Model Checking My 27 year quest to overcome the My 27 year quest to - - PowerPoint PPT Presentation

▶
model checking
SMART_READER_LITE
LIVE PREVIEW

Model Checking My 27 year quest to overcome the My 27 year quest to - - PowerPoint PPT Presentation

Jan 04, 2023 528 likes •1.13k views

Model Checking Model Checking My 27 year quest to overcome the My 27 year quest to overcome the state explosion problem state explosion problem Edmund Clarke Edmund Clarke Computer Science Department Computer Science Department Carnegie

slide-1
SLIDE 1

Model Checking Model Checking

My 27 year quest to overcome the My 27 year quest to overcome the state explosion problem state explosion problem Edmund Clarke Edmund Clarke Computer Science Department Computer Science Department Carnegie Mellon University Carnegie Mellon University

slide-2
SLIDE 2

Intel Pentium FDIV Bug Intel Pentium FDIV Bug

 Try 4195835 – 4195835 / 3145727 * 3145727.

Try 4195835 – 4195835 / 3145727 * 3145727.

– In 94’ Pentium, it doesn’t return 0, but 256. In 94’ Pentium, it doesn’t return 0, but 256.

 Intel uses the SRT algorithm for floating point division.

Intel uses the SRT algorithm for floating point division. Five entries in the lookup table are missing. Five entries in the lookup table are missing.

 Cost: $500 million

Cost: $500 million

 Xudong Zhao’s Thesis on Word Level Model Checking

Xudong Zhao’s Thesis on Word Level Model Checking

slide-3
SLIDE 3

Recent Rumor: New AMD TLB Recent Rumor: New AMD TLB Bug?? Bug??

AMD Family 10h revision B2 processors suffer from an issue in AMD Family 10h revision B2 processors suffer from an issue in the processor TLB the processor TLB ( (Translation Translation L Lookaside

  • okaside B

Buffer uffer). ).

Launch date of these p Launch date of these processors rocessors was delayed in September, 2007. was delayed in September, 2007.

AMD doesn’t have official announcement yet, but you can google AMD doesn’t have official announcement yet, but you can google “AMD B “AMD Barcelona bug arcelona bug” for plenty of discussion. ” for plenty of discussion.

slide-4
SLIDE 4

Temporal Logic Model Temporal Logic Model Checking Checking

 Model checking is an

Model checking is an automatic verification technique automatic verification technique for finite state concurrent systems. for finite state concurrent systems.

 Developed independently by

Developed independently by Clarke and Emerson Clarke and Emerson and and by by Queille and Sifakis Queille and Sifakis in early 1980’s. in early 1980’s.

 Specifications

Specifications are written in are written in propositional temporal propositional temporal logic logic. .

 Verification procedure is an

Verification procedure is an exhaustive search of the exhaustive search of the state space state space of the design.

  • f the design.
slide-5
SLIDE 5

Advantages of Model Advantages of Model Checking Checking

 No proofs!!!

No proofs!!!

 Fast (compared to other rigorous methods such as

Fast (compared to other rigorous methods such as theorem proving) theorem proving)

 Diagnostic counterexamples

Diagnostic counterexamples

 No problem with partial specifications

No problem with partial specifications

 Logics can easily express many concurrency properties

Logics can easily express many concurrency properties

slide-6
SLIDE 6

Main Disadvantage Main Disadvantage State Explosion Problem State Explosion Problem: :

2-bit counter

0,0 0,1 1,1 1,0

n-bit counter has 2n states

slide-7
SLIDE 7

Main Disadvantage Contd. Main Disadvantage Contd.

1 2 3 a b c

||

n states, m threads 1,a 2,a 1,b 2,b 3,a 1,c 3,b 2,c 3,c nm states

slide-8
SLIDE 8

Main Disadvantage Contd. Main Disadvantage Contd.

