Abstraction in model checking Michael Huth Computing Imperial

Objectives of this lecture • motivate need for abstraction in model checking; • present unified theory of abstraction in model checking; • study main abstraction techniques as instances of this unified theory; and • formulate research challenges for abstraction in model checking.

Outline of this lecture • Present a unified framework for classifying and specifying abstraction-based model checking problems; • show that three key abstraction techniques are expressible in this framework; and • discuss research challenges for abstraction in model checking.

Model checking problem (MCP) A MCP is a tuple (M, F, Ans, |=) where • • M in M : class of models f in F : class of queries a in Ans : domain of answers to queries |= : M x F Ans, an evaluation function. Instances written in infix: (M |= f) in Ans.

Example: SMV as a MCP M = Kripke structures as SMV programs F = computation tree logic (CTL) formulas Ans = Bool = { ff < tt } -- a partial order (M |= f) specification of CTL semantics over Kripke structures.

SMV example initial state M p q p, q p (M |= AF¬p) = ff

Example: a probabilistic MCP // precondition: 0 <= x <= 2 [Monniaux’ 01] int a. Random. Update(x : int) { for (i = 0; i < 5; i++) { // coin-flip() returns 0 or 1 with probability 0. 5 x = x + coin_flip(); } return x; } // postcondition: x < 3 Seek: [r, s] = [worst, best]-case probability of (0 £ x £ 2) G(x < 3) along all paths.

Randomized algorithms as MCP • • M = class of Markov decision processes F = LTL formulas Ans = Idom = {[r, s] | 0 £ r £ s £ 1} (M |= f) equals [r, s] where r = worst-case (demonic) probability s = best-case (angelic) probability of M |=’ f, |=’ is standard LTL semantics.

A Markov decision process non-deterministic state x=0 0. 5 x=1 0. 5 (M |= ¬F(3 £ x)) = ? 0. 5 x=2 0. 5 3£x 0. 5 How do negation, demons, and angels interact? Infinite model is abstracted by four predicates.

An object model sig Class { -- in D. Jackson’s Alloy [Jackson’ 00] pub, priv : set Method, field : set Field } sig Object { type : Class, method : set Method, field : set Field } fact { all o : Object | o. method = o. type. (pub + priv) } fun Scenario(o 1, o 2 : Object) { -- consistency check some o 1. method && o 1. type != o 2. type } assert Safety{ -- validity check all o : Object | no o. method & o. type. pub & o. type. priv }

A consistent snapshot Snapshot of a state that satisfies the facts and the constraints in the function Scenario.

A counterexample Counterexample: a state satisfying the facts, but violating the assertion Safety.

Object models as a MCP • M = class of object models, e. g. UML • F = typed first-order logic with transitive closure • Ans = { ^ < ff, tt } = Bool^, a partial order • (M |= f) equals ff f inconsistent with M tt f valid in M (no counterexample) ^ f consistent in M (some snapshot) Each M denotes a set of implementations.

Why abstraction: decidability int Collatz(x : int) { // precondition: 1 £ x int c = x; while (c != 1) { if (c % 2 == 0) { c = c / 2; } else { c = 3*c + 1; } } } // postcondition : c = 1 Infinite Kripke structure M in c and x. Value of (M |= (1 £ x) AF(c = 1)) is unknown! Often, we can prove that infinite-state MCPs cannot be decided.

Why abstraction: complexity Computation of |= may have high complexity: • for Markov decision processes and LTL formulas, time-complexity of (M |= f) is exponential complete in | f | - polynomial in | M |; - doubly • for Kripke structures and CTL, SMV checks are linear in | f | and | M |; bad news if | M | grows too fast.

Why abstraction: environments • Open models: under-specified or abstracted interaction environment; • Some techniques for closing models: - using filters: replace LTL check (M |= f) with (M |= h f) [Dwyer & Schmidt’ 97] where h encodes interaction with an environment - synthesize source code from LTL abstraction of a driver [Pasareanu’ 00].

Why abstraction: composition Connecting interfaces of components makes global model more abstract through hiding (here: a and b) of internal computation: a? a! b! Pro 1 Sched d? b? b! g? b? Pro 2 Weak (bi)simulations in process algebras [Milner’ 89].

