The VMT-LIB Language and Tools

09/27/2021 ∙ by Alessandro Cimatti, et al. ∙ 0

We present VMT-LIB, a language for the representation of verification problems of linear-time temporal properties on infinite-state symbolic transition systems. VMT-LIB is an extension of the standard SMT-LIB language for SMT solvers, developed with the goal of facilitating the interoperability and exchange of benchmark problems among different verification tools. Besides describing its syntax and semantics, we also present a set of open-source tools to work with the language.

READ FULL TEXT VIEW PDF
POST COMMENT

Comments

There are no comments yet.

Authors

page 1

page 2

page 3

page 4

This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

1 Introduction

In this paper we describe VMT-LIB, a language for the representation of verification problems of linear-time temporal properties on infinite-state symbolic transition systems. VMT-LIB was designed with the main goal of being simple to use (i.e. to parse and generate) for verification tools, with the aim of facilitating the interoperability among different tools and the collection of verification benchmarks for infinite-state systems. As such, it is similar in spirit to the Aiger [3] language for finite-state systems, and to the BTOR [16] language for word-level systems with arrays, with the difference that VMT-LIB supports arbitrary background SMT theories, including e.g. linear and nonlinear arithmetic, uninterpreted functions, and quantifiers.

VMT-LIB was developed as an extension of the standard SMT-LIB [2] language for SMT solvers, by exploiting the capability of SMT-LIB of attaching metadata to terms and formulas via annotations. In particular, a valid VMT-LIB file is also a valid SMT-LIB file. This allows to reuse all the libraries for manipulating SMT-LIB formulas that are available for various languages (e.g. [10, 15, 1]). Besides these generic libraries, we have also developed a set of tools to work with the language, including converters to and from other formats and formalisms (including Aiger, BTOR and Constrained Horn Clauses). All the tools are open source and available at the VMT-LIB webpage [18]. VMT-LIB is fully supported by the nuXmv [4] model checker, and it has been used as a benchmark format in several publications over the last few years (e.g. [6, 14, 11, 7, 5]).

The rest of the report is structured as follows. After providing the necessary theoretical background in §2, we describe the VMT-LIB syntax in §3, and its semantics in §4. In §5 we describe a set of open-source tools that we have developed to work with the language. Finally, we conclude in §6.

2 Theoretical Background and Definitions

Our setting is many-sorted first order logic. We use the standard notions of theory, satisfiability, validity, and logical consequence. We refer to the SMT-LIB specifications [2] for more details. We denote generic theories as . We write to denote that the formula is a logical consequence of in the theory ; when clear from context, we omit and simply write .

We refer to 0-arity predicates as Boolean variables, and to 0-arity uninterpreted functions as (theory) variables.

Given a set of variables , a signature , a domain , an interpretation function of the symbols in on the domain , an assignment to the variables in on the domain , and a -formula with free variables in , the satisfaction relation is defined in the usual way.

For each variable , we assume that there exists a corresponding variable , called the primed version of . If is a set of variables, is the set obtained by replacing each element with its primed version (). is the formula obtained by replacing each occurrence variable in with the corresponding primed.

In the following, the signature and the theory are implicitly given. A transition system (TS) is a tuple where is a set of state variables, is a formula representing the initial states, and is a formula representing the transitions, where is a set of input variables.

3 Syntax

VMT-LIB exploits the capability offered by the SMT-LIB language of attaching metadata to terms and formulas in order to specify the components of the transition system and the properties to verify. More specifically, we use the following SMT-LIB annotations:

:next name

is used to represent state variables. For each variable in the model, the VMT-LIB file contains a pair of variables, and , representing respectively the current and next version of . The two variables are linked by annotating with the attribute :next . All the variables that are not in relation with another by means of a :next attribute are considered inputs. Note that :next must define an injective function (i.e. it is an error if there are two variables with the same :next value), and that the names of the variables are not important.

