list<pair<const EState*, int> > CounterexampleAnalyzer::removeTraceLeadingToErrorState(const EState* errorState, TransitionGraph* stg) {
assert(errorState->io.isFailedAssertIO() || errorState->io.isStdErrIO() );
list<pair<const EState*, int> > erroneousTransitions;
PState* pstate = const_cast<PState*>( errorState->pstate() );
int latestInputVal = (*pstate)[_analyzer->globalVarIdByName("input")].getValue().getIntValue();
//eliminate the error state
const EState* eliminateThisOne = errorState;
EStatePtrSet preds = stg->pred(eliminateThisOne);
assert (stg->succ(eliminateThisOne).size() == 0); // error state should have no successors.
assert (preds.size() == 1); // error states are immediately removed after being discovered.
const EState* currentState = *(preds.begin());
stg->eliminateEState(eliminateThisOne);
//in the case of new input->output->error behavior, delete the output too
if (currentState->io.isStdOutIO()) {
eliminateThisOne = currentState;
preds = stg->pred(currentState);
assert (preds.size() == 1);
currentState = *(preds.begin());
stg->eliminateEState(eliminateThisOne);
}
//also delete the input state right before
assert (currentState->io.isStdInIO());
eliminateThisOne = currentState;
preds = stg->pred(currentState);
// exclude all edges leading to the input state right before the error state for future tracing attempts
// (due to the reduction to observable behavior, even a single execution trace can lead to multiple predecessors)
for (EStatePtrSet::iterator i=preds.begin(); i!= preds.end(); ++i) {
erroneousTransitions.push_back(pair<const EState*, int>(*i, latestInputVal));
}
stg->eliminateEState(eliminateThisOne);
return erroneousTransitions;
}
// MS: we definitely need to cache all the results or use a proper graph structure
TransitionGraph::TransitionPtrSet TransitionGraph::outEdges(const EState* estate) {
ROSE_ASSERT(estate);
if(getModeLTLDriven()) {
ROSE_ASSERT(_analyzer);
if(_outEdges[estate].size()==0) {
ROSE_ASSERT(_analyzer);
Analyzer::SubSolverResultType subSolverResult=_analyzer->subSolver(estate);
EStateWorkList& deferedWorkList=subSolverResult.first;
EStateSet& existingEStateSet=subSolverResult.second;
EStatePtrSet succNodes;
for(EStateWorkList::iterator i=deferedWorkList.begin(); i!=deferedWorkList.end(); ++i) {
succNodes.insert(*i);
}
for(EStateSet::iterator i=existingEStateSet.begin(); i!=existingEStateSet.end(); ++i) {
succNodes.insert(*i);
}
//cout<<"DEBUG: succ:"<<deferedWorkList.size()<<","<<existingEStateSet.size()<<":"<<succNodes.size()<<endl;
for(EStatePtrSet::iterator j=succNodes.begin(); j!=succNodes.end(); ++j) {
Edge newEdge(estate->label(),EDGE_PATH,(*j)->label());
Transition t(estate,newEdge,*j);
add(t);
}
}
//if(_outEdges[estate].size()>0) cout<<"DEBUG: #out-edges="<<_outEdges[estate].size()<<endl;
}
return _outEdges[estate];
}
vector<const EState*> CounterexampleAnalyzer::sortAbstractInputStates(vector<const EState*> v, EStatePtrSet abstractInputStates) {
for (EStatePtrSet::iterator i=abstractInputStates.begin(); i!=abstractInputStates.end(); ++i) {
PState* pstate = const_cast<PState*>( (*i)->pstate() );
int inVal = (*pstate)[_analyzer->globalVarIdByName("input")].getValue().getIntValue();
v[inVal - 1] = (*i);
}
return v;
}
CEAnalysisStep CounterexampleAnalyzer::getSpuriousTransition(list<CeIoVal> partOfCeTrace, TransitionGraph* originalTraceGraph,
const EState* compareFollowingHere, StateSets* statesPerCycleIndex) {
assert(compareFollowingHere);
const EState* currentState = compareFollowingHere;
bool matchingState;
CeIoVal realBehavior;
int index = 1;
CEAnalysisStep result;
result.assertionCausingSpuriousInput = false;
StateSets::iterator cycleIndexStates;
if (statesPerCycleIndex) { //bookkeeping for analyzing the cyclic part of the counterexample
cycleIndexStates = statesPerCycleIndex->begin();
}
// iterate over part of the counterexample and compare its behavior step-by-step against the original program's trace
for (list<CeIoVal>::iterator i = partOfCeTrace.begin(); i != partOfCeTrace.end(); i++) {
matchingState = false;
EStatePtrSet successors = originalTraceGraph->succ(currentState);