Why abstraction: specifications M is under-specified or uncertain M abstracts set of implementations; verification of a set of implementations; flexibility for implementor; e. g. • modal transition systems [Larsen & Thomsen’ 88] • checking partial systems [Bruns & Godefroid’ 99] • heap shape analysis of C programs [Sagiv et al. ’ 99] • CSP expressions and refinement checking [FDR’ 02] • quantitative mu-calculus [Morgan & Mc. Iver’ 02] etc.

A modal transition system One-or-more readers, one writer [HJS’ 02]: Exit_read Reads Exit_read write Sleeps Writes Exit_write Guaranteed transitions: Possible transitions: (set of implementations) Reads: some reader reads; Sleeps: no reads or writes. Writes: some write.

Why abstraction: Occam’s razor Whatever aspects of M, f, or |= are not needed for computing (M |= f) should be discarded. Software slicing, e. g. [Hatcliff et al. ’ 99]: • define set of program points C “of interest”; • C is the slicing criterion, e. g. determined by f; • compute points on which points in C depend; • compress the model accordingly.

Why abstraction: viewpoints [Jonsson & Larsen’ 91] probabilistic qualitative empty 1 1 1 deliver full cost error $1 deliver 1 - e e deliver full empty $1000 $1 full $1000 error

What to abstract? We want to abstract • models M to M’, e. g. bisimulation [Milner’ 89] or abstraction of an SMV program for M [Clarke et al. ’ 94]; • queries f to f’, e. g. approximating ATL* in ATL [Harding et al. ’ 02]; • answers a to a’, e. g. giving probabilistic models possibilistic interpretation [Clark et al. ’ 00].

How to abstract? MCP (M, F, Ans, |=) ? Abstract MCP (M’, F’, Ans’, |=’)

An abstraction signature a in M x M’ where (M, M’) in a means that model M’ abstracts M; • relation b in F x F’ where (f, f’) in b means that query f’ abstracts f; and • a function g : Ans’ Ans where g(a’) is the re-interpretation of answer a’ in Ans. How should g(M’|=’ f’) and (M |= f) relate in Ans?

Soundness as a guide #1 Suppose that the MCP and its abstract MCP are equal and Ans = Bool. If M’ abstracts M, we may want (M’ |= f) = tt (M |= f) = tt, i. e. certified verifications on abstractions apply to the abstracted model, too. If Bool = {ff < tt}, we may express this as g(M’ |= f) £ (M |= f) where g(a’) = a’ for all a’ in Ans.

Soundness as a guide #2 Consider the [r, s] semantics of [worst, best]-case probabilities for an LTL formula on a Markov decision process with Ans = Idom = {[r, s] | 0 £ r £ s £ 1}. If M’ abstracts M, we want g(M’|= f) = [r’, s’] £ [r, s] = (M |= f) where [r’, s’] £ [r, s] iff r’ £ r & s £ s’.

Abstract MCP (M’, F’, Ans’, |=’) abstracts (M, F, Ans, |=) iff there are • a in M x M’ -- model abstraction • b in F x F’ -- query abstraction • g : Ans’ Ans -- answer abstraction • and a partial order £ on Ans such that (ABS) (M, M’) in a, (f, f’) in b g(M’ |=’ f’) £ (M |= f)

Soundness encoded in order Let g be the identity, Ans = Bool in (ABS): • ff < tt: certified verifications in abstractions apply to un-abstracted model; • tt < ff: certified refutations in abstractions apply to un-abstracted model; • Intuitively, combined verification & refutation certificates require that ff and tt be incomparable, e. g. for objects models in first-order logic.

Surveying the literature Papers on abstraction typically focus on one aspect of abstraction at a time: • (bi)simulations, refinements a • thresholds, fixed-point unfolding b • bounded model checking |=’ • possibilistic abstraction Ans’ In any event, g and £ specify the meaning of Soundness in (ABS).

Query equivalence ~ Let (M, F, Ans, |=) be a MCP. For M, M’ in M define M ~ M’ iff (QE) lf: F. (M |= f) = lf: F. (M’ |= f). The query equivalence ~ on M induces an abstract MCP: a is ~ ; b = { (f , f ) | f in F }; and g(a’) = a’ for all a’ in Ans = Ans’.

