TAME (Timed Automata Modeling Environment), an interface to the theorem proving system PVS, is designed for proving properties of three classes of automata: I/O automata, Lynch-Vaandrager timed automata, and SCR automata. TAME provides templates for specifying these automata, a set of auxiliary theories, and a set of specialized PVS strategies that rely on these theories and on the structure of automata defined using the templates. Use of the TAME strategies simplifies the process of proving automaton properties. particularly state and transition invariants. TAME provides two types of strategies: strategies for "automatic" proof and strategies designed to implement "natural" proof steps, i.e., proof steps that mimic the high-level steps in typical natural language proofs. TAME's "natural" proof steps can be used both to mechanically check hand proofs in a straightforward way and to create proof scripts that can he understood without executing them in the PVS proof checker. Several new PVS features can be used to obtain better control and efficiency in user-defined strategies such as those used in TAME. This paper describes the TAME strategies, their use, and how their implementation exploits the structure of specifications and various PVS features, It also describes several features, currently unsupported in PVS. that would either allow additional "natural" proof steps in TAME or allow existing TAME proof steps to be improved. Lessons learned from TAME relevant to the development of similar specialized interfaces to PVS or other theorem provers are discussed.
