An Algorithm for Strengthening State Invariants Generated from Requirements Specifications

In earlier work, we developed a xpoint algorithm for automatically generating state invariants, properties that hold in each reachable state of a state machine model, from state-based requirements speci cations. Such invariants are useful both in validating requirements speci cations and as auxiliary lemmas in proofs that a requirements speci cation satis es other invariant properties. This paper describes a new related algorithm that strengthens state invariants generated by our initial algorithm and demonstrates the new algorithm on a simpli ed version of an automobile cruise control system. The paper concludes by describing how the two algorithms were used to generate state invariants from a requirements speci cation of a cryptographic device and how the invariants in conjunction with a theorem prover were used to prove formally that the device satis es a set of critical security properties.