## Implementing a Model Checker for LEGO (1997)

### Cached

### Download Links

- [www-sop.inria.fr]
- [www.dur.ac.uk]
- [www.cs.rhul.ac.uk]
- DBLP

### Other Repositories/Bibliography

Venue: | Proc. of the 4th Inter Symp. of Formal Methods Europe, FME'97: Industrial Applications and Strengthened Foundations of Formal Methods |

Citations: | 14 - 3 self |

### BibTeX

@INPROCEEDINGS{Yu97implementinga,

author = {Shenwei Yu and Zhaohui Luo},

title = {Implementing a Model Checker for LEGO},

booktitle = {Proc. of the 4th Inter Symp. of Formal Methods Europe, FME'97: Industrial Applications and Strengthened Foundations of Formal Methods},

year = {1997},

pages = {442--458},

publisher = {Springer-Verlag}

}

### OpenURL

### Abstract

. Interactive theorem proving gives a general approach for modelling and verification of both hardware and software systems but requires significant human efforts to deal with many tedious proofs. To be used in practical, we need some automatic tools such as model checkers to deal with those tedious proofs. In this paper, we formalise a verification system of both CCS and an imperative language in LEGO which can be used to verify both finite and infinite problems. Then a model checker, LegoMC, is implemented to generate the LEGO proof terms of finite models automatically. Therefore people can use LEGO to verify a general problem and throw some finite sub-problems to be verified by LegoMC. On the other hand, this integration extends the power of model checking to verify more complicated and infinite models as well. 1 Introduction Interactive theorem proving gives a general approach for modelling and verification of both hardware and software systems but requires significant human effor...

### Citations

3202 |
Communication and Concurrency
- Milner
(Show Context)
Citation Context ... of our model checker is the automatic generation of proof terms so that we can enhance the efficiency of verification in a general theorem prover, LEGO. We use Calculus of Communicating System (CCS) =-=[21]-=-, a message-passing concurrent language, to model the systems and propositionalscalculus to express the system properties. Both CCS and propositionalscalculus are formalised in LEGO for both finite an... |

1294 |
Symbolic Model Checking
- McMillan
- 1993
(Show Context)
Citation Context ... have showed how to verify concurrent programs in LEGO by combining interactive theorem proving with model checking. This approach can be generalised to other temporal logic model checker such as SMV =-=[20]-=-. Beside the proof terms, another difference of LegoMC with model checkers in HOL and PVS is the domain languages. They use automata and we use CCS and the imperative language which are more natural t... |

694 | A framework for defining logics
- Harper, Honsell, et al.
- 1993
(Show Context)
Citation Context ...[18]. 3.1 LEGO LEGO is an interactive proof development system designed and implemented by Randy Pollack in Edinburgh [18]. It implements several related type systems--the Edinburgh Logical Framework =-=[12]-=-, the Calculus of Constructions [7], and the Extended Calculus of Constructions [17]. LEGO is a powerful tool for interactive proof development in the natural deduction style and supports refinement p... |

533 | PVS: A Prototype Verification System
- Shankar
- 1992
(Show Context)
Citation Context ...ugh. Muller and Nipkow [22] used HOL theorem prover to reduce the alternating bit protocol expressed in I/O automata to a finite state one to be verified by their own model checker. PVS proof checker =-=[23]-=- even includes a model checker as a decision procedure which presented the possibility of combining theorem proving and model checking in a smooth and tight way [26]. However, the correctness of model... |

471 |
The calculus of constructions
- Coquand, Huet
- 1988
(Show Context)
Citation Context ...e proof development system designed and implemented by Randy Pollack in Edinburgh [18]. It implements several related type systems--the Edinburgh Logical Framework [12], the Calculus of Constructions =-=[7]-=-, and the Extended Calculus of Constructions [17]. LEGO is a powerful tool for interactive proof development in the natural deduction style and supports refinement proof as a basic operation and a def... |