// the trace graph should always contain enough states for the comparision
assert(successors.size()>0);
// retrieve the correct state at branches in the original program (branches may exist due to inherent loops)
// note: assuming deterministic input/output programs
for (EStatePtrSet::iterator succ = successors.begin(); succ != successors.end(); succ++) {
realBehavior = eStateToCeIoVal(*succ);
//cout << "DEBUG: realBehavior: " << ceIoValToString(realBehavior) << " ceTraceItem: " << ceIoValToString(*i) << endl;
if (realBehavior == (*i)) { //no spurious behavior when following this path, so continue here
currentState = (*succ);
index++;
matchingState = true;
if (statesPerCycleIndex) {
//check if the real state has already been seen
pair<boost::unordered_set<const EState*>::iterator, bool> notYetSeen = cycleIndexStates->insert(currentState);
if (notYetSeen.second == false) {
//state encountered twice at the some counterexample index. cycle found --> real counterexample
result.analysisResult = CE_TYPE_REAL;
return result;
} else {
cycleIndexStates++;
}
}
// special case. output-> failing assertion occurs during execution of the original program, leading to a spurious input symbol.
// RefinementConstraints should use the failing assertion's condition to add new constraints, trying to enforce the assertion to fail
// and thus eliminating the spurious input symbol.
} else if (realBehavior.second == IO_TYPE_ERROR && i->second == IO_TYPE_INPUT) {
result.assertionCausingSpuriousInput = true;
result.failingAssertionInOriginal = (*succ)->label();
}
}
// if no matching transition was found, then the counterexample trace is spurious
if (!matchingState) {
result.analysisResult = CE_TYPE_SPURIOUS;
result.spuriousIndexInCurrentPart = index;
return result;
}
}
IoType mostRecentOriginalIoType = (partOfCeTrace.rbegin())->second;
determineAnalysisStepResult(result, mostRecentOriginalIoType, currentState, originalTraceGraph, index);
return result; // partOfCeTrace could be successfully traversed on the originalTraceGraph
}
Label CounterexampleAnalyzer::getFirstObservableSpuriousLabel(TransitionGraph* analyzedModel, PrefixAndCycle counterexample, int numberOfSteps) {
boost::unordered_set<const EState*>* currentDepth = new boost::unordered_set<const EState*>();
boost::unordered_set<const EState*>* nextDepth = new boost::unordered_set<const EState*>();
currentDepth->insert(analyzedModel->getStartEState());
list<CeIoVal> prefix = counterexample.first;
list<CeIoVal> cycle = counterexample.second;
unsigned int prefixIndex = 0;
unsigned int cycleIndex = 0;
assert(prefix.size() > 0); // in case of an empty prefix, refine the initialization here
list<CeIoVal>::iterator currentCeBehavior = prefix.begin();
bool inCycle = false;
// traverse all paths in the analyzed model that match with the counterexample's behavior
for (int i = 0; i < numberOfSteps; i++) {
//traverse one more level
for (boost::unordered_set<const EState*>::iterator k = currentDepth->begin(); k != currentDepth->end(); k++) {
EStatePtrSet successors = analyzedModel->succ(*k);
// add those successor states to "nextDepth" that match the desired behavior
for (EStatePtrSet::iterator m = successors.begin(); m != successors.end(); m++) {
if (eStateToCeIoVal(*m) == *currentCeBehavior) {
nextDepth->insert(*m);
}
}
}
// swap currentDepth and nextDepth, then clear nextDepth
boost::unordered_set<const EState*>* swapTemp = currentDepth;
currentDepth = nextDepth;
nextDepth = swapTemp;
nextDepth->clear();
//update currentCeBehavior
if (!inCycle) {
if (prefixIndex < prefix.size() - 1) {
currentCeBehavior++;
prefixIndex++;
} else {
currentCeBehavior = cycle.begin();
inCycle = true;
}
} else {
if (cycleIndex < cycle.size() - 1) {
currentCeBehavior++;
cycleIndex++;
} else {
currentCeBehavior = cycle.begin();
cycleIndex = 0;
}
}
}
// the counterexample itself comes from analyzing "anaylzedModel", there has to be at least one matching state
assert (currentDepth->size() > 0);
const EState* firstMatch = *(currentDepth->begin());
delete currentDepth;
delete nextDepth;
assert(firstMatch);
return firstMatch->label();
}
// author: Marc Jasper, 2015.
