ATVA 2019: International Symposium on Automated Technology for Verification and Analysis

Murawski, AM

Ramsay, S

Tzevelekos, N

English

Queen Mary Research Online

ATVAEASY TO USECONSISTENTDOCUMENTEDCOMPLETEREPLICABLEArtifact* **APPROVEDDEQ: Equivalence Checker for DeterministicRegister AutomataA. S. Murawski1, S. J. Ramsay2, and N. Tzevelekos31 University of Oxford, UK2 University of Bristol, UK3 Queen Mary University of London, UKAbstract. Register automata are one of the most studied automata mod-els over infinite alphabets with applications in learning, systems modellingand program verification. We present an equivalence checker for determin-istic register automata, called DEQ, based on a recent polynomial-timealgorithm that employs group-theoretic techniques to achieve succinctrepresentations of the search space. We compare the performance of ourtool to other available implementations, notably in the learning libraryRALib and nominal frameworks LOIS and NLambda.Introduction Register automata [9,17] are one of the simplest models of com-putation over infinite alphabets. They operate on an infinite domain of data bystoring data values in a finite number of registers, where the values are availablefor future comparisons or updates. The automata can recognise when a datavalue does not appear in any of the registers or has not been seen so far at all [21].Recent years have seen a surge of interest in models over infinite alphabetsdue to their ability to account for computational scenarios with unbounded data.For instance, XML query languages [19] need to compare attribute values thatoriginate from infinite domains. In program verification there is need for ab-stractions of computations over infinite datatypes [9,7] and unbounded resources,such as Java objects [14] or ML references [16]. More broadly, they have beenadvocated as a convenient formalism for systems modelling, which fuelled interestin extending learning algorithms to the setting [18,3,1,5,13].This paper presents DEQ, a tool for verifying language equivalence of deter-ministic register automata (the nondeterministic case is undecidable [17]). Asmany of the above-mentioned applications rely on equivalence checking, severalimplementations are available online for comparison. We compare the perfor-mance of our tool to the equivalence routine from RALib [4] (a library for activelearning of register automata), and two others, programmed in the LOIS [11] andNLambda [10] frameworks. The equivalence-testing routine coded in NLambdahas recently been used as part of an automata learning framework [13].Our experiments show that DEQ compares favourably to its competitors.At the theoretical level, this is thanks to being based on the first polynomial-time algorithm [15] for the problem. The algorithm improves upon the “naive”algorithm that would expand a register automaton to a finite-state automaton over2 A. S. Murawski, S. J. Ramsay, and N. Tzevelekosp1 p2 p3push, 1• push, 2•pop, 1 pop, 2p1 p2 p3push, 1~ push, 2~pop, 1 pop, 2Fig. 1. Two size-2 “fresh” stacks.1 R = Rinit ; ∆ = {u0};2 while (∆ is not empty) do3 u = ∆.get();4 if u 6∈ Gen(R)5 if u fails 1-step test return NO;6 ∆.add(succ-set(u));7 R = R updated with u;8 return YESFig. 2. Algorithm in outline.a sufficiently large finite alphabet, often incurring an exponential blow-up. Ours isalso the only tool that can handle global freshness, i.e. the recognition/generationof values that have not been seen thus far during the course of computation. Thisis an important feature in the context of programming languages that makes itpossible to model object creation faithfully.Register automata Let D be an infinite set (alphabet). Its elements will becalled data values. Register automata are a simple model for modelling languagesand behaviours over such an alphabet. They operate over finitely many states and,in addition, are equipped with a finite number of registers, where they can storeelements of D. Each automaton transition can refer to the registers by requiringe.g. that the data value from a specific register be part of the transition’s labelor, alternatively, that the label feature a fresh data value: either not currently inthe registers, or globally fresh (never seen before), which could then be stored inone of the registers. Formally, transition labels are pairs (t, d), where t is a tagdrawn from a finite alphabet and d ∈ D. We write q t,i−→ q′ to specify transitionslabelled with (t, d) where t is a tag and d is the data value