Formal Methods in System Design

, Volume 34, Issue 2, pp 104–125

Local proofs for global safety properties


DOI: 10.1007/s10703-008-0063-8

Cite this article as:
Cohen, A. & Namjoshi, K.S. Form Methods Syst Des (2009) 34: 104. doi:10.1007/s10703-008-0063-8


This paper explores locality in proofs of global safety properties of concurrent programs. Model checking on the full state space is often infeasible due to state explosion. A local proof, in contrast, is a collection of per-process invariants, which together imply the desired global safety property. Local proofs can be more compact than global proofs, but local reasoning is also inherently incomplete. In this paper, we present an algorithm for safety verification that combines local reasoning with gradual refinement. The algorithm gradually exposes facts about the internal state of components, until either a local proof or a real error is discovered. The refinement mechanism ensures completeness. Experiments show that local reasoning can have significantly better performance over the traditional reachability computation. Moreover, for some parameterized protocols, a local proof can be used as the basis of a correctness proof over all instances.


Model checkingLocal reasoningCompositionalityLocal proofs

Copyright information

© Springer Science+Business Media, LLC 2008

Authors and Affiliations

  1. 1.New York UniversityCourant InstituteNew YorkUSA
  2. 2.Bell LabsMurray HillUSA