next up previous
Next: Proving an Invariant Up: No Title Previous: No Title

Invariants

An invariant is a predicate that is true in all states. In the context of state machines, we usually care that an invariant is true in all reachable states. The statement of an invariant, tex2html_wrap_inline342 , in full generality looks like:

tex2html_wrap_inline344

where tex2html_wrap_inline342 is a predicate over variables in s and in is a predicate that says whether a state is in an execution. Normally the universal quantification over all executions and the condition that s be in e is omitted (it is understood):

tex2html_wrap_inline354

Sometimes we also omit the universal quantification over s as well because it's also understood:

tex2html_wrap_inline358

For example, here is an invariant for the Counter example given in State Machine Variations handout:

tex2html_wrap_inline360

which says that in all states, x's value is greater than or equal to 0. We know this is true because initially x's value is 0 and because the inc action always increases x's value by 1. Since inc is Counter's only action, there's no other way to change x.





Norman Papernick
Mon Mar 18 14:28:12 EST 1996