Abstraction Refinement for Emptiness Checking of Alternating Data Automata

Radu Iosif,Xiao Xu

doi:10.1007/978-3-319-89963-3_6

Radu Iosif, Xiao Xu

Open Access

https://doi.org/10.1007/978-3-319-89963-3_6

Copy DOI

Abstract

Alternating automata have been widely used to model and verify systems that handle data from finite domains, such as communication protocols or hardware. The main advantage of the alternating model of computation is that complementation is possible in linear time, thus allowing to concisely encode trace inclusion problems that occur often in verification. In this paper we consider alternating automata over infinite alphabets, whose transition rules are formulae in a combined theory of Booleans and some infinite data domain, that relate past and current values of the data variables. The data theory is not fixed, but rather it is a parameter of the class. We show that union, intersection and complementation are possible in linear time in this model and, though the emptiness problem is undecidable, we provide two efficient semi-algorithms, inspired by two state-of-the-art abstraction refinement model checking methods: lazy predicate abstraction [8] and the Impact semi-algorithm [17]. We have implemented both methods and report the results of an experimental comparison.

Highlights

The language inclusion problem is recognized as being central to verification of hardware, communication protocols and software systems
A property is a specification of the correct executions of a system, given as a set P of executions, and the verification problem asks if the set S of executions of the system under consideration is contained within P. This problem is at the core of widespread verification techniques, such as automata-theoretic model checking [23], where systems are specified as finite-state automata and properties defined using Linear Temporal Logic [21]. The bottleneck of this and other related verification techniques is the intractability of language inclusion (PSPACE-complete for finite-state automata over finite alphabets)
For automata over finite alphabets, the language inclusion problem can be encoded as the emptiness problem of an alternating automaton of linear size

Summary

Introduction

The language inclusion problem is recognized as being central to verification of hardware, communication protocols and software systems. When considering infinite data as part of the input alphabet, language inclusion is undecidable and, even complementation becomes impossible, for instance, for timed automata [1] or finite-memory register automata [13]. One can recover theoretical decidability, by restricting the number of variables (clocks) in timed automata to one [20], or forbidding relations between current and past/future values, as with symbolic automata [24] In such cases, the emptiness problem for the alternating versions becomes decidable [4,14]. Emptiness is undecidable in our case, mainly because counting (incrementing and comparing to a constant) data values is allowed, in many data theories Another related model is that of predicate automata [6], which recognize languages over integer data by labeling the words with conjunctions of uninterpreted predicates. We believe that the lazy annotation techniques for Horn clauses are suited for branching computations, which we intend to consider in a future tree automata setting

Preliminaries

Alternating Data Automata

Boolean Closure

Antichains and Interpolants for Emptiness

Lazy Predicate Abstraction for ADA Emptiness

Checking ADA Emptiness with Impact

Findings

Experimental Evaluation