Model Checking vs. Theorem Proving: A - Cornell University

26

Transcript of Model Checking vs. Theorem Proving: A - Cornell University

Page 1: Model Checking vs. Theorem Proving: A - Cornell University

����������� ��������� ��� ������� ����� ��! "#� �$� �%� ��&(')��*+� �-,.���0/ �21

3�4$5.687+9;:=<+>@? AB7�68CEDF? D�GFHF4I5J9+6(:=<+KL? CMG�NO.PQHSRTABUV?�G�68DXWQ6 5J6 ? CMYM9[Z\68D�]E68C^ ? D[3�4$5.6$_`ZLR�a�b�c8d�e fhgie�aia+_�j ^ R68Uk? NBAmlon89p?�AB7�68CED�_rqi? CMG�Nms�t@? ABUk?iG�68D�<uNBv+U;<wY04�U

'yx{z|��}y'{��~&���6�?�CE���+6�]�9p?�]�C�?�]E9+68C�]E9�?�DyCE687+CE6 5J68D�]�N�D+��?�Dk? ��68D�]8��5���D�4��QA�6 G��i6@?i5o?(Y�4iABA�6 Y�f]�N�4�D=4 ����4iC�U~�+A-?i5�_i?�D�G�]E9+68D~G�4iNBD+��]�9+684iC�68U�7+C�4 q�NBD+��]�4�5.686�N���?@��NBq$6�D#��4�CEU{��A-?o��4�A�AB4 ��5���CE4�U�? D?��i68D�]8�w5���D+4 �QAB6 G���6�v�?�5.6$_�N�]oUV?���v�6@Uy4�CE6Q��5J60���+A�]�4�CE687+CE6 5J68D�]�]E9+N-5���D+4 �QAB6 G��i6Tv��~?�5.68Uk? D�]EN-YUy4�G�6�Ah_�?�D�G~]�9+68DVG�4=Uy4�G�68A�YM9+6 YM��N�D+�@]E4~5J686�N�� ]E9+6@��N�q$68D=��4�C�U~�+A�?�N�5o]EC��+6�NBDy]E9�?�]QUX4�G�68Ah<���6G�N�5�Y���5E5@9+4 ��]�4;Y�4iD�5J]EC���Y0](?yUy4�G�68A�]E9�?�](CE687+C�6�5J68D�]M5@? D�? ��68D�]8��5T��D+4 �QAB6 G��i6{N�D�?yD��+U~v�68C�4��G�N��`6�C�68D�]QY�4iD�]E68 �]M5�_�? D�Gy]�9+6�D[Y�4iD�5JN�G�68C�9�4��¡]�4X?�7+7+CE4$?iY¢9;]�9+6(Uy4�G�6�ABfmY¢9+6�Y¢��N�D+�(7+C�4iv+AB68U£<

¤J¥�¦ §w¨�©¢ª�«%§­¬¯®�°�§w¨ °.¨%¨�°.±8«%§­©¢®w®�²#«�¦ °�¨m©¢³�°L©¢¨ ´0±�°L«%¦i©M«\©Mµ�µi°E©¢ª�¨�§w±�¶�·h¸-¹ º�»J¹�¼M½�¾.¿8¸�ÀJ½�½u¹wÁ0ÀJ¿i»hÀ�¼M¿�ÂTÃ�¼�¸BÄ�ÀJÅƼ�¸�¹�»h¼¢½Ç Ä�ÀhÈ¢·.ÉÆÈËÊ\Ì�ȢŠÍ�¸�Î�¸�¼�¸-¹�ÈM¿(ÏËÐ|¼hÍ ÀJ·hÑ�¹�¿TÒ\ÈM¿iÈ¢·ÓÈËÊ�Ô8È�Ä8¿@Ã�»MÌ�¼¢·h¸BÄ�É%ÕLÖB°E×$Ø�ÙLØ ÚÛ§uÜB¨m¬%¦ §w«�ÝEÞJß0à�¬.©0×�°.³�§�¬�á+ª%°.¨�¨�ß�âEã�ã â�ßµ µ�Ø�âEä�âhåIâ�æ0ç�Ø+è-« §w¨ ©M±@°hé «�°J±i×8°E×#ê0°.ª%¨�§w´0±#´MÜ�©�µi©Mµ�°.ª�«�¦i©¢«�©Mµ�µi°E©¢ª�¨�§�±�Ð�·J¹�¿i»J¹ëÍi½wÀhÑLÈ-ÊÓìÓ¿�ÈMí�½�ÀhÂ�Á¢Àoî|ÀËÍi·hÀhÑEÀJ¿8¸�¼�ï¸-¹�ÈM¿~¼¢¿iÂ@î�Àm¼�ÑEÈM¿ ¹�¿�Á�ð�Ð�·mÈ�»hÀm¢¹�¿8Á�Ñ�È-Ê�¸BÄ�ÀÆñIÀh»mÈ¢¿iÂ@¾.¿�¸ËÀJ·.¿i¼�¸�¹�È¢¿i¼M½�Ì�ÈM¿.ÊEÀJ·mÀJ¿i»hÀJß�ò�Ø$àLØ$à�®w®�°J±�ß�ó\Ø�ô�§wõ�°.¨Eß+©M±i×�ö�Ø÷ ©¢±i×8°.ø�©M®w®+Ö�°�×8¨EØëÞ.ß�µi©Mù�°.¨ ú0û�ä�å ú0úMü�ßiâ�ã0ã�â0Ø

e

Page 2: Model Checking vs. Theorem Proving: A - Cornell University

ý þ�ÿ������������� ��yÿ

��9+6£5J]M? D�G+? CMG ?�7�7+C�4I?�YM9 NBD R�O#]�4���D+4 �QAB6 G��i6FCE687+C�6�5J68D�]M? ]�NB4iD�_\��4�N�D+��v�?iY¢� ]�4��ëH[Y�ZL? C�]�9��$_c8aig����._�N-5�]E42CE687+C�6�5J68D�]~?�D ?���6�D�]��w5=��D+4 �QA�6 G���6;?i5{?�Y�4�A�AB6 Y0]�NB4iD�4�����4�C�U~�+A�?�5�_\�Q9+N�Y¢9 ��6;Y8? Dq�NB68� ?i5T?�������� �"!$#&%'!)(+*-,�!M<LRTD;?��i68D�]QN-5�]�9�68D;5�?�N�G ]E4=��D+4 ��?#�m?iY�]�N�� NB]QN�5�.0/1��2&*�(3�"!o��CE4�U ]E9+6��4�CEU{��A-?�5�NBD[9+N�5���D+4 �QAB6�G���6~v�?�5.6$<)��9+N-5@N�5#Y�?�ABA�6 GFNBD � W4I5J68Dp5�YM9+68NBD|_�c8a���b � ]�9+6�4�N�D�]E68C�7�C�68]E6 G�f5J��U~v�4iABN�Y�fh5.]�CE��Y�]���C�6 5$5 ?�7�7+C�4I?�YM9�< ��9�68C�6 ? C�6 ]J�L4 7+C�4iv+AB6�Uk5 N�D�? 7+7+A���N�D+� ]�9+N�5[?�7+7�C�4$?iY¢9|<��9+6�6�C�5J]XY�4�Uy6�5#NBD ]E9+6;G�N87VY��+A�]J�[4 �(C�6�7+C�6 5.68D�]�NBD��[?��i68D�]M5��\��D+4 �QAB6 G��i6kNBD ]�68CEUk5@4��@��4iC�U~�+fA-?i5{NBD 5J4iUy6[? 7+7+C�4i7+C�N�?�]E6[A-?�D�����? ��6$<9��9+6�5.6 Y�4iD�G A�NB6 5=NBD ]�9+6£G�N87VY��+A�]J� 4���]�9+6�4�C�6�U 7�C�4 q�fNBD��+<:��9+6�5J6�7+CE4�v+A�68Uk5k?�CE6 Y�A�4$5J6�AB� C�6�A-?�]E6 G<;�]E9+6�D+6�6 G ]�4 �p5J6�A�4���N�Y�]E4 C�687�C�6 5.68D�];? ��68D�]M50���D+4 �QAB6 G��i6�D+6 Y06 5�5.NB]M? ]�6 5F]E9+6 ��5J6 4 �yq$68CE� 6� �7+CE6 5�5.NBq$6�AB4i��N-Y�5�_�v+��][]�9+6 Uy4iC�6�68 �7�C�6 5E5JNBq$6 ?AB4i��N�Y�_o]E9+6F9p?�CMG�68C=NB]~N-5�]E427+CE4 q$6 ]E9+684iC�68Uk5(NBD ]�9�? ]{A�4���N�Y�< O¯D ]E9+N-5=7�?�7�68C�_���6;? C�����6F��4�CX?Uy4�G�6�ABf�]�9+684iC�68]EN-YTC�?�]E9+68C�]�9�? D�?{7+C�4$4 ��f%]E9+684iC�68]EN-Y�? 7+7+CE4$?�YM9[]�4~]�9�6�7+CE4�v+A�68U[<>=\5�5.68D�]�N-? ABA��$_�]E9+6N-G�6 ?2N-5=]�4 C�687+CE6 5J6�D�]~]�9+6�? ��68D�]8��5{��D+4 �QAB6 G��i6Fv�� ?�G�?�]M? 5.]�C��pY�]��+CE6FCE687+C�6�5J68D�]�N�D+��5.4�Uy6£5J68fUk? D�]EN-YyUy4�G�68A@?�NBD ]�9+6£5J7+N�C�NB]~4���]E9+6A4�5JNB]E��?�]E6 G�fm?��+]E4�Uk? ]M?�5 ? 7+7+CE4$?�YM9B�rWQ4$5.68D�5EY¢9+6�NBD�_@c�a��ib';WQ4$5J6�D�5�YM9+68N�Dy? D�G�C(?�68A�v+ABN�D+�+_�c�a���g �ED _�?�D�G{CE687+A�?�Y�6�]�9+6�4�C�6�U�7+C�4 q�NBD+��v��GFH��#'!+�0IKJL!$IK�-MN��%�_�]�9�? ]N-50_�Y¢9�6 Y¢��NBD��#�Q9�68]�9+6�C�? �iNBq$68D{��4iC�U~�+A-?(N-5�]EC��+6(NBDk]E9+6(Uy4�G�68Am<

R@5Q?�Dk68 �?�UX7+AB6�4���]�9+N�5Q?�7+7�C�4$?iY¢9|_�Y�4�D�5.N-G�6�C�]�9�6�Y04�D�]�68 �]�4 ��CE68A-? ]�NB4iD�?�A G�?�]M? v�?�5.6=5.�+5.]�68Uk50<O`68]QP v�6k? CE68A-? ]�N�4�D�? A�G�?�]M? v�?�5.6;?�D�G�AB6�]SR v�6k?T6pCM5J]Ef%4iCMG�6�C)UÛ�+6�C��$<���9+6~]�9�684�CE68Uyf�7+C�4 q�NBD+�?�7�7+C�4I?�YM9=��4���A-G#q�NB6��VP ?i5�CE687+CE6 5J68D�]�N�D+��5J4iUy6���4�CEU{�+A�?>RXWk? D�G���4i�+A-G(68qi?�AB�p?�]�6L]�9+6YU$�+68CE�#v��]�CE��N�D+��]E4=7+C�4 q$6�4�C�G�N�5J7+CE4 q$6ZRXW�[ R�<\j�D���4�CE]��+D�? ]�68A��$_$]�9+6�4�C�6�U 7+CE4 q�N�D+�#��4iC�6�CM5.]�f�4�CMG�68C�A�4���N�YN-5Q�+D�G�6 Y�N-G�?�v+A�6$<���9+6�Uy4�G�68ABfmY¢9�6 Y¢��NBD���? 7+7+CE4$?�YM9�_`4iD[]�9+6�4�]E9+68C@9�? D�G`_���4i�+A-G[YM9+6 YM�{�Q9�68]�9+6�CR 9�4�A-G�5TNBD;]�9+6 G+?�]�?�v�?i5J6)Py<���9+N-5�Y8? DFv�6=68qi?�A���?�]E6 G N�DF]�N�Uy6@7�4�A���D�4�UyN�?�A�NBDk]E9+6=5.N"\86�4��\]E9+6G+? ]M?�?hY¢�E<�� KL?�C�G�Nh_�c�a���d�� D <

R@5k?�D+4i]�9+6�CF68 �?�Uy7�AB6$_�Y�4iD�5JN�G�68C;?�D�? ��68D�];RTABN�Y�6F�Q9�4 ��D+4 ��5 ]�9p?�]8_@�iNBq$68D 9+68C;Y���C�C�6�D�]687+N�5J]E68UyN-Yk5.]M?�]E6A?�Nh<u6$<B_�]E9+6[NBD���4iC�Uk? ]�N�4�D 5J9�629�?i5y4�v+]�?�NBD�6 G ]E9��p5 �m?�C D _@]�9�6[��4�CEA-G Y�4i�+A-G v�6NBD ? D���4iD+6F4 �(]�9�C�686y7�4I5�5JN�v+AB6£5J]�?�]�6�5�< O¯D ]E9+6k7�4I5�5.NBv+A�68f%�L4�CEA-G+5~?�7+7�C�4$?iY¢9|_�]�9+N�5{5.NB]E��?�]ENB4�D N�5Uy4�G�6�AB6 Gkv��;?�C@C�NB7��$6=5J]EC���Y0]��+CE6��QNB]E9[]�9+CE686=7�4$5E5JNBv�AB6=��4iC�A�G+5�<�R@5T��5.��?�Am_���6=5E?8�F]�9p?�]�RTABN�Y�6��D+4 ��5#?{�m?iY�]>][N���]FN�5�]EC��+6=N�D�?�A�A�]�9+CE686�4 �Q]E9+6=��4iC�A-G�5�]E9�?�]�RTA�N-Y�6�Y�4iD�5JN�G�68C�5T7�4$5�5.NBv+A�6{�iNBq$68D9+68CQ6�7+N-5.]�68UyN�YQ5J]�?�]�6I<

^ NBDpY�6$_�NBD 7�? C�]EN-Y��+A�?�C�_�? ABAQ]M? �+]�4iAB4i��NB6�5 �QN�ABA�v�6k]�CE�+6;?�]X?�A�AQ]�9+CE686y��4iC�A�G+5{R�ABN-Y06yY�4iD�5JN�G�68C�57�4$5E5JNBv�AB6$_�N�]���4iABA�4���5 ]�9�? ]\RTABN�Y�6\��D�4���5�?�ABA�7+CE4�7�4$5.NB]�N�4�D�? A�]M?���]�4�A�4��iNB6 50< ��9+N-5�UV?���5J6868U�5.]�CM? D+��6I<��9+6�5J68]L4��|7+C�4i7�4I5JN�]�NB4iD�?�A�]�?��+]E4�A�4���N�6 5oN�5���68A�ABf���D+4 �QD~]�4(v�6(Y�4ifE^Z_�fmY�4�UX7+AB68]E6$< >T4 � Y8? DyR�ABN-Y06$_�Q9+4 ?���]E68C;?�A�A(G�4$6 5yD+4i]F5.6868U ]�4 7�4$5E5J6 5E5F? D�� 68 �]ECM? 4�CMG�NBD�? C�� C�6�?�5J4iD+NBD�� 7�4 ��6�C8_T��D+4 �S? ABA]M? �+]�4iAB4i��NB6�5Ó�Q9�68D~5J9+6�Y�?�D��u]�7+CE4 q$6Q]�9+68UG`~OhD�]�9�6QUy4�G�68A�fhYM9+6 YM��N�D+�Q? 7+7+CE4$?�YM9�_$]�9�68C�6QN�5�D+4i]�9+N�D+��+D���5J�p?�A\? v�4i�+]@]E9+N-5��m?�Y�]�<@RTA�N-Y�6���D+4 ��5�?{7+CE4�7�4$5.NB]�N�4�D�? A���4�CEU{��A-?HR N��aR N-5Q]�CE�+6�N�DF]E9+6�]E9+C�6865J]�?�]E6 5�]�9p?�]LRTABN�Y�6LY�4�Dp5JN-G�68CM5�7�4I5�5JN�v+AB6I<b��9+N�5�Y8?�D=v�6�YM9+6 YM�$6 G@NBD�]�NBUX6c�dMN�e!$*�/N�D=]�9+6QA�68D+��]E9�4 �fR�<^T4i]�N-Y06@]�9�? ]Q68q$68Dy]E9+4�����9;RTABN�Y�6���D+4 ��5Q? ABA�]M? �+]�4iAB4i��NB6�5Z?h?�UX4�D+�=4i]�9+68C��m?iY�]M5Q5.9+6(��D�4���5��iNBq$68D9+68C\687�N-5J]E68UyN�Yo5.]M? ]�6 D _�5.9+6�G�4$6 5�D+4�]L��D�4��g�hJiMNIKJ~4��|]�9+6Q�m?�Y0]M5\5J9+6���D+4 ��5o? C�6�]M? �+]�4iAB4��iNB6 5>?m?�D�G7+CE4�v�? v+AB�£G�4$6 5@D+4�]�Y8? C�6�j D <@��9���5�_�]E9+6��L68ABA�f%��D+4 �QDk�l�+%�MNI+*�����FH��M8,�I&Mm!3��In!~7+CE4�v+A�68Uo�r>TN�D�]ENB����?�_c8a�p b���G�4$6 5�D+4i]�7+CE6 5J68D�](]�9+6V5�?�UX6yG�Nl7kY0�+AB]ENB6 5TN�D2]E9+6yUy4�G�68ABfmY¢9�6 Y¢��N�D+�k? 7+7+C�4I?�YM9 ?�5�N�]�G�4$6 5NBD;]�9+6(]E9+684�CE68Uyf�7+C�4 q�NBD+�~? 7+7+CE4$?�YM9k?h? AB]E9+4��+�i9�_�?i5�L6=5J9p?�ABA�5J6�6$_+4�]E9+68C�C�68A�?�]�6�G G�N87VY��+AB]ENB6 5QG�4

c

Page 3: Model Checking vs. Theorem Proving: A - Cornell University

?�CEN-5.6 D <��9+6Q7�? CM?�G�NB��U�4���Uy4�G�6�A+YM9+6 YM��N�D+��?�CE4$5.6Q68 �7�ABN-Y0NB]�A��TN�D=]�9+6ÆY�4�D�]�6� �] 4��L6�D+N�]�68fm5J]�?�]E6Q7+C�4i��CM? U

q$68CEN86�Y8? ]�N�4�D�<q? ^ 686 � Z\A-? C��$6k? D�Gsr�C�t�+U~v�68C���_Tc�a��up � ��4�C~? D 4 q$68CEq�N�68�(< D ^ �+7�7�4I5J6;��6k9�?8q$6;?6�D+N�]�68fm5J]�?�]E6F7+CE4���C�?�U vw?%]E9+NBD���4��xvS?i5�_o��4iC{6� +? Uy7+AB6I_�?�Y�4�UyU~�+D+N�Y8?�]ENB4iD�5@7+C�4i]�4�Y�4iA D _Æ?�D�G��6[�Æ?�D�]y]�4 ��D+4 � �Q9+68]�9�68CyNB]X5�? ]�N�5y6�6 5k5.4�Uy6£5J7�6 Y�Nl6�Y8?�]ENB4iD�zT_Q�Q9+N-YM9 �L6�?�5E5J�+Uy6�Y�?�D v�668 �7+C�6�5�5J6�G�N�D2]E68Uy7�4�C�?�A�A�4���N�Y�<|{ Oh]@N�5@D+4�]�9�?�C�G2]�4£Y�4�Uy7�AB68]E68AB�kYM9�? CM?�Y0]�68CEN"\86=]E9+6{7�C�4��iCM? Uwvv���? ]�6�Uy7�4�CM? A\AB4��iN-Y ��4iC�U~�+A-?}RX~�<�?E=\5�5.68D�]�N-? ABA��$_fRX~ G�6�5�Y�CENBv�6 5�? ABA\]�9�6y7�4$5�5.NBv+A�6y]�C�?�D�5.NB]ENB4�Dp54��Qv N�D 6 ?iY¢9 7�4I5�5.NBv+A�6[��AB4iv�?�A�5J]M? ]�6�;�]�9+N�5 N�5 7�4I5�5JN�v+AB6�5.NBD�Y06�v N-5X?�6�D�NB]�6�fh5.]M?�]E6[7+C�4i]�4�Y�4iAh< D� D+6y�Æ?�� 4���Y¢9+6�Y¢��NBD+�k�Q9+6�]�9+68CQv 5E?�]�N�5y6�6�5�]�9+6;5J7�6 Y0N86�Y8? ]�N�4�Dkz�N-5�]�4�YM9+6 YM�[N���Rf~�[ z N�5qi?�A�N-G � H[? D+D�?(?�DpG�_�D��+68ABNm_+c8a���c � <�jTD���4iC�]E�+D�?�]E68AB�I_Û]E9+6Qqi?�A�N-G�N�]J�(7+CE4�v+A�68U ��4iC\]�68Uy7�4iCM?�A�AB4��iN-Y�N�568 �]�CE68Uy68A��=G�Nl7kY���AB]8< ?���6 YM9+D+N�Y8?�A�AB�$_$N�]�N-5�6� �7�4�D�68D�]EN-? ABf�]�NBUX6�Y�4�Uy7�AB68]E6 � =�Uy68C�5J4�DV?�D�G;>@?�A�7�6�C�D�_c8a���b � _��Q9+N-YM9�UX4$5J]�A�NB�$68A��TUV?��$6 5`N�]�U~��YM9@9�?�C�G�68C�]E9�?�D=]E9+6�qi? ABN-G�NB].�@7+CE4�v+A�68U ��4�C�7+CE4�7�4$5.NB]ENB4�Dp?�AAB4i��N�Y�< D

O�?�]E68C8_�C�6 5.6 ?�C�Y¢9�68CM5QD+4�]EN-Y�6�GV]E9�?�]�?�D+4i]�9+68C�?�7�7+C�4I?�YM9[��4���A-G �L4�CE� 6�UÛ��? ABA��y��68A�A � Z\A-?�CE�$6�!+�*��"��_�c�a���gi?';�=�Uy6�CM5J4iD;?�D�G[Z\A-?�CE�$6$_`c�a��id';��T��68NBA�AB6(? D�G ^ N��m?���N-50_`c8a���d � <�W�?�]E9+68C�]�9�? D 9p?�q�NBD���vv�6@C�6�7+C�6 5.68D�]�6 G=v��X?���4iC�U~�+A-?�_�v Y�?�Dkv�6@C�687�C�6 5.68D�]E6 G=v��~?HC@C�N�7+�$6�5J]�CE��Y�]E�+C�6��~\l�]�9�6(5J]�?�]�6�5NBDq� ~ C�6�7+C�6 5.68D�]�]�9�6 7�4I5�5JN�v+AB6k�iAB4�vp?�A�5J]M? ]�6 5=4���v=_�? D�G ]E9+6k6 G��i6 5 CE687+CE6 5J68D�]�]E9+6k7�4$5�5.NBv+A�6]�C�?�D�5.NB]ENB4�Dp5T4��Yv=<�^T4i]�6�]E9�?�]�]�9�6�,�M8��!)?%Nm<r6$<�_�]�9�6�D��+U{v�68CL4��L5.]M? ]�6 5 D 4��Y� ~ N-5Q6 5�5.68D�]�N-? ABA��{]E9+65�? Uy6L?�5�]�9+6\A�68D+��]E9�4 �0R ~ ?%q�NB6���6 G(?�5 ?�5J]�CENBD+��4���5J��U{v�4�A�5 D <�Z\9+6 YM��N�D+�Q�Q9+68]E9+68Cfv 5E?�]�N�5y6�6�5�]E9+65J7�6 Y0N86�Y8? ]�N�4�D�z�D+4 � ?�UX4��+D�]M5�]�4 Y¢9�6 Y¢��NBD��@N���z�N-5\]�CE�+6@? ]�]E9+6(5J]�?�]E6@NBD}� ~ ]�9p?�]QY04�C�CE6 5J7�4iD�G+5]�4~]�9�6#N�D+NB]EN-? A�5J]�?�]E6#4 �Yv=< ��9+N-5QY�?�DFv�6�G�4iD+6�N�D ]ENBUy6x�lMN�e!$*�/\NBDk]�9+6�5.N"\86@4 �Y� ~ ?�D�GGR�<

� �LY�4���CM5J6I_`NB]�Y�4���A-G v�6~? C�����6 GF]�9�? ](?�A�A�]E9�?�]�]�9+N�5T? C�����Uy68D�]�5J9+4 ��5@N-5Q]�9�? ]T��4�C�?{5.7�6�Y�N-? A5J��v`Y0A-?�5E54 ����4�CEU{��A-?�5Z?�D�?�UX68AB�$_$]E9+4$5.6�4���]�9�6#��4�CEU�R ~ [ z D _�]E9+6�qi?�A�N-G�N�].�{7+CE4�v+A�68U N�5Q5JNB�iD+N���fN-Y�?�D�]�AB�V5JNBUX7+AB68CL]�9�? DFN�]TN�5N�DF��6�D+68CM? Ah<�OhD�G�686�G`_+7�68C�9�? 7�5T]E9+N-5Q4�v�5.68C�qi? ]�NB4iD�5J9+4i�+A-GF6�D�Y�4���CM?��i6��5Q]�4S6�DpG 4�]E9+68C�5.�+v�Y�A-?i5�5J6�5Æ��4iCQ�Q9+N-YM9k]�9+6(qi?�A�N-G�N�]J�~7+CE4�v+A�68U N�5Q5J4iABqi?�v+A�6(NBDk7�4�AB��D+4iUyN-? A`]�N�Uy6?hYM�E<A��=�Uy68C�5J4iD�!+�x*��"��_�c8a��ia-� D <2>�4��L68q$68C�_��L6y��4i�+A-G Y�A�?�N�US]�9�? ]=]�9+N�5=?�C��i�+Uy68D�](UyN-5E5J6 5@]E9+67�4�N�D�]�< ��9+6@C�6�?�5J4iDy]�9p?�]o��4iC�U~�+A-?i5�4�� ]�9�6��4iC�U�RX~�[ z ?�CE6T6 ?i5J�~]�4 G�6 ?�A��QNB]E9{N�5ov�6 Y8? ��5J6@Rf~YM9�?�C�?�Y�]E68C�N�\86 5�?V7p?�C�]EN-Y���A-?�C�5J]M? ]�6~NBD�?{7p?�C�]EN-Y���A-?�C�5J]�CE��Y�]E�+C�6$_�N�D[]�9�? ]�? D��£5J]�?�]�6=�Q9�68C�6}RX~�N�55�? ]�N�5y6�6 GkN-5QN-5.4�Uy4iC�7+9+N�YT]�4~]�9�6�NBD�NB]�N�?�A|5J]M? ]�6�4��\]E9+6=5.]�C��pY�]��+CE6�G�6n6�D+6�G v���v=<>��9��p5�_+��4�C�]�9+6 5.6��4�CEU{��A-?�50_$]�9+6@qi? ABN-G�NB].�=7+C�4iv+AB6�U CE6 G���Y�6�5Ó]E4~?�Uy4�G�68A�fhYM9+6 YM��N�D��@7+C�4iv+AB6�U[_�?�D�Gk5J4=N�5o]ECM?�Y0]M?�v�AB6$<

��9+6�Uy4�G�68ABf�]�9+6�4�C�6�]�N-Y[? 7+7+CE4$?�YM9�]�4k6�D+NB]E68fm5J]M? ]�6�7�C�4��iCM? U q$68C�Nl6�Y8? ]�NB4iD N�5�U$�+NB]E627�CM?�Y0]�NBfY8? Ah_�? D�G�5.68q$68CM? AL5J��5J]�6�Uk5Tv�?i5J6 G24iD�Uy4�G�6�A�YM9+6 YM��NBD+�y9p?�q$6=v�686�D�NBUy7�AB68U~68D�]�6�G � Z\A�?�CE�$6~?�D�Gr�C�t�+U{v�68CE�+_�c�a��up�;�P��+C�Y¢9k!+��*��"��_�c�a�aid � <LHF4�C�6�4�q$6�C8_+NB]Q9p?�5Qv�6�68DF68 �]�6�D�G�6 G{]E4yG�6 ?�A �QNB]E9 UX4�C�6Y�4iUy7+ABN�Y8?�]E6 G 7�C�4�]E4�Y�4�A�5�? D�G268D�q�N�C�4iD+Uy68D�]M5Z?�NBD�Y�A���G�N�D+��.0/1��(+*�(�M"�lM8,3�EMNI@7+CE4�]�4�Y04�A-5�?�D�G ?�5�5.�+Uy7+f]�N�4�D�5�4 �>��*�MN/3�e!1,+, � KL?�CMG�N�?�D�G���4�AB7�68C�_Tc�a��ig �ED < OhD 5J4iUy6kY8?i5J6 50_o]E9+6;?�5E5J�+Uy7�]�NB4iD�5�]�9p?�]~?�CE6v�68NBD��FG�6 ?�A�]@�QNB]E9k?h5J�pY¢9 ?�5T�m?�N�C�D+6�5�5 D ?�C�6~D+4i]#6�q$68DF68 �7+CE6 5�5.NBv+A�6�NBD[]E9+6~A-?�D�����? ��6~v�6�NBD+�k��5.6 G��4�C(]E9+6~5J7�6 Y�Nl6�Y8? ]�NB4iDF��4�CEU{�+A�?�<@��9+N�5TN-5�D+4�]�?y9+NBDpG�CM? D�Y�6=]�4X]�9+6=Uy4�G�68ABf�]�9+6�4�C�6�]�N-Y�?�7+7�C�4$?iY¢9|<��6=Y8? D[4���]�6�D[YM9+6 YM�{�Q9+6�]�9+68C�]�9�6=Uy4�G�68A 5E?�]�N�5y6�6�5T?i5�5J��Uy7+]�N�4�D�5�]�9�? ]@? C�6=D+4i]@68 �7+C�6 5E5JN�v+AB6@N�D]�9�6#A�?�D+�i��?��i6$<���X� ª�×�§�¨h¬ � ¨%¨�§w´0±\¦�°.ª�°`µ ª�°J¨ � ³T°.¨�«%¦ ° � ¨�°�´¢Ü'�J·m¼¢¿i»¯Ä�¹�¿8Á+«�°J³�µ�´0ªm©¢®0®w´0ù�§�¬MØ�è-±\«�¦ °`¬.©M¨%°�´¢ÜÛ½r¹�¿iÀh¼M·�«%°.³�µ�´0ªh©M®M®w´0ù�§­¬¢ß

«�¦�°\¨�§w« � ©M«�§w´�±�§w¨�¨%´0³�°Jø�¦i©M«`³�´�ª�°\¬h´0³Tµ ®w§�¬.©M«%°E×$ß�¨�°.°Z� ö+³T°.ª�¨%´0±(©M±�×@� ©¢®�µ�°.ª%±�ß�â�ã3�0ä-� ÷8§w¨�«%®­©Q©¢±i×Z `®�©Mª�õ�°0ß$âEãn�0ä-�Ú$§�¬%¦8«�°.±�¨�«�°J§�±�©M±i×Tá+± � °.®w§-ß�âEãn�0䢡�Ø

d

Page 4: Model Checking vs. Theorem Proving: A - Cornell University

��9+6=Y04�C�6�4��\]E9+N-5Q7�? 7�6�CH? ^ 6�Y�]�N�4�D[d D N�5TG�68q$4�]E6 Gy]�4k?~G�68]�?�NBA�6 GkG�6 5EY�C�N�7+]�N�4�DF4 �\]�9�6�Uy4�G�6�ABfYM9+6 YM��N�D+�=? 7+7+C�4I?�YM9�_�?yG�N-5EY���5E5JNB4iDF4 �\7�4�]�6�D�]EN-?�A 7+CE4�v+A�68Uk5o�QN�]�9;]�9+6 ?�7+7+CE4$?iY¢9£?�D�GF9+4 ��5.4�Uy6UyN���9�]�v�6�G�6 ? AB]��QN�]�9=v�����5.NBD+��Y��+C�CE68D�]�]E6 Y¢9�D+NNU$�+6 50_�? D�G{?(Y�4iUy7�? C�N-5.4�D�4���]E9+6QUy4�G�6�ABfmY¢9+6�Y¢��NBD+�?�7�7+C�4I?�YM9F? D�G ]E9+6@]E9+684�CE68Uyf�7+C�4 q�NBD+� ?�7+7�C�4$?iY¢9|<��26�?�A�5J4~Y�4iD�5JN�G�68C�?%NBD ^ 6�Y�]�N�4�D�£ D ]�9+6(AB4i��N�Y8?�A4�UXD+N-5EY�NB68DpY�6Q7+C�4iv+AB6�U ��4�CQ]E9+6(Uy4�G�68A�fhYM9+6 YM��N�D+�@7�4�N�D�]Q4 �\q�NB68�(_�?�DpGFG�N�5�Y���5E5Q? A�4��iN-Y@? 7+7+C�4i7+C�N�f?�]E6 ��4iC(C�6 ?i5J4�D�NBD+�k��5.NBD+�k]�9�6{Uy4�G�68ABfmY¢9�6 Y¢��N�D+�X?�7+7+CE4$?iY¢9�_�N�D�5J7+N�C�6 GFv��F]E9+6~AB4��iN-Y�4 �QC�6�5J4���CMY�68fv�4��+DpG�6 Gy��D�4��QA�6 G��i6@7+C�6�5J68D�]�6 G~NBD � HF4$5.6 5�_�c�a���� � <���6(Y�4�DpY�AB��G�6@NBD ^ 6 Y�]�N�4�D)¤=�QNB]E9k?���68D�68CM? AG�N�5�Y���5E5JN�4�Dk4��\]E9+6�?�7+7�C�4�7�C�N-? ]�68D�6 5�5

¥ ¦ § ÿ�¨ ��©�ª « ����ªS¬n­®��©�ª@�)��ª@�� � ¯H°�°�Y��¯�>©

±�²$³ ´Aµ�¶¸· ¹�º@ºZ» ¼Aµ¾½+¿$º@ÀL¶�ÁÃÂV¹�ÄXÄb¿$¶

P�6���4iC�6��i68]�]ENBD+�(N�D�]E4@]�6 YM9+D+N�Y8?�A�G�68]M? NBA-50_���6QUX4�]�N�qi?�]�6L]�9+6QUX4�G�68ABf�]�9�684�CE68]�N�Yo? 7+7+CE4$?�YM9~v�� ?�7+7+A���fNBD��yNB]�]�4k]�9�6���6�ABABf���D+4 �QDÅ4�U~��G+G��kYM9+N�A-G�CE68DL5=7+��\&\8A�6$<Z��9�[email protected]�?�CE]�N�Y��+A-? C�A��k?�7+7�C�4�7�C�N-? ]�6��4�C(]E9+N-5ZÆ+6 5.]M5EY¢9+CEN���]�_�5JN�D�Y�6=H[Y ZL?�C�]E9��;�Q?i5�4iD+6~4��Q]E9+6=7+N�4�D+686�CM5T4 ��?�]E]�68UX7+]�N�D+�{]E4y��4�C�UV?�ABN�\865J�pY¢9k7+��\�\8AB6 5��p5JNBD��{687�N-5J]E68UyN�YA�4���N�Y85�?�D�G`_�NBDpG�686 G`_�]�9+6�U{�pG+G��XY¢9+N�A-G�CE68Dy7+�i\&\8AB6�N-5�? �i68D+68C�?�ABfN"\�?�]�N�4�D=4 ��]�9�6Q�QN-5J6�f%Uy6�D�7+��\�\8AB6ÆY�4�D�5.N-G�6�C�6 G�N�DG�rH[Y�ZL? C�]�9��$_+c�aup��-�.<b��9�6Tq$68C�5JN�4�D=4���]E9+6TU~��G+G��YM9+NBA�G�C�68DX7+��\&\8A�6@��N�q$68Dy9+6�C�6(N-5�]�?��$68Dy��C�4iUÇ�ëPQ?�CE�QN-5J6I_�c8a���cn�.l

