CTL+FO verification as constraint solving

Abstract

Expressing program correctness often requires relating program data throughout (different branches of) an execution. Such properties can be represented using CTL+FO, a logic that allows mixing temporal and first-order quantification. Verifying that a program satisfies a CTL+FO property is a challenging problem that requires both temporal and data reasoning. Temporal quantifiers require discovery of invariants and ranking functions, while first-order quantifiers demand instantiation techniques. In this paper, we present a constraint-based method for proving CTL+FO properties automatically. Our method makes the interplay between the temporal and first-order quantification explicit in a constraint encoding that combines recursion and existential quantification. By integrating this constraint encoding with an off-theshelf solver we obtain an automatic verifier for CTL+FO.

HornDroid: Practical and Sound Static Analysis of Android Applications by SMT Solving

“…We are currently working on the verification of CTL formulas, by using a recently developed encoding into Horn clauses [4]. Furthermore, we plan to extend our tool in order to check non-interference properties and prove the absence of implicit information flows.…”

“…The Horn clauses are encoded in the SMT-LIB format supported by many popular SMT solvers, including our choice Z3 [9]. HornDroid automatically generates analysis queries based on its database of sources and sinks 4 and the unsatisfiability of the queries is verified using the Property-Directed Reachability (PDR) engine implemented in Z3 [16]. If no query is satisfiable, no information leak from a source to a sink may occur in the analysed application.…”

Program Synthesis for Program Analysis

“…With respect to the verification of temporal properties, a danger invariant for a loop with an assertion A essentially proves the CTL property EF¬A over the loop. While there exist CTL verifiers based on a reduction to exist-forall quantified Horn clauses [11,12], we specialise the concept for finding deep bugs and describe a modular constraint generation technique over arbitrary programs, rather than for transition systems.…”

Constrained narrowing for conditional equational theories modulo axioms

“…Various kinds of symbolic techniques such as: (i) automata and grammars, e.g., [1,15,13,14,38,66,5,4,3,33]; (ii) SMT and other forms of constraint solving, e.g., [6,20,35,36,64,73,75,39,11]; and (iii) narrowing [72,30,31,9,10], have been employed for this purpose. All are useful in their own way and can complement each other; and there is great interest in combining the power of these different symbolic approaches to handle a wider range of applications [59,60] (see, e.g., [70] and the survey [58] for combinations of this kind).…”