Universal Guards, Relativization of Quantifiers, and Failure Models in Model Checking Modulo Theories

Abstract

Model Checking Modulo Theories is a recent approach for the automated verification of safety properties of a class of infinite state systems manipulating arrays, called arraybased systems. The idea is to repeatedly compute pre-images of a set of (unsafe) states by using certain classes of first-order formulae representing sets of states and transitions, and then reduce fix-point checks to Satisfiability Modulo Theories problems. Unfortunately, if the guards contain universally quantified index variables, the backward procedure cannot be fully automated. In this paper, we overcome the problem by describing a syntactic transformation on array-based systems, which can be seen as an instance of the well-known operation of relativization of quantifiers in first-order logic. Interestingly, when specifying and verifying distributed systems, the proposed syntactic transformation can be interpreted as the adoption of the crash-failure model, which is well-known in the literature of fault-tolerant systems. By eliminating universal quantifiers from guards, the transformation significantly extends the scope of applicability of the symbolic backward reachability procedure. To provide empirical evidence of this claim, we discuss our findings in applying the proposed technique to a significant case-study in the verification of some classical algorithms for reliable broadcast.

Verification of Concurrent Design Patterns with Data

“…Later, many different works addressing various classes of infinite-state systems and/or parameterised topologies have been published, using combinations of approaches, often including predicate abstraction and SMT satisfiability (e.g. [1,16,20,21,25]). With respect to these, we use symbolic representations not only to get a finite representation of infinite spaces, but also to express the (data-sensitive) synchronisations with the environment, making our models suitable for compositional verification.…”

Scalable automated symbolic analysis of administrative role-based access control policies by SMT solving1

“…The minimal requirement for the mechanization of this procedure is the decidability of the satisfiability modulo T n RBAC of formulae of the form (7). That this is indeed the case can be seen by a reduction to the satisfiability problem of formulae in the Bernays-Shönfinkel-Ramsey (BSR) class [25], which is wellknown to be decidable.…”

“…The reduction consists of the following two observations. First, it is possible to re-write any instance of (7) to an equivalent BSR formula as follows. We start considering the case n = 0; by definition, (7) is I(ua 0 ) ∧ G(ua 0 ).…”

“…First, it is possible to re-write any instance of (7) to an equivalent BSR formula as follows. We start considering the case n = 0; by definition, (7) is I(ua 0 ) ∧ G(ua 0 ). By assumption, I is of the form ∀x 1 .ϕ 1 (ua, x 1 ) and G is of the form ∃x 2 .ϕ 2 (ua, x 2 ) for quantifier-free formulae ϕ 1 and ϕ 2 .…”

Monotonic Abstraction Techniques: from Parametric to Software Model Checking

“…[6,7]). The approach has been reformulated in [16,17] within the declarative context of array-based systems [34] in order to apply it to the verification of reliable broadcast algorithms [39] in a fault-tolerant environment. The declarative reformulation makes clear that monotonic abstraction can be viewed operationally as a purely symbolic manipulation applying quantifier instantiation in order to overapproximate sets of states represented via ∃ * ∀-formulae.…”