SAT-Based Automated Completion for Reachability Analysis
Résumé
Reachability analysis in rewriting has served as a verification
technique in recent decades, despite the underlying issue being undecidable.
Regular tree model-checking has found application in verifying security
protocols, Java programs, and concurrent systems. The premise in these
approaches is to represent the targeted system as a state system and en-
code its transitions using a term rewriting system or a tree transducer.
The crucial aspect lies in calculating a fixed point that represents the set
of configurations or states that can be reached. While this is generally
uncomputable, it is sufficient to compute an overapproximation. for the
purpose of verifying safety properties.
Let A, B, and R represent, respectively, an initial set of terms, a set of
forbidden (“bad”) terms, and a term rewriting system. The question is
whether there exists a regular approximation A⋆ of the set of reachable
terms such that A⋆ ⊇ R∗ (A) and A⋆ ∩ B = ∅.
Finding suitable approximations requires, in practice, the use of heuristics,
steered towards an anticipated conclusive fixed point by the intervention
of human domain experts. The parameters upon which they act may take
the form of term equations, normalizing rules, predicate abstractions, etc,
but in all cases boil down to carefully choosing states to merge during the
fixpoint computation, forcing convergence while avoiding overshooting the
approximation into B.
We propose a practical, scalable automated method offloading that expert
work to a SAT solver.