## Programming a symbolic model checker in a fully expansive theorem prover (2003)

### Cached

### Download Links

- [www.cl.cam.ac.uk]
- [www.cl.cam.ac.uk]
- [www.cl.cam.ac.uk]
- DBLP

### Other Repositories/Bibliography

Venue: | Proceedings of the 16th International Conference on Theorem Proving in Higher Order Logics, volume 2758 of Lecture Notes in Computer Science |

Citations: | 16 - 5 self |

### BibTeX

@INPROCEEDINGS{Amjad03programminga,

author = {Hasan Amjad},

title = {Programming a symbolic model checker in a fully expansive theorem prover},

booktitle = {Proceedings of the 16th International Conference on Theorem Proving in Higher Order Logics, volume 2758 of Lecture Notes in Computer Science},

year = {2003},

pages = {171--187},

publisher = {Springer-Verlag}

}

### Years of Citing Articles

### OpenURL

### Abstract

Abstract. Model checking and theorem proving are two complementary approaches to formal verification. In this paper we show how binary decision diagram (BDD) based symbolic model checking algorithms may be embedded in a theorem prover to take advantage of the comparatively secure environment without incurring an unacceptable performance penalty. 1

### Citations

2408 | Model Checking
- Clarke, Grumberg, et al.
- 1999
(Show Context)
Citation Context ... letters) such that for any action a ∈ T , a ⊆ S × S. – L : S → 2 AP labels each state with the set of atomic propositions true in that state. We now present the syntax of Lµ, essentially as given in =-=[6]-=-. Definition 2. Let VAR be the set of relational variables, p ∈ AP be an atomic proposition and a ∈ T be an action. Then if f and g are Lµ formulas, so are: T rue, F alse, p, ¬f, f ∧ g, f ∨ g (the pro... |

1296 |
Symbolic Model Checking
- McMillan
- 1992
(Show Context)
Citation Context ...xioms and inference rules only, i.e. by proof. This reliance on a very small trusted core is often named the “fully-expansive” approach and gives a high assurance of security.sSymbolic model checking =-=[21]-=- is a popular model checking technique. Sets of states are represented by the BDDs [3] of their characteristic functions. This representation is compact and provides an efficient 1 way to test set equ... |

876 | Symbolic Boolean manipulation with ordered binary-decision diagrams
- Bryant
- 1992
(Show Context)
Citation Context ...re is often named the “fully-expansive” approach and gives a high assurance of security.sSymbolic model checking [21] is a popular model checking technique. Sets of states are represented by the BDDs =-=[3]-=- of their characteristic functions. This representation is compact and provides an efficient 1 way to test set equality and do image computations. This is useful because evaluating temporal logic form... |

847 |
A formulation of the simple theory of types
- Church
- 1940
(Show Context)
Citation Context ...(in the sense of soundness not being compromised), we have chosen the HOL theorem prover [16] for our task. HOL is based on the HOL logic [15] which is an extension of Church’s simple theory of types =-=[5]-=-, and is written in Moscow ML. Terms (of ML type term) in the logic can be freely constructed. Theorems (of ML type thm) can be constructed using the core axioms and inference rules only, i.e. by proo... |

623 | Model Checking and Abstraction
- Clarke, Grumberg, et al.
- 1994
(Show Context)
Citation Context ...ker for logics other than Lµ, justified by a semantics-based translation of the language into Lµ using the theorem prover; implementing more powerful versions of standard abstraction frameworks (e.g. =-=[7, 8]-=-) using the decision procedures and simplifiers provided by HOL. A different aspect that we have not touched on is that this approach enables us to simultaneously get a handle on both the syntax and s... |

529 |
A lattice-theorethic Fixpoint Theorem and its applications
- Tarski
- 1955
(Show Context)
Citation Context ...x-point of the predicate transformer τ : 2 S → 2 S given by τ(W ) = [f ]M e[Q ← W ] Environments can be given a partial ordering ⊆ under component-wise subset inclusion. By Tarski’s fix-point theorem =-=[29]-=-, if e[Q ← W ] ⊆ e ′ [Q ← W ′ ] ⇒ [f(Q)]M e[Q ← W ] ⊆ [f(Q)]M e ′ [Q ← W ′ ] i.e. the semantics evaluate monotonically over environments, then the existence of fix-points is guaranteed. In fact, since... |

