Solving Existentially Quantified Horn Clauses

Abstract

Abstract. Temporal verification of universal (i.e., valid for all computation paths) properties of various kinds of programs, e.g., procedural, multi-threaded, or functional, can be reduced to finding solutions for equations in form of universally quantified Horn clauses extended with well-foundedness conditions. Dealing with existential properties (e.g., whether there exists a particular computation path), however, requires solving forall-exists quantified Horn clauses, where the conclusion part of some clauses contains existentially quantified variables. For example, a deductive approach to CTL verification reduces to solving such clauses. In this paper we present a method for solving forall-exists quantified Horn clauses extended with well-foundedness conditions. Our method is based on a counterexample-guided abstraction refinement scheme to discover witnesses for existentially quantified variables. We also present an application of our solving method to automation of CTL verification of software, as well as its experimental evaluation.

On Automation of CTL* Verification for Infinite-State Systems

“…Our runtimes show that our tool runs well within the range of performance previously exhibited by specialized tools such as as [10,12,8,3,11], which can only verify significantly less expressive properties over infinite-state programs. Our tool has successfully both verified and invalidated CTL * properties corresponding to their expected results for all but one of the benchmarks.…”

“…Existing tools which support this functionality include [3] and [11]. In our tool prototype, we build upon the latter.…”

“…expressed in CTL) or lineartime properties (e.g. LTL) of general integer manipulating programs [3,12,10,8,11]. Branching-time property verification requires reasoning about sets of states within a transition system that satisfy a particular temporal formula.…”

“…Existing automated tools for verification of infinite-state programs support either branching-time only or linear-time only reasoning, e.g., [5,10,12,8,3,11,27]. The important distinction however is that these tools do not allow for the interaction between linear-time and branching-time formulae.…”

“…It is, in principle, applicable to every class of infinite-state systems for which such procedures are available (provided that integer variables are allowed). Addition-ally, our procedure is not complete as we use a series of techniques for safety [24], termination [25,9], nontermination [19], and CTL [3,11] that are not complete. Furthermore, our determinization procedure is not complete.…”