PVS

PVS is a self-hosted formal verification environment built around a typed specification language and interactive proof. It is best suited to researchers and engineers formalizing mathematics or verifying hardware and algorithms. The range of proof and evaluation tools is substantial, but commercial users must settle licensing before relying on its runtime.

Overview

PVS brings specification, type checking, theorem proving, symbolic model checking, and evaluation into one environment. Its typed higher-order logic supports predicate subtypes, dependent types, and parameterized theories, making it a fit for properties that need precise expression rather than a lightweight way to check ordinary application code.

Predefined theories, libraries, examples, utilities, and documentation provide a foundation for formalization work. The environment is also used as a backend for computer algebra and code verification systems. Its self-hosted deployment suits teams that want verification work within their own environment, though building from GitHub sources can be sensitive to platform conditions.

Key features

The interactive prover offers procedures for induction, rewriting, simplification and decision procedures, with symbolic model checking as a complementary method. PVS supports counterexamples and proof artifacts, useful for inspecting verification outcomes. Proof scripts and command-line tools can re-prove theories and libraries in batch mode, so verification can be repeated without relying solely on an interactive session.

Evaluation and testing broaden the workflow beyond proof. PVS can evaluate ground expressions, run random testing during proofs, and use the Yices SMT solver. PVSio adds evaluation and animation, including input/output, floating-point arithmetic, exception handling, and parsing. These capabilities are valuable when a project needs to explore behavior as well as establish properties, but they do not make PVS a general-purpose software development environment.

GNU or X Emacs is the integrated interface, with Tcl/Tk displays for proof trees and theory hierarchies. The linked VSCode plugin may interest users seeking a different editor, but its interface is experimental; users should not treat it as a mature replacement for the documented Emacs workflow.

Pricing

PVS (noncommercial): free. This plan is for noncommercial use. Downloading the Allegro runtime requires accepting its separate click-through license, so free access is not permission to ignore those terms.

PVS (commercial): custom pricing. Commercial entities need a current PVS license or must contact SRI for licensing before downloading the Allegro runtime. This is the relevant route for business use, but organizations should resolve the license requirement before building a workflow around that runtime.

The sources are under GPL, while the Allegro runtime has its own click-through license. That distinction matters: the noncommercial plan is not a blanket commercial-use grant.

Platforms

PVS supports Linux, macOS, and Windows. It is self-hosted, and the platform-sensitive source build makes the supported operating systems a starting point rather than a guarantee that every local build environment will be straightforward.

Who it's for

PVS is a strong candidate for formal methods researchers, verification engineers, and teams working on mathematical formalization, hardware, algorithms, or verification backends. It is less suitable for general software teams seeking a conventional development interface, or commercial organizations that need an uncomplicated, clearly priced runtime license.

Pros and cons

Pros: A single environment combines a rich typed logic, interactive theorem proving, symbolic model checking, evaluation, random testing, and batch re-proving, supporting varied verification workflows.

Pros: PVSio and Yices support behavioral exploration alongside proof, while libraries, examples, and tutorials give formalization projects useful starting material.

Cons: The integrated interface is GNU or X Emacs, and the VSCode option is experimental, limiting the appeal for users expecting a polished modern editor workflow.

Cons: Commercial runtime use requires a current license or contact with SRI, adding a decision and licensing step for business adoption.

Cons: Source builds can be sensitive to the platform environment, which may complicate setup for teams building from GitHub.

Alternatives

For a broader list, see Formal Verification Tools. Choose Rocq instead if a free interactive theorem prover and dependently typed programming language better matches the work. Z3 is a free alternative for users who want its MIT-licensed solver rather than PVS's integrated specification and proof environment.

Alloy Analyzer is another free option, distributed as a self-contained executable. UPPAAL may suit eligible academic users who need its free academic license. Consider CBMC for free open-source software under a 4-clause BSD license, or Isabelle for a free theorem prover with BSD-style licensing for its main code base. SPIN offers free source and executables under BSD 3-Clause; ACL2 is also a free alternative.

Verdict

Choose PVS if your work calls for expressive formal specifications, interactive proof, and complementary model checking or evaluation in a self-hosted environment. Its breadth is the main reason to adopt it; the Emacs-centered workflow and commercial runtime licensing are the main reasons to look elsewhere.