long TransitionGraph::numberOfObservableStates(bool includeIn, bool includeOut, bool includeErr) {
long result = 0;
EStatePtrSet allStates = estateSet();
for (EStatePtrSet::iterator i=allStates.begin(); i!=allStates.end(); ++i) {
if ((includeIn && (*i)->io.isStdInIO()) || (includeOut && (*i)->io.isStdOutIO())
|| (includeErr && ((*i)->io.isStdErrIO()||(*i)->io.isFailedAssertIO())) ) {
result++;
}
}
return result;
}
void CounterexampleAnalyzer::determineAnalysisStepResult(CEAnalysisStep& result, IoType mostRecentOriginalIoType,
const EState* currentState, TransitionGraph* originalTraceGraph, int index) {
result.analysisResult = CE_TYPE_UNKNOWN;
result.mostRecentStateRealTrace = currentState;
result.continueTracingOriginal = true;
// set and return the result
// Takes care of the corner case that error states after the lastly assessed input symbol render
// further tracing of the original program's path impossible.
if (mostRecentOriginalIoType == IO_TYPE_INPUT) {
EStatePtrSet successors = originalTraceGraph->succ(currentState);
assert(successors.size() == 1); //(input-)determinism of the original program
const EState * nextEState = *(successors.begin());
assert(nextEState);
if (nextEState->io.isStdErrIO() || nextEState->io.isFailedAssertIO()) {
// (*) see below (the first symbol of the next partOfCeTrace has to be the spurious transition here)
result.analysisResult = CE_TYPE_SPURIOUS;
result.spuriousIndexInCurrentPart = index;
} else if (nextEState->io.isStdOutIO()) {
successors = originalTraceGraph->succ(nextEState);
for (EStatePtrSet::iterator i = successors.begin(); i != successors.end(); ++i) {
const EState* nextEState = *i;
if (nextEState->io.isStdErrIO() || nextEState->io.isFailedAssertIO()) {
// (*) see below
result.continueTracingOriginal = false;
}
}
}
} else if (mostRecentOriginalIoType == IO_TYPE_OUTPUT) {
EStatePtrSet successors = originalTraceGraph->succ(currentState);
for (EStatePtrSet::iterator i = successors.begin(); i != successors.end(); ++i) {
const EState* nextEState = *i;
if (nextEState->io.isStdErrIO() || nextEState->io.isFailedAssertIO()) {
// (*) see below
result.continueTracingOriginal = false;
}
}
}
// (*) there is a not yet seen error state. Because every state except from successors of the last input state of the trace have
// been looked at already, the cycle part of the CE contains no input state before the error state. RERS programs need to
// contain at least one input symbol in the cycle part of a counterexample --> this counterexample is spurious.
}
EStatePtrSet CounterexampleAnalyzer::addAllPrefixOutputStates(EStatePtrSet& startAndOuputStatesPrefix, TransitionGraph* model) {
EStatePtrSet allEStates = model->estateSet();
for (EStatePtrSet::iterator i=allEStates.begin(); i!=allEStates.end(); ++i) {
//start state has already been added
if ((*i)->io.isStdOutIO()) {
if (! (*i)->isRersTopified(_analyzer->getVariableIdMapping())) {
startAndOuputStatesPrefix.insert(*i);
}
}
}
return startAndOuputStatesPrefix;
}
vector<bool> CounterexampleAnalyzer::hasFollowingInputStates(vector<bool> v, const EState*eState, TransitionGraph* model) {
EStatePtrSet successors = model->succ(eState);
for (EStatePtrSet::iterator k=successors.begin(); k!=successors.end(); ++k) {
if ((*k)->io.isStdInIO()) {
PState* pstate = const_cast<PState*>( (*k)->pstate() );
int inVal = (*pstate)[_analyzer->globalVarIdByName("input")].getValue().getIntValue();
v[inVal - 1] = true;
}else {
cout << "ERROR: CounterexampleAnalyzer::cegarPrefixAnalysisForLtl: successor of prefix output (or start) state is not an input state." << endl;
assert(0);
}
}
return v;
}
vector<const EState*> CounterexampleAnalyzer::getFollowingInputStates(vector<const EState*> v, const EState* startEState, TransitionGraph* model) {
EStatePtrSet firstInputStates = model->succ(startEState);
for (EStatePtrSet::iterator i=firstInputStates.begin(); i!=firstInputStates.end(); ++i) {
if ((*i)->io.isStdInIO()) {
PState* pstate = const_cast<PState*>( (*i)->pstate() );
int inVal = (*pstate)[_analyzer->globalVarIdByName("input")].getValue().getIntValue();
v[inVal - 1] = (*i);
} else {
cout << "ERROR: CounterexampleAnalyzer::cegarPrefixAnalysisForLtl: successor of initial model's start state is not an input state." << endl;