OhUk?��iNBD+6}È YM9+NBA�G�C�68D�7+A�?���NBD��F]�4i��68]E9+68C�<V��9+6kUy4i]�9+68C�4���]�9+6�5J6kYM9+NBA�G�C�6�D29�?i5]E4�A-G ]�9+6�U ]�9�? ]{N��@]E9+68� ��6�]~G�NBCE]J� ]�9+68CE6k�QNBABAQv�6£5J68q$68CE6kY�4iD�5J6�U$�+68DpY�6 5�< ^ 4+_�4 �Y�4i�+CM5.6$_+6 ?iY¢9;YM9+NBA�G �Æ?�D�]M5Q]�4~�$68687kY�A�6 ?�D|_�v+�+]Q6�?�YM9 �L4��+A�GyAB4 q$6@]�4X5J6�6#]E9+6(4�]E9+68CM5�i68]@G�NBC�].�$<Y^T4 � N�]Q9�?�7+7�68Dp5@G��+CENBD+�~]�9+6�NBCQ7+A�?��X]�9�? ](5J4iUy6@4��L]E9+6�Y¢9+N�A-G�CE68D�_�5�?8��É4 ��]�9+68U£_��i68](U{�pG�4iD�]�9+6�NBC@��4�CE689+6 ?iG+5�<G=\?�YM9 Y8?�D 5J686~]�9+6~U~��G�4iD�4�]E9+68C�5#v+�+]D+4i]�4iD 9�N-5o4 �QD{��4iC�689�6 ?�G`< ^ 4+_�4 ��Y�4���CM5J6I_�D+4�4�D+6(5E?8�+5Q?(]�9+N�D+�+<\RTA�4�D+� Y�4�UX6 5�]�9�6�m? ]�9+68C�_��Q9+4(5E?8�+50_h4�R] AB6�?�5J]�4�D+6Q4 �`�$4i��9�?i5�U{��G@4iD=�$4��+C�9�6 ?�G`_Ê5@]�9���5�6� �7+CE6 5�5.NBD+�?y�m?�Y�]���D+4 �QD�]E4[6 ?�YM9�4���]�9�68U)v�6���4iC�6y9�6k5J7�4��$6�?%N���ÉkË c D <G��9+6{�m? ]�9+68C�]�9+6�D?i5J��5]E9+6T��4�A�AB4 �QNBD��)UÛ�+6�5J]�N�4�D�_�4 q$68CQ? D�G 4 q$68C�lc4 �ÍÌ 4$6 5�?�D��y4����$4��k��D+4 � �Q9�68]�9+6�C ��$4i�y9�?8q$6TU~��G=4�Dk�$4���C�9+6 ?iGe`�52R�5�5J��UyNBD+�(]E9�?�]�? ABA`]E9+6(YM9+NBA�G�C�6�D~?�C�6�7�6�CMY�687�]�NBq$6I_N�D�]E68ABA�NB��6�D�]�_�]EC��+]E9����+Ah_�? D�Gy]�9�? ]�]�9�68�~?�D�5.��68CÆ5JN�U{�+A�]M? D+684��p5JAB�I_��Q9�?�]L�QNBA�A�9p?�7+7�68D<`

��9+68CE6{N�5(?Î4�7�C�4$4��¢5F]E9�?�]�]�9+6H6�CM5.]HÉ�Ï c{]ENBUy6 5Q9+6X?�5.�+5(]�9+6}UÛ��6 5J]ENB4�D|_�]�9�68��QN�ABA�? ABA 5E?��Ð4�D+4�5�_�v+�+]�]�9+68Dk]E9+6HÉ�Ñ8Ò(]ENBUy6�]�9�6�G�NBC�].�kYM9+N�A-G�CE68D{�QN�ABA|?�D�5.��68C)4��$6 5$5�<

��9+6x4�7+CE4$4��¢5@N-5�v��@N�D�G���Y0]�NB4iD(4�D�Ép<bÆ+4�C É�Ó co]E9+6�CE6 5J�+A�]�N-5`4iv�q�NB4i��5�l ]�9+6LG�N�C�].�YM9+NBA�G=5J686�5Ó]E9�?�]LD+4�4iD+6@68A�5J6QN�5ÓU~��G+G��$_$5J4�9+6�U{��5.]�v�6@]�9�6TU~��G+G���4�D+6I<bO`68]L��5�G�4É�Ó d�< ^ 4y]E9+68CE6�? C�6�Ô.��5J]@].�L4yG�N�C�].�kYM9+NBA�G�C�6�D�_�Õk?�DpGÖ8<>=\?iY¢9£?�D�5.��68C�5�4�D+4�5{]�9�66�C�5J]L]�NBUX6$_�v�6 Y�?���5.6T4 � ]�9+6�U{�pG�4�D~]�9+6�4�]E9+68C8<\P���]8_$�Q9+68D�ÖL5�?8��5¾4�D�4+_|5xÕ�C�6 ? ABN�\86 5]E9�?�]@9�6=U{��5.]Tv�6=U~��G+G��I_���4�C@4i]�9+68CE�QN-5.6�Ö@��4i�+A-GF9p?�q$6���D�4��QD[]E9+6=U~��Gy�Q?�5@4iD9+N�5o9+6�?�Gy? D�Gk?�D�5.��68CE6 G4��$6�515�]�9�6c6�CM5.]�]ENBUy6$<f��9���5�Õ~?�Dp5J��6�CM5S4��$6�515#]E9+6(5.6 Y�4�DpG]ENBUy6$<ÆP��+]¾Ö��i4$6 5T]�9�C�4�����9�]�9+6 5�?�UX6#CE6 ?�5.4�D+N�D+�+<@^�4�� 5J�+7+7�4I5J6�É×Óg£';�5.4y]�9�68C�6? C�6y]E9+C�686VG�NBCE]J� YM9+NBA�G�C�68D|_XÕLØnÖ�Ø+Ù <2Z\9+NBA�GVÕ�? C�����6 5=?�5#��4iABAB4 ��50<2R�5�5J��Uy6yO(G�4iD��r]

£

Page 5: Model Checking vs. Theorem Proving: A - Cornell University

9�?8q$6=U~��GF4�D�U~�F9+6 ?iG`<���9�68D�_�v��[]E9+6�ÉÓ dFY8?i5J6$_�v�4�]E9AÖ�?�DpGVÙ��QNBA�A\?�D�5.��68C4E�$6 515F]E9+6[5.6 Y�4�DpG ]ENBUy6I<2� 9+68D ]E9+68� G�4iD��r]�_�9+6kC�6�?�ABN�\86 5(]�9�? ]{]E9+6;?�5�5.�+Uy7+]ENB4iD�Æ?�5�m? A-5J6I_�]E9�?�]@9�6�N-5�U{��G�G��$_+? D�G[5J4k�QN�ABA ?�Dp5J��6�C�4��$6 5$5 4iD[]�9+6=]E9+NBC�G�U$�+6 5.]�NB4iD�<^ N�UyNBA�?�CEAB�#��4iC¾Ö?�D�GGÙ�< � ��9+6(��68D+6�CM?�A Y�?�5J6(N�5Q5JNBUXNBA-? C8< �

��9+68CE6Q9�?8q$6Qv�6�68D=Uk?�D��=? ]�]E68Uy7+]�5�]E4�G�6 5�Y�CENBv�6Q]�9�N-5�].��7�6Q4 ��CE6 ?�5.4�D+N�D+�(�QNB]�9�NBD~?@AB4i��N-Yi_�7�?�CEf]�N�Y��+A�?�C�A��(NBD~]�9+6�Y�4iD�]E68 �]�4��|]�9+6Q�QN�5J68f�Uy68D�7+��\&\8A�6$<�P�6�5JN-G�6 5�H[Y ZL?�C�]E9����w5 4��QD=��4�CEUk?�A�N"\ ? ]�N�4�D�N�D�rH[Y ZL?�C�]E9��I_+c8a�p��-�._$4i]�9+68C���4iC�Uk? ABN"\�?�]�N�4�D�5 ?%UV?�D��=Y8? C�C�N�6 G�4���]�? ]QH[Y�ZL? C�]E9����w5�N�D�5J]ENB�I?�]�N�4�D D Y8? Dv�6@��4��+D�GkNBD�_$��4�CQ68 �?�UX7+AB6$_®�rRQ]�]M? CMG�N|?�D�G ^ N�UyNh_�c�a��-¤i;`R�NB68A�AB4�!+�Y*��"��_�c8a�����;`RTN�68ABA�4�!+�>*��"��_�c�a��ia';C@�+4+_\c�a��-¤i;bC@4�D�4�ABN���6$_\c�a��-¤i;b^@? NB](R�v`G�?�ABA�?�9�_\c�a���a�; ^ ]�?�CE�`_\c8a���c3�.<���9�6{�QN�5J68f�Uy68D;7+��\&\8A�6�N�56 5E5J68D�]�N�?�ABA���?�5J7�6 Y0N-?�A�Y�?�5J6;4���]�9+6;U{�pG+G�� Y¢9+N�A-G�CE68D�7+�i\&\8AB6I_��Q9+68C�6k]E9+68C�6;? C�6F]E9+C�6�6 U~��G+G��YM9+NBA�G�C�68D|_�? D�G�]�9+6X�QN-5J6XUy68D�?�CE6GUÛ�+6�C�NB6�G25.6�UÛ��68D�]EN-? ABAB�;CM? ]�9+68C�]�9�? D 5JNBU~�+A�]M?�D�684���5.AB�$<�=�q$68D��4�C�]�9�N-5Q5J7�6 Y0N-?�A�Y8?i5J6$_���4iC�Uk? ABN"\�NBD+��]�9+6(7+��\�\8AB6@N�5D�4�D�]�C�N�q�N�?�A�;+?�DpGF?�A�A�]�9+6�7+C�6�q�N�4���5o��4iC�Uk? ABN"\�?�f]�N�4�D�5QNBD�q$4�A�[email protected]�Uy6�Uy6 YM9�?�D+N�5JU�?�]J��7+N�Y8?�A�AB�=��5.NBD+�~9+NB�i9+68CEf%4iCMG�68C�AB4i��N�Y�4iC�Y�NBC�Y��+Uk5EY�C�N�7+]�N�4�D D ��4iCY8? 7+]��+CENBD+�;]�9+6VG�6 G���Y0]�NB4iD Y8? 7�?�v+N�ABN�]�NB6�5�4 ��]�9+6V?���6�D�]�5��QNB]�9�NBD�]E9+6yAB4i��N�Y�< ��6k5.9+4 � 9+4 ��]E9+65JN�]���? ]�N�4�D;Y8?�D;v�6�YM9�? CM?�Y0]�68CEN"\86 G~Uy4�G�68A�f%]E9+684�CE68]�N�Y8?�A�AB�$_iNBD;?�7�?�CE]�N�Y��+A-? C�A��y68AB6��$?�D�]��Æ?8�$<

��4X68 �7�A-?�N�DF4i�+C(YM9�?�C�?�Y�]E68C�N�\ ?�]ENB4�D|_+��6�D�686 GF5.4�Uy6(7+CE68ABN�UyNBDp?�C�N�6 5o4iDFUy4�G�?�A AB4��iN-Y�?�D�GF]E9+67�4$5E5JNBv�AB68f���4iC�A-G�5#7�? CM?�G�NB��U£< ��6~�Q?�D�](]�4;G�6 5EY�C�N�v�6~?�D ? ��68D�]8��5���D+4 �QAB6�G���6$<)��9+6~]�C�?�G�N�]�N�4�D�? A�Q?8��]E4�G�42]E9+N-5=N-5�]E4�5E?�� ]�9�? ]y? D ?��i68D�]{��D+4 ��5{?F�m?�Y0])R N���NB]=N�5�]�CE�+6FN�D ? ABAQ�L4�C�A�G+5=]�9�? ]]�9�6�? ��68D�]�Y�4iD�5JN�G�68CM5Q7�4$5E5JNBv�AB6$<���6�Y8?�7+]E�+C�6(]E9+N-5�v��yUy6 ? D�5o4 �L?�Úx/3MÛ.���!Z,3��/nÜ�In��Ü'/+!M<�RÝC�CENB7+�$65J]EC���Y0]��+CE6�� ��4�C�È{? ��68D�]M5�N-5 ?Q]��+7+A�6�?ßÞfØ+àbØ1á { Ø&â&â&â3Ø1á@ã D _��Q9+6�C�6>ÞkN-5�?�5J68] 4��p7�4I5�5.NBv+A�6@�b��/+�l#-,�4iC,3��*��ß!1,0_Là[?i5�5.4�Y�N-? ]�6 5��QN�]�9k6 ?�YM9y�L4�C�A�G{NBDGÞ ?�]�CE�+]�9V?�5�5.NB�iD+Uy68D�]Z?�7+C�4i7�4I5JN�]�NB4iD�?�A�4iC�6�CM5.]�f�4�C�G�68C?�5�]�9+6�Y8?i5J6�UV?��Xv�6 D _�?�DpG�á¾ä N-5�?G(&MN��*�/3å�/K!+�d*��EMN���=4�DVÞL<QOhD�]E�+NB]ENBq$68A��$_�]E9+6�]EC��+]E9[?�5E5JN���D+Uy6�D�]àb?Eæ D ]�68A�A-5���5{�Q9p?�]~N-5=]�C���6FNBD ?2��4iC�A�GAæ(<ç��9�6FC�6�A-?�]ENB4iDAá ä N�5 N�D�]E68D�G�6�G ]�4 Y8? 7+]��+CE6F]E9+67�4$5E5JNBv�NBABN�].�{CE68A-? ]�NB4iD;?�Y8Y�4iCMG�N�D+�=]�4X?��i68D�]�è�l>?Eé�Ø+ê Dbë á ä N���? ��68D�]�è�Y�4�Dp5JN-G�68CM5��L4�C�A�G�ê{7�4$5�5.NBv+A�6�Q9+68D NBD���4�CEA-G�é�<y�26~]�9+6�D 5�?8��?��i68D�]HèQ��D+4 ��5xR ? ]���4iC�A�GVé2NBD 5J]EC���Y0]��+CE6���_\? D�G2�QCENB]�6?E��Ø+é DZì ÓÅí ä R�_+N�� R�N-5Q]�CE�+6(NBD;?�A�A�]�9+6���4iC�A-G�5>ê{]�9�? ]@? ��68D�]�èoY04�D�5.N-G�68C�5�7�4$5�5.NBv+A�6�N�D �L4�CEA-G�é�<��9+N�5@Y8?�7�]��+CE6 5@]�9+6=N�D�]E�+NB]ENB4�D;]�9�? ]�?�D ?���6�D�]@��D+4 ��5(?{�m?�Y�]@N��LNB]@N�5T]�CE�+6~?�]�?�A�A�]�9�6=��4�CEA-G+5�9+6Y�4iD�5JN�G�68CM5�7�4I5�5JN�v+AB6I<

^T4 � �L6@C�6�]��+CED ]E4=]�9+6�U{��G�G��yYM9+N�A-G�CE68D{7���\&\8A�6�;$U{��YM9~4���4��+C�G�N�5�Y��p5�5JN�4�DkN-5�]�?��$68D~��C�4�U ?��4�CE]�9�Y04�UyN�D+�{v�4$4i� � Æ�? ��NBDÅ!¢��*��"��_`]�4V?�7+7�6 ? C=c8aia�b � <�Æ�NBC�5J]�Y�4�Dp5JN-G�68C@]�9�6=5JN�]���? ]�N�4�D[v�6���4�CE6�]E9+6�m?�]E9+68C�5.7�6�?���5�< ^ �+7+7�4$5.6=]�9+6�C�6�?�CE6SÈ[YM9+N�A-G�CE68Dk?�A�]�4i��68]E9+68C&;+�L6(D��+U~v�68C\]�9+6�USc�Ø&â�â&â&Ø+È < ^ 4�Uy64���]�9�6�YM9+N�A-G�CE68D{9p?�q$6�U{��G�G�� ��4iC�689�6 ?�G+50_+�Q9+NBA�6@]�9�6#CE6 5J]ÆG�4~D+4�]�<��26�Y8? DFG�6 5�Y�CENBv�6(?=7�4$5�5.NBv+A�65JN�]���? ]�N�4�Dkv��~? DGÈ�f�]��+7+A�6@4��Óe���5�? D�G[c��w5\4���]�9+6���4�C�UÃ?Eî { Ø&â&â&â&Ø¢î®ã D _��Q9+68CE6@î�ä<Ó�c@N���Y¢9+N�A-GHè�9p?�5?@U{�pG+G��@��4�CE689+6 ?iG`_�?�D�G�î�ä<Ó e�4i]�9+6�C��QN-5.6$< ��9���5�_$N��ïÈ�Ó�£�_Û]E9+68D~?(]��+7+A�6Q4��|]�9+6���4iC�U�?�c�ØMe'Ø�c D��4i�+A-G~5�?8�=]E9�?�]L]�9+68CE6@? C�6�68 �?�Y�]EAB��].�L4�YM9+N�A-G�CE68D=�QNB]E9{U~��G+G��@��4iC�689+6�?�G+50_�D�? Uy68AB�I_�YM9+NBA�Gyc�?�D�GYM9+NBA�G�£�< ^ �+7+7�4$5.6y]�9+6X?�Y0]���? A�5.NB]E��?�]ENB4�D�N-5(G�6�5�Y�CENBv�6 G[v��;]�9+N�5�]E�+7+A�6$<=� 9�?�] 5JNB]E��?�]ENB4iD�5(G�4$6 5YM9+NBA�G�cyY�4iD�5JN�G�68C(7�4$5�5.NBv+A�6{v�6���4iC�6y]E9+6=�m?�]�9�68C�5J7�6 ?���5K` ^ NBD�Y�6~YM9+N�A-G�cyY�?�D 5.686=]�9+6~��4�C�6�9+6 ?�G�54��?�A�Ao]E9+6XY¢9+N�A-G�CE68DFv�6 5.N-G�6�5�9�NBUk5.68A��E_�9+N-5@4iD+AB��G�4i�+v+](N-5(? v�4i�+]=�Q9+68]E9+68C@9�6{9�?i5#U~��GF4�D�9+N�54 �QD ��4iC�689�6 ?�G`< ��9���5\YM9+NBA�G{c�Y�4�Dp5JN-G�68CM5�].��4(5.NB]E��?�]ENB4�Dp5Ó7�4I5�5JN�v+AB6I_ÛDp?�Uy68A��$_�?�c�Ø�e'Ø8c D ?%]E9+6�?�Y0]���? A5JN�]���? ]�N�4�D D ? D�GV?he�ØMe'Ø�c D < ^ NBUXNBA-? C�A��$_�Y¢9+N�A-GkdyY�4iD�5JN�G�68C�5].��4V5JNB]E��?�]ENB4iD�5T7�4$5E5JNBv�AB6$lZ?Ec�ØMe�Ø8c D ?�D�G?�c�Ø8c�Ø�c D <q^T4i]�6k]�9�? ]=NBD ��6�D+68CM? Ah_LY¢9�NBA-GÐè��QN�ABAL9�?8q$6y]�9+6;5E?�Uy6kNBD���4�C�UV?�]�N�4�D�N�D ]J�L4[7�4$5�5.NBv+A�6

¤

Page 6: Model Checking vs. Theorem Proving: A - Cornell University

��4iC�A�G+5�68 �?�Y�]EAB�~N���]�9+68�V?���CE686(NBD;?�A�A Y�4�UX7�4iD+68D�]M5\68 +Y0687+]�7�4I5�5JN�v+AB�k]E9+6xè Ñ8Ò Y04�Uy7�4�D�68D�]�<�26�Y8?�DkY�?�7+]E�+C�6@]E9+6@�i68D+68C�?�A�5.NB]E��?�]ENB4�DXv��X?SC@C�N�7+�$6�5J]�CE��Y�]E�+C�6�� Y�4�D�5.N-5.]�NBD���4��Ód ã 5J]�?�]�6�5

?%4iD+6Q��4�C\6 ?�YM9=4��|]�9+6�d ã È�f%]E�+7+AB6�5 D < ^ NBDpY�6�Y¢9�NBA-Gxè�Y04�D�5.N-G�68C�5�?#�L4�CEA-G�7�4$5E5JNBv�AB6�N���N�]\?��iC�686�5ÓN�Dy? ABAY�4iUy7�4�D+68D�]M5�68 �Y�687+] 7�4$5E5JNBv�AB��]E9+6>èðÑ8Ò�Y04�Uy7�4�D�68D�]�_��L6�]�?��$6@?Eñ�Ø1ò D ë á ä 68 +?iY�]�A��@N��eñT? D�Góò ? ��CE686NBD£?�A�A\Y�4�UX7�4iD+68D�]M5Q68 �Y�687+]Q7�4$5E5JN�v+AB�;]�9+6)èmÑlÒ8fmY�4iUy7�4�D+68D�]8<�^T4�]EN-Y�6�]�9�? ]@]�9�N-5�G�6n6�D+N�]�N�4�D[Uk? �$6 5á ä ?�D[6�UÛ�+N�qi?�AB6�D�Y�6�CE68A-? ]�N�4�D�<@��4kY�4iUy7+AB6�]�6(]�9+6~G�6 5�Y�CENB7+]ENB4iDF4��L]E9+6)C@C�NB7��$6�5.]�CE��Y�]���C�6)��_`�L69�?8q$6@]E4~G�6n6�D+6(]E9+6(]�C���]�9;?�5E5JNB�iD+Uy68D�]>à�<���4XG�4=]E9+N-50_+��6@9�?8q$6@]E4yG�6 Y�N-G�6T�Q9�? ]T]E9+6(7+C�N�UyNB]ENBqi67+CE4�7�4$5.NB]�N�4�D�5�?�C�6(N�DF4���CTA�?�D+�i��?��i6$<���6#]�?��$6(]�9�68U ]�4~v�6~n+] { Ø&â&â�â&ØE] ã ØE]`s$_+�Q9�68C�6$_+N�D�]E�+NB]ENBq$68A���_] ä 5.]M? D�G+5o��4�CH4�Y¢9�NBA-G)è�9�?i5Q?#U~��G+G�����4iC�689�6 ?�G�5�_��Q9+N�AB6>]k5.]M? D�G+5o��4�Cx4M? ]QAB6 ?i5J]�4iD+6�Y¢9�NBA-G=9�?i5Q?U~��G+G�����4iC�689+6�?�G�5�<���9���5�_���6�G�6n6pD+6@à[5J4~]�9p?�]@?E��Ø&?Eî { Ø&â�â&ânØ¢î ã�D$Dcì ÓÐ] ä N��Ó?�DpGV4iD+AB�~N��aî ä Ó�ci_?�DpGA?E��Ø&?Eî { Ø&â&â�â&Ø+î�ã D1D)ì Óg]2N��?�D�G�4�D+A��2N���î'ôHÓ c ��4iC=5J4iUy6@õ�< � �Y�4��+C�5J6$_0]2N�5#6�U$�+NBqi? AB68D�]]�4Q] {�ö â&â&â ö ]'ã�_�5J4kNB]�5]EC��+]E9[qi?�AB��6~Y8?�D[v�6~G�68]E68C�UXNBD+6 G{��CE4�U ]E9+6�]EC��+]E9[qi?�AB��6=4��L]�9+6=4i]�9+6�C7+CENBUyN�]�NBq$6�7+CE4�7�4$5.NB]�N�4�D�50<H��9+68CE6=N-5TD�4�]�9�NBD+�y]E4y7+CE68q$68D�]T��5Q��C�4�U Y¢9�4$4$5JN�D+�;?{A-? D+���p?���6~�Q9+68CE6]�9�6@7+C�N�UyNB]ENBq$6L7+C�4i7�4I5JN�]�NB4iD�5�?�C�6�D+4�]QN�D�G�687�68D�G�68D�]�< ^ N�D�Y�6@N�]�N�5�Y�4iD�q$68D�NB68D�]�]�4~?iG+Gk?�7+C�N�UyNB]ENBqi67+CE4�7�4$5.NB]�N�4�D G�6 5EY�C�N�v+NBD+�=]E9+6��m?�]E9+68C��w5�5J]M? ]�68UX68D�]�_+��6 G�4k5J4�<Z��9+N�5@Y�4iUy7+AB6�]�6 5\]�9+6~G�6�5�Y�CENB7+]ENB4�D4�����<

� 9+NBA�6�]E9+N-5ZC@CENB7+�$6 5J]�CE��Y�]E�+C�6=Uk?8�k5.6868U÷UÛ�+N�]�6 Y�4�Uy7�ABN-Y�?�]�6�G`_+NB](?iY�]��p?�ABA��k9�?�5(?�D�68A�68�$? D�]��C�?�7+9�N-Y8? AoCE687+CE6 5J68D�]M? ]�N�4�D�<=��6yY8? D2]E9+NBD��F4���]E9+6Xd ã 5.]M?�]E6 5#N�DÎÞ ?�5@D+4�G�6 5(NBD ?y��CM? 7+9�_�?�D�G7+A�?�Y�6Æ?�D~6 G���6LA-? v�6�AB6 GHè�v�6�]J�L6868D 5J]M? ]�6 5�ñT? D�Góò�N��0è�Y8? D+D+4�]�]�68A�A+? 7�?�CE]�5.]M? ]�6 5bñ�?�DpGSò�?�v�6�Y8?���5.6]�9�68�y? ��CE686(NBD;?�A�A�Y�4iUy7�4�D+68D�]M5\4�]E9+68CQ]�9p?�Dk]�9+6xè�Y04�Uy7�4�D�68D�] D < ^ �+7+7�4$5.6��L6@NB�iD+4�CE6�5.68A���f�AB4$4i7�5?�DpGV]E9+6(A-? v�6�ABNBD��=4�Dk]�9+6(6 G���6 5o��4iCQ]�9+6(Uy4iUy68D�]8<���9+6�D �L6@9�?8q$6(?~5J]EC���Y�]E�+C�6��QNB]�9;d ã D+4�G�6 50_6 ?iY¢9�G�6�5�Y�CENBv�6 G v��[? D�È�f�]��+7�AB6=4��e���5@?�D�G�ci�w50_�5.��YM9[]�9�? ]@].��4yD+4�G�6 5(?�C�6ZÔ.4iNBD+6�GFv��£?�D[6 G��i668 �?�Y�]EAB�(N��|]�9+6��=G�N��`6�C�NBD=4iD+6@Y04�Uy7�4�D�68D�]�<b��9+6QCE6 ?�G�68C\�QNB]�9~?@�i4$4�GVN�Uk?��iNBD�? ]�N�4�D=�QNBA�A+5.686�]�9�? ]]�9�N-5QG�6n6pD+6 5Q?�D�È�fmG�NBUX68D�5JN�4�D�? A�Y���v�6I< ��9+6�Y8?�5.6HÈ×Ó�£=N-5�N�ABA���5J]ECM?�]E6 G{N�D�Æ NB����C�6~c�<

OhD�]E�+NB]ENBq$68A��$_�6�?�YM9yYM9+NBA�G���D�4���5��Q9�N-YM9{4 � ]�9+6�4�]E9+68CQYM9+N�A-G�CE68D{9p?�q$6�U~��G+G��(��4�C�6�9+6 ?�G�5�< ��9+N�5NBD�]���NB]�N�4�D;N-5@v�4�C�D�6{4i�+](NBD[4���C���4iC�Uk? A�G�6n6�D+N�]�NB4iD[4��Æ��D+4 �QA�6 G���6I<HÆ+4�C@68 �?�UX7+AB6$_�NB]�N-5T6 ?i5J�[]E45J6�6{]E9�?�](�Q9+68D ]�9+6X?�Y�]E��?�AL5.NB]��p?�]�N�4�D�N�5H?�c�Ø�e'Ø8c D _��L6{9p?�q$6�?��çØ&?Ec�ØMe�Ø8c D$D�ì Óøí {nù ]iú8_�5.NBD�Y�6=N�Dv�4�]E9 �L4�CEA-G+5�]E9�?�]ÆY¢9+N�A-Gkc(Y�4�Dp5JN-G�68CM5\7�4I5�5.NBv+A�6@N�� ]E9+6(?�Y0]���? A�5JN�]���? ]�N�4�DkN-5�?�c�Ø�e'Ø8c D _�YM9+NBA�G{d�G�4$6 5D+4i]�9�?8q$6�?�U{��G�G��#��4iC�689+6�?�G`< ^ N�UyNBA�?�CEAB�$_ ��6�9�?8q$6S?��çØ&?Ec�ØMe�Ø8c D$DZì Ó�í { ]'û l\YM9+NBA�GycT��D+4 ��5�]�9�? ]YM9+NBA�G¾£��w5`��4�CE689+6 ?iG#N-5`U~��G+G��$<�>T4 ��6�q$68C8_�?��çØ&?Ec�ØMe�Ø8c D$DZì Ó ù í { ] { <oZ\9+N�A-G=cQG�4$6 5�D+4i]���D�4�� ]�9�? ]9+N�5T4 �QDF��4�C�6�9+6 ?�GFN�5TU~��G+G��$_�5.NBD�Y06�NBD[]E9+6=4�]E9+68C@�L4�CEA-GF9+6 Y�4�D�5.N-G�6�CM5T7�4$5E5JN�v+AB6nüg?he�_we�_�c D ü 9+N�5��4�CE689+6 ?iGyN-5QD+4�]QU~��G+G��I<

W6�]��+CED+NBD+��]�4�4���C�? D�?�A��+5.N-5�4���]E9+6\7+��\&\8A�6$_ Y�4iD�5JN�G�68C �Q9�?�] 9�?�7�7�6�D�5�?���]E68C ]�9+6��m?�]E9+68C�5J7�6 ? �+50<��9+6{�m? ]�9+6�C~5�?8�+5�]`_\? �m?iY�]�]E9�?�]=N�5�?�A�C�6 ?iG�����D+4 �QD ]�4£?�A�A�]�9�6kY¢9�NBA-G�C�68D�N��Æ]�9+68CE6k?�CE6y].��4[4iCUy4iC�6[YM9+N�A-G�CE68D �QNB]E9 U{��G�G�����4�C�6�9+6 ?�G�5�<ø^T68q$68CE]�9+6�AB6 5E5�_�]E9+6�5.]M? ]�6�4��=��D+4 �QAB6�G���6�YM9�?�D���6 50_68q$68D[N��Æ?�ABA�]�9+6XY¢9�NBA-G�C�68D£?�ABCE6 ?�G��[��D+4 ��]`<�r�4�NBD�� vp?�YM�[]�4k4��+C(68 �?�UX7+AB6��QNB]�9�ÈAÓý£�_�N��L]E9+6NBD�NB]�N�?�AÆ5JNB]E��?�]ENB4iD �Q?i5×?Ec�ØMe�Ø8c D _�?�AB]E9+4�����9 6�q$68C��$4iD+6y��D+68� v�6���4iC�6F]E9+6y�m?�]E9+68CX5J7�4��$6;]�9�? ]y? ]AB6�?�5J]�4�D+6~YM9+NBA�Gy9�?�G�?{U~��G+G��y��4�CE689+6 ?iG`_�YM9+NBA�G[c{Y04�D�5.N-G�68CE6 G ]E9+6~5JN�]���? ]�N�4�Dk?he�ØMe'Ø�c D 7�4$5�5.NBv+A�6v�6���4�CE6@]�9�6�m? ]�9+68CL5.7�4i�$6$<\OhD{]E9�?�]Æ5JN�]���? ]�NB4iD�_+YM9+N�A-GH£#�L4��+A�GyY�4iD�5JN�G�68C�?he�ØMe'ØMe D 7�4$5E5JN�v+AB6$< ��9���50_v�6���4�CE62]E9+6F�m?�]E9+68C;5J7�4i�$6$_@YM9+NBA�G c[]�9+4i�+��9�]kNB]y�Æ?�5y7�4$5�5.NBv+A�62]E9�?�];YM9+NBA�GÅ£�]�9+4i�+��9�]kNB]k�Q?i57�4$5E5JNBv�AB6=]�9p?�]@D+4iD+6=4��L]E9+6~Y¢9�NBA-G�C�68Dk9�?iG2?{U~��G+G��{��4�CE689+6 ?iG`<(R��]�6�CT]E9+6��m?�]E9+68C�5J7�6 ?���5�_�N�]TN�5I+��FHFH���ó���i�����"!$#&%'!(]E9�?�]L?�]\A�6 ?�5.]o4iD+6(YM9+NBA�G#9�?i5�?@U~��G+G��(��4�C�6�9+6 ?�G�<b��9+6�D+4�]ENB4iDy4���Y�4�UyUX4�D

b

Page 7: Model Checking vs. Theorem Proving: A - Cornell University

þþþþ

þþþ ÿ ÿ

ÿ ÿÿ ÿ

ÿ

þþþþ

þþþ

ÿ ÿÿ ÿ

ÿ ÿÿÿ ÿ

ÿ ÿÿ ÿ

ÿ

þ þ þ þ þ þ þ

þ þ þ þ þ þ þ

ÿ ÿÿ ÿ

ÿ ÿÿ

��

��

?he�ØMe'ØMe D

?�c�ØMe'ØMe D?he'Ø�e'Ø8c D

?�c�Ø�c�ØMe D?�c�ØMe'Ø8c D

?he�Ø8c�Ø�e D

?he�Ø8c�Ø�c D

?�c�Ø8c�Ø8c D

c

c

d

d

£

£

£ £

d c

d c

Æ�NB�i�+C�6~cil���9+6xC@C�N�7+�$6(5.]�C��pY�]��+CE6@��4�CQ]�9�6#U~��G+G��yYM9+NBA�G�C�6�D{7+�i\&\8AB6��QNB]�9�È�ÓÅ£

��D+4 �QAB6 G��i6$_��Q9�?�]=6�q$68C��$4iD+6���D+4 ��5#]E9�?�]�68q$68C��$4iD+6=��D+4 ��5#]�9p?�]�6�q$68C��$4iD+6=��D�4���5)â&â&â0_�4iC8_�N�DH[Y�ZL? C�]�9����w5o]E68C�UXNBD+4iAB4��i�G�ëH[Y�ZL?�CE]�9��!+��*��"��_`c�aup�a-�._+�Q9�? ]H4M?�D��{��4$4iAN5���D+4 ��5�_+7+A�?���5�?=Y0C���Y�N�?�AC�4iAB6@9�68C�6$_�?i5���6�5J9�? ABA�5.686$<���6@Y�?�DkC�687�C�6 5.68D�]\]E9+6@YM9�? D+��6(NBD~]�9�6@��CE4��+7���5Q5J]�?�]�6�4�����D+4 �QA�6 G���6��C�?�7+9�N-Y8? ABAB�)?�NBD=]�9�6Q��68D+6�CM?�A�Y8?i5J6 D v��=5.NBUy7�AB�@CE68Uy4 q�N�D+�Q]�9�6Q7�4iNBD�]>?he�ØMe'Ø�â&â&â&ØMe D ��C�4iU�]E9+6�Y��+v�6$_��6�]�]�N�D+�(?�4E]�CE�+D�Y8? ]�6 G�5(Y���v�6I<�?hHF4iC�6�?iY8Y��+C�?�]�6�AB�$_ �Q9�?�]�9�?�7+7�68Dp5ÓN�5�]�9p?�]\]�9+6LD+4�G�6x?he�ØMe'Ø&â�â&â&ØMe DC�6�Uk?�N�D�5�_�v+�+]�?�A�A�]�9+6(6 G���6 5Qv�68].��6868D�?he'Ø�e'Ø&â&â�â&ØMe D ?�DpG D+4�G�6�5�QN�]�9k68 �?�Y�]EAB�~4�D+6Xc�G�N�5�? 7+7�6 ?�C�_5JN�D�Y�6QN�]oN�5\Y�4�UyUX4�D���D+4 �QAB6�G���6�]�9�? ]�68q$6�D=N���4�D+A��=4�D+6�Y¢9+N�A-G�9�?i5�?@U~��G+G��(��4�C�6�9+6 ?�G�_�?8��]�68C\]E9+6�m?�]E9+68CÆ5J7�6 ?���5Q]�9�? ]QYM9+NBA�G �QN�ABA`D�4�]�Y�4iD�5JN�G�68C�N�]�7�4$5E5JN�v+AB6@]E9�?�]QD�4=4�D+6(9�?i5Q?�U{��G�G��#��4iC�689+6�?�G`< D��9+6�5JN�]���? ]�N�4�DFN�5�NBA�AB��5.]�CM? ]�6 G~NBDGÆ�NB�i�+C�6�d�<

