Name

invcheck — Checks whether a formula is an invariant of an LPE

Synopsis

invcheck -invariant file [-generate] [-all] [-verbose] [-help] [-help-all] [-version] [Data Options] [Rewriter Options] [input.tbf]

Description

This filter reads from input.tbf (or stdin if not given) an LPE in .tbf format,reads a conjectured invariant phi from file. invcheck reports on stderr for which summands the invariant holds. If -generate is absent, -verbose is turned on automatically, otherwise there would no output on stderr at all.

Given process parameters d, initial state init, and summands

sum (ei, ai(fi) . P(gi) <| hi |> delta )

then invcheck tries to prove phi(init) and for all i the universal closure of: phi(d) and hi(d, ei) implies phi(gi(d, ei)) . The first proves the invariant initially holds, the second that it is preserved by all transitions. The tool terminates as soon as a counter example is found, unless the -all flag is given.

Options

-invariant file

Read an invariant from file. This file should contain exactly one formula, i.e of type Bool. The formula may contain the process parameters of the LPE as free variables, but no other variables. This flag is obligatory.

-generate

Generate the invariance formulae and write them to stdout in the format understood by formcheck. They are not checked but merely generated. The main reason is that the formulae could be translated and submitted to other theorem provers, like PVS or Isabelle.

-all

Do not terminate as-soon-as invariant violation is found

-print

Print BDDs for failed summands in ASCII on stderr

-print-dot

Print BDDs for failed summands in dot-format on stdout

-counter

Print counter examples

-verbose

Indicate to stderr which summands holds

-help

Display help information

-help-all

Display all help information

-version

Get the version number of this release

Limitations

Besides the limitations of the prover, it should be noted that invcheck doesn't perform induction-loading. The invariant should hold "as is". Invariants that need a simultaneous induction proof should be put in conjunction in one formula-file. Furthermore, it is not possible to express invariants containing quantifiers. These can often be avoided by adding more functions in the specification. For instance, the invariant on list L: forall l. l in L implies l < 5 should be replaced by max(L)<5, after specifying the function max which returns the maximum value in a list.

Last update

16 December 2008 by Bert Lisser