Invariant Checking for SMT-Based Systems with Quantifiers
Authors: 
Gianluca Redondi, Alessandro Cimatti, Alberto Griggio, Kenneth L. McmillanAuthors Info & Claims
Gianluca Redondi, Alessandro Cimatti, Alberto Griggio, Kenneth L. McmillanAuthors Info & ClaimsArticle No.: 24, Pages 1 - 37
Abstract
This article addresses the problem of checking invariant properties for a large class of symbolic transition systems defined by a combination of SMT theories and quantifiers. State variables can be functions from an uninterpreted sort (finite but unbounded) to an interpreted sort, such as the integers under the theory of linear arithmetic. This formalism is very expressive and can be used for modeling parameterized systems, array-manipulating programs, and more. We propose two algorithms for finding universal inductive invariants for such systems. The first algorithm combines an IC3-style loop with a form of implicit predicate abstraction to construct an invariant in an incremental manner. The second algorithm constructs an under-approximation of the original problem and searches for a formula which is an inductive invariant for this case; then, the invariant is generalized to the original case and checked with a portfolio of techniques. We have implemented the two algorithms and conducted an extensive experimental evaluation, considering various benchmarks and different tools from the literature. As far as we know, our method is the first capable of handling in a large class of systems in a uniform way. The experiment shows that both algorithms are competitive with the state of the art.
References
[1]
Francesco Alberti, Silvio Ghilardi, Elena Pagani, Silvio Ranise, and Gian Paolo Rossi. 2012. Universal Guards, Relativization of Quantifiers, and Failure Models in Model Checking Modulo Theories. Journal on Satisfiability, Boolean Modeling and Computation 8 (2012), 29–61.
[2]
Arturo Amendola, Anna Becchi, Roberto Cavada, Alessandro Cimatti, Alberto Griggio, Giuseppe Scaglione, Angelo Susi, Alberto Tacchella, and Matteo Tessi. 2020. A Model-Based Approach to the Design, Verification and Deployment of Railway Interlocking System. In Proceedings of the 9th International Symposium on Leveraging Applications of Formal Methods, Verification and Validation: Applications (ISoLA ’20), Lecture Notes in Computer Science, Vol. 12478, Springer, 240–254.
[3]
Haniel Barbosa, Clark W. Barrett, Martin Brain, Gereon Kremer, Hanna Lachnitt, Makai Mann, Abdalrhman Mohamed, Mudathir Mohamed, Aina Niemetz, Andres Nötzli, Alex Ozdemir, Mathias Preiner, Andrew Reynolds, Ying Sheng, Cesare Tinelli, and Yoni Zohar. 2022. cvc5: A Versatile and Industrial-Strength SMT Solver. In Proceedings of the 28th International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS ’22), Lecture Notes in Computer Science, Vol. 13243, Springer, 415–442.
[4]
Roderick Bloem, Swen Jacobs, and Ayrat Khalimov. 2015. Decidability of Parameterized Verification. Morgan & Claypool Publishers.
[5]
Aaron R. Bradley. 2011. SAT-Based Model Checking without Unrolling. In Verification, Model Checking, and Abstract Interpretation. Ranjit Jhala and David Schmidt (Eds.), Springer, Berlin, 70–87.
[6]
Danilo Bruschi, Andrea Di Pasquale, Silvio Ghilardi, Andrea Lanzi, and Elena Pagani. 2022. A Formal Verification of ArpON – A Tool for Avoiding Man-in-the-Middle Attacks in Ethernet Networks. IEEE Transactions on Dependable and Secure Computing 19, 6 (2022), 4082–4098.
[7]
Alessandro Carioni, Silvio Ghilardi, and Silvio Ranise. 2012. MCMT in the Land of Parametrized Timed Automata. In VERIFY-2010. Proceedings of the 6th International Verification Workshop (VERIFY ’10). Markus Aderhold, Serge Autexier, and Heiko Mantel (Eds.), EPiC Series in Computing, Vol. 3, EasyChair, 47–64. 2398–7340
[8]
Ching-Tsun Chou, Phanindra K. Mannava, and Seungjoon Park. 2004. A Simple Method for Parameterized Verification of Cache Coherence Protocols. In Formal Methods in Computer-Aided Design. Alan J. Hu and Andrew K. Martin (Eds.), Springer, Berlin, 382–398.
[9]
Alessandro Cimatti, Alberto Griggio, Sergio Mover, and Stefano Tonetta. 2016. Infinite-State Invariant Checking with IC3 and Predicate Abstraction. Formal Methods in SystemDesign 49, 3 (2016), 190–218.
