Skip to main content

How to Win First-Order Safety Games

Part of the Lecture Notes in Computer Science book series (LNTCS,volume 11990)


First-order (FO) transition systems have recently attracted attention for the verification of parametric systems such as network protocols, software-defined networks or multi-agent workflows like conference management systems. Functional correctness or noninterference of these systems have conveniently been formulated as safety or hypersafety properties, respectively. In this article, we take the step from verification to synthesis—tackling the question whether it is possible to automatically synthesize predicates to enforce safety or hypersafety properties like noninterference. For that, we generalize FO transition systems to FO safety games. For FO games with monadic predicates only, we provide a complete classification into decidable and undecidable cases. For games with non-monadic predicates, we concentrate on universal first-order invariants, since these are sufficient to express a large class of properties—for example noninterference. We identify a non-trivial sub-class where invariants can be proven inductive and FO winning strategies be effectively constructed. We also show how the extraction of weakest FO winning strategies can be reduced to SO quantifier elimination itself. We demonstrate the usefulness of our approach by automatically synthesizing nontrivial FO specifications of messages in a leader election protocol as well as for paper assignment in a conference management system to exclude unappreciated disclosure of reports.


  • First order safety games
  • Universal invariants
  • First Order Logic
  • Second order quantifier elimination

The project has received funding from the European Research Council (ERC) under the European Union’s Horizon 2020 research and innovation programme under grant agreement No. 787367 (PaVeS) as well as grant agreement No. 683300 (OSARES). This work was also partially supported by the German Research Foundation (DFG) as part of the Collaborative Research Center “Foundations of Perspicuous Software Systems” (TRR 248, 389792660).

This is a preview of subscription content, access via your institution.

Buying options

USD   29.95
Price excludes VAT (USA)
  • DOI: 10.1007/978-3-030-39322-9_20
  • Chapter length: 23 pages
  • Instant PDF download
  • Readable on all devices
  • Own it forever
  • Exclusive offer for individuals only
  • Tax calculation will be finalised during checkout
USD   69.99
Price excludes VAT (USA)
  • ISBN: 978-3-030-39322-9
  • Instant PDF download
  • Readable on all devices
  • Own it forever
  • Exclusive offer for individuals only
  • Tax calculation will be finalised during checkout
Softcover Book
USD   89.99
Price excludes VAT (USA)
Fig. 1.
Fig. 2.
Fig. 3.


  1. 1.

    In general, edges may use multiple input predicates of the same type. This can, however, always be simulated by a sequence of edges that stores the contents of the input relations in auxiliary predicates from \({\mathcal {R}_{ state }}\) one by one, before realizing the substitution of the initial edge by means of the auxiliary predicates.

  2. 2.

    Predicates under the control of player \(\mathcal {B}\) can be used to introduce equalities through SO existential quantifier elimination (see [31]).

  3. 3.

    The Bernays-Schönfinkel-Ramsey fragment contains all formulas of First Order Logic that have a quantifier prefix of \(\exists ^*\forall ^*\) and do not contain function symbols. Satisfiability of formulas in BSR is known to be decidable [28].


  1. Ackermann, W.: Untersuchungen über das Eliminationsproblem der mathematischen Logik. Math. Ann. 110, 390–413 (1935)

    CrossRef  MathSciNet  Google Scholar 

  2. de Alfaro, L., Roy, P.: Solving games via three-valued abstraction refinement. In: Caires, L., Vasconcelos, V.T. (eds.) CONCUR 2007. LNCS, vol. 4703, pp. 74–89. Springer, Heidelberg (2007).

    CrossRef  Google Scholar 

  3. Ball, T., et al.: Vericon: towards verifying controller programs in software-defined networks. In: ACM Sigplan Notices, vol. 49, pp. 282–293. ACM (2014)

    Google Scholar 

  4. Behmann, H.: Beiträge zur Algebra der Logik, insbesondere zum Entscheidungsproblem. Math. Ann. 86(3–4), 163–229 (1922)

    CrossRef  MathSciNet  Google Scholar 

  5. Börger, E., Stärk, R.: History and survey of ASM research. In: Börger, E., Stärk, R. (eds.) Abstract State Machines, pp. 343–367. Springer, Berlin (2003).