�26\D+6� �]�5J9+4 ��]E9�?�] 6 ?iY¢9(]�N�Uy6 ]�9+6LYM9+NBA�G�C�68D�C�6 5.7�4iD�G�]�4�]�9�6Ó�m? ]�9+6�C8�w5�U$�+6 5.]�N�4�D��QN�]�9�?H4�D+4�5�_]�9�6T�iC�4���7��w5\5J]�?�]E6@4��|��D+4 �QA�6 G���6�YM9�? D+��6 5\? D�G{]�9�6@Y���v�6QN�5����+C�]E9+68C\]�CE�+D�Y8? ]�6 G`<\Z\4�D�5.N-G�6�Co�Q9p?�]9�? 7+7�68D�5\?���]E68C\]�9+6�YM9+NBA�G�C�6�D�C�6�5J7�4�D�G�4�D�4�5#]E4@]�9�6�m? ]�9+68C��w5h6pCM5J]aUÛ�+6�5J]�N�4�D�< �26�Y�A�?�NBU�]E9�?�]\D+4 �?�A�A�]�9�6=D+4�G�6 5@�QNB]E9[68 �?�Y�]EAB�k4�D+6kc~Y8? D[v�6{68A�NBUyN�D�?�]E6 G`<@? � C�_`Uy4�CE6=?iY8Y��+C�?�]�6�AB�$_�]�9+6=6�G���6 5@]E4]�9�6 5J6=D+4�G�6 5T��C�4�U D+4�G�6 5@�QN�]�9[68 �?�Y�]EAB�y].�L4[c���5#? ABA�G�N-5E?�7+7�6 ? C@��C�4�U ]�9+6=�iCM? 7+9�<H^T4�G�6 5T�QNB]E94�D�6#4iC���68��6�C@c���5�? C�6(D+4=AB4iD+��6�CQC�6 ?iY¢9�? v+AB6���C�4�U D+4�G�6�5�QN�]�9y].��4=4iCQUy4�CE6�ci�w50<\Om��]�9�68C�6(? C�6@N�D�m?�Y0]#].�L4 4iC(Uy4�CE6~Y¢9+N�A-G�CE68DF�QN�]�9�U{�pG+G��y��4�CE689+6 ?iG+5�_ ]�9+68D�NB]�N-5(Y�4�UXUy4�D;��D+4 �QA�6 G���6~? Uy4�D��?�A�A\]�9+6kYM9+N�A-G�CE68D[]�9�? ]=]�9+6�C�6X?�C�6V?�]�A�6 ?�5.]�].��4£Y¢9�NBA-G�C�68D[�Q9+4[9p?�q$6~U~��G+G��k��4�C�6�9+6 ?�G�5�< D ��9+6C�6�?�5J4iD+NBD��F7�? CM?�A�AB68A�5@]�9�? ]=G�4iD+6{N�D2]E9+6�4�7+CE4$4��¢5��iNBq$68D�NBD�]�9�6y5.]�4�CE�$<yO%�Æ]�9+6X?�Y�]E��?�AÆ5JN�]���? ]�NB4iD��6�C�6�G�6 5EY�C�N�v�6 G�v��I_$5�?8�$_$]�9�6Q]��+7+A�6@?�c�ØMe'Ø&â�â&â&ØMe D _$]�9+6�DyYM9+NBA�G{cQ��4i�+A-G=NBD�NB]�N�?�A�AB�(9�?8q$6�Y�4�Dp5JN-G�68C�6 G].��4�5.NB]��p?�]�N�4�D�5~7�4I5�5.NBv+A�6$l?Ec�ØMe�Ø&â&â&â�ØMe D ? D�G�?he�ØMe'Ø&â�â&â&ØMe D < ^ NBD�Y06 4iD�Y�6k]�9�6 �m?�]E9+68C~5.7�6�?���5 N�]N-5~Y�4iUyUy4�D ��D+4 �QA�6 G���6;]�9�? ]�?me'ØMe�Ø&â&â&â�ØMe D N�5 D�4�]y7�4$5E5JN�v+AB6$_L9+6F�L4��+A�G ]�9�68D ��D+4 � ]�9�? ]{]E9+6

g

Page 8: Model Checking vs. Theorem Proving: A - Cornell University

ÿ ÿÿ ÿ

ÿ ÿÿ

þþþþ

þþþ

ÿ ÿÿ ÿ

ÿ ÿÿÿ ÿ

ÿ ÿÿ ÿ

ÿ

þ þ þ þ þ þ þ

þ þ þ þ þ þ þ

��

��

?�c�ØMe'ØMe D?he'Ø�e'Ø8c D

?�c�Ø�c�ØMe D?�c�ØMe'Ø8c D

?he�Ø8c�Ø�e D

?he�Ø8c�Ø�c D

?�c�Ø8c�Ø8c D

c d

£

£ £

d c

d c

�NB�i�+C�6�d�lY��9+6xC@C�N�7+�$6(5J]EC���Y0]��+CE6�?8��]�68CQ]E9+6@�m?�]E9+68C�5J7�6 ? �+5

5JN�]���? ]�N�4�D N-5~G�6 5EY�C�N�v�6 G v���?�c�Ø�e'Ø&â&â�â&ØMe D _�?�D�G ]E9���5=��4i�+A-G ��D+4 � ]E9�?�]y9�N-5{4 �QD ��4�CE689+6 ?iG N�5U~��G+G��$< � DpY�6�68q$68CE�$4�D+6�?�Dp5J��6�CM5>4�D+4�5]E4Q]�9+6��m?�]E9+68C��w5e6�C�5J]fU$�+6 5J]ENB4iD�_8NB]�N�5�Y�4�UyUX4�D���D+4 �QA�6 G���6]�9p?�]@]E9+6~5JN�]���? ]�NB4iD�Y�?�D+D+4i]@v�6�?Ec�ØMe�Ø&â&â&â�ØMe D <H?E^T4i]�6=]�9p?�](9+68CE6���6=U~��5.]Q��5J6=]E9+6~?�5E5J�+Uy7�]�NB4iD]�9p?�]QNB]LN-5LY�4�UyUX4�D=��D+4 �QAB6 G��i6@]�9p?�]Q68q$68CE�$4�D+6QN�5oN�D�]E68ABA�NB��6�D�]\? D�Gy]�CE�+]�9�����Ah_+? D�Gk5J4~Y8? DkG�4=]E9+6C�6�?�5J4iD+NBD��FC�6�UÛ�+N�C�6 Gk]�4;5J9�4���?�c�ØMe'Ø&â�â&â&ØMe D N�5@D+4�](7�4$5E5JNBv�AB6$< D ^ NBUyN�A-?�CQCE6 ?�5.4�D+N�D+�[? ABA�4���5@��5@]E468A�NBUyN�D�?�]E6T68q$6�C��X5JNB]E��?�]ENB4iDF�QNB]E9F68 �?�Y0]�AB�~4�D�6yc�<���9���50_`?8��]�68C�? ABA�]E9+6=YM9+NBA�G�C�6�Dy9�?8q$6�?�D�5.��68CE6 G4�D�4�5[]�4[]�9�6{�m?�]E9+68C8��5�6�C�5J])U$�+6 5.]�NB4iD�_�NB]�N-5=Y�4iUyUy4iD[��D+4 �QA�6 G���6X]�9�? ]~?�]=AB6�?�5J]����b��Y¢9+N�A-G�CE68D9�?8q$6@U~��G+G��=��4�CE689+6 ?iG+5�<

Æ+�+C�]E9+68CQ? C��i�+Uy68D�]M5\NBDy]E9+6�5�?�[email protected]+NBCENB]�Y8? Dyv�6#�p5J6 Gy]�4~5.9+4 � ]E9�?�]�?8��]�68CQ]E9+6(YM9+NBA�G�C�6�Dy? D+f5J�L68CZ4ED+4�5HÉ(]�NBUX6 5�_ ��6ÆY8?�D~68ABN�UyNBDp?�]�6Ó?�ABA�]�9+6QD+4�G�6 5��QNB]�9X?�]�Uy4$5.]�É~c���5 ?�4�C�_�Uy4�CE6Q?iY8Y��+C�?�]�6�AB�$_G�N�5�Y�4iD+D+6 Y�]�]�9�6 5J6�D+4�G�6 5��CE4�U ]�9�6�C�6�5J]@4 �\]�9+6���C�?�7+9 D <@�26�]�9���5Q9�?8q$6=?y5.6�UÛ��68D�Y�6(4���C�CENB7+�$65J]EC���Y0]��+CE6 5�_�G�6�5�Y�CENBv+N�D+�=]�9+6 Y¢9�NBA-G�C�68D���5���D+4 �QA�6 G���6�? ]T68q$6�C��X5J]�6�7FNBDk]E9+6�7+CE4�Y�6 5E5�<>=\5�5.68D�]�N-? ABA��$_�Q9�? ]@N-5Q��4iNBD+�k4�D[N�5]E9�?�]�N��E_�NBD[5.4�Uy6(D+4�G�6�ñ$_�NB]�v�6�Y�4�Uy6�5QY�4�UyUX4�Dk��D�4��QA�6 G��i6�]�9p?�]�?{D+4�G�6ò@N�5�N�Uy7�4$5E5JNBv�AB6$_�]�9+6�D�? ABA\6 G��i6 5T��C�4�US6�q$68C��kD+4�G�6Té2C�6 ?iY¢9p?�v+A�6���C�4�UÇñ~]�4�ò(?�CE6{6�ABNBUXNBD�? ]�6 G`<?E��9�N-5�5JNB]E��?�]ENB4iD N�56�q$68Dy6 ?i5JNB6�CQ]�4XG�6 5�Y0C�NBv�6@4iD�Y�6���6�?�G+Gk]�N�Uy6T]E4{]E9+6(7+N-Y0]��+CE6$<��26(CE68]��+CEDF]E4]�9�N-5�7�4�N�D�]QN�D ]E9+6(D+68 �]�5J6 Y0]�NB4iD�< D

R��]�6�CSÉFCE4��+DpG+5#4 ��U$�+6 5J]ENB4iD+NBD+��_�NB]@N�5#Y04�UyUy4iDk��D+4 �QA�6 G���6~]�9p?�]�?�](AB6�?�5J]HÉ�� cXY¢9+N�A-G�CE68D9�?8q$6�U~��Gk4�D�]�9+68N�C��4iC�689�6 ?�G+50<=O%�L]�9+6=]EC��+6~5.NB]��p?�]�N�4�D[N�5@G�6 5EY�C�N�v�6�GFv��£?V]E�+7+A�6��QNB]E9[68 �?�Y�]EAB�É��Xc@ci�w5�_i]�9+68D�v�6���4�CE6�]�9�6o�m?�]E9+68C�?�5.�+5�]E9+6>U$�+6 5.]�N�4�D#��4iC�]E9+6Z?�É��Xc D�� Ñ`]ENBUy6I_�]�9�4$5J6�YM9+N�A-G�CE68D@�QNB]E9U~��G+G��y��4�CE689+6 ?iG+5@�QNBA�A���D+4 ��]E9+6=68 �?�Y�](5.NB]E��?�]ENB4�D|_�? D�G[NBD[7�? C�]�N�Y��+A�?�C@��D+4 ��]E9+68NBC���4�C�6�9+6 ?�G�5?�CE6{U~��G+G��$_`? D�G�Y�4iD�5J6�UÛ�+6�D�]EAB�;?�D�5.��68C�4E�$6 515�<�^�4�]�6=]E9�?�]�]�9+6��[Y�4i�+A-G�D|�r](? D�5J�L68C�4��$6 5$5 ? D��6 ? C�ABN�68C8_I5JNBDpY�6T��7{]E4�]�9�N-5�7�4�NBD�]\6 ?�YM9XY¢9+N�A-G��QN�]�9X?#U~��G+G��(��4�C�6�9+6 ?�G~Y�4iD�5JN�G�68CM5�N�]o7�4I5�5JN�v+AB6�]�9�? ]9+6�G�N�GVD�4�]�9�?8q$6(? U~��G+G�����4�C�6�9+6 ?�G�<

�26�Y�4iD�]E68D�Gy]�9p?�]�]�9+N�5�Uy4�G�68A�f%v�?i5J6 GX?�C��i�+Uy68D�]��iNBq$6 5Q?�U~��YM9yY0AB6 ? C�68CLNBD�G�N�Y8?�]ENB4iD 4 ���Q9p?�]N-5���4�N�D+�F4iD2�QN�]�9[]E9+N-5@7+��\�\8AB6�]�9�? D�? D��[4 �Q]�9�6=7+C�68q�NB4i��5��4iC�Uk? ABN"\�?�]�N�4�D�5�]�9�? ]�? ]�]E68Uy7+]E6 G ]E4

p

Page 9: Model Checking vs. Theorem Proving: A - Cornell University

G�6 5EY�C�N�v�6{]E9+6y]�9�684�CE68Uyf�7+C�4 q�NBD+�;?�v�NBABN�]�N�6 5T4���]�9�6k?��i68D�]�5#�QN�]�9+N�D ?V��4iC�Uk? AoA�4��iN-Y�<G��9+6yCE6 ?�G�6�C5J9�4��+A�G{D+4�]E6T]E9�?�]L4��+CLC�6 ?i5J4iD+NBD+� ?�v�4���]Q]�9+6�7+��\&\�AB6�?�7+7+A�NB6 5�]E4�? D��~D��+U{v�68C�È 4 ��Y¢9�NBA-G�C�68D ?�D�G?�D��yD��+U~v�6�C É��ÅÈF4 �LG�NBCE].�~Y¢9+N�A-G�CE68D�<�O¯DVY�4�D�]�C�?�5J]�_+]�9+6(]E9+684�CE68Uyf�7+C�4 q�NBD+��? 7+7+C�4I?�YM9+6 5Q]�4=]E9+67+��\�\8AB6���5J��? ABA��FG�6 ?�A��QN�]�9�5.4�Uy6@6� �6�G É;?�DpGÈA?�].��7+N�Y8?�A�AB��ÈVÓ ÉGÓB£ D <S��9+6~? v+NBA�NB].�y]E4kG�6 ? A�QNB]E9y?(7�?�C�?�Uy6�]�C�N�\86 G#�m? UyNBA��#4 � Uy4�G�68A�5�_��Q9�N-YM9{N�5ÓN�Uy7�4�CE]M?�D�]\NBD~Uk?�D���N�D�5J]�?�D�Y06 5�4���Y�4iUyUy4�D�f5J6�D�5J6~C�6 ?i5J4iD+NBD+�Ð?hY¢�E<���C#? ����Uk? D+D�_\c8aia�cn� D _�N�5#? D2N�Uy7�4�CE]M?�D�]@��6 ?�]E�+C�6=4 ��]�9+6~Uy4�G�6�ABfmY¢9+6�Y¢��NBD+�?�7�7+C�4I?�YM9�;`5.686 � Z\A-?�CE�$6�!+��*��"��_�c�a��ig�v�; ^ N-5.]�A�?=?�D�G�rT6�C�Uk? D�_`c�a��up � <

±�²E± � µ���½� ��<µ�¶�����@À����@Àï½���L¶� �¶����Á��<½������cº@¶�¿����9+6(Y04�D�5.]�C��pY�]�N�4�Dy4 � ]�9+6�5J68UV?�D�]�N-Y�UX4�G�68A+��4�CL]�9+6�U{�pG+G��~YM9+NBA�G�C�68D=7���\&\8A�6Q�Q?�5Q5.4�Uy6��Q9�?�]�*�#Ji��I�<�Z\AB6�?�C�A��$_�N��L��6 ?�C�6=]E4;?�7+7+A��F]E9+6�Uy4�G�68ABf�]�9+6�4�C�6�]�N-Y(? 7+7+C�4I?�YM92N�D[��68D�68CM? Ah_`�L6�D+686�GF]�6 YM9+fD+N UÛ�+6�5Æ��4iC@G�6�5�Y�CENBv+N�D+�y? D�G[Y�4iD�5J]EC���Y�]ENBD+�~]�9�6=5J6�Uk?�D�]�N�Y�UX4�G�68Ah_�? D�G ]E6 YM9+D+NNU$�+6 5o��4iC(YM9+6 YM��N�D+�N��|?T��4�CEU{��A-?QN-5�]EC��+6QN�D{]E9�?�]\Uy4�G�6�Ah<��26�Y04�D�5.N-G�68C�]�9+6�6�C�5J]\N-5E5J�+6QN�D{]E9+N-5�5J�+v�5.6 Y�]ENB4�D|_�? D�G=AB6 ?8q$6]�9�6�5.6 Y�4iD�Gy]�4~]�9+6(D+68 �]�5J��v�5J6 Y0]�NB4iD�<

H[?�D��yR�O�?�7+7�ABN-Y�?�]�N�4�D�5LG�6 ? A`�QNB]E9k?��i68D�]M5oN�D�]E68CM?iY�]�N�D+��?�Uy4iD+��]E9+68Uk5.68ABq$6�5�? D�G� 84iCT�QN�]�9k? D68 �]�68CED�?�A 68D�q�N�C�4iD+Uy68D�]8< ú OhD�5.��Y¢9£?k5J68]E]�NBD��+_`�L6�v�68ABN�68q$6(]�9�? ]@]�9�6=7�4I5�5.NBv+A�68f%�L4�CEA-G+5T7p?�CM?iG�NB�iU��NB68A�G+5`]�9+6L? 7+7+C�4i7+C�N�?�]E6�5J68Uk? D�]EN-Y�Uy4�G�68Am<f��9���50_��L6��L4��+A�G#ABN��$6�]E4@Uy4�G�6�A$?�5J��5J]�6�U 4 ��NBD�]�6�CM?�Y0]�fNBD��(?��i68D�]�5\?�5\?@C�CENB7+�$6Æ5J]EC���Y�]E�+C�6I<b��4�G�4�5.4+_$��6Q�p5J6Q]�9�6���4�C�UV?�A+Uy4�G�68A�4 � � Æ�?��iNBD�!+�b*�����_�c�a�aid';>@? AB7�68C�D ? D�GAÆ�?��iNBD�_�c8a���a��H?%�Q9+N�Y¢9 N�D ]E�+C�D N�5�v�?�5.6 G 4iD 6 ? C�ABN�68C�UX4�G�68A-5(]�9�? ]y? 7+7�6 ?�CE6 G N�D�r>�?�AB7�68CED ?�D�G HF4$5.6 5�_�c8aia�e';�_�?�CENB��9 ?�D�G W�?�Uk? D���ÔE? U[_@c�a���b�;#Z\9�? D�G�� ? D�G HFN�5JC�?�_�c�a��ig';WQ4$5J6�D�5�YM9+68N�DF? D�G�C(?�68A�v+ABN�D+�+_�c8a���g-� D <L�26(v+CENB6"!��VG�6 5�Y0C�NBv�6(]�9�6#��4�CEUk?�A�UX4�G�68A`9�68C�6$_�5.NBD�Y06#�L65J9p?�ABAQUV?��$6y��5.6k4��(N�]�A-? ]�68C�_oCE6���68CEC�NBD��[]�9+6kC�6�?�G�68C=]E4q�r>@? AB7�68CED ? D�GAÆ�? ��NBD|_Tc�a���a��T��4�C=UX4�C�6G�68]�?�N�A-5�<

�26 ?�5E5J�+Uy6�]�9�? ](?�]�6 ?�YM9F7�4�N�D�]�NBDF]ENBUy6I_�6 ?iY¢9£?���6�D�]@N�5N�D[5.4�Uy6)�l��I+*���,3�E*���!M<(OhD���4�CEUk?�A�AB�$_]�9�N-5@AB4�Y8? AQ5.]M?�]E6y68D�Y04�G�6 5#]E9+6~NBD���4iC�Uk? ]�NB4iD2N�](9�?�5(4�v�5.68C�q$6 G[]�9���5@�m?�C8<;OhD�?iG+G�N�]�NB4iD�_�]E9+68CE6{N�5?�A�5J4£?�D�!3�i2&MN/1����F�!K�'��5.]M? ]�6$_ �Q9+N-YM92�$6�687�5@]�C�?�YM�[4��Q6�q$68C���]�9+N�D+�yCE68AB68qi? D�](]�4k]E9+6k5J��5J]E68USD+4i]C�6�Y�4�C�G�6 GFNBD[]E9+6X?���6�D�]�5���5.]M?�]E6 5�<~R %��d��(+*��a,3��*���!=N-5@?k5J6�UÛ�+6�D�Y�6�?Eñ$#+Ø+ñ { Ø&â&â�ânØ+ñ ã�D Y�4�Dp5JN-5.]�N�D+�k4��]�9�6=68D�q�NBCE4�D+UX68D�]Æ5J]�?�]�6)ñ$#@? D�G[]�9+6=A�4�Y8?�A\5.]M? ]�6)ñ ä 4��L6 ?iY¢9�? ��68D�]@è�<�R /3Ü���4��Æ]�9+6~5.�+5.]�68U N�5?{���+D�Y�]ENB4iDF��C�4�U ]�N�Uy6)?%�Q9+N�Y¢9�_���4�C@6 ?i5J6~4��L68 �7�4$5JN�]�N�4�D�_���6 ?�5E5J�+Uy6=C�?�D+�i6 5@4 q$68CT]E9+6~D�?�]E�+CM? AD��+U{v�68C�5�_$? AB]E9+4��+�i9y��6�Y�4i�+A-G{6�?�5JN�AB��]M?��$6�NB]\]E4�CM? D+��6�4�q$6�Co]E9+6�C�6 ? A-5 D ]E4���A�4�v�? A�5.]M?�]E6 5�< ��9���50_N��&%@N�5�?�C���D�_�]E9+68D'%�?he D Ø(%�?Ec D Ø�â&â&â+N-5L?=5J6�U$�+68DpY�6T4 ���iAB4iv�?�A|5J]M? ]�6 5�]E9�?�]�_�CE4��+�i9+AB�k5.7�6 ?���NBD+��_+N-5L?Y�4iUy7+AB6�]�6�G�6 5EY�C�N�7+]�N�4�Dy4 � �Q9�?�]�9�? 7+7�68D�5�4 q$68C\]�N�Uy6TN�Dy4�D�6@7�4$5�5.NBv+A�6(68 �6�Y��+]�N�4�D~4���]�9+6�5J��5J]�6�U[<��6F]M? �$6;?25.�+5.]�68U ]�4 Y�4iD�5JN�5J]~4���?�5.68]=4���CE�+D�5�< O¯D�]���NB]�N�q$68AB�I_�]�9�6 5J6kC���D�5yG�6 5EY�C�N�v�6F? ABAQ]E9+67�4$5E5JNBv�AB6�5J6�U$�+68DpY�6 5�4���68q$68D�]M5\]�9�? ]@Y04��+A�GV4�Y�Y��+CQNBD;?~5J��5J]E68U[<

r�NBq$68D ?[5J��5J]E68U*)[_���6~C�60��68C�]E4[?F7�? NBC�?�%-Ø,+ D Y�4iD�5JN�5J]ENBD+�;4���?FC���D�% ë ) ? D�G ? ]�N�Uy6+ ?i5�?×.i��MN�'��<���9+6y7�4iNBD�]M5�Y�?�D�v�6Xq�N�68��6 G[?i5���4iC�A-G�5�N�D�?GC@C�NB7��$6~5J]�CE��Y�]E�+C�6$<y��6k5E?��[].�L47�4�N�D�]�5S?-%�Ø(+ D ? D�GV?-%/.NØ,+0. D 5.��Y¢9;]�9�? ]�%�?-+ D Óø?Eñ$#+Ø+ñ { Ø&â&â�ânØ+ñ/1 D ? D�G2%/.N?-+3. D Óø?Eñ/.# Ø+ñ/. { Ø&â&â&â3Ø+ñ/.1 D4 ¥�¦ °�± ´0«%§w´0±@´MÜ�5h©Mù�°.±8«76�¨%¦ ´ � ®­×98i°�«m©¢õ0°.±(ªh©M«%¦ °.ª\®w´8´0¨%°.®w²�¦ °.ª%°0Ø\à�±�©Mù�°.±8«\¬.©M±�8�°Q©Qª�´"8i´�«�´�8 ¨%°.ª�ê8§w± ù�©¢±

°.±8ê8§wª�´0±�³�°.±8«Eß8©�õ8± ´Mø�®w°E×8ù�°:8i©¢¨�°�Ö�´�ª�õ8± ´Mø�®w°E×�ù0°;8i©¢¨�°.¨hÞ�8i°.§w± ù�«�´�®�×Q§w±8Ü�´�ª�³�©¢«�§w´0±�ßE´�ª�©oµ ª�´ ¬h°.¨%¨�´�ª §w±�©\µ�©Mªm©¢®w®�°J®³�©�¬%¦ §w± °0Ø+ö+ê0°.ª%²8«�¦ §w± ùQø`°�¨m©�²�©¢µ µ ®w§w°.¨`§�±(©¢®�®�´MÜ�«%¦ °.¨�°�¬h´0±8«�°¯é�«%¨EØ

Page 10: Model Checking vs. Theorem Proving: A - Cornell University

?�CE6}MN��#�M8,3�EMN��%�Ü'M8,+Ji*�(3�"!(]�4~?��i68D�]�è�_+? D�G �QCENB]�6Q?-%�Ø(+ D�<Zä ?�% . Ø(+ . D _+N-5Yñ ä Ó�ñ .ä _�Nh<u6$<B_$N���?���6�D�]�è�9p?�5]�9�6�5�?�UX6QAB4�Y8? A�5J]�?�]�6�?�]\v�4�]E9y7�4�N�D�]�5�<���6�]M?��$6 <�ä ]�4(7+A�?8��]�9�6QC�4�A�6T4 ��]E9+6Q7�4$5�5.NBv+N�ABN�]J�(CE68A-? ]�NB4iDá ä ;+D+4i]�6(]�9p?�]�á ä N�5Q?�D;6�UÛ��NBqi?�A�68D�Y�6�C�68A�?�]ENB4�Dk�+DpG�68CQ]�9�N-5QNBD�]�68CE7+C�68]�?�]ENB4�D|<

RTD�MN�'��!3/E.0/K!+��!$#S,�å�,3��!3F N�5�?#7p?�NBC�?=)�Ø¢à D Y�4iD�5JN�5J]�N�D+��4 �\?�5J��5J]E68U>) ]�4��i68]�9�68C��QN�]�9k?�Uk? 7+f7+N�D+��à[]�9p?�]�?�5�5.4�Y�N-? ]�6 5�? ]EC��+]E9[?�5E5JN���D+Uy6�D�]Q�QN�]�9F6�?�YM9 7�4iNBD�]8<>��9+6 5J68UV?�D�]�N-Y�5Ó4 �L��D+4 �QA�6 G���6��4�CEU{��A-?�5QNBD[N�D�]E68C�7�C�68]E6 GF5.�+5.]�68Uk5QN-5@N�G�68D�]�N-Y�?�A�]�4k]E9�?�](NBD�C@CENB7+�$6 5J]�CE��Y�]E�+C�6 50<=OhD[7�?�CE]�N�Y��+A-? C8_��N�q$68D ?F7�4�N�D�]}?-%�Ø(+ D N�D ?�D NBD�]�6�C�7+CE68]�6 G�5J��5J]E68U@? Ó:?7)�Ø+à D _��L6y9�?8q$6�?A?cØ(%�Ø(+ D�ì Ó�í ä R N��?B?�Ø(%/.NØ(+3. DZì ÓÝR ��4�C�?�ABA 7�4�N�D�]�5S?-%/.�Ø(+3. D 5.��YM9F]�9p?�]H?�%C. Ø(+3. D�<Zä ?-%�Ø(+ D <�^T4�]EN-Y�6(]�9p?�]@�+DpG�68C�]�9+N�5NBD�]�6�C�7+CE68]M? ]�NB4iD�_�?�D;?��i68D�]���D+4 ��5�R�N��hR2N-5\]�C���6(?�]�? ABA�]�9+6�5JNB]E��?�]ENB4iD�5�]�9+6�5J��5J]�6�U Y�4i�+A-G~v�6�NBD�_��N�q$68Dy]E9+6�?���6�D�]��w5�Y��+C�CE68D�]�NBD���4�C�UV?�]�N�4�D�?m?�5Q68D�Y�4�G�6 Gyv��yN�]M5�A�4�Y8?�A 5.]M?�]E6 D <

Æ+4�CL?#�iNBq$68D~G�N�5J]EC�NBv��+]�6 G�7�C�4�]E4�Y�4�Am_�N�]oN�5�4���]E68D~C�68A�?�]�N�q$68AB��5.]�CM? NB�i9�].��4�C��Æ?�C�G{]�4�Y�4iD�5J]EC���Y�]\]E9+65J��5J]E68USY04�C�CE6 5J7�4iD�G�NBD��F]�4k]E9+6{7�C�4�]E4�Y�4�Am<)��9+6{A�4�Y8?�AL5.]M?�]E6{4 �Q6 ?iY¢9[7�C�4�Y�6 5E5(Y8?�D�].��7+N�Y8?�A�AB�kv�6YM9�?�C�?�Y�]E68C�N�\86 G#v��~?@D���U{v�68C�4 ��N�D�]E68C�D�? A+qi?�CEN-?�v�AB6 5>?%]E9�?�]�_���4�C�6� +? Uy7+AB6I_ G�6 5�Y0C�NBv�6�]�9+6�Uy6 5E5�? ��6 5]�9���5 �m? CkC�6 Y�6�NBq$6 G ?�DpG ]�9+6[qi?�A��+6 5{4 �~Y�6�C�]M? NBD AB4�Y8? A#qi? C�N-? v+AB6�5 D _�? D�G ]E9+68CE6FN-5X? ]ECM? D�5JN�]�NB4iD���+D�Y0]�NB4iDF]E9�?�](G�6 5�Y�CENBv�6 5�9+4 ��]�9�6=5J��5J]E68U Y¢9p?�D+�i6 5Æ��CE4�U 4�D�6=��AB4iv�?�A�5J]�?�]E6=]�4X?�D+4i]�9+68C�<S? ^ 686$_��4�C�68 �?�Uy7+A�6$_ �ë>@? AB7�68C�D ?�D�GED��pY¢��_\c8a�aid-����4iC=?FG�68]M? NBAB6�G�68 �?�UX7+AB6�4���]�9�6yUy4�G�68A�NBD+�X7+C�4�Y�6�5�5?�DpG ?[��D+4 �QA�6 G���6�f%v�?i5J6 G ? D�?�A��+5.N-5=4���?2G�N�5J]EC�NBv��+]�6 G�7+CE4�]E4�Y�4�Am< D O¯D ]E9+6;Y8?�5.6 4 �(]�9�6 U~��G+G��YM9+NBA�G�C�68D[7���\&\8A�6$_�]�9+68CE6y? C�6kd ã C��+D�50_�4�D+6VY�4�CEC�6 5.7�4iD�G�N�D+�F]E4[6 ?�YM92N�D+NB]EN-? A\5JN�]���? ]�NB4iD�<G��9+6�È�fG�N�Uy68D�5.NB4�Dp?�A�Y��+v�6���6£5J]M? C�]E6 G �QN�]�9 G�6�5�Y�CENBv�6 5{]E9+6FN�D+NB]EN-?�A�5JN�]���? ]�N�4�D�l�]E9�?�]yN�5�_Q]�9�6�C�CENB7+�$65J]EC���Y0]��+CE6FY04�D�5.N-5J]ENBD+��Ô.�p5J]=4���]�9+6k]�N�Uy6XeF7�4iNBD�]M50<k��9+6k4�]�CE�+D�Y8? ]�6 G Y��+v�6 5$5[?�C�6;]�9+6TC�CENB7+�$65J]EC���Y0]��+CE6 5�Y�4iD�5JN�5J]ENBD+��4�� ]�N�Uy6F+ 7�4�N�D�]�5�_$��4�CG+�Ó c�ØMd'Ø+£�Ø&â&â&â�P��=q�N�68�QNBD��#]E9+6(5.�+5.]�68U ?i5Q?�5J6�]4��ÓC��+D�50_��L6�v+CENBD+�~]�N�Uy6@N�D�]E4{]E9+6(7+N-Y�]E�+C�6(N�D[?=D�?�]E�+CM? A��Q?8�$_�? D�G[5J686(]E9�?�]�_�N�D �m?�Y0]8_�D+4�G�6 5@G�4D+4i]=G�N�5�?�7�7�6�?�C8_ 4�D+A��26�G���6 50<yHF4iC�6k?iY8Y��+C�?�]�6�AB�$_`�Q9�NBAB6~].��4kC���D�5#Uk?8�;v�6@Ô.4�N�D+6 G[v���? D�6 G��i6?�](]ENBUy6H+�_�]E9+68C�6~Uk?8�kD+4�](v�6k? D26 G���6~v�6�]J�L6868D[]E9+68US? ]�]ENBUy6H+>� ci_�v�6 Y8? ��5J6~]�9+6X?��i68D�]]�9p?�]QY04��+A�G�D��r]LG�N�5J]ENBD+�i�+N-5.9{]E9+68U ?�]\]ENBUy6I+ ?iY&U$�+NBCE6 G=5J4iUy6QNBD���4iC�Uk? ]�N�4�D~]�9�? ]�? ABA�4��L6 G=9+NBU�]E4G�N�5J]�N�D+����N-5J9~]�9�68U�? ]o]ENBUy6I+J�£c�<>? ^ 686 � >@? AB7�68CEDy? D�G�Æ�? ��NBD|_�c�a��ia � ��4iCL?�G�68]�?�N�AB6 G=G�6�5�Y�CENB7+]ENB4�D4��Ó]�9+6�5J6�]Q4���C��+D�5�Y�4iC�C�6�5J7�4�D�G�NBD+�~]�4~]�9+6(U~��G+G��~YM9+N�A-G�CE68Dy7+��\�\8AB6$< D

Æ+4�C���D+4 �QAB6 G��i68f�v�?�5.6 G�? 7+7+ABN�Y8?�]ENB4iD�5�_8]E9+6\Uy4�G�68A�NBD+�L7+C�4iv+AB68U¡Uk?8�Qv�6\9�? CMG�6�C�v�6 Y8? ��5J6\4 �+]E9+6G�Nl7kY���AB].�@NBD~G�6 5�Y�CENBv+N�D+�@]E9+6�5J]�?�]�6�5.7�?�Y06$<\PQ?�5.N-Y8? ABAB�I_�N�]�N�5�D+4�]LY�A�6 ?�C�9+4 � ]E4�G�6 5�Y0C�NBv�6Q]E9+6�5J]�?�]�6�5�Q9+68D;]�9+6��kY�4�D�]M? NBDkNBD���4�C�UV?�]�N�4�D;?�v�4i�+](?��i68D�]M5��+��D+4 �QAB6�G���6$<LOhDk]�9+N�5TY�4iD�]E68 �]8_�]E9+6H������� �"!$#&%'!,3��/nÜ�In��Ü'/+!1,(? 7+7+C�4I?�YM9k5J������6�5J]�6�G{NBD��ÛÆ�?��iNBD�!+�Y*��"��_�c8aia�cn��UV?���7+C�4 q$6���5J60���+Af?hY¢�E<L�u>@?�UXNBAB]E4�D ?�D�GÌ 68A���C�?�D�G�6I_�c8a��ia';0O`61Ô.4�A��k?�DpGFHFNBDp5J4���Ah_�c8aia�e�� D <