Two non-equivalent models M 1 A a b A 1 d M 2 B a a d B 1’ b c [Milner’ 89] M 1 and M 2 are trace c equivalent, but A 3 not query equivalent: A 2 B 2 (M 1 |= [a]<b>tt) = tt B 3 (M 2 |= [a]<b>tt) = ff

Bisimulations Seek to replace M with a smaller or minimal M’ such that M is query-equivalent to M’: M ~ M’. Bisimulations [Park’ 81, Milner’ 89] • are a device for establishing instances of ~ • relate two models in an operational manner • lead to co-inductive reasoning principles • have typically efficient decision algorithms.

Labeled transition system (LTS) M = (S, i in S, Act, R in S x Act x S) • S set of states, Act set of actions • i initial state • (s, h, s’) in R means: action h can be chosen in state s and may result in state s’. Spin and LTSA programs: describe LTSs. Labeled transition systems (Spin and LTSA) and Kripke structures (SMV) inter-translate.

Two labeled transition systems M 1 A a b A 1 A 2 c d M 2 B a a d B 1’ b c [Milner’ 89] Trace equivalent, but A 3 distinguished by: B 2 B 3 [a]<b>tt

Bisimulations A bisimulation between labeled transition systems is a relation Q in S 1 x S 2 such that 1. (i 1, i 2) in Q -- relates initial states 2. whenever (s, s’) in Q then (s, h, t) in R 1 (s’, h, t’) in R 2 for some (t, t’) in Q (s’, h, t’) in R 2 (s, h, t) in R 1 for some (t, t’) in Q

A weak bisimulation example [Milner’ 89] b? C 1 a C 0 a a C 2 t D 1 D 0 b? a b? D 2 b? C 3 Redefine R: each transition is pre-/post-composed with finitely many consecutive silent actions t. Q = {(C 0, D 0), (C 1, D 1), (C 2, D 2), {(C 3, D 0)}

Coherence of weak bisimulation • redefining R by abstracting consecutive silent actions abstracts M into M’; • weak bisimulation in M “is” a bisimulation in M’; • for temporal logics, weak bisimulation is - potentially inconsistent with soundness of abstraction, e. g. [Graf & Sifakis’ 87]; - sometimes sound & complete for such a logic, e. g. [Desharnais et al. ’ 02].

Soundness and completeness Let (s, s’) in Q for a bisimulation Q. (M{s} is M with initial state s. ) • Soundness: prove by structural induction on f in F that M{s} ~ M{s’}, i. e. (QE) lf. (M{s} |= f) = lf. (M{s’} |= f), where F is your favourite modal logic. • Completeness: Whenever M{s} ~ M{s’}, is (s, s’) in Q for some bisimulation Q?

~ for labeled transition systems Let M be a class of labeled transition systems and F propositional modal logic f : : = p | ¬f | f & f | <a>f • bisimulation is sound & complete for ~ [Hennessy & Milner’ 85] • trace equivalence is unsound for ~ (see the previous example).

Three key abstraction techniques We now study three abstractions of the MCP for labeled transition systems: • universal a. U: renders certified verifications for “for all paths” properties; • existential a. E: renders certified verifications for “for some path” properties; • three-valued a. K: renders certified verification & refutation for all path properties.

Universal abstractions FU = { f | f = “for all paths, …” } • liveness: for all paths, eventually …” • safety: for all paths, globally …” MU = labeled transition systems over Act f : : = ff | tt | f&f | f | [h]f | AGhf | A[f. Uhf] |= standard labeled transition system semantics b. U = {(f , f) | f in F}, g(a’) = a’ Ans = Ans’ = {ff < tt}.

Universal a. U in MU x MU A labeled transition system M 2 universally abstracts a labeled transition system M 1, written (M 1, M 2) in a. U, if and only if $Q in S 1 x S 2 such that 1. (i 1, i 2) in Q 2. whenever (s, s’) in Q, then (s, h, t) in R 1 $(s’, h, t’) in R 2 : (t, t’) in Q.

Example 20 p s 0 tea i 1 -50 p s 1 i 2 10 p coffee -50 p s 2 t 0 10 p 20 p tea coffee t 1 Q = {(i 1, i 2), (s 0, t 1), (s 2, t 1), (s 1, t 0)} is a universal abstraction Q-1 is not: (t 1, s 2) in Q-1 and (t 1, 20 p, i 2) in R 2, but there is no 20 p transition out of s 2.

