Skip to content

Commit

Permalink
First tests completed about clock predicate abstraction
Browse files Browse the repository at this point in the history
  • Loading branch information
kopero2000 committed Oct 31, 2023
1 parent d308fc2 commit 3dc717f
Show file tree
Hide file tree
Showing 54 changed files with 1,896 additions and 353 deletions.
30 changes: 15 additions & 15 deletions doc/CEGAR-algorithms.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ This document gives a brief introduction to the possible configuration options o

> "[Counterexample-Guided Abstraction Refinement](https://link.springer.com/chapter/10.1007/10722167_15) (CEGAR) is a widely used technique for the automated formal verification of different systems, including both software and hardware.
CEGAR works by iteratively constructing and refining abstractions until a proper precision is reached.
It starts with computing an abstraction of the system with respect to some abstract domain and a given initial -- usually coarse -- precision.
It starts with computing an abstraction of the system with respect to some abstract dataDomain and a given initial -- usually coarse -- precision.
The abstraction [over-approximates](https://dl.acm.org/doi/10.1145/186025.186051) the possible behaviors (i.e., the state space) of the original system.
Thus, if no erroneous behavior can be found in the abstract state space then the original system is also safe.
However, abstract counterexamples corresponding to erroneous behaviors must be checked whether they are reproducible (feasible) in the original system.
Expand All @@ -28,18 +28,18 @@ Quoted from [Á. Hajdu and Z. Micskei - Efficient Strategies for CEGAR-Based Mod
Note that not all options might be available in all tools.
The available options, along with their default values are presented in the help screen (`--help`) of each tool.

### `--domain`
### `--dataDomain`

The domain controls the abstract information that is being tracked about the system.
The dataDomain controls the abstract information that is being tracked about the system.

* `PRED_CART`: [Cartesian predicate abstraction](https://link.springer.com/article/10.1007/s10009-002-0095-0) keeps track of conjunctions of logical predicates (e.g., `x > 5 and y = x`) instead of concrete values.
* `PRED_BOOL`: [Boolean predicate abstraction](https://link.springer.com/article/10.1007/s10009-002-0095-0) keeps track of arbitrary Boolean combination of predicates.
* `PRED_SPLIT`: Boolean predicate abstraction, but states are [split]((https://link.springer.com/content/pdf/10.1007%2Fs10817-019-09535-x.pdf)) into sub-states along disjunctions.
* `EXPL`: [Explicit-value abstraction]((https://link.springer.com/chapter/10.1007/978-3-642-37057-1_11)) keeps track of concrete values, but only for a (continuously expanded) set of variables.
* `EXPL_PRED_CART`, `EXPL_PRED_SPLIT`, `EXPL_PRED_BOOL` and `EXPL_PRED_COMBINED`: Product abstraction domains, available for XSTS models. The set of control variables (marked with `ctrl`) are tracked explicitly while others are tracked by predicates (using the corresponding predicate domain). Variables can automatically be switched from predicate tracking to explicit tracking depending on the `--autoexpl` option (see below).
* `EXPL_PRED_CART`, `EXPL_PRED_SPLIT`, `EXPL_PRED_BOOL` and `EXPL_PRED_COMBINED`: Product abstraction domains, available for XSTS models. The set of control variables (marked with `ctrl`) are tracked explicitly while others are tracked by predicates (using the corresponding predicate dataDomain). Variables can automatically be switched from predicate tracking to explicit tracking depending on the `--autoexpl` option (see below).

Predicate abstraction (`PRED_*`) tracks logical formulas instead of concrete values of variables, which can be efficient for variables with large (or infinite) domain.
Explicit-values (`EXPL`) keep track of a subset of system variables, which can be efficient if variables are mostly deterministic or have a small domain.
Predicate abstraction (`PRED_*`) tracks logical formulas instead of concrete values of variables, which can be efficient for variables with large (or infinite) dataDomain.
Explicit-values (`EXPL`) keep track of a subset of system variables, which can be efficient if variables are mostly deterministic or have a small dataDomain.
Cartesian predicate abstraction only uses conjunctions (more efficient) while Boolean allows arbitrary formulas (more expressive).
Boolean predicate abstraction often gives predicates in a disjunctive normal form (DNF).
In `PRED_BOOL` this DNF formula is treated as a single state, while in `PRED_SPLIT` each operand of the disjunction is a separate state.
Expand All @@ -54,10 +54,10 @@ More information on the abstract domains can be found in Section 2.2.1 and 3.1.3
Controls the initial precision of the abstraction (e.g., what predicates or variables are tracked initially).