^ �+7+7�4I5J6���6�9p?�q$6ÆY�4�Dp5J]�CE��Y�]E6 G�?TUX4�G�68A$4���]E9+6�5J��5J]E68U[<�_�C�4 q�N-G�6�G#]�9p?�]��L6QY8? D~Y�4�Uy7�AB68]E68AB�YM9�?�C�?�Y�]E68C�N�\86@? D;?���6�D�]��w5�AB4�Y�?�A 5J]�?�]E6Sñ(v��X?#��4�CEU{��A-?@R�K�_�]�9+6�D �L6(Y8? D CE6 G���Y06@]�9+6(7+CE4�v+A�68U 4��YM9+6 YM��N�D+�=�Q9+68]E9+68C�?�D�?��i68D�]@NBD;AB4�Y8? A�5.]M?�]E6)ñ���D�4���5�R ]�4kYM9+6 YM��N�D+��]E9+6=qi?�A�N-G�N�]J�X4��YR�Kc[ R�_5JN�D�Y�6Æ?���6�D�] è���D�4���5�RFNBD�A�4�Y8?�Ap5J]M? ]�6�ñQN��0RkN-5�]EC��+6Æ?�]\? ABA+7�4I5�5JN�v+AB6L��4iC�A-G�5��Q9+68CE6QNB]M5�AB4�Y�?�A�5.]M?�]E6N-5@ñ$<y>�4��L68q$68C�_`v�68NBD+�;? v+AB6~]�4£Y¢9�? CM?iY�]�68CEN"\86~? D�? ��68D�]8��5#A�4�Y8?�AL5J]�?�]E6{v��[Uy6 ? D�5T4���?{��4iC�U~�+A-?�QNBA�A�?�A�Uy4$5.]\Y�68CE]M? NBD+A��#CE6�U$�+NBCE6Q]�9+6���5J6�4���?@q$68C���68 �7�C�6 5E5JNBq$6LAB4i��N-Yi_���4�CL�Q9+N-YM9=]�9+6�4�C�6�U�7+CE4�q�NBD��N-5�U$�+NB]E6#N�D�]ECM?iY�]M? v+AB6$<���9+6=Uy4�G�68A�fhYM9+6 YM��N�D��=?�7�7+C�4I?�YM9�_`4�D[]E9+6�4i]�9+6�CT9�? D�G`_�G�4$6 5TD+4i]TCE6�UÛ��NBC�6]�9p?�]�AB4�Y8? A 5J]M? ]�6 5�v�6(68D�Y04�G+?�v+A�6=?i5o��4�C�U~�+A�?�5�<���9��p5�_+NB]�G�4$6 5D�4�]QC�6�UÛ�+N�C�6@CE6 5J4iC�]ENBD+�=]E4y?�A�4���N�Y]�9p?�]�N-5�Uy4iC�6@68 �7+CE6 5�5.NBq$6�]�9�? DFD+6 Y06 5�5E?�C��X]�4~68 �7�C�6 5E5o]�9�6�?i5�5.68C�]ENB4�D�R�<

a

Page 11: Model Checking vs. Theorem Proving: A - Cornell University

RTDkNBUy7�4iC�]M? D�]LN-5E5J�+6(]�4~Y04�D�5.N-G�68CQ�Q9�68D;Y�4�Uy7p?�C�N�D+��]E9+6(].��4~?�7�7+C�4I?�YM9+6 5QN-5�]�9p?�]Q4���C�6�7+C�68f5J6�D�]�?�]�N�4�D�< ��9�6@]�9+6�4�C�6�Uyf%7�C�4 q�N�D+�(? 7+7+C�4I?�YM9yC�6�UÛ�+N�C�6 5���5\]�4�C�687+CE6 5J6�D�]\]�9�6(?��i68D�]��w5\��D+4 �QA�6 G���6v��y?=Y�4iABA�6 Y�]�N�4�D~4�� ��4�CEU{�+A�?�5�NBDV5J4�UX6TA�?�D+�i��?��i6$<���9�6#UX4�G�68ABfmYM9+6 YM��N�D+�(? 7+7+CE4$?�YM9FN�D�5J]E6 ?�G~C�687+fC�6�5J68D�]M5=]�9+6£?��i68D�]��w5=��D�4��QA�6 G��i6[?�5X?2AB4�Y8? A@5.]M? ]�6[NBD 5J4iUy6;5J]�CE��Y�]E�+C�6$< ��6F9�?8q$6$_L9+4 ��68q$68C�_Y�4iUy7+AB6�]�6#��CE686 G�4iUS]�4�G�6�Y�N-G�6=4iD�]�9�6yC�687�C�6 5.68D�]�?�]ENB4�D�4���]E9+6~AB4�Y8? AQ5J]�?�]E6k?�D�G�]�9+6k5.]�CE��Y�]���C�6$<��9+68CE6y? C�6X?�7+7�ABN-Y�?�]�N�4�D�5@]E9�?�] ?�C�N�5J6���CE6�UÛ��68D�]EAB�;NBD�R@OT�Q9�68C�6=]E9+6{A�4��iN-Y8? A�YM9+4iN-Y�6���4iC#]E9+6~C�687+fC�6�5J68D�]M? ]�NB4iD2N�5@NBD�]�68CEUk5T4��Q��4iC�U~�+A-?i5�<}Æp4iC(68 +? Uy7+A�6$_`]�9�6{7+CE4�v+A�68Uyfm5J4iABq�NBD+�k5.�+5.]�68U ^ �QWTO�_ ^C�6�7+C�6 5.68D�]M5\?(5J]M? ]�6@v��~?(5J68]\4 ��6�CM5.]�f�4�CMG�68Co��4iC�U~�+A-?i5n;�4i7�6�CM?�]ENB4iD�5�4�D~]�9+6�5J]�?�]E6(?�CE6TCE687+C�6�5J68D�]�6 Gv��~?�G+G�N�D+�~Y�68CE]M? NBD=��4�C�U~�+A�?�5�? D�GyG�68A�68]�N�D+�(4�]E9+68CM5 � Æ�N��$6 5�? D�G�^TN�A-5�5.4�D�_�c8a�p d � <�R@5�? D+4�]E9+68CL68 �f?�UX7+AB6$_�O`68q$6 51U$�+6 � O`68q$6 51U$�+6$_�c�a��-¤I? � 5.]���G�N�6 5o��D+4 �QAB6�G���6�v�?�5.6 5c?�C(PQ5 D �Q9�68C�6���6�9�?8q$6MLFNPO�O?�DpGEQ@Þbí 4i7�68CM? ]�NB4iD�5�< R��]�6�C�]�9�6�C(P�N-5#]E4�A�G ?;5J6�U$�+68DpY�6y4����m?�Y0]M5�_��L6k5J9�4��+A�G v�6k? v+AB6k]E4C�6�7+C�6 5.68D�]@]�9+6X5JN�]���? ]�N�4�D���5JN�D+�F]E9+6y5.68]�R[4��L�m?�Y�]�5@]�9�? ]�NB](9�?i5@v�6�68D2]E4�A�G`< ûTS � 9�? ]xC�CENB7+�$65J]EC���Y0]��+CE6�G�4$6 5]E9+N-5�CE687+CE6 5J68D�]n`

��9+6�6�C�5J]�]�9+N�D+�F�L6{9�?8q$6~]�4£G�6 Y�N�G�6{N�5@�Q9�?�]�]�9+6y�iAB4iv�?�AÆ5J]M? ]�6 5�?�CE6y��4iNBD+�[]E4Fv�6$<���9+68CE6N-5@4iD+AB�[4iD+6y? ��68D�](NBD�]�9+6~5.�+5.]�68U£_`D�?�UX68AB�$_�]�9�6�C(P N�]M5.68A��E_�5.4[?y��A�4�v�? AL5J]M? ]�6y�QN�ABA v�6k?y7�?�N�CY�4iD�5JN�5J]�N�D+�~4��L]�9+6�68D�q�N�C�4�D�Uy68D�]�5.]M? ]�6=? D�GF]�9�6HC(P@�w5�A�4�Y8?�A�5J]�?�]�6I<TR�5�L6=5�? N-G;?�v�4 q$6$_��L6=Y8? DN-G�68D�]EN����k]�9�6�C(P@�w5�AB4�Y8? A�5.]M? ]�6~�QNB]�9[]E9+6=��4�C�U~�+A�?�5T]E9�?�](NB]�9�?�5(v�6�68D2]E4�A�G`<=� 9�?�]�?�v�4i�+]�]E9+668D�q�N�C�4iD+Uy68D�]n` ^ NBDpY�6Q��6�?�5E5J�+Uy6Q]E9�?�]\]E9+68C�6�N-5�?#C�6�?�A+�L4�C�A�G 6� �]E68C�D�? A+]�4(]E9+6ZC(P@_��L6�Y8?�DX]M?��$6]�9�6�68D�q�N�C�4iD+Uy68D�]�]E4yv�6~?yY�4�UX7+AB68]E6(G�6 5EY�C�N�7+]�N�4�D;4��L]�9+6�C�68A�68qi?�D�]��6�?�]���C�6 5Q4��L]�9�6���4iC�A�G`<T��6Uy4�G�6�A`]�9�N-5�v��y]M? ��N�D+�{]E9+6(68D�q�N�C�4�D�Uy68D�]\5J]�?�]�6�]�4~v�6�?G/K!¢�l*��EMN���i*��<,3�E/3Ü'I3�EÜ�/K!M<VU���9���5�_�?=��A�4�v�? A5J]�?�]E6#N�5�?�7�? NBC�?-QSØ"R D _��Q9+68CE6�Q N�5�?�C�6�A-?�]ENB4iD�?�A|5J]�CE��Y�]E�+C�6H?�NBD�]��+N�]�N�q$68AB�$_iG�6 5EY�C�N�v+NBD���]�9�6@��4iC�A-G D?�DpGWRyN�5Q? ��4iC�U~�+A-?)?%N�D�]E�+NB]ENBq$68A���_�]E9+6�Y�4�D�Ô.�+D�Y�]ENB4�Dk4 �\]�9+6@�m?iY�]M5�]E9+6xC#P 9�?i5v�6868Dk]E4�A-G D <

^T68 �]y��6[9p?�q$6[]E4 G�6 Y�N�G�6[�Q9�?�]k]E9+6�? ABA�4��Æ?�v+A�6[��A�4�v�? A�5.]M? ]�6 5k?�CE6$<ø��9+N-5y]E�+C�D�5y4i�+]F]E4v�6�U$�+N�]�6X5J68D�5.NB]ENBq$6�]E4F]E9+6{6� �7+CE6 5�5.NBq$68D�6 5�5T4 �Q]E9+6�C(P@< ^ �+7+7�4$5.6 �L6~?�5E5J�+Uy6~]�9p?�]�]E9+6}C#P N�5*-,+,�!3/+�EMN���YX�(+*-,�!$#�_�Nm<r6$_�NB]�N-5�]E4�A-Gk4�D+A��y�m?�Y�]�5N�DF]�9�6=?�5E5J68CE]�N�4�DFA�?�D+�i��?��i6~?�D�GkD+4{�m?iY�]M5�?�v�4���]@NB]�5��D+4 �QAB6 G��i6$<b��9�68Dk��6(Y8? DkC�6 5.]�C�N�Y�]L?�]E]�68D�]�N�4�Dk]�4���AB4iv�?�A 5.]M? ]�6 5Z?�QSØ"R D �Q9+6�C�6@]E9+6@��4�C�U~�+A�?HR~N�5]�CE�+6�N�D2Q�<�?E��9+N�5TY8? 7+]���C�6 5Q]�9+6 ?�5E5J�+Uy7�]�NB4iDF]E9�?�]�]�9+6QC(P N-5Q4�D+A��k]�4�A�G ]EC��+6(�m?�Y�]�5T? v�4i�+]@]E9+6��4iC�A�G`< D Om���L6�Uk? �$6oD�4�����C�]�9�68C�CE6 5J]EC�N�Y�]�N�4�D�50_�]�9+6�D�_$?�Y�Y�4�C�G�NBD+��]�4(4��+CÓG�6n6�D+N�]�N�4�D=4�����D+4 �QAB6 G���6$_Z ¥+´Q³�´ ×8°.®$«%¦ °�À\[�È¢½uÎ�¸-¹�ÈM¿Q´¢Ü�«�¦ °\õ8± ´Mø�®w°E×�ù0°�8i©¢¨�°0ß�´�± °\¦i©¢¨ «�´ � ¨�°�¨�´0³T° «%°.³�µ�´0ªh©M®�¨%«�ª � ¬h« � ª�°Qø�¦ °.ª%°\°E©�¬�¦

µ�´0§w±8«L§w¨�ª�°.µ ª%°.¨�°J±�«%°E×]88²~©(¨%°.«�´¢Ü Ü�´�ª�³ � ®�©¢¨EØ=÷8°.°H�_^@´0ª%ª�§w¨Q©M±i×3` ©�×8´iß�âEãn�0ç1¡ ©M±�×=ª�°¯Ü�°.ª�°J±i¬h°.¨(«%¦ °.ª%°.§w±~ÜB´0ªQ©×8§w¨m¬ � ¨�¨%§�´�±@´MÜ�¨ � ¬%¦(©�³�´ ×8°J®�Øa à ®w«%¦ ´ � ù�¦�§w«�³�©�²Q§w±i×�°.°E×M8�°\ª�°�©M¨�´�±i©(8�®�°�§w±@³�©¢±�²�¬J©M¨�°J¨ «�´Qª%°.µ ª%°.¨�°.±8«L©�¨%§w« � ©¢«�§w´0±M88²�«%¦ °\¨�°J« ´MÜ+Ü�©�¬h«�¨ ©¢±©Mù�°.±8«�¦i©M¨;8�°.°.±#«�´0®�×$ß�± ´0«%°�«�¦i©¢«;8�²@×8´0§w± ù�¨�´Qø`°L©¢ª�°\©M¨%¨ � ³T§�±�ù�Ö-©M³�´�± ù\´�«�¦ °.ª�«%¦ §w± ù0¨hÞ�«%¦i©M«�«%¦ °�b&c §w¨;8i°J§�±�ù«�´�®�×oÜ�©0¬h«%¨|©d8i´ � «�©�¨%«m©¢«�§�¬�¨%§�« � ©M«%§w´0±�ß�¨�´\«%¦i©M«�í+Ä À.¿Q«%¦ ° §w±8ÜB´0ª�³@©M«%§�´�±L©Mª%ª�§wê0°�×�§�¨`§wª�ª%°.®w°.ê0©M±8«EØ+ô�´0ª�°héi©¢³�µ ®w°0ßM§rÜ�ø`°¬h´�± ¨�§�×8°.ª�µ�ª�´0µ�´0¨%§w«�§w´0± ¨`ø�¦ ´�¨�° «%ª � «%¦@³�©�²L¬%¦i©¢± ù0°�´Mê0°.ª`«�§w³�°�ß0§w«�³@©�²�8i°�«%¦i©M«�©M«`¨�´�³�°�µ�´0§w±8«�«�¦ °�b�cy§w¨�«%´0®�×Fe©M±�× «%¦ °.±�®�©M«�°Jª�§w«$§w¨$«�´0®�×�fge`Øih=°p×�´�± ´0«�± °E¬h°.¨%¨m©¢ª�§w®w²\ø|©¢±8«$«�´�ê8§w°.ø=«�¦ °�b&c�©M¨i8i°J§�±�ù §w±\©M±�§w±i¬h´0±�¨�§w¨�«%°.±8«�¨%«m©¢«�°�©¢««�¦�§�¨�µi´�§w±�«�ØYh=°`¬.©M±\ù�°.«�©Mª%´ � ±i×Ó«�¦ §w¨�×�§kj�¬ � ®w«-²:88²\© � ù�³�°.±8«�§w± ù�´ � ª�ª%°.µ ª%°.¨�°.±8«h©M«�§w´�±Q«�´ §w±i¬¯® � ×8°�«�§w³T°0ß.¨%´�«%¦i©M«l5�e©M«�«�§w³�°�úd6�ø�´ � ®�×\± ´�«m8i°�§�±�¬h´0± ¨%§w¨�«�°J±�«�ø�§�«%¦�5�fge#©M«+«�§w³�°`ü�6�Ønh=° ¬.©¢±�©M®w¨�´�§w³�©¢ù0§w± °�©�³�´0ª%°�¨%´0µ ¦�§�¨%«�§�¬.©¢«�°E×Gb�c«�¦�©M«�×�§�¨h¬.©Mªh×8¨�©M±�°E©¢ª�®w§w°.ª$Ü�©�¬h«�§rÜ §w«�§w¨$§w±i¬h´�± ¨�§w¨�«%°.±8«+ø�§�«%¦�®­©¢«�°.ª�§w±8Ü�´0ª%³�©¢«�§w´0±�Ø���´Mø`°.ê0°JªEßM¨ � ¬%¦L©M±L©¢µ µ ª%´�©0¬%¦�o � §�¬%õ8®w²®w°E©0×�¨�«�´�©M®w®�«�¦ °�×8§pj�¬ � ®w«�§w°.¨�´�± °�°.±i¬h´ � ±8«�°.ª%¨ §w±@ù0°.± °Jªm©M®�ø�§w«�¦ � µ$× ©M«%§�±�ù�8�°.®w§w°hÜ�¨�Ö�¨%°.°0ß�°0Ø ùiØwß�� ôi©¢ù0§w± À¯¸|¼M½pq�ß$âEãn�0ú-�rGs©¢ªm×8°.±�Ü�´0ª%¨Eß$âEãn�3� ¡ Þ.Ø�ô�´0ª`°héi©M³Tµ ®w°0ß�ø�¦i©M«�×8´�ø�°\×8´�§rÜ�ø�°�¦i©�ê�° «�¦�ª�°.°�Ü-©0¬h«%¨�«�¦i©¢«|©¢ª�°�µi©M§wª%ø�§�¨%°\¬h´0± ¨%§w¨�«�°J±�«�ß$8 � «ø�¦ ´�¨�°\¬h´0±ut � ±i¬h«%§w´0±@§w¨�§�±�¬h´0± ¨%§w¨�«�°J±�«-v�h ¦ §�¬�¦T´MÜ�«�¦�°�«%¦ ª�°J°�Ü�©0¬¯«�¨�×�´Lø`°\×8§w¨m¬.©¢ªm×$vw à�ª%°.®�©M«%§�´�±i©M®�¨�«%ª � ¬h« � ª�°@¬h´0±�¨�§w¨�«%¨\´MÜ�©@×8´0³@©M§w±�´¢Ü�§w±i×8§wê8§�× � ©M®$°J®�°J³�°.±8«�¨�ß$©M±i×(©¢± ©¢¨�¨%§�ù�± ³�°J±�«�´¢Ü�Ü � ±�¬h«�§w´0±�¨©M±�×�ª%°.®�©M«%§�´�± ¨`«�´Q«�¦�°�Ü � ±i¬¯«�§w´0±@©M±i×Tª�°J®­©¢«�§w´0±T¨�²8³G8�´0®w¨�´¢Ü�«%¦ °\©M¨�¨%°.ª�«%§w´0±(®�©M±�ù � ©¢ù0°0Ø

c8e

Page 12: Model Checking vs. Theorem Proving: A - Cornell University

]�9�6���D+4 �QAB6 G��i6(v�?�5.6)C#P9�������h,�?��m?�Y�]�R N�D[?y5.]M?�]E6xRkN��YR 9+4iA-G+5QNBD£?�A�A�]E9+6��iAB4�vp?�A�5J]M? ]�6 5�4��]�9�6#��4�CEUÇ?-QSØ"R D <QP��+]Q]�9p?�]@Uy6�?�D�5�]E9�?�]�]�9+6QC(P ��D+4 ��5ZR N�D;?y5J]�?�]�6yRkN��YR 9+4�A�G+5QNBD[? ABA�]E9+6Uy4�G�6�A-5o4 �GRy4iC8_+6�U$�+N�q�? AB68D�]�A��$_$N���R N-5Q?�AB4i��N�Y8?�A Y�4iD�5J6�UÛ�+6�D�Y�6@4 �GR�<

��9+N-5�6� +? Uy7+AB6~? ABCE6 ?�G�� 5J9�4���5�9�4�� ]�9�6yUy4�G�68A�fhYM9+6 YM��NBD+�k? 7+7+CE4$?�YM9 Y8?�D v�6yq�NB68�L6 G�?i5=?��6�D+68CM? ABN�\ ?�]ENB4�DX4���]�9+6@]E9+684iC�68Uyf�7+CE4�q�NBD���? 7+7+CE4$?�YM9�<LP��+]�]E9+6@Uy4�G�68ABfmY¢9�6 Y¢��NBD��(?�7+7�C�4$?iY¢9k�iNBq$6 5��5�?�G+G�6�GW!�68 �NBv+N�ABN�]J�I<HÆ+4�C(68 �?�Uy7+A�6$_�Y�4iD�5JN�G�68C(]�9�6�In�d�-,�!$#zX��b��/+�l#V*-,+,�Ü�Fc.L�EMN��� � W68N�]�68C�_�c8a��-¤ � _�Q9+68CE6y? D��k�m?�Y�](D+4i]�68 �7+A�N-Y�N�]�AB�V5J]�4iC�6 G[NBD[]E9+6XG+?�]�?�v�?i5J6yN�5�]�?��$68D[]E4kv�6=�m?�A�5J6$<)��9+6~D+686�G£��4iC5J�pY¢9k? Dk?�5E5J�+UX7+]�N�4�Dk? v�4i�+]QD+68�I?�]ENBq$6�NBD���4iC�Uk? ]�NB4iDy5.]�68UV5���C�4iU ]E9+6T�m?�Y0]�]�9p?�]�N�Dy? D��XY�4iUy7+AB6� ?�7�7+ABN�Y8?�]ENB4�D|_Û]E9+6QD��+U{v�68C�4���D�68�$? ]�NBq$6��m?iY�]M5�qi?�5.]�A��=4��+]ED��+U~v�68CM5 ]�9+6QD��+U~v�6�C�4��|7�4I5JN�]�NBq$6Q4iD+6 50_5J4 ]E9�?�]kNB]kN�5{]�4i]M?�A�AB� NBD���6 ?i5JN�v+AB6[]E4 6� �7+A�N-Y�N�]�A��2CE687+C�6�5J68D�]y]�9�62D+6��$?�]ENBq$6;NBD���4iC�Uk? ]�NB4iD NBD ]E9+6G+? ]M?�vp?�5J6I<y�26~Y8? D�Y�?�7+]E�+C�6~]�9+N�5(?�5�5.�+Uy7+]ENB4iD2Uy4�G�68ABf�]�9+6�4�C�6�]�N-Y�?�ABA��yv��FC�6�5J]�CEN-Y�]ENBD+�V?�]�]E68D�]�NB4iD]�4�7�?�N�CM5�?-QSØ"R D �Q9+68C�6�D+4i]�4�D�AB�~N-5{R~]EC��+6�NBD'Q�_Ûv��+]�68q$6�C��=? ]�4iUyN-Y���4�CEU{�+A�?ZvH?-| { Ø&â&â&â3Ø(|�ã D D+4i]NBUX7+ABN�6 G�v��'R~N-5o�m? A-5J6�NBD'Q�< � 9+NBA�6@]�9�6(Y�AB4I5J6 G�f%�L4�C�A�Gy?�5E5J�+UX7+]�N�4�D;Y8?�DXv�6@��4iC�Uk? ABN"\�6 G�NBD�6pCM5J]Ef4�C�G�68CLAB4��iN-Y�_$�Q9+N�Y¢9~Uy6 ? D�5�]�9�? ]��L6(Y8?�DX��5J6�]�9+6�]�9+684iC�68UXf%7+CE4 q�N�D+�(?�7�7+C�4I?�YM9 ]E4HU$�+68CE�~Y�AB4I5J6 G�f��4iC�A�G ��D+4 �QAB6�G���6yvp?�5J6�5�� WQ68N�]�68C�_Qc8a���¤��._\? D�?�A��'\8N�D+�F]E9+6k7+C�4iv+AB6�U ��CE4�U ]�9+6kUy4�G�6�ABfmY¢9+6�Y¢��NBD+�7�68CM5.7�6 Y�]�N�q$6=AB6 ?iG+5@]�4£? Y04�Uy7+A�68]�6 Y¢9p?�CM?iY�]�6�C�N"\�?�]�N�4�D�4��Æ]�9+6XY�4�UX7+AB68 �NB].�y4 ��UÛ��68C��£?�D�5.��68CENBD+��_?�DpGV���+CE]�9+68CEUy4�CE6$_$NB]Q68Dp?�v+A�6 5�4�D+6�]�4XG�6 ? A��QNB]�9k9+N���9+6�C�f�4�CMG�68C�UÛ��68C�N�6 5�_��Q9+N-YM9;?�C�6(D+4i]T�p5J��? ABAB�?�UX68D�?�v�AB6@]E4=]�9+6(]�9�684�CE68Uyf�7+C�4 q�NBD+� ?�7+7+CE4$?iY¢9 � KL?�C�G�Nh_�c8a��ig-�.<

��9+6QY0AB4$5.6 G�f���4iC�A-G�?�5E5J�+Uy7�]�NB4iD�N�5�4iD+AB�(4�D�6�4���Uk? D�����6LUyNB�i9�] Y04�D�5.N-G�68C�UV?���NBD+�Q]E4@C�6 5.]�CEN-Y�]?�]E]�68D�]�N�4�D ]�4[4iD+AB� Y�68C�]�?�N�DÅ?-QSØ�R D <�R@5 ^ 9+4�9�? U � ^ 9+4�9�? U[_Qc8a��up��T4iv�5J68CEq$6 G`_�Uy4I5J]���4iC�Uk5(4��D+4iD+Uy4�D�4�]�4iD+N-Y�CE6 ?�5.4�D+N�D+�@Y�?�D(v�6�q�NB68�L6 GT?i5�? ]�]E68Uy7+]�5�]�4�C�6�5J]�CEN-Y�]|?�]E]�68D�]�N�4�D(]�4�5.4�Uy6\Y04�ABA�6 Y�]ENB4�D4��0.0/+!"��!3/3/K!$#o7�? NBC�5�<b��9�6���4�Y���5�NBD=Uk? D��(4 �`]E9+6Q��4iC���5�4�D~D+4iD+Uy4�D�4�]�4iD+N-Y�CE6 ?�5.4�D+N�D+�(N-5�4iD{�p5JNBD��5J4iUy6�A�4��iN-Y8? A���4iC�Uk? ABN-5.U ]�4;G�6�5�Y�CENBv�6�]E9+6=5.68]@4��L7+CE6���68CEC�6 GkUy4�G�68A�5�<Z��9�N-5TN�5TD+6 Y�6�5�5�? C��;N��\4iD+6�QN-5.9+6 5Q]�4X?�7+7�AB�k]�9+6(]E9+684�CE68Uyf�7+C�4 q�NBD+�~? 7+7+CE4$?�YM9�< � �+C�Y�4iD�]E68D�]ENB4iD N�5]E9�?�]�]�9�684�CE68U 7+CE4�q�NBD��N-5SÔ.��5.]k4�D+6��Æ?8� ]�4 68qi?�A���?�]E6VU$�+68CENB6 5y? D�G D+4i]kD+6 Y�6 5E5�? C�NBA�� ]E9+624i7+]�N�Uk?�A��Q?8�$< Æ+CE4�U 4���C7�4�N�D�]@4 �Lq�N�68�(_`]�9�6�C�N���9�]@U$�+6 5J]ENB4iD[N-5TD+4i]@�Q9+68]E9+68C@4iD+6~Y8? D[7+C�4 q$6=N��o?�D ?�5�5.68C�]ENB4iD�R ��4�ABA�4 ��5��C�4iU ?y��D+4 �QA�6 G���6~v�?i5J6'R`_���5.NBD+�£5J4iUy6�D+4iD+Uy4iD+4�]E4�D+N�Y A�4���N�Y�_�v+�+](CM? ]�9+6�C#N���R 9+4iA-G+5(NBD[]E9+6C@C�N�7+�$6�5J]EC���Y�]E�+C�6�C�6�7+C�6 5.68D�]�6 G�v��3RG?%�Q9+68CE6T]E9+6�D+4�D+UX4�D+4i]�4�D�N-Y�N�]J��N-5LY8?�7+]E�+C�6�G v��=C�6 5.]�CEN-Y�]ENBD+�?�]E]�68D�]�N�4�Dk]�4X?�7+CE6���68C�CE6 Gk5J68]Q4 ��7�4I5�5JN�v+AB6���4iC�A-G�5 D <

=�q$68D��QNB]E9+4���]=]�9+6kY04�Uy7+A�N-Y8? ]�N�4�D�?�CEN-5.NBD+�k��C�4�U ]�9+6yD�4�]�N�4�D 4���7�C�6���68CE68D�Y�6I_�]�9�6k5JN�]���? ]�NB4iD��6�]M5@Uy4�CE6=Y�4iUy7+A�N-Y8? ]�6 GyN��L�L6~?�5�5.�+Uy6=]E9�?�](]�9�6)C#P N�5�]E4�A�G �m?�Y�]�5�]E9�?�](N�D�Y�AB�pG�6�N�D���4�CEUk?�]ENB4�D?�v�4i�+]{N�]M5(4��QD ��D+4 �QAB6 G���6$_�Nm<r6$<�_�]�9�6k5J7�6 Y�Nl6�Y8? ]�NB4iD N-5ó�-�������"!$#&%�!(X�(3*-,�!$#�< R@5�7�4�NBD�]�6�G24��+]=N�D� O`6�q$6 51U$�+6$_�c�a��-¤I? � _`]E9+N-5�Y8? D[v�6)U$�+N�]�6�N�Uy7�4�CE]M?�D�]QNBD[7�CM?�Y0]�N-Y06$<�Æp4iCT6� +? Uy7+AB6I_�5J�+7+7�4I5J6X?�C(PN-5Q]�4iA-Gk]�9+6(��4�ABA�4 �QNBD+�=�m?�Y�]�5@?�v�4i�+]�?{5.Uk?�A�A���C�4i�+7[4��L7�684i7+AB6$lx4M3�4�9�D[N-5�?{]�6 ?iY¢9�68C+5�_�4�H[?�C��kN�5?F]�6�?�YM9+68C+5�_�? D�G�4��$4�� ��D+4 � ? v�4i�+]X?�ABAL]�9+6~]�6�?�YM9+68CM5$5�<���9�68D ��6~68 �7�6 Y0]�]�9�6�C(P ]�4[��D+4 �]�9p?�]�P�NBABA�N-5QD+4�]�?=]�6 ?iY¢9+6�C@?h?�5E5J�+UXNBD+�=N�]Q��D+4 ��5Q]�9�? ]@P�N�ABA�N-5�G�N-5.]�NBDpY�]o��CE4�U H[?�CE�F? D�GF3�4i9+D D <OhD�]E�+NB]ENBq$68A��$_8]�9�N-5�N-5�v�6 Y8? ��5J6@]E9+6�]�9+CE686@?i5�5.68C�]ENB4�Dp5o]�4i��68]E9+68C\C�6�5J]�CEN-Y�]�]�9+6(5.68]\4��|7�4I5�5.NBv+A�6@��4iC�A-G�5]�4~4�D�6 5��Q9+68CE6#4iD+AB�V3�4�9+D£?�D�G;H[?�C��V?�C�6(]E6 ?�YM9+68C�5�<

>T4 � Y�?�DF�L6(Uy4�G�68A�]�9+N�5K`G��9�? ]TN�5�_+�Q9�? ]T7�? NBC�5¾?�QSØ"R D 5J9+4i�+A-Gk��6�?�A�AB4 � D+4 � ?%�Q9+6�C�6�RyN�5]�9�6QY�4iD�Ô.�+D�Y�]ENB4iD=4���]�9+6L]�9+CE686o��4iC�U~�+A-?i5`Uy68D�]�N�4�D+6 G(? v�4 q$6 D `kZ\AB6 ? C�AB�I_�]�?���NBD+��7�?�N�CM5�?�QSØ"R D 5J��YM9]�9p?�]PRkN�5T]�CE�+6�N�D2Q �QN�ABA�D+4i]@��4iC���_�5JN�D�Y�6�?{CE68A-? ]�NB4iD�?�A�5J]EC���Y0]��+CE6�Q�G�4$6 5@D+4�]�G�68]E68C�UyN�D+6@]E9+6]�CE�+]�9[4 �\��4�C�U~�+A�?�5QNBD�q$4�ABq�NBD��{��D+4 �QAB6 G���6$<@��9+6~? D�5J�L68C@N�5T]�9�? ]@�Q9+68D[�L6=9�?8q$6=?{��D+4 �QAB6�G���68f

c�c

Page 13: Model Checking vs. Theorem Proving: A - Cornell University

v�?i5J6 G;5J7�6 Y�Nl6�Y8?�]ENB4iD�_��L6�Y�?�D+D+4i]�5J68A�6 Y�]L]�9+6�?�A�AB4 �Q? v+AB6�5J]M? ]�6 5Q4�D�6�? ]�? ]ENBUy6I_�68q$68DyN����L6(?�A�AB4 �5J4iUy6�D�4�]�N�4�D�4��Æ7+C�6���6�C�68D�Y06$<(WT? ]�9+6�C8_�NB]@N�5T]�9�6~Y�4�A�AB6 Y�]ENB4iDF4��?�A�A�7�4$5�5.NBv+A�6y5.]M? ]�6 5@]�9p?�]@9�?i5#]E4v�6;Y�4�D�5.N-5.]�68D�]=�QNB]E9 ]E9+6GC(P@< ��9���50_o�L6;Y8?�D+D�4�]@Ô.��5J]���4�Y��p5 4iD ]�9�6 �iAB4iv�?�A�5.]M?�]E6 5n;Q�L6 9p?�q$6]�4;Y�4iD�5JN�G�68C(]�9�6{�Q9+4iAB6=CE6 5J�+A�]�N�D+�GC�CENB7+�$6 5J]EC���Y�]E�+C�6I<{OhD�]��+N�]�N�q$68AB�$_+�L6y? C�6~]�CE��N�D+�y]�4£G�6 5EY�C�N�v�6?�C@C�N�7+�$6k5J]EC���Y0]��+CE6kY�4�Dp5JN-5.]�N�D+�24 �(?[Y04�ABA�6 Y�]ENB4�D 4���7�?�N�CM5�?-QxØ"R D 5J�pY¢9 ]�9p?�]3R�N�5�]�CE�+6kNBD�]E9+6C�6�5J�+A�]�NBD���C�CENB7+�$6V5J]�CE��Y�]E�+C�6$<Å?�^T4�]EN-Y�6X]�9�? ]=]�9+6k]�CE�+]�9 4��}R G�687�68D�G�5�4�D ]E9+6k�Q9+4�A�6GC�CENB7+�$65J]EC���Y0]��+CE6$_�D+4i]�Ô.�p5J]�4�D~Q�< D

3���5J]�?�5 ]�9+68CE6L?�C�6L7�4�]�6�D�]EN-?�A�AB��Uk?�D��(5.]M?�]E6 5 Y�4�D�5.N-5.]�68D�]��QNB]E9=?Q��NBq$6�D�?i5�5.68C�]ENB4�D�f%v�?i5J6 G=5.7�6 Y�NBf6�Y8? ]�N�4�D�_$]�9�68C�6�? C�6�7�4i]�68D�]�N�?�A�AB��UV?�D��HC@C�N�7+�$6Q5.]�C��pY�]��+CE6 5\Y�4�Dp5JN-5.]�68D�]��QN�]�9X?��iNBq$68D=��D+4 �QAB6�G���68fv�?i5J6 G 5.7�6�Y�N86�Y�?�]�N�4�D�< �26£Y8?�D ��5J6£5J4�UX6FD+4i]�NB4iD 4 ��7�C�6���68CE68D�Y�6X]�4 5.68AB6 Y0]~?��+D�NNU$�+6GC�CENB7+�$65J]EC���Y0]��+CE6$< R 7�4�7+��A-?�CXD+4�]ENB4�D 4 �(7+CE6���68C�6�D�Y�6kN-5=4�D+6;]�9�? ]y]�CENB6 5=]�4 Y�N�CMY��+UV5�Y�CENBv�6y]�9�6�C(P@�w5��D+4 �QAB6 G��i6$<���9+6=N-G�6 ? N�5]E4yq�NB68� ]�9+6���D�4��QA�6 G��i6=5J7�6 Y0N86�6 GkNBD;]�9+6QC#P¡?�5H*����b� Ji*���M8,@���i���b��<��9���5�_@]E9+N-5y7+CE6���68C�6�D�Y�6[Y�?�D v�6�q�N�68��6 G ?�5;? Y�A�4$5J6�G�f%�L4�CEA-G ?�5E5J�+UX7+]�N�4�D¡?�]F]E9+6���D+4 �QA�6 G���6AB6�q$68Ah<>��9�N-5TD+4i]�N�4�D[9�?i5�CE6 Y�68N�q$6 Gy?{A�4�]@4 �Æ?�]�]E68D�]�NB4iDFN�DF]�9�6=7�?�5.](G�6 Y8?iG�6 � Æ�?���N�DÅ!+��*��"��_�c�a�a�c�;>@? AB7�68C�D ?�DpG�HF4$5.6 5�_Lc8a���¤�; C@4�D�4�ABN���6$_\c�a��-¤i; O`68q$6 5$UÛ�+6I_�c8a���c�; O`6�q$6 51U$�+6$_\c8a��-¤I?';bO`6�q$6 51U$�+6$_c8aia�e�;<_�? C�N���9�_�c�a�a�c�;�K�? CMG�Nm_`c�a���b���<

