ProB gets Nauty: Effective Symmetry Reduction for B and Z Models

Abstract

Symmetry reduction holds great promise to counter the state explosion problem. However, currently it is "conducting a life on the fringe", and is not widely applied, mainly due to the restricted applicability of many of the techniques. In this paper we propose a symmetry reduction technique applied to high-level formal specification languages (B and Z). Not only does symmetry arise naturally in most models, it can also be exploited without restriction by our method. This method translates states of a formal model into directed graphs, and then uses graph canonicalisation to detect symmetries. We use the tool NAUTY to efficiently perform graph canonicalisation, which we have interfaced with the model checker PROB.In this paper we present the general technique, show how states can be translated first into vertex-coloured graphs suitable for NAUTY. We present empirical results, showing the effectiveness of our method as well as analysing the cost of graph canonicalisation.

A Refinement-Based Correctness Proof of Symmetry Reduced Model Checking

“…Our work relied on the identification of symmetric states that satisfy the same predicates [6,Theorem 1], and the implementation of an augmented model checking algorithm in ProB that checks only one state from each symmetry class. Experimental results were encouraging and have been shown to reduce the time of model checking by up to three orders of magnitude, e.g., [8]. Moreover, these techniques have been integrated into the final version of the tool.…”

“…We note that the style of state space traversal specified contrasts with that of rmc1 and instead reflects more closely a classical symmetry reduction algorithm, which we used in [7,8]. Therefore, upon encountering an unexplored state (e.g., s1 in add inv ), we compute and store only the unique representatives of its successors that have not yet been checked (rep(s2)); the model checking algorithm will never store two symmetric states, and it has less of a demand for memory.…”

“…From here, two separate two chains of refinement specify details of algorithms that implement the standard and reduced approaches. The refinement branch for the reduced approach includes rmc1, which reflects the style of model checking we adopted in [6], and rmc2, that reflects the style we used in [7] and [8]. Given that both chains refine the abstract specification, we obtain our desired soundness result.…”

“…Previously, we have focused on addressing the state space explosion challenge that faces model checking [6,7,8]. This is where a linear increase in the size of a specification leads to a combinatorial increase in the number of states that the model checker must explore.…”

“…Section 4 provides a refinement machine whose behaviour closely models standard model checking in ProB. Next, the refinement in Section 5.1 adheres to our style of symmetry reduction implemented in [6], and Section 5.2 gives a refinement that matches our symmetry reduction strategy used in [7,8]. Finally, we provide a discussion of our work in Section 6.…”