First-order logic, and quantifiers in particular, are widely used in deductive verification of
programs and systems. Quantifiers are essential for describing systems with unbounded domains,
but prove difficult for automated solvers. Significant effort has been dedicated to finding quantifier
instantiations that establish unsatisfiability of quantified formulas, thus ensuring validity of a
system’s verification conditions. However, in many cases the formulas are satisfiable—this is
often the case in intermediate steps of the verification process, e.g., when an invariant is not yet
inductive. For such cases, existing tools are limited to finding finite models as counterexamples.
Yet, some quantified formulas are satisfiable but only have infinite models, which current solvers
are unable to find. Such infinite counter-models are especially typical when first-order logic is used
to approximate the natural numbers, the integers, or other inductive definitions such as linked lists,
which is common in deductive verification. The inability of solvers to find infinite models makes
them diverge in these cases, providing little feedback to the user as they try to make progress in
their verification attempts.
In this paper, we tackle the problem of finding such infinite models, specifically, finite representations thereof that can be presented to the user of a deductive verification tool. These models give
insight into the verification failure, and allow the user to identify and fix bugs in the modeling of
the system and its properties. Our approach consists of three parts. First, we introduce symbolic
structures as a way to represent certain infinite models, and show they admit an efficient model
checking procedure. Second, we describe an effective model finding procedure that symbolically
explores a given (possibly infinite) family of symbolic structures in search of an infinite model for
a given formula. Finally, we identify a new decidable fragment of first-order logic that extends
and subsumes the many-sorted variant of EPR, where satisfiable formulas always have a model
representable by a symbolic structure within a known family, making our model finding procedure
a decision procedure for that fragment.
We evaluate our approach on examples from the domains of distributed consensus protocols
and of heap-manipulating programs (specifically, linked lists). Our implementation quickly finds
infinite counter-models that demonstrate the source of verification failures in a simple way, while
state-of-the-art SMT solvers and theorem provers such as Z3, cvc5, and Vampire diverge or return
“unknown”.