[10]
Alessandro Cimatti, Alberto Griggio, and Gianluca Redondi. 2021a. Universal Invariant Checking of Parametric Systems with Quantifier-Free SMT Reasoning. In Proceedings of the 28th International Conference on Automated Deduction (CADE ’21), 28.
[11]
Alessandro Cimatti, Alberto Griggio, and Gianluca Redondi. 2022. Verification of SMT Systems with Quantifiers. In Proceedings of the 20th International Symposium on Automated Technology for Verification and Analysis (ATVA ’22). Ahmed Bouajjani, Lukás Holík, and Zhilin Wu (Eds.), Lecture Notes in Computer Science, Vol. 13505, Springer, 154–170.
[12]
Alessandro Cimatti, Alberto Griggio, Bastiaan Joost Schaafsma, and Roberto Sebastiani. 2013. The MathSAT5 SMT Solver. In Proceedings of the Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS ’13). N. Piterman and S. A. Smolka (Eds.), Springer-Verlag, Berlin.
[13]
Alessandro Cimatti, Alberto Griggio, and Roberto Sebastiani. 2010. Efficient Generation of Craig Interpolants in Satisfiability modulo Theories. ACM Transactions on Computational Logic 12, 1 (nov 2010), Article 7, 54 pages. DOI:
[14]
Alessandro Cimatti, Alberto Griggio, and Stefano Tonetta. 2021b. The VMT-lib Language and Tools. arXiv:2109.12821. Retrieved from https://arxiv.org/abs/2109.12821
[15]
Alessandro Cimatti, Ivan Stojic, and Stefano Tonetta. 2018. Formal Specification and Verification of Dynamic Parametrized Architectures. In Proceedings of the International Conference on Formal Methods (FM ’18). K. Havelund, J. Peleska, B. Roscoe, and E. de Vink (Eds.), Lecture Notes in Computer Science, Vol. 10951, Springer, Cham.
[16]
Edmund M. Clarke, Orna Grumberg, Somesh Jha, Yuan Lu, and Helmut Veith. 2003. Counterexample-Guided Abstraction Refinement for Symbolic Model Checking. Journal of the ACM 50, 5 (2003), 752–794. DOI:
[17]
Sylvain Conchon, Amit Goel, Sava Krstic, Alain Mebsout, and Fatiha Zaïdi. 2012. Cubicle: A Parallel SMT-based Model Checker for Parameterized Systems. In Proceedings of the 24th international conference on Computer Aided Verification (CAV ’12).
[18]
Sylvain Conchon, Amit Goel, Sava Krstic, Alain Mebsout, and Fatiha Zaïdi. 2013. Invariants for Finite Instances and Beyond. In Proceedings of the International Conference on Formal Methods in Computer-Aided Design (FMCAD ’13).
[19]
Leonardo Mendonça de Moura and Nikolaj Bjørner. 2008. Z3: An Efficient SMT Solver. In Proceedings of the Theory and Practice of Software, 14th International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS).
[20]
David Detlefs, Greg Nelson, and James B. Saxe. 2005. Simplify: A Theorem Prover for Program Checking. Journal of the ACM 52, 3 (2005), 365–473.
[21]
Michael Dooley and Fabio Somenzi. 2016. Proving Parameterized Systems Safe by Generalizing Clausal Proofs of Small Instances. In Proceedings of the International Conference on Computer Aided Verification (CAV ’16). S. Chaudhuri and A. Farzan (Eds.), Lecture Notes in Computer Science, Vol. 9779, Springer, Cham.
[22]
Yotam M. Y. Feldman, Oded Padon, Neil Immerman, Mooly Sagiv, and Sharon Shoham. 2019. Bounded Quantifier Instantiation for Checking Inductive Invariants. Logical Methods in Computer Science 15, 3 (2019), 1–47.
[23]
Yeting Ge, Clark Barrett, and Cesare Tinelli. 2009. Solving Quantified Verification Conditions Using Satisfiability Modulo Theories. Annals of Mathematics and Artificial Intelligence 55, 1–2 (Feb 2009), 101–122.
[24]
Silvio Ghilardi, Enrica Nicolini, Silvio Ranise, and Daniele Zucchelli. 2008. Towards SMT Model Checking of Array-Based Systems. In Automated Reasoning. Alessandro Armando, Peter Baumgartner, and Gilles Dowek (Eds.), Springer, Berlin, 67–82.
[25]
Silvio Ghilardi and Silvio Ranise. 2010. Backward Reachability of Array-based Systems by SMT Solving: Termination and Invariant Synthesis. Logical Methods in Computer Science 6, 4 (2010), 1–48.