412 |
Computer-Aided Verification of Coordinating Processes: The AutomataTheoretic Approach
- Kurshan
- 1994
(Show Context)
Citation Context ...interpreted constants as lemmas and used Voss model checker to give the interpretation. Kurshan and Lamport [14] proved a multiplier where the 8-bit multiplier can be verified by COSPAN model checker =-=[15]-=- and n-bit multiplier composed from 8-bit multipliers can be verified by TLP theorem prover [11]. In principle, their approaches are to divide the whole problem to separated sub problems and then use ... |

323 |
Symbolic model checking: 10 states and beyond
- Burch, Clarke, et al.
- 1990
(Show Context)
Citation Context ...to certain problems - i.e., simple finite state processes, although this limitation can be partially overcame to deal with more complicated problems by improving the efficiency through BDD techniques =-=[4]-=-. Since theorem proving and model checking are complementary techniques, both schools have been trying to combine the strength of these two approaches by using theorem provers to reduce or divide the ... |

302 | Lambda calculus notation with nameless dummies, a tool for automatic formula manipulation, with application to the Church-Rosser theorem
- Bruijn
- 1972
(Show Context)
Citation Context ...onstructor should be [rec:(Process-?Process)-?Process]. However, LEGO does not allow this sort of expressions since in general they could introduce paradoxes [17]. Instead, we use de Bruijn's indexes =-=[8]-=- to deal with variable binding. The transition relation can be defined as an inductive relation with each of the constructors in the definition corresponding to one or two rules. For instance, the con... |

223 |
Efficient model checking in fragments of the propositional mu-calculus
- Emerson, Lei
- 1986
(Show Context)
Citation Context ...ive of P , ff an action of P , and P 0 an ff-derivative of P . 2.2sCalculus Kozen's (propositional) modalscalculus(K) has expressive power subsuming many modal and temporal logics such as LTL and CTL =-=[4, 5, 10]-=-. We take a negation-free version of modal -calculus and use Winskel's construction of tagging fixed points with sets of states [27]. The assertions are constructed from the following grammar: \Phi ::... |

147 |
LEGO Proof Development System: User's Manual
- Luo, Pollack
- 1992
(Show Context)
Citation Context ... correct system is only a "TRUE." People can only choose to believe that "TRUE" as a pure act of faith, or not at all. On the other hand, the proofs of type theory based theorem pr=-=overs, such as LEGO [18]-=-, ALF [1, 19], Coq [9] and Nuprl [6], are proof terms( terms) which in principle can be justified by different proof checkers so that people can have more confidence on formal proofs. Moreover, proof ... |

111 | Another look at LTL model checking
- Clarke, Grumberg, et al.
- 1994
(Show Context)
Citation Context ...ive of P , ff an action of P , and P 0 an ff-derivative of P . 2.2sCalculus Kozen's (propositional) modalscalculus(K) has expressive power subsuming many modal and temporal logics such as LTL and CTL =-=[4, 5, 10]-=-. We take a negation-free version of modal -calculus and use Winskel's construction of tagging fixed points with sets of states [27]. The assertions are constructed from the following grammar: \Phi ::... |

108 |
Computation and Reasoning, A Type Theory for Computer Science
- Luo
- 1994
(Show Context)
Citation Context ...ted by Randy Pollack in Edinburgh [18]. It implements several related type systems--the Edinburgh Logical Framework [12], the Calculus of Constructions [7], and the Extended Calculus of Constructions =-=[17]-=-. LEGO is a powerful tool for interactive proof development in the natural deduction style and supports refinement proof as a basic operation and a definitional mechanism to introduce definitional abb... |

103 | A structural induction theorem for processes
- Kurshan, McMillan
- 1989
(Show Context)
Citation Context ...bine the strength of these two approaches by using theorem provers to reduce or divide the problems to ones which can be checked by model checkers. Wolper and Lovinfosse [28] and Kurshan and McMillan =-=[16]-=- extended model checking to be able to be used for the inductive step by using an invariant to capture the inductive hypothesis. Joyce and Seger [13] used HOL theorem prover to verify formulas which c... |