    CrossRef  MATH  Google Scholar 

  6. Börger, E., Stärk, R.: Tool support for ASMs. In: Börger, E., Stärk, R. (eds.) Abstract State Machines, pp. 313–342. Springer, Berlin (2003).

    CrossRef  MATH  Google Scholar 

  7. Brachman, R.J., Levesque, H.J., Reiter, R.: Knowledge Representation. MIT Press, Cambridge (1992)

    Google Scholar 

  8. Bradley, A.R.: SAT-based model checking without unrolling. In: Jhala, R., Schmidt, D. (eds.) VMCAI 2011. LNCS, vol. 6538, pp. 70–87. Springer, Heidelberg (2011).

    CrossRef  Google Scholar 

  9. de Moura, L., Bjørner, N.: Z3: an efficient SMT solver. In: Ramakrishnan, C.R., Rehof, J. (eds.) TACAS 2008. LNCS, vol. 4963, pp. 337–340. Springer, Heidelberg (2008).

    CrossRef  Google Scholar 

  10. Dimitrova, R., Finkbeiner, B.: Abstraction refinement for games with incomplete information. In: IARCS Annual Conference on Foundations of Software Technology and Theoretical Computer Science FSTTCS, vol. 2008, pp. 175–186 (2008)

    Google Scholar 

  11. Dimitrova, R., Finkbeiner, B.: Counterexample-guided synthesis of observation predicates. In: Jurdziński, M., Ničković, D. (eds.) FORMATS 2012. LNCS, vol. 7595, pp. 107–122. Springer, Heidelberg (2012).

    CrossRef  MATH  Google Scholar 

  12. Finkbeiner, B., Müller, C., Seidl, H., Zalinescu, E.: Verifying security policies in multi-agent workflows with loops. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 2017, Dallas, TX, USA, 30 October–03 November 2017, pp. 633–645. IEEE (2017).

  13. Finkbeiner, B., Seidl, H., Müller, C.: Specifying and verifying secrecy in workflows with arbitrarily many agents. In: Artho, C., Legay, A., Peled, D. (eds.) ATVA 2016. LNCS, vol. 9938, pp. 157–173. Springer, Cham (2016).

    CrossRef  MATH  Google Scholar 

  14. Gabbay, D.M., Schmidt, R., Szalas, A.: Second Order Quantifier Elimination: Foundations. Computational Aspects and Applications. College Publications, Michigan (2008)

    MATH  Google Scholar 

  15. Gurevich, Y.: Evolving algebras 1993: Lipari guide. arXiv preprint arXiv:1808.06255 (2018)

  16. Henzinger, T.A., Jhala, R., Majumdar, R.: Counterexample-guided control. In: Baeten, J.C.M., Lenstra, J.K., Parrow, J., Woeginger, G.J. (eds.) ICALP 2003. LNCS, vol. 2719, pp. 886–902. Springer, Heidelberg (2003).

    CrossRef  Google Scholar 

  17. Holzer, M., Kutrib, M., Malcher, A.: Complexity of multi-head finite automata: origins and directions. Theoret. Comput. Sci. 412(1–2), 83–96 (2011)

    CrossRef  MathSciNet  Google Scholar 

  18. Karbyshev, A., Bjørner, N., Itzhaky, S., Rinetzky, N., Shoham, S.: Property-directed inference of universal invariants or proving their absence. J. ACM (JACM) 64(1), 7 (2017)

    CrossRef  MathSciNet  Google Scholar 

  19. Miller, D.A., Nadathur, G.: Higher-order logic programming. In: Shapiro, E. (ed.) ICLP 1986. LNCS, vol. 225, pp. 448–462. Springer, Heidelberg (1986).

    CrossRef  Google Scholar 

  20. Levesque, H.J., Reiter, R., Lespérance, Y., Lin, F., Scherl, R.B.: GOLOG: a logic programming language for dynamic domains. J. Logic Programm. 31(1), 59–83 (1997).

