SAT-Based Automated Completion for Reachability Analysis

Abstract

Reachability analysis in rewriting has served as a verification technique in recent decades, despite the underlying issue being undecidable. Regular tree model-checking has found application in verifying security protocols, Java programs, and concurrent systems. The premise in these approaches is to represent the targeted system as a state system and encode its transitions using a term rewriting system or a tree transducer. The crucial aspect lies in calculating a fixed point that represents the set of configurations or states that can be reached. While this is generally uncomputable, it is sufficient to compute an overapproximation for the purpose of verifying safety properties.

Let A, B, and $\mathcal {R}$ represent, respectively, an initial set of terms, a set of forbidden (“bad”) terms, and a term rewriting system. The question is whether there exists a regular approximation $A^\star$ of the set of reachable terms such that $A^\star \supseteq \mathcal {R}^*(A)$ and $A^\star \cap B = \varnothing$.

Finding suitable approximations requires, in practice, the use of heuristics, steered towards an anticipated conclusive fixed point by the intervention of human domain experts. The parameters upon which they act may take the form of term equations, normalizing rules, predicate abstractions, etc., but in all cases boil down to carefully choosing states to merge during the fixpoint computation, forcing convergence while avoiding overshooting the approximation into $B$.

We propose a practical, scalable automated method offloading that expert work to a SAT solver.