Counterexample-guided Abstraction Refinement for the Analysis of ...

SPCv 1L F Lw 1 w v 22UPSP UP SP SPCFig. 5. Hypergraph obtained after abstraction refinement.Proposition 3. The algorithm computing the refined over-approximation C ′ G fora given gts G and a (spurious) abstract run J of C G terminates.Furthermore the new over-approximation is still a valid over-approximationas before.Proposition 4. Let C G ′ be the refined over-approximation of the gts. Then, forevery real run J r of the graph transformation system there exists an abstract runJ ∈ Run A (C G ′ ) such that J r corresponds to J , i.e., J r ≪ J .In the following two propositions we will show that we have eliminated thegiven spurious counterexample and have not added any new ones. First we shouldanswer the following question: what kind of runs have we eliminated by abstractionrefinement? It is easy to see that in the refined over-approximation we havelost the initial spurious counter-example J . In fact we have not only eliminatedJ , but some more runs as described below.Definition 11 (Correspondence with respect to runs). Let (P,ι) and(P ′ ,ι ′ ) be two Petri graphs for a gts (R,G 0 ). Furthermore let J ∈ Run A (P,ι)and J ′ ∈ Run A (P ′ ,ι ′ ) be two abstract runs of these Petri graphs and let H bethe set of real runs considered earlier. We say that J ′ corresponds to J withrespect to H if J ′ corresponds to J and a run J ′′ ∈ H of maximal length weaklycorresponds to a prefix of J ′ .Using this definition we can now state and prove the following propositions.Proposition 5. The refined over-approximation C G ′ , constructed above does notcontain any run J ′ corresponding to the spurious run J of C G with respect toH.We can also show that no new spurious runs have appeared, which meansthat the new approximation is strictly better than the old one.Proposition 6. If the refined over-approximation C G ′ contains a spurious runJ ′ , then it corresponds to some spurious run J in C G .We remark that the considered abstraction refinement approach can also beimplemented in the case of any number of spurious counterexamples by iterativelyrefining the abstraction. Naturally, due to undecidability and the factthat gtss are in general Turing-complete, there is no guarantee that it will everterminate.