256 |
Results on the propositional mu–calculus
- Kozen
- 1983
(Show Context)
Citation Context ...culus is underway. (1)s3 Model Checking Our general approach is independent of the choice of temporal logic. We shall apply it to the model checking procedure for the propositional µ-calculus Lµ from =-=[19]-=-. Lµ is very expressive and a model checker for it gives us model checkers for the popular temporal logics CTL and LTL. 2 Formulae of Lµ describe properties of a system that can be represented as a st... |

225 |
Efficient model checking in fragments of the propositional mu-calculus
- Emerson, Lei
- 1986
(Show Context)
Citation Context ...reliminary because we have as yet not implemented any of the standard optimisations such as partitioning the transition relation, iterative squaring, caching or exploiting non-alternating quantifiers =-=[11]-=-. All these would speed up the BDD component and increase the performance difference. On the other hand, our test bed is a toy example and the expectation is that even with all these optimisations, th... |

206 | PVS: Combining specification, proof checking, and model checking
- Owre, Rajan, et al.
- 1996
(Show Context)
Citation Context ... Improved integrations of theorem provers with global model checkers typically enable the theorem prover to call upon the model checker as a black-box decision procedure given as an atomic proof rule =-=[24, 22]-=-. The prover translates expressions involving values over finite domains into purely propositional expressions that can be represented by BDDs. This allows use of the result as a theorem (as in our fr... |

198 |
Melham, editors. Introduction to HOL: A Theorem Proving Environment for Higher Order Logic
- Gordon, F
- 1993
(Show Context)
Citation Context ...s within acceptable bounds. Since our emphasis is on security (in the sense of soundness not being compromised), we have chosen the HOL theorem prover [16] for our task. HOL is based on the HOL logic =-=[15]-=- which is an extension of Church’s simple theory of types [5], and is written in Moscow ML. Terms (of ML type term) in the logic can be freely constructed. Theorems (of ML type thm) can be constructed... |

142 |
Abstract syntax and variable binding
- Fiore, Plotkin, et al.
- 1999
(Show Context)
Citation Context ...le to pass a well-formed Kripke structure M, a well-formed formula f, an environment e and a variable map ρ to the model checking procedure T which returns a judgement of the form ρ (s |= e M f) ↦→ b =-=(12)-=- where the state s is a boolean tuple comprising the atomic propositions M is defined over.sPreliminaries The first step in implementing the model checker is to prove the well-formedness of M and f. T... |

103 | Local model checking in the modal mu-calculus - Stirling, Walker - 1991 |

73 | Automatic deductive verification with invisible invariants,” Tools and Algorithms for the Construction and Analysis of Systems
- Pnueli, Ruah, et al.
- 2001
(Show Context)
Citation Context ...e system resulting in spurious counter-examples. Decision procedures for some subsets of first order logic have been used in automatic discovery of abstraction predicates [9] and invariant generation =-=[23]-=-. There is no technical obstacle to implementing these frameworks in our setting. Well-known tools that implement some of the research sketched here include [16, ?,?,?]. 7 Concluding Remarks The imple... |

69 |
Representing circuits more efficiently in symbolic model checking
- Burch, Clarke, et al.
- 1991
(Show Context)
Citation Context ... 10.14 8.08 1.69 6 11.94 9.04 1.45 7 15.29 9.16 1.32 8 18.93 8.97 1.29 The model is a simple 3-stage pipelined ALU, described in [6] and earlier work. The BDD variable ordering is that recommended in =-=[4]-=-. We do not have space to describe the model in detail. The properties we checked use fixed point computations and thus thoroughly exercise both implementations. All benchmarks were conducted in the s... |

