Learning to divide and conquer: applying the L* algorithm to automate assume-guarantee reasoning

  • Authors:

  • Corina S. Păsăreanu;Dimitra Giannakopoulou;Mihaela Gheorghiu Bobaru;Jamieson M. Cobleigh;Howard Barringer

  • Affiliations:

  • Perot Systems, NASA Ames Research Center, Moffett Field, USA 94035;RIACS, NASA Ames Research Center, Moffett Field, USA 94035;Department of Computer Science, University of Toronto, Toronto, Canada M5S 3G4;Department of Computer Science, University of Massachusetts, Amherst, USA 01003;School of Computer Science, University of Manchester, Manchester, UK M13 9PL

  • Venue:
  • Formal Methods in System Design
  • Year:
  • 2008

Quantified Score

Hi-index 0.00

Visualization

Abstract

Assume-guarantee reasoning enables a "divide-and-conquer" approach to the verification of large systems that checks system components separately while using assumptions about each component's environment. Developing appropriate assumptions used to be a difficult and manual process. Over the past five years, we have developed a framework for performing assume-guarantee verification of systems in an incremental and fully automated fashion. The framework uses an off-the-shelf learning algorithm to compute the assumptions. The assumptions are initially approximate and become more precise by means of counterexamples obtained by model checking components separately. The framework supports different assume-guarantee rules, both symmetric and asymmetric. Moreover, we have recently introduced alphabet refinement, which extends the assumption learning process to also infer assumption alphabets. This refinement technique starts with assumption alphabets that are a subset of the minimal interface between a component and its environment, and adds actions to it as necessary until a given property is shown to hold or to be violated in the system. We have applied the learning framework to a number of case studies that show that compositional verification by learning assumptions can be significantly more scalable than non-compositional verification.