Certifying proofs for SAT-based model checking

Abstract

In the context of formal verification, certifying proofs are evidences of the correctness of a model in a deduction system produced automatically as outcome of the verification. They are quite appealing for high-assurance systems because they can be verified independently by proof checkers, which are usually simpler to certify than the proof-generating tools. Model checking is one of the most prominent approaches to formal verification of temporal properties and is based on an algorithmic search of the system state space. Although modern algorithms integrate deductive methods, the generation of proofs is typically restricted to invariant properties only. Moreover, it assumes that the verification produces an inductive invariant of the original system, while model checkers usually involve a variety of complex pre-processing simplifications. In this paper we show how, exploiting the k-liveness algorithm, to extend proof generation capabilities for invariant checking to cover full linear-time temporal logic (LTL) properties, in a simple and efficient manner, with essentially no overhead for the model checker. Besides the basic k-liveness algorithm, we integrate in the proof generation a variety of widely used pre-processing techniques such as temporal decomposition, model simplification via computation of equivalences with ternary simulation, and the use of stabilizing constraints. These techniques are essential in many cases to prove that a property holds, both for invariant and for LTL model checking, and thus need to be considered within the proof. We implemented the proof generation techniques on top of IC3 engines, and show the feasibility of the approach on a variety of benchmarks taken from the literature and from the Hardware Model Checking Competition. Our results confirm that proof generation results in negligible overhead for the model checker.

Hardware Model Checking Algorithms and Techniques

“…In the BLOCKCUBE(q, Q, F k ) procedure, described in Algorithm 7, the queue of proof obligations is initialized with (q, k), encoding the fact that q must be blocked in F k (line 2). Then, proof obligations are iteratively extracted from the queue and discharged (lines [3][4][5][6][7][8][9][10][11][12][13][14].…”

“…Complementary to the verification phase itself, there is then the additional problem of certifying checkers' results, in order to better support their acquisition in complete design cycles scenarios [12,13].…”

Safe and Secure Future AI-Driven Railway Technologies: Challenges for Formal Methods in Railway

“…The concept of certified model checking was conceived for the µ-calculus [86]. A proof of concept has been provided for SMT-based model checking [74] (where certificates are basically invariants) and more recently for liveness checking of finite-state systems [60] and timed automata [103] (where certificates consist of reachability invariants and topological ranking functions). In the latter case, the certifier was fully verified in the theorem prover Isabelle/HOL.…”

Neural Network Verification with Proof Production

“…We can see that the overhead of proof production time is relatively small for all queries (an average overhead of 5.7%), while the certification time is non-negligible, but shorter than the time it takes to solve the queries by a factor of 66.5% on average. The importance of proof production in verifiers has been repeatedly recognized, for example by the SAT, SMT, and model-checking communities (e.g., [15], [21], [36]). Although the risks posed by numerical imprecision within DNN verifiers have been raised repeatedly [12], [40], [44], [43], we are unaware of any existing proof-producing DNN verifiers.…”