State Explosion Problem State Explosion Problem: : Unavoidable in worst case, but steady progress over the past 27 years using clever algorithms, data structures, and engineering

slide-9
SLIDE 9

Determines Patterns on Infinite Traces Determines Patterns on Infinite Traces Atomic Propositions Atomic Propositions Boolean Operations Boolean Operations Temporal operators Temporal operators a a “a is true now” “a is true now” X a X a “a is true in the ne “a is true in the neX Xt state” t state” Fa Fa “a will be true in the “a will be true in the F Future” uture” Ga Ga “a will be “a will be G Globally true in the future” lobally true in the future” a U b a U b “a will hold true “a will hold true U Until b becomes true” ntil b becomes true”

LTL - Linear Time Logic LTL - Linear Time Logic

a

slide-10
SLIDE 10

Determines Patterns on Infinite Traces Determines Patterns on Infinite Traces Atomic Propositions Atomic Propositions Boolean Operations Boolean Operations Temporal operators Temporal operators a a “a is true now” “a is true now” X a X a “a is true in the neXt state” “a is true in the neXt state” Fa Fa “a will be true in the “a will be true in the F Future” uture” Ga Ga “a will be “a will be G Globally true in the future” lobally true in the future” a U b a U b “a will hold true “a will hold true U Until b becomes true” ntil b becomes true”

LTL - Linear Time Logic LTL - Linear Time Logic

a

slide-11
SLIDE 11

Determines Patterns on Infinite Traces Determines Patterns on Infinite Traces Atomic Propositions Atomic Propositions Boolean Operations Boolean Operations Temporal operators Temporal operators a a “a is true now” “a is true now” X a X a “a is true in the ne “a is true in the neX Xt state” t state” Fa Fa “a will be true in the Future” “a will be true in the Future” Ga Ga “a will be “a will be G Globally true in the future” lobally true in the future” a U b a U b “a will hold true “a will hold true U Until b becomes true” ntil b becomes true”

LTL - Linear Time Logic LTL - Linear Time Logic

a

slide-12
SLIDE 12

Determines Patterns on Infinite Traces Determines Patterns on Infinite Traces Atomic Propositions Atomic Propositions Boolean Operations Boolean Operations Temporal operators Temporal operators a a “a is true now “a is true now” ” X a X a “a is true in the ne “a is true in the neX Xt state” t state” Fa Fa “a will be true in the “a will be true in the F Future” uture” Ga Ga “a will be Globally true in the future” “a will be Globally true in the future” a U b a U b “a will hold true “a will hold true U Until b becomes true” ntil b becomes true”

LTL - Linear Time Logic LTL - Linear Time Logic

a a a a a

slide-13
SLIDE 13

Determines Patterns on Infinite Traces Determines Patterns on Infinite Traces Atomic Propositions Atomic Propositions Boolean Operations Boolean Operations Temporal operators Temporal operators a a “a is true now” “a is true now” X a X a “a is true in the ne “a is true in the neX Xt state” t state” Fa Fa “a will be true in the “a will be true in the F Future” uture” Ga Ga “a will be “a will be G Globally true in the future” lobally true in the future” a U b a U b “a will hold true Until b becomes true” “a will hold true Until b becomes true”

LTL - Linear Time Logic LTL - Linear Time Logic

a a a a b

slide-14
SLIDE 14

Branching Time Branching Time

slide-15
SLIDE 15

CTL: Computation Tree Logic CTL: Computation Tree Logic

EF g “g will possibly become true”

slide-16
SLIDE 16

CTL: Computation Tree Logic CTL: Computation Tree Logic

AF g “g will necessarily become true”

slide-17
SLIDE 17

CTL: Computation Tree Logic CTL: Computation Tree Logic

AG g “g is an invariant”

slide-18
SLIDE 18

CTL: Computation Tree Logic CTL: Computation Tree Logic

EG g “g is a potential invariant”

slide-19
SLIDE 19

CTL: Computation Tree Logic CTL: Computation Tree Logic

CTL uses the temporal operators CTL uses the temporal operators

AX, AG, AF, AU AX, AG, AF, AU EX, EG, EF, EU EX, EG, EF, EU

CTL* CTL* allows complex nestings such as allows complex nestings such as AXX, AGX, EXF, ... AXX, AGX, EXF, ... CTL: linear model checking algorithm ! CTL: linear model checking algorithm !

slide-20
SLIDE 20

Model Checking Problem Model Checking Problem

 Let

Let M M be a be a state-transition graph state-transition graph. .