96 |
Verifying properties of large sets of processes with network invariants,” in Automatic Verification Methods for Finite State Systems
- Wolper, Lovinfosse
- 1990
(Show Context)
Citation Context ...chools have been trying to combine the strength of these two approaches by using theorem provers to reduce or divide the problems to ones which can be checked by model checkers. Wolper and Lovinfosse =-=[28]-=- and Kurshan and McMillan [16] extended model checking to be able to be used for the inductive step by using an invariant to capture the inductive hypothesis. Joyce and Seger [13] used HOL theorem pro... |

88 | An integration of model-checking with automated proof checking
- Rajan, Shankar, et al.
- 1995
(Show Context)
Citation Context ...n model checker. PVS proof checker [23] even includes a model checker as a decision procedure which presented the possibility of combining theorem proving and model checking in a smooth and tight way =-=[26]-=-. However, the correctness of model checkers is still a big concern since they themselves are computer softwares which could contain bugs. The output of most model checkers including the model checker... |

80 |
Constable et al. Implementing Mathematics with the NuPRL Proof Development System
- L
- 1986
(Show Context)
Citation Context ...ple can only choose to believe that "TRUE" as a pure act of faith, or not at all. On the other hand, the proofs of type theory based theorem provers, such as LEGO [18], ALF [1, 19], Coq [9] =-=and Nuprl [6]-=-, are proof terms( terms) which in principle can be justified by different proof checkers so that people can have more confidence on formal proofs. Moreover, proof terms provide a common interface for... |

53 | Mechanical verification of concurrent systems with tla
- Engberg, Grønning, et al.
- 1992
(Show Context)
Citation Context ...and Lamport [14] proved a multiplier where the 8-bit multiplier can be verified by COSPAN model checker [15] and n-bit multiplier composed from 8-bit multipliers can be verified by TLP theorem prover =-=[11]-=-. In principle, their approaches are to divide the whole problem to separated sub problems and then use different tools to solve individual problems. Their works based on paper and pencils are the ear... |

50 |
The Coq proof assistant user's guide. Version 5.8
- Dowek, Felty, et al.
- 1993
(Show Context)
Citation Context ... a "TRUE." People can only choose to believe that "TRUE" as a pure act of faith, or not at all. On the other hand, the proofs of type theory based theorem provers, such as LEGO [18=-=], ALF [1, 19], Coq [9]-=- and Nuprl [6], are proof terms( terms) which in principle can be justified by different proof checkers so that people can have more confidence on formal proofs. Moreover, proof terms provide a common... |

45 | Combining model checking and deduction for I/O-automata. In Brinksma et al Ed (eds) Tools and algorithms for the construction and analysis of systems
- Müller, Nipkow
- 1995
(Show Context)
Citation Context ...mpts of combining theorem proving and model checking. 0 Email address:fShenwei.Yu, Zhaohui.Luog@durham.ac.uk However, the integration of these two systems is still not tight enough. Muller and Nipkow =-=[22]-=- used HOL theorem prover to reduce the alternating bit protocol expressed in I/O automata to a finite state one to be verified by their own model checker. PVS proof checker [23] even includes a model ... |

35 |
Linking BDD-based symbolic evaluation to interactive theorem-proving
- Joyce, Seger
- 1993
(Show Context)
Citation Context ...olper and Lovinfosse [28] and Kurshan and McMillan [16] extended model checking to be able to be used for the inductive step by using an invariant to capture the inductive hypothesis. Joyce and Seger =-=[13]-=- used HOL theorem prover to verify formulas which contain uninterpreted constants as lemmas and used Voss model checker to give the interpretation. Kurshan and Lamport [14] proved a multiplier where t... |

