Using TAME to prove invariants of automata models

Abstract

TAME is a special-purpose interface to PVS designed to support developers of software systems in proving properties of automata models. One of TAME's major goals is to allow a software developer who has basic knowledge of standard logic, and can do hand proofs, to use PVS to represent and to prove properties about an automaton model without rst becoming a PVS expert. A second goal is for a human to be able to read and understand the content of saved TAME proofs without running them through the PVS proof checker. A third goal is to make p r o ving properties of automata with TAME less costly in human time than proving such properties using PVS directly. Recent work by Romijn and Devillers et al., based on the I/O automata model, has provided the basis for two case studies on how w ell TAME achieves these goals. Romijn speci ed the RPC-Memory Problem and its solution, while Devillers et al. speci ed a tree identify protocol. Hand proofs of specication properties were provided by the authors. In addition, Devillers et al. used PVS directly to mechanize the specications and proofs of the tree identify protocol. In one case study, the third author, a new TA M E u s e r w i t h n o p r e v i o u s PVS experience, used TAME to create PVS speci cations of the I/O automata presented by Romijn and Devillers et al. and to check the hand proofs of invariant properties. The PVS speci cations and proofs of Devillers et al. provide the basis for the other case study, which compares the TAME approach to an alternate approach w h i c h uses PVS directly.

Deadlock and starvation free reentrant readers–writers: A case study combining model checking with theorem proving

“…in [20] using VeriTech. With the tool TAME one can specify a time automaton directly in the theorem prover PVS [3]. For the purpose of developing consistent requirement specifications, the transformation of specifications in a model checker (Uppaal [21]) to specifications in PVS has been studied in [10].…”

“…Interesting methods to do this would be using a semantic compiler, as was done in the European Robin project [31], or employing a specially designed formal library for models created with a model checker, e.g. TAME [3]. Relation of unbounded model to source code.…”

Software Cost Reduction

“…The model contains de nitions of the functions that can be derived from the SCR tables. 2 Applying the de nition in the model to the condition table in Table 3 Similarly, applying the de nition in the model to the event table in Table 2 produces the following de nition of the term Overridden: To de ne the required behavior completely and unambiguously, each SCR table must de ne a total function. To a c hieve this, the model requires the information in each table to satisfy certain properties.…”

Automated deductive requirements analysis of critical systems

“…Furthermore these systems normally present themselves as a whole: source logic, PVS libraries, and proof strategies are strictly integrated and cannot be used separately. This significantly increases the efficiency of the automatic conduction of proof previously done by hand (as in Archer and Heitmeyer [1997a] and Archer et al [2000]), but hinders their use by designers with limited expertise in the use of the source logic (even if expert in using PVS). Moreover single components like libraries or code cannot be reused at all, since they are tailored to that particular system.…”