Abstraction for Falsification

Abstract

Abstract. Abstraction is traditionally used in the process of verification. There, an abstraction of a concrete system is sound if properties of the abstract system also hold in the concrete system. Specifically, if an abstract state a satisfies a property ψ then all the concrete states that correspond to a satisfy ψ too. Since the ideal goal of proving a system correct involves many obstacles, the primary use of formal methods nowadays is falsification. There, as in testing, the goal is to detect errors, rather than to prove correctness. In the falsification setting, we can say that an abstraction is sound if errors of the abstract system exist also in the concrete system. Specifically, if an abstract state a violates a property ψ, then there exists a concrete state that corresponds to a and violates ψ too. An abstraction that is sound for falsification need not be sound for verification. This suggests that existing frameworks for abstraction for verification may be too restrictive when used for falsification, and that a new framework is needed in order to take advantage of the weaker definition of soundness in the falsification setting. We present such a framework, show that it is indeed stronger (than other abstraction frameworks designed for verification), demonstrate that it can be made even stronger by parameterizing its transitions by predicates, and describe how it can be used for falsification of branching-time and linear-time temporal properties, as well as for generating testing goals for a concrete system by reasoning about its abstraction.

Model-Based Testing of a WAP Gateway: An Industrial Case-Study

“…That is, if v a = α(v), then the truth-value of t i < t j or t i ≤ t j is the same for the corresponding abstract TIDs a i and a j . It can be shown that the abstract transition relation is must abstraction and thus underapproximates the concrete transition relation [LT88,BKY05].…”

Better Under-Approximation of Programs by Hiding Variables

“…Also, when X = ∅, we have that [c] X = D V . Accordingly, the values T ∅ and F ∅ coincide with the existential T ∃ and F ∃ values from the six-valued semantics studied in [BKY05]. Finally, it is interesting to note that the semantics is monotonic, in the sense that if [a |= θ] T X and X ⊆ X, then [a |= θ] T X .…”

“…Finally, it is interesting to note that the semantics is monotonic, in the sense that if [a |= θ] T X and X ⊆ X, then [a |= θ] T X . Thus, our semantics is a natural refinement of the existential semantics in [BKY05].…”

“…In the above example, there is a must − transition from (x > 8) to (x > 6). Like must transitions (let us refer to them in the sequel as must + transitions), must − transitions are closed under transitivity, and as argued in [Bal04,BKY05], they are often useful in cases must + transitions do not exist.…”

State Focusing: Lazy Abstraction for the Mu-Calculus

“…-Improved simplifications of the underlying configuration structure are made by using a 9-valued logic, which is an extension of the 6-valued one used in [3]. -A separation of the refinement determination from the model checking is made,…”