PVS

PVS is a mechanized environment for writing formal specifications and verifying them. It combines a typed higher-order logic language with predefined theories, a type checker, an interactive theorem prover, a symbolic model checker, utilities, libraries, documentation, and examples. The language supports predicate subtypes, dependent types, and parameterized theories. Proof capabilities include induction, rewriting, simplification with decision procedures, abstraction, and symbolic model checking; command-line tools can re-prove theories and libraries in batch mode. PVS also supports the Yices SMT solver, evaluation of ground expressions through PVSio, and random testing during proofs. PVSio includes input/output, floating-point arithmetic, exception handling, and parsing. GNU or X Emacs serves as the integrated interface, and Tcl/Tk can display proof trees and theory hierarchies. Listed applications include mathematical formalization, hardware and algorithm verification, and use as a backend for computer algebra and code verification systems. Sources are under GPL; the Allegro runtime has a separate click-through license. Commercial entities need a current PVS license or should contact SRI about licensing before downloading the runtime.

PVS brings specification, theorem proving, model checking, evaluation, and testing tools into one formal verification environment. Users should review its runtime licensing terms and build requirements before adopting it.

PVS is aimed at users doing mathematical formalization, hardware or algorithm verification, and related formal methods work. Its commercial runtime licensing terms are important for commercial entities.

Overview

PVS is a self-hosted environment for formal specification and verification, best suited to researchers and engineers working with mathematical, hardware, or algorithmic systems. Its range of proof and evaluation tools is compelling, but the Emacs-centered interface and commercial runtime terms make it a specialized choice.

Key features

PVS pairs a typed higher-order logic language with predefined theories, a type checker, libraries, examples, and documentation. Predicate subtypes, dependent types, and parameterized theories give specialists ways to express detailed properties; they also make PVS a poor fit for teams seeking a lightweight tool for conventional application development.

Its interactive prover supports induction, rewriting, simplification through decision procedures, abstraction, and symbolic model checking. Counterexamples and proof artifacts help users examine verification results. Proof scripts and command-line tools can re-prove theories and libraries in batch mode, a practical advantage for repeatable work across a larger verification effort.

Evaluation and testing broaden the workflow beyond interactive proof. PVS supports the Yices SMT solver, evaluation of ground expressions, and random testing during proofs. PVSio adds evaluation and animation, including input/output, floating-point arithmetic, exception handling, and parsing. These capabilities suit projects that benefit from exploring behavior as well as proving properties.

The integrated interface uses GNU or X Emacs, with Tcl/Tk displays for proof trees and theory hierarchies. A VSCode plugin is available, but its interface is experimental; users who want a polished mainstream IDE workflow should weigh that limitation. Building from GitHub sources can also depend sensitively on the platform environment.

Pricing

PVS (noncommercial): free. This plan is for noncommercial use, and the Allegro runtime requires acceptance of a click-through license. There are no stated seat or quota caps. The free price does not make the runtime terms optional.

PVS (commercial): custom pricing. Commercial users need a current PVS license or must contact SRI about licensing before downloading the Allegro runtime. That makes PVS less convenient for a business that needs clear, self-service commercial terms.

PVS sources are under GPL, while the Allegro runtime has a separate license. Documentation includes system, language, and prover guides, tutorials, examples, and release notes, though manuals may not cover newer features. Users can report bugs by email or GitHub and ask questions through a Google Group or moderated help mailing list.

Platforms

PVS supports Linux, macOS, and Windows and is deployed self-hosted. Teams should account for platform-sensitive source builds when planning installation.

Who it's for

PVS is a strong candidate for formal-methods practitioners doing mathematical formalization, hardware or algorithm verification, or building computer algebra and code-verification systems. Its theorem-proving focus, symbolic model checking, and batch re-proving support serious verification workflows. It is not the natural pick for casual users or commercial teams unwilling to resolve runtime licensing before adoption.

Pros and cons

• Pros: A broad formal verification environment combines a rich specification language, interactive proving, symbolic model checking, evaluation, and random testing.
• Pros: Batch re-proving and proof artifacts support repeatable verification and inspection of results.
• Cons: GNU or X Emacs is the integrated interface, while the VSCode interface is experimental.
• Cons: Commercial use of the Allegro runtime requires a current license or contact with SRI, adding a licensing step for businesses.
• Cons: Building from source can be sensitive to the platform environment, complicating setup.

Alternatives

Browse formal verification tools to compare options. Choose Z3 if you want a free, MIT-licensed solver with Android, API, web, self-hosted, and desktop platform options. HOL4 is another free theorem-proving option, distributed under a modified three-clause BSD license.

Rocq is a free interactive theorem prover and dependently typed programming language. Alloy Analyzer is a free, open-source, self-contained executable. CBMC is a free option under a four-clause BSD license, while Isabelle is distributed for free under open-source licenses, with its main code base subject to BSD-style regulations. NuSMV is free and open source under LGPL v2.1; PRISM is free and open source under GPL version 2.

Verdict

Choose PVS if your work calls for expressive formal specifications, interactive theorem proving, model checking, and evaluation in one self-hosted environment. Its strongest advantage is the breadth of that verification workflow; look elsewhere if you need a conventional IDE experience or straightforward commercial runtime licensing.