^ 4[�m?�C~��6k9�?8q$6kY�4iD�5JN�G�68C�6�G 4iD+AB� 5.NB]��p?�]�N�4�D�5=�QNB]E9 ?25.NBD+�iAB6;?��i68D�]�< OhD 5J�pY¢9 5JN�]���? ]�N�4�D�50_C@C�N�7+�$6\5J]EC���Y0]��+CE6 5�G�68�i68D+68C�?�]�6\]E4T6 5E5J68D�]�N�?�A�AB��5J68]�5`4����L4�C�A�G+5�< H[? D��(R�O`?�7�7+ABN�Y8?�]ENB4�Dp5�_ 9+4 ��68q$68C�_G�6 ? AT�QN�]�9 U{�+A�]�N�7+AB6~NBD�]�68C�?�Y�]ENBD+��? ��68D�]M50< Oh]~N-5=�Q9+68D �L6F]EC�� ]�4��iNBq$6y��4�CEUk?�A�5.68Uk? D�]EN-Y85�]E45J6�D�]E68D�Y�6 5 5J�pY¢9 ?�5Z4 Ì 6�?�D~G�4$6 5.D��r]���D+4 � �Q9+68]E9+68C ^�NB �4�D���D+4 ��5�]E9�?�] Ì 6 ?�D=��D+4 ��5�]�9p?�]Y^TNB �4�D��D+4 ��5{? v�4i�+]y]E9+6k��? ]�68CE�$?�]E6[v+C�6�?���f%N�DL5F]�9�? ]y]�9�6V����ABAQ7�4 ��68C~4���C@C�NB7��$6F5.]�CE��Y�]���C�6 5=Y�4iUy6 5NBD�]�4k7+A�?8�$<=OhD�5.��YM9�5.NB]��p?�]�N�4�D�50_�Y�N�CMY���Uk5�Y�CENBv+N�D+�~]�9�6~?���6�D�]�5�����D�4��QA�6 G��i6{N�5�9�NB��9�AB�FD�4�D�]�C�N�q�N�?�A?hYM�E< � Æ�? ��NBDk!+��*��"��_ c8a�a�c�;0_�?�CENB��9�_`c�a�a�c�;`KL?�C�G�Nh_�c8a���b �ED <

��4�5.�+UyUk? C�N�\86$_`N�D�C�68A�?�]ENBq$68A��[5JN�Uy7+A�6~5J68]E]�NBD��$5#N�]�Uk?8�[D+4i]=v�6y]�4$4�G�Nl7kY0�+AB](]�4�G�6 5�Y�CENBv�6$_NBUX7+ABN�Y�NB]EA��;4�C=68 �7+A�N-Y�N�]�AB�I_�]E9+6;5J68]=4 �(C���D�5�]�9�? ]yYM9�? CM?�Y0]�68CEN"\86~]�9+6;5.�+5.]�68U[_�?�D�G ]�9���5���6;Y8? D��6�]Q?SC@CENB7+�$6�5J]EC���Y�]E�+C�6I_Û�Q9�N-YM9{N�5o]�9�6(?�7+7�C�4�7�C�N-? ]�6(5.68Uk? D�]EN-Y�Uy4�G�6�Ah<f_�C�6���68CE68D�Y�6�Y�CENB]�6�C�N-?�?�D�GG�6��m? �+AB]�5�Uk?8��Uk? �$6Q]�9+N�5Ó]�?�5.�{Uy4iC�6�G�Nl7kY0�+AB]�_�v+�+]\��6�68 �7�6 Y�]\]�9�? ]�68q$6�D=NBD~]�9+N�5oY�?�5J6I_�]�9�6T]�?�5J��QNBA�A`v�6 Y�4iUy6@Uk? D�?��i6 ?�v�AB6(?i54i�+CT��D�G�68C�5J]M? D�G�N�D+�{4 �\]�9�6 5J6(D+4i]�NB4iD�5�G�68687�68D�50<

±�²-� · ��º@¶�¿y�hµ�¶�����½+Á�^ �+7�7�4I5J6(��6�9�[email protected]�Uy689�4�� Y04�D�5.]�C��pY�]�6 G~�Q9�?�]L��6(Y�4iD�5JN�G�68CL]�4�v�6(]�9�6@? 7+7+C�4i7+C�N�?�]E6�5.68Uk? D�]EN-YUy4�G�6�Ah<T��6=D+4 ���Æ?�D�]@]�4VY¢9+6�Y¢�yN��Æ?{��N�q$68DF��4�CEU{�+A�?HR N-5T]EC��+6=N�D�?{7�? C�]�N�Y��+A�?�C(5.]M?�]E6=4��Æ]�9�? ]Uy4�G�6�Ah<

Z\9+6 YM��N�D+�[�Q9+68]E9+68C~? D ?�CEv+NB]ECM? C��2��4iC�U~�+A-?kNBD ]�9+6k68 �]�6�D�G�6 G�A-? D+���p?���6;9+4�A�G+5=NBD ?��iNBq$68D��4iC�A�G 4��#?2��N�q$68DqC�CENB7+�$6;5.]�C��pY�]��+CE6F9�?i5{].��4 Y�4�UX7�4iD+68D�]M50l �L6 9p?�q$6;]�4�v�6�?�v+A�6 ]E4 YM9+6 YM��Q9+68]E9+68CÐ*-,+,�!3/+�EMN����,�?%Nm<r6$<�_���D�4��QA�6 G��i68fË��CE686F��4�CEU{��A-?�5 D 9+4iA-G NBD ? �iNBq$68D 5.]M? ]�6q?%��6�Y�?�ABA�]�9+N�5*-,+,�!3/+�EMN���qIKJL!$IK��MN��% D _�?�DpG YM9+6 YM���Q9+68]�9�68C����i�����"!$#&%'!=��4�CEU{��A-?�5)?%Nm<r6$<�_|��4iC�U~�+A-?i5#4 �@]E9+6y��4�C�Uí ä R D 9+4�A�G N�D ? ��NBq$6�D 5.]M?�]E6$< O%����6 Y8?�D�G�4 v�4�]E9 4��~]E9+6 5J6�]M?i5J��5�_@]E9+68D �L6�Y8? D 9p?�D�G�A�6?�CEv+NB]ECM? C��@��4�CEU{�+A�?�5�v���NBD�G��pY�]�N�4�D�4iD=]�9+6Æ5J]EC���Y�]E�+C�6L4���]�9�6o��4�CEU{��A-?�< ^ N�D�Y�6LYM9+6 YM��N�D+�Q�Q9+68]E9+68C�?��D+4 �QAB6 G��i6��4iC�U~�+A-?@9+4iA-G+5\NBD�q$4�A�q$6 5bU$��?�D�]�Nl6�Y8?�]ENB4iD{4 q$68C\]�9�6@7�4$5�5.NBv+A�6@��4iC�A�G+5�_�]�9+6�Y�4�UX7+AB68 �NB].�

c8d

Page 14: Model Checking vs. Theorem Proving: A - Cornell University

4�� Uy4�G�68A�Y¢9+6�Y¢��NBD+��G�687�68D�G+5k4�DB?h?�DpG N�5V].��7+N-Y�?�ABA���7�4�A���D+4iUyN-? A@NBD ]E9+6�7+C�4�G��pY�]k4�� D ]E9+C�686U$��?�D�]�N�]�NB6�5�l�]E9+6~Y�4�UX7+AB68 �NB].�=4 �Q?i5�5.68C�]ENB4�D YM9+6 YM��N�D+�+_�]�9+6~5.N"\86�4��L]�9+6=�iNBq$68DGC@C�N�7+�$6=5.]�CE��Y�]���C�6$_?�DpG�]E9+6~5JN�\86�4 ��]E9+6���4�CEU{��A-?�<���9��p5�_�4��+C�?�v+N�ABNB].�k]�4;G�4XUy4�G�68A�Y¢9�6 Y¢��NBD��=6n7kY0NB68D�]�A��kG�687�68D�G�5Y�CE��Y�N-? ABA�� 4iD24i�+C�?�v+N�ABN�]J�;]�4;G�4;?�5E5J68CE]�N�4�D Y¢9+6�Y¢��NBD+�~6n7VY�NB6�D�]EAB�k? D�G�4i�+C�?�v+N�ABN�]J�;]�4;G�6 ? A��QNB]E94�A�?�CE��6�5~5J]EC���Y�]E�+C�6�5�<

Æ+4�CQ7+CE4�7�4$5.NB]�N�4�D�? A�A-? D+����? ��6 50_�?�5E5J68CE]�NB4iD;Y¢9+6�Y¢��NBD+��N-5�U$�+N�]�6@6 ?i5J��l�NB]LY8? D v�6(G�4�D+6(NBDXABNBD�6 ?�C]�N�Uy6$< R@G+G�NBD+�(Uy4�G+? ABN�]�NB6�5���4�CL��D+4 �QA�6 G���6�G�4$6 5�D�4�]Q5.NB�iD+N86�Y�?�D�]�AB�~Y04�Uy7+A�N-Y8? ]�6L]�9+N�D+�$50<�rTN�q$68DX?6�D+N�]�6�C@C�NB7��$6@5.]�C��pY�]��+CE6@� Ó9?ßÞfØ+àbØ$á { Ø&â&â&â3Ø1á ã�D _�G�6n6�D+6 ì"ì � ì"ì ]E4�v�6@]E9+6(5J��U 4 � ]�9+6@D��+U~v�68C4���5J]�?�]�6�5oNBD�Þ�?�D�G=]�9+6�D��+U{v�68C 4��|7�?�N�CM5\NBDHá ä _�èbÓ c�Ø&â&â&â&Ø¢È�< ��9���5�_ ì"ì � ì"ì N-5\?@Uy6 ?�5.�+C�6Q4 ��]E9+65JN�\86�4���]E9+6�C�CENB7+�$6�5J]EC���Y0]��+CE6Z��< O`6�] ì R ì v�6@]�9+6�AB6�D+��]E9{4 ��R�_$q�N�68��6 G=?i5�?�5J]�CENBD+��4���5.��U~v�4�A-50<

"(� ���\���8�-/ �����T���=��& �<JL!K/K!�M8,×*��A*���%���/3M"�NJiF �NJi*��xIKJL!$IK�&,�M ��*×.0/$�n.��-,�M"��MN����*�������/3FHÜu�l*GR M8,,�*���M8,��>!$#�MN��*�,3�E/3Ü�In�EÜ�/K!�� �y�<JL!x*���%���/3M"� JiF�/nÜ��u,QMN�×��MNF�!M�x? ì"ì � ì"ìg�Vì R ìÛD �

"(� ���p,�&�O`68]YR { Ø�â&â&â3Ø+R���v�6T]E9+6�5J�+v���4iC�U~�+A-?i5�4���RL_�ABN�5J]�6�G�NBD~4�CMG�68C\4���A�68D+�i]�9�_$�QNB]E9{]ENB6 5 v+C�4i�$68D?�CEv+NB]ECM? C�NBA��$<G��9���50_���6y9p?�q$6}R��×Ó�R�_\? D�G2N���RXä�N�5�?[5J��v���4�CEU{�+A�?y4���Rhô�_�]�9�68DkèP�Bõ�<£O¯](N�56 ?i5J��]E4�Y¢9+6�Y¢�[]E9�?�]=]E9+68C�6V?�C�6;? ]=Uy4$5.] ì R ì 5J�+v���4iC�U~�+A-?i5#4 �@R�_L5J4[�L6yU~��5J]�9�?8q$6�É�� ì R ì <RTD;6 ?�5.� N�D�G���Y0]�NB4iDF4iDVÉn.�5.9+4 ��5T]�9�? ]@��6 Y8?�D;A-? v�6�A�6 ?iY¢9£5J]�?�]�6)ñ�N�D�� �QN�]�9�R ô 4�C ù R ô _p��4iCõ�Ó�c�Ø&â&â&â3ØnÉn.�_�G�687�68D�G�N�D+�=4�D;�Q9+68]E9+68CQ4�C�D+4i]�R ô N-5�]EC��+6�?�]�ñ$_+NBDy]ENBUy6}�S?�Én. ì�ì � ì�ìÛD < ��9�6#4iD+AB�D+4iD�]EC�NBq�N-? A Y8?�5.6(N-5QN��aR ô N-5�4 �\]�9+6(��4�CEU�í ä R ô�� _��Q9+68C�6�õn.��Îõ�<\�26�A-? v�6�A ?{5.]M?�]E6Hñ(�QNB]�9�í ä R ô��N���6�?�YM9F5.]M? ]�6Sò�5.��YM9 ]E9�?�]x?Eñ�Ø1ò D�ë á ä N-5�A�?�v�68AB6�GV�QN�]�9�R ô�� <QR�5�5J��UyNBD+�=N�D�G���Y0]�NBq$6�AB�=]�9p?�]@6 ?iY¢95J]�?�]E6{9�?i5�? ABC�6�?�G��;v�6�68D2A�?�v�68A�6 GF�QNB]E9VR ô � 4iC ù R ô � _�]E9+N-5(5J]E687 Y8?�D Y�AB6�?�C�A��kv�6XY8? C�C�N�6 GF4���]#N�D]�N�Uy6��S? ì"ì � ì"ìÍD _�?�5�G�6 5.NBCE6 G`<

��9+NBD��$5T�i68]@Uy4iC�6�Y�4�UX7+ABN�Y8?�]E6 G{4�DpY�6=��6�Uy4 q$6@]�4�6pCM5J]Ef%4iCMG�6�C@A-? D+����? ��6 50<S=�q$68D;?i5�5J6�C�]�N�4�DYM9+6 YM��N�D+�TUV?��(v�6�G�Nl7kY���AB]8< O%����6�Y�4iD�5JN�G�68C\5.]�CE��Y�]���C�6 5��QN�]�9~NBD'6pD+NB]E6QG�4iUk?�N�D�5�_�N�]�N-5 D+4�]L?�A��Q?8��5Y�A�6 ?�C�9+4 ��]E4@C�6�7+C�6 5.68D�]�]�9+68U£_�AB6�]�? AB4�D�6QG�4�?�5E5J68CE]�NB4iD=YM9+6 YM��N�D+�+<k�x=Óq$6�D#N�����6\CE6 5J]EC�N-Y0] ?�]�]E68D�]�NB4iD]�4 5J]EC���Y�]E�+C�6�5Ó�QN�]�9H6�D+N�]�6�G�4�Uk? NBD�50_�?�5�5.68C�]ENB4iDkY¢9�6 Y¢��NBD��@Uk?8��v�6�q$68C�� G�N87VY��+A�]\G��+6@]E4�][email protected]"\864���]�9�6�G�4�Uk? NBD�<�O¯Dk�i68D+68C�?�Ah_+]E4~Y¢9�6 Y¢�=]E9+6(]�CE�+]�9k4��o?#��4�C�U~�+A�?�5J�pY¢9k?i5I�hîLR�?Eî D _$�L6@Uk?8�{9p?�q$6]�4XYM9+6 YM�=]�9+6(]�CE�+]�9k4 �YR�?-| D ��4iCT6�?�YM9FG�4�Uk? NBDy68A�68Uy68D�]�|+<

=�q$68D{N�� ?i5�5J6�C�]�N�4�DkYM9+6 YM��NBD+�@N�5o6 ?i5J�$_$�L6@5.]�NBA�A�9�?8q$6Q]�4=Y04�7�6@�QNB]E9y]�9�6TU~�+AB]ENB]E��G�6�4 � 7�4$5�5.NBv+A�6��4iC�A�G+5�<�Æp4iCF68 �?�UX7+AB6$_LNBD ]�9+6 Y�4�D�]�6� �]k4�� NBD�Y04�Uy7+A�68]�6;��D�4��QA�6 G��i62v�?i5J6 50_@]�9+6�D��+U{v�68CX4��7�4$5E5JNBv�AB6@�L4�C�A�G+5QY8? Dyv�6@68 �7�4iD+68D�]�N�?�A`N�D{]E9+6(5.N"\86@4 � ]�9+6���D+4 �QA�6 G���6�v�?�5.6$_��Q9+N�Y¢9~Uk? �$6 5 UÛ�+6�C��68qi?�A���?�]ENB4iD�NBD�]�C�?�Y�]�?�v+A�6 � KL? CMG�Nm_�c8a���g � <{��6{D+4i]�6$_ 9+4 ��68q$6�C8_�]�9�? ](]�9+6{�m?iY�](]�9�? ]�]E9+6{D��+U~v�68C4���7�4$5E5JNBv�AB6��L4�CEA-G+5�N�5>UÛ�+N�]�6@A�?�CE��6�G�4$6 5QD+4�]�? �+]�4iUk?�]EN-Y8? ABA��=Uy6 ?�DX]�9�? ]TN�]�N-5�9p?�CMGk]�4~YM9+6 YM�y? ABA��D+4 �QAB6 G��i6 ��4iC�U~�+A-?i5�<}��9+6{CE6 5J��AB]M5(4�� � Ì �L4�C�� ?�DpG�HF4$5.6 5�_Lc8a�aie';\HF4I5J6 5(?�DpGÎ���+]E]�AB6I_oc�a���� �G�68UX4�D�5.]�CM? ]�6;]�9�? ]k5J4iUy6k��D+4 �QA�6 G���6k��4�CEU{�+A�?�5=4��(N�D�]E68C�6�5J]XY8?�D v�6[6�q�? AB��? ]�6 G 637kY�N�68D�]�AB�[N�DY�68CE]M? NBD;Y�4�D�]�6� �]�5�G�6 5.7+NB]E6�?�DF6� �7�4�D�68D�]EN-? A`D��+U{v�68CL4���7�4$5�5.NBv+A�6��L4�C�A�G+5�<

� 9�?�]�Y8?�D[�L6=G�4y]E4yG�6 ?�A��QN�]�9£5JNB]E��?�]ENB4iD�5T�Q9+68CE6�]E9+6�D��+U~v�6�CQ4��\7�4$5E5JN�v+AB6=�L4�C�A�G+5Q4�C@]E9+6D��+U{v�68C�4��G�4�UV?�NBD[6�AB68Uy6�D�]�5�N-5T]E4$4FA-? C��i6{]E4 9p?�D�G�A�6�`���9+6�C�6~?�CE6y?yD��+U~v�6�CT4 ��?�7�7+C�4I?�YM9+6 5� ó�°�¬h°.±8«+ø�´�ª�õ8¨ � b�©¢± °.®w®�©Mõ8§w¨�Àh¸�¼M½pq�ß0â�ã0ã��-��b�©(8�©M± ÝE©�Àh¸�¼¢½kq�ß8â�ã0ã�� ¡ ©�× ×8ª�°J¨�¨+¨�µ�°E¬h§�©M® ¬.©¢¨�°.¨�´MÜi©M¨%¨�°.ª%«�§w´0±Q¬%¦ °E¬%õ8§�±�ù

Ü�´�ª�§�±C�i± §w«�°�¨�«�ª � ¬h« � ª�°.¨�Ø

c&£

Page 15: Model Checking vs. Theorem Proving: A - Cornell University

4�D�6�Y�4i�+A-G 7+�+C�5J�+6I<�Æp4iCk4�D+6�]�9+N�D+�+_@�L62UXNB��9�]~9+4�7�6�]E4 v�6�? v+AB6�]�4V6�DpG C�6 5.]�CEN-Y�]E6 G�?%v+��]5J]ENBA�AoN�D�]E68C�6�5J]�N�D+� D 5.�+v�Y�A-?i5�5J6�5 4 �Q��4�C�U~�+A�?�5T��4�C=�Q9+N�Y¢9 ��6kY8? D G�4[Uy4�G�68ALY¢9+6�Y¢��NBD+�k6n7VY�N�68D�]EAB�NBD�Y068C�]�?�NBD;C�6 5.]�CEN-Y�]E6 G?�v+�+](5.]�NBA�A�N�D�]E68C�6�5J]�N�D+� D 5.�+v�Y�A-?i5�5.6 5@4��Æ5J]EC���Y�]E�+C�6�5�_'Ô.��5.](?�5@�L6�D+4 ��9p?�q$6]�6�Y¢9+D�NNU$�+6 5���4�C�G�4iNBD+�@N�D���68CE68D�Y�6�637kY�N�68D�]�AB���QNB]E9=Y�6�C�]M? NBD 5J�+v�Y�A�?�5�5.6 5�4 �+��4�CEU{�+A�?�5b?m5J��YM9=?i5�>T4�CEDY�A�?���5.6 5 D <�OhD�G�6�6 G`_+O ^ fmR ��4�CEU{�+A�?�5Z?��Q9+N-YM9y6 5E5J68D�]�N�?�ABA��yY04�C�CE6 5J7�4iD�GF]�4X>T4�CED;Y�A-? ��5J6 50_�?�A�]�9+4i�+��95J6�6@�rP�C�?�YM9+Uk? D�_$c8a���b-����4�C\5.4�Uy6LY8?8q$6 ? ]M5 D Y8? D=v�6ÆY¢9�6 Y¢�$6�GTq$68C���6n7kY0NB68D�]�A��TN�D=O ^ fmR 9+N�68CM? CMYM9+NB6 50<

R)5.6 Y�4iD�G ?�7�7+C�4I?�YM9 N-5y]�4 Y�4�Dp5JN-G�68Ck9+68�+CEN-5J]EN-Y85X?�D�G G�6��m?��+A�]M50< ^ N�D�Y�6�]�9+6 G�N87VY��+A�].� N�DUy4�G�6�A@YM9+6 YM��N�D+��?�CEN-5.6 5{�Q9+68D �L6[9�?8q$6FA�?�C��i6�5.]�CE��Y�]���C�6 5y? D�G� �4�CkA-? C���6�G�4�Uk? NBD�50_�L6FD+6�6 G��4$4�G[9+68��C�N-5.]�N�Y85Æ��4iCT9p?�D�G�A�NBD+�V5J��YM9[5.NB]��p?�]�N�4�D�50<T��6�N�DV�m?iY�]@��5.6=5.��Y¢9;9+68�+CEN-5.]�N-Y�5Q?�ABA ]�9�6�]�N�Uy6NBDX4��+C�G+?�N�AB�~ABN���6$<fÆp4iCQ68 �?�Uy7+A�6$_�N�� ]�9+68CE6�?�C�6�]�4$4~Uk?�D��=7�4$5�5.NBv+N�ABN�]�NB6�5c?%Nm<r6$<�_$]�4$4~Uk?�D��=7�4$5�5.NBv+A�6��4iC�A�G+5 D _`��6(��4�Y���5@? ]�]�6�D�]ENB4�D;4�D[4iD+AB�£? ��68� ?�]�9+6�4�D+6 5���6~G�686�U ]�4yv�6=]E9+6�4EUy4$5.]@C�68A�68qi?�D�]+5?�Y�Y�4�C�G�NBD+�k]E4[5J4iUy6=Uy68]EC�N�Y#4�CG4�Uy4I5J]@A�NB�$68A���5~?�Y�Y�4�C�G�NBD+�;]�4;5J4iUy6~7+C�4iv�?�v+N�ABN�]J�£G�N-5.]�CENBv+�+]ENB4iD D _NB�iD+4�CENBD+�~]�9�6�C�6�5J]8<QZ\4�Dp5JN-G�68C@?~5JN�]���? ]�N�4�DF�Q9�68C�6 RTABN�Y�6@N-5Q?i5J�$6 GkN���?h5.9+6���D+4 ��5]E9�?�] D R N-5�]E9+6Y8?i5J6$<���4�?�Dp5J��6�C=]�9+N�5SU$�+6 5J]ENB4iD�_�RTA�N-Y�6~��4i�+A-G�9�?8q$6{]E4�Y¢9+6�Y¢��? ABA\]�9+6X��4�CEA-G+5=5.9+6kY�4iD�5JN�G�68C�57�4$5E5JNBv�AB6F]E4�5.686kN��xR 9+4iA-G+5=NBD ?�A�AQ4��(]E9+68U[<k��9+6�C�6FUV?���v�6�c�ØMe�eie'ØMeie�e���4iC�A-G�5 ]E9�?�]XRTABN�Y�6Y�4iD�5JN�G�68CM5�7�4I5�5.NBv+A�6$_`�Q9+N�Y¢9;Uy6 ?�Dp5]E9�?�](5.9+6=9�?i5#?~AB4�]�4��ÆY¢9�6 Y¢��NBD��{]E4kG�4+<�>T4 ��6�q$68C8_+N��LRTABN�Y�69�?i5=?F7+C�4iv�?�v+N�ABN�]J� 5J7p?�Y�6y4iD ]�9+6 5.6k��4�CEA-G+50_�]�9+6�D�]�9+6�C�6yUk?8�[v�6;?[5J�+vp5J68]=4 ����4�CEA-G+5�4 �(5.N"\86c�Ø�e�e�e~]�9�? ]T9�?i57�C�4�vp?�v+N�ABNB].�Gâwaia�<LRTABN�Y�6(Y�4i�+A-GkYM9+6 YM�{]E9+6 5J6~c�ØMe�eie{��4iC�A-G�5n;+N��aR�9+4�A�G+5QNBD;?�A�A�4��]�9�68U[_`]E9+68D�]�9+N�5#UyN���9�]Tv�6y]�?��$68D ?�5�5J�'7VY�NB6�D�]�4E68q�N-G�68DpY�6�5 ��4iC=RTA�N-Y�6�]�4[5E?8�2]E9�?�]xR N�D�G�686 G9+4iA-G+50<c=�q$68Dk�QN�]�9+4i�+]@68 �7+ABN�Y�NB]\7+CE4�v�? v+NBA�NB].�$_�RTA�N-Y�6�UyNB�i9�]Æ5J]�N�ABA�9�?8q$6�?{D+4i]�N�4�DF4 �L�Q9+N-YM9k4��\]E9+6c�Ø�e�e�e�ØMe�eie �L4�C�A�G+5�?�C�6�Uy4$5.]TA�NB�$68A��{4iCTUX4$5J]�C�6�AB68qi?�D�]8< ^ NBUyN�A-? C�AB�I_ÛN��\��6(9�?8q$6 ?{A-? C���6 G�4�UV?�NBD?�DpG �Q? D�]~]�4 YM9+6 YM�2]E9+6F]EC��+]E9 4 � ?£��4iC�U~�+A-?;5J��YM9 ?i5H�hîeRY?Eî D _��L6FY�?�D �p5J6F9�68�+C�N�5J]EN-Y85�?�D�GG�6��m? �+AB]�5]E4yY0�+]�G�4 �QD[]�9+6�5.6 ?�C�Y¢9£5J7�?iY�6�?�7�6�C�9�? 7�5TYM9+6 YM��NBD+�QR�?-| D ��4iCT4iD+AB�V? ��68�¡7�4i]�68D�]�N�?�A�AB�4M? v+D+4iC�Uk? AN5~G�4�Uk? NBDy6�AB68Uy6�D�]�5 D <

:\68](?�D�4�]�9�68C�?�7+7+CE4$?iY¢9���4i�+A-G[v�6{]E4y9�?8q$6~?yD+4�]ENB4�D�4��Æ�Q9�?�]@��6 ? ]��+CE6 5(?�CE6�4�C�6�AB68qi?�D�]+5y]E4]�9�6@7+C�4iv+AB6�U[_�?�D�GyN-G�68D�]EN����~? ABA`�L4�CEA-G+5�]E9�?�]�? ��C�6�6#4iDkNBC�CE68AB6�q�? D�]���6 ? ]��+CE6 5�_�]�9���5QY��+]E]�N�D+�~G�4 �QD4�D~]�9�6Q5J6�?�CMYM9~5J7p?�Y�6$<\P�6�NBD+��?�v+A�6Q]�4(G�4#]E9+N-5�G�687�68D�G+5 v�4i]�9~4�D~v�68NBD+��?�v+A�6Q]�4(N-G�6�D�]EN����@CE68AB68qi? D�]D+4i]�NB4iD�5Q?�DpGV4iDyv�68NBD��~?�v+A�6T]E4~Y¢9+6�Y¢��C�68A�68qi?�D�]Ó��6�?�]���C�6 5\CM?�7�N-G�A��$<�r�4�NBD���v�?iY¢�~]�4=4i�+C�7+CE68q�NB4��p568 �?�Uy7�AB6$_i5J�+7�7�4I5J6@R�N-5\?@7+C�4i7�4I5JN�]�NB4iD�?�A���4�CEU{�+A�?@5J�pY¢9X?�5�?"] { ö ]�ú DY� ? ù ]�ú ö ]'û D _$�Q9+68C�6Y] { _�]iú8_?�DpG�]'û�?�CE6�7+CENBUyN�]�NBq$6�7+CE4�7�4$5.NB]�N�4�D�50<(Oh]@N-5Q6 ?�5.�k]�4k5.686�]E9�?�]@R N�5]EC��+6��+D+A�6 5�5�] { ?�DpG[?�]@A�6 ?�5.]4�D�6�4��ï]�ú�4�CY]'û�?�C�6(�m?�A�5J6$< ��9+6(]EC��+]E9Fqi?�A��+6 5�4��o?�ABA�4i]�9+6�CQ7+C�4i7�4I5JN�]�NB4iD�5@? C�6=Y0AB6 ? C�AB�=N�C�CE68AB68qi? D�]]�4X]�9+6(]�CE�+]�9[4 �YR�< Ì 687�68DpG�NBD+�X4�DF9�4���RTA�N-Y�6I�w5o7�4I5�5JN�v+AB6���4iC�A-G�5@?�CE6�C�6�7+C�6 5.68D�]�6 G`_+N�]QUk?8�yv�6]�9p?�]�RTABN�Y�6@Y�?�D;Y¢9�6 Y¢�=]E9�?�]�RTA�N-Y�6�G�4$6 5QD+4�]�Y04�D�5.N-G�68C�?=��4iC�A�GV7�4I5�5JN�v+AB6(�Q9+6�C�6�] { ?�D�G;?�]QA�6 ?�5.]4�D�6{4 � ]�ú�?�D�GG]'û=? C�6=�m?�A�5J6$_��QNB]E9+4���]�YM9+6 YM��NBD+�X?�A�AQc�ØMeie�e�ØMe�eie�7�4$5E5JN�v+AB6~��4iC�A-G�5�<=�26~C�6�Uk?�CE�]�9p?�]o��4iC�Uk? ABN�5JUk5`��4�CL68 �7�C�6 5E5JNBD���? D�GyC�6 ?i5J4iD+NBD+���QNB]E9{N�C�C�6�AB68qi?�DpY�6Q9�?8q$6Tv�686�DkG�68q$68A�4�7�6 G`_iv�4i]�97+CE4�v�? v+NBA�N-5J]EN-YZ?-��4�C�6� +? Uy7+AB6I_��Í_�6 ?�CEA�?�DpG{K\68C�Uk?�_+c8a��up�� D ? D�G{D+4iD+f�7+C�4iv�?�v+N�ABN�5J]�N�YH� ^ �+v+C�?�Uk? D+N-? D?�DpG�r�68D�6 5J68CE68]�9|_`c8a��up��._�v+�+]Q]E9+N-5\N-5Q? DF? C�6 ?��Q9�68C�6@U~��YM9 ����C�]�9�68C��L4�C��~C�6�Uk?�N�D�5o]E4�v�6�G�4�D+6I<

R@5 ?�ABA$]E9+6 5.6�? 7+7+CE4$?�YM9+6 5 5J9�4��(_iU{��YM9�G�687�68D�G+5�4�D�7+C�6�Y�N-5.68AB��9+4 ��]�9�6o�L4�CEA-G+5�? C�6��i68D+68C�?�]E6 G?�DpG#C�6�7+C�6 5.68D�]�6 G`<ïÆ�NBD�G�NBD+��? 7+7+C�4i7+C�N�?�]E6�C�6�7+C�6 5.68D�]M?�]ENB4iD�5`N-50_�4 ��Y�4���CM5J6I_�?QUk?-Ô.4iC`4�7�68D�7+C�4iv+AB6�U[<

R ��C�6�?�]~G�6 ? AQ4��(60�`4iC�]~NBD�]E9+684iC�68U 7�C�4 q�N�D+�[9�?i5 v�6868D 68 �7�68D�G�6�G 4iDV6�D�G�N�D+�29�68�+C�N�5J]EN-Y85]�9p?�](��4iC��F�L68ABA���4�C(]E9+6���4�CEU{�+A�?�5Q]�9�? ]�?�C�N�5J6=N�D27+C�?�Y�]EN-Y�6I<(RTD�?�A�4��i4���5.AB�$_�NBD[UX4�G�68A�Y¢9+6�Y¢��NBD+��_NB]���4i�+A-GFv�6���5J6�����A�]E4�6�D�GF9+6��+C�N�5J]�N�Y85�]�9p?�]@�L4�C��;��68A�A`��4�C(5.]�CE��Y�]���C�6 5Q]�9�? ](?�CEN-5.6�NBD;7+CM?iY�]�N�Y�6$<

cn¤

Page 16: Model Checking vs. Theorem Proving: A - Cornell University

RTA�]�9+4i�+��9 ]E9+6[��4iC�� 4iD UX4�G�68A�Y¢9+6�Y¢��NBD+�[N�D ]�9+N�5{C�6��$?�C�G N�5y5J]ENBA�ATN�D NB]M5~NBD��m? D�Y��$_Q]�9�6[6 ?�CEAB�C�6�5J�+A�]M5�? 7+7�6 ?�C�UÛ�+N�]�6Q7+CE4�UyN�5JN�D+�)�ë>T4�A�]1\8UV?�D+D�_�c8a�����;+P��+C�Y¢9�!+�a*��"��_�c8a�aid-�.<�Æp4iC\68 +? Uy7+A�6$_��Q9�68Dq$68CEN�����NBD+�kY0NBCMY0�+NB]�5�_��L6y? C�6yD�4�]~G�6 ? ABN�D+�F�QN�]�9 ? C�v+N�]�CM? C��ÐC@C�NB7��$6~5J]�CE��Y�]E�+C�6 50<���9+6yCE68����A-?�CENB].�NBDk]E9+6�5J]�CE��Y�]E�+C�6�5J������6�5J]M5�9+68�+CEN-5J]EN-Y85\]�9�? ]@5.6868U ]E4{�L4�CE�y��68A�A`N�DF5.]�CE��Y�]���C�6 5��QN�]�9F��7 ]E4Fc�e ú-�5J]�?�]E6 5S�ëP��+C�Y¢9k!+��*��"��_�c8aia�d���j

� ��Y�4��+C�5J6$_ ]�6 YM9+D+N UÛ��6 5@D+686 G[]�4;v�6;G�6�q$68AB4i7�6�GF]�4�?�A�AB4 ���p5�]�4F�p5J6y]E9+6 5J6~9+68��C�N-5.]�N�Y85(?�D�GG�6��m? �+AB]�5@NBD ?V7�C�NBDpY�NB7+A�6 GF�Q?8�$<~HF��YM9[4���]E9+6=C�6�Y�68D�]@��4iC��[NBD�4�q�NBq�N�����NBD���5yY8? D2v�6yq�NB6���6 G;?�5v�68NBD�� N�D[]�9+N�5@5J7�NBC�N�])��=�]�9+68CENBD+�i]�4iDç!+��*��"��_\c8a���a�;XO`6�q$6 51U$�+6$_ c8a���g-�E<x��9+6=N-G�6�?VN�5T]�4VY��+]�G�4 �QD4�D;]�9+6(D��+U~v�6�C�4��Ó7�4I5�5.NBv+N�ABNB]ENB6 5\v��)6�ABA�NBD+�=N�DF5.4�Uy6Q?%9+4i7�60���+ABA�� D N�D+6 5�5.68D�]�N-? A G�68]�?�NBA�5�<���4�CE� 4iD?F7�4$5E5JNBv�AB68f���4iC�A-G�5 ��C�?�Uy68�L4�CE����4iC=7+C�4iv�?�v+N�ABN�]J� � PQ?iY8YM9���50_�c�a�a�e�;>Æ�?��iNBD ?�D�G >@? AB7�68CED�_Tc�a�a�c�;>@? AB7�68C�D|_�c�a�a�e�;f^TNBA�5�5J4iD�_ c8a��ig � Uk?8�y7+CE4 q�N�G�6(NBD�5.NB��9�]M5�NBD�]�4~��5JN�D+�y7+CE4�v�? v+NBA�N-5J]EN-Y(9+68�+CEN-5J]EN-Y85�N�D?=7+C�N�D�Y�NB7�AB6 G=�Q?8�y]E4yY���]�G�4 �QD ]E9+6�5J6 ? CMYM9;5J7�?iY�6$<