    CrossRef  MathSciNet  MATH  Google Scholar 

  21. Mazala, R.: Infinite games. In: Grädel, E., Thomas, W., Wilke, T. (eds.) Automata Logics, and Infinite Games. LNCS, vol. 2500, pp. 23–38. Springer, Heidelberg (2002).

    CrossRef  MATH  Google Scholar 

  22. McMillan, K.L., Padon, O.: Deductive verification in decidable fragments with ivy. In: Podelski, A. (ed.) SAS 2018. LNCS, vol. 11002, pp. 43–55. Springer, Cham (2018).

    CrossRef  Google Scholar 

  23. Müller, C., Seidl, H., Zalinescu, E.: Inductive invariants for noninterference in multi-agent workflows. In: 31st IEEE Computer Security Foundations Symposium, CSF 2018, Oxford, UK, 9–12 July 2018, pp. 247–261. IEEE (2018).

  24. Padon, O., Immerman, N., Karbyshev, A., Lahav, O., Sagiv, M., Shoham, S.: Decentralizing SDN policies. In: ACM SIGPLAN Notices, vol. 50, pp. 663–676. ACM (2015)

    CrossRef  Google Scholar 

  25. Padon, O., Immerman, N., Shoham, S., Karbyshev, A., Sagiv, M.: Decidability of inferring inductive invariants. In: Proceedings of the 43rd Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL 2016, pp. 217–231. ACM (2016).

  26. Padon, O., Losa, G., Sagiv, M., Shoham, S.: Paxos made EPR: decidable reasoning about distributed protocols. Proc. ACM Programm. Lang. 1(OOPSLA), 108 (2017)

    Google Scholar 

  27. Padon, O., McMillan, K.L., Panda, A., Sagiv, M., Shoham, S.: Ivy: safety verification by interactive generalization. ACM SIGPLAN Notices 51(6), 614–630 (2016)

    CrossRef  Google Scholar 

  28. Ramsey, F.P.: On a problem of formal logic. In: Gessel, I., Rota, G.C. (eds.) Classic Papers in Combinatorics. MBC, pp. 1–24. Birkhäuser, Boston (2009).

    CrossRef  Google Scholar 

  29. Rosenberg, A.L.: On multi-head finite automata. IBM J. Res. Dev. 10(5), 388–394 (1966)

    CrossRef  MathSciNet  Google Scholar 

  30. Russell, S.J., Norvig, P.: Artificial Intelligence: A Modern Approach. Pearson Education Limited, Kuala Lumpur (2016)

    MATH  Google Scholar 

  31. Seidl, H., Müller, C., Finkbeiner, B.: How to win first-order safety games. arXiv preprint arXiv:1908.05964 (2019)

  32. Seidl, H., Müller, C., Finkbeiner, B.: How to win first order safety games - software artifact, October 2019.

  33. Spielmann, M.: Abstract state machines: verification problems and complexity. Ph.D. thesis, RWTH Aachen University, Germany (2000).

  34. Walker, A., Ryzhyk, L.: Predicate abstraction for reactive synthesis. In: 2014 Formal Methods in Computer-Aided Design (FMCAD), pp. 219–226, October 2014.

  35. Wernhard, C.: Second-order quantifier elimination on relational monadic formulas – a basic method and some less expected applications. In: De Nivelle, H. (ed.) TABLEAUX 2015. LNCS (LNAI), vol. 9323, pp. 253–269. Springer, Cham (2015).

    CrossRef  MATH  Google Scholar 

Download references

Author information

Authors and Affiliations


Corresponding author

Correspondence to Christian Müller .

Editor information

Editors and Affiliations

Rights and permissions

Reprints and Permissions

Copyright information

© 2020 Springer Nature Switzerland AG

About this paper

Verify currency and authenticity via CrossMark

Cite this paper

Seidl, H., Müller, C., Finkbeiner, B. (2020). How to Win First-Order Safety Games. In: Beyer, D., Zufferey, D. (eds) Verification, Model Checking, and Abstract Interpretation. VMCAI 2020. Lecture Notes in Computer Science(), vol 11990. Springer, Cham.

Download citation

  • DOI:

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-39321-2

  • Online ISBN: 978-3-030-39322-9

  • eBook Packages: Computer ScienceComputer Science (R0)