Proving Partial-Correctness and Invariance Properties of Transition-System Models

Abstract

We propose a deductive verification approach for proving partial-correctness and invariance properties on transition-system models. Regarding partial correctness, we generalise the recently introduced formalism of Reachability Logic, currently used as a language-parametric logic for programs, to transition systems. We propose a sound and relatively complete proof system for the resulting reachability logic. The soundness of the proof system is formally established in the Coq proof assistant, and the mechanised proof provides us with a Coq-certified Reachability-Logic prover for transition-system models. The relative completeness of the proof system, although theoretical in nature, also has a practical value, as it induces a proof strategy that is guaranteed to prove all valid formulas on a given transition system. The strategy reduces partial-correctness verification to invariance verification; for the latter we propose an incremental technique in order to deal with the case-explosion problem that affects it. All these techniques were instrumental in enabling us to prove, within reasonable time and effort limits, that the nontrivial algorithm implemented in security hypervisor that we designed in earlier work meets its expected functional requirements.

(Co)inductive Proof Systems for Compositional Proofs in Reachability Logic

“…Hence, completeness is a theoretical property; the practically useful property is Lemma 3, which users have to provide with a suitable q that satisfy the three inclusions therein. In [15] we use this lemmma for verifying an infinite-state transition-system specification of a hypervisor.…”

“…After several applications of [Str] and [Spl] (14) is reduced to proving the three last following subgoals: (15) :…”

“…A proof by coinduction in Coq is ultimately a wellformed corecursive function, where well-formedness is defined as a syntactical guardedness condition, (Co)inductive Proof Systems for Compositional Proofs in Reachability Logic which is quite complex in the theory [4], and even more so in the implementation. We have nonetheless managed to prove the soundness and completeness of using this tactic: cofix-style proofs of soundness and completeness for , described in standard mathematical notation, are reported in [15]. For , however, cofix became useless because, for some reason, it does not accept to be mixed in a proof by induction.…”

“…Several versions of the logic have been proposed over the years [13,19,18]. The formalism has been generalised from programming languages to more abstract models: rewriting logic [8,17] and transition systems [14], which can be used for specifying designs, and verifying them before they are implemented in program code. This does not replace code verification, just as code verification does not replace the for transition systems, and logical, for formulas.…”