## Proving Invariants via Rewriting and Abstraction (2005)

Citations: | 2 - 2 self |

### BibTeX

@TECHREPORT{Sumners05provinginvariants,

author = {Rob Sumners and Sandip Ray},

title = {Proving Invariants via Rewriting and Abstraction},

institution = {},

year = {2005}

}

### OpenURL

### Abstract

We present a deductive method for proving invariants of reactive systems. Our approach uses term rewriting to reduce invariant proofs to reachability analysis on a finite graph. This substantially automates invariant proofs by obviating the need to define inductive invariants while still benefitting from the expressiveness of deductive methods. We implement a procedure supporting this approach which interfaces with the ACL2 theorem prover. The interface affords sound extension of our procedure with rewrite rules based on proven theorems. We demonstrate the method in the verification of cache coherence protocols. 1

### Citations

2028 |
Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints
- Cousot, Cousot
- 1977
(Show Context)
Citation Context ...ate abstraction involves creating an abstract model whose state variables correspond to predicates in the concrete system. The idea is derived from the more general notion of abstract interpretations =-=[15]-=-. Graf and Saidi [1] made the idea explicit and used it to verify communication protocols in PVS. Predicate abstractions have been used recently in SLAM [16] and BLAST [17] to verify device drivers an... |

1380 |
Symbolic Model Checking
- McMillan
- 1993
(Show Context)
Citation Context ...4. Note that any model checker can be interfaced with our work by translating the abstraction graph to a program understandable by the checker. We have implemented interfaces for VIS [8], Cadence SMV =-=[9]-=-, and NuSMV [10]. Our checker also contains additional features to provide user feedback, such as pruning counterexamples to only report predicates that are relevant to the failures in the reachabilit... |

653 | Construction of abstract state graphs with PVS
- Graf, Saidi
- 1997
(Show Context)
Citation Context ..., while still preserving the expressiveness of theorem proving. We use term rewriting to reduce an invariant proof to the reachability analysis of a finite graph; the graph is a predicate abstraction =-=[1]-=- of the system. Rewriting is guided by rewrite rules that relate the different functions used to model the system. The rules are selected from theorems proven by a theorem prover. Our approach transfe... |

490 | Lazy Abstraction
- Henzinger, Jhala, et al.
- 2002
(Show Context)
Citation Context ...of abstract interpretations [15]. Graf and Saidi [1] made the idea explicit and used it to verify communication protocols in PVS. Predicate abstractions have been used recently in SLAM [16] and BLAST =-=[17]-=- to verify device drivers and C programs, and in UCLID [18, 14] to verify unbounded state systems. The key difference between these approaches and ours is in the method employed for predicate discover... |

410 | Automatically validating temporal safety properties of interfaces
- Ball, Rajamani
- 2001
(Show Context)
Citation Context ...general notion of abstract interpretations [15]. Graf and Saidi [1] made the idea explicit and used it to verify communication protocols in PVS. Predicate abstractions have been used recently in SLAM =-=[16]-=- and BLAST [17] to verify device drivers and C programs, and in UCLID [18, 14] to verify unbounded state systems. The key difference between these approaches and ours is in the method employed for pre... |

285 |
ComputerAided Reasoning: An Approach
- Kaufmann, Manolios, et al.
- 2000
(Show Context)
Citation Context ...assists in the development of these extensions and refinements which, in our experience, can be reused in the verification of similar systems. Our procedure is interfaced with the ACL2 theorem prover =-=[4]-=-. ACL2 has been used to verify several commercial systems [5, 6], and we make use of rewrite rules that have been proven in these efforts. However, ACL2 is not critical to our method; it is used prima... |

194 | NUSMV: a new Symbolic Model Verifier
- CIMATTI, CLARKE, et al.
- 1999
(Show Context)
Citation Context ...y model checker can be interfaced with our work by translating the abstraction graph to a program understandable by the checker. We have implemented interfaces for VIS [8], Cadence SMV [9], and NuSMV =-=[10]-=-. Our checker also contains additional features to provide user feedback, such as pruning counterexamples to only report predicates that are relevant to the failures in the reachability check. We have... |

88 |
Abstract and model check while you prove
- Sadi, Shankar
- 1999
(Show Context)
Citation Context ...etween these approaches and ours is in the method employed for predicate discovery, that is, computation of the predicates necessary for construction of the abstract model. Predicate discovery in PVS =-=[1, 19]-=- involves on-the-fly validity checks using the theorem prover. While this allows specification 10sof arbitrary formulas as predicates, it can be prohibitively expensive. Other predicate abstraction me... |

85 | Automatic deductive verification with invisible invariants
- Pnueli, Ruah, et al.
- 2001
(Show Context)
Citation Context ... channel 2 to send invalidation (flush) requests. Clients send flush responses on channel 3, sometimes with data. The German protocol has been studied extensively by the formal verification community =-=[11, 12, 13]-=-. The original implementation has single-entry channels. In UCLID, indexed predicates were used [14] to verify a version in which channels are modeled as unbounded FIFOs. Our system is inspired by the... |

