<!DOCTYPE article PUBLIC "-//NLM//DTD JATS (Z39.96) Journal Archiving and Interchange DTD v1.0 20120330//EN" "JATS-archivearticle1.dtd">
<article xmlns:xlink="http://www.w3.org/1999/xlink">
  <front>
    <journal-meta />
    <article-meta>
      <title-group>
        <article-title>Model Checking of Array-Based Systems: from Foundations to Implementation</article-title>
      </title-group>
      <abstract>
        <p>We are interested in automatically proving safety properties of infinite state systems, by combining the classical algebraic approach of [4] with deductive techniques exploiting, off-the-shelf, SMT solvers. After briefly recalling the main contributions in [4] leading to the use of backward reachability analysis to prove safety properties and overviewing the long line of works stemming from that seminal paper (such as [9, 8, 5-7]), we present the notion of array based systems [10]. Such systems are declarative abstractions of several classes of parametrised systems and (sequential) programs manipulating arrays. In the framework of array based systems, key notions from [4] (such as configuration, configuration ordering, and monotonic transition) can be adapted and reused in a uniform and simple way. A by-product of this approach is to make readily available deductive techniques (like the synthesis and the use of invariants [11]) in the context of the algorithmic verification technique of backward reachability. This is so because the framework retains the modularity and the flexibility typical of logic-based approaches to modelchecking (in the same spirit of, e.g., [14]). The key feature of array-based systems is that a suitable format for initial/unsafe states and transition formulae can be designed: this format is sufficiently expressive to cover interesting classes of infinite state systems and, at the same time, generates proof obligations (during backward analysis) that can be discharged by instantiation and SMT solving techniques for quantifier-free formulae. To make the theoretical framework useful in practice, powerful heuristics are required to obtain adequate performances: these heuristics concern optimization of the computation of the pre-image [13], (static and dynamic) filtration of the instantiations that current SMT solvers cannot yet handle efficiently, as well as forward/backward simplification routines [12]. In the last part of the talk, we report our experimental experience with a prototype tool called mcmt [1], currently under development: we discuss its architecture (especially the interplay between the generation of proof obligations, the computation of pre-images, and the various heuristics) and its integration with the SMT solver Yices [3]; finally we compare mcmt with some state-of-the-art model checkers based on dedicated techniques like pfs [2]. This is joint work with Silvio Ranise (Universit`a di Verona).</p>
      </abstract>
    </article-meta>
  </front>
  <body />
  <back>
    <ref-list>
      <ref id="ref1">
        <mixed-citation>
          1.
          <string-name>
            <surname>mcmt</surname>
          </string-name>
          . http://homes.dsi.unimi.it/∼ghilardi/mcmt.
        </mixed-citation>
      </ref>
      <ref id="ref2">
        <mixed-citation>2. pfs. http://www.it.uu.se/research/docs/fm/apv/tools/pfs.</mixed-citation>
      </ref>
      <ref id="ref3">
        <mixed-citation>3. Yices. http://yices.csl.sri.com.</mixed-citation>
      </ref>
      <ref id="ref4">
        <mixed-citation>
          4.
          <string-name>
            <given-names>P. A.</given-names>
            <surname>Abdulla</surname>
          </string-name>
          ,
          <string-name>
            <given-names>K.</given-names>
            <surname>Cerans</surname>
          </string-name>
          ,
          <string-name>
            <given-names>B.</given-names>
            <surname>Jonsson</surname>
          </string-name>
          , and
          <string-name>
            <given-names>Y.-K.</given-names>
            <surname>Tsay</surname>
          </string-name>
          .
          <article-title>General decidability theorems for infinite-state systems</article-title>
          .
          <source>In Proc. of LICS</source>
          , pages
          <fpage>313</fpage>
          -
          <lpage>321</lpage>
          ,
          <year>1996</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref5">
        <mixed-citation>
          5.
          <string-name>
            <given-names>P. A.</given-names>
            <surname>Abdulla</surname>
          </string-name>
          , G. Delzanno,
          <string-name>
            <given-names>N. B.</given-names>
            <surname>Henda</surname>
          </string-name>
          ,
          <article-title>and</article-title>
          <string-name>
            <given-names>A.</given-names>
            <surname>Rezine</surname>
          </string-name>
          .
          <article-title>Regular model checking without transducers</article-title>
          .
          <source>In TACAS</source>
          , volume
          <volume>4424</volume>
          <source>of LNCS</source>
          , pages
          <fpage>721</fpage>
          -
          <lpage>736</lpage>
          ,
          <year>2007</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref6">
        <mixed-citation>
          6.
          <string-name>
            <given-names>P. A.</given-names>
            <surname>Abdulla</surname>
          </string-name>
          ,
          <string-name>
            <surname>G.</surname>
          </string-name>
          <article-title>Delzanno, and</article-title>
          <string-name>
            <given-names>A.</given-names>
            <surname>Rezine</surname>
          </string-name>
          .
          <article-title>Parameterized verification of infinitestate processes with global conditions</article-title>
          .
          <source>In CAV</source>
          , volume
          <volume>4590</volume>
          <source>of LNCS</source>
          , pages
          <fpage>145</fpage>
          -
          <lpage>157</lpage>
          ,
          <year>2007</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref7">
        <mixed-citation>
          7.
          <string-name>
            <given-names>P. A.</given-names>
            <surname>Abdulla</surname>
          </string-name>
          ,
          <string-name>
            <given-names>N. B.</given-names>
            <surname>Henda</surname>
          </string-name>
          ,
          <string-name>
            <surname>G.</surname>
          </string-name>
          <article-title>Delzanno, and</article-title>
          <string-name>
            <given-names>A.</given-names>
            <surname>Rezine</surname>
          </string-name>
          .
