THETA: a Framework for Abstraction Refinement-Based Model Checking Tamás Tóth 1 , Ákos Hajdu 1,2 , András Vörös 1,2 , Zoltán Micskei 1 , István Majzik 1 1 Budapest University of Technology and Economics Department of Measurement and Information Systems 2 MTA-BME Lendület Cyber-Physical Systems Research Group FMCAD 2017, Vienna, Austria, 05.10.2017. Budapest University of Technology and Economics 1 THETA: a Framework for Abstraction Refinement-Based Model Checking Department of Measurement and Information Systems
Introduction Motivation: a framework for o Abstraction refinement-based algorithms o Easy development, evaluation and combination o Supporting various formalisms o Open source: github.com/FTSRG/theta Θ o Applicable where systems have different aspects (e.g. CPS) Our solution: Theta 2 THETA: a Framework for Abstraction Refinement-Based Model Checking
Theta – Characteristics Θ Generic Configurable Various kinds of Different algorithms formal models and strategies Modular Reusable and combinable modules 3 THETA: a Framework for Abstraction Refinement-Based Model Checking
Generic – Formalisms Symbolic transition systems I := x = 0 Ʌ y = 0 o Low level formalism T := x' = y + 1 Ʌ y’ = 2 * y o Based on SMT formulas Control flow automata x := 0 [x ≥ 5] o Programs as graphs x := x + 1 [x < 5] o Edges annotated with statements Timed automata o Clock variables t := 0 t ≤ 3 o Operations over clocks t > 3 Support for new formalisms o Reusable components, e.g. expressions 4 THETA: a Framework for Abstraction Refinement-Based Model Checking
Generic – Language frontends Symbolic transition systems [FORTE’16] o AIGER format o Intermediate language for PLCs Control flow automata [VPT’17] extern int nondet_int (); int main () { int a = nondet_int (); int b = nondet_int (); o Subset of C int c ; while ( a != 0 ) { c = a ; a = b % a ; o Size reduction techniques b = c ; } assert ( b != 0 ); } Timed automata [FORMATS’17] o UPPAAL XTA 5 THETA: a Framework for Abstraction Refinement-Based Model Checking
Modular – Architecture Formalisms and language front-ends AIGER PLC C programs UPPAAL XTA Transition systems Control flow automata Timed automata Verification back-end Abstract domain Abstraction refinement loop Interpreter ART Abstractor Refiner Init func. Transfer func. Action func. SMT solver interface 6 THETA: a Framework for Abstraction Refinement-Based Model Checking
Modular – Extensibility New algorithms Formalisms and language front-ends AIGER PLC C programs UPPAAL XTA Transition systems Control flow automata Timed automata Verification back-end Abstract domain Abstraction refinement loop Interpreter ART Abstractor Refiner Init func. Transfer func. Action func. SMT solver interface 7 THETA: a Framework for Abstraction Refinement-Based Model Checking
Modular – Extensibility New formalisms Formalisms and language front-ends ? AIGER PLC C programs UPPAAL XTA ? ? ? Transition systems Control flow automata Timed automata Verification back-end Abstract domain Abstraction refinement loop Interpreter ART Abstractor Refiner Init func. Transfer func. Action func. SMT solver interface 8 THETA: a Framework for Abstraction Refinement-Based Model Checking
Configurable – Parameters Abstract domain Refinement strategy Search strategy • Predicate • • Binary interp. forw. BFS • Explicit value • • Binary interp. backw. DFS • Zone • • Sequence interp. Dist. to error • Location • • Unsat core Random • Composition Initial precision Precision granularity Predicate split • • Global • Empty Atoms • • Local • Property-based Conjuncts • Whole 78 configs for control flow automata 52 configs for transition systems 15 configs for timed automata 9 THETA: a Framework for Abstraction Refinement-Based Model Checking
Configurable – Use Cases Developing and evaluating new algorithms o Extending predicate abstraction with explicit values [FORTE’16] o Lazy reachability checking of timed automata [FORMATS’17] Diverse results support configurability HWMCC & PLC [MiniSym’17] SV-COMP [VPT’17] UPPAAL [FORMATS’17] Comparison of execution time in case of different analysis configurations on various models 10 THETA: a Framework for Abstraction Refinement-Based Model Checking
Conclusions Theta: Model checking framework Formalisms and language front-ends AIGER PLC C programs UPPAAL XTA Transition systems Control flow automata Timed automata o Generic, modular, configurable Verification back-end Abstract domain Abstraction refinement loop o Various formalisms and frontends Interpreter Abstractor ART Refiner Init func. Transfer func. Action func. o Abstraction refinement algorithms SMT solver interface Current and future work extern int nondet_int (); int main () { int a = nondet_int (); o Extend the C frontend (LLVM) int b = nondet_int (); int c ; while ( a != 0 ) { c = a ; o Experiment with novel algorithms a = b % a ; b = c ; } assert ( b != 0 ); o Increase input models in experiments } o Automatic configuration selection → github.com/FTSRG/theta 11 THETA: a Framework for Abstraction Refinement-Based Model Checking
References [FORTE’ 16] A Configurable CEGAR Framework with Interpolation-based Refinements . Hajdu, Á .; Tóth , T.; Vörös , A.; and Majzik , I. In Formal Techniques for Distributed Objects, Components and Systems, vol. 9688 of LNCS, pages 158--174. Springer, 2016. [MiniSym’ 17] Exploratory Analysis of the Performance of a Configurable CEGAR Framework . Hajdu, Á .; and Micskei, Z. In Proceedings of the 24th PhD Mini-Symposium, pages 34--37, 2017. Budapest University of Technology and Economics, Department of Measurement and Information Systems [VPT’ 17] Towards Evaluating Size Reduction Techniques for Software Model Checking . Sallai, Gy.; Hajdu, Á .; Tóth , T.; and Micskei, Z. In Proceedings of the Fifth International Workshop on Verification and Program Transformation, vol. 253 of EPTCS, pages 75--91. Open Publishing Association, 2017. [FORMATS’ 17] Lazy Reachability Checking for Timed Automata using Interpolants . Tóth , T.; and Majzik, I. In Formal Modelling and Analysis of Timed Systems, vol. 10419 of LNCS, pages 264--280. Springer, 2017. 12 THETA: a Framework for Abstraction Refinement-Based Model Checking
Recommend
More recommend
