A verification environment for I-O-automata based on formalized meta-theory

This thesis deals with the computer-assisted veri cation of embedded systems described as Input/Output automata. We achieve contributions in two elds: the theory of untimed I/O automata and its tool support. For the latter a combination of the theorem prover Isabelle with model checking is used. Concerning the theory of I/O automata, we present a new temporal logic which considerably facilitates the usual implementation proofs between live I/O automata and serves as a property speci cation language. Furthermore, a new theory of abstraction is developed which allows us to combine theorem proving and model checking. Theorem proving is used to justify the reduction of the original system to a smaller model which is then analyzed automatically by model checking. The theorem prover reasons about rst-order proof obligations only. For the remaining obligations translations to the model checkers cke and STeP are given. In contrast to existing abstraction theories, the proof of both temporal properties and implementation relations can be abstracted, a methodology for treating liveness abstractions is proposed, and a formal relation to the dual concept of re nement is established. Concerning tool support, we provide a veri cation environment that covers both standard I/O automata theory and the aforementioned extensions. The overall guideline for its construction is reliability. Therefore, meta-theoretic notions of I/O automata such as compositionality and re nement are mechanically veri ed in Isabelle. Nevertheless, a practicable environment for system veri cation is obtained. This is due to a new methodology for Isabelle's logics HOL and HOLCF, which allows the user of the framework to employ the simpler logic HOL, whereas meta-theoretic investigations gain from the more expressive HOLCF. Possibly in nite communication histories of I/O automata are formalized as lazy lists based on Scott's domain theory. This results in a generally applicable sequence model which turns out to be favorable in an elaborate comparison with alternative formalizations. In addition to the usual inductive proof principles for lazy lists we provide an infrastructure for coinduction. The practical relevance of the resulting veri cation environment is proven by several case studies, in particular by an industrial helicopter alarm system. Acknowledgments First of all, I would like to thank Tobias Nipkow for his continuous support. His supervision has been a perfect mixture of advice, inspiration, and encouragement. Furthermore, I am grateful to many friends and colleagues for valuable discussions and helpful comments on draft versions of the thesis. They include Frits Vaandrager, Stephan Merz, Markus Wenzel, Larry Paulson, David Gri oen, Marco Devillers, Ingolf Kr uger, David von Oheimb, Jan Philipps, and Oscar Slotosch. Moreover, I wish to thank Tobias Hamberger for his e orts on carrying out a case study in order to demonstrate the developed tool set. I am indebted to Manfred Broy and Tobias Nipkow for providing the stimulating environment that made this thesis possible. This includes many other people of the Munich research group as well, especially those who were involved with Isabelle or participated in the KorSys project. I merely mention Peter, Stephan, Wolfgang, David, Jan, Oscar, Max, Christian, Franz, and Conny. Special thanks are due to my roommates Konrad Slind and Markus Wenzel for the excellent atmosphere in our o ce. I really enjoyed the inspiring discussions at tea time. I am glad that this thesis is completed, because during its writing I had less time to spend with my daughter Susanna than I would have liked to have. And I would like to thank my wife Christiane for her love and support and for reminding me of the more important things in life. Finally, there are two people who laid the basis for my current life and work with regard to many aspects: Pa & ma: thank you. To Christiane and Susanna