 Let

Let ƒ ƒ be the be the specification specification in temporal logic. in temporal logic.

 Find all states

Find all states s s of

  • f M

M such that such that M, s |= ƒ M, s |= ƒ. .

  • CTL Model Checking: CE 81; CES 83/86; QS 81/82.

CTL Model Checking: CE 81; CES 83/86; QS 81/82.

  • LTL Model Checking: LP 85.

LTL Model Checking: LP 85.

  • Automata Theoretic LTL Model Checking: VW 86.

Automata Theoretic LTL Model Checking: VW 86.

  • CTL* Model Checking: EL 85.

CTL* Model Checking: EL 85.

slide-21
SLIDE 21

State-transition graph describes system evolving

  • ver time.

Model of computation Model of computation

~ Start ~ Close ~ Heat ~ Error Start ~ Close ~ Heat Error ~ Start Close ~ Heat ~ Error ~ Start Close Heat ~ Error Start Close Heat ~ Error Start Close ~ Heat ~ Error Start Close ~ Heat Error

Microwave Oven Example

slide-22
SLIDE 22

Temporal Logic and Model Temporal Logic and Model Checking Checking

  • The oven doesn’t

The oven doesn’t heat up heat up until the until the door is closed door is closed. .

  • Not

Not heat_up heat_up holds holds until until door_closed door_closed

  • (

(~ ~ heat_up heat_up) ) U U door_closed door_closed

slide-23
SLIDE 23

Transition System

(Automaton, Kripke structure)

Hardware Description

(VERILOG, VHDL, SMV)

Informal Specification Temporal Logic Formula

(CTL, LTL, etc.)

compilation manual algorithmic verification

Model Checking Model Checking

slide-24
SLIDE 24

Hardware Example: IEEE Hardware Example: IEEE Futurebus Futurebus+

+

 In 1992 we used Model Checking to verify the

In 1992 we used Model Checking to verify the IEEE IEEE Future+ cache coherence protocol Future+ cache coherence protocol. .

 Found a number of

Found a number of previously undetected errors previously undetected errors in the in the design. design.

 First time that formal methods were used to find

First time that formal methods were used to find errors in an errors in an IEEE standard IEEE standard. .

 Development of the protocol began in

Development of the protocol began in 1988 1988, but , but previous attempts to validate it were informal. previous attempts to validate it were informal.

slide-25
SLIDE 25

Symbolic Model Checking Symbolic Model Checking Burch, Clarke, McMillan, Dill, and Hwang 90; Burch, Clarke, McMillan, Dill, and Hwang 90; Ken McMillan’s thesis 92 Ken McMillan’s thesis 92

The Partial Order Reduction

The Partial Order Reduction Valmari 90 Valmari 90 Godefroid 90 Godefroid 90 Peled 94 Peled 94

Four Big Breakthroughs on Four Big Breakthroughs on State Space Explosion State Space Explosion Problem! Problem!

slide-26
SLIDE 26

Four Big Breakthroughs on State Four Big Breakthroughs on State Space Explosion Problem (Cont.) Space Explosion Problem (Cont.)

Bounded Bounded Model Checking Model Checking – Biere, Cimatti, Clarke, Zhu 99 Biere, Cimatti, Clarke, Zhu 99 – Using Fast SAT solvers Using Fast SAT solvers – Can handle thousands Can handle thousands

  • f state elements
  • f state elements

Can the given property fail in k-steps? I(V0) Æ T(V0,V1) Æ … Æ T(Vk-1,Vk) Æ (: P(V0) Ç…Ç: P(Vk))

k-steps Property fails in some step Initial state BMC in practice: Circuit with 9510 latches, 9499 inputs BMC formula has 4 £ 106 variables, 1.2 £ 107 clauses Shortest bug of length 37 found in 69 seconds

slide-27
SLIDE 27

Four Big Breakthroughs on Four Big Breakthroughs on State Space Explosion Problem State Space Explosion Problem (Cont.) (Cont.)

