[Paper Review] Improved Static Analysis of Parameterised Boolean Equation Systems using Control Flow Reconstruction

Jeroen J. A. Keiren, J.W. Wesselink+1 more|arXiv (Cornell University)|Apr 24, 2013

Formal Methods in Verification15 references3 citations

TL;DR

This paper presents a sound static analysis technique for Parameterised Boolean Equation Systems (PBESs) that reduces combinatorial explosion during instantiation by reconstructing control flow graphs (CFGs) and eliminating dead parameters. By applying liveness analysis to control flow parameters (CFPs), the method simplifies PBESs before solving, achieving up to 97% reduction in underlying Boolean Equation System (BES) size and significantly improved solving performance, with negligible overhead when no reduction is possible.

ABSTRACT

We present a sound static analysis technique for fighting the combinatorial explosion of parameterised Boolean equation systems (PBESs). These essentially are systems of mutually recursive fixed point equations ranging over first-order logic formulae. Our method detects parameters that are not live by analysing a control flow graph of a PBES, and it subsequently eliminates such parameters. We show that a naive approach to constructing a control flow graph, needed for the analysis, may suffer from an exponential blow-up, and we define an approximate analysis that avoids this problem. The effectiveness of our techniques is evaluated using a number of case studies.

Motivation & Objective

• To address the combinatorial explosion in solving PBESs via instantiation to Boolean Equation Systems (BESs), which often leads to intractable state space sizes.
• To develop a static analysis technique that identifies and removes parameters that are not live in a PBES, thereby simplifying the system before solving.
• To construct a control flow graph (CFG) for PBESs using control flow parameters (CFPs), enabling liveness analysis similar to compiler optimizations.
• To provide an optimized variant of the analysis that avoids exponential blow-up in CFG construction while retaining strong reduction capabilities.
• To evaluate the method on real-world model checking and equivalence checking problems, demonstrating superior reduction and performance gains over existing techniques.

Proposed method

• The method constructs a control flow graph (CFG) for a PBES based on control flow parameters (CFPs), which represent the flow of execution through predicate variable instances.
• It applies liveness analysis to the CFG to identify parameters that are not live—i.e., those that do not affect the final solution—thereby enabling their removal from the PBES.
• A naive CFG construction may lead to exponential blow-up in size due to the number of CFPs; thus, the method introduces an approximate, optimized analysis that trades some reductive power for lower complexity.
• The approach integrates with existing PBES solving pipelines, particularly instantiation to BESs, and is implemented in the mCRL2 toolset for practical evaluation.
• The technique leverages compiler-style liveness analysis and state space reduction techniques to simplify PBESs prior to solving.
• The method is sound: simplifying a PBES using this analysis preserves the solution of the original system.

Experimental results

Research questions

• RQ1 Can control flow reconstruction in PBESs enable the detection of non-live parameters to reduce the size of the underlying Boolean Equation System (BES)?
• RQ2 How can a control flow graph (CFG) be meaningfully defined for PBESs, given their lack of explicit program counter semantics?
• RQ3 What is the trade-off between reduction power and computational complexity when constructing CFGs for PBESs?
• RQ4 To what extent can this static analysis outperform existing techniques like pbesparelm in reducing BES size and improving solving time?
• RQ5 Can the method scale to large, real-world PBESs from model checking and equivalence checking, and what performance gains are achievable?

Key findings

• The proposed method achieved up to 97% additional reduction in BES size compared to the pbesparelm technique, particularly in complex cases like Hesselink’s register model checking.
• For the Hesselink I-S model checking problem, the method reduced the BES size by 93% compared to the original, while pbesparelm achieved only 0% reduction.
• In equivalence checking, the method reduced the BES size by 44% for Buf-Onebit with 4 parameters, compared to 32% with pbesparelm, demonstrating superior reductive power.
• The optimized version of the analysis, while achieving slightly less reduction than the full version, was significantly faster and incurred negligible overhead when no reduction was possible.
• In cases where no reduction was achieved, the method's overhead was minimal, and in most cases, the total solving time was not negatively impacted.
• The experiments confirm that using the local stategraph algorithm with the new analysis is often faster than the global stategraph algorithm, even when the reduction is smaller.