Counterexample-guided Abstraction Refinement for the Analysis of ...

Proposition 2. The equivalence ̂Q constructed above is the smallest equivalencecontained in Θ.Example: We consider again the abstract error trace J which can be obtainedby firing transitions “Cross Location” and “Error”. However, this error trace hasno real runs that correspond to it, which can be seen by computing the set Hof runs corresponding to prefixes of J . Here, the set H 0 consists of the initialhypergraph and the set H 1 contains one graph G 1 . The next rule “Error” cannotbe applied to G 1 in such a way that the corresponding diagram commutes andtherefore the set H 2 is empty.Fig. 4 shows the left-hand side of rule “Error”, G 1 ∈ H 1 and graph(m 1 ), thegraph corresponding to the marking reached after one step. One notices thatno appropriate morphism η can be found unless the nodes w 1 and w 2 in G 1are merged. Therefore we have Q w ′1= {w 1 ,w 2 }, Q w ′2= {w 2 } and the smallestequivalence relation ̂Q relates the nodes w 1 and w 2 and no other nodes. Notefor instance that w 2 must be contained in Q w ′1since both are attached to theunary edge labelled UP.left-hand side of rule ”Error”L 2UPFw ′ 1 w ′ 2η”real graph” G 1 graph(m 1 ) (graph generated by m 1 )UPL F Lv 1 w 1 w 2 v 2ξw 1,2UPLLv 1,2ϕFFig. 4. Hypergraphs G 1 ∈ H 1, L 2 and graph(m 1) from the firewall example.4.3 Elimination of Spurious RunsThe general idea for destroying spurious runs is to avoid the merging of nodesfrom the same equivalence class of ̂Q. For this reason we assign colours to thenodes of the graphs contained in H and disallow the merging of nodes correspondingto nodes with the same colour. For reasons that will become clearbelow a node may have several colours, i.e., a node v is associated to a set cols(v)of colours.For each G ∈ H k we and each morphism ξ k : G → graph(m k ) we considerthe corresponding relation Q G,ξk . Then we assign colours to nodes in such away that there exists at least one pair v 1 ,v 2 of nodes such that v 1 Q G,ξk v 2 andcols(v 1 ) ∩ cols(v 2 ) ≠ ∅. There are several ways to do this and all of them willhelp to eliminate the counterexample. In our implementation we choose a colorfor each set of nodes Q v and assign it to all nodes contained in Q v .In order to catch “bad” mergings as early as possible, these colours have tobe distributed to the remaining graphs contained in H. Let us recall here that