 Localization Reduction

Localization Reduction

– Bob Kurshan 1994 Bob Kurshan 1994

 Counterexample Guided Abstraction Refinement (CEGAR)

Counterexample Guided Abstraction Refinement (CEGAR)

– Clarke, Grumberg, Jha, Lu, Veith 2000 Clarke, Grumberg, Jha, Lu, Veith 2000 – Used in most software model checkers Used in most software model checkers

slide-28
SLIDE 28

From Hardware to Software: From Hardware to Software:

Natural Question: Is it possible to model check Natural Question: Is it possible to model check software? software? According to According to Wired News

Wired News on Nov 10, 2005:

  • n Nov 10, 2005:

“ “When Bill Gates announced that the technology When Bill Gates announced that the technology was under development at the 2002 Windows was under development at the 2002 Windows Engineering Conference, he called it the holy Engineering Conference, he called it the holy grail of computer science grail of computer science” ”

slide-29
SLIDE 29

Grand Challenge: Grand Challenge: Model Check Software ! Model Check Software ! What makes Software Model Checking Software Model Checking different ?

slide-30
SLIDE 30

What Makes Software Model What Makes Software Model Checking Different ? Checking Different ?

 Large/unbounded base types:

Large/unbounded base types: int, float, string int, float, string

 User-defined types/classes

User-defined types/classes

 Pointers/aliasing + unbounded #’s of heap-allocated cells

Pointers/aliasing + unbounded #’s of heap-allocated cells

 Procedure calls/recursion/calls through pointers/dynamic method

Procedure calls/recursion/calls through pointers/dynamic method lookup/overloading lookup/overloading

 Concurrency + unbounded #’s of threads

Concurrency + unbounded #’s of threads

slide-31
SLIDE 31

What Makes Software Model What Makes Software Model Checking Different ? Checking Different ?

 Templates/generics/include files

Templates/generics/include files

 Interrupts/exceptions/callbacks

Interrupts/exceptions/callbacks

 Use of secondary storage: files, databases

Use of secondary storage: files, databases

 Absent source code for: libraries, system calls, mobile code

Absent source code for: libraries, system calls, mobile code

 Esoteric features: continuations, self-modifying code

Esoteric features: continuations, self-modifying code

 Size (e.g., MS Word = 1.4 MLOC)

Size (e.g., MS Word = 1.4 MLOC)

slide-32
SLIDE 32

What Does It Mean to Model Check What Does It Mean to Model Check Software? Software? 1.

  • 1. Combine static analysis and model checking

Combine static analysis and model checking Use

Use static analysis static analysis to extract a to extract a model K model K from a boolean from a boolean abstraction of the program. abstraction of the program. Then check that f is true in K (K Then check that f is true in K (K ² ² f), where f is the f), where f is the specification of the program. specification of the program.

  • SLAM (Microsoft)

SLAM (Microsoft)

  • Bandera (Kansas State)

Bandera (Kansas State)

  • MAGIC, SATABS (CMU)

MAGIC, SATABS (CMU)

  • BLAST (Berkeley)

BLAST (Berkeley)

  • F-Soft (NEC)

F-Soft (NEC)

slide-33
SLIDE 33

What Does It Mean to Model Check What Does It Mean to Model Check Software? Software? 1.

