An abstraction-refinement framework for trigger querying

Trigger querying is the problem of finding, given a system M and an LTL formula φ, the set of scenarios that trigger φ in M; that is, the language L of finite computations of M such that all infinite computations that have a prefix in L continue with a suffix that satisfies φ. For example, the trigger query M |=? → Ferr asks for the set of scenarios after which err aught to eventually happen. Trigger querying thus significantly extends query checking, which seeks propositional solutions, and is an extremely useful methodology for system exploration and understanding. The weakness of trigger querying lies in the fact that the size of the solution is linear in the size of the system. For trigger querying to become feasible in practice, we must offer solutions to cope with systems of big, and possibly infinite, state spaces. In this paper we describe an abstraction-refinement framework for trigger querying. The general idea is to replace the reasoning about M by reasoning about an abstraction M_A of M, and return to the user two languages, L _l and L _u , that under- and over-approximate L, respectively. We consider predicate abstraction, and the languages L_l and L_u are defined with respect to the set of predicates. The challenge in defining the approximating languages is that trigger querying does not have a clear polarity, and the definition of L_l and L_u has to combine the upper- and over-approximations of M. We describe an automata-theoretic approach for refining and reducing L_u \ L _l . While refinement for model checking is lengthwise, in the sense that it is based on counterexamples, here we suggest both lengthwise and widthwise refinement, where the latter is based on cuts in an automaton for L_u \ L_l and thus can symbolically handle batches of counterexamples. We show that our framework is robust and can be applied also for classical query checking as well as variants and extensions of trigger querying.