assert(0);
}
}
return v;
}
PropertyValueTable* CounterexampleAnalyzer::cegarPrefixAnalysisForLtl(int property, SpotConnection& spotConnection,
set<int> ltlInAlphabet, set<int> ltlOutAlphabet) {
// visualizer for in-depth model outputs (.dot files)
Visualizer visualizer(_analyzer->getLabeler(),_analyzer->getVariableIdMapping(),
_analyzer->getFlow(),_analyzer->getPStateSet(),_analyzer->getEStateSet(),_analyzer->getTransitionGraph());
string vizFilenamePrefix = "";
if(args.count("viz-cegpra-detailed")) {
vizFilenamePrefix=args["viz-cegpra-detailed"].as<string>();
string filename = vizFilenamePrefix + "_cegpra_init.dot";
writeDotGraphToDisk(filename, visualizer);
}
// OVERVIEW
// (0) check if the initial model already satsifies the property
// (0.5) initialization
// (while (property != satisfied)) do
// (1) Disconnect the concrete prefix (initially the start state) from the over-approx. part of the model
// (2) Anaylze the most recent counterexample while adding the trace of the original program to the prefix part of the model
// If the counterexample is real: reconnect once more to determine the model's size, ESCAPE the loop and return results
// (3) Reconnect both parts of the model
// (4) Check the property on the now slightly refined model
// od
// (5) return results;
cout << "STATUS: CEGPRA is now analyzing LTL property " << property << "..." << endl;
if (_csvOutput) {
(*_csvOutput) << endl << property << ",";
}
TransitionGraph* model = _analyzer->getTransitionGraph();
assert(model->isComplete());
// (0) check if the given property already holds on the initial over-approximated model
PropertyValueTable* currentResults = spotConnection.getLtlResults();
if (currentResults->getPropertyValue(property) != PROPERTY_VALUE_UNKNOWN) {
cout << "STATUS: property " << property << " was already analyzed. CEGAR analysis will not be started." << endl;
return currentResults;
}
spotConnection.checkSingleProperty(property, *model, ltlInAlphabet, ltlOutAlphabet, true, true);
currentResults = spotConnection.getLtlResults();
// (0.5) prepare for the continuous tracing of concrete states (will become the prefix of a refined abstract model)
// store connectors in the over-approx. part of the model (single row of input states in the initial "topified" model)
const EState* startEState = model->getStartEState();
pair<EStatePtrSet, EStatePtrSet> concOutputAndAbstrInput = getConcreteOutputAndAbstractInput(model);
EStatePtrSet startAndOuputStatesPrefix = concOutputAndAbstrInput.first;
vector<const EState*> firstInputOverApprox(ltlInAlphabet.size());
firstInputOverApprox = sortAbstractInputStates(firstInputOverApprox, concOutputAndAbstrInput.second);
int loopCount = 0;
bool falsified = false;
bool verified = true; // the usual case for the loop below to terminate is a verified property.
string ce = "no counterexample yet";
// as long as the property is not satisfiable yet, refine by enlarging the prefix of concrete states according to counterexamples
while (currentResults->getPropertyValue(property) != PROPERTY_VALUE_YES) {
if (_maxCounterexamples > -1 && (loopCount + 1) > _maxCounterexamples) {
verified = false;
spotConnection.resetLtlResults(property);
break;
}
loopCount++;
if (loopCount % 50 == 0) {
cout << "STATUS: " << loopCount << " counterexamples analyzed. most recent counterexample: " << endl;
cout << ce << endl;
}
// (1) disconnect prefix and over-approx. part of the model
model->setIsComplete(false);
for (unsigned int i = 0; i < firstInputOverApprox.size(); i++) {
TransitionPtrSet connectionsToPrefix = model->inEdges(firstInputOverApprox[i]);
for (TransitionPtrSet::iterator k=connectionsToPrefix.begin(); k!=connectionsToPrefix.end(); ++k) {
// check if predeccesor at the source of that transition is a concrete (prefix) state
if ( !(*k)->source->isRersTopified(_analyzer->getVariableIdMapping()) ) {
model->erase(**k);
}
}
}
model->setIsPrecise(true);
if(args.count("viz-cegpra-detailed")) {
stringstream filenameStream;
filenameStream << vizFilenamePrefix << "cegpra_afterDisconnect_i" << loopCount << ".dot";
writeDotGraphToDisk(filenameStream.str(), visualizer);
}
// (2) add a trace to the prefix according to the most recent counterexample. Analyze the counterexample while adding the trace.