  • 1. Simulate program along all paths in

Simulate program along all paths in computation tree computation tree

² ² Java PathFinder (NASA Ames)

Java PathFinder (NASA Ames)

² ² Source code + backtracking (e.g., Verisoft)

Source code + backtracking (e.g., Verisoft)

² ² Source code + symbolic execution + backtracking

Source code + symbolic execution + backtracking (e.g., MS/Intrinsa Prefix) (e.g., MS/Intrinsa Prefix)

  • Use finite-state machine to look for patterns

Use finite-state machine to look for patterns in control-flow graph in control-flow graph [Engler]

[Engler]

slide-34
SLIDE 34

What Does It Mean to Model Check What Does It Mean to Model Check Software? Software? 1.

  • 1. Design with Finite-State Software Models

Design with Finite-State Software Models

Finite state software models can act as “missing link” Finite state software models can act as “missing link” between transition graphs and complex software. between transition graphs and complex software.

² ² Statecharts

Statecharts

² ² Esterel

Esterel

slide-35
SLIDE 35

What Does It Mean to Model Check What Does It Mean to Model Check Software? Software?

  • Use Bounded Model Checking and SAT

Use Bounded Model Checking and SAT [Kroening]

[Kroening] ² ² Problem: How to compute set of reachable states? Problem: How to compute set of reachable states? Fixpoint computation is too expensive. Fixpoint computation is too expensive. ² ² Restrict search to states that are reachable from initial Restrict search to states that are reachable from initial state within state within fixed number fixed number n of transitions n of transitions ² ² Implemented by Implemented by unwinding unwinding program and using program and using SAT solver SAT solver

slide-36
SLIDE 36

Key techniques for Software Model Key techniques for Software Model Checking Checking

Counterexample Guided Abstraction Refinement Counterexample Guided Abstraction Refinement

  • Kurshan, Yuan Lu, Clarke et al JACM, Ball et al
  • Kurshan, Yuan Lu, Clarke et al JACM, Ball et al
  • Uses
  • Uses counterexamples

counterexamples to refine abstraction to refine abstraction

Predicate Abstraction Predicate Abstraction

  • Graf and Saidi, Ball et al, Chaki et al, Kroening
  • Graf and Saidi, Ball et al, Chaki et al, Kroening
  • Keeps track of
  • Keeps track of

certain predicates on data certain predicates on data

  • Captures relationship between variables

Captures relationship between variables

slide-37
SLIDE 37

Transition System Informal Specification Temporal Logic Formula

(CTL, LTL, etc.)

Safety Property:

bad state unreachable:

satisfied

Initial State

Counterexamples Counterexamples

Program

slide-38
SLIDE 38

Transition System Program Informal Specification Temporal Logic Formula

(CTL, LTL, etc.)

Initial State

Safety Property:

bad state unreachable

Counterexample

Counterexamples Counterexamples

slide-39
SLIDE 39

Transition System Program Informal Specification Temporal Logic Formula

(CTL, LTL, etc.)

Initial State

Safety Property:

bad state unreachable

Counterexamples Counterexamples

Counterexample

slide-40
SLIDE 40

Existential Abstraction Existential Abstraction

M Mα Given an abstraction function α : S → Sα, the concrete states are grouped and mapped into abstract states : α α α Preservation Theorem ?

slide-41
SLIDE 41

Preservation Theorem Preservation Theorem

  • Theorem (Clarke, Grumberg, Long)

Theorem (Clarke, Grumberg, Long)

If property holds on

If property holds on abstract model abstract model, it holds on , it holds on concrete model concrete model

  • Technical conditions

Technical conditions

  • Property is universal i.e., no existential quantifiers

Property is universal i.e., no existential quantifiers

  • Atomic formulas respect abstraction mapping

Atomic formulas respect abstraction mapping

  • Converse implication is not valid !

Converse implication is not valid !

slide-42
SLIDE 42

Spurious Behavior Spurious Behavior

AGAF red

“Every path necessarily leads back to red.”

Spurious Counterexample: <go><go><go><go> ... “red” “go”

Artifact of the abstraction !

slide-43
SLIDE 43

How to define Abstraction How to define Abstraction Functions? Functions?

