Refinement Selection

Counterexample-guided abstraction refinement (CEGAR) is a commonly-used approach for the automatic construction of an abstract model of a given program. It uses information learned from infeasible error paths to guide the verification process. We address the problem of selecting which information to learn from a given infeasible error path. Previously, we presented a method that can extract a set of sliced path prefixes from a given infeasible error path, each of which can be used for refining the abstract model. We showed that the choice which sliced path prefix is used for refinement significantly impacts effectiveness and efficiency of the analysis. In this work, we extend existing work in three directions: (1) we adopt the idea to generate sliced path prefixes to a new domain, namely one based on predicate abstraction, (2) we define and investigate several promising heuristics for selecting an appropriate refinement, and (3) we enable a completely new combination of a value analysis and a predicate analysis that does not only find out which information to learn from an infeasible error path, but automatically decides which analysis is best to be refined. These contributions allow a more systematic refinement strategy for CEGAR-based analyses. We implemented the new algorithms in the verification framework CPAchecker and make our work publicly available. In a thorough experimental study, we show that refinement selection often avoids state-space explosion in cases where existing approaches diverge, and that it can be even more powerful if applied on a higher level where it dictates which analysis of a combination is best to be refined.