  Satisfiability Modulo Theories (SMT) solvers have been successfully applied
to solve many problems in formal verification such as bounded model checking
(BMC) for many classes of systems from integrated circuits to cyber-physical
systems. Typically, BMC is performed by checking satisfiability of a possibly
long, but quantifier-free formula. However, BMC problems can naturally be
encoded as quantified formulas over the number of BMC steps. In this approach,
we then use decision procedures supporting quantifiers to check satisfiability
of these quantified formulas. This approach has previously been applied to
perform BMC using a Quantified Boolean Formula (QBF) encoding for purely
discrete systems, and then discharges the QBF checks using QBF solvers. In this
paper, we present a new quantified encoding of BMC for rectangular hybrid
automata (RHA), which requires using more general logics due to the real
(dense) time and real-valued state variables modeling continuous states. We
have implemented a preliminary experimental prototype of the method using the
HyST model transformation tool to generate the quantified BMC (QBMC) queries
for the Z3 SMT solver. We describe experimental results on several timed and
hybrid automata benchmarks, such as the Fischer and Lynch-Shavit mutual
exclusion algorithms. We compare our approach to quantifier-free BMC
approaches, such as those in the dReach tool that uses the dReal SMT solver,
and the HyComp tool built on top of nuXmv that uses the MathSAT SMT solver.
Based on our promising experimental results, QBMC may in the future be an
effective and scalable analysis approach for RHA and other classes of hybrid
automata as further improvements are made in quantifier handling in SMT solvers
such as Z3.