:init

is used to specify the formula for the initial states of the model. This formula should contain neither next-state variables nor input variables. Multiple formulas annotated with :init are implicitly conjoined. As a convenience, the annotation can also use a “dummy” value true.

:trans

is used to specify the formula for the transition relation. As in the case for :init, multiple :trans formulas are conjoined together, and also in this case the annotation can be written as :trans true.

:invar-property idx

is used to specify invariant properties, i.e. formulas of the form , where is the formula annotated with :invar-property. The non-negative integer idx is a unique identifier for the property.

:live-property idx

is used to specify an LTL property of the form , where is the formula annotated with :live-property. The non-negative integer idx is a unique identifier for the property.

In a VMT-LIB file, only annotated terms and their sub-terms are meaningful. Any other term is ignored. Moreover, only the following commands are allowed to occur in VMT-LIB files: set-logic, set-option, declare-sort, define-sort, declare-fun, define-fun.(For convenience, an additional (assert true) command is allowed to appear at the end of the file.)

The following example shows a simple model in the syntax of nuXmv [4] on the left, and its corresponding VMT-LIB translation on the right.

nuXmv VMT
MODULE main
-- declaring the state
-- variable x
VAR x : integer;
IVAR b : boolean;
INIT x = 1;
TRANS
next(x) = b ? x + 1 : x;
INVARSPEC x > 0;
LTLSPEC FG x > 10;
; declaring the state variable x
(declare-const x Int)
(declare-const x.next Int)
(define-fun sv.x () Int (! x :next x.next))

(declare-const b Bool)
(define-fun init () Bool
         (! (= x 1) :init))
(define-fun trans () Bool
   (! (= x.next (ite b (+ x 1) x)) :trans)
(define-fun p1 () Bool
              (! (> x 0) :invar-property 1))
(define-fun p2 () Bool
              (! (> x 10) :live-property 2))

Since the SMT-LIB format (and thus also the VMT-LIB one that inherits from SMT-LIB) does not allow to annotate the declaration of variables, it is a good practice to insert immediately after the declaration of the variables a set of defines to specify the relations among variables. See for instance the define sv.x in the example above that introduces the relation between x and x.next.

LTL Properties, Invariant Constraints and Fairness Conditions.

Since one of the main goals of VMT-LIB is that of simplicity, the language does not provide any direct support for high-level constructs such as specifications written in full LTL, invariant constraints or fairness conditions. However, this is not a limitation in terms of expressiveness, as all such constructs can be easily encoded in VMT-LIB:

LTL properties

can be compiled into invariant and/or live properties using standard algorithms from the literature (e.g. [17, 9, 8]);

invariant constraints

can be straightforwardly embedded into init and trans formulas;

fairness conditions

can be embedded into live properties using a symbolic version of standard degeneralization procedures for Büchi automata (e.g. [12]).

4 Semantics

Given a transition system over a background theory with a signature and an interpretation , a state of is an interpretation of the state variables . A (finite) path of is a finite sequence of states, with the same domain and interpretation of symbols in the signature , such that and for all , , . We say that a state is reachable in iff there exists a path of ending in . Note that, since the interpretation is unique, uninterpreted function and predicate symbols are rigid, i.e. they are not allowed to change across states.

Invariant Properties

An invariant property is a symbolic representation of a set of states that must be a superset of the reachable states of . In other words, iff is reachable in , . Consequently, a counterexample for is a finite path of such that .

Live Properties

A live property represents a set of states that is eventually invariant. In LTL syntax, it would be denoted with . More formally, iff for all paths , . (Note that finite paths vacuously satisfy a live property, because we can always take to satisfy the previous definition.) Consequently, a counterexample for is an infinite path of such that .

5 VMT-LIB Tools

VMT-LIB support in verification tools.

