Symmetry Reduction for B by Permutation Flooding

Abstract

Abstract. Symmetry reduction is an established method for limiting the amount of states that have to be checked during exhaustive model checking. The idea is to only verify a single representative of every class of symmetric states. However, computing this representative can be nontrivial, especially for a language such as B with its involved data structures and operations. In this paper, we propose an alternate approach, called permutation flooding. It works by computing permutations of newly encountered states, and adding them to the state space. This turns out to be relatively unproblematic for B's data structures and we have implemented the algorithm inside the ProB model checker. Empirical results confirm that this approach is effective in practice; speedups exceed an order of magnitude in some cases. The paper also contains correctness results of permutation flooding, which should also be applicable for classical symmetry reduction in B.

A Refinement-Based Correctness Proof of Symmetry Reduced Model Checking

“…Through this machine, we also show that our original work in symmetry reduction [6] is sound with respect to the abstract specification of model checking. In this particular strategy, called permutation flooding, each unexplored state encountered is first checked against the invariant.…”

“…That is, if standard model checking exhausts its search space without finding an error, called a counterexample, then it must be guaranteed that symmetry reduced checking exhausts its constrained search space without finding a counterexample. In [6], we sketched a proof that shows this. In this paper, we go a step further and present a complete B development that shows the soundness of our methods through B refinement.…”

“…Previously, we have focused on addressing the state space explosion challenge that faces model checking [6,7,8]. This is where a linear increase in the size of a specification leads to a combinatorial increase in the number of states that the model checker must explore.…”

“…The impact is that checking large specifications becomes intractable. Our work relied on the identification of symmetric states that satisfy the same predicates [6,Theorem 1], and the implementation of an augmented model checking algorithm in ProB that checks only one state from each symmetry class. Experimental results were encouraging and have been shown to reduce the time of model checking by up to three orders of magnitude, e.g., [8].…”

“…Section 4 provides a refinement machine whose behaviour closely models standard model checking in ProB. Next, the refinement in Section 5.1 adheres to our style of symmetry reduction implemented in [6], and Section 5.2 gives a refinement that matches our symmetry reduction strategy used in [7,8]. Finally, we provide a discussion of our work in Section 6.…”