35 | Verification of a multiplier: 64 bits and beyond
- Kurshan, Lamport
- 1993
(Show Context)
Citation Context ...hypothesis. Joyce and Seger [13] used HOL theorem prover to verify formulas which contain uninterpreted constants as lemmas and used Voss model checker to give the interpretation. Kurshan and Lamport =-=[14]-=- proved a multiplier where the 8-bit multiplier can be verified by COSPAN model checker [15] and n-bit multiplier composed from 8-bit multipliers can be verified by TLP theorem prover [11]. In princip... |

27 |
A short description of another logical framework
- Augustsson, Coquand, et al.
- 1990
(Show Context)
Citation Context ...ystem is only a "TRUE." People can only choose to believe that "TRUE" as a pure act of faith, or not at all. On the other hand, the proofs of type theory based theorem provers, suc=-=h as LEGO [18], ALF [1, 19]-=-, Coq [9] and Nuprl [6], are proof terms( terms) which in principle can be justified by different proof checkers so that people can have more confidence on formal proofs. Moreover, proof terms provide... |

27 |
A note on model checking the modal - calculus
- Winskel
- 1989
(Show Context)
Citation Context ... subsuming many modal and temporal logics such as LTL and CTL [4, 5, 10]. We take a negation-free version of modal -calculus and use Winskel's construction of tagging fixed points with sets of states =-=[27]-=-. The assertions are constructed from the following grammar: \Phi ::= X j \Phis\Psi j \Phis\Psi j hKi\Phi j [K]\PhijZ:U \Phi j Z:U \Phi where U is called tag which is a subset of states, X ranges over... |

16 |
The new implementation of ALF
- Magnusson
- 1992
(Show Context)
Citation Context ...ystem is only a "TRUE." People can only choose to believe that "TRUE" as a pure act of faith, or not at all. On the other hand, the proofs of type theory based theorem provers, suc=-=h as LEGO [18], ALF [1, 19]-=-, Coq [9] and Nuprl [6], are proof terms( terms) which in principle can be justified by different proof checkers so that people can have more confidence on formal proofs. Moreover, proof terms provide... |

13 | A verified typechecker
- Pollack
- 1995
(Show Context)
Citation Context ...ich supports the computational use of the type theory. General applications of LEGO at the moment are to formalise a system and reason about its properties, such as the verification of proof checkers =-=[25]-=-. There is an Inductive command in LEGO [24] to simplify the declaration of inductive types and relations by automatically constructing the basic LEGO syntax from a `high level' presentation. The synt... |

5 |
Incremental Changes in LEGO
- Pollack
- 1994
(Show Context)
Citation Context ...pe theory. General applications of LEGO at the moment are to formalise a system and reason about its properties, such as the verification of proof checkers [25]. There is an Inductive command in LEGO =-=[24]-=- to simplify the declaration of inductive types and relations by automatically constructing the basic LEGO syntax from a `high level' presentation. The syntax is as follows. Inductive [T1:M1] ... [Tm:... |

2 |
Local model checking for inifinite state spaces
- Bradfield, Stirling
- 1992
(Show Context)
Citation Context ... of the proof which can not use LegoMC to solve is still a difficult work. Bradfield and Stirling developed a sound and complete tableau proof system of local model checking for infinite state spaces =-=[2]-=-. It is expected that we can formalise their proof system in LEGO to help the verification of infinite problems. Since LegoMC generates the proof terms of LEGO syntax, it depends on the formalisation ... |

1 |
Algebraic Abstraction with Process Preorders
- Bruns
- 1995
(Show Context)
Citation Context ...[21], we can then use abstract model instead of original one. Here bisimilarity is proved in LEGO, and LegoMC is used to prove the abstract finitestate model. We take a simple token ring network from =-=[3]-=- as an example to explain the above approach. Assume there are n workstations in a ring network as Fig. 2. Every workstation which wants to enter its critical section should hold a token which passes ... |