An SMT Approach to Bounded Reachability Analysis of Model Programs

Abstract

Abstract. Model programs represent transition systems that are used to specify expected behavior of systems at a high level of abstraction. The main application area is application-level network protocols or protocollike aspects of software systems. Model programs typically use abstract data types such as sets and maps, and comprehensions to express complex state updates. Such models are mainly used in model-based testing as inputs for test case generation and as oracles during conformance testing. Correctness assumptions about the model itself are usually expressed through state invariants. An important problem is to validate the model prior to its use in the above-mentioned contexts. We introduce a technique of using Satisfiability Modulo Theories or SMT to perform bounded reachability analysis of a fragment of model programs. We use the Z3 solver for our implementation and benchmarks, and we use AsmL as the modeling language. The translation from a model program into a verification condition of Z3 is incremental and involves selective quantifier instantiation of quantifiers that result from the comprehension expressions.

Incremental Instance Generation in Local Reasoning

“…Another approach of generating instances of axioms incrementally, guided by a candidate model, has been followed by Veanes et al [2] in context of bounded reachability analysis. Although not explained in much detail, they seem to use an even stronger semantic condition: only instances which contradict the current candidate model are generated.…”

“…We consider a clause C redundant with respect to F if there is a clause D ∈ F which is a variant of C. 2 If all inferences based on sel only produce instances which are redundant with respect to F , we call F saturated under IG (with respect to the selection function sel). If F is saturated under IG, the procedure terminates and states satisfiabliliy of the input.…”

Protocol Modeling with Model Program Composition

“…We are investigating an SMT approach for doing reachability analysis of model programs [36], where we use Z3 [41,5] for our implementation, as it supports background theories [17,16] for arithmetic as well as sets and maps. A prototype is being implemented for a fragment of model programs written in AsmL.…”

“…The step semantics of model programs is based on the theory of abstract state machines (ASMs) [25] with a rich background universe [6]. This enables explicit state exploration techniques [21] and symbolic analysis techniques that support the needed background theories [36], as well as a range of other ASM technologies [8] to be applied to model programs.…”

Rewriting modulo SMT and open system analysis

“…A key open research issue of current symbolic techniques is extensibility. Techniques that combine different methods have been proposed, e.g., decision procedures [50,51], unifications algorithms [7,11], theorem provers with decision procedures [1,10,53], and SMT solvers in model checkers [3,30,49,62,66]. However, there is still a lack of general extensibility techniques for symbolic analysis that simultaneously combine the power of SMT solving, rewriting-and narrowingbased analysis, and model checking.…”