68 | ACL2 theorems about commercial microprocessors
- Brock, Kaufmann, et al.
- 1996
(Show Context)
Citation Context ...s which, in our experience, can be reused in the verification of similar systems. Our procedure is interfaced with the ACL2 theorem prover [4]. ACL2 has been used to verify several commercial systems =-=[5, 6]-=-, and we make use of rewrite rules that have been proven in these efforts. However, ACL2 is not critical to our method; it is used primarily as a mechanized logic with which we are familiar. We believ... |

68 |
Syntactic program transformations for automatic abstraction
- Namjoshi, Kurshan
- 2000
(Show Context)
Citation Context ...ut also affords greater control over the structure and form of the system definition and the efficiency of predicate discovery. Our approach is similar in concept to the work of Namjoshi and Khurshan =-=[21]-=-. This method computes predicates by applying syntactic transformations to a formula that represents weakest liberal preconditions; it is also the basis of indexed predicate discovery in UCLID [14]. O... |

62 | A symbolic approach to predicate abstraction
- Lahiri, Bryant, et al.
- 2003
(Show Context)
Citation Context ...he idea explicit and used it to verify communication protocols in PVS. Predicate abstractions have been used recently in SLAM [16] and BLAST [17] to verify device drivers and C programs, and in UCLID =-=[18, 14]-=- to verify unbounded state systems. The key difference between these approaches and ours is in the method employed for predicate discovery, that is, computation of the predicates necessary for constru... |

54 | Counter-example based predicate discovery in predicate abstraction
- Das, Dill
(Show Context)
Citation Context ...computational approach. SLAM and BLAST use boolean programs with a control-flow skeleton similar to the original system, UCLID uses weakest liberal preconditions and index variables, and Das and Dill =-=[20]-=- use counterexample analysis. To our knowledge, all these methods enforce some restriction on the language to express systems and target properties. Our method, on the other hand, is motivated to expl... |

52 | Indexed predicate discovery for unbounded system verification
- Lahiri, Bryant
- 2004
(Show Context)
Citation Context ...data. The German protocol has been studied extensively by the formal verification community [11, 12, 13]. The original implementation has single-entry channels. In UCLID, indexed predicates were used =-=[14]-=- to verify a version in which channels are modeled as unbounded FIFOs. Our system is inspired by the version with unbounded FIFOs. However, since we have not built rules to reason directly about unbou... |

35 | R.E.: Constructing quantified invariants via predicate abstraction
- Lahiri, Bryant
- 2004
(Show Context)
Citation Context ... channel 2 to send invalidation (flush) requests. Clients send flush responses on channel 3, sometimes with data. The German protocol has been studied extensively by the formal verification community =-=[11, 12, 13]-=-. The original implementation has single-entry channels. In UCLID, indexed predicates were used [14] to verify a version in which channels are modeled as unbounded FIFOs. Our system is inspired by the... |

28 | Exact and efficient verification of parameterized cache coherence protocols
- EMERSON, KAHLON
(Show Context)
Citation Context ... channel 2 to send invalidation (flush) requests. Clients send flush responses on channel 3, sometimes with data. The German protocol has been studied extensively by the formal verification community =-=[11, 12, 13]-=-. The original implementation has single-entry channels. In UCLID, indexed predicates were used [14] to verify a version in which channels are modeled as unbounded FIFOs. Our system is inspired by the... |

22 | A case study in formal verification of register-transfer logic with ACL2: The floating point adder of the AMD Athlon processor
- Russinoff
- 2000
(Show Context)
Citation Context ...s which, in our experience, can be reused in the verification of similar systems. Our procedure is interfaced with the ACL2 theorem prover [4]. ACL2 has been used to verify several commercial systems =-=[5, 6]-=-, and we make use of rewrite rules that have been proven in these efforts. However, ACL2 is not critical to our method; it is used primarily as a mechanized logic with which we are familiar. We believ... |

15 |
Efficient rewriting of data structures in acl2
- Kaufmann, Sumners
- 2002
(Show Context)
Citation Context ...ons used to model the system and can be used in other systems using the same functions. It is customary for the users of a theorem prover to design rules that simplify terms which arise during proofs =-=[2, 3]-=-. We found that most of the rules necessary for our work are generic, and already available as proven theorems in a deductive setting. Note that since the logic of a theorem prover is undecidable, any... |

12 |
Finite set theory based on fully ordered lists
- Davis
- 1990
(Show Context)
Citation Context ...ons used to model the system and can be used in other systems using the same functions. It is customary for the users of a theorem prover to design rules that simplify terms which arise during proofs =-=[2, 3]-=-. We found that most of the rules necessary for our work are generic, and already available as proven theorems in a deductive setting. Note that since the logic of a theorem prover is undecidable, any... |

3 | O’Hallaron, D.R.: Computer Systems: A Programmer’s Perspective - Bryant - 2003 |