## Verifying Invariants Using Theorem Proving (1996)

Venue: | IN ALUR AND HENZINGER [AH96 |

Citations: | 27 - 5 self |

### BibTeX

@INPROCEEDINGS{Graf96verifyinginvariants,

author = {Susanne Graf and Hassen Saïdi},

title = {Verifying Invariants Using Theorem Proving},

booktitle = {IN ALUR AND HENZINGER [AH96},

year = {1996},

pages = {196--207},

publisher = {Springer Verlag}

}

### Years of Citing Articles

### OpenURL

### Abstract

Our goal is to use a theorem prover in order to verify invariance properties of distributed systems in a "model checking like" manner. A system S is described by a set of sequential components, each one given by a transition relation and a predicate Init defining the set of initial states. In order to verify that P is an invariant of S, we try to compute, in a model checking like manner, the weakest predicate P 0 stronger than P and weaker than Init which is an inductive invariant, that is, whenever P 0 is true in some state, then P 0 remains true after the execution of any possible transition. The fact that P is an invariant can be expressed by a set of predicates (having no more quantifiers than P ) on the set of program variables, one for every possible transition of the system. In order to prove these predicates, we use either automatic or assisted theorem proving depending on their nature. We show in this paper how this can be done in an efficient way using the Prototype V...

### Citations

1588 | The Temporal Logic of Reactive and Concurrent Systems - Manna, Pnueli - 1992 |

408 |
A Computational Logic Handbook
- Boyer, Moore
- 1997
(Show Context)
Citation Context ...uction Using a theorem prover to do model checking is not a new idea 2 . Theorem proving has been used successfully for the verification of temporal logic formulas on programs, specially systems like =-=[BM88]-=-, [OSR93a] 3 , [GM93] and [CCF + 95]. In most of these approaches, it is mainly emphasized how to define the syntax of a specification formalism and its semantics (in terms of sets of computations) as... |

400 |
Temporal verification of reactive systems: safety
- Manna, Pnueli
- 1995
(Show Context)
Citation Context ...ed point has been reached. 1.2 Related work Tools like STeP [MAB + 94], TPVS [BLUP94] and CAVEAT [GR95] use this technique. In CAVEAT systematic strengthening of invariants is not foreseen. STeP 4 in =-=[MP95]-=- many such schemata and corresponding verification rules are presented for which we will implement strategies in the future 5 The state predicate f pre[ ](P ) defines the smallest set of states that v... |

106 |
Introduction to HOL
- Gordon, Melham
- 1993
(Show Context)
Citation Context ...m prover to do model checking is not a new idea 2 . Theorem proving has been used successfully for the verification of temporal logic formulas on programs, specially systems like [BM88], [OSR93a] 3 , =-=[GM93]-=- and [CCF + 95]. In most of these approaches, it is mainly emphasized how to define the syntax of a specification formalism and its semantics (in terms of sets of computations) as well as the satisfac... |

92 | Srivas. An integration of model checking with automated proof checking
- Rajan, Shankar, et al.
- 1995
(Show Context)
Citation Context ...ion of temporal logic formulas on computations. Then, a system S satisfies a property f if every computation of S satisfies f . In general, not much is told about how to verify the obtained formulas. =-=[RSS95]-=- explains how model checking (for finite state systems) is implemented in PVS as a tactic (which consists in transforming the model checking problem into a decidable -calculus formula and to run a dec... |

91 | Powerful Techniques for the Automatic Generation of Invariants
- Bensalem, Lakhnech, et al.
- 1996
(Show Context)
Citation Context ... Use of auxiliary invariants It is in general essential to use already proved invariants or systematically generated structural invariants obtained by static analysis ([MAB + 94], [BBM95], [MP95] and =-=[BLS96]-=-). Let I stand for the conjunction of all these invariants. In order to prove that P is inductive, it is sufficient to prove IsP )gpre[ ](P ) () 9 A Bdd simplifier is available in PVS as a tactic. 8 i... |

77 | Experiments in theorem proving and model checking for protocol veri
- Havelund, Shankar
- 1996
(Show Context)
Citation Context ... implemented in PVS as a tactic (which consists in transforming the model checking problem into a decidable -calculus formula and to run a decision procedure on this formula) . In [RSS95], [DF95] and =-=[HS96] model che-=-cking is used to prove abstract descriptions of systems, while "ordinary" theorem proving is used to show the ? Verimag is a joint laboratory of CNRS, Institut National Polytechnique de Gren... |

51 |
Automatic generation of invariants and intermediate assertions. Theoretical Computer Science 173, 1 (Feb.), 49{87. Preliminary version appeared
- Bjrner, Browne, et al.
- 1997
(Show Context)
Citation Context ...S proof checker. 4.3 Use of auxiliary invariants It is in general essential to use already proved invariants or systematically generated structural invariants obtained by static analysis ([MAB + 94], =-=[BBM95]-=-, [MP95] and [BLS96]). Let I stand for the conjunction of all these invariants. In order to prove that P is inductive, it is sufficient to prove IsP )gpre[ ](P ) () 9 A Bdd simplifier is available in ... |

