Toward a More Complete Alloy

Abstract

Abstract. Many model-finding tools, such as Alloy, charge users with providing bounds on the sizes of models. It would be preferable to automatically compute sufficient upper-bounds whenever possible. The Bernays-Schönfinkel-Ramsey fragment of first-order logic can relieve users of this burden in some cases: its sentences are satisfiable iff they are satisfied in a finite model, whose size is computable from the input problem. Researchers have observed, however, that the class of sentences for which such a theorem holds is richer in a many-sorted framework-which Alloy inhabitsthan in the one-sorted case. This paper studies this phenomenon in the general setting of order-sorted logic supporting overloading and empty sorts. We establish a syntactic condition generalizing the Bernays-Schönfinkel-Ramsey form that ensures the Finite Model Property. We give a linear-time algorithm for deciding this condition and a polynomial-time algorithm for computing the bound on model sizes. As a consequence, model-finding is a complete decision procedure for sentences in this class. Our work has been incorporated into Margrave, a tool for policy analysis, and applies in real-world situations.

Verifying Security Policies in Multi-agent Workflows with Loops

“…φ ′ s with k ≥ 0 and φ ′ s a FOLTL formula containing no existential quantifiers. is definition extends the definition of the Bernays-Schönfinkel-like fragments in [1,27] from FOL to FOLTL, 2 and of the Bernays-Schönfinkel-like fragment in [22] from unsorted FOLTL to sorted FOLTL. Note that the previous sample formula is in ∃ * FOLTL.…”

“…e decidable FOL fragments in[1,27] are larger than the projection of the ∃ * FOLTL fragment to sorted FOL, as they also consider function symbols.…”

A decidable and expressive fragment of Many-Sorted First-Order Linear Temporal Logic

“…In the spririt of [4,13,16,17], we devised a many-sorted version of the Geneva fragment presented in [12], which extends its expressiveness and fits the data structuring features of Electrum [7]. Also and contrary to [12] there is no need to split and "dispatch" fair and prop anymore.…”

Smart Bound Selection for the Verification of UML/OCL Class Diagrams

“…Similarly, even though first-order logic is undecidable in general, some fragments of first-order logic are known to be decidable, such as "effectively propositional logic". This fragment can also be defined in the context of the many-sorted first-order logic used in Alloy [40]. In specifications within these restricted notations, verification is decidable and it is possible to compute exact verification bounds.…”