Verifying safety properties of Lustre programs: An SMT-based approach

An important problem in hardware and software design is ensuring a designed system is error-free. Even small errors in a computer system can have disastrous consequences to a project, sometimes costing large amounts of money to correct, or even leading to unexpected and catastrophic system failure. There are a number of steps one can take to eliminate as many errors as possible. We focus on a set of techniques known as formal methods that are used in computer science to help ensure correct system behavior. In order to minimize the potential for human error and to reduce the time and expertise needed, we seek to use techniques that are highly automatable. We focus on one such approach, an inductive variation of model checking that can be used to verify formally the invariance of properties or produce counterexamples. One class of systems of particular interest for verification are reactive systems. This is a class of systems that continuously react to their environment in a timely manner. Reactive systems are pervasive in everyday life, ranging from simple thermostats to the controls of nuclear power plants. As a representative language to describe these systems, we look at an established specification and programming language, Lustre. We have developed a set of techniques based on inductive reasoning and Satisfiability Modulo Theories (SMT) that are automatically able to prove invariant properties of systems described in Lustre. These techniques involve the translation