          <article-title>Handling parameterized systems with non-atomic global conditions</article-title>
          .
          <source>In Proc. of VMCAI</source>
          , volume
          <volume>4905</volume>
          <source>of LNCS</source>
          , pages
          <fpage>22</fpage>
          -
          <lpage>36</lpage>
          ,
          <year>2008</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref8">
        <mixed-citation>
          8.
          <string-name>
            <given-names>G.</given-names>
            <surname>Delzanno</surname>
          </string-name>
          ,
          <string-name>
            <given-names>J.</given-names>
            <surname>Esparza</surname>
          </string-name>
          ,
          <article-title>and</article-title>
          <string-name>
            <given-names>A.</given-names>
            <surname>Podelski</surname>
          </string-name>
          .
          <article-title>Constraint-based analysis of broadcast protocols</article-title>
          .
          <source>In Proc. of CSL</source>
          , volume
          <volume>1683</volume>
          <source>of LNCS</source>
          , pages
          <fpage>50</fpage>
          -
          <lpage>66</lpage>
          ,
          <year>1999</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref9">
        <mixed-citation>
          9.
          <string-name>
            <given-names>J.</given-names>
            <surname>Esparza</surname>
          </string-name>
          ,
          <string-name>
            <given-names>A.</given-names>
            <surname>Finkel</surname>
          </string-name>
          , and
          <string-name>
            <given-names>R.</given-names>
            <surname>Mayr</surname>
          </string-name>
          .
          <article-title>On the verification of broadcast protocols</article-title>
          .
          <source>In Proc. of LICS</source>
          , pages
          <fpage>352</fpage>
          -
          <lpage>359</lpage>
          . IEEE Computer Society,
          <year>1999</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref10">
        <mixed-citation>
          10.
          <string-name>
            <given-names>S.</given-names>
            <surname>Ghilardi</surname>
          </string-name>
          ,
          <string-name>
            <given-names>E.</given-names>
            <surname>Nicolini</surname>
          </string-name>
          ,
          <string-name>
            <given-names>S.</given-names>
            <surname>Ranise</surname>
          </string-name>
          , and
          <string-name>
            <given-names>D.</given-names>
            <surname>Zucchelli</surname>
          </string-name>
          .
          <article-title>Towards SMT Model-Checking of Array-based Systems</article-title>
          .
          <source>In Proc. of IJCAR</source>
          , LNCS,
          <year>2008</year>
          . Full version available as
          <source>a Technical Report</source>
          at http://homes.dsi.unimi.it/∼ghilardi/allegati/GhiNiRaZuRI318-08.pdf.
        </mixed-citation>
      </ref>
      <ref id="ref11">
        <mixed-citation>
          11.
          <string-name>
            <given-names>S.</given-names>
            <surname>Ghilardi</surname>
          </string-name>
          and
          <string-name>
            <given-names>S.</given-names>
            <surname>Ranise</surname>
          </string-name>
          .
          <article-title>Goal-Directed Invariant Synthesis in Model Checking Modulo Thoeries</article-title>
          .
          <source>In Proc. of TABLEAUX 09, LNCS</source>
          ,
          <year>2009</year>
          . Full version available as
          <source>a Technical Report</source>
          at http://homes.dsi.unimi.it/∼ghilardi/allegati/GhRaRI325-09.pdf.
        </mixed-citation>
      </ref>
      <ref id="ref12">
        <mixed-citation>
          12.
          <string-name>
            <given-names>S.</given-names>
            <surname>Ghilardi</surname>
          </string-name>
          and
          <string-name>
            <given-names>S.</given-names>
            <surname>Ranise</surname>
          </string-name>
          .
          <article-title>Model Checking Modulo Theories at work: the integration of Yices with mcmt</article-title>
          .
          <source>In Proc. of AFM 09</source>
          ,
          <year>2009</year>
          .
          <article-title>Available from mcmt web page</article-title>
          .
        </mixed-citation>
      </ref>
      <ref id="ref13">
        <mixed-citation>
          13.
          <string-name>
            <given-names>S.</given-names>
            <surname>Ghilardi</surname>
          </string-name>
          ,
          <string-name>
            <given-names>S.</given-names>
            <surname>Ranise</surname>
          </string-name>
          , and
          <string-name>
            <given-names>T.</given-names>
            <surname>Valsecchi</surname>
          </string-name>
          .
          <article-title>Light-Weight SMT-based Model-Checking</article-title>
          .
          <source>In Proc. of AVOCS 07-08</source>
          , ENTCS,
          <year>2008</year>
          .
          <article-title>Available from mcmt web page</article-title>
          .
        </mixed-citation>
      </ref>
      <ref id="ref14">
        <mixed-citation>
          14.
          <string-name>
            <given-names>T.</given-names>
            <surname>Rybina</surname>
          </string-name>
          and
          <string-name>
            <given-names>A.</given-names>
            <surname>Voronkov</surname>
          </string-name>
          .
          <article-title>A logical reconstruction of reachability</article-title>
          .
          <source>In Revised Papers of the 5th Int. A. Ershov Mem. Conf. on Perspectives of Systems Informatics (PSI</source>
          <year>2003</year>
          ), volume
          <volume>2890</volume>
          <source>of LNCS</source>
          , pages
          <fpage>222</fpage>
          -
          <lpage>237</lpage>
          ,
          <year>2003</year>
          .
        </mixed-citation>
      </ref>
    </ref-list>
  </back>
</article>