Abstract Counterexample-based Refinement for Powerset Domains R. Manevich1,†, J. Field2 , T. A. Henzinger3,§, G. Ramalingam4,¶, and M. Sagiv1 1 Tel Aviv University, {rumster,msagiv}@tau.ac.il 2 IBM T.J. Watson Research Center,
[email protected] 3 EPFL,
[email protected] 4 Microsoft Research India,
[email protected] Abstract. Counterexample-guided abstraction refinement (CEGAR) is a powerful technique to scale automatic program analysis techniques to large programs. However, so far it has been used primarily for model checking in the context of predicate abstraction. We formalize CEGAR for general powerset domains. If a spurious abstract counterexample needs to be removed through abstraction refinement, there are often several choices, such as which program location(s) to refine, which ab- stract domain(s) to use at different locations, and which abstract values to compute. We define several plausible preference orderings on abstrac- tion refinements, such as refining as “late” as possible and as “coarse” as possible. We present generic algorithms for finding refinements that are optimal with respect to the different preference orderings. We also compare the different orderings with respect to desirable properties, in- cluding the property if locally optimal refinements compose to a global optimum. Finally, we point out some difficulties with CEGAR for non- powerset domains. 1 Introduction The CEGAR (Counterexample-guided Abstraction Refinement) paradigm [1, 3] has been the subject of a significant body of work in the automatic verification community. The basic idea is as follows. First, we statically analyze a program using a given abstraction. When an error is discovered, the analyzer generates an abstract counterexample, and checks whether the error occurs in the corre- sponding concrete execution path.