{"id":18422448,"url":"https://github.com/sri-csl/sally","last_synced_at":"2025-04-07T07:03:14.143Z","repository":{"id":21455153,"uuid":"24773571","full_name":"SRI-CSL/sally","owner":"SRI-CSL","description":"A model checker for infinite-state systems.","archived":false,"fork":false,"pushed_at":"2024-12-20T01:05:16.000Z","size":5883,"stargazers_count":74,"open_issues_count":19,"forks_count":13,"subscribers_count":13,"default_branch":"master","last_synced_at":"2025-03-31T06:03:48.995Z","etag":null,"topics":["bounded-model-checking","ic3","k-induction","model-checker","transition-systems","verification"],"latest_commit_sha":null,"homepage":"http://sri-csl.github.io/sally/","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SRI-CSL.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"COPYING","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2014-10-03T20:57:19.000Z","updated_at":"2025-03-20T04:48:12.000Z","dependencies_parsed_at":"2025-01-31T13:10:39.252Z","dependency_job_id":"ba9c64b2-2d8f-4acf-a74c-6bdc0633fcb2","html_url":"https://github.com/SRI-CSL/sally","commit_stats":null,"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SRI-CSL%2Fsally","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SRI-CSL%2Fsally/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SRI-CSL%2Fsally/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SRI-CSL%2Fsally/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SRI-CSL","download_url":"https://codeload.github.com/SRI-CSL/sally/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247608150,"owners_count":20965952,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bounded-model-checking","ic3","k-induction","model-checker","transition-systems","verification"],"created_at":"2024-11-06T04:30:05.725Z","updated_at":"2025-04-07T07:03:14.066Z","avatar_url":"https://github.com/SRI-CSL.png","language":"C++","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![Build Status](https://travis-ci.org/SRI-CSL/sally.svg?branch=master)](https://travis-ci.org/SRI-CSL/sally)\n[![Coverage Status](https://coveralls.io/repos/SRI-CSL/sally/badge.svg?branch=master)](https://coveralls.io/r/SRI-CSL/sally?branch=master)\n[![Coverity Scan Build Status](https://scan.coverity.com/projects/5578/badge.svg)](https://scan.coverity.com/projects/5578)\n\n# Sally\n\nSally is a model checker for infinite state systems described as transition\nsystems. It is research software under development so the features and the\ninput language may change rapidly.\n\n## Prerequisites\n\nIn order to compile Sally you will need a reasonable c++ compiler such as g++ or clang, the cmake build system, the GMP library, some boost libraries, and a working Java runtime (for parser generation). On Ubuntu-like systems, the following should cover it:\n```bash\nsudo apt-get install g++\nsudo apt-get install cmake\nsudo apt-get install libgmp-dev\nsudo apt-get install libboost-program-options-dev libboost-iostreams-dev libboost-test-dev libboost-thread-dev libboost-system-dev\nsudo apt-get install default-jre\n```\nIn addition, Sally needs an SMT solver for reasoning about the systems. It currently supports\n[Yices2](http://yices.csl.sri.com/), [MathSAT5](http://mathsat.fbk.eu/), and [OpenSMT2](http://verify.inf.usi.ch/opensmt2).\nOptionally, Sally can also use [dReal](https://github.com/dreal/dreal4).\n\nFor best results, we recommend using Yices2 and at least one of\nMathSAT5 or OpenSMT2 (or both).\n\n## How to Compile\n\nYou can configure and build Sally with:\n```bash\ncd build\ncmake ..\nmake\nmake check\n```\nThe ``cmake`` command will search for the necessary libraries and for the backend\nSMT solvers installed on your system.\n\nFor convenience, you can take a look at the at the following scripts to install \nsome common SMT solvers:\n\n- [install_yices2.sh](https://github.com/SRI-CSL/sally/blob/master/contrib/install_yices2.sh)\n- [install_opensmt2.sh](https://github.com/SRI-CSL/sally/blob/master/contrib/install_opensmt2.sh)\n- [install_dreal4.sh](https://github.com/SRI-CSL/sally/blob/master/contrib/install_dreal4.sh)\n\n\nIf a solver is installed in a non-standard\nlocation, and ``cmake`` does not find it, you can give extra options. For example,\nif MathSAT5 is installed in the $MD directory, meaning that there are\n$MD/include and $MD/lib directories with MathSAT5 headers and libraries, then\nconfigure and build with\n```bash\ncd build\ncmake .. -DMATHSAT5_HOME=$MD\nmake\nmake check\n```\nYou can also set YICES2_HOME, OPENSMT2_HOME, or DREAL_HOME.