Infinitary Limit Program Verification

• Infinitary Limit Program is a construction that reduces the safety verification of infinite families of systems to a single, canonical limit structure.
• It exploits local symmetry and universality through Fraïssé limit constructions to enable automated and complete safety proofs.
• The approach uses T-predicate automata and well-structured search methods to establish proof equivalence between finite systems and the limit program.

An infinitary limit program, in the context of safety verification for parameterized programs over arbitrary topologies, is a construction that allows the reduction of verification for an entire (potentially infinite) family of finite-state or infinite-state systems to analysis of a single, canonical infinitary structure. This methodology is deployed to exploit local symmetry and universality in the underlying class of system topologies, thereby yielding strong results for algorithmic verification—including decision procedures—without requiring explicit axiomatization of every member of the family. The approach is grounded in recent advances in model theory, automata theory, and parametric proof systems (Cheng et al., 26 Jan 2026).

1. Parameterized Programs, Topologies, and Symmetry

A parameterized program consists of an infinite family $\{P_i\}$ of concurrent programs, each defined over a finite (or possibly infinite) topology $T_i$ determined by a fixed first-order vocabulary $V$ (which includes predicates and functions but no constants). These topologies model communication networks or interconnection graphs for processes or components.

Nodes within each $T_i$ serve as the indices for indexed commands (i.e., program actions parameterized by location). Symmetry arises from local structural isomorphisms: two tuples of nodes $\vec{a} \in T^k$, $\vec{b} \in {T'}^k$ are considered locally isomorphic (denoted $\vec{a} \simeq \vec{b}$) if there is a structure isomorphism between their generated neighborhoods, enabling transfer of proof arguments across isomorphic localities (Cheng et al., 26 Jan 2026).

2. Parametric Proof Spaces and Local Proof Reasoning

A parametric proof space is a set of valid Hoare triples (precondition, command sequence, postcondition), syntactically formulated over a universal topology $T$ encompassing all $T_i$ as substructures. The proof space is syntactically closed under three inference rules:

• Sequencing: Chaining of triples via shared postconditions/preconditions, respecting combinatorial entailment of assertions.
• Conjunction: Parallel composition of independent proof arguments for the same command.
• Parametric Symmetry: Transport of triples along local isomorphisms between neighborhoods in $T$, allowing local argument reuse even when no global symmetry exists.

The language $T_i$0 recognized by a proof space $T_i$1 consists of all runs whose error traces are covered by the closure of $T_i$2, and is closed under local isomorphism $T_i$3 (Cheng et al., 26 Jan 2026).

3. Fraïssé Limit Construction: Definition and Properties

To enable reasoning about the entire family $T_i$4, one constructs a Fraïssé-style limit $T_i$5. This countable structure is the unique (up to isomorphism) ultrahomogeneous, universal limit of the class of all finitely generated substructures of the $T_i$6. Formally, for any finite substructure in any $T_i$7, there is an isomorphic copy within $T_i$8, and all isomorphisms between finite substructures extend to automorphisms of $T_i$9.

This universality and homogeneity ensure that any safety property or counterexample for a member of the family is also manifest in the limit structure. Every finite topology embeds in $V$0, and the local isomorphism types of subtuples remain representative for the whole class (Cheng et al., 26 Jan 2026).

4. Definition of the Infinitary Limit Program

Given the Fraïssé limit topology $V$1, one defines the infinitary limit program $V$2 over $V$3—that is, $V$4 comprises one instance of each indexed command for each node in $V$5, following the same operational semantics as in the family $V$6 but interpreted over the universal structure.

Each command is lifted by local isomorphism expansions so every run/behavior in a finite $V$7 corresponds, modulo $V$8, to a run/behavior in $V$9, and vice versa (Cheng et al., 26 Jan 2026).

5. Completeness and Verification Equivalence

A central theorem establishes logical equivalence between the verification problems for the family and its infinitary limit:

• The parameterized system $T_i$0 is safe (no error admits a run in any $T_i$1) if and only if the limit program $T_i$2 is safe (no error run in $T_i$3).
• Any $T_i$4-proof space $T_i$5 covers (proves safety for) all $T_i$6 if and only if it covers $T_i$7, i.e., if $T_i$8.

It thus suffices to construct and analyze $T_i$9 and verify the inclusion $\vec{a} \in T^k$0 rather than working with the potentially infinite union over $\vec{a} \in T^k$1 of $\vec{a} \in T^k$2 (Cheng et al., 26 Jan 2026).

6. Decision Procedures: Automata and Well-Structured Search

Error traces and proof spaces are represented using $\vec{a} \in T^k$3-predicate automata (T-PAs), automata whose alphabet is $\vec{a} \in T^k$4 and whose transition function uses positive quantifier-free formulas over a vocabulary extending $\vec{a} \in T^k$5. Under effective finiteness conditions on the local isomorphism types in $\vec{a} \in T^k$6, both $\vec{a} \in T^k$7 and $\vec{a} \in T^k$8 can be accepted by T-PAs.

The inclusion check $\vec{a} \in T^k$9 is reduced to the emptiness of $\vec{b} \in {T'}^k$0, which is semi-decidable via a standard backward coverability search for well-structured transition systems (WSTS). Decidability is achieved when:

• $\vec{b} \in {T'}^k$1 is homogeneous and $\vec{b} \in {T'}^k$2 is finite for all $\vec{b} \in {T'}^k$3,
• Quantifier-free satisfiability in $\vec{b} \in {T'}^k$4 is decidable,
• Covering is a well-quasi-order (WQO) on the reachable configurations of the automaton (e.g., for Boolean data and homogeneous topologies like rings) (Cheng et al., 26 Jan 2026).

7. Illustrative Example: Token-Passing Ring

In the standard token-passing ring, each process updates the token bit at its neighbors. The limit program $\vec{b} \in {T'}^k$5 is defined over the universal ring $\vec{b} \in {T'}^k$6, the countable disjoint union of all finite rings. The parametric proof space $\vec{b} \in {T'}^k$7 is constructed from a finite basis (e.g., triples for rings of size 3), closed under local symmetry, sequencing, and conjunction.

The error language $\vec{b} \in {T'}^k$8 and the coverage language $\vec{b} \in {T'}^k$9 are recognized by monadic T-PAs. Verification reduces to checking emptiness of their intersection, which is guaranteed decidable by the finiteness of $\vec{a} \simeq \vec{b}$0 and WQO properties, providing a fully constructive and complete verification algorithm for safety properties across all ring sizes (Cheng et al., 26 Jan 2026).