Abstract Framework for All-Path Reachability Analysis toward Safety and Liveness Verification (Full Version)

2026-02-04

AI Summary

This work proposes a unified framework that extends All-Path Reachability (APR) analysis to support formal verification of both safety and liveness properties. By introducing the notion of total validity within Abstract Reduction (AR) systems and establishing a one-to-one correspondence between this concept and the inference rules of Logically Constrained Term Rewriting Systems (LCTRS), the framework is capable of reasoning about infinite execution paths. The key contribution lies in providing necessary and sufficient conditions for cycle-free cyclic proof trees, which guarantee total validity and thereby enable a unified application of APR to both safety and liveness verification.

Technology Category

• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Knowledge Representation and Reasoning: Automated Reasoning and Theorem Proving
• Reasoning under Uncertainty: Applications

Application Category

• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics
• Security and Privacy: Large-scale security measurements
• Systems and Infrastructure for Web, Mobile and WoT: Web performance, measurement, and characterization

Abstract

An all-path reachability (APR) predicate over an object set is a pair of a source set and a target set, which are subsets of the object set. APR predicates have been defined for abstract reduction systems (ARSs) and then extended to logically constrained term rewrite systems (LCTRSs) as pairs of constrained terms that represent sets of terms modeling configurations, states, etc. An APR predicate is said to be partially (or demonically) valid w.r.t. a rewrite system if every finite maximal reduction sequence of the system starting from any element in the source set includes an element in the target set. Partial validity of APR predicates w.r.t. ARSs is defined by means of two inference rules, which can be considered a proof system to construct (possibly infinite) derivation trees for partial validity. On the other hand, a proof system for LCTRSs consists of four inference rules, leaving a gap between the inference rules for ARSs and LCTRSs. In this paper, we revisit the framework for APR analysis and adapt it to verification of not only safety but also liveness properties. To this end, we first reformulate an abstract framework for partial validity w.r.t. ARSs so that there is a one-to-one correspondence between the inference rules for partial validity w.r.t. ARSs and LCTRSs. Secondly, we show how to apply APR analysis to safety verification. Thirdly, to apply APR analysis to liveness verification, we introduce a novel stronger validity of APR predicates, called total validity, which requires not only finite but also infinite execution paths to reach target sets. Finally, for a partially valid APR predicate with a cyclic-proof tree, we show a necessary and sufficient condition for the tree to ensure total validity. The condition implies that if there exists a cyclic-proof tree for an APR predicate, the proof graph of which is acyclic, then the APR predicate is totally valid.

Problem

• all-path reachability
• safety verification
• liveness verification
• abstract reduction systems
• logically constrained term rewrite systems

Innovation

• all-path reachability
• total validity
• cyclic proof
• safety and liveness verification
• logically constrained term rewrite systems