Proving Cutoff Bounds for Safety Properties in First-Order Logic

Raz Lotan,Eden Frenkel,Sharon Shoham
2024-08-20
Abstract:First-order logic has been established as an important tool for modeling and verifying intricate systems such as distributed protocols and concurrent systems. These systems are parametric in the number of nodes in the network or the number of threads, which is finite in any system instance, but unbounded. One disadvantage of first-order logic is that it cannot distinguish between finite and infinite structures, leading to spurious counterexamples. To mitigate this, we offer a verification approach that captures only finite system instances. Our approach is an adaptation of the cutoff method to systems modeled in first-order logic. The idea is to show that any safety violation in a system instance of size larger than some bound can be simulated by a safety violation in a system of a smaller size. The simulation provides an inductive argument for correctness in finite instances, reducing the problem to showing safety of instances with bounded size. To this end, we develop a framework to (i) encode such simulation relations in first-order logic and to (ii) validate the simulation relation by a set of verification conditions given to an SMT solver. We apply our approach to verify safety of a set of examples, some of which cannot be proven by a first-order inductive invariant.
Logic in Computer Science,Programming Languages
What problem does this paper attempt to address?
The problem that this paper attempts to solve is: how to verify the safety properties of parameterized systems in first - order logic under the finite - domain semantics. Specifically, the paper proposes a new verification method to overcome the shortcoming of first - order logic in being unable to distinguish between finite and infinite structures, thereby avoiding spurious counterexamples caused by infinite structures. By introducing a cutoff method based on size - reducing simulation, the paper aims to prove that for any system instance exceeding a certain bound, its safety violation can be simulated in a smaller system instance, thus simplifying the problem to verifying instances of a finite size. ### Problem Background First - Order Logic (FOL), as a powerful formal tool, is widely used for modeling and verifying complex systems, such as distributed protocols and concurrent systems. These systems are usually parameterized by the number of nodes or threads in the network. Although these quantities are finite in any specific system instance, they are theoretically unbounded. However, one shortcoming of first - order logic is that it cannot distinguish between finite and infinite structures, which may lead to spurious counterexamples. ### Core Problems of the Paper To meet this challenge, the paper proposes a new verification method, that is, to verify safety properties in first - order logic through size - reducing simulation. Specifically, the paper attempts to solve the following problems: 1. **Problem of Spurious Counterexamples**: Since first - order logic cannot distinguish between finite and infinite structures, spurious counterexamples caused by infinite structures may occur. 2. **Problem of Verification Complexity**: For parameterized systems, it is very difficult to directly verify all possible instances. 3. **Limitations of Inductive Invariants**: In some cases, it is difficult to express appropriate inductive invariants in first - order logic. ### Solutions The paper proposes a cutoff method based on size - reducing simulation. The main contributions include: 1. **Defining Finite - Domain Semantics**: Only consider the first - order logic semantics of finite instances. 2. **Introducing Size - Reducing Simulation**: By proving that the safety violation of a larger instance can be simulated in a smaller instance, the problem is simplified to verifying instances of a finite size. 3. **Developing a Verification Framework**: Provide a framework to encode and verify size - reducing simulation relations and use SMT solvers to automatically verify these relations. ### Conclusion Through this method, the paper not only solves the problem of spurious counterexamples caused by infinite structures but also provides an effective verification means, which is applicable to those system instances that cannot be verified by inductive invariants.