55 | The state of spin
- Holzmann, Peled
- 1996
(Show Context)
Citation Context ...bound and free variables. We use f(Q1, Q2, . . .) to denote that Q1, Q2, . . . occur free in f. 2 Though from a practical viewpoint, model checkers for Lµ are not as efficient as say SMV [21] or SPIN =-=[17]-=-. Note also that for logics that do not admit a direct syntactic embedding into Lµ, e.g. LTL, the translation into Lµ is non-trivial and a fully-expansive translation provides much needed assurance of... |

52 | Five axioms of alpha-conversion
- Gordon, Melham
- 1997
(Show Context)
Citation Context ...e τ = λW.T [f ] ρ M e[Q ← W ] and τ k (∅) = τ k+1 (∅) (see Definitions 3 and 6). Thus, by Theorem 12, if we can show that in the (i + 1) th iteration F P f Q M e[Q ← ∅] i = F P f Q M e[Q ← ∅] (i + 1) =-=(13)-=- we have the required result (using Definition 10). To start, we require a “bootstrap” theorem. Theorem 13. ∀ f M e Q s.F P f Q M e[Q ← ∅] 0 s = F Proof Sketch Immediate from Definition 9 and the HOL ... |

49 | Counter-example based predicate discovery in predicate abstraction
- DAS, L
- 2002
(Show Context)
Citation Context ...oo much non-determinism to the system resulting in spurious counter-examples. Decision procedures for some subsets of first order logic have been used in automatic discovery of abstraction predicates =-=[9]-=- and invariant generation [23]. There is no technical obstacle to implementing these frameworks in our setting. Well-known tools that implement some of the research sketched here include [16, ?,?,?]. ... |

44 | SAT based abstraction-refinement using ILP and machine learning techniques
- Clarke, Gupta, et al.
- 2002
(Show Context)
Citation Context ...ker for logics other than Lµ, justified by a semantics-based translation of the language into Lµ using the theorem prover; implementing more powerful versions of standard abstraction frameworks (e.g. =-=[7, 8]-=-) using the decision procedures and simplifiers provided by HOL. A different aspect that we have not touched on is that this approach enables us to simultaneously get a handle on both the syntax and s... |

38 | Model checking guided abstraction and analysis - Saidi - 2000 |

35 | Model checking for infinite state systems using data abstraction, Computer Aided Verification
- Filkorn
- 1995
(Show Context)
Citation Context ... g. s |= e M f ∧ g ⇔ s |= e M f ∧ s |= e M g (7) ∀ s M e f g. s |= e M f ∨ g ⇔ s |= e M f ∨ s |= e M g (8) ∀ s M e Q. s |= e M Q ⇔ e Q s (9) ∀ s M e a f. s |= e M 〈a〉f ⇔ ∃q.(M.T a)(s, q) ∧ q |= e M f =-=(10)-=- e[Q←F P f Q M e[Q←X]n] ∀ f M e Q s X n. s |= M f ⇔ F P f Q M e[Q ← X] (n + 1) s (11) Since we need to test semantics for boolean satisfiability (Proposition 5 requires this), we need to define satisf... |

35 | Verification of a multiplier: 64 bits and beyond
- Kurshan, Lamport
- 1993
(Show Context)
Citation Context ...TL* can be found in [27]. This work also proves the proof system sound and complete using game-theoretic analysis. An early example of combination of theorem provers and model checkers can be seen in =-=[20]-=-. Here the prover is used to split the proof into various sub-goals which are small enough to be verified by a separate model checker. There issno actual integration so the translation between the lan... |

34 |
Heijenoort, editor. From Frege to Gödel: A Source Book
- van
- 1967
(Show Context)
Citation Context ...S : α set, S0 : α set, T : string → (α×α) → bool and L : α → β → bool representing components so named in Definition 1. 4 Note that action names are modelled as strings. 4 Sets in HOL are not ZF sets =-=[31]-=-. A set S : αset in HOL is a predicate of type α → bool. Thus set membership x ∈ S is equivalent to the application Sx. We use both notations as appropriate.sAt the time of writing HOL did not support... |