\n\n\nTo compile Sally in debug mode, build with\n```bash\ncd build\ncmake .. -DCMAKE_BUILD_TYPE=Debug\nmake\nmake check\n```\n\nIn order to use the non-linear capabilities of Yices2 in Sally, you\nmust use a version of Yices2 compiled with MCSAT support, and\n[LibPoly](https://github.com/SRI-CSL/libpoly) must be\ninstalled on your system. As above, you can pass `-DLIBPOLY_HOME=$LPD` to\ncmake if LibPoly is installed in a non-standard location.\n\n\n## Input Language\n\nSally takes as input a simple description of transition systems based on the\nSMT2 language. A transition system consists of a description of the state type,\na formula describing the initial states of the system, and a formula describing\nthe transitions from the current to the next state of the system.\n\n### State Types\n\nState type is a list of variables that are part of the state, together with\ntheir types.\n```lisp\n;; A definition of a state type called \"my_state_type\" with variables\n;; x and y of type Real.\n(define-state-type my_state_type\n  ((x Real) (y Real))\n)\n```\nSometimes it is useful to model systems that take inputs that are not part of the system state. Such inputs can be defined by using the more general form of state type definition.\n```lisp\n;; State type with inputs\n(define-state-type state_type_with_inputs\n  ((x Real) (y Real))\n  ((d Real))\n)\n```\nAbove, the variable ``d`` is such an input. These input variables can only be referenced in transition formulas, by using the ``input`` namespace.\n\nWith a defined state type, we can define sets of states and transitions over the\nstate type.\n\n### State Formulas\n\nWe can describe a set of states with a state formula over the state type. A\nstate formula is a first-order formula over the variables of the state type,\nwritten in SMT2 format.\n```lisp\n;; Definition of a set of states \"x_is_zero\" capturing all states\n;; over the state type \"my_state_type\" where x is 0.\n(define-states x_is_zero my_state_type\n  (= x 0)\n)\n```\nOnce a state formula has been defined it can be reused in other state formulas\nover the same state type.\n```lisp\n;; A definition of a set of states \"initial_states\" over\n;; \"my_state_type\" by a state formula. These are all states where\n;; both x and y are 0.\n(define-states initial_states my_state_type\n  (and x_is_zero (= y 0))\n)\n```\n\n### State Transitions\n\nWe can describe allowed state transitions by a first-order formula over the\ncurrent (state) and next variables of the state type. We use the prefix\n``state`` to denote current variables, and the prefix ``next`` to denote the\nvariables in the next state. Previously defined state formulas over the same\nstate type can be used as if they were variables (state or next). Similarly,\npreviously defined transitions over the same type can be used directly.\n```lisp\n;; Definition of a transition where the next value of x is the\n;; current value + 1.\n(define-transition inc_x my_state_type\n  (= next.x (+ state.x 1))\n)\n\n;; Definition of a transition that increases both x and y\n(define-transition inc_x_and_y my_state_type\n  (and inc_x (= next.y (+ state.y 1)))\n)\n\n;; Definition of a transition that increases x and y if not\n;; exceeding 100, or goes back to the state with x = y = 0\n(define-transition transition my_state_type\n  (or\n    (and (\u003c state.x 100) inc_x_and_y)\n    next.initial_states\n  )\n)\n```\n\n### Transition Systems\n\nWe can define a state transition system by defining the state type, the initial\nstates of the system and the transitions that the system can make.\n```lisp\n;; Directly define a simple counter system that increases x and y\n(define-transition-system T1 my_state_type\n  ;; Initial states\n  (and (= x 0) (= y 0))\n  ;; Transition\n  (and (= next.x (+ state.x 1)) (= next.y (+ state.y 1)))\n)\n\n;; Define the counter system that can reset to 0 by reusing defined\n;; formulas\n(define-transition-system T2 my_state_type\n   ;; Initial states\n   initial_states\n   ;; Transitions\n   transition\n)\n\n;; Transition system with inputs\n(define-transition-system T3 state_type_with_inputs\n  (and (= x 0) (= y 0))\n  (and (= next.x (+ state.x input.d))\n   (= next.y (+ state.y input.d))\n  )\n)\n```\n\n### Adding assumptions\n\nAdditional constraints can be added to the transition system\nafter it has been defined.