Assumeguarantee

Assume-guarantee reasoning, sometimes written as assume-guarantee or simply assumed-guaranteed reasoning, is a formal verification technique used to reason about systems composed of interacting components. Rather than proving properties for the whole system in one piece, it analyzes each component in isolation under an assumed environment and the guarantees it provides as a result. If the guarantees of all components collectively satisfy the assumptions of the others, a global property of the entire system can be inferred.

In this approach, every component is paired with a contract consisting of an environmental assumption and a behavioral guarantee. The assumption specifies what the component expects from its surroundings (such as inputs, calls, or behaviors of other components), and the guarantee specifies what the component will ensure (such as outputs, state changes, or timing) when the assumption holds. Verification proceeds by proving, for each component, that under the stated assumption the component indeed guarantees the stated behavior. When all components’ guarantees satisfy the other components’ assumptions, the system-wide property follows by composition.

Assume-guarantee reasoning is used in model checking, refinement, and contract-based design for software, hardware, and embedded systems, particularly in safety- and security-critical domains. It supports modular design and scalable verification by reducing complex global proofs to a set of local proofs.

Limitations include the need for accurate and compatible environmental assumptions; incorrect assumptions can undermine soundness or completeness. Circular dependencies between components may arise and require fixpoint computations, abstraction, or iterative refinement. Variants like rely-guarantee reasoning share related ideas and differ in formalization and composition rules.