currently stored inregister i. Similarly, qt,i•−−→ q′ describes transitions labelled with (t, d), whered ∈ D is currently not stored in any registers. Once the transition fires, d will bestored in register i. In contrast, qt,i~−−→ q′ captures transitions with labels (t, d),where d ranges over all elements of D that have not yet been encountered by theautomaton (d is “globally fresh”).Consider the automaton at the top of Figure 1, which simulates a bounded“fresh” stack of size 2. By the latter we mean that the simulated stack can storeup to two 2 distinct data values. The automaton starts from state p1, with all itsregisters empty (erased). It can make a transition labelled with (push, d1), for anydata value d1, store it in register 1, and go to state p2. From there, it can eitherpop the data value already stored in register 1 and go back to p1 (also erasingthe register), or push another data value by making a transition (push, d2), forany data value d2 6= d1, and go to state p2. From there, it can pop the data valuealready stored in register 2 (and erase that register) and go to p1, and so on.The other automaton in Figure 1 (bottom) also simulates a 2-bounded freshstack, but it does so using globally fresh transitions. That is, each (push, d)DEQ: Equivalence Checker for Deterministic Register Automata 3transition made by the automaton is going to have a data value d that is differentfrom all data values used before. We can thus see that bisimilarity of the twoautomata will fail after one pop: the upper automaton will erase a data valuefrom its registers and, consequently, will be able to push the same data valueagain later. The automaton below, though, will always be pushing globally freshdata values. In other words, the following trace (push, d1) (pop, d1) (push, d1) ispermitted by the upper automaton, but not by the lower one.Implementation We have developed a command-line tool for deciding languageequivalence of this class of automata, implemented in Haskell4. The two inputautomata (DRA) are specified using an XML file format (parsed using thexml-conduit library [20]). Strictly speaking, the algorithm presented in [15]decides whether two states within the same automaton are bisimilar. Hence,our implementation first transforms the input (an instance of the languageequivalence problem for two DRA) into an instance of the bisimilarity problem,by constructing the disjoint union of the two automata.Our algorithm exploits the observation that (in the deterministic setting)language equivalence and bisimilarity are related, and it attempts to build abisimulation relation incrementally. To avoid exponential blow-ups, we rely onsymbolic representations based on (partial) permutations, which capture matchesbetween register content in various configurations. The outline of the algorithmis presented in Figure 2.The algorithm is similar in flavour to the classic Hopcroft-Karp algorithmfor DFA [8], which maintains sets of pairs of states. In contrast, we work withfour-tuples (q1, σ, q2, h), where q1, q2 are states, σ is a partial permutation andh is a parameter related to the number of registers. DEQ represents partialpermutations using an implementation of immutable integer maps that is basedon big endian patricia trees [12]. Most operations complete in amortized timeO(min(n,W )), where W is the number of bits of an integer. This is importantbecause manipulating partial permutations through insertion and deletion is atthe core of the innermost loop (line 7).Starting from a four-tuple u0, which represents the input equivalence problem,our implementation uses a queue ∆ (initialised to {u0}). This is used to store thefour-tuples that still need to be scrutinised to establish the original equivalence.Since the total number of possible four-tuples is exponential in the numberof registers (because one component is a partial permutation over the registerindexes), the algorithm prescribes a sophisticated compact representation calleda generating system. The generating system R represents the set of four-tuplesthat have already been analysed (its initial value Rinit contains four-tuples withidentical states and identity permutations).Each iteration of the loop considers a four-tuple u taken from the queue (line3): first we check if it is already generated by the generating system accumulatedso far (line 4). Querying the generating system for membership requires deciding ifa permutation belongs to a permutation group generated by R. For this purpose,4 The tool and its source are available at http://github.com/stersay/deq.4 A. S. Murawski, S. J. Ramsay, and N. Tzevelekos1101001000100001 10 100 1000 10000Deq (ms)NLambda (ms)11010010001 10 100 1000Deq (ms)LOIS (ms)1101001000100001 10 100 1000 10000Deq (ms)RALib−Eqcheck (ms)Fig. 3. Tool comparison.DEQ uses an implementation of the celebrated Schreier-Sims polynomial timegroup membership algorithm provided by the HaskellForMaths library [2].If the four-tuple is already generated we move on to the next iteration.Otherwise we check if the configurations represented by u can withstand a one-step attack in the corresponding bisimulation game (line 5). If u fails single-steptesting, the algorithm can immediately terminate and return NO. If u passes thetests, the algorithm generates a set succ-set(u) consisting of “successor four-tuples”that are added to ∆ for future verification (line 6). In this case, the generatingsystem is extended to represent u as well (line 7). For efficiency reasons, DEQfuses these two parts of the algorithm together. A collection of successors iscomputed by looping over all outgoing transitions relevant to u, and failing ifany cannot be constructed. In what follows we refer to this as the inner loop ofthe algorithm. The successor four-tuples are then added to the queue and thegenerating system R is extended so that it generates u.Case Studies In theory the worst-case performance of the algorithm is dom-inated by the complexity of permutation group membership testing, which isO(n5) for a straightforward implementation of the Schreier-Sims algorithm. In thefollowing series of case studies we examine the performance of our implementationoutside of the worst case, in particular where the group structure is quite simple.All the experiments were carried out on an Ubuntu 16.04 virtual machine,running on a Windows 10 host equipped with an Intel Core i7-8650U CPU at1.9GHz and 8GB of RAM. Z3 4.4.1 and OpenJDK 1.8.0 191 are used for thepurposes of running the tools LOIS and RALib-EqCheck (see below).Stack data structure (stacks) In this case study, we describe two families ofautomata simulating finite stacks, indexed by the stack size. Similar familieshave been considered within the nominal automata learning framework of [13].In both families of machines, the registers under their natural order are used inorder to store the elements of a stack, but one family “pushes” data into theregisters from right to left and the other from left to right (so the machines arenevertheless equivalent).By considering the plot of running time against stack size in Figure 4 (left), weconclude that any overhead due to the group membership algorithm is insignificantwhen the groups are easy to describe (as growth remains roughly quadratic in n).DEQ: Equivalence Checker for Deterministic Register Automata 5l l l l ll lll lll lllll lllllll ll050010000 100 200 300 400 500SizeTime (ms)l l l l l ll ll lll lllllllllllll010002000300040000 100 200 300 400 500SizeTime (ms)l l l l l ll ll llllllll040008000120000 20 40 60 80SizeTime (ms)Fig. 4. Tool scaling (stacks, glolo, cpt).Global simulating local freshness (glolo) In this case study we maintain a relativelysimple group structure in the generating system, but introduce globally freshtransitions. Due to the use of global freshness, no other tools will process thisexample. In this study we consider pairs of machines which first read and storeexactly r globally fresh names. Next, one machine reads a locally fresh name,whilst the other reads a globally fresh name, but because all of the history ofthe computation is stored in registers, local and global freshness coincide, andthe configurations are bisimilar. Associated run times are plotted in Figure 4(middle). It can be seen that the management of the history that is required bysupporting global freshness adds a linear factor: the curve displayed is a cubicpolynomial, fit using R’s lm algorithm.Partial permutations represented compactly (cpt) Here we consider a family ofinstances in which the collection of partial permutations occurring in constructedbisimulations is large.In the pairs of automata of this study, all r registers are initially populatedover the course of the first r states, but the order in which they are populatedmay differ. Afterwards, the machines may store a fresh letter in any register orread from any register, and return to the same state. Due to these possibilities,the correspondence between these states in the two machines can become