How to Win First-Order Safety Games

  • Helmut Seidl
  • Christian MüllerEmail author
  • Bernd Finkbeiner
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 11990)


First-order (FO) transition systems have recently attracted attention for the verification of parametric systems such as network protocols, software-defined networks or multi-agent workflows like conference management systems. Functional correctness or noninterference of these systems have conveniently been formulated as safety or hypersafety properties, respectively. In this article, we take the step from verification to synthesis—tackling the question whether it is possible to automatically synthesize predicates to enforce safety or hypersafety properties like noninterference. For that, we generalize FO transition systems to FO safety games. For FO games with monadic predicates only, we provide a complete classification into decidable and undecidable cases. For games with non-monadic predicates, we concentrate on universal first-order invariants, since these are sufficient to express a large class of properties—for example noninterference. We identify a non-trivial sub-class where invariants can be proven inductive and FO winning strategies be effectively constructed. We also show how the extraction of weakest FO winning strategies can be reduced to SO quantifier elimination itself. We demonstrate the usefulness of our approach by automatically synthesizing nontrivial FO specifications of messages in a leader election protocol as well as for paper assignment in a conference management system to exclude unappreciated disclosure of reports.


First order safety games Universal invariants First Order Logic Second order quantifier elimination 


  1. 1.
    Ackermann, W.: Untersuchungen über das Eliminationsproblem der mathematischen Logik. Math. Ann. 110, 390–413 (1935)MathSciNetCrossRefGoogle Scholar
  2. 2.
    de Alfaro, L., Roy, P.: Solving games via three-valued abstraction refinement. In: Caires, L., Vasconcelos, V.T. (eds.) CONCUR 2007. LNCS, vol. 4703, pp. 74–89. Springer, Heidelberg (2007). Scholar
  3. 3.
    Ball, T., et al.: Vericon: towards verifying controller programs in software-defined networks. In: ACM Sigplan Notices, vol. 49, pp. 282–293. ACM (2014)Google Scholar
  4. 4.
    Behmann, H.: Beiträge zur Algebra der Logik, insbesondere zum Entscheidungsproblem. Math. Ann. 86(3–4), 163–229 (1922)MathSciNetCrossRefGoogle Scholar
  5. 5.
    Börger, E., Stärk, R.: History and survey of ASM research. In: Börger, E., Stärk, R. (eds.) Abstract State Machines, pp. 343–367. Springer, Berlin (2003). Scholar
  6. 6.
    Börger, E., Stärk, R.: Tool support for ASMs. In: Börger, E., Stärk, R. (eds.) Abstract State Machines, pp. 313–342. Springer, Berlin (2003). Scholar
  7. 7.
    Brachman, R.J., Levesque, H.J., Reiter, R.: Knowledge Representation. MIT Press, Cambridge (1992)Google Scholar
  8. 8.
    Bradley, A.R.: SAT-based model checking without unrolling. In: Jhala, R., Schmidt, D. (eds.) VMCAI 2011. LNCS, vol. 6538, pp. 70–87. Springer, Heidelberg (2011). Scholar
  9. 9.
    de Moura, L., Bjørner, N.: Z3: an efficient SMT solver. In: Ramakrishnan, C.R., Rehof, J. (eds.) TACAS 2008. LNCS, vol. 4963, pp. 337–340. Springer, Heidelberg (2008). Scholar
  10. 10.
    Dimitrova, R., Finkbeiner, B.: Abstraction refinement for games with incomplete information. In: IARCS Annual Conference on Foundations of Software Technology and Theoretical Computer Science FSTTCS, vol. 2008, pp. 175–186 (2008)Google Scholar
  11. 11.
    Dimitrova, R., Finkbeiner, B.: Counterexample-guided synthesis of observation predicates. In: Jurdziński, M., Ničković, D. (eds.) FORMATS 2012. LNCS, vol. 7595, pp. 107–122. Springer, Heidelberg (2012). Scholar
  12. 12.
    Finkbeiner, B., Müller, C., Seidl, H., Zalinescu, E.: Verifying security policies in multi-agent workflows with loops. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 2017, Dallas, TX, USA, 30 October–03 November 2017, pp. 633–645. IEEE (2017).
  13. 13.
    Finkbeiner, B., Seidl, H., Müller, C.: Specifying and verifying secrecy in workflows with arbitrarily many agents. In: Artho, C., Legay, A., Peled, D. (eds.) ATVA 2016. LNCS, vol. 9938, pp. 157–173. Springer, Cham (2016). Scholar
  14. 14.