* `EMPTY`: Start with an empty initial precision.
* `ALLVARS`: Tracks all variables from the beginning. Available for CFA and XSTS if `--domain` is `EXPL`.
* `ALLASSUMES`: Track all assumptions by default (e.g., branch/loop conditions). Only applicable for CFA and if `--domain` is `PRED_*`.
* `PROP`: Available for XSTS. Tracks variables from the property if `--domain` is `EXPL` and predicates from the property if `--domain` is `PRED_*`.
* `CTRL`: Available for XSTS if `--domain` is `EXPL` or `EXPL_PRED_*`. Tracks all control variables.
* `ALLVARS`: Tracks all variables from the beginning. Available for CFA and XSTS if `--dataDomain` is `EXPL`.
* `ALLASSUMES`: Track all assumptions by default (e.g., branch/loop conditions). Only applicable for CFA and if `--dataDomain` is `PRED_*`.
* `PROP`: Available for XSTS. Tracks variables from the property if `--dataDomain` is `EXPL` and predicates from the property if `--dataDomain` is `PRED_*`.
* `CTRL`: Available for XSTS if `--dataDomain` is `EXPL` or `EXPL_PRED_*`. Tracks all control variables.

We observed that usually the `EMPTY` initial precision yields good performance: the algorithm can automatically determine the precision.
However, if the system is mostly deterministic, it might be suitable to track all variables from the beginning.
Expand All @@ -84,14 +84,14 @@ Available for CFA, determines the [points where abstraction is applied](https://
### `--maxenum`

Available for CFA and XSTS.
Maximal number of states to be enumerated when performing explicit-value analysis (`--domain EXPL`) and an expression cannot be deterministically evaluated.
Maximal number of states to be enumerated when performing explicit-value analysis (`--dataDomain EXPL`) and an expression cannot be deterministically evaluated.
If the limit is exceeded, unknown values are propagated.
As a special case, `0` stands for infinite, but it should only be used if the model does not have any variable with unbounded domain (or that variable is deterministically assigned).
As a special case, `0` stands for infinite, but it should only be used if the model does not have any variable with unbounded dataDomain (or that variable is deterministically assigned).
In general, values between `5` to `50` perform well (see Section 3.1.1 of [our JAR paper](https://link.springer.com/content/pdf/10.1007%2Fs10817-019-09535-x.pdf) for more information).

### `--autoexpl`

Automatic predicate-to-explicit switching strategy. Available for XSTS, when used an `EXPL_PRED_*` domain. The goal of these options is to automatically detect when many values of a variable are enumerated in order to unroll a loop.
Automatic predicate-to-explicit switching strategy. Available for XSTS, when used an `EXPL_PRED_*` dataDomain. The goal of these options is to automatically detect when many values of a variable are enumerated in order to unroll a loop.
* `STATIC`: No automatic switching
* `NEWATOMS`: A variable is switched to explicit tracking when it appears in an atom that isn't present in the model.
* `NEWOPERANDS`: A variable is switched to explicit tracking when it appears in an expression with an operand that it doesn't appear with in the model.
Expand All @@ -104,7 +104,7 @@ Strategy for refining the precision of the abstraction, i.e., inferring new pred
* `BW_BIN_ITP`: Backward binary interpolation (see Section 3.2.1 of [our JAR paper](https://link.springer.com/content/pdf/10.1007%2Fs10817-019-09535-x.pdf) for more information). Searches backwards for the first state where the counterexample becomes infeasible starting from the target state.
* `SEQ_ITP`: Sequence interpolation.
* `MULTI_SEQ`: Sequence interpolation with multiple counterexamples (see Section 3.2.2 of [our JAR paper](https://link.springer.com/content/pdf/10.1007%2Fs10817-019-09535-x.pdf) for more information). Can be useful for models with high cyclomatic complexity to converge faster.
* `UNSAT_CORE`: Extract variables to be tracked from an unsat core, only available if `--domain` is `EXPL`.
* `UNSAT_CORE`: Extract variables to be tracked from an unsat core, only available if `--dataDomain` is `EXPL`.
* `UCB`: Extracts predicates or variables using weakest preconditions and unsat cores ([see paper](https://link.springer.com/chapter/10.1007%2F978-3-319-26287-1_10) for more information). _Experimental feature._ Available for CFA.
* `NWT_*`: Newton-style refinement. _Experimental feature._ Available for CFA. The following variants are supported ([see paper](https://dl.acm.org/doi/10.1145/3106237.3106307) for more information):
* `NWT_SP` and `NWT_WP` only works for really simple inputs,
Expand All @@ -120,7 +120,7 @@ Floating point support *(known experimental problems)*:

