In this paper we discuss the implementation of neighbourhood graph abstraction in the GROOVE tool set. Important classes of graph grammars may have unbounded state spaces and therefore cannot be verified with traditional model checking techniques. One way to address this problem is to perform graph abstraction, which allows us to generate a finite abstract state space that over-approximates the original one. In previous work we presented the theory of neighbourhood abstraction. In this paper, we present the implementation of this theory in GROOVE and illustrate its applicability with a case study that models a single-linked list

Rensink, Arend

Zambon, Eduardo

English

University of Twente Research Information

Electronic Communications of the EASSTVolume X (2010)Proceedings of theFourth International Workshop onGraph-Based Tools(GraBaTs 2010)Neighbourhood Abstraction in GROOVE — Tool PaperArend Rensink and Eduardo Zambon6 pagesGuest Editors: Juan de Lara, Daniel VarroManaging Editors: Tiziana Margaria, Julia Padberg, Gabriele TaentzerECEASST Home Page: http://www.easst.org/eceasst/ ISSN 1863-2122ECEASSTNeighbourhood Abstraction in GROOVE — Tool PaperArend Rensink and Eduardo Zambon∗rensink@cs.utwente.nl, zambon@cs.utwente.nlFormal Methods and Tools GroupDepartment of Computer ScienceUniversity of Twente, The NetherlandsAbstract: In this paper we discuss the implementation of neighbourhood graph ab-straction in the GROOVE tool set. Important classes of graph grammars may have un-bounded state spaces and therefore cannot be verified with traditional model check-ing techniques. One way to address this problem is to perform graph abstraction,which allows us to generate a finite abstract state space that over-approximates theoriginal one. In previous work we presented the theory of neighbourhood abstrac-tion. In this paper, we present the implementation of this theory in GROOVE andillustrate its applicability with a case study that models a single-linked list.Keywords: Graph Abstraction, Graph Transformation, Model Checking, GROOVE1 IntroductionMany verification methods rely on the exploration of the state space of systems. However, evenfor small systems the state space size tends to blow up exponentially. Moreover, one would liketo be able to analyse systems independently of their instantiated size. An approach that can inprinciple solve both these problems is state abstraction. The idea behind this is that “similar”states are actually grouped together, and such a group of similar states is modelled in such away the distinction between them is no longer visible. The behaviour of the abstract state is thecollection of possible behaviours of the original states.This principle has been long known and studied, e.g., in abstract interpretation [CC77] andshape analysis [SRW98, SRW02]. In the context of graph transformation we have seen severaltheoretical studies on suitable abstractions [Ren04, RD06, BBKR08, RN08, BKK03, KK06].However, to the best of our knowledge only the last of these is backed up by an implementation,namely AUGUR2 [KK08].In this paper we report an extension of GROOVE that implements the neighbourhood abstrac-tion principle of [BBKR08], showing its feasibility at least on a small example. This gives us abasis for experimenting with different, more expressive notions of abstraction.2 Neighbourhood AbstractionOur notion of abstraction is based on neighbourhood similarity: two nodes are considered in-distinguishable if they have the same incoming and outgoing edges, and the opposite ends of∗ The work reported herein is being carried out as part of the GRAIL project, funded by NWO (Grant 612.000.632).1 / 6 Volume X (2010)Neighbourhood Abstraction in GROOVE — Tool Paperthose edges are also comparable (in a parameterisable sense). Graphs are abstracted by foldingall indistinguishable nodes into one, while keeping count of their original number up to somebound of precision. The incident edges are also combined. Counting up to some bound is doneusing multiplicities. We use Mk = {0, . . . ,k,ω} with k ∈ N consisting of exact numbers up to k(which is typically a low value such as 1 or 2) and the value ω standing for “many”.Formally, a graph is a tuple G = 〈V,E〉 of nodes and edges, where (in our case) the edges aretriples (v,a,w) of source node, label, and target node. The abstractions are called shapes: theyare 5-tuples S = 〈G,∼,multnode,multin,multout〉 in which• G is the underlying graph structure of the shape;• ∼ ⊆V ×V is a neighbourhood similarity relation;• multnode : V→Mν is a node multiplicity function, which records how many concrete nodeswere folded into a given abstract node, up to bound ν ;• multin,multout : (V ×L×V/∼)→Mµ are incoming and outgoing edge multiplicity func-tions, which record how many edges with a certain label the concrete nodes had that werefolded into an abstract node, up to a bound µ and a group of ∼-similar opposite nodes.The following is pseudo-code for generating the abstract state space. Q is the set of all shapesand F the set of fresh, yet to be explored shapes; P is the set of rules and G the start graph.1 let S := abstracti(G), Q := /0, F := {S}2 while F 6= /03 do choose S ∈ F (which S is selected depends on the exploration strategy)4 let F := F \{S}5 for p ∈ P, m ∈ prematch(p,S), S′ ∈materialise(m,S)6 do let R := normalise(apply(p,m,S′))7 if R /∈ Q8 then let Q := Q∪{R}, F := F ∪{R}9 fi10 od11 odThe important phases in this algorithm are:• abstract computes the shape of a graph. This is controlled by a parameter i expressing theradius of the neighbourhood to be considered in the neighbourhood similarity relation.• prematch computes morphisms of a rule p into a shape S. Such a morphism is not yet amatch, because the images of p’s left hand side may be nodes with multiplicity > 1; inthat case they have to be materialised.• materialise creates concrete nodes and edges for the image of p in S. This is a non-deterministic step, as there may be choices involved in choosing multiplicities for theinstantiated nodes and edges.• apply is rule application, which can be carried out as usual because the rule now acts upona concrete subgraph of S′.• normalise merges the transformed graph back into the rest of the shape; it is thus similarto abstract except that it acts upon a (partially materialised) shape rather than a graph.Proc. GraBaTs 2010 2 / 6ECEASSTFor instance, abstracti converts the following graph into a shape, using i = 1 and ν = µ = 1. Theindicated C-nodes in the graph are folded because they are indistinguishable by their incomingand outgoing edges.C CCCL C nh ntnn︷ ︸︸ ︷=⇒C C CL n nnthIn the right hand side figure, all C-labelled nodes are ∼-similar, and all edge multiplicities are 1.The “joined” incoming and outgoing edges indicate that the multiplicities apply to a bundle ofedges, rather than a single edge. The fat C-node has multiplicity ω .3 Case studyAs a test case for our abstraction implementation we use a graph transformation system thatmodels a single-linked list. The list is formed by cells, representing the elements in the list,which are connected by a next pointer. Additionally, a list has a root object that indicates the firstand last elements of the list, by way of pointers called head and tail, respectively. The modellingof such structure as a graph in GROOVE is trivial, as shown in the previous section. The root ofthe list is represented by a L-node and the cells by C-nodes. Pointers head, tail, and next aremodelled by edges labelled h, t, and n, respectively.We consider two list operations: one that puts a new element to the tail of the list, and anotherthat gets the head element from the list. These operations are modelled in our graph transfor-mation system by two rules, shown below. GROOVE combines the left and right hand side of arule in a single graph, and colours and shapes are used to distinguish different elements. Blue(dashed thin) elements are deleted by the rule application; green (continuous fat) nodes and edgesare created; and black (continuous thin) elements are preserved. For simplicity, we assume thatour lists always have at least one element1.L C Ctt n L C Chnhput rule get ruleIt is clear that the concrete state space of this example is unbounded: the put rule is alwaysenabled, and successive applications of this rule keep producing longer and longer lists. How-ever, the abstract state space produced by our abstraction mechanism is finite. For an abstractionradius of one, the state space has 10 states and 21 transitions, as shown in Fig. 1. Each dashedbox represents a state, with its numbering on the lower left corner, and the corresponding shapedrawn with solid lines. The transitions between states are shown by dashed arrows, labelled withthe rule applied.There are many interesting points to note in the state space of Fig. 1. First, as long as nodeand edge multiplicities stay within their bounds, the abstract graph transformation correspondsto the concrete one. This is seen on states s0, s1, and s2, where the shapes are concrete.1 otherwise, two more rules are necessary to insert an element to an empty list and to remove the last element.3 / 6 Volume X (2010)Neighbourhood Abstraction in GROOVE — Tool Papers0 CL ths1C CL nhts2C C CL n nths3C C CL n nnths4 CC CLnhtnn ns5 CC CLnhtnn ns6 C CLnths7 C CLnths8C C CL nnhts9C C CL nnhtputgetputgetputputgetgetputgetgetputgetgetgetputputputgetputgetFigure 