31 | Combining theorem proving and trajectory evaluation in an industrial environment
- Aagaard, Jones, et al.
- 1998
(Show Context)
Citation Context ...BDDs as a built-in datatype. In [18] Voss was interfaced to HOL and verification using a combination of deduction and symbolic trajectory evaluation (STE) was demonstrated. Later work can be found in =-=[1]-=-. Recent developments have been outside the public domain after the developers moved to Intel. Local model checkers have been implemented in a purely deductive fashion. This is possible because local ... |

29 |
Voss - a formal hardware verification system user’s guide
- Seger
- 1993
(Show Context)
Citation Context ...nt, which does not scale as badly as BDDs for larger examples, will catch up when the program is run for harder examples. 6 Related Work The system closest in spirit to our own is the HOL-Voss system =-=[26]-=-. Voss has a lazy functional language FL with BDDs as a built-in datatype. In [18] Voss was interfaced to HOL and verification using a combination of deduction and symbolic trajectory evaluation (STE)... |

21 |
Programming Combinations of Deduction and BDD-based Symbolic Calculation
- Gordon
(Show Context)
Citation Context ...d ∗ term bdd → term bdd) ρ(v1) = n1 . . . ρ(vp) = np ρ t1 ↦→ b1 ρ t2 ↦→ b2 ρ ∃v1 . . . vp.t1 op t2 ↦→ appex b1 b2 (n1, . . . , np) falsity, and NOT,AND and OR denote the eponymous BDD operations (see =-=[14]-=- for details). In practice, existential quantification of conjunction (often called the relational product or image computation) occurs frequently and is an expensive operation. BuDDy provides a speci... |

19 |
The hol-voss system: Model-checking inside a generalpurpose theorem prover
- Joyce, Seger
- 1993
(Show Context)
Citation Context ...the program is run for harder examples. 6 Related Work The system closest in spirit to our own is the HOL-Voss system [26]. Voss has a lazy functional language FL with BDDs as a built-in datatype. In =-=[18]-=- Voss was interfaced to HOL and verification using a combination of deduction and symbolic trajectory evaluation (STE) was demonstrated. Later work can be found in [1]. Recent developments have been o... |

14 | A note on model checking the modal ν-calculus - Winskel - 1989 |

11 | Combinations of model checking and theorem proving
- Uribe
- 2000
(Show Context)
Citation Context ...e complex systems but requires skilled manual guidance for verification and human insight for debugging. An increasing amount of attention has thus been focused on combining these two approaches (see =-=[30]-=- for a survey). In this paper we demonstrate an approach to embedding a model checker in a theorem prover. The expectation is that this will ease combination of state-based and definitional models and... |

8 |
Srivas. An integration of model checking and automated proof checking
- Rajan, Shankar, et al.
- 1995
(Show Context)
Citation Context ... Improved integrations of theorem provers with global model checkers typically enable the theorem prover to call upon the model checker as a black-box decision procedure given as an atomic proof rule =-=[24, 22]-=-. The prover translates expressions involving values over finite domains into purely propositional expressions that can be represented by BDDs. This allows use of the result as a theorem (as in our fr... |

4 |
Automating a model checker for recursive modal assertions in HOL
- Agerholm, Skjødt
- 1990
(Show Context)
Citation Context ...ble because local model checking [?,28, 32] does not require external oracles like BDD engines for efficiency. Thus it is difficult to directly compare this work with our own global model checker. In =-=[2]-=- a local model checking algorithm is given for Lµ. However monotonicity conditions for assertions are proved on-line rather than as a general theorem (e.g. Theorem 11) that can later be specialised. A... |

2 |
Deductive Local Model Checking
- Sprenger
- 2000
(Show Context)
Citation Context ...ty conditions for assertions are proved on-line rather than as a general theorem (e.g. Theorem 11) that can later be specialised. A deeper treatment for the less expressive logic CTL* can be found in =-=[27]-=-. This work also proves the proof system sound and complete using game-theoretic analysis. An early example of combination of theorem provers and model checkers can be seen in [20]. Here the prover is... |