SLAB: A Certifying Model Checker for Infinite-State Concurrent Systems

Abstract

Abstract. Systems and protocols combining concurrency and infinite state space occur quite often in practice, but are very difficult to verify automatically. At the same time, if the system is correct, it is desirable for a verifier to obtain not a simple "yes" answer, but some independently checkable certificate of correctness. We present SLAB -the first certifying model checker for infinite-state concurrent systems. The tool uses a procedure that interleaves automatic abstraction refinement using Craig interpolation with slicing, which removes irrelevant states and transitions from the abstraction. Given a transition system and a safety property to check, SLAB either finds a counterexample or produces a certificate of system correctness in the form of inductive verification diagram. Slicing AbstractionsSLAB (for sl icing abstractions) is an automatic certifying model checker that implements the abstraction refinement loop presented in [1]. It interleaves refinement steps with slicing, which tracks the dependencies between variables and transitions in a system and removes irrelevant parts.SLAB maintains an explicit graph representation of the abstract model: each node represents a set of concrete states, identified by a set of predicates; each edge represents a set of concrete transitions, identified by their transition relations.Starting with the initial abstraction, the abstract model is transformed by refinement and slicing steps until the system is proved correct or a concretizable error path is found.A refinement step increases the precision of the abstraction by introducing a new predicate, which is obtained by Craig interpolation from the unsatisfiable formula corresponding to some spurious error path. To minimize the increase in the size of the graph, the new predicate is only applied to one specific node on the error path. This node is split into two copies, the labels of which now additionally contain the new predicate and its negation, respectively.A slicing step reduces the size of the abstraction while maintaining all error paths. Elimination rules drop nodes and edges from the abstraction if they have

Inductive data flow graphs

“…The program is a challenge for many existing approaches. We ran experiments, for example, with the tool THREADER [16], which generates Owicki-Gries type proofs and rely-guarantee type proofs, and with the tool SLAB [11], which uses abstraction-refinement using Craig interpolation with slicing. In both tools, the space used for the proof grows exponentially in N .…”

“…As mentioned above, existing approaches to the algorithmic verification of concurrent programs, e.g. [10,11,16,19], provide a different angle of attack at the same fundamental issue: the exponential space complexity (exponential in the number of threads). None of these approaches shifts the burden of the exponential growth of space towards a combinatorial problem (over finite graphs).…”

“…The exponential cost of space is not an issue that occurs just in theory. We observe the exponential curve, e.g., when we run THREADER [16] and SLAB [11] on the ticket algorithm and the program Increment (see Section 2). These are two concurrent programs (parametrized in the number n of threads) where our approach comes with a formal guarantee for polynomial space consumption.…”

Automatic Verification of Real-Time Systems with Rich Data: An Overview

“…PEA are the stepping stone for further transformations into the input languages of verification engines developed in the project. These engines are the model checkers ARMC [35] and SLAB [11], and the tool H-PILoT [25] for dealing with complex data; they implement the paradigms of abstraction refinement and local theory extensions. The graphical tool Syspect realizes a tool chain from COD down to these verification engines [15].…”

Complete instantiation-based interpolation

“…Since then, interpolation-based algorithms have been developed for a number of problems in program analysis and verification [1,15,17,24,25,31,34,39]. An important requirement for most of these algorithms is that interpolants are ground (i.e., quantifier-free).…”