Abstract:First-order logic, and quantifiers in particular, are widely used in deductive verification. Quantifiers are essential for describing systems with unbounded domains, but prove difficult for automated solvers. Significant effort has been dedicated to finding quantifier instantiations that establish unsatisfiability, thus ensuring validity of a system's verification conditions. However, in many cases the formulas are satisfiable: this is often the case in intermediate steps of the verification process. For such cases, existing tools are limited to finding finite models as counterexamples. Yet, some quantified formulas are satisfiable but only have infinite models. Such infinite counter-models are especially typical when first-order logic is used to approximate inductive definitions such as linked lists or the natural numbers. The inability of solvers to find infinite models makes them diverge in these cases. In this paper, we tackle the problem of finding such infinite models. These models allow the user to identify and fix bugs in the modeling of the system and its properties. Our approach consists of three parts. First, we introduce symbolic structures as a way to represent certain infinite models. Second, we describe an effective model finding procedure that symbolically explores a given family of symbolic structures. Finally, we identify a new decidable fragment of first-order logic that extends and subsumes the many-sorted variant of EPR, where satisfiable formulas always have a model representable by a symbolic structure within a known family. We evaluate our approach on examples from the domains of distributed consensus protocols and of heap-manipulating programs. Our implementation quickly finds infinite counter-models that demonstrate the source of verification failures in a simple way, while SMT solvers and theorem provers such as Z3, cvc5, and Vampire diverge.

Algorithmic Verification of Intransitive Noninterference for 3-Domain Security Policies with A Sat Solver

Analysis for Intransitive Noninterference Security Properties in Probabilistic Systems

Program Verification by Using DISCOVERER

Structural Invariants for Parametric Verification of Systems with Almost Linear Architectures

Verifying Programs Using Abstraction and Theorem Proving.

Data-driven verification and synthesis of stochastic systems via barrier certificates

A SAT Solver and Computer Algebra Attack on the Minimum Kochen-Specker Problem

A Resolution-Based Interactive Proof System for UNSAT

Data-driven Safety Verification of Stochastic Systems via Barrier Certificates

A proof theoretic analysis of intruder theories

SAT-based Formal Verification of Fault Injection Countermeasures for Cryptographic Circuits

Parameterized Verification of Systems with Precise (0,1)-Counter Abstraction

IVeri: Privacy-Preserving Interdomain Verification

Compositional Verification of Efficient Masking Countermeasures Against Side-Channel Attacks

Combining Domain-Specific and Foundational Logics to Verify Complete Software Systems

An Infinite Needle in a Finite Haystack: Finding Infinite Counter-Models in Deductive Verification

Goal-constrained Planning Domain Model Verification of Safety Properties

Fully-Automated Verification of Linear Systems Using Inner- and Outer-Approximations of Reachable Sets

Detecting spurious counterexamples efficiently in abstract model checking

Industrial-Strength Verification of Solid State Interlocking Programs

Verifying Isolation Properties in the Presence of Middleboxes