Symbolic Causality Checking Using Bounded Model Checking

Abstract

Abstract. In precursory work we have developed causality checking, a fault localization method for concurrent system models relying on the Halpern and Pearl counterfactual model of causation that identifies ordered occurrences of system events as being causal for the violation of non-reachability properties. Our first implementation of causality checking relies on explicit-state model checking. In this paper we propose a symbolic implementation of causality checking based on bounded model checking (BMC) and SAT solving. We show that this BMC-based implementation is efficient for large and complex system models. The technique is evaluated on industrial size models and experimentally compared to the existing explicit state causality checking implementation. BMC-based causality checking turns out to be superior to the explicit state variant in terms of runtime and memory consumption for very large system models.

Counterexample Simplification for Liveness Property Violation

“…In [11], the authors present a general approach for causality analysis of system failures based on component specifications and observed component traces. In [3], the authors choose the Halpern and Pearl model to define causality checking in order to localise errors in hardware systems by analysing counterexample traces. Our approach is complementary to causality analysis since it helps to detect any kind of bugs and not only those involving causality.…”

Debugging of Concurrent Systems Using Counterexample Analysis

“…Concurrency is explicitly taken into account in [3,4]. In [3], the authors choose the Halpern and Pearl model to define causality checking.…”

“…In [3], the authors choose the Halpern and Pearl model to define causality checking. In particular, they analyse traces of counterexamples generated by bounded model checking to localise errors in hardware systems.…”

“…The approach presented in [13] is able to analyse concurrent systems and to extract sequences of events for identifying bugs, thus representing one of the closest results to our work. Reasoning on traces as achieved in [3,4,13] induces several issues. The handling of looping behaviours is non-trivial and may result in the generation of infinite traces or of an infinite number of traces.…”

Counterfactual Causality from First Principles?

“…Symbolic approaches to causality checking have been proposed e.g. in [3] for Halpern and Pearl's actual causality and in [35,11] for fault ascription in real-time systems; except for [11] they rely on generating and analyzing bounded counterfactuals.…”