^T4�]EN-Y�6=]E9�?�](v��[��5JN�D+�;G�6��m? �+AB]�5�N�D2]E9+N-5��Q?8�$_���6X?�CE6{A�6 GFD�?�]E�+CM? ABA��[]�4kD+4�D�Uy4�D+4i]�4iD+N-Y�N�].�$<>T4 ��6�q$68C8_8C�?�]�9�68C�]E9�?�D=]E9+6��l�+%�MNI�v�68NBD+��D+4iD+Uy4�D�4�]�4iD+N-Yi_�]�9+6LUy4�G�68AIY¢9�6 Y¢��NBD��QN-5�D+4�D+UX4�D+4i]�4�D�N-Y�<��6TUyN���9�]��QNB]E9�G�C�?�� 5.4�Uy6�4�� 4i�+CQY04�D�Y�A���5JN�4�D�5\? v�4i�+]�?���4iC�U~�+A-?@v�68N�D+�(]�C���6@NBDX?#�iNBq$68DX5J]EC���Y�f]���C�6�N��L��6��i68]T���+CE]�9+6�CTN�D���4�CEUk?�]ENB4�D;]�9�? ]@AB6�?�G+5Q��5T]E4yv�68ABN�68q$6(]�9�? ]@]�9+6~G�6��m?��+A�]@?i5�5.�+Uy7+]ENB4�Dp5��6(��5.6 Gy]�4X5JN�Uy7+ABN�����]E9+6(Uy4�G�68A�fhYM9+6 YM��N�D+�(7+C�4iv+AB6�U ? C�6�D�4�]�Y�4iC�C�6�Y�]8<

� � ����ªQ¬� ÿ�¨ ��ªS§������>�ªZ­g�k�T��ÿ��ªS� ¯H¨)ª ÿT��§

R@5yN-5~��68A�A@��D�4��QD|_T]�9�6�5.]M?�DpG+?�C�G 7�4$5�5.NBv+A�68f���4�CEA-G Uy4�G�68A���4�Ck��D�4��QA�6 G��i6�5J����68C�5V��C�4iU ]E9+6AB4i��N�Y8?�A�4iUyD+N�5�Y�N�68D�Y�6@7�C�4�v�AB68U[lÆ?���6�D�]�5���D+4 ��?�A�A�]M? �+]�4iAB4��iNB6 50_ ?�D�GF��D+4 ��?�ABA�]�9+6=A�4���N�Y8?�AÓY�4�D+f5J6�UÛ�+6�D�Y�6 5�4 �(]�9+6�NBC���D+4 �QAB6�G���6Ð?%]�9p?�]~N-5�_\��6k9�?8q$6k]�9�6 N�D���68CE68D�Y�6yCE�+AB6k4.��C�4�U R NBD���68C)í ä R�5?�DpG ]E9+6[?  �N�4�U 4¢í ä R � í ä ?ER [ z D [ í ä z�5 D <9��9+6[A�4��iN-Y8? A@4�UyD�N-5�Y0NB68D�Y06y7+C�4iv+AB6�U 9p?�5v�6868D�q�NB68�L6 G ?�5�? Uk?-Ô.4iC[5.9+4�CE]MY�4iUyNBD+� 4 �y]E9+6 7�4$5�5.NBv+A�68f���4�CEA-G ��CM?�UX68��4iC���< KL? C�NB4i��5[?�]Ef]�6�Uy7+]M5�9p?�q$6;v�6868D Uk?iG�6F]E4�4 q$68CMY�4iUy6yN�]�?m5J686$_���4iCy68 �?�Uy7+A�6$_ � Æ�? ��NBD ? D�G >@? AB7�68C�D|_#c�a����';O`68q$6 5$UÛ��6$_�c8a��-¤�v � ?�D�GF]E9+6�CE6���68CE68D�Y�6 5\]�9+6�C�68N�D D <>��9�6�AB4i��N�Y8?�A 4�UyD�N-5�Y0NB68D�Y06T7+CE4�v+A�68U N-5�5J4iUy68f�Q9�? ]{]ECM?�Dp5¯��4�CEUy6 G2�Q9�68D q�N�68��6 G[��C�4�U ?FUy4�G�68A�fhYM9+6 YM��N�D+�y7�68C�5J7�6 Y�]ENBq$6$< R@5���6yUX68D�]ENB4iD+6 G6 ? C�ABN�68C8_\NB]=N�5 D�42A�4�D+�i68Cy5.4��+D+CE6 ?�5.4�D�? v+AB6[]E9�?�]X?�D ? ��68D�]~��D+4 ��5~?�A�AQ]M?���]�4�A�4��iNB6 5�?m?�A�]�9+4i�+��9]�9�6y? ��68D�]��QN�ABA\].��7+N�Y8?�A�AB�kD+4i]=��D+4 ���Q9+N-YM924 ��]�9+6XUk?�D�� ��4iC�U~�+A-?i5TNB]���D+4 ��5(]�4Fv�6y]EC��+6X?�CE6NBD��m?iY�]=]M? �+]�4iAB4��iNB6 5 D <k^T6�q$68C�]E9+68AB6�5�5�_ ?i5 �L6y4�v�5.68C�q$6�G 6�?�C�A�NB68C�_�Uy4�G�68AQYM9+6 YM��N�D+�;Y8?�D ? A-5J4�v�6NBD�]�C�?�Y�]�?�v+A�6$<;O¯]�Y8? D 5J]�N�ABA\v�6y]�9�6kY8?�5.6$_��iNBq$68D�4���C~G�6n6�D+N�]�N�4�D�_ ]�9�? ]~?�D ? ��68D�]=Y8? D94���D+4 ��5[?��4�CEU{��A-?T�QN�]�9+4i�+]\v�6�NBD+��?�v�AB6�]�4=Y04�Uy7+��]�6�]E9�?�]LNB]\��D+4 ��5Ó]E9+6Q��4�C�U~�+A�?�<f��9+N-5\Y8? D{v�6@q�NB6���6 G�?�5]�9�6#CE68NBDpY8?�CED�?�]ENB4�Dk4 �\]�9+6(A�4���N�Y8?�A�4�UyD�N-5�Y0NB68D�Y06T7+CE4�v+A�68U N�Dy]�9+6(Uy4�G�68ABfmY¢9�6 Y¢��NBD�����C�?�Uy6���4�CE�`<

��9+6 5J4���CMY�6[4 �=]�9�6[7+C�4iv+AB68U N-5{4i�+C;G�6n6�D�NB]�N�4�D 4 ����D+4 �QAB6�G���6�?i5V]EC��+]E9 N�D ?�A�A@7�4$5�5.NBv+A�6��4iC�A�G+5�<G��9+N-5=G�6n6�D+N�]�NB4iD�G�4$6 5�D+4�]�]M? �$6yNBD�]�4;?�Y�Y�4��+D�]�]E9+6kY�4iUy7+�+]�?�]ENB4�Dp?�A\6���4�CE]�D+686�G�6 G2]E468qi?�A���?�]E6=]�CE�+]�9�NBD�? ABA�7�4$5E5JN�v+AB6=�L4�C�A�G+5�<��26=�L4��+A�G�A�NB�$6(]�4k9�?8q$6~?{��4�CEUk?�A �Q?8�F4 ��Y8? 7+]���C�NBD��]�9�6T��D+4 �QAB6 G���6�4���?@C�6 5.4��+C�Y�68f�v�4��+D�G�6 Gy?��i68D�]�NBD~]�9�6TUy4�G�68ABfmY¢9�6 Y¢��NBD����C�?�Uy68�L4�CE�`< OhD � HF4I5J6 50_c8a���� � _QHF4$5.6 5�7+C�6�5J68D�]M5=?[AB4i��N-Yy4 �(C�6 5.4��+C�Y�68f�v�4��+D�G�6 G ��D�4��QA�6 G��i6$_o�Q9�68C�6k9+6k]�CENB6 5�]E42UV?��$65J6�D�5J6�4��+]\4 ��D+4i]�NB4iD�5�5.��YM9~?�5¾4�?�DX?��i68D�]LY8? DyY04�Uy7+��]�6�RFNBD~7�4�A���D+4iUyN-? A�]ENBUy6�5�< >TN-5�?�7+7+CE4$?iY¢9N-5�q$6�C��~U{��YM9~NBDy]E9+6�5J7+N�C�NB]Q4 ��]E9+6(Uy4�G�68A�f%]E9+684iC�68]EN-Y�?�7+7+CE4$?iY¢9£?�G�q$4�Y8? ]�6 Gy9+6�C�6$_�5JNBDpY�6(�Q9�?�]QN�]

c8b

Page 17: Model Checking vs. Theorem Proving: A - Cornell University

Uy6 ? D�5o��4�C�9+N�U ]�4~v�6=?�v�AB6(]�4XY�4�UX7+�+]�6xR�NBD;7�4�AB��D+4iUyN-? A`]�N�Uy6@N�5@�����Q]�9�? ]ZR Y8?�D;v�6�7+C�4 q$6 G?%N�D[5.4�Uy6�?�7�7+C�4i7+C�N�?�]�6~?  �N�4�U 5J��5J]E68U D N�DF7�4�A���D+4iUyN-? A�]�N�Uy6$_�v��+]TC�?�]E9+68C�]�9�? ]@]�9+6�]�CE�+]�9;4���R?�]Æ?�7�?�CE]�N�Y��+A-? CL5J]M? ]�6(NBDX?=5J]EC���Y0]��+CE6(Y8?�DXv�6�Y�4�Uy7��+]�6 G=NBD~7�4�A���D+4iUyN-? A�]�NBUX6$<��@��6@NBD���4iC�Uk? ABA��G�N�5�Y���5E5�5.4�Uy6XG�68]�?�NBA�5@4���HF4$5.6 5�� AB4i��N-Y=9+68CE6k?�DpG2C�68A�?�]E6{N�]�]�4;4��+C(��CM? Uy68��4iC��0;�]E9+6yC�6�?�G�68C(N�568D�Y04��+C�?���6�G ]�4~Y04�D�5.�+AB]Q�ëHF4$5J6�5�_�c8a���������4�CQUy4iC�6(G�68]M? NBA-5Q? D�G UX4�]�N�qi?�]�N�4�D�<

HF4$5.6 5�p5J6 5Q]�9+6�G�N�5J]EC�NBv��+]�6 Gk5.�+5.]�68Uk5�UX4�G�68A�G�N-5�Y0��5�5.6 GyNBDF]E9+6(7+C�6�q�N�4���5Q5.6 Y�]�N�4�D�_+�Q9�68C�6 ?5J��5J]E68U N�5@N-G�68D�]�Nl6�6 Gk�QNB]�9 ?F5.68]@4 ��C��+D�50<~R@5@��6=Uy68D�]�N�4�D+6�GF?�v�4 q$6$_�]�9�6yG�636�D+NB]ENB4iD[4��Q�Q9p?�]NB]=UX6 ?�D�5@��4�C}í ä R ]E4[9+4�A�G ?�]X?F7�4�N�D�]~NBD ?[C��+D G�4$6 5=D+4i]{]�?��$6kNBD�]�4�?iY8Y�4���D�]~Y�4iUy7+A�68 �N�].��f]�9�684�CE68]�N�YyY�4�Dp5JN-G�68CM? ]�NB4iD�5�<���6k�Q? D�]=]E4�G�636�D+6k?[D+4�]ENB4iDÅí]�ä R �Q9+N�Y¢9 N�D�]E�+NB]ENBq$68A��[?�UX4��+D�]M5]�4Ð4M?��i68D�]@è���D�4���5�R ?�D�G`_�Uy4�CE684 q$68C8_�Y8?�D�Y�4iUy7+�+]E6�]E9+N-5Q��D�4��QA�6 G��i6=NBDF7�4iAB��D+4�UyN�?�A ]�N�Uy6$<|5$�^T4i]�N-Y06#]E9�?�]��Q9+68]E9+68C@?A?cØ(%�Ø(+ D�ì Ósí ä R G�687�68D�G+5Q4�D�AB�y4iD�% ä ?�+ D _�?��i68D�]�è���5�AB4�Y8? A�5.]M?�]E6=? ]T]E9+67�4�N�D�]}?-%�Ø(+ D <;Om���L6k5�?8��]�9�? ]~?��i68D�]QèT��D+4 ��5#9+4 � ]�4[Y04�Uy7+��]�6}R NBD�7�4iAB��D+4�UyN�?�A\]�N�Uy6$_`�L6]M? �$6=]�9+N�5@]�4kUy6 ? DF]�9p?�]��i��FH*��m��!3/H�hJi*��>,3�E*���!xèSM8,}MN�n�YèHI+*��VI+��Fc.0Ü��ß!@RL<H��4£Y8?�7�]��+CE6=]�9+N�5NBD�]���NB]�N�4�D�_���6~C�6�U$�+NBCE6=]�9�? ](]�9+68CE6{6� �N�5J](? D ?�A���4�CENB]E9+U Q ]E9�?�](�i68]M5xè��w5TA�4�Y8?�AL5.]M?�]E6k?�5(NBD+7��+]8_?�DpG2Y�4iUy7+�+]E6 5TN�D[7�4iAB��D+4�UXN-?�A ]�N�Uy6��Q9�68]�9+6�C@R N�5TNBUX7+ABN�6 Gyv��;]�9+6=A�4�Y8?�AL5J]�?�]E6$<H^T4i]�N-Y06=]�9�? ]]�9�68C�6@N�5�?=5.ABNB�i9�]L5.�+v+]�A�68].�{9�68C�6$l ��6@9p?�q$6�5�? N-Gy]�9p?�]FQ U~��5J]�C��+DkNBDX7�4iAB��D+4�UXN-?�A�]ENBUy6$_iv+�+]��L69�?8q$6�D+4�]�5E?�N-G~�Q9�?�]L]�9+6@]ENBUy6QN�5�7�4iAB��D+4�UXN-?�A�N�D�<��26�5JN�G�6 5.]�687y]E9+N-5�N�5�5J��6@v��X5JN�Uy7+A���?i5�5.�+UyNBD��]�9p?�]\�QNB]E9=6 ?�YM9=AB4�Y8? A�5J]M? ]�6$_$]E9+68C�6QN�5�5J4iUy6Q7�? CM?�UX68]�68C�;�]E9+6�Y�4�Uy7��+]M? ]�NB4iD�U~��5J]�v�6Q7�4iAB��D+4�UyN�?�ANBD ]�9�? ]y7�? CM?�UX68]�68C�<�Æp4iCy68 �?�Uy7�AB6$_\]�9+6;7�?�C�?�Uy6�]�68C~Y8? D v�6[]�9+6;D��+U~v�68C=4�� ? ��68D�]M5{N�D ]E9+65J��5J]E68U[_�?{7�?�CE]�N�Y��+A-? C�5J9�? C�6 GFN�D+7+�+]x?%]E9+N-5�N�5T? 7+7+CE4�7+CEN-?�]E6=NBD;Y�CE��7+]E4��iCM?�7�9+N-Y�?�7+7+A�N-Y8? ]�N�4�D�53;`5.686� >�?�AB7�68CED9!+�)*��"��_@c�a���� �ED _�4iC{]E9+6F]ENBUy6�?h5JN�D�Y�6k]�9�N-5~Y�4�CEC�6 5.7�4iD�G+5{CE4��+�i9+AB� ]E4�]�9+6kD��+U~v�6�C=4��7+N�6 Y�6 5\4��\N�D���4�CEUk?�]ENB4�Dk]E9�?�]Q]E9+6=? ��68D�]Q9�?�5QC�6�Y�68NBq$6�G{]�9���5o�m?�C�_�5J4~]�9+6 Y�4�UX7+�+]M? ]�N�4�Dy�L4��+A�G v�67�4�A���D+4iUyN-? A�NBD�]�9�6k?�Uy4i�+D�]@4���N�D���4�CEUk?�]ENB4�D�9+68A�G�v��[]�9�6y? ��68D�] D <���4£5J�+UyUV?�C�N�\86$_���N�q$68D�? DNBD�]�6�C�7+CE68]�6 GX5J��5J]�6�U�? ? D�GF?=7�4�N�D�]@?�%-Ø(+ D N�D ]E9+6�5J��5J]E68U[_$��6�5�?8�y]E9�?�]x?B?�Ø(%�Ø(+ D�ì Ó�í]�ä R N��

c�<@?A?cØ(%�Ø(+ D>ì ÓÅí ä RL_�?�D�Gd�<Q]E9+68C�6\68 �N-5.]M5�? D=?�A���4iC�NB]E9+U¡Q ]�9�? ]�]�?��$6 5�?i5�N�D+7+�+]fñ$_i?A�4�Y8?�A�5J]�?�]�6L4��p?��i68D�]�è�_i?�D�G(C�68]E�+C�Dp5

4E:o6�515{4iC×4¢^T4�5�_ G�687�68D�G�N�D+�k4�D[�Q9+6�]�9+68C�íóäðR 9+4iA-G+5@N�D�?�ABA�?%C�6�5J7�<�D+4�D�6 D 4��Q]E9+6=7�4�N�D�]�5�Q9+6�C�6}è�9�?�5(AB4�Y8? A�5.]M? ]�6�ñ�;�UX4�C�6�4�q$6�C8_�Q CE�+D�5@NBD�]�N�Uy6�7�4�A���D�4�UyN�?�A�N�D[]�9+6~7�?�C�?�Uy6�]�68C?i5�5J4�Y0N-?�]E6 G �QN�]�9Gñ$<

¢ à ª�°J®­©¢«�°E×y©¢µ µ ª�´8©0¬%¦y«�´�«�¦ °#®�´�ù0§�¬.©¢®�´�³�± §w¨m¬¯§�°J±i¬h°�µ�ª�´�8�®�°J³�Ü�ª%´0³�«%¦ °@«�¦ °J´0ª�°J³G£-µ ª�´Mê8§w± ù�ê�§w°.ø�µ�´0§w±8«�ø|©¢¨µ ª%´0µ�´0¨�°�×y88²yb�´0±�´0®w§wù0°x� b�´0± ´�®�§wù�°0ß�âEãn�0ç1¡-Ø=è-±~¦�§�¨Q©Mµ�µ ª�´8©0¬%¦y«�¦ °@©Mù0°J±�«Q§w¨�ù0§wê0°J±~¨�´�³�°Q§w± §w«�§�©¢®�§w±8Ü�´0ª%³�©¢«�§w´0±�Øhk¦i©¢«�§w«+õ�±�´Mø�¨�§w¨�«�¦ °J±Qø�¦i©M«�§w«�¬J©M±�×8°E× � ¬h°�ÜBª�´0³2«�¦ §w¨�§w± §w«%§­©¢®8§�±�Ü�´0ª%³�©M«%§w´0±�ß � ¨�§w± ùL©Óµi©Mª%«�§�¬ � ®�©Mª�©�é�§w´�³�¨�²8¨%«�°.³�ߧw±�©¤8�´ � ±�×8°E×@± � ³G8�°.ª`´MÜ�¨%«�°.µ�¨EØ¥ h=°�ª�°J³�©Mª%õL«%¦i©M«`µ�´0®w²8± ´0³T§­©¢®0«%§�³T°�õ8± ´Mø�®w°E×�ù0°�¬J©M±F8�° ê8§w°.ø`°E×�©¢¨|©Ó¨�µ�°E¬h§�©M®�¬.©¢¨�°�´MÜ�°¯é�µ�®�§�¬h§w«�õ8± ´Mø�®w°E×�ù0°�§w±«�¦�°�®w´�ù0§�¬�´¢Üpù�°.± °.ªh©M®+©�ø|©¢ª�°.± °J¨�¨ ´¢Üï�ëô�©Mù0§w±�©¢±i×Z� ©M®wµ�°.ª�±�ß�âEãn�3�¢¡�Ø+è-±�«%¦ °\®w´0ù�§�¬`´MÜ�ù0°.±�°.ªm©¢®�©�ø�©Mª�°J± °.¨�¨�ß «%¦ °.ª�°Q©Mª%°´0µ�°.ªh©M«�´�ª�¨;¦¤§mß"¨;§.ß0©¢±iפ©:§hß0ø�¦�°.ª�°�¦¤§ªe`ß/¨;§�e�©¢±i×�©l§ªe#ª�°Jµ ª�°.¨%°.±8«Eß�ª�°.¨%µi°E¬¯«�§wê0°.®w²8ß8«�¦i©¢«�©Mù�°.±8«�«$§w³Tµ ®w§­¬¯§�«%®u²�õ�±�´Mø�¨e`ß�°hé µ ®w§­¬¯§�«%®w²�õ8± ´Mø�¨:e`ß$©M±i×@§w¨�©�ø|©¢ª�°�´Mܬe`Ø�à�±�©Mù�°.±8« °hé µ ®w§�¬h§w«�®w²Qõ8± ´Mø�¨�e~°¯é�©�¬h«�®w²@§rÜ�¦ °\§w³�µ ®w§�¬h§w«�®w²�õ8± ´Mø�¨&e©M±�×�§�¨\©�ø�©Mª%°Q´MÜ:e0�+«%¦ � ¨Eß+«%¦ °Q°�o � §wê0©M®w°.±i¬¯°F¨;§7e'­ Öª¦¤§�e}®9©:§�e�ÞÓ¦ ´0®�×8¨�Ø�è-±=«%¦ °Q®w´0ù0§�¬o´MÜ�ª�°.¨%´ � ªh¬h°-£�8i´ � ±i×8°�ת�°�©M¨�´�± §w± ùiß+µ�´0®w²8± ´�³�§�©M®p£�«%§�³Q°oõ�±�´Mø�®�°�×8ù0°@Ö�¦M¯§ Þoµ ®�©�²�¨o«�¦ °Tª�´0®w°T´MÜ�°hé µ ®w§­¬¯§�«�õ8± ´Mø�®w°E×8ù�°0ß�«%¦ ° � ¨ � ©¢®�± ´0«%§�´�±=´MÜõ8± ´Mø�®w°E×8ù�°QÖª¦¤§-Þ�µ ®�©�²�¨�«�¦ °�ª�´�®w°\´MÜ�§w³Tµ ®w§­¬¯§�«`õ8± ´Mø�®w°E×8ù�°0ß$©M±i×°578�°.§w± ù�©d8 ®w°\«�´@¬h´0³Tµ � «%°\§w±(µi´�®w²�±�´0³�§�©¢®$«�§w³�°�6µ ®�©�²8¨�«%¦ °\ª%´0®w°�´MÜp©�ø�©Mª%°.± °.¨%¨EØ

c8g

Page 18: Model Checking vs. Theorem Proving: A - Cornell University

��9+6@A�4���N�Y4 � C�6 5.4��+C�Y�68f�v�4��+D�G�6 G{C�6�?�5J4iD+NBD���7+CE4�q�N-G�6 5\?�Dy68A�68�$? D�]���C�?�Uy68�L4�CE�#��4�CÆ?�D�? AB��\8NBD��C�6�5J4���CMY�68f�v�4��+DpG�6 G=D+4�]ENB4�Dp5Ó4 ����D+4 �QA�6 G���6I<�Oh]�N�5�5J9�4��QD~]�4�v�6Q�p5J6����+A���4�C\? D�?�A��'\8N�D+�(G�N�5J]EC�NBv��+]�6 G7+CE4�]�4�Y04�A-5�N�D��rHF4I5J6 50_Qc8a����-�._\? D�G�NB]�N-5#6� �]E68D�G�6 G[NBD ?FD��+U~v�68C@4 �@�Æ?���5#N�D��ë>@?�A�7�68C�D�!¢�S*�����_c8a������@]�4 G�6 ? AQ�QNB]�9 Y�C���7+]E4���C�?�7+9�N-Yy7+C�4i]�4�Y�4iA-50< ^ 4�Uy6y4 �(]�9�6 5J6k68 �]�68Dp5JNB4iD�5~5J�+�i��6 5.] ���+CE]�9+6�CUy4�G�Nl6�Y8? ]�NB4iD�5��Q9+N�Y¢9yUV?��$6@]E9+6(AB4��iN-YTUX4�C�6�?�7+7+A�N-Y8? v+AB6(]E4~R@OM<���6�G�N-5�Y0��5�5Q]�9+6�5J6(9+68CE6$<

Æ�NBC�5J]LD+4�]E6@]�9�? ]�N��fí]�ä R29+4iA-G+50_�]E9+68Dy]E9+68C�6�N-5>,���F�!Q7�4�AB��D+4iUyN-? A�]ENBUy6�? AB�i4�C�N�]�9+U ]�9p?�]��QN�ABA?�A�AB4 � ]�9+6(? ��68D�]Q]�4XY�4iUy7+�+]E6T�Q9+6�]�9+68CQ9�6#��D+4 ��5>R ?�]�? D��k5.]M? ]�6(NBDk]�9�6(5J]EC���Y�]E�+C�6I<\>T4 ��68q$68C�_]�9�6~?���6�D�]@UV?��XD+4�](��D+4 � �Q9p?�](]�9�? ](?�A���4iC�NB]E9+U N�5�<(HF4iC�6=C�6�?�ABN�5J]EN-Y8? ABAB�I_�CM? ]�9+6�C#]E9�?�D[9p?�q�NBD��?�Y�Y�6 5�5�]E4~?�A�A`7�4�A���D+4iUyN-? A�]�NBUX6@? AB��4iC�N�]�9+Uk50_�?�D[? ��68D�]�UV?��~9�?8q$6�5J68q$68C�?�A|?�AB�i4�CENB]�9�Uk5o]E9�?�]�5.9+6Y8? D{]EC��=]�4���5J6�]�4@6�����C�6@4i�+]\�Q9+68]�9�68CL5J9+6@��D+4 ��5 R�<\Oh]\N-5�6 ?�5.�=]�4�Uy4�G�N�����]�9+6�AB4i��N�Y�]�4�9p?�D�G�A�6]�9�N-5Q5JN�]���? ]�N�4�D�< O`68]G± v�6�5J4�UX6(5J68]L4��L? AB�i4�C�N�]�9+UV5�<���6(]�9+6�DFG�6n6�D+6H?A?cØ,%-Ø(+ D>ì Ó í2²ä R�Ô.��5.]�?�5��6�G�N-G�?A?cØ,%-Ø(+ D>ì Ó í]�ä R�_�68 +Y0687+]�]E9�?�]LNBDy]E9+6(5.6 Y�4�DpG Y0A-?��p5J6$_���6�C�6�U$�+NBCE6T]E9�?�]FQ ë ±(_$CM? ]�9+6�C]�9p?�D~]�9�? ]¤Q N�5�7�4�A���D+4iUyN-? A�]ENBUy6I<�? � ��Y04��+C�5J6$_�N�����6Q]M? �$6G± ]�4�Y�4�Dp5JN-5.]�4���?�A�A+7�4�AB��D+4iUyN-? ABf�]�NBUX6?�A���4iC�NB]E9+Uk50_`]�9+6�D2�L6=C�6 Y�4 q$68C�]�9+6~G�636�D+NB]ENB4iD24 ��í]�ä RL< D ��9��p5�_�N��ÆRTABN�Y�6�]EC�NB6�5T68 �?�Y�]EAB�F4iD+6~4��].��4k? AB�i4�C�N�]�9+UV5�]�4�6��i�+C�6=4i�+]@N��>R N-5T]EC��+6I_�]E9+68D]±¡��4���A-G[Y�4iD�5JN�5J]@4 ��]E9+4$5.6=].��4X?�AB�i4�CENB]�9�Uk5�_?�DpGá�²³m´ 䶵 # R ��4���A-G29+4iA-G�? ]=?k7�4iNBD�]�68 �?�Y0]�AB�[N���RTA�N-Y�6=��D+4 ��5SR¡?�D�G�5.9+6kY8? D Y�4iUy7+�+]E6=]�9+N�5�m?�Y0]o�p5JNBD��#4iD+6�4���9�68C\]J�L4�?�AB�i4�CENB]�9�Uk5�<���6@Y8? D{N�Uk?��iNBD+6L]�9�? ]LG�N���68CE68D�]Ó?���6�D�]�5o9�?8q$6�?�Y�Y�6 5�5�]E4G�N��`6�C�68D�]L?�AB�i4�CENB]�9�Uk5n;�?�D;? ��68D�]��QN�]�9yUy4iC�6�68 �7�6�C�]�N�5J6���4i�+A-G{9p?�q$6�?�Y�Y�6 5�5\]�4=Uy4iC�6�?�D�G~v�6�]�]�6�C?�A���4iC�NB]E9+Uk50<2OhD ]�9�N-5#�Æ?8�$_���6;Y8? D UX4�G�68AL?[5JN�]���? ]�NB4iD �Q9+6�C�6y4iD+6;?���6�D�]=��D+4 ��5�9+4 � ]E4�G�45J4iUy68]E9+NBD+���Q9+NBA�6�?�D+4i]�9+68C�G�4$6 5QD+4i]8<

��9+N-5@��CM? Uy68��4iC���Y8? D ?�A�5J4[v�6y68 �]�6�D�G�6 G2]E4[Y8? 7+]���C�6��"!$*�/3��MN��%i< � D+6X�Q?8�2]E9�?�] ?�D ?��i68D�]UyN���9�]{A�6 ?�CED N-5{]E9�?�]kNB]XAB6 ? C�D�5{D�68� ?�AB�i4�CENB]�9�Uk5�<B��9��p5�_TC�?�]E9+68Ck]�9�? D 9p?�q�NBD���]�9+6�Y0A-?�5E5y4��?�A���4iC�NB]E9+Uk5·±�v�68N�D+��6� �6�G`_`��6XY8? D[NBUk? ��NBD�6�]�9p?�]�N�]@N-5�?X����D�Y�]�N�4�D�4��Æ]�9+6~5.]M?�]E6$_��Q9�N-YM9[Uk?8�YM9�?�D+�i6@4 q$68C\]�N�Uy6$<�Æ+4�CEUk?�A�AB�$_i��6�Y�4��+A�G{68 �7�?�DpG{]�9+6�D+4i]�NB4iDk4���?SC@CENB7+�$6�5J]EC���Y�]E�+C�6�]�4�NBD�Y0AB��G�6? ���+DpY�]�N�4�D]±¡]�9�? ](?�5E5J4�Y�N�?�]�6�5T�QNB]E9[6 ?�YM9[5.]M?�]E6Hñ~?�D�G[? ��68D�]�è�_�]E9+6~5J6�]T4 �Q? AB�i4�C�N�]�9+UV5¤±@?Eè1Ø+ñ D]�9p?�]�?��i68D�]�è�9�?�5�?�]@9+N�5(G�N-5.7�4I5�? A�? ]�5J]M? ]�6)ñ$<���6~Y8?�D�]�9�68D�G�6n6�D�6�¸ ä Rhü ? ��68D�]@è�68 �7+ABN�Y�NB]EAB���D+4 ��5¾R�ü ]�4;v�6{]EC��+6X?�]�5J]�?�]E6�ñyN���í ²n¹ äBº K7»ä R 9+4iA-G+5(?�] 5J]�?�]�6}ñ$_�]�9�? ]�N-50_�N���? ��68D�]xè��D+4 ��5@R?�DpGyY8?�D;Y�4iUy7+�+]E6QNB]\v��{��5.NBD+��4�D+6�4�� ]�9�6(?�A���4�CENB]E9+Uk5�NBD3±@?�è1Ø+ñ D <���6@4�UXNB]�]E9+6T��4�CEUk?�A�G�6�]M?�N�A-59+68CE6�;�]E9+68�k? C�6�?�A�A 5J]ECM?�N���9�]J��4iC��Q? CMG`<

Æ�NBDp?�ABA��$_`�L6=C�68Uk? C��k]�9p?�](NBD[7+C�?�Y�]EN-Y�6=N�]@Uk?8�;5J686�U ]�4kv�6~]�4$4[5.]�CE4�D+�;?yC�6�U$�+N�C�68Uy6�D�]���4iCRTA�N-Y�6�]�4=9�?8q$6(]�4��-����� RL< Æp4iCQ68 �?�Uy7+A�6$_$NB]LUk?8�{v�6(68D+4i�+��9y��4�C�RTA�N-Y�6�]�4=��D+4 ��R��QN�]�9k9+NB�i97+CE4�v�? v+NBA�NB].�$_ 4�C\]�4(AB6�]�9+6�C�? AB�i4�C�N�]�9+UV5�Uk? �$6�4�Y8Y�?�5JN�4�D�? A�UyN-5.]M?��$6�5�_ ?�5�A�4�D+��?�5�]E9+68�=? C�6QD+4i]\]�4$4��C�6�UÛ�+6�D�]�<�Oh]�N�5oD+4i]Q]�4$4~9�?�C�GV]E4=Uy4�G�N����=4��+C�G�636�D+NB]ENB4iD�5�]�4=�i68]Q5.��Y¢9k7+CE4�v�? v+NBA�N-5.]�N-YQD+4i]�NB4iD�5Q4��Y�4iUy7+�+]�?�v+A�6Q��D+4 �QA�6 G���6�;Û]E9+6 5.6QN-5�5.�+6 5L?�C�6�G�N�5�Y���5E5J6 G=NBD~Uy4iC�6QG�68]M? NBA�NBDG�u>@?�A�7�6�C�D�!+� *��"��_�c8a������.<��9+6 5.6=7+C�4iv�?�v�NBABN�5J]EN-Y@D+4�]ENB4iD�5@�Q9+68C�6�68C�CE4�C�N-5@? ABA�4��L6 G UV?��X��NBq$6(��5�?{7+C�N�D�Y�N�7+AB6 Gy�Æ?��k]E4kG�6 ? A�QNB]E9y]�9�6#7�C�4�v�AB68U�4 ��9�?8q�NBD+�=]E4$4=Uk?�D��~5J]�?�]E6 5�NBDy]E9+6(Uy4�G�68A�]E4~G�4=6n7VY�NB68D�]�Uy4�G�68A�Y¢9+6�Y¢��NBD+��<��9+N�5�N-5�5.�+6�G�6 5.68C�q$6 5o����C�]�9�68CQ68 �7+AB4iCM?�]ENB4iD�<

c-p

Page 19: Model Checking vs. Theorem Proving: A - Cornell University

¼ ½ �§ Z��§�§ ��yÿ ¯{ÿ�� ��yÿ�Z¬��§ ��Vÿ�§

��6Q9�?8q$6�?�C��i�+6 G{9�68C�6���4iC�?@Uy4�G�68ABf�]�9+6�4�C�6�]�N-Y\CM? ]�9+68C\]E9�?�DX?@7+C�4$4 ��f%]E9+684�CE68]�N�YT? 7+7+CE4$?�YM9y]E4#CE6 ?�f5J4iD+NBD��y? v�4i�+]���D+4 �QA�6 G���6I<��26�G�4=D+4i]TUX6 ?�Dy]E4~5J�+�i��6 5.]T]E9�?�]Q]E9+6(Uy4�G�68A�f%]E9+684iC�68]EN-Y�?�7+7+CE4$?iY¢9N-5L?�7�?�Dp?�Y�6 ?�< ��9+68CE6(?�CE6(G�N87VY��+A�]�N�6 5�]�4�v�6(4 q$68CMY04�Uy6L9+68C�6I_�NBD�q$4�A�q�N�D+�(9+4 � ]�4S6�DpG{]�9+6�Uy4�G�68A?�DpG 9�4���]E4�G�4[Uy4�G�6�A�YM9+6 YM��NBD+�y4iD A-?�CE��6k5.]�CE��Y�]���C�6 50_<Ô.��5J] ?�5�]�9�68C�6k? C�6kG�N87VY��+AB]ENB6 5�NBD�]E9+6]�9�684�CE68Uyf�7+C�4 q�NBD+��?�7+7�C�4$?iY¢9|< � ��C�9+4�7�6�N-5�]E9�?�]\]E9+6QUy4�G�68A�f%]E9+684iC�68]EN-Yo7�68C�5J7�6 Y�]ENBq$6L�QNBABA�5J������6�5J]D+68��9+6��+C�N�5J]�N�Y85Q?�DpGFD+68��?�7+7�C�4$?iY¢9�6 5�<@��6#��686�A�]�9�? ]@Uk?�D��y4 ��]E9+6=? 7+7+CE4$?�YM9+6 5�]�9�? ](?�CE6~Y��+C�fC�6�D�]EAB�kv�68NBD+�X]�C�N�6 G`_�NBD�Y0AB��G�N�D+�~]�9+6=7+CE6���68CEC�6 GkUy4�G�68A�5T? 7+7+C�4I?�YM92]E4yD+4iD+Uy4�D�4�]�4iD+N-Y�CE6 ?�5.4�D+N�D+�?�DpGF]�9+6�N-G�6 ?~4��x4�q�NBq�N�����NBD+��5���D�4��QA�6 G��i6�v�?i5J6 50_�?�CE6~?�A-5.4yv�6 5J]��+D�G�68C�5J]E4$4�G�N�D[]�9+6 Y�4�D�]�68 �]�4��]�9�6=Uy4�G�68A�fhYM9+6 YM��N�D+����C�?�Uy6���4�CE�`<���9���5�_�]�9+N�5T7�68CM5.7�6�Y�]�N�q$6�Uk?8�k? ABAB4 ����5T]E4y�+D+N����;?VD��+U~v�68C4��oY��+C�CE68D�]�ABN�D+6 5\4��\CE6 5J6 ? CMYM9�<

