d m ) / S i,0 O. Rezine () Verification Reading Group 29 / 33

30 Abstraction Refinement: Abstraction refining algorithm: for j := 1 to m { j := j for every a, b E j { if proj(s i,0, j, a) proj(s i,0, j, b) then j := j \{(a, b)} } } Lemma When S i,x = the relation j computed by PolyRefine is an equivalence relation which refines j and separates S i.0 and S i,1. Furthermore, the equivalence relation j is the coarsest refinement of j O. Rezine () Verification Reading Group 30 / 33

31 Abstraction Refinement: Theorem Given a model M and an ACTL specification ϕ whose counterexample is either path or loop, CEGAR will find a model M such that M = ϕ M = ϕ O. Rezine () Verification Reading Group 31 / 33

32 Extensions and tools: CEGAR has been implemented in many tools such as Blast, Moped.. It has been also enriched with: Use of SAT Solvers instead of OBDD. Use of Inerpolants in order to refine the abstraction. Has been also applied for infinite state systems... O. Rezine () Verification Reading Group 32 / 33

33 Thanks for your attention. O. Rezine () Verification Reading Group 33 / 33