Automated Assume-Guarantee Reasoning for Simulation Conformance

Abstract

We address the issue of efficiently automating assume-guarantee reasoning for simulation conformance between finite state systems and specifications. We focus on a non-circular assume-guarantee proof rule, and show that there is a weakest assumption that can be represented canonically by a deterministic tree automata (DTA). We then present an algorithm L T that learns this DTA automatically in an incremental fashion, in time that is polynomial in the number of states in the equivalent minimal DTA. The algorithm assumes a teacher that can answer membership and candidate queries pertaining to the language of the unknown DTA. We show how the teacher can be implemented using a model checker. We have implemented this framework in the COMFORT toolkit and we report encouraging results (over an order of magnitude improvement in memory consumption) on non-trivial benchmarks. IntroductionFormal verification is an important tool in the hands of software practitioners for ascertaining correctness of safety critical software systems. However, scaling formal techniques like model checking [11] to concurrent software of industrial complexity remains an open challenge. The primary hurdle is the state-space explosion problem whereby the number of reachable states of a concurrent system increases exponentially with the number of components.Two paradigms hold the key to alleviating state-space explosion -abstraction [10,9] and compositional reasoning [23,8]. Both of these techniques have been extensively studied by the formal verification community and there have been significant breakthroughs from time to time. One of the most important advancements in the domain of compositional analysis is the concept of assume-guarantee [23] (AG) reasoning. The essential idea here is to model-check each component independently by making an assumption about its environment, and then discharge the assumption on the collection of the rest of the components. A variety of AG proof-rules are known, of which we will concern ourselves with the following non-circular rule called AG-NC:where M 1 M 2 is the concurrent system to be verified, S is the specification, and an appropriate notion of conformance between the system and the specification. AG-NC is known to be sound and complete for a number of conformance notions, including K.

Optimized L*-Based Assume-Guarantee Reasoning

“…A symbolic version of this framework has also been developed by Alur et al [10]. The use of learning for automated AG reasoning has also been investigated in the context of simulation checking [11] and deadlock detection [12]. The basic idea behind the automated AG reasoning paradigm is to learn an assumption [13], using L*, that satisfies the two premises of AG-NC.…”

Learning Meets Verification

“…Angluin's algorithm has been extended to deal with regular tree languages rather than word languages in [26,18]. Learning of strategies for games has been considered in [25].…”

“…In [18], the assume-guarantee reasoning for simulation conformance between finite state systems and specifications is considered. A non-circular assumeguarantee proof rule is considered, for which a weakest assumption can be represented canonically by a deterministic tree automaton (DTA).…”

Compositional Verification and 3-Valued Abstractions Join Forces

“…Recently, [12] followed by [5,10], considered automatic assumption generation for AG reasoning. They use learning algorithms for finite automata in order to automatically produce suitable assumptions for an AG rule.…”

“…The environment is then verified, in order to guarantee that it actually satisfies the assumption. Many of the works on compositional model checking are based on the AG paradigm and on learning [12,5,10] (see the related work section for more details). In contrast, our approach is based on techniques taken from the 3-valued game-based model checking for abstract models [26,18,19].…”