��9+6xUÛ��6 5J]ENB4�D;5.]�NBA�A�C�68UV?�NBDp5�_���4�C�? D��k7�? C�]�N�Y��+A�?�C�?�7�7+ABN�Y8?�]ENB4�D|_��Q9+68]E9+68CQ]E4{��5.6(]�9+6(Uy4�G�6�ABf]�9�684�CE68]�N�Y 4iC�7+CE4$4���f�]�9+684iC�68]EN-Yy? 7+7+CE4$?�YM9�<;R]�5.4�Uy6~AB68q$6�Ah_`N�]�Y04��+A�G�v�6k? C�����6 G2]�9p?�]=]�9�N-5@N-5�?D+4iD+fEU$�+6 5.]�N�4�D�;�?�]�?@5.�'7kY0NB68D�]�A��T9+N���9�AB68q$68Am_8]�9+6L].��4�?�7+7+CE4$?iY¢9+6�5�Y�4�D�q$68CE��6$l`� N�]�9 ?T5.�'7kY0NB68D�]�A��C�N�Y¢9�AB4i��N�Y�_��L6yY8? D Y�68CE]M? NBD+A���Y¢9�? CM?iY�]�68CEN"\86~?kUy4�G�68A\N�D�5JN�G�6{]E9+6~AB4��iN-Y�_�?�D�G�]E9+68C�6~N-5@D+4i]�9+N�D+�NBD ]E9+6F7�C�4$4���f�]�9�684�CE68]�N�Y[?�7+7+CE4$?iY¢9 ]�9�? ]y7+CE68q$68D�]M5=��5 ��C�4iU G�4iNBD+� 4��+Cy]E9+684iC�68U 7+C�4 q�NBD+��v����5.NBD+� Uy4�G�6�A@YM9+6 YM��N�D+�+< ^ N�UyNBA�?�C�A��$_L?�5 �L6[9�?8q$6�5J�+�i��6 5.]�6 G NBD ]E9+6�7+C�68q�NB4i��5y5.6 Y�]�N�4�D�50_T]E9+6Uy4�G�6�ABfmY¢9+6�Y¢��NBD+��?�7�7+C�4I?�YM9kY8?�DVY8?�7+]E�+C�6�]�9+684iC�68U�7�C�4 q�N�D+�+l$�[email protected]+A���A�4$4��X?�]�]E9+6(Y�A�?�5E5Ó4 �\? ABAUy4�G�6�A-5�Y�4�D�5.N-5.]�68D�]T�QN�]�9;]�9+6~?  �N�4�Uk50<TR�5�5J��UyNBD+�~4���C@AB4i��N-Y(9�?�5�?yY�4�UX7+AB68]E6�?� �NB4�UV?�]�N�\ ?�]ENB4iD�_N��Ó?#�m?�Y0]TN�5�]�C���6#N�Dk?�A�A�4��\]E9+68U[_$]E9+68DkNB]QN�5�7+C�4 qi?�v+A�6$<

>T4 ��68q$6�C8_�]E9+N-5~Y�4�D�q$68CE��68D�Y06F4�vp5�Y��+CE6 5{]E9+6F�m?�Y�]X]�9�? ]y]�9+6[].�L4 ?�7+7�C�4$?iY¢9�6 5y9�?8q$6FCM? ]�9+6�CG�N��`6�C�68D�]=7+9+N�AB4$5.4�7+9�NB6 5~?�D�G G�4�UV?�NBDp5 4 ��?�7+7�ABN-Y�?�v+N�ABNB].�$<k��9�6F]�9�684�CE68Uyf�7+C�4 q�NBD+��? 7+7+C�4I?�YM9 N�5Uy4iC�6k? 7+7+C�4i7+C�N�?�]E6F�Q9+68D ��6;G�4�D+4�]~��D+4 � �Q9�? ]{]E9+6kUy4�G�68A�5�AB4$4i� A�NB�$6X?�D�G ]�9+6;v�6 5J]=�Æ?��]�4�G�6 5�Y�CENBv�6y]E9+68U N-5#v���Uy6 ?�Dp5#4���?� �NB4iUk5�<£O¯D Y�4�D�]�C�?�5J]�_o]E9+6yUy4�G�68ABfmY¢9�6 Y¢��NBD��k?�7+7�C�4$?iY¢9 N�5?�7�7+C�4i7+C�N�?�]�6��Q9+68D �L6�G�4 ��D�4�� �Q9�?�]k]E9+6[Uy4�G�68A�5 A�4$4�� A�NB�$6;?�D�G ��6�Y�?�D¡G�6 5�Y0C�NBv�6[]E9+68UCM? ]�9+6�CQ7+C�6 Y0N-5J6�AB�$_�?�5QNBDk]E9+6(U{��G�G���fmYM9+NBA�G�C�68D=7���\&\8A�6$<

�26L��4i�+A-G�?�C��i�+6$_�9�4��L68q$68C�_8]�9�? ]�]E9+6�Uy4�G�68ABfmY¢9�6 Y¢��NBD���? 7+7+CE4$?�YM9=9�?i5�4�D+6LUk?-Ô.4iC ?�G�qi?�D�]M? ��64 q$68C�]E9+6�]E9+684iC�68Uyf�7+CE4�q�NBD��=?�7�7+C�4I?�YM9�_+�Q9+N-YM9kN-5�7�68CE9�?�7�5�D+4�]QN�UyUy6 G�N�?�]E68A���4�v�q�NB4��p5Æ��CE4�U ]E9+6�Q?8���L6k9�?8q$6kG�6 5EY�C�N�v�6�G ]E9+68U[<Ð��9+6k]�9+6�4�C�6�Uyf%7�C�4 q�N�D+�[? 7+7+CE4$?�YM9 N�Uy7+A�N-Y�N�]�AB�£?�5E5J�+Uy6�5�]�9�? ]]�9�6=A-?�D�����? ��6=��4�C�G�6 5EY�C�N�v+NBD+�X]�9+6~5.NB]��p?�]�N�4�Dq?%Nm<r6$<�_+]�9+6~5.�+5.]�68U 4�C(]�9+6=UX4�G�68A D N-5�]�9+6~5E?�Uy6 ?�5]�9�6#A�?�D+�i��?��i6���4�C�G�6 5EY�C�N�v+NBD+�=]E9+6(7+C�4i7�68C�]ENB6 5�4 �\]�9+6�5.�+5.]�68U NBDk�Q9+N�Y¢9k�L6�? C�6(NBD�]�6�C�6 5.]�6 G`< Æ+4iC68 �?�Uy7�AB6$_�]�9�6F5.NB]E��?�]ENB4�D Y8? A-Y���AB��5�9�?i5�v�6868D ��5J6�G ��4iC=v�4�]�9 7+�+CE7�4I5J6 5~5JN�D�Y�6kH[Y ZL?�C�]E9���6�CM5.]NBD�]�CE4�G���Y�6�G�N�]#N�D c8aib��V?��Q9+68D�]E9+6ó6pCM5J]�q$68CM5.NB4iD24 �Q�rH[Y�ZL? C�]�9��$_\c8aig�����?�7+7�6 ? C�6 G D <���9p?�]��L6Uk?8��D+686 G@CM? ]�9+6�C�7�4 ��68C.���+A$A-? D+���p?���6�5���4�C G�6�5�Y�CENBv+N�D+��?T5.NB]E��?�]ENB4�D}?%].��7+N-Y8? ABA����m?�C Uy4�CE6�7�4��L68CJ����A]�9p?�D�]�9+4I5J6~D+686 G�6�G ��4�C�G�6 5EY�C�N�v+NBD+�X]�9+6=7+CE4�7�68CE]�NB6�5��L6=�Q? D�](]�4k7+CE4 q$6~?�v�4��+]�]�9+6~5.�+5.]�68U D N�568q�N-G�6�D�]Æ?�ABCE6 ?�G��yNBDk]�9�6#U~��G+G��~Y¢9+N�A-G�CE68Dk? D�G ]E9+6(�QN-5J6�f%Uy6�D{7+�i\&\8AB6�5�<

��9+6(Uy4�G�68A�fhYM9+6 YM��NBD+�(? 7+7+CE4$?�YM9[? ABA�4���5��p5]E4=6���6 Y�]�N�q$68AB� G�6 Y�4i�+7+A�6#]E9+6�G�6 5EY�C�N�7+]�N�4�Dy4 ��]E9+6Uy4�G�6�A���C�4iUS]�9+6XG�6 5EY�C�N�7+]�N�4�D�4��Q]E9+6~7+C�4i7�6�C�]�N�6 5@��6~�Q? D�](]�4;7+C�4 q$6~? v�4i�+]=]�9�6{Uy4�G�68Ah<)��9+N�5G�6 Y04��+7+A�NBD+��N-5���5.6����+A�NBDkUk?�D��~Y8?i5J6 5�v�6 5.N-G�6 5�]E9+4$5.6(�Q9+68C�6�Y�NBC�Y��+Uk5EY�C�N�7+]�N�4�D=N-5Q? DkN-5�5.�+6$<�Z\4iD+f5JN�G�68C ]�9+6ÆY8?�5.6�4 �`7�C�4��iCM? UyUyNBD��QA-?�D�����? ��6 50<\>T68C�6\�L6QY8? D�q�NB68��]E9+6�7�C�4��iCM? U�?�5�G�6 5�Y0C�NBv�NBD+�Q]E9+65J��5J]E68U[< ?E��9�68C�6@�QN�ABA+v�6(?(7�?�CE]�N�Y��+A-? CQ5.68]\4�� C���D�5�Y�4iC�CE6 5J7�4�DpG�NBD+�=]E4�6 ?iY¢9X7+C�4i��CM? U[< D �26�Uk?8�

c&�

Page 20: Model Checking vs. Theorem Proving: A - Cornell University

]�9�68Dk�Q?�D�]Q]�4~7+CE4�q$6�7+C�4i7�6�C�]�N�6 5Q4���]�9+6(7+CE4���C�?�UÇ?h5.��YM9F?i5]E68C�UXNBD�? ]�NB4iD�_$4�C�5J4iUy6@NBD�qi?�CEN-?�D�]M5 D <Oh]L5J6868UV5�?8�Q���Æ?�CMG=]�4�C�6�U$�+N�C�6Q]�9p?�]\]�9+6�7+CE4�7�68C�]ENB6 5\4��|]�9+6�7+C�4i��C�?�U v�6�68 �7�C�6 5E5J6 G�N�D{]E9+6@5E?�Uy6A-? D+���p?���6�?i5�]�9+6@UX4�G�68A�4�� ]E9+6@7+CE4���C�?�U[_�v+�+]L]�9�? ]QN-5o6�5�5J6�D�]EN-?�A�AB���Q9�?�]Q�L4��+A�G{v�6#CE6�U$�+NBCE6 G v��?=]�9+684iC�68UXf%7+CE4 q�N�D+��?�7+7+CE4$?iY¢9�<

��9+6 5.6@68 �?�Uy7+A�6 5\5J�+�i��6 5.]Q]�9�? ]Q�Q9+68Dy�p5JNBD��=]�9+6@UX4�G�68ABfmYM9+6 YM��N�D+�(?�7�7+C�4I?�YM9�_+NB]L�QNBABA�7+CE4�v�? fv+A��{v�6(��5J60���+A`]E4{9�?8q$6@]E6 YM9+D+NNU$�+6 5���4iC�Y�4�D�5.]�CE��Y�]�N�D+�=Uy4iC�6�Y�4�Uy7�ABN-Y�?�]�6�G Uy4�G�68A-5���C�4�U 5JN�Uy7+A�68CUy4�G�6�A-5�_ ��5JN�D+��q�? C�N�4���5=Y�4iD�5J]EC���Y0]�4�C�5�<���4�CE��4�D 5J�pY¢9 ]�6�Y¢9+D�NNU$�+6 5@9�?�5=v�6868D ?[Uk?-Ô.4iC@��4�Y���5NBD ]E9+6k5J]E��G�� 4���7+CE4���C�?�UyUXNBD+�kA-? D+���p?���6�5 ��4�C=�$6 ? CM50<A?hR ].��7+N-Y8? A\68 +? Uy7+A�6{N�5�]�9+6k��4iC���4iDZQZ ^ v��=HFN�ABD+68CÓ?�D�G=9+N-5\Y�4iABA�6 ?��i�+6 5��ëHFNBABD�68C8_+c�a��ie-�.< D OhD�G�686 G�_ÛN�D~?�A�Uy4$5.]\?�D��~G�N-5EY�NB7�ABNBD�6��Q9+68CE6Y�4iUy7+ABN�Y8?�]E6 Gk5J��5J]E68Uk5QD+686 Gk]�4kv�6~?�D�? AB��\86 G`_`]E9+68CE6~?�C�6=]E6 YM9+D+NNU$�+6 5o��4iC�Y�4�D�5.]�CE��Y�]�N�D+�yUy4�G�68A-5��4�CÆ?�Y�4iUy7+A�N-Y8? ]�6 G=5.�+5.]�68U���CE4�U 5JNBUX7+AB68C�Y�4iUy7�4�D+68D�]M50<�HF4iC�6@68UX7+9�?�5.N-5�4iD;?#Uy4�G�6�ABfmY¢9+6�Y¢��NBD+�?�7�7+C�4I?�YM9 UXNB��9�]\AB6 ?iGy]�4=Uy4iC�6���4�CE�k?�A�4�D+�=]E9+6 5.6#A�NBD+6�5�<b��9�6#9�4�7�6(��4���A-Gyv�6@]�9�? ]QN�����6@9p?�q$6?#v�68]E]�68CL�+D�G�6�CM5J]�?�D�G�NBD+��4�� �Q9+68CE6T]E9+6@Uy4�G�68A-5\?�CE6@Y04�UyN�D+�@��C�4�U£_���6@UXNB��9�]�v�6�?�v+A�6@]�4 G�68q�N-5J6v�68]�]E68CQ]�6�Y¢9+D�NNU$�+6 5Ó��4iC�G�4�N�D+�~Uy4�G�68A|Y¢9+6�Y¢��NBD+��<

OhDy5.�+UyUk? C��$_8�L6�G�4(D+4�]\68 �7�6 Y�]�]E9+6TUX4�G�68ABfmYM9+6 YM��N�D+��?�7+7�C�4$?iY¢9~]�4�5.�+7+7+A�?�D�]o]E9+6Q]�9�684�CE68Uyf7+CE4�q�NBD���?�7+7+CE4$?iY¢9�< W�?�]�9�68C8_\��6k��4i�+A-G 9+4�7�6k]�9p?�]~]�6 YM9+D+N UÛ�+6�5���C�4iU 6 ?iY¢9 4�D�6FY�?�D N�D�5J7�NBC�6?�G�q�? D�Y�6 5�NBD[]�9�6=4�]�9�68C8<(OhD[? D��£Y8?�5.6$_`�L6�9+4i7�6~]�9�N-5TUk? D+N���6�5J]�4=N�D�5J7�NBC�6�5���+C�]E9+68C�C�6 5.6 ?�C�Y¢9[4iDUy4�G�6�ABfmY¢9+6�Y¢��NBD+��]�6 YM9+D+N UÛ�+6�5Ó��C�4iU ]�9�6�R�Oo7�68CM5.7�6 Y�]�N�q$6$<

¾ ����Á�l¿�¿$¶bº��G� ¶ Á¤�g ��9+6yN�G�6 ?i5#NBD ]�9+N�5#7�? 7�6�C�9�?8q$6yv�6868D v+C�68�QN�D+� ��4iC=?k�Q9+NBA�6$<?mR v+CENB6��Æ7�?�C�?���C�?�7+9 G�N-5EY���5E5JNBD��5J4iUy6k4���]�9+6�5J6FN�5�5.�+6 5=?�7�7�6�?�C�6�G NBD � >@?�A�7�6�C�D�_�c8a��up � < D Ì N�5�Y���5E5JN�4�D�5=�QNB]E9 >�6 Y�]�4iC)O`68q$6 5$UÛ�+6?�DpG :\4�C�?�U HF4$5.6 59�68AB7�6 Gk��5Æ��4iC�U~�+A-? ]�6@]E9+6 5.6�N-5E5J�+6�5�<���6��L4��+A�GVA�NB�$6(]�4~]�9p?�D+�;WQ4�D�Æ�? ��NBD|_R@G+? U r�CE4�q$6I_ Ì ?8q�N-G`_�O.5JC�?�68Am_ ^ ]E68q$6ZC(? ����Uk?�D�D�_er�68CE9�?�C�G×O�? �$68Uy68�$6�C8_i?�D�Gk>T6 Y0]�4�C�O`68q$6 5$UÛ�+6��4�C���5.6����+A�Y04�UyUy6�D�]�5Ó4iD;?�DF6�?�C�A�NB68CÆG�CM?8��]T4 ��]E9+N-5�7p?�7�68C8<

À ª�Á�ª@��ª�ÿ��ªS§

� R�NB68A�AB4�!+�>*�����_�c8a���� � O�<TZ�<ÆRTNB68A�AB4�_ Ì <>^@?�C�G�Nh_�? D�G H�< ^ Y¢9p?�68C.�E< :\68]k? D+4�]E9+68C;5J4iAB�+]ENB4iD ]E4]�9+6~]�9+CE686=�QN-5.68Uy68D;7+��\&\�AB6$<�OhDÃÂ>/$��I-��Ä�/$#�ÅK�'�$Æ �"��Ç0å�Fc.��Y���2ÈV!+�NJi��#����l�+%�Mm!1,�����/ÉÅK�'��!+�"�lM|%�!3���Ç0å�,3��!3F¾,0_�7�?��i6 5c£ia��/Ê�¤$e�p$_�c�a�����<

�rR�NB68A�AB4�!+�>*�����_�c8a��ia-�)O�<`Z�<�RTN�68ABA�4+_ Ì <L^@? CMG�Nm_�?�D�G;H�< ^ YM9�? 68CJ�E<\WQ6 ?�5.4�D+N�D+�X?�v�4��+]���D+4 �QA�6 G���6?�D�G=NB�iD+4�C�?�D�Y�6I<+OhDxÂ�/1��I-�nÅK�'�ËÆ ���:Ì ���K���L���PÍYM �3�NJ'ÎZ!3�e!3/$*��EMN����Ç0å�,3��!3F¾,0_�7�? ��6 5�g�c&�/Ê�gidup$_�c�a��ia�<

�rRQ]�]�?�C�G�N�? D�G ^ N�UyNh_�c8a���¤���r�<@RQ]�]�?�C�G�N�?�D�G�H�< ^ NBUyNm< W6 ?i5J4iD+NBD+� ?iY�C�4I5�5Fq�NB68�Q7�4iNBD�]M5�< OhDÂ>/$��I-�f�ß�MÏÌlÐFÅ�Ñ/Ò+_+7�? ��6 5�£�c�bCÊu£�d�b�_\c8a���¤+<

�rPQ?iY8YM9���50_�c8a�aie-�)Æ�<�PQ?�Y�Y¢9���5�<PÓ�!E.0/K!$,�!3�'��MN��%�*��i#0ÓZ!$*-,����iMN��%���M"� J2Â�/1��(+*�(�M"�lM8,3�EMNISÚx����� �"!$#&%'!M<H[Oß��_�C�6 5E5�_`ZL? U{v+CEN-G��i6$_+H[?i5�50<B_�c8aia�e�<

c8a

Page 21: Model Checking vs. Theorem Proving: A - Cornell University

�rPQ? C��QN�5J6$_�c8a���cn� 3+<kPQ?�C��QN�5J6$< ^ Y�68D�6 5 ? D�G 4i]�9+68C 5.NB]E��?�]ENB4�Dp5�< Ôi��Ü�/n��*��G�ß�Õ JiM"�l�-,��n.�Jiå�_p��'?�p D l|£�giaCÊu£�aup�_\c�a���ci<

�rP�C�?�YM9+Uk? D�_�c8a��ib-� W#<�P�CM?�YM9+Uk? D�<yO�ABNB6�G2? v�4i�+]=]�9�6y]�CE686 5H?%4iC8_\G�6��m? �+AB]�5(?�D�G G�6n6pD+NB]ENB4�Dp5�N�D��D+4 �QA�6 G���6(CE687+C�6�5J68D�]M? ]�NB4iD D <��<JL!FзÅÈ�*&%�*-��MN�e!�_�g'?E£ D lÊ��eCÊÛa�£�_�c8a���b�<

�rP���CMYM9V!+�>*�����_�c8a�aid-� 3+<$W#<iP��+C�Y¢9�_�=Q<$H�<$Z\A-?�CE�$6$_ Ì <�O�< Ì NBA�Ah_i3+<$>T�Q? D+�+_I?�D�GHC=<�O�<$H[Y8HFNBA�A-? D�<^ ��U~v�4�A�N-Y�Uy4�G�68AIY¢9+6�Y¢��NBD+��l�c�e ú-� 5.]M?�]E6 5 ?�D�G@v�68�$4�DpG`<mÅ3�K����/3FH*��EMN���x*���#�Ì ���'��/1���w_ia���?hd D lBc3¤$dCÊc-p$ci_�c�a�aid�<

� Z\9p?�D�G��V?�D�G;HFN-5JC�?�_�c�a���g � C=<$H�<�Z\9p?�D�G��~? D�G~3+<$HFN-5.CM?�<�>T4 � 7+C�4�Y06 5�5.6 5�AB6 ? C�D�<�ÖxM8,3��/3MN(&Üu��!$#Ì ��Fc.0Üu��MN��%�_ c�?Ec D lͤ$e/Ê�b�d�_�c8a���g�<

�­Z\A�?�CE�$6(?�D�G�r�C�t��U{v�68CE�+_�c8a��up��H=Q<�H�<�Z\A-? C��$6X?�D�G � < r�C�t��U{v�68CE�+<;W6 5.6 ?�C�Y¢9�4�D ?��+]E4�Uk? ]�N-Yq$68C�Nl6�Y8?�]ENB4iD�? D�G 6�D+N�]�68fm5J]�?�]E6kY�4�DpY��+C�CE68D�]�5.�+5.]�68UV5�<kOhD�3+<fÆ�<���C�?��+v|_�P@< 3+<�r�C�4I5ß\$_�P@<���<O�?�Uy7�5.4�D�_�? D�GÅ^�<L3+<�^TN�A-5E5J4�D|_�6 G�N�]�4�C�5�_·Ð��i��Ü'*��FÓZ!32&Mm!K� �ß�ÃÌ ��Fc.0Ü���!3/0Ç0I�Mm!3��In!u��×i���"�MØ$_7�?��i6 5@d�giaCÊÛd���a�<�RTD+D���? A W68q�NB6���5�OhD�Y�<�_�_�? AB4~RTA�]�4+_�ZL?�A�N��E<B_�c8a��up$<

�­Z\A�?�CE�$6�!+�>*�����_�c8a��ig�?��)=<�H�<�Z\A-?�CE�$6$_f=Q<�R�<f=�Uy68C�5J4�D|_�?�DpG�R�<f_�< ^ N-5.]�A-?�<FR��+]�4iUk?�]EN-Y�q$68CENBf6�Y8?�]ENB4iD 4 �c6pD+NB]E68fh5.]M? ]�6;Y�4�DpY��+C�CE68D�]=5J��5J]E68Uk5@��5.NBD+�[]E68Uy7�4�C�?�A�A�4��iN-Yy5.7�6�Y�N86�Y�?�]�N�4�D�50<ÃÐ}ÌlÈ��/$*��u,������xÂ�/1�+%�/$*�FHFHMN��%ÉÙh*���%�Ü�*&%'!1,x*���#PÇ0å&,3�ß!3F¾,0_i�'?md D l�d-¤�¤ËÊ�dig�£�_�c8a���g�<�RTDy6 ? C�A��=q$68CM5.NB4�D?�7+7�6 ? C�6 G NBDÚÂ�/1��I-�FÛnÜ��NJÝÐ}ÌlÈ Ç0å�Fc.i�-,�MNÜ'FÇ���ÞÂ�/3MN��I&MÛ.L�"!1,×�ß�3Â�/1�+%�/1*�FHFHMN��%°Ùf*���%�Ü'*&%'!$,0_c8a���£�<

�­Z\A�?�CE�$6�!+�>*�����_�c8a��ig�v��)=Q<\H�<�Z\A�?�C��$6I_ � <>rTC�t�+U~v�68C���_�? D�G H�<\P�C�4 �QD+6I< WQ6 ?�5.4�D+N�D+� ? v�4i�+]D+68].��4iC���5�QN�]�9FUV?�D��ó6�D�NB]�6�fh5.]M?�]E6�7+CE4�Y�6 5E5J6 50<TOhD2Â�/1��I-�:ß��NJ'Ð}ÌlÈàÇ0å�Fc.��b���°Â�/3MN��I&MÛ.L�"!$,)�ß�ÖxM8,3�E/3MN(&Ü��ß!$#2Ì ��Fc.0Ü��EMN��%�_+7�?��i6 5�d-¤$e/Ê�d�¤���_\c�a���g�<

� Ì ��4�CE�k?�DpGFHF4$5.6 5�_�c�a�aie � Z�< Ì ��4iC��;?�D�GF: <`HF4I5J6 50<cC@D+4 �QA�6 G���6 ?�D�G[Y04�UyUy4iDk��D+4 �QA�6 G���6NBDk?�P��'\ ? D�]ENBD+6Q6�D�q�NBCE4�D+Uy6�D�]�l�Y�CM?i5J9{�m? NBA��+C�6 50<lÅ3�+����/nFH*���MN����*���#°Ì ��Fc.0Ü���*��EMN����_i����?hd D lBc�b�gCÊc&��g�_�c�a�aie�<

� =�Uy6�CM5J4iDk?�DpG�Z\A-? C��$6$_�c8a���d � =Q<�R�<�=�Uy6�CM5J4iD�?�D�Gx=<iH�<�Z\A-? C��$6$<Ij@5JN�D+�Tv�CM?�DpY¢9+N�D+��]�NBUX6�]E68Uyf7�4iCM? A+AB4i��N-Y\]�4(5.��D�]�9�6 5JN�\86L5J��D�Y¢9�C�4�D�N"\ ? ]�NB4iD�5J�$68A�68]�4iD�5�<mÇ0I&Mm!K��In!��ß��Ì ��Fc.0Ü��ß!3/�Â�/1�+%�/1*�FHFHMN��%�_d�lwd�¤+c(Ê�d�gig�_\c8a���d�<

�Û=�Uy6�CM5J4iDk?�DpGF>@? AB7�68C�D|_`c8a���b��)=<\R�< =ÓUX68CM5.4�D ? D�G 3+<�:=<�>�?�AB7�68CED�< Ì 6 Y�N�5JNB4iD 7+C�4�Y�6�G��+C�6�5?�D�Gk68 �7�C�6 5E5JNBq$6�D+6 5�5\NBDy]E9+6(]�68UX7�4iCM? A`AB4i��N�Y�4 ��v�CM?�DpY¢9+N�D+�=]�N�Uy6$<�Ôi��Ü'/3��*����ß�áÌ ��Fc.0Üu��!3/@*���#Ç0å�,3��!3F>Ç0I&Mm!3�iIn!1,0_�£�e�?�c D lBc(Ê�d�¤+_�c�a���b�<

�Û=�Uy6�CM5J4iDV!+��*��"��_�c8a���a-�)=Q<�R�<�=�Uy68CM5.4�D�_ï�@< ^ ?�G�A�68C8_�? D�G�3+< ^ C�NBD�NBqi?�5E?�D�<)=X7kY0NB68D�]T]E68Uy7�4�C�?�AC�6 ?i5J4�D�NBD+��<\O¯D'Â�/1��I-�:Ûnâ�� JyÐ}ÌlÈ*Ç0å�Fc.������xÂ�/nMN�iI&MÛ.L�"!1,Q�ß�FÂ>/$�+%�/1*�FHFHMN��%�Ùf*���%�Ü�*&%'!1,0_�7�?��i6 5c8g�g/Ê�c�p���_\c�a���a�<

d�e

Page 22: Model Checking vs. Theorem Proving: A - Cornell University

�Û=�]E9+68C�N�D+��]E4�Dk!+��*��"��_�c8a���a-� Ì <X=�]E9+68C�N�D+��]E4�D�_ R�< P�4iC���N�G+?�_ W(< 3+<�P�C�?�YM9+Uk? D�_`? D�G�>�<ïC#? �+]1\I<K@NBq�N-GF��D+4 �QAB6 G���6X?�D�G2]ECM?iY�]M? v+AB6~C�6 ?i5J4iD+NBD+��l�7+CE68ABN�UyNBD�? C��yCE687�4�CE]8<kOhDEÂ�/$�-I��lÏY�"!32-!K�'� JãÅ3�iX�ß!3/3��*���MN����*���Ôi��MN�'�MÌ ���+��!3/K!3�iIn!H���]Ð�/K��M �YI&MN*��;Å3���ß!+���lM|%'!3�iI�!2ä�Å(Ô�ÌlÐFÅ]Æ Ñnådæi_�7�?��i6 5�cicn¤$g/Ê�cic8b�d�_c8a��ia�<

�ÛÆ�? ��NBD;? D�GF>@? AB7�68CED�_`c�a������~W#<fÆ�?��iNBD ?�DpG�3+<�:=< >@? AB7�68CED�<FP�6�ABNB60�E_�?8�Æ?�C�6�D+6 5�50_�? D�G�ABNBUXNB]�6�GC�6 ?i5J4�D�NBD+��<{Ð�/+�EM ��I&MN*��çÅK�'��!+�"�lM|%�!3��In!M_f£-¤�l|£iaCÊ�p�g�_�c�a�����<

� Æ�? ��NBD;? D�GF>@? AB7�68CED�_`c�a�a�c � W#<0Æ�?��iNBD ?�D�G[3+<`: <`>@? AB7�68CED�<�j�D�Y�68CE]M?�N�D�].�$_+v�68A�NB6��E_�?�DpG�7+CE4�v�? fv+NBA�NB].�$<MÌ ��Fc.0Ü���*��EMN����*���ÅK�'��!+�"�lM|%�!3��In!M_bp�?�£ D lBc8gieCÊpc-p�£�_\c8a�a�c�<

� Æ�? ��NBDk!+��*��"��_�c8a���£ � W#<�Æ�?��iNBD�_i3+< Ì < jTA�ABUk? D�_8? D�G�H�<8: <8K�? CMG�Nm< � D(]�9+6Æ5J68Uk? D�]EN-Y85+4 ���+7�G+?�]E6 5NBDXG+?�]�?�v�?i5J6 50<�OhD°Â�/1��I-�èØ���#ÉÐ}ÌlÈéÇeå�Fc.��L���xÂ�/3MN��I&MÛ.L�"!1,��ß�GÖx*���*�(+*-,�!¤Ç0å&,3�ß!3F¾,0_$7�? ��6 5 £ib�dCÊ£�g�b�_�c�a���£�<

�ÛÆ�? ��NBDk!+��*��"��_�c8aia�c3�~W#<0Æ�?���N�D�_ 3+<�: <�>@?�A�7�68C�D�_|?�D�G[H�<`: <�KL?�C�G�Nh<(R�UX4�G�68ABf�]�9�684�CE68]�N�Y#? D�?�A�f�+5.N-5@4��Æ��D+4 �QA�6 G���6I<3Ô���Ü�/3��*�� �ß�H�NJL!PÐ}ÌlÈ£_�a�c�?hd D l|£���dCÊ�¤$d��+_Qc8a�a�c�<XR 7+CE68ABN�UyNBDp?�C��Xq$68CM5.NB4�D?�7+7�6 ? C�6 GkNBD2Â�/1��I-��ØYß�� J'ÅuÏ�Ï�ÏTÇ0å�Fc.��-,�MNÜ�Fø���°Í���Ü���#�*���MN���u,Q�ß�yÌ ��Fc.0Ü��ß!3/·Ç0I�Mm!3��In!M_�c�a���¤+<

�ÛÆ�? ��NBDk!+��*��"��_�c8aia�d��~W#<�Æ�?���N�D�_�3+<�: <$>@?�A�7�68C�D�_I?�D�G=H�<�: <�KL?�C�G�Nh<+� 9p?�]\Y8? D{UV?�YM9+NBD+6�5`��D+4 �Z`� D=]E9+6\7+C�4i7�68C�]ENB6 5�4�����D+4 �QAB6 G��i6\NBD=G�N-5J]EC�N�v+�+]�6�G#5.�+5.]�68UV5�<gÔ���Ü�/3��*����ß�>�NJL!�Ð}ÌlÈ£_�£�a�?hd D l|£id��CÊ£up g�_�c�a�aid�<

�ÛÆ�? ��NBDk!+��*��"��_+]�4X?�7�7�6�?�C�c8a�aib-� W#<iÆ�? ��N�D�_�3+<�:=<�>@? AB7�68CED�_�:=<�HF4$5.6 5�_�?�D�GkH�<�: <ÛKL? CMG�Nm<�ÓZ!$*zX,�����MN��%G*�(+��Üu�bÚx����� �"!$#&%'!M<�H[O���_ÓCE6 5�50_`ZL?�U~v+C�N�G���6I_+H[?�5E5�<�_+]�4~?�7�7�6�?�C8_ c8aia�b�<

� Æ NB�$6 5\?�DpG�^TN�A-5�5.4�D�_�c�aup�d � W(<�=Q<'Æ NB�$6 5�? D�G�^�<�3+<�^TN�A-5�5.4�D�< ^ �QW�O�_ ^ l�?(D+68� ?�7+7+CE4$?iY¢9k]�4(]E9+6?�7+7+A�N-Y8? ]�N�4�D[4��L]E9+684�CE68U 7�C�4 q�N�D+�~]�4y7+CE4�v+A�68US5.4�A�q�N�D+�+<PÐ�/+�EM ��I&MN*��çÅK�'��!+�"�lM|%�!3�LIn!M_\d�l�c&��a/Ê�die���_c8aup�d�<

� rQt? CMG�68D���4�CM50_�c8a���� � _ <�rQt?�CMG�68D���4�C�5�<LÚx��������!$#&%'!�MN�ÉÍ �lÜzê <�ZL? U{v+CEN-G��i6\jTD+N�q$68CM5.NB].��_�C�6 5E5�_$ZL?�Uyfv+C�N�G���6$_�j�<|C=<B_�c8a�����<