Abstraction too fine Abstraction too fine ➨ ➨

State Explosion

State Explosion

Abstraction too coarse Abstraction too coarse ➨ ➨

Information Loss

Information Loss

Automatic Automatic Abstraction Methodology Abstraction Methodology

slide-44
SLIDE 44

Automatic Abstraction Automatic Abstraction

M Original Model Refinement Refinement Mα Initial Abstraction

Spurious Spurious counterexample

Validation or Counterexample

Correct !

slide-45
SLIDE 45

CEGAR CEGAR

C Counter

  • unterE

Example-

xample-G

Guided

uided A

Abstraction

bstraction

R Refinement

efinement

C Program

Initial Initial Abstraction Abstraction Simulator No error No error

  • r bug found
  • r bug found

Property Property holds holds Simulation Simulation sucessful sucessful Bug found Bug found Abstraction refinement Abstraction refinement Refinement Model Checker Verification Verification Spurious counterexample Spurious counterexample Counterexample Counterexample Abstract Model

slide-46
SLIDE 46

Software Example: Device Driver Software Example: Device Driver Code Code

Also according to Also according to Wired News Wired News: : “ “Microsoft has developed a tool called Static Device Microsoft has developed a tool called Static Device Verifier or SDV, that uses ‘ Verifier or SDV, that uses ‘Model Checking Model Checking’ to ’ to analyze the source code for Windows drivers and analyze the source code for Windows drivers and see if the code that the programmer wrote matches a see if the code that the programmer wrote matches a mathematical model of what a Windows device driver mathematical model of what a Windows device driver should do. If the driver doesn’t match the model, the should do. If the driver doesn’t match the model, the SDV warns that the driver might contain a bug.” SDV warns that the driver might contain a bug.”

slide-47
SLIDE 47

Back to Hardware! Back to Hardware!

Ease of design increases

Gate level (netlists) Register Level ………… System Behavioral

Formal verification support

slide-48
SLIDE 48

Register Level Verilog: module counter_cell(clk, carry_in, carry_out); input clk; input carry_in;

  • utput carry_out;

reg value; assign carry_out = value & carry_in; initial value = 0; always @(posedge clk) begin // value = (value + carry_in) % 2; case(value) 0: value = carry_in; 1: if (carry_in ==0) value = 1; else value = 0; endcase end endmodule Gate Level (netlist): .model counter_cell .inputs carry_in .outputs carry_out .names value carry_in _n2 .def 0 1 1 1 .names _n2 carry_out$raw_n1

  • =_n2

.names value$raw_n3 .names _n6 .names value _n6 _n7 .def 0 0 1 1 1 0 1 .r value$raw_n3 value 0 0 1 1

….. (120 lines)

slide-49
SLIDE 49

Lack of verification support Lack of verification support

Gate level (netlists) Register Level ………… System Behavioral

use techniques from software verification Must be automatic and scalable!!

slide-50
SLIDE 50

Model Checking at the Register Model Checking at the Register Level Level

Gate level (netlists) Register Level ………… System Behavioral

Model check

 

slide-51
SLIDE 51

Abstraction-Refinement loop Abstraction-Refinement loop (CEGAR) (CEGAR)

C Program

Initial Initial Abstraction Abstraction Simulator No error No error

  • r bug found
  • r bug found

Property Property holds holds Simulation Simulation sucessful sucessful Bug found Bug found Abstraction refinement Abstraction refinement Refinement Model Checker Verification Verification Spurious counterexample Spurious counterexample Counterexample Counterexample Abstract Model

slide-52
SLIDE 52

Benchmarks Benchmarks

 Ethernet MAC from opencores.org

Ethernet MAC from opencores.org

 5000 lines of RTL Verilog

5000 lines of RTL Verilog

Checked three properties: 3. Transmit module simulates state machine on left. (ETH0) 4. Checks transitions out of state BackOff (ETH1) 5. Checks transitions out of state Jam (ETH2)