Path lemma • G “globally” : at every state on a path • f 1 Uf 2 “until” : f 1 holds until f 2 holds (and the latter will hold) on a path If (s, s’) in Q, Q universal abstraction, and (s, h 1, s 1)(s 1, h 2, s 2) … a path in M 1, then $path (s’, h 1, u 1)(u 1, h 2, u 2)…in M 2 such that (si, ui) in Q for all 1 £ i.

Soundness proof #1 (s, s’) in universal abstraction Q lf. (M{s’} |= f) £ lf. (M{s} |= f) for all f in FU where ff < tt. Structural induction on f; tt | ff, &, and || easy. • s’ |= [h]f; if (s, h, t) in R 1, then (s, s’) in Q (s’, h, t’) in R 2 for some (t, t’) in Q; but s’ |= [h]f t’ |= f; so (t, t’) in Q and induction t |= f; thus, s |= [h]f.

Soundness proof #2 • s’ |= AGhf : every h-path (s, h, s 1)(s 1, h, s 2)… has some h-path (s’, h, u 1)(u 1, h, u 2)… such that (si, ui) in Q for all 1 £ i. Thus, by induction f holds at s’ and all ui. s |= AGhf. • s’ |= A[f 1 Uhf 2] : similar reasoning.

Completeness of a. U QU = {(s, s’) | lf. (M{s’}|= f) £ lf. (M{s}|= f)} is the maximal universal abstraction (ignoring binding of initial states) if models are finitely branching: for all s in S and h in Act, the set {t | (s, h, t) in R} is finite. Finite branching: a compactness condition.

Completeness proof snippet Let (s, s’) in QU and (s, h, t) in R 1 such that every (s’, h, t’) in R 2 implies (t, t’) not in QU; then, for each t’ with (s’, h, t’) in R 2 there is some ft’ such that (M{t} |= ft’) < (M{t’} |= ft’); – Why? thus, (M{s’} |= [h] ||t’ ft’) = tt and (s, s’) in QU (M{s} |= [h] ||t’ ft’) = tt, a contradiction. – Why? Question: what if there is no (s’, h, t’) in R 2?

Unsoundness of a. U for $ 20 p s 0 tea i 1 -50 p s 1 i 2 10 p coffee -50 p s 2 t 0 10 p 20 p tea coffee Q = {(i 1, i 2), (s 0, t 1) , (s 2, t 1), (s 1, t 0) } is a universal abstraction, but (M{t 1} |= <10 p>tt) = tt (M{s 0} |= <10 p>tt) = ff. t 1

Left-total and right-total relation Given a labeled transition system M 1 over a state set S 1, we abstract M 1 to some M 2 with some state set S 2 via some left-total & right-total relation Q in S 1 x S 2: For all s in S 1, $t in S 2 such that (s, t) in Q. For all t in S 2, $s in S 1 such that (s, t) in Q. E. g. (s, t) in Q iff s is in the equivalence class t.

Specification of abstraction Given a labeled transition system M 1 over S 1 and a left-/right-total relation Q in S 1 x S 2 1. Choose some initial i 2 with (i 1, i 2) in Q 2. (s’, h, t’) in R 2 iff $(s, h, t) in R 1 : (s, s’), (t, t’) in Q Q is a universal abstraction by construction!

Example construction M 1 20 p s 0 tea i 1 -50 p s 1 i 2 10 p coffee M 2 -50 p s 2 t 0 10 p 20 p tea coffee t 1 S 1 = {i 1, s 0, s 1, s 2}, S 2 = {i 2, t 0, t 1}, Q = {(i 1, i 2), (s 0, t 1), (s 2, t 1), (s 1, t 0) } is left-total and right-total. The constructed abstraction of M 1 is M 2.

Assessment Universal abstractions have compositional specifications of abstractions sound & complete semantics for universal-path properties treatment of ¬ problematic: - meaning of abstract ff answers? - preservation of existential-path checks?

Existential abstractions FE = { f | f = “for some trace, …” } • liveness: for some traces, eventually …” • safety: for some traces, globally …” ME = labeled transition systems f : : = tt | ff | f&f | f | <h>f | E[f. Uhf] | EGhf |= standard labeled transtion system semantics b. E = {(f , f) | f in F}, g(a’) = a’, and Ans = Ans’ = {ff < tt}.