[26]
Aman Goel and Karem A. Sakallah. 2021. On Symmetry and Quantification: A New Approach to Verify Distributed Protocols. In Proceedings of the 13th International Symposium on NASA Formal Methods (NFM ’21).
[27]
Aman Goel and Karem A. Sakallah. 2021. Towards an Automatic Proof of Lamport's Paxos. In Proceedings of the International Conference on Formal Methods in Computer Aided Design (FMCAD ’21). IEEE, 112–122.
[28]
Arie Gurfinkel, Sharon Shoham, and Yuri Meshman. 2016. SMT-Based Verification of Parameterized Systems. In Proceedings of the 2016 24th ACM SIGSOFT International Symposium on Foundations of Software Engineering (FSE ’16). ACM, New York, NY, 338–348.
[29]
Travis Hance, Marijn Heule, Ruben Martins, and Bryan Parno. 2021. Finding Invariants of Distributed Systems: It's a Small (Enough) World After All. In Proceedings of the 18th USENIX Symposium on Networked Systems Design and Implementation (NSDI ’21). USENIX Association, 115–131.
[30]
Alexander Ivrii, Arie Gurfinkel, and Anton Belov. 2014. Small Inductive Safe Invariants. In Proceedings of the 14th Conference on Formal Methods in Computer-Aided Design (FMCAD ’14). IEEE, 115–122.
[31]
A. Karbyshev, N. Bjørner, S. Itzhaky, N. Rinetzky, and S. Shoham. 2015. Property-Directed Inference of Universal Invariants or Proving Their Absence. In Proceedings of the 27th International Conference on Computer Aided Verification. Daniel Kroening and Corina S. Păsăreanu (Eds.), Lecture Notes in Computer Science, Vol. 9206, Springer, Cham, 583–602.
[32]
Jason R. Koenig, Oded Padon, Neil Immerman, and Alex Aiken. 2020. First-Order Quantified Separators. In Proceedings of the 41st ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI ’20).
[33]
Laura Kovács and Andrei Voronkov. 2013. First-Order Theorem Proving and Vampire. In Proceedings of the 25th International Conference on Computer Aided Verification (CAV ’13).
[34]
Sava Krstic. 2005. Parametrized System Verification with Guard Strengthening and Parameter Abstraction. In Automated Verification of Infinite State Systems.
[35]
Shuvendu K. Lahiri, Thomas Ball, and Byron Cook. 2005. Predicate Abstraction via Symbolic Decision Procedures. In Proceedings of the 17th International Conference on Computer Aided Verification (CAV ’05). Kousha Etessami and Sriram K. Rajamani (Eds.), Lecture Notes in Computer Science, Vol. 3576, Springer, 24–38.
[36]
Shuvendu K. Lahiri and Randal E. Bryant. 2007. Predicate Abstraction with Indexed Predicates. ACM Transactions on Computational Logic 9, 1 (Dec 2007), 4–es.
[37]
Shuvendu K. Lahiri, Robert Nieuwenhuis, and Albert Oliveras. 2006. SMT Techniques for Fast Predicate Abstraction. In Computer Aided Verification. Thomas Ball and Robert B. Jones (Eds.), Springer, Berlin, 424–437.
[38]
Yongjian Li, Kaiqiang Duan, David N. Jansen, Jun Pang, Lijun Zhang, Yi Lv, and Shaowei Cai. 2018. An Automatic Proving Approach to Parameterized Verification. ACM Transactions on Computational Logic 19, 4 (Nov 2018), Article 27, 25 pages.
[39]
Haojun Ma, Aman Goel, Jean-Baptiste Jeannin, Manos Kapritsos, Baris Kasikci, and Karem A. Sakallah. 2019. I4: Incremental Inference of Inductive Invariants for Verification of Distributed Protocols. In Proceedings of the 27th ACM Symposium on Operating Systems Principles (SOSP ’19). 15 pages.
[40]
Makai Mann, Ahmed Irfan, Alberto Griggio, Oded Padon, and Clark W. Barrett. 2021. Counterexample-guided prophecy for model checking modulo the theory of arrays. arXiv:2101.06825.
[41]
Kenneth L. McMillan. 2006. Lazy Abstraction with Interpolants. In Computer Aided Verification. Thomas Ball and Robert B. Jones (Eds.), Springer, Berlin, 123–136.
[42]
Kenneth L. McMillan. 2018. Eager Abstraction for Symbolic Model Checking. In Computer Aided Verification. Hana Chockler and Georg Weissenbacher (Eds.), Springer International Publishing, Cham, 191–208.
