Name

invelm — Eliminates summands with guards contradicting an invariant

Synopsis

invelm [-help] [-help-all] [-version] [-invariant file ] [-simplify] [-rewrite] [-splitsums] [-summand n] [-witness] [-print] [-print-dot] [-counter] [-help-rewrite] [-help-simplify] [Data Options] [Rewriter Options] [input.tbf]

Description

This filter reads from input.tbf (or stdin if not given) an LPE in .tbf format, reads an invariant phi from file and eliminates summands with guards contradicting that invariant. Invariant phi must be a term of type Bool in the signature of the input LPE, which may contain process parameters of the LPE as free variables, but no other free variables. It is assumed that this term is an invariant of the LPE. If -invariant is missing, it is set to 'T'. This is especially useful with -simplify.

When the guard of some summand is 'F' it will never be executed, so it can be eliminated. But even when the summand is satisfiable, it might happen that all states where the guard holds are unreachable. Such a summand will be never executed either. Given an invariant phi, approximating the set of reachable states, invelm eliminates such summands.

invelm eliminates all summands i from the input LPE such that phi and hi is provable equivalent to 'F'.

If the guard is different from 'F', it is kept unaltered, except when -simplify is used.

The LPE will be written to stdout.

Note that it is not checked whether the provided invariant actually holds. Application of invelm is only sound after checking the invariant, for instance by using invcheck.

Options

-help

Display help information

-help-all

Display all help information

-version

Get the version number of this release

-invariant file

Read an invariant from file. If this option is missing, then invariant 'T' will be assumed.

-simplify

Rewrite each conjunction of guard and invariant to a BDD

The effect of this option is to make global knowledge (provided by the invariant) locally available in each guard. This may be helpful for other tools that use the prover, such as confcheck. However, static analysis tools (e.g. constelm, parelm, sumelm) may perform worse, because BDDs are syntactically harder, and all variables of the invariant tend to occur in all summands.

-rewrite

The rewrite system is modified as follows:

  • Parameters of the LPE are viewed as constants (maps)

  • Certain facts from the invariant are viewed as rewrite rules

These rewrite rules are added to the existing rewrite rules, and applied to all summands. The abstract datatype is not changed. The new rules are displayed on stderr (except with -silent)

As an example, if the invariant is of the form:

    and(eq(x,plus(y,z)),
    and(c,
    and(not(b),
    and(eq(length(l),S(0))
    and(or(a,d),
        not(or(gt(x,y),e)))))))
  

Then the following rules are added

    x -> plus(y,z)
    c -> T
    b -> F
    length(l) -> S(0)
    gt(y,z) -> F
    e -> F
  

Typically, applying parelm subsequently, will eliminate x,c,b and e.

-splitsums

Split summands with guard or( , ) in multiple summands

-summand n

Eliminate/simplify only summand n

-witness

Provides a witness for summands that seem to be reachable

-silent

Suppress information per summand

-print

Print resulting BDDs

-print-dot

Print resulting BDDs in .dot format to stdout instead of LPE.

-help-rewrite

Print more help on -rewrite flag

-help-simplify

Print more help on -simplify flag

Limitations

This tool is incomplete, because the invariant might be T for some unreachable states. Even with an appropiate invariant, the prover might not find a contradiction, which can be inspected by using -witness.

Last update

16 December 2008 by Bert Lisser