Existential a. E in ME x ME A labeled transition system M 2 existentially abstracts a labeled transition sytem M 1, written (M 1, M 2) in a. E, if and only if $Q in S 1 x S 2 such that 1. (i 1, i 2) in Q 2. (s, s’) in Q (s, h, t) in R 2 $(s’, h, t’) in R 1 : (t, t’) in Q.

Example 20 p s 0 tea i 1 -50 p s 1 i 2 10 p coffee -50 p s 2 t 0 10 p coffee t 1 Q = {(i 1, i 2), (s 0, t 1), (s 2, t 1), (s 1, t 0)} is an existential abstraction. Q-1 is not: (t 1, s 0) in Q-1 and (s 0, 20 p, i 1) in R 1, but there is no 20 p transition out of t 1.

Path lemma If (s, s’) in Q, Q existential abstraction, and (s’, h, u 1)(u 1, h, u 2) … a path in M 2, then $path (s, h, s 1)(s 1, h, s 2) in M 2 such that (si, ui) in Q for all 1 £ i.

Soundness proof #1 (s, s’) in existential abstraction Q (M{s’} |= f) £ (M{s} |= f) for all f in FE where ff < tt. The cases tt, ff, &, and || are clear. • s’ |= <h>f; thus, $(s’, h, t’) in R 2 : t’ |= f; then (s, s’) in Q (t, t’) in Q for some (s, h, t) in R 1; but then t’ |= f t |= f by induction; therefore, s |= <h>f.

Soundness proof #2 • s’ |= EGhf : every path (s’, h, u 1)(u 1, h, u 2) …has some path (s, h, s 1)(s 1, h, s 2) … such that (si, ui) in Q for all 1 £ i. Thus, by induction f holds at s and all si. s |= EGhf. • s’ |= E[f 1 Uhf 2] : similar reasoning.

Completeness of a. E QE = {(s, s’) | lf. (M{s’}|= f) £ lf. (M{s}|= f)} is the maximal existential abstraction (ignoring binding of initial states) if models are finitely branching: for all s in S, h in Act, the set {t | (s, h, t) in R} is finite.

Completeness proof snippet • let (s, s’) in QE and (s’, h, t’) in R 2 such that every (s, h, t) in R 1 implies (t, t’) not in QE; then, for each t with (s, h, t) in R 1 there is some ft such that (M{t} |= ft) < (M{t’} |= ft); thus, (M{s’} |= <h> &t ft) = tt and (t, t’) in QE (M{s} |= <h> &t ft) = tt, a contradiction. – Why?

Exercises 1. Unsoundness of a. E for : find (M 1, M 2) in a. E, 2. f in FU with (M 2 |= f) = tt, and (M 1 |= f) = ff. A 2. For the LTSs below, prove that there is no existential abstraction Q with (i 1, i 2) in Q: M 1 20 p s 0 M 2 i 1 -50 p tea 10 p 20 p -50 p 20 p 10 p s 1 tea i 2 s 2 t 0 tea t 1 tea 10 p t 2

Specifying abstractions Given a labeled transition system M 2 and a left-total & right-total relation Q in S 1 x S 2, construct M 1 with state set S 1 such that Q is an existential abstraction: (s’, h, t’) in R 1 iff $(s, h, t) in R 2 : (s, s’), (t, t’) in Q choose some i 2 with (i 1, i 2) in Q. Q is an existential abstraction by construction!

Example construction M 1 10 p s 0 i 1 -50 p s 1 coffee i 2 10 p coffee M 2 -50 p s 2 t 0 10 p coffee t 1 S 1 = {i 1, s 0, s 1, s 2}, S 2 = {i 2, t 0, t 1}, Q = {(i 1, i 2), (s 0, t 1), (s 2, t 1), (s 1, t 0) } is left-total and right-total. The constructed abstraction of M 2 is M 1.

Assessment Existential abstractions have compositional specifications of abstractions sound & complete for existential-path properties treatment of ¬ problematic: - meaning of abstract ff answers? - preservation of universal-path checks?

Comparing QU and QE S QU s’ s QE s R $ R t QU t’ t QE t’ Naïve combinaton of & renders bisimulations, handles ¬, but allows for no notion of refinement.

Three-valued models • A modal transition system [Larsen & Thomson’ 88] M is a pair (Ma, Mc) of LTSs with same initial state i such that Ra in Rc; • Ra models guaranteed transitions; • Rc models possible transitions; • “Ra in Rc” makes guarantees and possibilities consistent; and • Rc Ra is the under-specified aspect of the model.

