invcheck — Checks whether a formula is an invariant of an LPE
invcheck
-invariant
file
[-generate
] [-all
] [-verbose
] [-help
] [-help-all
] [-version
] [Data Options
] [Rewriter Options
] [
]input
.tbf
This filter reads from
(or
input
.tbf stdin
if not given) an LPE
in .tbf
format,reads a conjectured invariant
from
phi
.
invcheck reports on
file
stderr
for which summands the invariant
holds. If -generate
is absent, -verbose
is turned on automatically, otherwise there would no output on
stderr
at all.
Given process parameters d
,
initial state init
, and summands
|
then invcheck tries to prove
and
for all
(init)phi
i
the universal closure of:
.
The first proves the invariant initially holds, the second that it is
preserved by all transitions.
The tool terminates as soon as a counter example is found, unless the
(d) phi
and
hi(d, ei)
implies
(gi(d, ei))
phi
-all
flag is given.
-invariant
file
Read an invariant from file
.
This file should contain exactly one formula, i.e of type Bool.
The formula may contain the process parameters of the LPE as free variables,
but no other variables. This flag is obligatory.
-generate
Generate the invariance formulae and write them to
stdout
in the format understood by
formcheck.
They are not checked but merely generated. The main reason is that the
formulae could be translated and submitted to other theorem provers,
like PVS or Isabelle.
-all
Do not terminate as-soon-as invariant violation is found
-print
Print BDDs for failed summands in ASCII
on stderr
-print-dot
Print BDDs for failed summands in dot-format
on stdout
-counter
Print counter examples
-verbose
Indicate to stderr
which summands holds
-help
Display help information
-help-all
Display all help information
-version
Get the version number of this release
Besides the limitations of the prover, it should be noted that
invcheck doesn't perform induction-loading.
The invariant should hold "as is". Invariants that need a simultaneous
induction proof should be put in conjunction in one formula-file.
Furthermore, it is not possible to express invariants containing
quantifiers. These can often be avoided by adding more functions in the
specification. For instance, the invariant on list L
:
should be replaced by
forall
l. l in
L implies
l < 5 max(L)<5
, after specifying the function
max
which returns the maximum value in a list.