[43]
Oded Padon. 2018. Deductive Verification of Distributed Protocols in First-Order Logic. In Proceedings of the Formal Methods in Computer Aided Design (FMCAD), 1.
[44]
Oded Padon, Neil Immerman, Sharon Shoham, Aleksandr Karbyshev, and Mooly Sagiv. 2016. Decidability of Inferring Inductive Invariants. ACM SIGPLAN Notices 51, 1 (Jan 2016), 217–231.
[45]
Oded Padon, Kenneth L. McMillan, Aurojit Panda, Mooly Sagiv, and Sharon Shoham. 2016. Ivy: Safety Verification by Interactive Generalization. ACM SIGPLAN Notices 51, 6 (Jun 2016), 614–630.
[46]
Oded Padon, James R. Wilcox, Jason R. Koenig, Kenneth L. McMillan, and Alex Aiken. 2022. Induction Duality: Primal-Dual Search for Invariants. Proceedings of the ACM on Programming Languages 6, POPL (2022), 1–29.
[47]
Amir Pnueli, Sitvanit Ruah, and Lenore D. Zuck. 2001. Automatic Deductive Verification with Invisible Invariants. In Proceedings of the International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS). T. Margaria and W. Yi (Eds.), Lecture Notes in Computer Science, Vol. 2031, Springer, Berlin.
[48]
Andrew Reynolds. 2017. Quantifier Instantiation Beyond E-Matching. In Proceedings of the International Conference on Computer Aided Verification (CAV ’17). Martin Brain and Liana Hadarean (Eds.).
[49]
M. Talupur and M. R. Tuttle. 2008. Going with the Flow: Parameterized Verification Using Message Flows. In Proceedings of the International Conference on Formal Methods in Computer-Aided Design, 1–8.
[50]
Stefano Tonetta. 2009. Abstract Model Checking without Computing the Abstraction. In Proceedings of the International Conference on Formal Methods (FM ’09). Ana Cavalcanti and Dennis R. Dams (Eds.), Springer, Berlin, 89–105.
[51]
Cole Vick and Kenneth L. McMillan. 2023. Synthesizing History and Prophecy Variables for Symbolic Model Checking. In Proceedings of the 24th International Conference on Verification, Model Checking, and Abstract Interpretation (VMCAI ’23). Cezara Dragoi, Michael Emmi, and Jingbo Wang (Eds.), Lecture Notes in Computer Science, Vol. 13881, Springer, 320–340.
[52]
Jianan Yao, Runzhou Tao, Ronghui Gu, Jason Nieh, Suman Jana, and Gabriel Ryan. 2021. DistAI: Data-Driven Automated Invariant Learning for Distributed Protocols. In Proceedings of the 15th USENIX Symposium on Operating Systems Design and Implementation (OSDI 21).
Index Terms
- Invariant Checking for SMT-Based Systems with Quantifiers
Recommendations
Certifying proofs for SAT-based model checking
AbstractIn the context of formal verification, certifying proofs are evidences of the correctness of a model in a deduction system produced automatically as outcome of the verification. They are quite appealing for high-assurance systems because they can ...
Infinite-state invariant checking with IC3 and predicate abstraction
We address the problem of verifying invariant properties on infinite-state systems. We present a novel approach, IC3ia, for generalizing the IC3 invariant checking algorithm from finite-state to infinite-state transition systems, expressed over some ...
SMT-based Bounded Model Checking for Weighted Interpreted Systems and for Weighted Epistemic ECTL
AAMAS '15: Proceedings of the 2015 International Conference on Autonomous Agents and Multiagent SystemsWe define the SMT-based bounded model checking (BMC) method for Weighted Interpreted Systems and for the existential fragment of the Weighted Epistemic Computation Tree Logic. We implemented the new BMC algorithm and compared it with the SAT-based BMC ...
Comments
Information & Contributors
Information
Published In
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].
Publisher
Association for Computing Machinery
New York, NY, United States
Publication History
Published: 29 October 2024
Online AM: 03 August 2024
Accepted: 24 July 2024
Revised: 10 May 2024
Received: 13 November 2023
Published in TOCL Volume 25, Issue 4
Check for updates
Author Tags
Qualifiers
- Research-article
Contributors
Other Metrics
Bibliometrics & Citations
Bibliometrics
Article Metrics
- 0Total Citations
- 131Total Downloads
- Downloads (Last 12 months)131
- Downloads (Last 6 weeks)15
Reflects downloads up to 30 Jan 2025
Other Metrics
Citations
View Options
Login options
Check if you have access through your login credentials or your institution to get full access on this article.
Sign in