A modal transition system One-or-more readers, one writer [HJS’ 02]: Exit_read Reads Exit_read R a: R c: write Sleeps Writes Exit_write (set of implementations) Reads: some reader reads; Sleeps: no reads or writes. Writes: some write.

Three-valued abstraction a. K A modal transition system M 2 abstracts a modal transition system M 1, written (M 1, M 2) in a. K, iff $Q in S 1 x S 2 such that 1. (i 1, i 2) in Q [Larsen’ 89] 2. (s, s’) in Q (a) (s’, h, t’) in R 2 a $(s, h, t) in R 2 a with (t, t’) in Q (b) (s, h, t) in R 1 c $(s’, h, t’) in R 1 c with (t, t’) in Q

Refinements The model below is abstracted by the modal transition system above by Q = {(s, s) | s in S}. read Reads Exit_read write Sleeps read Guaranteed transitions Ra: Possible transitions Rc: Writes Exit_write The relational inverse of a three-valued abstraction is a refinement.

Property logic Queries FK with unrestricted negation f : : = ff | ¬f | f & f | <h>f | m. Z. f where [h] = ¬<h>¬ and m. Z. f is a least fixed point, e. g. AFh p = m. Z. (p || [h]Z). |= : M x F Bool^ represented via |=a, |=c : M x F Bool, checking assertions and consistency (respectively), such that |= and |=a agree on tt answers, |= and |=c agree on ff answers.

Query semantics Let l in {a, c} range over the assertion and consistency mode, respectively. Then |=l is usual semantics of the modal mu-calculus, except for (s |=a ¬f iff not s |=c f) and (s |=c ¬f iff not s |=a f) [Kelb’ 94] s |=l <h>f iff $(s, h, t) in Rl with t |=l f. Exercise: specify the meaning of s |=l [h]f.

Example checks One-or-more readers, one writer [HJS’ 02]: er w er r Reads Sleeps r Writes ew Sleeps |=a ¬m Z. ¬<w><ew>¬Z s |=a ¬<w><r> at all states s s |=c <r><r><er><w> at all states s s |=a <r><r><er><w> at some state s?

Soundness and completeness Exercise: let (s, s’) in Q, where Q is a threevalued abstraction of two modal transition systems. Show for all f in FK, lf. (M{s’}|= f) £ lf. (M{s}|= f) where ^ < ff, tt in Bool^: 1. s’ |=a f s |=a f and 2. s |=c f s’ |=c f. Completeness holds if Ma and Mc are finitely-branching [Larsen’ 89, HJS’ 02].

Specification of abstraction Given a modal transition system M 1 over S 1 and a left-/right-total relation Q in S 1 x S 2 1. Choose some initial state i 2 with (i 1, i 2) in Q. 2. (s’, h, t’) in (R 2)a iff for all (s, s’) in Q, $(t, t’) in Q : (s, h, t) in (R 1)a 3. (s’, h, t’) in (R 2)c iff $(s, s’) in Q, $(t, t’) in Q : (s, h, t) in (R 1)c.

Infinite-state example [GHJ’ 02] S 1 = {s | s = [x i, y j, z k]} x, y, z integer variables; i, j, k integer values Transition labeled with program statements, e. g. (s, x = z, [x k, y j, z k]) in R S 2 = all DNFs (how many are there? ) over f 1 = odd(x), f 2 = (y > 0), and f 3 = (z < 0) (f 1 f 2 f 3 , x = z, ¬f 1 f 2 f 3) in (R 2)c (R 2)a (f 1 f 2 f 3, x = z, f 1 f 2 f 3 || ¬f 1 f 2 f 3) in (R 2)a

Reduction to two-valued checks • The three-valued MCP we presented can be abstracted into a MCP such that Ans’ = Bool x Bool; models and queries have a “complemented” copy of Act; and |= consists of two ordinary LTS checks. • Exercise: read [Bruns & Godefroid’ 00] and extract g, a, and b from it to specify this abstract MCP.

Exercise in query abstraction • Read [Reps et al. ’ 02] and discuss whether the results of loc. cit. induce an instance (ABS) of an abstract MCP. • Explain in what sense the abstract MCP of [Bruns & Godefroid’ 00] performs query abstractions.

