LESAR/ECVERIF(1)

NAME

lesar, ecverif - formal verification

SYNOPSIS

lesar <file.lus> <node> [OPTION]

ecverif <file.ec> <node> [OPTION]

DESCRIPTION

The lesar command first calls lus2ec, then ecverif. The ecverif tool takes a program whose first output is Boolean, and tries to prove that this Boolean output remains true, for any execution of the program. This proof is made under (possible) assumptions on the environment: all assertions (assert statements) are assumed to remain true for any execution. The goal is then to prove that:

``Whatever be the sequence of inputs, as long as the assertions (the hypothesis) are satisfied, the first output (the property) remains true.’’

OPTIONS

  Miscellaneous

-v  verbose mode. Since the algorithms used in the tool are very expensive, it is strongly recomended to use this option in order to have a feed-back on the verification progress.

-help
    print available options.

-dbg
    print debug information.

  Static analysis

-nomin
    disable the (extended) sub-expression minimization.

-split
    splits the property into several smaller ones (if possible).

-optb
    Boolean optimization (aka. constant propagation) at the source level. This option was supported by older versions, but it is normally useless since the bdds construction stage is now optimized.

  Model checking

The main stage of the model checker consists in exploring the underlying automaton (the model). The user may choose between several algorithms for this exploration.

Assertions are taken into account during the exploration to throw away unfeasible transitions. A state whose all outgoing transitions have all been discarded is said to be a sink state. Assertions that can produce sink states are said to be non-causal.

-enum
    (default) uses the enumerative algorithm. The automaton is checked state by state, starting from the initial one. The verification fails as soon as a state violating the property is reached. An error occurs if the assertions are found to be non-causal.

-states
    enum mode only: stops exploration after states are visited.

-forward
    symbolic forward algorithm. The set of reachable states is build as a Boolean formula over the state variables. The verification fails if this set contains some states violating the property.

-backward
    symbolic backward algorithm. This algorithm builds a symbolic representation of the bad states, i.e. states that can lead to the violation of the property. The verification fails if the initial state belongs to this set.

-causal
    computes a causal assertion equivalent to the initial one, before starting exploaration. This computing is expensive, so it is recommended to use it only when needed (when a first attempt have failed because of non-causal assertions). Moreover, this option is completely useless with the forward algorithm, which implements its own treatment for non-causal assertions.

-poly
    use the polyhedra library to check wether linear constraints on numerical values are feasible. Without this option, semantics of numerical values is completly ignored, and any condition is supposed to be feasible as soon as integers or reals are involved.

  Diagnosis

-diag
    prints a diagnosis when verification fails. The diagnosis describes an execution that may lead to an error state. The kind of description depends on the algorithm: sequence of actual values in enumerstive mode, sequence of constraints in symbolic modes.

  Bdds

-merge : perform a “clever” variable ordering before building bdds; this option may be useful when the state generation phase hangs.

-bddpage
    the space devoted to bdds is allocated by pages. Before allocating new pages, the program first performs garbage collection; for big programs, frequent garbage collection may dramatically slow down the model-checking, so the user may increase the size of pages, expressed in kilo-unit (default 10).

NOTES

The graphical proof manager xlesar helps builbing and managing proofs.

See~~.

AUTHORS

Pascal Raymond

SEE ALSO

lustre, lus2ec, ecexe, luciole, simec, lus2oc, ec2oc, ocmin, lus2atg, oc2atg, ec2c, poc, lux, lesar, ecverif, xlesar