Abstraction refinement and antichains for trace inclusion of infinite state systems

Abstract

A generic register automaton is a finite automaton equipped with variables (which may be viewed as counters or, more generally, registers) ranging over infinite data domains. A trace of a generic register automaton is an alternating sequence of alphabet symbols and values taken by the variables during an execution of the automaton. The problem addressed in this paper is the inclusion between the sets of traces (data languages) recognized by such automata. Since the problem is undecidable in general, we give a semi-algorithm based on a combination of abstraction refinement and antichains, which is proved to be sound and complete, but whose termination is not guaranteed. Moreover, we further enhance the proposed algorithm by exploiting a concept of data simulations, i.e., simulation relations aware of the data associated with the words. We have implemented our technique in a prototype tool and show promising results on multiple non-trivial examples.

Appendix A: Alternative notions of the product state

Below, we briefly discuss two alternative notions of product states that we originally considered but dropped them since we were not able to build a sound antichain construction on them.

The first option we considered was to link predicates with the individual states involved in a product state. In that case, the predicate map linked particular states of automata ${\mathcal {A}}^e$ and B to sets of formulas as follows: $\Pi _{ind}: Q_{{\mathcal {A}}^e}\cup Q_B \rightarrow 2^{ \text{ Form }({\mathcal {D}})}$. The product state was then defined as $s_{ind}=(\langle {\mathbf {q}},\Phi _q\rangle , P)$ with ${\mathbf {q}}$ being a state of the automaton ${\mathcal {A}}^e$, $\Phi _q\subseteq \Pi _{ind}({\mathbf {q}})$, and $P\subseteq \{ \langle r,\Phi _r\rangle \mid r \in Q_{B}$ and $\Phi _r\subseteq \Pi _{ind}(r)\}$. The semantics of the product state $s_{ind}=(\langle {\mathbf {q}},\Phi _q\rangle , P )$ was that whenever the automaton ${\mathcal {A}}^e$ is in the state ${\mathbf {q}}$ with a valuation $\nu \models \Phi _q$ of the variables, then the automaton B can be in any state r such that $\langle r,\Phi _r\rangle \in P$ and $\nu \models \Phi _r$. A product state $s_{ind}=(\langle {\mathbf {q}},\Phi _q\rangle , P )$ was considered accepting iff ${\mathbf {q}}\in F_{{\mathcal {A}}^e}$ and there existed $\nu \models \Phi _q$ such that $\nu \not \models \bigvee \{\Phi _r \mid \langle r,\Phi _r\rangle \in P \wedge r\in F_B\}$. That implied existence of a trace accepted by ${\mathcal {A}}^e$ at the state ${\mathbf {q}}$ with the final valuation $\nu$, not covered by the automaton B. A problem with this product construction is that it cannot be used for soundly deciding the inclusion problem as shown in the following example: Take the product state $s_1=(\langle q_1, x\in \{1,2\}\rangle , \{\langle r_1, x=1\rangle ,\langle r_2, x=2\rangle \})$ obtained for an automaton ${\mathcal {A}}^e$ with the rule $q_1 \xrightarrow {{\scriptscriptstyle \sigma , x'=x+1}}{} q_2$ and an automaton B with rules $r_1 \xrightarrow {{\scriptscriptstyle \sigma , x'>x}}{} r_3$ and $r_2 \xrightarrow {{\scriptscriptstyle \sigma , x'=x+1\wedge x>10}}{} r_3$. Moreover, let $q_2$ be final in ${\mathcal {A}}^e$ and $r_3$ be final in B. When one computes the post of $s_1$, one gets $s_2=(\langle q_2, x\in \{2,3\}\rangle , \{\langle r_3, x>1\rangle \})$, which is not accepting, because all configurations of ${\mathcal {A}}^e$ (i.e. $x\in {\left\{ 2,3 \right\} }$) are covered by configurations of B (i.e. $x>1$). However, the automaton ${\mathcal {A}}^e$ can do a step $(q_1,x=2)\xrightarrow {{\scriptscriptstyle \sigma , x'=x+1}}{} (q_2,x=3)$, which cannot be followed by B (it cannot do a step from the configurations $(r_1,x=2)$ or $(r_2,x=2)$). Hence, an antichain construction based on this notion of product states could hide a real counterexample and provide an unsound answer.

In order to avoid the unsoundness of the above solution, we attempted to use predicates representing relations between successive values of variables within a step leading to a given product state. In this case, the predicate map was defined as $\Pi _{rel} : Q_{{\mathcal {A}}^e}\cup Q_B \rightarrow 2^{ \text{ Form }({\mathcal {D}})} \times 2^{ \text{ Form }({\mathcal {D}})}$. The product state was then defined as $s_{rel}=(\langle {\mathbf {q}},\Phi _q\rangle , P)$ with ${\mathbf {q}}$ being a state of the automaton ${\mathcal {A}}^e$, $\Phi _q\subseteq \Pi _{rel}({\mathbf {q}})$, and $P\subseteq \{ \langle r,\Phi _r\rangle \mid r\in Q_{B}$ and $\Phi _r\subseteq \Pi _{rel}(r)\}$. The semantics of the product state $s_{rel}=(\langle {\mathbf {q}},\Phi _q\rangle , P )$ was that whenever the last step of ${\mathcal {A}}^e$ was $(\_,\nu )\xrightarrow {{\scriptscriptstyle }}{}({\mathbf {q}},\nu ')$ such that $(\nu ,\nu ')\models \Phi _r$, then the last step of B could have been $(\_,\nu )\xrightarrow {{\scriptscriptstyle }}{}(r,\nu ')$ where $\langle r,\Phi _r\rangle \in P$ and $(\nu ,\nu ')\models \Phi _r$. (The source states of the steps were not reflected in the product states, and hence are represented using the underscore sign.) A product state was considered final iff ${\mathbf {q}}\in F_{{\mathcal {A}}^e}$ and there existed a relation $(\nu ,\nu ')\models \Phi _r$ such that $(\nu ,\nu ')\not \models \bigvee \{\Phi _r \mid \langle s,\Phi _r\rangle \wedge r\in F_{B} \}$. The antichain tree could be used for sound checking of the inclusion in this case. However, a problem was to find a subsumption relation to soundly prune the antichain tree. A natural way of defining the subsumption relation following the approach of [1] is to define the subsumption as follows: $(\langle {\mathbf {q}}_1,\Phi _1\rangle , P_1 ) \sqsubseteq (\langle {\mathbf {q}}_2,\Phi _2\rangle , P_2)$ iff (i) ${\mathbf {q}}_1 = {\mathbf {q}}_2$, (ii) $\Phi _1 \rightarrow \Phi _2$, and (iii) for each $\langle r,\Phi _r\rangle \in P_2$ there exists $\langle s,\Phi _s\rangle \in P_1$ such that $r=s$ and $\Phi _r \rightarrow \Phi _s$. Unfortunately, it turns out that using such a subsumption cannot be used for sound inclusion checking since comparing formulae representing solely the last step of the automata can lead to omitting counterexamples to inclusion that depend on longer traces. Existence of a suitable sound subsumption for this type of product states, which is needed to ensure termination of the antichain construction, is an open problem.