Verifying Safety Properties with the TLA +  Proof System

  • Kaustuv Chaudhuri
  • Damien Doligez
  • Leslie Lamport
  • Stephan Merz
Part of the Lecture Notes in Computer Science book series (LNCS, volume 6173)


TLAPS, the TLA +  proof system, is a platform for the development and mechanical verification of TLA +  proofs. The TLA +  proof language is declarative, and understanding proofs requires little background beyond elementary mathematics. The language supports hierarchical and non-linear proof construction and verification, and it is independent of any verification tool or strategy. Proofs are written in the same language as specifications; engineers do not have to translate their high-level designs into the language of a particular verification tool. A proof manager interprets a TLA +  proof as a collection of proof obligations to be verified, which it sends to backend verifiers that include theorem provers, proof assistants, SMT solvers, and decision procedures.

The first public release of TLAPS is available from [1], distributed with a BSD-like license. It handles almost all the non-temporal part of TLA +  as well as the temporal reasoning needed to prove standard safety properties, in particular invariance and step simulation, but not liveness properties. Intuitively, a safety property asserts what is permitted to happen; a liveness property asserts what must happen; for a more formal overview, see [3,10].


Theorem Prover Proof System Safety Property Proof Obligation Proof Assistant 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
  2. 2.
  3. 3.
    Alpern, B., Schneider, F.B.: Defining liveness. Inf. Process. Lett. 21(4), 181–185 (1985)CrossRefMathSciNetzbMATHGoogle Scholar
  4. 4.
    Bonichon, R., Delahaye, D., Doligez, D.: Zenon: An extensible automated theorem prover producing checkable proofs. In: Dershowitz, N., Voronkov, A. (eds.) LPAR 2007. LNCS (LNAI), vol. 4790, pp. 151–165. Springer, Heidelberg (2007)CrossRefGoogle Scholar
  5. 5.
    Bouton, T., de Oliveira, D.C., Déharbe, D., Fontaine, P.: veriT: An open, trustable and efficient SMT-solver. In: Schmidt, R.A. (ed.) CADE 2009. LNCS, vol. 5663, pp. 151–156. Springer, Heidelberg (2009)Google Scholar
  6. 6.
    Chaieb, A., Nipkow, T.: Proof synthesis and reflection for linear arithmetic. Journal of Automated Reasoning 41, 33–59 (2008)CrossRefMathSciNetzbMATHGoogle Scholar
  7. 7.
    Chaudhuri, K., Doligez, D., Lamport, L., Merz, S.: A TLA +  Proof System. In: Sutcliffe, G., Rudnicki, P., Schmidt, R., Konev, B., Schulz, S. (eds.) Workshop on Knowledge Exchange: Automated Provers and Proof Assistants. CEUR Workshop Proceedings, vol. 418, pp. 17–37 (2008)Google Scholar
  8. 8.
    Corbineau, P.: A declarative proof language for the Coq proof assistant. In: Miculan, M., Scagnetto, I., Honsell, F. (eds.) TYPES 2007. LNCS, vol. 4941, pp. 69–84. Springer, Heidelberg (2008)CrossRefGoogle Scholar
  9. 9.
    Gafni, E., Lamport, L.: Disk Paxos. Distributed Computing 16(1), 1–20 (2003)CrossRefGoogle Scholar
  10. 10.
    Lamport, L.: Proving the correctness of multiprocess programs. IEEE Trans. Softw. Eng. SE-3(2), 125–143 (1977)CrossRefMathSciNetGoogle Scholar
  11. 11.
    Lamport, L.: How to write a proof. American Mathematical Monthly 102(7), 600–608 (1995)CrossRefMathSciNetzbMATHGoogle Scholar
  12. 12.
    Lamport, L.: Specifying Systems. Addison-Wesley, Boston (2003)Google Scholar
  13. 13.
    Paulson, L.C. (ed.): Isabelle. LNCS, vol. 828. Springer, Heidelberg (1994)zbMATHGoogle Scholar
  14. 14.
    Rudnicki, P.: An overview of the Mizar project. In: Workshop on Types for Proofs and Programs, Bastad, Sweden, pp. 311–332 (1992)Google Scholar
  15. 15.
    Wenzel, M.: The Isabelle/Isar reference manual (December 2009),

Copyright information

© Springer-Verlag Berlin Heidelberg 2010

Authors and Affiliations

  • Kaustuv Chaudhuri
    • 1
  • Damien Doligez
    • 2
  • Leslie Lamport
    • 3
  • Stephan Merz
    • 4
  1. 1.INRIA SaclayFrance
  2. 2.INRIA RocquencourtFrance
  3. 3.Microsoft Research Silicon ValleyUSA
  4. 4.INRIA NancyFrance

Personalised recommendations