�r>�?�AB7�68CED;?�D�G�Æ�?��iNBD�_�c�a���a��~3+<$:=<+>@? AB7�68CEDy? D�GkW#<�Æ�?��iNBD�<�HF4�G�68ABA�NBD+�(��D+4 �QAB6 G���6�?�D�Gk?�Y0]�NB4iDNBD G�N-5J]EC�N�v+�+]�6�G 5J��5J]E68Uk50<ëÖxM8,3��/nMN(&Ü���!$#ÚÌ ��Fc.0Üu��MN��%�_�£�?m¤ D lBc�b�aCÊpc-p�a�_~c8a��ia�<¡R 7+CE68ABN�UyNBD�? C��q$68CM5.NB4�D;? 7+7�6 ?�CE6 G N�DWÂ�/$�-I��mÒ��NJ'Ð}ÌlÈ*Ç0å�Fc.i�-,�MNÜ�F ���°Â�/nMN��I�MÛ.L�"!1,Q�ß�MÖxM8,3��/nMN(�Üu��!$#2Ì ��Fc.0Üu�7XMN��%�_�c8a���b�_��QN�]�9y]E9+6@]�N�]�A�6�4�R ��4�CEUk?�A�Uy4�G�6�A�4 ����D+4 �QAB6�G���6$_�?iY�]�N�4�D�_�?�D�GkY�4iUyU{��D+N-Y8? ]�N�4�D�N�DG�N-5.]�C�N�v+�+]E6 Gk5J��5J]�6�Uk5�l 7+C�68A�NBUyN�D�?�CE�=C�687�4iC�]+5�<

�r>�?�AB7�68CED;?�D�GkHF4$5.6 5�_�c�a���¤��~3+<�:=<\>@? AB7�68CED ?�DpG :=<\HF4I5J6 50<Å��4 �Æ?�CMG�5y?�]E9+684iC�� 4��(��D+4 �QABf6 G���6X?�DpG�N���D+4iCM?�DpY�6$<=OhD�Â>/$��I-�;зÐFзÅWì���/1�&,+Ji�n.k���2í@���iXyFH�������E���iMNI�Ùh�+%�MNI�_`7�? ��6 5=c�d�bCÊcn¤�£�_�c�a��-¤�<=WQ687+C�N�D�]E6 GyNBD�C=<�W(<`R�7+]H?E=\G`< D _;Ùf�+%�MNIK,ó*���#0È ��#'!+�Û,)�ß�0Ì ����I&Ü�/n/+!3�'�¤Ç0å&,3�ß!KF¾,0_^ 7+C�N�D+��6�C�f�Ko6�C�A-? �+_�P�68CEABN�D� �^T6�� :\4�CE�`_+7+7|<�¤$b�a/Ê�¤�p g�_�c8a��ib�<

d�c

Page 23: Model Checking vs. Theorem Proving: A - Cornell University

�r>�?�AB7�68CED;?�D�GkHF4$5.6 5�_�c�a�aie-�~3+<�:=<i>@? AB7�68C�DX?�DpG�:=<$HF4$5.6 5�<0C@D+4 �QAB6 G���6�?�DpG{Y�4iUyUy4iD#��D+4 �QABf6 G���6�NBD£?{G�N�5J]EC�NBv��+]�6 Gy68D�q�NBC�4iD+Uy68D�]8<GÔi��Ü�/n��*��f�ß��� JL!�Ð}ÌlÈ[_L£�p�?E£ D l�b-¤$a/Ê�b��up$_Lc8aia�e�<�R 7+C�68fABNBUXNBD�? C��~q$68CM5.NB4�D;? 7+7�6 ?�CE6 G N�DÝÂ�/1��I-�:Ä�/$#áÐ}ÌlÈ Ç0å�Fc.i�-,�MNÜ�F ���°Â�/nMN��I�MÛ.L�"!1,)�ß��ÖxM8,3��/3MN(&Üu��!$#Ì ��Fc.0Üu��MN��%�_ c8a��-¤+<

�r>�?�AB7�68CED;?�D�G]D���YM�`_�c8aia�d-�~3+<�:=<�>@? AB7�68C�D;? D�G�O�< Ì <�D��pY¢��<�R ABN�]�]EAB6@��D+4 �QAB6 G���6(��4$6 5�?=AB4�D���Q?8�`l[��D+4 �QAB6 G���68f�v�?�5.6 G G�68C�N�q�? ]�N�4�D�5y? D�G Y�4iC�C�6�Y�]�D+6�5�5�7+CE4$4��m5{��4�Ck?[�m?�UyN�AB��4��(7+CE4�]E4�Y�4�A�5�<Ô���Ü�/n�i*��f�ß�@� JL!MÐ}ÌlÈ£_�£ia'?E£ D lͤ�¤$a/Ê�¤�p��+_\c8aia�d�<

� >�?�AB7�68CEDk!+�>*��"��_�c�a���� � 3+< :=<�>@? AB7�68CED�_�:=< HF4I5J6 50_\?�D�G�H�< W(<f���+]E]�A�6$<kR ��D+4 �QAB6 G��i68f�v�?�5.6 G?�D�? AB��5JN-5\4��f\86�C�4(��D�4��QA�6 G��i6$<�OhD]Â�/1��I-�èØmÜ�� JyÐ}ÌlÈ*Ç0å�Fc.��0�����<JL!$��/nå@�ß�HÌ ��Fc.0Üu��MN��%�_�7�?��i6 5c&£�d/Ê�c3¤'p$_\c�a�����<

� >�?�AB7�68CED�_`c�a���p � 3+<+:=<�>@?�A�7�6�C�D�<\[email protected]+�=CE6 ?�5.4�D+N�D+�k? v�4i�+]���D+4 �QA�6 G���6(]E4y? D�?�A��'\86�G�N�5J]EC�NBv��+]�6 G5J��5J]�6�Uk5�< OhD 3+< Æ�<b��CM? �+v�_QP@<\3+<�r�CE4$5ß\I_�P@<���< O�? Uy7�5J4iD�_L?�D�Gq^�<\3+< ^TNBA�5�5.4�D�_\6 G�N�]�4�C�5�_Ð�����Ü�*��lÓZ!32�Mm!3�Å�ß��Ì ��Fc.0Üu��!3/9ÇeI&Mm!3��In!u��×i���"��Ø$_�7�?��i6 5Z£�p"Ê�g���<�R�D+D��p?�A WQ68q�N�68��5QOhD�Y�<�_L_�?�A�4RTAB]E4+_`ZL?�A�N��E<�_`c8a��upI<

�r>�?�AB7�68CED�_`c�a�aie-�~3+<+:=<�>@? AB7�68CED�<QRTD£?�D�? AB��5JN-5Q4���6�CM5.]�f�4�CMG�68C@AB4i��N�Y854 �\7+CE4�v�? v+NBA�NB].�$<GÐ�/K��M �YI&MN*��Å3�'��!+�"�dM|%'!3�LIn!M_�¤$g�l|£�cicdÊu£�b�e�_\c8a�aie�<

�r>�?�UyN�AB]�4iDy? D�G Ì 68AB�iCM?�DpG�6$_�c8a���a�� ^ <�3+<$>@? UyNBA�]�4iD=?�DpGy3+<�_�< Ì 6�AB��C�?�D�G�6$<`R�D{N�D�q$6 5.]�N��$?�]ENB4iD=4��Uy4�G+?�A 5.]�CE��Y�]���C�6 5Q?i5T? D[?�A�]�68CED�?�]ENBq$6(5.68Uk? D�]EN-YQv�?�5.N-5���4�C�687+N-5.]�68UXN-Y�AB4i��N�Y85�<�Ì ��Fc.0Ü��E*���MN����*��Å3�'��!+�"�dM|%'!3�LIn!M_ b�lÊ��dCÊÛa�g�_�c8a���a�<

�r>�NBD�]�NB���i?�_�c8a�p b��=3+<�>�NBD�]�NB���i?�<kOhUy7�4$5E5JN�v+AB6=7�4$5E5JN�v+AB6y�L4�CEA-G+5�q�NBD�G�N-Y8? ]�6 G`<2Ôi��Ü�/n��*��Y�ß�� JiM"�l�zX,��n.�JiMNI+*���Ùf�+%�MNI�_�¤+lÛ¤�p b/Ê�¤���¤+_�c�aup�b�<

� >�4�AB]$\8Uk? D+D�_�c8a���� � r�<�3+< >T4�A�]1\8UV?�D+D�<~RTD NBUy7+CE4 q$6 G 7+CE4�]E4�Y�4�ALC�6 ?iY¢9�? v+NBA�NB].�[? D�?�A��+5.N-5(]�6 YM9+fD+NNU$�+6$<¤Ç0�ß�3���b*�/+!·Â�/1*�In��MNIn!x*���#áÏ�ê+.L!3/3Mm!3��In!�_�c��'?hd D l�c&£up�Ê�c�g�c$_�c�a�����<

� C(? v�?�D�\�? !+��*��"��_�c8aia�e � Æ�< C(?�vp?�D�\ ?�_�3+<rfmH�< ^ ]�68q$6�D+D+6$_\? D�GA_ <��24iAB7�68C8< >@?�D�G�ABNBD��[NBD'6�D�NB]�6]�68Uy7�4iCM?�AÆG+?�]�?�<[OhDÚÂ�/$�-I���å�� J�Ð}ÌlÈ Ç0å�Fc.������ÝÂ�/nMN��I�MÛ.L�"!1,G�ß�yÖx*���*�(+*-,�!áÇeå�,3��!3F¾,0_�7�?��i6 5£�a�d/Ê�¤Ie�£�_\c�a�a�e�<

�ÛC(? D+68ABA�?���N-5@!+�>*��"��_�c�a�aie-�)Æ�<�C(? D+68ABA�?���N-50_'r�<�H�<�C���7�6�C8_�?�D�G)_�<mD <$WQ68q$6 5�\$<`Z\4�Dp5J]�C�?�N�D�]�UÛ�+6�C��A-?�D�����? ��6 50<�O¯D�Â�/1��I-�èå��NJ�Ð}ÌlÈîÇ0å�Fc.��i���PÂ�/nMN��I�MÛ.L�"!1,��ß��Öx*���*�(+*-,�!�Ç0å�,3��!3F¾,0_�7�? ��6 5�d�a�a/Ê�£�c&£�_c8a�aie�<

�ÛC(? ����Uk?�D�D�_`c�a�a�c3� ^ <Zr�<�C(?�����Uk? D+D�<�R ��4�CEUk?�A�]�9+684iC�� 4��X5J7p?�]�N�?�A(C�6�?�5J4iD+NBD��+< OhD 3+<�R�<RTABA�68D�_ W(<�Æ�N��$6 5�_ ? D�GH=Q< ^ ?�D�G�6��Q?�A�Ah_ 6 G�N�]�4�C�5�_nÂ�/nMN��I�MÛ.L�"!1,��ß��Ú¾�������"!$#&%�!{Ó�!E.0/K!$,�!3�'��*��EMN���)*���#ÓZ!$*-,�����MN��%YïMÂ>/$��I-��Ç�!$I+����#3Å3�'��!3/3��*���MN����*��GÌ ���K��!3/+!3��In!'äNÚMÓàÆ åiÛuæi_�7�? ��6 5Z£�¤'p�Ê�£�big�<�HF4�C��I?�DC#? ����Uk? D+D�_ ^ ? D�Æ+CM? D�Y�N-5EY�4+_�ZL?�A�N��E<B_�c8aia�c�<

�ÛC@4iD+4�A�NB��6I_`c8a��-¤��)C <LC@4iD+4�A�NB��6I<TZ\NBC�Y��+Uk5EY�C�N�7+]�N�q�6�NB��D�4�CM? D�Y�6$<LOhDÝÂ�/1��I-�gí�*��EMN����*���Ì ���K��!3/+!3��In!���°Ð�/K��M �YI&MN*���ÅK�'�ß!¢�"�lM|%'!K�eIn!2ä�ÐFзÐFÅ~Æ Ñ/ÒËæi_+7�?��i6 5Tdie�d/Ê�d�e�¤+_�c�a���¤+<

d�d

Page 24: Model Checking vs. Theorem Proving: A - Cornell University

�ÛC@4iD+4�A�NB��6I_`c8a���g��)C < C@4iD+4�A�NB��6I<ÚÐðÖQ!$#�Ü'In��MN���EÈ���#'!+���ß�3ñZ!¢�lMm!"�0< HF4�C��I?�D�C(?�����Uk?�D+D|_ ^ ?�DÆpC�?�D�Y0N-5�Y04+_`ZL?�A�N��E<�_`c8a���g�<

�ÛC@�+4�_�c8a��-¤���K=<LC@�+4+<LR ��4�CEUk?�A�D�? ]��+C�?�A�G�6 G��pY�]�N�4�D;5J��5J]E68U ?�v�4i�+]@��D+4 �QAB6 G��i6$<\H[?�D���5EY�C�N�7+]8_Z\4�Uy7+��]�68C ^ Y0NB68D�Y06 Ì 687+]�<B_ ^ ]M? D���4�C�GFjTD+N�q$68CM5.NB].�$_+c�a���¤+<

� O`6$Ô.4�AB�V?�D�GkHFNBDp5J4���Ah_�c8aia�e � _�9�<�O`6$Ô.4�AB�X?�DpG H�<�HFN�D�5J4i�+Ah< R 5.�+v�Ô.6 Y�]ENBq$6QAB4i��N�YT4�� ��D+4 �QAB6 G���6$<H[?�D���5�Y�CENB7+]�_�c8aia�e�<

� O`6�q$6 51U$�+6$_�c8a���c � >�< 3+<bO`68q$6 5$UÛ��6$<���9+6yN�D�]E68CM?iY�]�N�4�D��QNB]�9 NBD�Y�4iUy7+A�68]�6=��D+4 �QAB6 G���6~v�?�5.6 5�lX?��4�C�UV?�A`]EC�6 ? ]�Uy6�D�]�<`OhD]Â�/1��I-�gÇ�!32�!3�'�NJ°ÅK�'��!3/n�i*��EMN����*��;Ôi��MN�'�FÌ ���K��!3/+!3��In!����0Ð�/+�EM �YI�MN*���Å3���ß!+�VX�lM|%'!3��In!~ä�Å(Ô�ÌlзÅ'Æ ÑiÛuæi_+7�? ��6 5�d-¤IeCÊÛd-¤$b�_\c8a���c�<

�ÛO`6�q$6 51U$�+6$_�c8a��-¤I?-�~>�< 3+<bO`6�q$6 51U$�+6$<�Æ+4���D�G+?�]ENB4iD�5�4���?y���+D�Y�]ENB4�Dp?�AQ? 7+7+CE4$?�YM9�]E4[��D+4 �QA�6 G���6C�687+CE6 5J6�D�]�?�]�N�4�D�<¤Ð�/+��M �YI&MN*���Å3���ß!+���lM|%'!3�LIn!M_ d�£�lBc�b�b/Ê�d�c�d�_\c8a��-¤�<

�ÛO`6�q$6 51U$�+6$_�c8a��-¤iv��~>�< 3+<�O`68q$6 5$UÛ��6$<$R�AB4i��N-Y\4���N�Uy7+A�N-Y�N�]�?�D�G(68 �7+ABN�Y�NB]�v�6�ABNB60�E<�OhDxÂ�/$�-I��zí@*���MN����*��Ì ���K��!3/K!K��In!H���3Ð�/K��M �YI&MN*��;Å3���ß!+���lM|%'!3�iIn!Wä�ÐFÐFзÅ~Æ Ñ/ÒËæi_+7�?��i6 5(c8a��/Ê�die�d�_\c�a��-¤�<

�ÛO`6�q$6 51U$�+6$_�c8a���g��~>�<�3+<�O`68q$6�51U$�+6$<=H[? ��N�D+�yv�68ABN�68q$68C�54i�+](4���Y�4iUy7+�+]E68CM50<áÐ�/+�EM ��I&MN*��lÅ3���ß!+���lMBX%'!3��In!M_ï£�e�lÊ��c(Ê�c8e���_�c�a��ig�<

� O`6�q$6 51U$�+6$_�c8aia�e � >�<`3+<ïO`68q$6 51U$�+6$<(R�ABA�O��D+4 �(l@?k5J]E��G��;NBD�?���]�4$687+N�5J]E68UyN-Y(AB4i��N-Yi<PÐ�/K��M �YI&MN*��Å3�'��!+�"�dM|%'!3�LIn!M_�¤$d�?E£ D lwdig�£CÊu£�eia�_\c8aia�e�<

� O`N�Y¢9�]�6�D�5J]E68NBDX?�D�GG_�D��+6�ABNh_�c8a���b � � <�O`N-YM9�]�68D�5.]�68N�Dy? D�GkR�<�_�D��+68A�Nh<�Z\9+6 YM��N�D+��]E9+6c6�D�NB]�6�fh5.]M?�]E6Y�4�D�Y0�+C�CE68D�]�7+CE4���C�?�Uk5�5�?�]EN-5h���F]�9�68NBC�ABN�D+6 ?�C�5.7�6 Y�N86�Y8?�]ENB4�Dp5�<(OhDÝÂ�/1��I-�&ÛòÄ�� J~Ð}ÌlÈàÇ0å�Fc.��a���Â>/3MN��I&MÛ.L��!1,)�ß�MÂ�/$�K%�/1*�FHFHMN��%PÙf*���%�Ü'*&%�!1,0_+7�?��i6 5�aup"Êpc8e�p$_\c8a���b�<

�rH[? D+D�?=? D�G�_�D��+68ABNm_`c�a���c3�xD <�H[?�D+Dp? ? D�G[R�<L_�D��+68ABNm<QKo6�C�N86�Y8?�]ENB4�D;4��L]�6�Uy7�4�CM? A�7+C�4i��C�?�Uk50l]�9+6y]E68Uy7�4�C�?�A���CM? Uy68�L4�C���<;O¯D W(< ^ <�P�4��$6�C�? D�G�3+< ^ <�HF4$4iC�6$_�6 G�NB]�4iCM50_P�<JL!~Ì ��/n/+!$In���e!1,+,Â>/$��(n�"!3F�MN�ÃÌ ��Fc.0Ü��ß!K/ÇeI&Mm!3��In!M<|R@Y8?�G�68UyN-Y>_�CE6 5�50_L^T68� :o4iC���_�c8a���c�<

� H[Y ZL?�C�]E9���!+��*��"��_�c8a�p a � 3+<iH[Y�ZL? C�]�9��$_iH�< ^ ?�]�4�_��@<$>@?8��?i5J9+Nm_�? D�G ^ <iO¯�I?�CEN-5J9�Nh< � D�]�9+6LUy4�G�68A]�9+684iC��k4�����D+4 �QAB6 G��i6$< ��6 Y¢9�D+N-Y8? A�WQ687�4�CE] ^ ��R�^TfJZ ^ fßp���fmg�bupI_ ^ ]�?�D���4iCMG[jTD+N�q$68CM5.NB].�$_+c�aup�a�<

� H[Y ZL?�C�]E9��I_`c8aig�� � 3+<�H[Y ZL?�C�]E9��I<_�CE4���C�?�Uk5��QN�]�9 Y04�UyUy4iD�5J68Dp5J6$<�OhD H�<�HFNBDp5J���$_�6 G�NB]�4iC8_Ç�!3FH*��'��MNI9ÅK�K����/nFH*���MN���PÂ>/$��In!1,+,�MN��%�_�7p?���6�5a¤Ie�£/Ê�¤+c���<�H[Oß�k_�C�6�5�5�_�ZL?�U~v+C�N�G���6$_iH[?�5E5�<�_�c�a�g���<_�?�CE]T4 ��]E9+N-5�?�CE]�N-Y0AB6@N�5Q?�C�687+CENBD�]���C�4iU ?�D£?�D;?�CE]�N-Y0AB6@v��y]�9�6�5E?�Uy6�]�NB]EAB6$_�NBD2Â�/1��I-�&Ì ���K�������� JL!yÈV!$IKJi*���M8��*���MN���k�ß���<Ji��Ü-%�J��·Â�/1��In!1,+,�!1,0_f^@? ]�NB4iD�?�A�_�9���5JN�Y8?�AYO�?�v�4iCM?�]E4�CE�$_���6 G+G�NBD+�i]�4�D|_=ÓD���A-? D�G`_�K\4�Ah<�c�_�7+7�<<p�p"Ê���¤+_ c8aib���<

�rH[Y ZL?�C�]E9��I_`c8a�p����=3+<~H[Y�ZL?�CE]�9��$< Æ+4�C�UV?�ABN�\ ?�]ENB4iD�4��[].�L4 7���\&\8A�6 52NBD�q$4�A�q�N�D+� ��D+4 �QAB6 G���6$<H[?�D���5�Y�CENB7+]�_`Z\4�Uy7��+]�68C ^ Y�N�68D�Y�6 Ì 687+]8<�_ ^ ]�?�D���4iCMG;jTD+NBq$6�CM5JN�].�$_+c8a�p���<

�rHFN�ABD+6�C8_�c8a���e-� W#<�HFN�ABD+68C�<>Ð Ì *��lI&Ü��lÜ�,Ð�ß��Ì ��FHFHÜ���MNI+*���MN��%EÇ0å&,3�ß!KF¾,0< O`6 Y�]E�+C�6�^�4�]�6�5VN�DZ\4�Uy7+��]�68C ^ Y0NB68D�Y06$_$Ko4iAh<�a�d�< ^ 7+CENBD+�i68C�f�K\68C�A�?���_+P�68CEABNBD� �^T68� :\4iC���_`c8a���e�<

d�£

Page 25: Model Checking vs. Theorem Proving: A - Cornell University

�rHF4iC�CEN-5Q?�DpG×^�?�G�4�_�c�a���g��H_ <\>�<�HF4iC�C�N�5=?�D�G W(<\R�<b^�?�G�4�<�WQ687+C�6�5J68D�]�N�D+�[?iY�]�N�4�D�5=�QNB]E9 ? D?�5�5.�+Uy7+]ENB4iD+f%vp?�5J6�G ]�CE�+]�9kUk? NBD�]�68Dp?�D�Y�6�5J��5J]E68U[< OhD]Â�/1��I-�gí@*���MN����*���Ì ���K��!K/K!3��In!x���°Ð�/+��M ��XI&MN*��çÅK�'��!+�"�lM|%�!3��In!2ä�зÐFÐFÅ2Æ Ñiâuæi_�7�? ��6 5(c&£/Ê�c�p$_�c�a���g�<

�rHF4I5J6 5Q? D�G����+]E]�AB6I_`c8a������=:=< HF4$5.6 5�? D�G�H�<iW(<����+]E]�A�6$<�_ÓCE4��iCM?�UXUyNBD+�Æ5JN�U{�+A�]M? D+684��p5�?�Y�]ENB4�Dp5��5JN�D+�yY04�UyUy4iD{��D+4 �QAB6�G���6$<¤Ð�� %���/nM"�NJiFHMNI+*�_L£�l�c8d�cdÊ�c�g�a�_�c8a�����<

� HF4I5J6 50_�c8a���� � :=< HF4$5.6 5�<�W6�5J4���CMY�68f�v�4��+DpG�6 G=��D+4 �QA�6 G���6I<�OhD H�<8:=<�KL? CMG�Nm_�6 G�NB]�4iC8_nÂ�/1��I-�nÇ�!$I"X����#]Ì ���K��!3/+!3��In!����E�<JL!$��/K!¢�EMNI+*��iÐ�,�.L!$In�N,x�ß�·Ó�!$*-,�����MN��%)*�(+��Ü��XÚx����� �"!$#&%'!M_`7p?���6�5Qd�g�c(Ê�d�p g�<HF4�C��I?�D�C(?�����Uk?�D+D|_ ^ ? D�Æ+CM? D�Y�N-5EY�4+_�ZL?�A�N��E<B_�c8a�����<

� ^�?�NB]ÆRTv�G+?�A�A-? 9�_�c8a���a � H�<|R�<�^@? NB]�RTv�G+?�A�A-? 9�<yR�A�4���N�Y�4�fm?�A���68v�CM?�N�Y{? 7+7+CE4$?�YM9�]E4 ]E9+6~Uy4�G�68A]�9+684iC��k4�����D+4 �QAB6 G��i6$<��<JL!$��/K!¢�EMNI+*��&Ì ��Fc.0Üu��!3/·Ç0I&Mm!3�iIn!M_�g�g�?hd D lwdie�b/Ê�d�£id�_\c8a���a�<

�Û^�NBA-5E5J4iD�_`c�a���g��H^�<L^�NBA-5E5J4iD�< _�C�4�vp?�v+N�ABN-5.]�N�YTAB4i��N-Yi<¤Ð�/K��M �YI&MN*���ÅK�'�ß!¢�"�lM|%'!K��I�!�_�d���llp$cdÊu�upI_�c8a���g�<� _�?�C�N���9V?�D�G;WT? Uk?�D���ÔE?�U£_�c�a��ib � W(<X_�?�C�N���9 ?�D�G�W(<�W�?�UV?�D���ÔE?�U[< Ì N-5.]�CENBv+�+]E6 G[7+C�4�Y�6�5�5JN�D+�

?�D�G2]E9+6~AB4��iN-Y�4 �Q��D+4 �QAB6 G��i6$<~OhD�W(<�_�? C�NB��9�_�6 G�N�]�4iC8_�Â�/1��I-�ì���/1�&,+Ji�n.q���WÙh�K%�MNIK,)�ß��Â�/1�zX%�/1*�F¾,0_�7�?��i6 5Tdib�g/Ê�d�g���_\c8a���b�<

� _�?�C�N���9|_`c8aia�c � W(<�_�?�CENB��9�<�HF4iD+4�]E4�D+N�Y�? D�G@D+4�D+UX4�D+4i]�4�D�N-Y�AB4i��N-Y�5`4�����D+4 �QAB6 G���6$<nÍïÜ'��#�*�F�!K�'�E*Å3�K����/3FH*��EMNI+*'!�_�c8b'?�£�_ͤ D l�d�bibCÊ�d�p&¤�_oc�a�a�c�<

�Û_ 6 ?�CEA�?�DpG K\68C�UV?�_�c8a��up&�~3+<i_�6 ? C�A ?�DpG��@<�K\68CEUk?�<���9+6(AB4i��N-Y�4��\CE687+C�6�5J68D�]�N�D+�=G�6�7�6�D�G�68D�Y0NB6 5v�� G�N�C�6 Y�]E6 G���C�?�7+9�50<�OhDëÂ�/1��I-��í@*���MN����*��}Ì ���K��!3/+!3��In!����EÐ�/K��M �YI&MN*��GÅ3�'��!+���lM|%'!3��I&!Tä�зÐFÐFÅÆ Ñmó\æi_+7�?��i6 5c£�p&¤$Ê�£up�a�_\c8a��upI<

�d���+6�NBABA�6@? D�G ^ N��m?���N-50_`c�a���d��=3+<�_ <X���+68N�ABAB6 ?�D�G�3+< ^ N��m?���N-50< ^ 7�6 Y0N86�Y8? ]�N�4�D�?�DpG�q$68CEN86�Y�?�]�N�4�D;4��Y�4�D�Y0�+C�CE68D�]~5.�+5.]�68UV5�NBD ZY= ^ R@W(< OhDTÂ�/1��I-�Iß�� J�Å3���ËÆ �¤Ç0å�Fc.������EÂ�/1�+%�/$*�FHFHMN��%�_bO`6�Y�]��+CE6^T4�]E6 5yNBD Z\4�UX7+�+]�6�C ^ Y�N�68D�Y�6$_LKo4iAh<�c&£�p$_@7�? ��6 5G£�£up�Ê�£�p$c�< ^ 7+CENBD+�i68C�f�K\68C�A�?��+_�P�68C�A�NBD� �^T68�:o4iC���_�c8a���d�<

�rWQ68N�]�68C�_�c�a���¤��~W(<�W68N�]�68C�< ��4 �Æ?�CMG�5@? A�4��iN-Y8? A�C�6 Y�4iD�5J]EC���Y0]�NB4iDk4��\CE68A-? ]�NB4iD�?�A�G+? ]M?�vp?�5J6=]E9+684iC��$<O¯DXH�<�O�<�P�CE4�G�NB6I_$3+<$HF��AB4�7�4i�+AB4I5�_�?�D�G~3+<���< ^ Y¢9+UXN-G�]�_86 G�NB]E4�C�5�_;ô>�2Ì ����In!�.L�EÜ�*��mÈ���#'!+�"�dMN��%�_7�?��i6 5�c8a�cdÊÛd�£�£�< ^ 7+CENBD+�i68C�f�K\68C�A�?���_+P�68CEABNBD� �^T68� :\4iC���_`c8a��-¤�<

�rWQ4$5.68D�5EY¢9+6�NBDk? D�G�C(?�6�ABv+A�NBD+��_`c8a���g�� ^ <�3+<�W4I5J68D�5EY¢9�68NBDk? D�G�O�<L_ <�C(?�6�ABv+A�NBD+��<b��9+6�5J��D�]�9+6 5.N-54��LG�N���N�]M?�A�UV?�YM9+NBD+6�5Ó�QN�]�9k7+CE4�qi? v+AB6(687+N�5J]E68UyN-YQ7+CE4�7�68C�]ENB6 50<\OhDF3+<+: <+>@? AB7�68C�D|_+6 G�NB]E4�C�_¤�<JL!(X��/K!+��MNI+*��çÐ�,�.L!$In�N,)�ß�PÓ�!$*-,�����MN��%�*�(+��Ü���Úx����� �"!$#&%'!/ï�Â�/1��I-��ÛòånÑiâ~Ì ���K��!3/+!3��In!M_�7�? ��6 5@��£/Ê�a�p$<HF4�C��I?�D�C(?�����Uk?�D+D|_ ^ ? D�Æ+CM? D�Y�N-5EY�4+_�ZL?�A�N��E<B_�c8a���g�<

�rWQ4$5.68D�5EY¢9+6�NBD�_�c8a��ib-� ^ <+3+<�W4I5J68D�5EY¢9�68NBD�<fÆ+4�CEUk?�A�]E9+684�CENB6 5\4��ÓR@O�N�Dy��D�4��QA�6 G��i6(?�D�GyCE4�v�4�]EN-Y850<íS!3�¡ÎZ!3�e!3/$*��EMN���ÃÌ ��Fc.0Ü���MN��%�_L£�lÊ£-¤IbCÊ�£ibupI_oc�a��ib�<

� ^ 9+4�9�? U[_`c�a���p � :=< ^ 9�4�9�? U[<�R 5J6�Uk?�D�]�N�Y8?�AI?�7+7+CE4$?iY¢9=]E4@D+4�D�Uy4�D+4i]�4iD+N-Y\AB4��iN-Y850<�O¯DyÂ�/1��I-�YØ���#ÅuÏ�Ï�ÏëÇ0å�Fc.��f���°Ùf�+%�MNI@MN�ÃÌ ��Fc.0Ü��ß!K/9Ç0I&Mm!K��In!M_�7�?��i6 5Td�p b/Ê�dup�a�_\c8a��upI<QW6�7+C�N�D�]E6 G{NBDVH�<LO�<

d-¤

Page 26: Model Checking vs. Theorem Proving: A - Cornell University

rTN�D�5Jv�68CE��?E=\G`< D _�ÓZ!$*�#�MN��%-,óMN�õí�����FH������������MNIxÓZ!$*-,����iMN��%�_�HF4iC��$? DkC(?�����UV?�D�_ ^ ?�DÐÆpC�?�D+fY�N-5EY�4+_`ZL? ABN��E<�_`c�a��upI_�7�7�<�d�d�p"Ê�dib�e�<

� ^ N-5J]EA-?=? D�GFZ\A-?�CE�$6$_`c�a��ib � R�<�_�< ^ N�5J]EA-?�? D�G�=Q<+H�<+Z\A�?�C��$6I<���9+6�Y�4�Uy7�AB68 �NB].�(4�� 7+CE4�7�4$5.NB]ENB4�Dp?�AABNBD�6 ?�CQ]E68Uy7�4�C�?�A`A�4��iN-Y850<GÔ���Ü�/n�i*��f�ß�@� JL!MÐ}ÌlÈ£_�£id'?E£ D llp�£�£/Ê�p�¤$a+_�c�a���b�<

� ^ N-5J]EA-?=? D�G�rT6�C�Uk? D�_`c�a��up��~R�<f_�< ^ N�5J]�A�?F? D�G ^ < H�<br�68C�Uk? D�<kWQ6 ?�5.4�D+N�D+�F�QN�]�9�Uk? D��;7+C�4ifY�6 5�5.6 5�< OhD]Â�/1��I-�gØ��i#HÅ�Ï�Ï�Ï�Ç0å�Fc.��ï���xÙf�+%�MNI@MN�2Ì ��Fc.0Üu��!3/{Ç0I�Mm!3��In!M_�7�?��i6 5@c&£��CÊpc8b�d�_�c�a���p$<

� ^ ]M?�CE�`_�c�a���cn����< W(< ^ ]�?�CE�`<;R A�4��iN-Y{4 ����D+4 �QA�6 G���6I<]ö !3M"� ,�I+Ji/nM �3�X�:÷Ü�/PÈ�*��NJL!3FH*��EM8,�I+JL!xÙf�+%�M8�Ü'��#2Î�/3Ü'��#��l*&%'!3�V#'!K/È *�� JL!KFH*��EM8� _�d�p$lÊ£up$c(Ê�£�p&¤+_\c�a���ci<

� ^ �+v+CM? Uk?�D�N-?�D;? D�G�rT6�D+6 5J6�C�68]E9�_�c8a��up&� Ì < ^ �+v+C�?�Uk? D+N-? D�? D�G�H�<�W#<br�68D+6�5J68CE68]�9�<)��9+6~C�6�ABf68qi?�D�Y�6�4�� NBCEC�68A�68qi?�D�Y�6I<�OhD�Â�/1��I-�y�L!3�'�NJëÅK�'��!3/n�i*��EMN����*���Ôi��MN�'�'Ì ���K��!3/+!3��In!����TÐ�/K��M �YI&MN*��Å3�'��!+�"�dM|%'!3�LIn!2ä�Å(Ô�ÌlзÅ'Æ Ñmó\æi_+7�? ��6 5>¤+c�gCÊ�¤$d�d�_�c8a��upI<

� KL? CMG�N|?�D�Gk�24iAB7�68C8_�c�a��ig � H�<�: <+K�? CMG�N ? D�G�_ <���4�A�7�68C8<LRTD;?��+]E4�Uk? ]M? f%]E9+684�CE68]�N�Y(?�7+7+CE4$?iY¢9]�4�?���]�4�UV?�]�N�Y 7�C�4��iCM? U q$68C�Nl6�Y8? ]�NB4iD�<yOhDÚÂ�/$�-I��GÛ&,3�·ÅuÏ�Ï�Ï¡Ç0å�Fc.������ÝÙf�+%�MNI�MN�TÌ ��Fc.0Ü��ß!3/Ç0I&Mm!3��In!�_`7�?��i6 5�£�£�d/Ê�£�¤�¤+_\c�a���g�<

� KL? CMG�Nm_`c8a���d � H�<+:=<+KL?�C�G�Nh<���9+6=Y�4iUy7+A�68 �N�].�=4��\CE68A-? ]�NB4iD�?�AfU$�+68CE�yA-? D+���p?���6�5�<@OhD2Â�/1��I-��Û�Ò��NJÐ}ÌlÈøÇ0å�Fc.������E�<JL!$��/3å��ß�yÌ ��Fc.0Ü���MN��%�_+7�? ��6 5(c&£�p"Ê�c3¤$g�_oc�a��id�<

� KL? CMG�Nm_`c8a���b��=H�<Q:=<QKL?�CMG�Nh< RSUy4�G�68A�f%]E9+684�CE68]�N�Y[?�D�? AB��5JN�5 4��~UX4�D+4i]�4�D�N-Y[��D+4 �QA�6 G���6I< OhDÂ>/$��I-�Éí�MN�'�NJëÅK�'��!3/n�i*��EMN����*���Ôi��MN�'�2Ì ���+��!3/K!3�iIn!k���ùÐ�/+��M �YI&MN*��ÉÅK�'��!+�"�lM|%�!3��In!¡ä�Å(Ô�ÌlÐ·Å¡Æ Ñnßdæi_7�?��i6 5@b�eiaCÊÛb�c8d�_�c8a���b�<

� KL? CMG�Nm_`c8a���g��=H�<�:=<iK�? CMG�Nm<h���+6�C���NBD+�@A�4��iN-Y8? A�G+?�]�?�v�?i5J6 50<�Ô���Ü�/n�i*��L�ß�}Ì ��Fc.0Üu��!3/�*���#PÇ0å�,3��!3FÇ0I&Mm!3��In!$,0_�£�£�lBcn¤IdCÊpc8g�e�_\c8a��ig�<

d�b