Explaining counterexamples using causality

Abstract

When a model does not satisfy a given specification, a counterexample is produced by the model checker to demonstrate the failure. A user must then examine the counterexample trace, in order to visually identify the failure that it demonstrates. If the trace is long, or the specification is complex, finding the failure in the trace becomes a non-trivial task. In this paper, we address the problem of analyzing a counterexample trace and highlighting the failure that it demonstrates. Using the notion of causality introduced by Halpern and Pearl, we formally define a set of causes for the failure of the specification on the given counterexample trace. These causes are marked as red dots and presented to the user as a visual explanation of the failure. We study the complexity of computing the exact set of causes, and provide a polynomial-time algorithm that approximates it. We then analyze the output of the algorithm and compare it to the one expected by the definition. The algorithm is implemented as a feature in the IBM formal verification platform RuleBase PE, where the visual explanations are an integral part of every counterexample trace. Our approach is inde-A preliminary version of the paper appeared in the proceedings of CAV 2009. Form Methods Syst Des (2012) 40:20-40 21 pendent of the tool that produced the counterexample, and can be applied as a light-weight external layer to any model checking tool, or used to explain simulation traces.

Responsibility Analysis by Abstract Interpretation

“…Other related papers include error diagnosis by abductive/backward inference [15], tracking down bugs by dynamic invariant detection [23]. Actual causality is applied to explain counterexamples from model checker [6] and estimate the coverage of specification [10]. Besides, there are researches on analyzing causes of specific security issues.…”

Explaining SDN Failures via Axiomatisations

“…The seminal work in [15] has been adopted in various settings. Closely related to the explanation of failures based on adoptions of [15] are the results in [3,20,7], for instance. All these works adjust the definition of causality in [15] to the setting of system executions leading to a failure.…”

“…All these works adjust the definition of causality in [15] to the setting of system executions leading to a failure. The approach in [3] considers one such execution at a time, and uses counterfactual causal reasoning for identifying the points in the trace that are relevant for the failure. The results in [20,7], on the other hand, aim at discovering the causal explanations for all failures in a system, and strongly rely on model-checking based techniques [2].…”

Debugging of Markov Decision Processes (MDPs) Models

“…Generating small and indicative counterexamples only is not enough for understanding the error. Therefore, in conventional model checking many works have addressed the analysis of counterexamples to better understand the failure [18], [23], [10]. As it was done in conventional model checking, addressing the error explanation in probabilistic model checking is highly required, especially that probabilistic counterexample consists of multiple paths instead of single path and it is probabilistic.…”