Approximating semantics • |=c over-approximates & and |=a underapproximates || : if $(s, h, t) in Rc and there is no (s, h, t) in Ra, then Contradiction: we do have s |=c <h>tt & ¬<h>tt. Law of the excluded middle: we don’t have s |=c <h>tt || ¬<h>tt. How can one improve this precision?

Improving precision • An LTS is a modal transition system with Ma = Mc. • Strong semantics [Bruns & Godefroid’ 00] in a modal transition system: s |=str f iff t |=LTS f for all states t of an LTS, whenever s abstracts t in the sense of modal transition systems ( higher complexity). • abstraction model-checking for strong semantics: [Godefroid & Jagadeesan’ 02].

Property-driven precision Let P = (M, F, Ans, |=) such that P’ = (M’, F’, Ans’, |=’) abstracts P with some a, b, and g. For f in F, P’ is f-precise for P iff (PRE) M in M (M |= f) = / Mf Mf = { g(M’ |=’ f’) | (M, M’) in a, (f, f’) in b }. P’ is precise for P iff for all f in F : P’ is f-precise for P

MCP approximation problem (Ans, £) is a continuous domain [Abramsky & Jung’ 94] with a continuous distance function d : Ans x Ans R+; d(a, a) = 0. Given e > 0 and (PRE), find g(M’ |=’ f’) in Mf such that d(g(M’ |=’ f’) , (M |= f)) < e. E. g. d([r, s], [r’, s’]) = | r – r’| + |s – s’|. In practice, use (ABS) and a measurement m : Ans R+ such that m(g(M’ |=’ f’)) < e.

Example: finite-model property P = (M, F, Ans, |=), P’ = (M’, F’, Ans’, |=’), and M’ is the set of finite models of M; abstractions via a only. Refutation: tt < ff, m(ff) = 0, m(tt) = 1, e = 0. 5 m(g(M’ |=’ f’)) < e means that some finite model can refute the check. Exercise: define m for sound certification.

Diagnostics • Answers of MCPs require a “justification” that tools or humans may use as diagnostic evidence, e. g. Planning as a MCP; • SMV diagnostics: (path + possibly a loop); • diagnostics of abstract models can be spurious [Clarke et al. ’ 02, Giacobazzi & Quintarelli’ 01]; and • diagnostics for unrestricted queries are process-like, e. g. [Henzinger et al. ’ 00, Clarke et al. ’ 02].

Cost effectiveness Caveat: all the wonderful work on abstraction is of little use if • the cost of computing executable abstractions outweighs the savings over executing un-abstracted models; • there is no heuristic or other support that guides one in the choice of an abstraction: will this abstraction verify/refute the query?

Abandoning soundness There are good reasons for abandoning (ABS), the soundness of abstract MCPs: • testing [Godefroid’ 97, Pasareanu et al. ’ 01]; • probabilistic testing [Monniaux’ 01 a]; • lack of a finite-model property; • e-bisimulation and security [Di Pierro et al. ’ 02]; and • bounded model checking and efficiency.

Things we did not cover • Abstract interpretation [Cousot & Cousot ’ 77 and ’ 00], pioneered formal abstraction of systems! • game semantics and abstractions, e. g. [Henzinger et al. ’ 00]; • domain-theoretic semantics of abstraction for modal transition systems [HJS’ 02]; and • abstraction in software verification, e. g. [Cousot & Cousot’ 02].

Some research challenges • Query-driven computation of some M’ with (M, M’) in a; • use of answer domains for diagnostics (game semantics? ); • heuristics for revising M’ if abstract check is “uninformative”; • proof of property-driven precision for MCPs of practical impact; and • push of methods and results into quantitative model checking problems.

Conclusions • We presented a unified framework for specifying abstract MCPs. • We demonstrated the advantages of MCPs with under-specified (3 -valued) models. • We saw how 3 -valued MCPs judiciously connect established two-valued techniques. • We identified research issues and connections to ongoing work in software verification.

References • The slides of this talk can be downloaded from http: //www. doc. ic. ac. uk/~mrh/Sfm. ppt • The detailed references of papers cited in this talk can be downloaded from http: //www. doc. ic. ac. uk/~mrh/Sfm. pdf

Acknowledgments We gratefully acknowledge Patrice Godefroid, Radha Jagadeesan, and David Schmidt.