### `--predsplit`

Available if `--domain` is `PRED_*`.
Available if `--dataDomain` is `PRED_*`.
Determines whether splitting is applied to new predicates that are obtained during refinement.
* `WHOLE`: Keep predicates as a whole, no splitting is applied. Can perform well if the model has many Boolean variables.
* `CONJUNCTS`: Split predicates into conjuncts.
Expand Down
10 changes: 5 additions & 5 deletions doc/Portfolio.md
Original file line number Diff line number Diff line change
Expand Up @@ -15,11 +15,11 @@ Usage of the portfolio simply happens by using the `--portfolio` flag with a par

The complex portfolio has a global timeout of approximately 900 seconds.

"Based on preliminary experiments and domain knowledge, we manually constructed a dynamic algorithm selection portfolio for SV-COMP'22, illustrated by Figure.
"Based on preliminary experiments and dataDomain knowledge, we manually constructed a dynamic algorithm selection portfolio for SV-COMP'22, illustrated by Figure.
Rounded white boxes correspond to decision points.
We start by branching on the arithmetic (floats, bitvectors, integers).
Under integers, there are further decision points based on the cyclomatic complexity and the number of havocs and variables.
Grey boxes represent configurations, defining the *solver\domain\refinement* in this order.
Grey boxes represent configurations, defining the *solver\dataDomain\refinement* in this order.
Lighter and darker grey represents explicit and predicate domains respectively.
Internal timeouts are written below the boxes.
An unspecified timeout means that the configuration can use all the remaining time.
Expand All @@ -42,9 +42,9 @@ The configurations are:
3. A Newtonian analysis (mainly to handle bitvector arithmetics as well)

The precise parameters of these configurations:
1. `domain EXPL –initprec EMPTY –search ERR –encodingLBE –refinement SEQ_ITP –maxenum 1 –precgranularityGLOBAL –prunestrategy LAZY`
2. `domain PRED_CART –initprec EMPTY –search ERR–encoding LBE –refinement BW_BIN_ITP –predsplitWHOLE –precgranularity GLOBAL –prunestrategy LAZY`
3. `domain EXPL –initprec EMPTY –search ERR –encoding LBE –refinement NWT_IT_WP –maxenum1 –precgranularity GLOBAL –prunestrategy LAZY`
1. `dataDomain EXPL –initprec EMPTY –search ERR –encodingLBE –refinement SEQ_ITP –maxenum 1 –precgranularityGLOBAL –prunestrategy LAZY`
2. `dataDomain PRED_CART –initprec EMPTY –search ERR–encoding LBE –refinement BW_BIN_ITP –predsplitWHOLE –precgranularity GLOBAL –prunestrategy LAZY`
3. `dataDomain EXPL –initprec EMPTY –search ERR –encoding LBE –refinement NWT_IT_WP –maxenum1 –precgranularity GLOBAL –prunestrategy LAZY`

### Adding further portfolios
To create a new concrete portfolio, create a subclass of the `hu.bme.mit.theta.xcfa.analysis.portfolio.common.AbstractPortfolio` class and implement its abstract method `executeAnalysis`. The `AbstractPortfolio` class serves as a utility, in which the execution of any given configuration with a time limit on a separate thread is already implemented in the method `executeConfiguration`.
Expand Down
2 changes: 1 addition & 1 deletion subprojects/cfa/cfa-analysis/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,5 +5,5 @@ This project contains analysis modules related to the Control Flow Automata (CFA
### Related projects

* [`analysis`](../../common/analysis/README.md): Common analysis modules.
* [`cfa`](../cfa/README.md): Classes to represent CFAs and a domain specific language (DSL) to parse CFAs from a textual representation.
* [`cfa`](../cfa/README.md): Classes to represent CFAs and a dataDomain specific language (DSL) to parse CFAs from a textual representation.
* [`cfa-cli`](../cfa-cli/README.md): An executable tool (command line) for running analyses on CFAs.
2 changes: 1 addition & 1 deletion subprojects/cfa/cfa-cli/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ For more information about the CFA formalism and its supported language elements

### Related projects

* [`cfa`](../cfa/README.md): Classes to represent CFAs and a domain specific language (DSL) to parse CFAs from a textual representation.
* [`cfa`](../cfa/README.md): Classes to represent CFAs and a dataDomain specific language (DSL) to parse CFAs from a textual representation.
* [`cfa-analysis`](../cfa-analysis/README.md): CFA specific analysis modules enabling the algorithms to operate on them.