The VMT-LIB language is fully supported by nuXmv [4], a state-of-the-art symbolic model checker for finite- and infinite-state systems. Recently, the language has been adopted also by the AVR [11] model checker. VMT-LIB is also the native language of ic3ia [13], an efficient open-source model checker for invariant and LTL properties, as well as its recent extensions ProphIC3 [14] (for discovering universally quantified invariants over arrays) and Lambda [7] (for the verification of parametric systems).

Tools for working with VMT-LIB.

We provide a set of tools (mainly written in the Python programming language) to work with the VMT-LIB language. They are all available from the VMT-LIB webpage [18]. Currently, the following tools are provided:

vmt.py: parsing and printing of transition systems in VMT-LIB.

vmt2btor.py: converter from VMT-LIB to the BTOR format.

btor2vmt.py: converter from BTOR to VMT-LIB.

vmt2horn.py: converter from VMT-LIB to Constrained Horn Clauses.

vmt2nuxmv.py: converter from VMT-LIB to the SMV dialect of nuXmv.

ltl2vmt.py: a tool to convert arbitrary LTL properties into VMT-LIB :live-property specifications, by compiling them into symbolic tableaux which are then put in product with the transition system.

Moreover, further converters to VMT-LIB are available through nuXmv and ic3ia. In particular, ic3ia provides a horn2vmt tool for converting Constrained Horn Clauses to VMT-LIB, whereas nuXmv can be used to convert from VMT-LIB to Aiger and vice versa.

6 Conclusions

We have presented VMT-LIB, a language and a set of tools for the specification of verification problems over infinite-state transition systems aimed at simplicity and interoperability. In the future, we plan to extend the format to support the representation of counterexample traces for violated properties, and possibly also proof certificates for verified properties.