\n\nTo add a state formula as an additional assumption of the system (it holds at initial\nstates, it holds before and after every transition), we can use the ``assume``\ncommand.\n```lisp\n;; Add assumptions on the system\n(assume T3\n  (and (\u003c= x 100) (\u003c= y 100))\n)\n```\n\nTo add an assumption on the input values of the system, we can use the\n``assume-input`` command.\n```lisp\n;; Add assumption on the input space\n(assume-input T3\n  (\u003e= d 0)\n)\n```\n\n### Queries\n\nA query asks whether a state property is invariant for the given transition\nsystem (i.e., whether the state property is true in all reachable states).\nFor example, in the system ``T1``, it is clear that we the\nvariables ``x`` and ``y`` will always be equal and non-negative. We can check\nthese with the following queries.\n```lisp\n;; Check whether x = y in T1\n(query T1 (= x y))\n\n;; Check whether x, y \u003e= 0\n(query T1 (and (\u003e= x 0) (\u003e= y 0)))\n```\n\nIn the system ``T2``, it should hold that both ``x`` and ``y`` will never\nexceed 20.\n```lisp\n;; Check whether x, y \u003c= 20\n(query T2 (and (\u003c= x 20) (\u003c= y 20)))\n\n;; Check whether x, y \u003c= 19\n(query T2 (and (\u003c= x 19) (\u003c= y 19)))\n```\n\nIn the system ``T3``, the variables ``x`` and ``y`` should always be equal.\n```lisp\n;; Check whether we're always the same\n(query T3 (= x y))\n```\n\nThe full example above is available in ``examples/example.mcmt``.\n\n## Usage\n\nTo see the full set of options, run ``sally -h``. Some typical examples are as\nfollows\n\n* Checking the properties with the bounded model-checking (BMC) engine\n```bash\n\u003e sally --engine bmc examples/example.mcmt\nunknown\nunknown\nunknown\nunknown\nunknown\n```\n\n* Checking the property with BMC with a bigger bound and showing any\ncounter-example traces\n```bash\n\u003e sally --engine bmc --bmc-max 20 --show-trace examples/example.mcmt\nunknown\nunknown\nunknown\ninvalid\n(trace\n  (state (x 0) (y 0))\n  (state (x 1) (y 1))\n  ...\n  (state (x 20) (y 20))\n)\nunknown\n```\n\n* Checking the properties with the k-induction engine\n```bash\n\u003e sally --engine kind examples/example.mcmt\nvalid\nvalid\nunknown\nunknown\nvalid\n\u003e sally --engine kind --kind-max 20 examples/example.mcmt\nvalid\nvalid\nunknown\ninvalid\nvalid\n```\n\n* Checking the properties with the pdkind engine using the combination of yices2\n  and MathSAT5 as the reasoning engine\n```bash\n\u003e sally --engine pdkind --solver y2m5 examples/example.mcmt\nvalid\nvalid\nvalid\ninvalid\nvalid\n```\n\n* Checking nonlinear properties with Yices2\n\nBy relying on Yices2 with support for MCSAT, you can use Sally to reason\nabout (polynomial) non-linear systems using BMC and k-induction. The\nfollowing example models two systems computing sums `S1 = 1 + 2 + ... + n` and\n`S2 = 1^2 + 2^2 + ... + n^2`, and asks whether `S1 = n*(n+1)/2` and\n`S2 = n*(n+1)*(2n+1)/6`.\n\n```lisp\n;; Maintain Sum and n\n(define-state-type ST ((Sum Real) (n Real)))\n;; Initial states: Sum = 0, n = 0\n(define-states Init ST (and (= Sum 0) (= n 0)))\n\n;; Transition: Sum += n; n ++;\n(define-transition Trans1 ST (and\n  (= next.Sum (+ state.Sum state.n))\n  (= next.n (+ state.n 1))\n))\n\n;; Transition system: Sum = 1 + 2 + ... + (n-1)\n(define-transition-system T1 ST Init Trans1)\n;; Sum = n*(n-1)/2\n(query T1 (= Sum (/ (* n (- n 1)) 2)))\n\n;; Transition: Sum += n^2; n ++;\n(define-transition Trans2 ST (and\n    (= next.Sum (+ state.Sum (* state.n state.n)))\n    (= next.n (+ state.n 1))\n))\n\n;; Transition system: Sum = 1^2 + 2^2 + ... + (n-1)^2\n(define-transition-system T2 ST Init Trans2)\n;; Sum = n*(n-1)/2\n(query T2 (= Sum (/ (* n (- n 1) (- (* 2 n) 1)) 6)))\n\n```\n\nWe can prove these two properties with Sally by using Yices2 with MCSAT\nas follows\n\n```bash\n\u003e sally --engine kind ../examples/example-nra.mcmt\nvalid\nvalid\n```\n\n## Acknowledgments\n\nSally's development has been funded by the National Science Foundation, the National Aeronautics and Space Administration, and the Defense Advanced Research Projects Agency.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsri-csl%2Fsally","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsri-csl%2Fsally","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsri-csl%2Fsally/lists"}