Defer IPG Preamble Data0 BackOff Jam Data1 FCS PAD Idle

Transmit Module In Ethernet MAC

(self-loop on each state not shown)

slide-53
SLIDE 53

Experimental Results Experimental Results

111 94 161 359 ETH2 51 93 127 359 ETH1 55 21 44 359 ETH0 #Iters #Preds Time (sec) Latches Benchmark

slide-54
SLIDE 54

Challenges for the Future Challenges for the Future

 Exploiting the Power of

Exploiting the Power of SAT SAT, Satisfiability Modulo Theories ( , Satisfiability Modulo Theories (SMT SMT) )

 Compositional Model Checking

Compositional Model Checking of both Hardware and Software

  • f both Hardware and Software

 Software Model Checking

Software Model Checking, Model Checking and , Model Checking and Static Analysis Static Analysis

 Verification of Embedded Systems

Verification of Embedded Systems (Timed and Hybrid Automata) (Timed and Hybrid Automata)

 Model Checking and Theorem Proving

Model Checking and Theorem Proving (PVS, STEP, SyMP, Maude) (PVS, STEP, SyMP, Maude)

 Probabilistic

Probabilistic and and Statistical Statistical Model Checking Model Checking

 Interpreting

Interpreting Counterexamples Counterexamples

 Scaling up

Scaling up even more!! even more!!

slide-55
SLIDE 55

My goal: My goal: Verification of Safety-Critical Embedded Verification of Safety-Critical Embedded Systems Systems Do you trust your car? Do you trust your car?

Embedded Systems are as important in Europe as Computer Security is in the U.S.!

slide-56
SLIDE 56

Students, Post-docs, and Students, Post-docs, and Visitors Visitors

Ph.D. Students: Ph.D. Students:

Sergey Berezin Sergey Berezin

Michael Browne Michael Browne

Jerry Burch Jerry Burch

Sergio Campos Sergio Campos

Sagar Chaki Sagar Chaki

Pankaj Chauhan Pankaj Chauhan

David Dill David Dill

Allen Emerson Allen Emerson

Alex Groce Alex Groce

Anubhav Gupta Anubhav Gupta

Vicki Hartonas-Garmhausen Vicki Hartonas-Garmhausen

Himanshu Jain Himanshu Jain

Sumit Jha Sumit Jha

William Klieber William Klieber

David Long David Long

Yuan Lu Yuan Lu

Dong Wang Dong Wang

Will Marrero Will Marrero

Ken McMillan Ken McMillan

Marius Minea Marius Minea

Bud Mishra Bud Mishra

Christos Nikolaou Christos Nikolaou

Nishant Sinha Nishant Sinha

Prasad Sistla Prasad Sistla

Muralidhar Talupur Muralidhar Talupur

Xudong Zhao Xudong Zhao Post-docs:

Constantinos Bartzis

Armin Biere

Lei Bu

David Deharbe

Alexandre Donze

Azadeh Farzan

Ansgar Fehnker

Wolfgang Heinle

Tamir Heyman

James Kapinski

Daniel Kroening

Axel Legay

Daniel Milam

Alaexandar Nanevski

Joel Ouaknine

Karsten Schmidt

Subash Shankar

Ofer Strichman

Prasanna Thati

Micheal Theobald

Tayssir Touili

Helmut Veith

Silke Wagner

Karen Yorav

Haifeng Zhu

Yunshan Zhu Visitors:

  • Y. Chen

  • Y. Feng

  • T. Filkorn

  • M. Fujita

  • P. Granger

  • O. Grumberg

  • H. Hamaguchi

  • H. Hiraishi

  • S. Kimura

  • S. Krischner

G.H. Kwon

  • X. Li

  • A. Platzer

  • R. Raimi

  • H. Schlingloff

  • S. Shanker

Y.Q. Sun

  • T. Tang

  • F. Tiplea

  • Y. Tsay

J.P. Vidal

  • B. Wang

  • F. Wang

  • P. Williams

  • W. Windsteiger

Kwang Yi

  • T. Yoneda
slide-57
SLIDE 57

Questions? Questions?