Assume-Guarantee Reasoning

Concept

Assume-guarantee (AG) reasoning is a compositional verification technique in which a system specification is checked under explicit assumptions about its environment or inputs, and the result provides guarantees about observations of the system's state. It has been formulated in categorical, algebraic, and SAT-based formal settings, and applied to generalized Moore machines (including partially observable Markov decision processes and systems of parameterized ODEs), contract algebras, and CPU bug-injection frameworks such as ENCARSIA.

First seen 7/13/2026

Last seen 7/15/2026

Evidence 4 chunks

Wiki v2

WIKI

Assume-Guarantee Reasoning

Overview

Assume-guarantee (AG) reasoning is a technique for compositional model checking in which system specifications are checked under certain assumptions on system parameters or inputs, and the verification provides guarantees on observations of system state. By decomposing a global property into local assumptions on components and guarantees on their observable behavior, AG reasoning scales to systems whose monolithic analysis would be infeasible.

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

2 connections

ENCARSIA ← uses 100% 2e

ENCARSIA adopts a two-step assume-guarantee approach to guide the formal verification process.

Encarsia ← uses 100% 2e

ENCARSIA adopts a two-step assume-guarantee approach to guide the formal verification process.

LINKED ENTITIES

1 links

Encarsia USES Extracted graph relationship

CITATIONS

16 sources

16 citations — click to expand

[1] Assume-guarantee reasoning is a technique for compositional model checking in which system specifications are checked under certain assumptions on system parameters or inputs, and provide guarantees on observations of system state. Compositionality of Lyapunov functions via assume-guarantee reasoning

[2] A categorical framework for assume-guarantee reasoning for safety problems is developed by viewing systems as lenses, generalizing earlier work on the compositionality of generalized Moore machines. Compositionality of Lyapunov functions via assume-guarantee reasoning

[3] The framework includes ordinary Moore machines, partially observable Markov (decision) processes, and systems of parameterized ODEs (control systems). Compositionality of Lyapunov functions via assume-guarantee reasoning

[4] A tangency — a fibration with a section — determines the flavor of generalized Moore machine under consideration. Compositionality of Lyapunov functions via assume-guarantee reasoning

[5] The framework gives a novel formulation of assume-guarantee reasoning for (local) input-to-state stability ((L)ISS) Lyapunov functions on systems of parameterized ODEs. Compositionality of Lyapunov functions via assume-guarantee reasoning

[6] Symmetric monoidal loose right modules of AG-certified generalized Moore machines over symmetric monoidal double categories of certified wiring diagrams can be constructed 2-functorially from fibrations internal to the 2-category of tangencies. Compositionality of Lyapunov functions via assume-guarantee reasoning

[7] An algebra of assume-guarantee contracts is defined with new and known operations, and contracts are functorial: any Boolean algebra has an associated contract algebra. Some Algebraic Aspects of Assume-Guarantee Reasoning

[8] The contract algebra supports monoid and semiring structures, and mappings between such structures are studied, along with the action of a Boolean algebra on its contract algebra. Some Algebraic Aspects of Assume-Guarantee Reasoning

[9] ENCARSIA uses assume-guarantee reasoning to guide the formal verification stage that decides whether an injected transformation is architecturally observable. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection

[10] Model checking performance can be boosted by providing invariants or by partitioning the problem using assume-guarantee reasoning. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection

[11] ENCARSIA adopts a two-step assume-guarantee approach: first instruct the SAT solver to find inputs that satisfy the trigger condition using a property similar to c_propagated on the mixed-up signal; second, constrain the SAT solver to preserve the triggering sequence and propagate the discrepancy to architecturally-visible signals. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection

[12] ENCARSIA provides two formal-verification setups: a performance-oriented setup using JasperGold and a community-accessible setup using Yosys, both guided by a two-step assume-guarantee approach. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection

[13] The formal setup resets the CPUs and configures critical control/status registers (e.g., setting the FS field of mstatus to 1 to enable floating-point), modeled with initial-value abstractions and constraints for the first clock cycle. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection

[14] ENCARSIA restricts considered input behavior using SVA assume statements to avoid false positives from inaccessible SoC features, for example limiting Ibex to a single hardware thread via p_hart. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection

[15] Verification covers the c_propagated property; if it is not covered, the transformation is deemed ineffective and excluded from the evaluation. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection

[16] ENCARSIA limits injection to a single bug per design at a time to ensure that one bug does not hide another. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection