两个被广泛使用的Model Checking工具

最近看论文的时候，发现和软件分析、测试及模型检验相关的论文，都会引用两个Model Checking工具，分别是：

BLAST: http://mtc.epfl.ch/software-tools/blast/index-epfl.php/
SLAM: http://research.microsoft.com/en-us/projects/slam/

和这两个工具相关几篇主要论文，引用次数都很多，下面举几个例子：

“Software model checking tools, like SLAM [1] and Blast [2], ……”
——C. Y. Cho, D. Babi, P. Poosankam, K. Z. Chen, E. X. Wu, and D. Song, "MACE: model-inference-assisted concolic exploration for protocol and vulnerability discovery," in Proceedings of the 20th USENIX conference on Security, San Francisco, CA, 2011, p. 10-10.

“Two popular software model checker, BLAST and SLAM, have also been used for generating test inputs with the goal of covering a specific predicate or a combination of predicates [3, 4]”

——C. S. P, S, Reanu, P. C. Mehlitz, D. H. Bushnell, K. Gundy-Burlet, M. Lowry, S. Person, and M. Pape, "Combining unit-level symbolic execution and system-level concrete execution for testing nasa software," in Proceedings of the 2008 international symposium on Software testing and analysis, Seattle, WA, USA, 2008, pp. 15-26.

“most software model checkers [1, 5] do not offer control-flow (path) abstractions”

——R. Santelices and M. J. Harrold, "Exploiting program dependencies for scalable multiple-path symbolic execution," in Proceedings of the 19th international symposium on Software testing and analysis, Trento, Italy, 2010, pp. 195-206.

参考文献：

[1] T. Ball, R. Majumdar, T. Millstein, and S. K. Rajamani, "Automatic predicate abstraction of C programs," in Proceedings of the ACM SIGPLAN 2001 conference on Programming language design and implementation, Snowbird, Utah, United States, 2001, pp. 203-213.

[2] T. A. Henzinger, R. Jhala, R. Majumdar, and G. Sutre, "Software verification with BLAST," in Proceedings of the 10th international conference on Model checking software, Portland, OR, USA, 2003, pp. 235-239.

[3] D. Beyer, A. J. Chlipala and R. Majumdar, "Generating Tests from Counterexamples," in Proceedings of the 26th International Conference on Software Engineering, 2004, pp. 326-335.

[4] T. Ball, "A theory of predicate-complete test coverage and generation," in Proceedings of the Third international conference on Formal Methods for Components and Objects, Leiden, The Netherlands, 2005, pp. 1-22.

[5] D. Beyer, T. A. Henzinger, R. Jhala, and R. Majumdar, "The software model checker Blast: Applications to software engineering," Int. J. Softw. Tools Technol. Transf., vol. 9, pp. 505-525, 2007.

参考文献1在Google Schoolar中的引用次数为648次，参考文献2的引用次数为364次（引用次数为2012年3月21日数据），这两个工具的影响力可见一斑。