Extrapolation-Based Path Invariants for Abstraction Refinement of Fifo Systems

Abstract

Abstract. The technique of counterexample-guided abstraction refinement (Cegar) has been successfully applied in the areas of software and hardware verification. Automatic abstraction refinement is also desirable for the safety verification of complex infinite-state models. This paper investigates Cegar in the context of formal models of network protocols, in our case, the verification of fifo systems. Our main contribution is the introduction of extrapolation-based path invariants for abstraction refinement. We develop a range of algorithms that are based on this novel theoretical notion, and which are parametrized by different extrapolation operators. These are utilized as subroutines in the refinement step of our Cegar semi-algorithm that is based on recognizable partition abstractions. We give sufficient conditions for the termination of Cegar by constraining the extrapolation operator. Our empirical evaluation confirms the benefit of extrapolation-based path invariants.

Inferring models of concurrent systems from logs of their behavior with CSight

“…CSight relies on the McScM model checker [33,32], which represents a scalability bottleneck. Future work will use the more efficient Spin model checker [34].…”

McScM: A General Framework for the Verification of Communicating Machines

“…armc: the Abstract Regular Model Checking semi-algorithm [2] refines a global regular abstraction of the system by symbolic successor (or predecessor) calculation; we reimplemented the basic idea in our setting; cegar: Counterexample Guided Abstraction Refinement is a semi-algorithmic approach that allows to start with a rough, safety-conservative abstraction that is refined along spurious counterexamples [4]; McScM started originally by porting this approach to CM relying on a novel notion of path invariant based refinement [6]; the implemented generic algorithm allows for a variety of parameterization (in particular, path invariant generation methods); lart: we implemented the lazy abstraction approach [9] based on the construction of an abstract reachability tree; each vertex of the tree contains an abstract region, which may be refined with the help of path invariants when needed;…”

“…However, our armc implementation is not able to cope with a simple non-regular protocol. As cegar allows a variety of additional parameters to the algorithm, we can fill the two gaps in the table by changing the underlying path invariant generation A B P B R P c / d lo a d -b a la n c e r lo a d -b a la n c e r ( e r r ) n e s t e d c / d n o n -r e g u la r P e t e r s o n P O P 3 s e r v e r / 2 c li e n t s s li d in g w in d o w s ( s im p li fi e d ) T C P T C P ( e r r o r ) t o k e n r in g (e.g., -tc-engine apinv-fwd -k-min -1 leads to 13.48s/15.56M iB (BRP) and 5.67s/10.72M iB (server)); however, there is also no default parameterization for cegar that can be shown to be superior (see [6] for details).…”

“…McScM is programmed in OCaml and available under a BSD license. The development of McScM takes place in a software forge [14] that provides a wiki for documentation (including man pages and API), a bug and issue tracker, as well as our theoretical work [6,7]. The following discussion refers to McScM's release 1.2.…”

Global State Estimates for Distributed Systems

“…It also differs from the methodology described in [11] in the sense that in their framework, the authors try to infer from a distributed observation of a distributed system (modeled by a High Level Message Sequence Chart) the set of sequences that explains this observation. It is also different from model checking techniques [2,3,9,12] that proceed to a symbolic exploration of all the possible states of the system, without running it. We however use the same symbolic representation of queue contents as in [2,12].…”