    Gabbay, D.M., Schmidt, R., Szalas, A.: Second Order Quantifier Elimination: Foundations. Computational Aspects and Applications. College Publications, Michigan (2008)zbMATHGoogle Scholar
  15. 15.
    Gurevich, Y.: Evolving algebras 1993: Lipari guide. arXiv preprint arXiv:1808.06255 (2018)
  16. 16.
    Henzinger, T.A., Jhala, R., Majumdar, R.: Counterexample-guided control. In: Baeten, J.C.M., Lenstra, J.K., Parrow, J., Woeginger, G.J. (eds.) ICALP 2003. LNCS, vol. 2719, pp. 886–902. Springer, Heidelberg (2003). Scholar
  17. 17.
    Holzer, M., Kutrib, M., Malcher, A.: Complexity of multi-head finite automata: origins and directions. Theoret. Comput. Sci. 412(1–2), 83–96 (2011)MathSciNetCrossRefGoogle Scholar
  18. 18.
    Karbyshev, A., Bjørner, N., Itzhaky, S., Rinetzky, N., Shoham, S.: Property-directed inference of universal invariants or proving their absence. J. ACM (JACM) 64(1), 7 (2017)MathSciNetCrossRefGoogle Scholar
  19. 19.
    Miller, D.A., Nadathur, G.: Higher-order logic programming. In: Shapiro, E. (ed.) ICLP 1986. LNCS, vol. 225, pp. 448–462. Springer, Heidelberg (1986). Scholar
  20. 20.
    Levesque, H.J., Reiter, R., Lespérance, Y., Lin, F., Scherl, R.B.: GOLOG: a logic programming language for dynamic domains. J. Logic Programm. 31(1), 59–83 (1997). Scholar
  21. 21.
    Mazala, R.: Infinite games. In: Grädel, E., Thomas, W., Wilke, T. (eds.) Automata Logics, and Infinite Games. LNCS, vol. 2500, pp. 23–38. Springer, Heidelberg (2002). Scholar
  22. 22.
    McMillan, K.L., Padon, O.: Deductive verification in decidable fragments with ivy. In: Podelski, A. (ed.) SAS 2018. LNCS, vol. 11002, pp. 43–55. Springer, Cham (2018). Scholar
  23. 23.
    Müller, C., Seidl, H., Zalinescu, E.: Inductive invariants for noninterference in multi-agent workflows. In: 31st IEEE Computer Security Foundations Symposium, CSF 2018, Oxford, UK, 9–12 July 2018, pp. 247–261. IEEE (2018).
  24. 24.
    Padon, O., Immerman, N., Karbyshev, A., Lahav, O., Sagiv, M., Shoham, S.: Decentralizing SDN policies. In: ACM SIGPLAN Notices, vol. 50, pp. 663–676. ACM (2015)Google Scholar
  25. 25.
    Padon, O., Immerman, N., Shoham, S., Karbyshev, A., Sagiv, M.: Decidability of inferring inductive invariants. In: Proceedings of the 43rd Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL 2016, pp. 217–231. ACM (2016).
  26. 26.
    Padon, O., Losa, G., Sagiv, M., Shoham, S.: Paxos made EPR: decidable reasoning about distributed protocols. Proc. ACM Programm. Lang. 1(OOPSLA), 108 (2017)Google Scholar
  27. 27.
    Padon, O., McMillan, K.L., Panda, A., Sagiv, M., Shoham, S.: Ivy: safety verification by interactive generalization. ACM SIGPLAN Notices 51(6), 614–630 (2016)CrossRefGoogle Scholar
  28. 28.
    Ramsey, F.P.: On a problem of formal logic. In: Gessel, I., Rota, G.C. (eds.) Classic Papers in Combinatorics. MBC, pp. 1–24. Birkhäuser, Boston (2009). Scholar
  29. 29.
    Rosenberg, A.L.: On multi-head finite automata. IBM J. Res. Dev. 10(5), 388–394 (1966)MathSciNetCrossRefGoogle Scholar
  30. 30.
    Russell, S.J., Norvig, P.: Artificial Intelligence: A Modern Approach. Pearson Education Limited, Kuala Lumpur (2016)zbMATHGoogle Scholar
  31. 31.
    Seidl, H., Müller, C., Finkbeiner, B.: How to win first-order safety games. arXiv preprint arXiv:1908.05964 (2019)
  32. 32.
    Seidl, H., Müller, C., Finkbeiner, B.: How to win first order safety games - software artifact, October 2019.
  33. 33.
    Spielmann, M.: Abstract state machines: verification problems and complexity. Ph.D. thesis, RWTH Aachen University, Germany (2000).
  34. 34.
    Walker, A., Ryzhyk, L.: Predicate abstraction for reactive synthesis. In: 2014 Formal Methods in Computer-Aided Design (FMCAD), pp. 219–226, October 2014.
  35. 35.
    Wernhard, C.: Second-order quantifier elimination on relational monadic formulas – a basic method and some less expected applications. In: De Nivelle, H. (ed.) TABLEAUX 2015. LNCS (LNAI), vol. 9323, pp. 253–269. Springer, Cham (2015). Scholar

Copyright information

© Springer Nature Switzerland AG 2020

Authors and Affiliations

  • Helmut Seidl
    • 1
  • Christian Müller
    • 1
    • 2
    Email author
  • Bernd Finkbeiner
    • 2
  1. 1.Technische Universität MünchenMunichGermany
  2. 2.Saarland UniversitySaarbrückenGermany

Personalised recommendations