com-plex. However, since all transitions are available to both automata, they willnevertheless be bisimilar, and hence accept the same language. Running timesare plotted in Figure 4 (right); the curve displayed is a fourth-degree polynomial.Tool comparison We can encode the stacks family of examples using the frame-works of LOIS [11] and NLambda [10], and directly as a set of inputs to RALib-EqCheck5 [4]. However, these other tools can only handle instances of relativelysmall size. This is not surprising, since they support classes of automata thatare much more general. In contrast, the polynomial time algorithm implementedby DEQ is highly specialised to a specific subclass. Hence, we have restrictedour comparison to stacks of size at most 15. The scatter plots in Figure 3 showthe running times of the three implementations compared on all possible pairs5 We used an unreleased implementation of the equivalence checking algorithm thatwas kindly communicated to us by F. Howar.6 A. S. Murawski, S. J. Ramsay, and N. Tzevelekosof stack sizes6. We can encode the cpt family of examples also as inputs toRALib-EqCheck; the results of comparing the two tools on this family (up tosize 5) is shown in light blue in the right-most plot of Figure 3. The results showquite clearly that DEQ can determine (in)equivalence several orders of magnitudefaster than the other tools.Acknowledgement Research funded by EPSRC (EP/J019577/1).References1. F. Aarts, P. Fiterau-Brostean, H. Kuppens, and F. W. Vaandrager. Learning registerautomata with fresh value generation. Proc. of ICTAC, LNCS 9399, 165–183, 2015.2. D. Amos. http://hackage.haskell.org/package/HaskellForMaths.3. B. Bollig, P. Habermehl, M. Leucker, and B. Monmege. A robust class of datalanguages and an application to learning. LMCS 10(4), 2014.4. S. Cassel, F. Howar, and B. Jonsson. RALib: A LearnLib extension for inferringEFSMs. Proc. of DIFTS, 2015.5. S. Cassel, F. Howar, B. Jonsson, and B. Steffen. Active learning for extended finitestate machines. Formal Asp. Comput., 28(2):233–263, 2016.6. M. L. Furst, J. E. Hopcroft, and E. M. Luks. Polynomial-time algorithms forpermutation groups. Proc. of FOCS, 36–41, 1980.7. R. Grigore, D. Distefano, R. L. Petersen, and N. Tzevelekos. Runtime verificationbased on register automata. In Proc. of TACAS, LNCS 7795, 260–276, 2013.8. J. E. Hopcroft and R. M. Karp. A linear algorithm for testing equivalence of finiteautomata. Technical Report 114, Cornell University, 1971.9. M. Kaminski and N. Francez. Finite-memory automata. TCS 134(2):329–363, 1994.10. B. Klin and M. Szynwelski. SMT solving for functional programming over infinitestructures. Proc. of MSFP, EPTCS 207, 57–75, 2016.11. E. Kopczyn´ski and S. Torun´czyk. LOIS. Proc. of POPL, 586–598, 2017.12. http://hackage.haskell.org/package/containers.13. J. Moerman, M. Sammartino, A. Silva, B. Klin, and M. Szynwelski. Learningnominal automata. Proc. of POPL, 613–625, 2017.14. A. S. Murawski, S. J. Ramsay, and N. Tzevelekos. A contextual equivalence checkerfor IMJ*. Proc. of ATVA, LNCS, 234–240, 2015.15. A. S. Murawski, S. J. Ramsay, and N. Tzevelekos. Polynomial-time equivalencetesting for deterministic fresh-register automata. Proc. of MFCS, 72:1–72:14, 2018.16. A. S. Murawski and N. Tzevelekos. Algorithmic nominal game semantics. Proc. ofESOP, LNCS 6602, 419–438, 2011.17. F. Neven, T. Schwentick, and V. Vianu. Finite state machines for strings overinfinite alphabets. ACM Trans. Comput. Log., 5(3):403–435, 2004.18. H. Sakamoto. Studies on the Learnability of Formal Languages via Queries. PhDthesis, Kyushu University, 1998.19. T. Schwentick. Automata for XML. J. Comput. Syst. Sci., 73(3):289–315, 2007.20. M. Snoyman and A. Breitkreuz. http://hackage.haskell.org/package/xml-conduit.21. N. Tzevelekos. Fresh-register automata. Proc. of POPL, 295–306, 2011.6 The encoding used for the comparison with RALib-EqCheck was slightly modified toreflect certain structural constraints imposed by that tool. This alternative encodingis larger and hence runtimes are not comparable with the other two experiments.Note that the timing data for RALib-EqCheck contains JVM start-up time.

DEQ : Equivalence Checker for Deterministic Register Automata

https://qmro.qmul.ac.uk/xmlui/bitstream/handle/123456789/59154/Tzevelekos%20DEQ%20%3a%20Equivalence%20Checker%202019%20Published.pdf?sequence=2&isAllowed=y

DEQ : Equivalence Checker for Deterministic Register Automata

Abstract

Similar works

Full text

Available Versions

Queen Mary Research Online