43 | The PVS specification language
- Owre, Shankar, et al.
- 1993
(Show Context)
Citation Context ...em ) id system [ PARAMETER id ] : SYSTEM BEGIN h pvs declarations i BEGIN h sys components i END INITIALLY : h pvs boolean formula i END id system 7 This grammar is presented using the conventions of =-=[OSR93b]-=- 6 VCs Analysis Invariants Invariants Database generation Generation and Invariant PVS Type-checker use add ok / not ok / help me PVS + Strategies VC Result true / VC non provable Proof-checker updati... |

35 | Model checking for infinite state systems using data abstraction, assumption-commitment style reasoning and theorem proving
- Dingel, Filkorn
- 1995
(Show Context)
Citation Context ...systems) is implemented in PVS as a tactic (which consists in transforming the model checking problem into a decidable -calculus formula and to run a decision procedure on this formula) . In [RSS95], =-=[DF95] and [HS96-=-] model checking is used to prove abstract descriptions of systems, while "ordinary" theorem proving is used to show the ? Verimag is a joint laboratory of CNRS, Institut National Polytechni... |

28 | Characterization of a Sequentially Consistent Memory and Verification of a Cache Memory by Abstraction
- Graf
- 1994
(Show Context)
Citation Context ...BLS96] is compositional. In the future, more compositionality will by added by means of well-known rules. Another interesting direction is the use of abstraction in the manner proposed for example in =-=[Gra94]-=-. The present framework is appropriate for this approach as in the above mentioned paper, the most difficult part was to argue that the considered abstract operations are in fact abstractions of the c... |

20 |
Combining model checking and theorem proving to verify parallel processes
- Hungar
- 1993
(Show Context)
Citation Context ...on attempts are mentioned. 3 see [CLN + 95] for many examples of the use of PVS. 2 correctness of this abstract description with respect to a more concrete (in general infinite state) description. In =-=[Hun93]-=- it is proposed to verify the correctness of each component using model checking, and then to deduce the correctness of the composed system by means of compositional rules embedded as inference rules ... |

14 | A Tutorial on Specification and Verification using PVS
- Shankar, Owre, et al.
- 1993
(Show Context)
Citation Context ...sing a theorem prover to do model checking is not a new idea 2 . Theorem proving has been used successfully for the verification of temporal logic formulas on programs, specially systems like [BM88], =-=[OSR93a]-=- 3 , [GM93] and [CCF + 95]. In most of these approaches, it is mainly emphasized how to define the syntax of a specification formalism and its semantics (in terms of sets of computations) as well as t... |

7 | Model Checking and Other Ways of Automating Formal Methods - Rushby - 1995 |

3 | The ELLA Verification Environment: A Tutorial Introduction
- Barringer, Gough, et al.
- 1994
(Show Context)
Citation Context ...rify the correctness of each component using model checking, and then to deduce the correctness of the composed system by means of compositional rules embedded as inference rules in a theorem prover. =-=[BGMW94]-=- describes an integration of the PVS theorem prover in an environment for the verification of hardware specification. It is used for discharging verification conditions expressing the fact that a spec... |

3 |
CAVEAT : technique and tool for Computer Aided VErification And Transformation
- Gribomont, Rossetto
- 1995
(Show Context)
Citation Context ...n appropriate decision procedure) is used for establishing Q i ) Q i+1 that is for verifying that a fixed point has been reached. 1.2 Related work Tools like STeP [MAB + 94], TPVS [BLUP94] and CAVEAT =-=[GR95]-=- use this technique. In CAVEAT systematic strengthening of invariants is not foreseen. STeP 4 in [MP95] many such schemata and corresponding verification rules are presented for which we will implemen... |

1 |
Preprocessing for invariant validation. AMAST'96
- Gribomont
(Show Context)
Citation Context ...levant conjuncts". Invariants of the particular form (pc = i) ) Q, providing information about values of variable at some control point i, are only relevant for (*) whensstarts at control point i=-=. In [Gri96]-=-, a more refined strategy is defined which selects in a formula of the form h 1 h 1 \Delta \Delta \Delta hn ) c, formulas h i which are relevant for establishing the validity of c. 4.4 An efficient im... |

1 |
Syntax extentions in PVS, some suggestions. Unpublished notes
- Saidi
- 1995
(Show Context)
Citation Context ...ons. In Coq [CCF + 95], grammar extension is allowed which makes specifications easier to write and to read. In PVS, this technique can be generalized to allow user-defined specification syntax (e.g. =-=[Sai95]-=-). The defined specification syntax can be a combination of the PVS specification syntax and user specification syntax since it can be constructed using non-terminals of the PVS grammar. To prove that... |

1 |
Le Controle des Syst`emes Asynchrones
- Sifakis
- 1979
(Show Context)
Citation Context ...re very close to the internal PVS representation, allows to use many PVS features. 5 Examples We present two examples. The first one, which is finite state, is a mutual exclusion algorithm studied in =-=[Sif79]-=-. mutex : SYSTEM BEGIN ina, inb, PAB : VAR bool p1, p2 : VAR nat BEGIN p1=1 ---? p1 := 2 ; ina := true (t11) p1=2 AND inb ---? p1 := 3 ; (t12) p1=3 AND NOT(PAB) ---? p1 := 4 ; ina := false (t13) p1=4 ... |