Unsatisfiable Relations

Unsatisfiable relations are transition relations where, for certain reachable states from the origin node, there are no related reachable states in the destination node. In other words, there are no destination reachable states that, together with the origin reachable state which satisfies the guard, satisfy the transition relation. This is erroneous and should not happen.

Definition 27. A transition t has a unsatisfiable relation if there exists a reachable state ςtorigin so ςtorigin |= tguard but there exists no reachable state

ςtdestination soςtorigin∧ςtdestination |=tguard∧trelation

Checking for Unsatisfiable Relations as a SMT Query

Proving the relation of a transition may be unsatisfiable is to find a reachable state in the origin node which satisfies the guard but the relation is unsatisfiable so there is no reachable state in the destination node related. In order to check this with an SMT-solver, we want the SMT-solver to find a reachable state based on the RSC of the origin node which satisfies the guard but falsifies the relation in all cases. With in all cases we mean we also have to properly use the transition and states variables of the transition and the destination node.

With an unsatisfiable relation, we are interested in a state of the origin RSC and some assignment of the transition variables so the guard is satisfied. The assignment of the transition variables also have to be applied to the relation part

of the query. Therefore, we let the SMT-solver existentially close the transition variables. The relation contains the state variables for the destination node and we have to show that for all possible destination states it falsifies the relation. Therefore, we have to quantify the state variables of the destination node using a universal quantifier. All in all we reach the SMT query of definition 28. Definition 28. A transition t has a unsatisfiable relation if there exists an assignment of state variables for node torigin and transition variables of t so

RSCtorigin∧tguard∧ ∀vd,1, vd,2...¬trelation wherevd,i are the state variables for

the nodetdestination.

If a model exists for the query in definition 28 thent has an unsatisfiable

relation and the model shows for which reachable state in the origin node and as- signment of transition variables. If no model exists for the query then transition

t does not have an unsatisfiable relation.

In order to perform this query, we use scoping strategy 2 as opposed to the other verification properties.

For an example we shall use figure 4.7. We shall check if the transition from

n1 ton2 has an unsatisfiable relation. Noden1 has RSCi n1 prev== 0 and

the transition has the guard trueand the relationi n2 next== i n1 prev+ 2.

The query to the SMT-solver becomes:

1. i n1 prev== 0∧true∧ ∀i n2 next.¬[i n2 next==i n1 prev+ 2]

The query returns unsatisfiable although the reasoning why is not straight-

forward. There is only one reachable state for noden1 namelyςn1[0←i]. This

satisfies the RSC of n1 and the guard. However, there is a reachable state

for node n2 so the relation is satisfied, namely ςn2[2←i]. This means in the

query there is an assignment so¬trelationdoes not hold. Therefore the universal

quantifier evaluates to false and we deem the relation satisfiable for all reach- able states in the origin node and all assignments for the transition variables. Therefore, this transition does not have an unsatisfiable relation.

Soundness with over-approximated RSCs

We have defined the concept of unsatisfiable relations and how to check if some transition has an unsatisfiable relation. However, as with the other verification properties there are consequences when a RSC is an over-approximation.

There may be a stateςunreachablesoςunreachable|=RSC∧tguard,ςunreachable|=

∀vd,1, vd,2...¬trelationandςunreachable is unreachable. In other words, there may

exist a state which is not reachable, satisfies the guard but there is not a reach- able state in the destination node so the relation is satisfied. This is considered a false positive and may happen when the RSC is an over-approximation.

As with chapter 4.3.1, we note that the deduction rule respects the strongest relation and if only the deduction rule is used to find all RSCs then all RSCs are not over-approximations. In this case there can be no false positives.

A RSC may not be an under-approximation and therefore there can be no false negatives. A false negative in this case would be a reachable state in the origin node which satisfies the query but does not satisfy the RSC of origin node. In this case, the RSC would be an under-approximation as reachable states are not modelled by the RSC. However, this is not possible as the RSC must not be an under-approximation.

Table 4.1: Overview of soundness and completeness for the different steps of the verification procedure

Step Sound Complete

Generation & verification of reachable state constraints

Generation of RSCs is sound. When verifying if RSCs are valid, triple ver- ification rule may give spurious coun- terexamples.

Complete for STS graph structure. In- complete for generation and verification

of arbitary RSCs. Depends if SMT-

solver is complete.

If a safety property holds False positives when RSC is over-

approximation.

Complete if SMT-solver is complete.

If a dead transition exists False negatives when RSC is over-

approximation.

Complete if SMT-solver is complete.

If a sinkhole exists False positives when RSC is over-

approximation.

Complete if SMT-solver is complete.

If a start transition is unsatisfiable Sound. Complete if SMT-solver is complete.

If a transition relation is unsatisfiable False positives when RSC is over-

approximation.

Complete if SMT-solver is complete.