ce = currentResults->getCounterexample(property);
//cout << "STATUS: counterexample: " << ce << endl;
CEAnalysisResult ceaResult = analyzeCounterexample(ce, startEState, false, false);
if (ceaResult.analysisResult == CE_TYPE_REAL) {
// still reconnect the concrete prefix with the over-approx. part of the model (step (3)) in order to report the size.
falsified = true;
verified = false;
} else if (ceaResult.analysisResult == CE_TYPE_SPURIOUS) {
if(!boolOptions["keep-error-states"]) {
// remove a trace leading to an error state and mark the branches to it (do not reconnect in phase 3)
removeAndMarkErroneousBranches(model);
}
//the trace eliminating the spurious counterexample (maybe including a few extra states) was added to the prefix during analysis.
// --> nothing to do here
} else {
assert(0); //counterexample analysis not successfully completed
}
if(args.count("viz-cegpra-detailed")) {
stringstream filenameStream;
filenameStream << vizFilenamePrefix << "cegpra_afterCECheck_i" << loopCount << ".dot";
writeDotGraphToDisk(filenameStream.str(), visualizer);
}
// (3) reconnect both parts of the model
model->setIsPrecise(false);
//update set of output states (plus start state) in the precise prefix
addAllPrefixOutputStates(startAndOuputStatesPrefix, model);
for (set<const EState*>::iterator i=startAndOuputStatesPrefix.begin(); i!=startAndOuputStatesPrefix.end(); ++i) {
vector<bool> inputSuccessors(ltlInAlphabet.size(), false);
if(!boolOptions["keep-error-states"]) {
inputSuccessors = setErrorBranches(inputSuccessors, *i);
}
// determine which input states exist as successors in the prefix
inputSuccessors = hasFollowingInputStates(inputSuccessors, *i, model);
//connect with the approx. part of the model for all input values not found among the successor states
for (unsigned int k = 0; k < inputSuccessors.size(); k++) {
if (!inputSuccessors[k]) {
Edge newEdge;
model->add(Transition((*i), newEdge, firstInputOverApprox[k]));
}
}
}
model->setIsComplete(true);
if(args.count("viz-cegpra-detailed")) {
stringstream filenameStream;
filenameStream << vizFilenamePrefix << "cegpra_afterReconnect_i" << loopCount << ".dot";
writeDotGraphToDisk(filenameStream.str(), visualizer);
}
// if falsified: after reconnecting, leave the analysis loop, report size of the model and return the results
if (falsified) {
break;
}
// (4) check if the property holds on the refined model
spotConnection.resetLtlResults(property);
spotConnection.checkSingleProperty(property, *model, ltlInAlphabet, ltlOutAlphabet, true, true);
currentResults = spotConnection.getLtlResults();
}
// (5) check all properties using the current model and return the result
spotConnection.checkLtlProperties(*model, ltlInAlphabet, ltlOutAlphabet, true, false);
currentResults = spotConnection.getLtlResults();
printStgSizeAndCeCount(model, loopCount, property);
if (_csvOutput) {
if (verified && !falsified)
(*_csvOutput) << "y,";
if (!verified && falsified)
(*_csvOutput) << "n,";
if (!verified && !falsified)
(*_csvOutput) << "?,";
if (verified && falsified) {
cout << "ERROR: property can not be both verified and falsified. " << endl;
assert(0);
}
(*_csvOutput) << currentResults->entriesWithValue(PROPERTY_VALUE_YES)<<",";
(*_csvOutput) << currentResults->entriesWithValue(PROPERTY_VALUE_NO)<<",";
(*_csvOutput) << currentResults->entriesWithValue(PROPERTY_VALUE_UNKNOWN);
}
return currentResults;
}