1: The abstract state space for the parameters i = 1 and ν = µ = 1Proc. GraBaTs 2010 4 / 6ECEASSTSecond, an abstract state may represent an unbounded number of concrete ones. State s3, forexample, is an abstract representative for lists with four or more elements. This is illustrated bythe put transition from s3 to itself.Third, the non-determinism of the materialisation algorithm can be seen on the two get transi-tions from state s3. Although there is only one pre-matching of the rule, when materialising thispre-match two distinct shapes are produced.Fourth, we can see that the abstract state space has spurious configurations. For example, statess6 to s9 represent lists with unconnected elements, which do not occurr in the concrete statespace. This spurious shapes arise from the fact that the neighbourhood abstraction mechanismdoes not keep information regarding connectivity. This is a point where we plan to improve thecurrent theory.4 ConclusionThe results reported above are the very first steps toward the capability for GROOVE to incorpo-rate abstraction. We look upon this as a key factor in the eventual success of the tool. Thoughcurrently we have merely implemented the theory described in [BBKR08], we know from expe-rience that having the ability to actually experiment with smaller and larger cases provides a lotof additional motivation and can be a source of new ideas and developments.For instance, only a working implementation makes it possible to obtain figures about actualabstract state space sizes, which is one of the most important factors in the feasibility of anyabstraction-based methods. Some very first figures about the effect of increasing node multi-plicity bounds ν and radii i are collected in the following table. Clearly, the radius has a muchgreater effect on the state space size than the node multiplicity.ν = 1 ν = 2 ν = 3states trans. states trans. states trans.i = 1 10 21 14 29 18 37i = 2 389 1060 613 1486 969 2318Bibliography[BBKR08] J. Bauer, I. B. Boneva, M. E. Kurban, A. Rensink. A Modal-Logic Based Graph Abstraction.Pp. 321–335 in [EHRT08].[BKK03] P. Baldan, B. König, B. König. A Logic for Analyzing Abstractions of Graph Transforma-tion Systems. In Cousot (ed.), Static Analysis Symposium (SAS). LNCS 2694, pp. 255–272.Springer, 2003.[CC77] P. Cousot, R. Cousot. Abstract Interpretation: A Unified Lattice Model for Static Analysis ofPrograms by Construction or Approximation of Fixpoints. In POPL. Pp. 238–252. 1977.[EHRT08] H. Ehrig, R. Heckel, G. Rozenberg, G. Taentzer (eds.). International Conference on GraphTransformations (ICGT). LNCS 5214. Springer, 2008.[KK06] B. König, V. Kozioura. Counterexample-Guided Abstraction Refinement for the Analysisof Graph Transformation Systems. In Hermanns and Palsberg (eds.), Tools and Algorithms5 / 6 Volume X (2010)Neighbourhood Abstraction in GROOVE — Tool Paperfor the Construction and Analysis of Systems (TACAS). LNCS 3920, pp. 197–211. Springer,2006.[KK08] B. König, V. Kozioura. AUGUR2— A New Version of a Tool for the Analysis of Graph Trans-formation Systems. ENTCS 211:201–210, 2008.[RD06] A. Rensink, D. S. Distefano. Abstract Graph Transformation. In Mukhopadhyay et al. (eds.),Software Verification and Validation. ENTCS 157, pp. 39–59. May 2006.[Ren04] A. Rensink. Canonical Graph Shapes. In Schmidt (ed.), Programming Languages and Sys-tems (ESOP). LNCS 2986, pp. 401–415. Springer, 2004.[RN08] S. Rieger, T. Noll. Abstracting Complex Data Structures by Hyperedge Replacement. Pp. 69–83 in [EHRT08].[SRW98] S. Sagiv, T. W. Reps, R. Wilhelm. Solving Shape-Analysis Problems in Languages with De-structive Updating. ACM ToPLaS 20(1):1–50, 1998.[SRW02] S. Sagiv, T. W. Reps, R. Wilhelm. Parametric shape analysis via 3-valued logic. ACM ToPLaS24(3):217–298, 2002.Proc. GraBaTs 2010 6 / 6

Neighbourhood Abstraction in GROOVE - Tool Paper

A Logic for Analyzing Abstractions of Graph Transformation Systems.

A Modal-Logic Based Graph Abstraction.

Abstract Graph Transformation.

Abstract Interpretation: A Uniﬁed Lattice Model for Static Analysis of Programs by Construction or Approximation of Fixpoints.

Abstracting Complex Data Structures by Hyperedge Replacement.

AUGUR2— A New Version of a Tool for the Analysis of Graph Transformation Systems.

Canonical Graph Shapes.

Counterexample-Guided Abstraction Reﬁnement for the Analysis of Graph Transformation Systems.

Parametric shape analysis via 3-valued logic.

Solving Shape-Analysis Problems in Languages with Destructive Updating.

http://purl.utwente.nl/publications/72606

Neighbourhood Abstraction in GROOVE - Tool Paper

Abstract

Similar works

Full text

Available Versions

University of Twente Research Information