### Frontends
Expand Down
2 changes: 1 addition & 1 deletion subprojects/cfa/cfa/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
This project contains the Control Flow Automata (CFA) formalism. Its main purpose is to describe programs as a graphs, where nodes correspond to program locations and edges are annotated with program statements.
The project contains:
* Classes to represent CFAs.
* A domain specific language (DSL) to parse CFAs from a textual representation.
* A dataDomain specific language (DSL) to parse CFAs from a textual representation.

### Related projects

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
import static hu.bme.mit.theta.core.type.booltype.BoolExprs.True;

import java.util.ArrayList;
import java.util.Collections;
import java.util.Iterator;
import java.util.List;
import java.util.stream.Stream;
Expand Down Expand Up @@ -55,6 +56,11 @@ private ItpRefutation(final List<Expr<BoolType>> itpSequence) {
assert 0 <= this.pruneIndex && this.pruneIndex < itpSequence.size();
}

private ItpRefutation() {
itpSequence = Collections.emptyList();
pruneIndex = -1;
}

public static ItpRefutation sequence(final List<Expr<BoolType>> itpSequence) {
return new ItpRefutation(itpSequence);
}
Expand Down Expand Up @@ -115,4 +121,8 @@ public VarsRefutation toVarSetsRefutation() {
}
return VarsRefutation.create(builder.build());
}

public static ItpRefutation emptyRefutation(){
return new ItpRefutation();
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
package hu.bme.mit.theta.analysis.expr.refinement;

public class Prod2Refutation <R1 extends Refutation, R2 extends Refutation>implements Refutation{

final private R1 refutation1;
final private R2 refutation2;

public Prod2Refutation(R1 refutation1, R2 refutation2) {
this.refutation1 = refutation1;
this.refutation2 = refutation2;
}

public R1 getRefutation1() {
return refutation1;
}

public R2 getRefutation2() {
return refutation2;
}

@Override
public int getPruneIndex() {
if(refutation1.getPruneIndex() < 0) return refutation2.getPruneIndex();
if(refutation2.getPruneIndex() < 0) return refutation1.getPruneIndex();
return refutation1.getPruneIndex() > refutation2.getPruneIndex() ? refutation2.getPruneIndex() : refutation1.getPruneIndex();
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -16,5 +16,8 @@
package hu.bme.mit.theta.analysis.expr.refinement;

public interface Refutation {

int getPruneIndex();


}
Original file line number Diff line number Diff line change
@@ -0,0 +1,61 @@
package hu.bme.mit.theta.analysis.expr.refinement;

import com.google.common.collect.ImmutableList;
import hu.bme.mit.theta.analysis.zone.DBM;
import hu.bme.mit.theta.analysis.zone.ZoneState;
import hu.bme.mit.theta.core.decl.VarDecl;
import hu.bme.mit.theta.core.type.rattype.RatType;

import java.util.ArrayList;
import java.util.Collections;
import java.util.List;

public class ZoneRefutation implements Refutation{

private final int pruneIndex;
private final List<ZoneState> zoneSequence;
private final List<VarDecl<RatType>> clocks;


private ZoneRefutation(){
pruneIndex = -1;
zoneSequence = Collections.emptyList();
clocks = Collections.emptyList();
}
private ZoneRefutation(int prunIndex, List<ZoneState> zoneSequence, List<VarDecl<RatType>> clocks) {
this.pruneIndex = prunIndex;
this.zoneSequence= ImmutableList.copyOf(zoneSequence);
this.clocks = clocks;
}

public static ZoneRefutation binary(final int pruneIndex, final ZoneState itpZone, List<VarDecl<RatType>> clocks, final int statecount)
{
final List<ZoneState> zoneSequence = new ArrayList<>();
for (int i = 0; i < statecount; i ++){
if(i < pruneIndex) {
zoneSequence.add(ZoneState.top());
}
else if( i == pruneIndex){
zoneSequence.add(itpZone);
}
else zoneSequence.add(ZoneState.bottom());
}
return new ZoneRefutation(pruneIndex, zoneSequence, clocks);
}
@Override
public int getPruneIndex() {
return this.pruneIndex;
}

public ZoneState get(int index){
return zoneSequence.get(index);
}

public List<VarDecl<RatType>> getClocks() {
return clocks;
}

public static ZoneRefutation emptyRefutation(){
return new ZoneRefutation();
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -123,7 +123,6 @@ public void up() {
assert isClosed();
}
}
//TODO miért?
public void down() {
if (isConsistent()) {
for (int i = 1; i <= nClocks; i++) {
Expand Down
Loading

0 comments on commit 3dc717f

Please sign in to comment.