Automatic Verification of TLA +  Proof Obligations with SMT Solvers

Abstract

Abstract. TLA + is a formal specification language that is based on ZF set theory and the Temporal Logic of Actions TLA. The TLA + proof system tlaps assists users in deductively verifying safety properties of TLA + specifications. tlaps is built around a proof manager, which interprets the TLA + proof language, generates corresponding proof obligations, and passes them to backend verifiers. In this paper we present a new backend for use with SMT solvers that supports elementary set theory, functions, arithmetic, tuples, and records. Type information required by the solvers is provided by a typing discipline for TLA + proof obligations, which helps us disambiguate the translation of expressions of (untyped) TLA + , while ensuring its soundness. Preliminary results show that the backend can help to significantly increase the degree of automation of certain interactive proofs.

Formal Analysis of a Distributed Algorithm for Tracking Progress

“…An entire category of provers based on Satisfiability Modulo Theory (SMT) is especially good at some hard problems that involve arithmetic, uninterpreted functions, and quantifiers. The back-end prover smt3 uses one such SMT prover [8].…”

Smtlink 2.0

“…Their work focused on generating efficient refutation proofs that can be checked by a theorem prover in a short amount of time. Integrating SMT solvers into theorem provers has been a consistently developing area in the past decade [18,11,4,19,6,5,1,10]. Erkök [10] integrated the SMT solver Yices into Isabelle/HOL.…”

“…Several papers showed how their methods could be used for the verification of concurrent algorithms such as clock synchronization [11], and the Bakery and Memoir algorithms [19]. Erkök [10] uses the integration to prove memory safety of small C programs.…”

A Mechanized Model for CAN Protocols

“…Compared to the model-checking in general, theorem proving requires the help of the programmer to prove properties that are valid on an arbitrary number of processes. We focused in this paper on the pure use of Isabelle/HOL because most of our reasoning were about topology and induction, but we do not exclude the use of a proof assistant in conjunction with SMT solvers [12] in the future to ease reasoning, or reason more deeply about liveness properties for example.…”