References

  • [1] D. Baier, D. Beyer, and K. Friedberger (2021) JavaSMT 3: Interacting with SMT Solvers in Java. In Computer Aided Verification - 33rd International Conference, CAV 2021, Virtual Event, July 20-23, 2021, Proceedings, Part II, A. Silva and K. R. M. Leino (Eds.), Lecture Notes in Computer Science, Vol. 12760, pp. 195–208. External Links: Link, Document Cited by: §1.
  • [2] C. Barrett, P. Fontaine, and C. Tinelli (2021) The SMT-LIB Standard: Version 2.6. Technical report Note: https://smtlib.cs.uiowa.edu/papers/smt-lib-reference-v2.6-r2021-05-12.pdf Cited by: §1, §2.
  • [3] A. Biere, K. Heljanko, and S. Wieringa (July 2011) AIGER 1.9 and beyond. Technical report Technical Report 11/2, Institute for Formal Models and Verification, Johannes Kepler University, Altenbergerstr. 69, 4040 Linz, Austria. Cited by: §1.
  • [4] R. Cavada, A. Cimatti, M. Dorigatti, A. Griggio, A. Mariotti, A. Micheli, S. Mover, M. Roveri, and S. Tonetta (2014) The nuXmv Symbolic Model Checker. In Computer Aided Verification - 26th International Conference, CAV 2014, Held as Part of the Vienna Summer of Logic, VSL 2014, Vienna, Austria, July 18-22, 2014. Proceedings, A. Biere and R. Bloem (Eds.), Lecture Notes in Computer Science, Vol. 8559, pp. 334–342. External Links: Link, Document Cited by: §1, §3, §5.
  • [5] A. Cimatti, A. Griggio, A. Irfan, M. Roveri, and R. Sebastiani (2018) Incremental Linearization for Satisfiability and Verification Modulo Nonlinear Arithmetic and Transcendental Functions. ACM Trans. Comput. Log. 19 (3), pp. 19:1–19:52. External Links: Link, Document Cited by: §1.
  • [6] A. Cimatti, A. Griggio, S. Mover, and S. Tonetta (2016) Infinite-state invariant checking with IC3 and predicate abstraction. Formal Methods Syst. Des. 49 (3), pp. 190–218. External Links: Link, Document Cited by: §1.
  • [7] A. Cimatti, A. Griggio, and G. Redondi (2021) Universal Invariant Checking of Parametric Systems with Quantifier-free SMT Reasoning. In Automated Deduction - CADE 28 - 28th International Conference on Automated Deduction, Virtual Event, July 12-15, 2021, Proceedings, A. Platzer and G. Sutcliffe (Eds.), Lecture Notes in Computer Science, Vol. 12699, pp. 131–147. External Links: Link, Document Cited by: §1, §5.
  • [8] K. Claessen, N. Eén, and B. Sterin (2013) A circuit approach to LTL model checking. In Formal Methods in Computer-Aided Design, FMCAD 2013, Portland, OR, USA, October 20-23, 2013, pp. 53–60. External Links: Link Cited by: item LTL properties.
  • [9] E. M. Clarke, O. Grumberg, and K. Hamaguchi (1997) Another look at LTL model checking. Formal Methods in System Design 10 (1), pp. 47–71. Cited by: item LTL properties.
  • [10] M. Gario and A. Micheli (2015) PySMT: a solver-agnostic library for fast prototyping of SMT-based algorithms. In SMT Workshop 2015, Cited by: §1.
  • [11] A. Goel and K. A. Sakallah (2020) AVR: Abstractly Verifying Reachability. In Tools and Algorithms for the Construction and Analysis of Systems - 26th International Conference, TACAS 2020, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2020, Dublin, Ireland, April 25-30, 2020, Proceedings, Part I, A. Biere and D. Parker (Eds.), Lecture Notes in Computer Science, Vol. 12078, pp. 413–422. External Links: Link, Document Cited by: §1, §5.
  • [12] A. Griggio, M. Roveri, and S. Tonetta (2021) Certifying proofs for SAT-based model checking. Form Methods Syst Des. External Links: Document Cited by: item fairness conditions.
  • [13] IC3ia. https://es-static.fbk.eu/people/griggio/ic3ia/. Cited by: §5.
  • [14] M. Mann, A. Irfan, A. Griggio, O. Padon, and C. W. Barrett (2021) Counterexample-Guided Prophecy for Model Checking Modulo the Theory of Arrays. In Tools and Algorithms for the Construction and Analysis of Systems - 27th International Conference, TACAS 2021, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2021, Luxembourg City, Luxembourg, March 27 - April 1, 2021, Proceedings, Part I, J. F. Groote and K. G. Larsen (Eds.), Lecture Notes in Computer Science, Vol. 12651, pp. 113–132. External Links: Link, Document Cited by: §1, §5.
  • [15] M. Mann, A. Wilson, C. Tinelli, and C. W. Barrett (2020) Smt-Switch: A Solver-agnostic C++ API for SMT Solving. In

    Proceedings of the 18th International Workshop on Satisfiability Modulo Theories co-located with the 10th International Joint Conference on Automated Reasoning (IJCAR 2020), Online (initially located in Paris, France), July 5-6, 2020

    , F. Bobot and T. Weber (Eds.),
    CEUR Workshop Proceedings, Vol. 2854, pp. 48–58. External Links: Link Cited by: §1.
  • [16] A. Niemetz, M. Preiner, C. Wolf, and A. Biere (2018) BTOR2 , BtorMC and Boolector 3.0. In Computer Aided Verification - 30th International Conference, CAV 2018, Held as Part of the Federated Logic Conference, FloC 2018, Oxford, UK, July 14-17, 2018, Proceedings, Part I, H. Chockler and G. Weissenbacher (Eds.), Lecture Notes in Computer Science, Vol. 10981, pp. 587–595. External Links: Link, Document Cited by: §1.
  • [17] M. Y. Vardi (1995) An automata-theoretic approach to linear temporal logic. In Banff Higher Order Workshop, LNCS, Vol. 1043, pp. 238–266. Cited by: item LTL properties.
  • [18] VMT-LIB. http://vmt-lib.org. Cited by: §1, §5.