# Nernst and Seebeck effect in a graphene nanoribbon

Yanxia Xing1, Qing-feng Sun2, and Jian Wang1 1Department of Physics and the
Center of Theoretical and Computational Physics, The University of Hong Kong,
Pokfulam Road, Hong Kong, China
2Beijing National Lab for Condensed Matter Physics and Institute of Physics,
Chinese Academy of Sciences, Beijing 100080, China

###### Abstract

The thermoelectric power, including the Nernst and Seebeck effects, in
graphene nanoribbon is studied. By using the non-equilibrium Green function
combining with the tight-binding Hamiltonian, the Nernst and Seebeck
coefficients are obtained. Due to the electron-hole symmetry, the Nernst
coefficient is an even function of the Fermi energy while the Seebeck
coefficient is an odd function regardless of the magnetic field. In the
presence of a strong magnetic field, the Nernst and Seebeck coefficients are
almost independent of the chirality and width of the nanoribbon, and they show
peaks when the Fermi energy crosses the Landau levels. The height of $n$-th
(excluding $n=0$) peak is $[\ln 2/|n|]$ for the Nernst effect and is $\ln 2/n$
for the Seebeck effect. For the zeroth peak, it is abnormal with height $[2\ln
2]$ for the Nernst effect and the peak disappears for the Seebeck effect. When
the magnetic field is turned off, however, the Nernst effect is absent and
only Seebeck effect exists. In this case, the Seebeck coefficient strongly
depends on the chirality of the nanoribbon. The peaks are equidistant for the
nanoribbons with zigzag edge but are irregularly distributed for the armchair
edge. In particular, for the insulating armchair ribbon, the Seebeck
coefficient can be very large near the Dirac point. When the magnetic field
varies from zero to large values, the differences among the Seebeck
coefficients for different chiral ribbons gradually vanish and the nonzero
value of Nernst coefficient appears first near the Dirac point then gradually
extents to the whole energy region.

###### pacs:

72.15.Jf, 73.23.-b, 73.43.-f, 81.05.Uw

##  I introduction

As a single atomic layer extracted from graphite, graphene has been
successfully fabricated experimentally.ref1 ; ref01  Due to its peculiar
topological structure, the graphene exhibits peculiar properties.ref2  For the
graphene sheet, the conduction and valence band in graphene intersect at Dirac
points, the corners of the hexagonal first Brillouin zone. Around the Dirac
points graphene has a unique band structure and its quasi particles satisfy
the massless Dirac equation where the speed of light is replaced by the Fermi
velocity of graphene ($v_{F}\approx 10^{6}m/sec$). Experimentally, by varying
the gate voltage, the charge carriers of graphene can be easily tuned,
globallyref1  or locallyref3 . As a result the Fermi level can be above or
below the Dirac points, which is viewed as electron-like or hole-like system.
Along the different crystal direction in honeycomb lattice, the band
structureref4  and the transport properties are different. For the graphene
ribbon with the zigzag edge, a special edge state exists.ref5  While for the
graphene ribbon with armchair edge, it is metallic when the transverse layer
$N=3M-1$ with integer M and insulator otherwise.ref5  When the perpendicular
magnetic field is strong enough to form Landau levels (LLs), these differences
due to different chirality at the zero magnetic field disappear. In addition,
both theoreticallytheory2  and experimentally,ref2  the Hall conductance was
found to be the half-integer in the values $g(n+1/2)e^{2}/h$ with degeneracy
$g=4$, indicating that the quantization condition is shifted by a half-integer
compared with the usual integer quantum Hall effect. It is a direct
manifestation of the unique electronic structure of graphene.

The thermoelectric power (TEP), or the thermal gradient induced current (or
bias with an open boundary), results from a balance of electric and thermal
forces acting on the charge carriers. In general, we consider two
thermoelectric powers, the Nernst effect which is the transverse TEP induced
by a longitudinal thermal gradient in a perpendicular magnetic field and the
Seebeck effect which is the thermal gradient induced bias in a two probe
system. TEP is of great importance in understanding electronic transport
because it is more sensitive to the details of the density of states ref6  and
the particle-hole asymmetryref7  than the conductance. In the early days,
because of the experimental difficulty (particularly in low-dimensional
systems or nano-devices), the Nernst effect and Seebeck effect are often
neglected. Instead, one usually measures the Hall effect and the resistivity.
Now, with the development of the micro-fabrication technology and the low-
temperature measurement technology, the thermoelectric measurement in low-
dimensional samples has been feasible.ref8  Recently, the Nernst effect and
Seebeck effect have been widely observed and experimentally investigated in
many systems, including the high-Tc superconductivity,ref9  ferromagnets,ref10
semimetallic,ref11  Pyrochlore Molybdates,ref12  Bismuch,ref13  single walled
carbon nanotube,ref14  etc. For the graphene, the study of thermoelectric
properties can elucidate details of the electronic structure of the ambipolar
nature that cannot be realized by probing conductance alone. Very recently,
using a microfabricated heater and thermometer electrodes, the conductance and
the diffusive TEP of graphene are simultaneously measured by Zuev
et.al.Gtherm1  and Wei et.al..Gtherm2  Zuev et.al. found electrons and holes
contribute to Seebeck effect in opposite ways. At high temperatures direct
measurement of Seebeck coefficient $S_{C}$ can be compared with that
calculated from the Mott relation.Mott  Furthermore, divergence of $S_{C}$ and
the large Nernst signal were found near the charge neutral point (i.e. the
Dirac point).Gtherm2  Also, at low temperatures, depending on $E_{F}$, TEP is
oscillating. The temperature suppresses the oscillation and enhances the
magnitude of TEP.

Up to now, some theoretical investigations have been carried out on the
thermal response in the graphene. The electronic transport coefficients
including thermopower was semiclassically treated and only classical Hall
effect (low field) in graphene was studied.theory1  In addition, the Nernst
coefficient was studied only in weak magnetic field. It was found to be strong
and positive near Dirac point.theory2  For a strong magnetic field in the
quantum Hall regime, the Seebeck coefficient was studied and was focused on
its dependence of the field orientation.theory3  In all these works, the
quantum Nernst effect is absent because of the calculational subtleties in the
presence of the strong magnetic field. For the normal two dimensional electron
gas characterized by a parabolic dispersion, the Nernst effect has been
studied.NernstTheory1 ; NernstTheory2 ; KuboNernst  Of these works, two
alternative boundary conditions were considered in calculating the thermal
response functions. One is the adiabatic boundary condition that the
temperatures in the upper and lower edge are fixed. In this case the Nernst
coefficient is similar to the Seebeck coefficient.NernstTheory1  The other one
is the non-adiabatic boundary condition on the upper and lower edges, in which
the edge currents are in contact with two heat baths with different
temperatures.KuboNernst  The Nernst coefficient is different from the Seebeck
coefficient. It is the purpose of our work to focus on the quantum Nernst
effect in the graphene nanoribbon with the adiabatic boundary condition.

In this paper, we carry out a theoretical study of the Nernst effect in a
crossed graphene nanoribbon and the Seebeck effect in a single graphene
nanoribbon in the strong perpendicular magnetic field, zero magnetic field,
and weak magnetic field. By using the tight binding model and the
nonequilibrium Green function method, the transmission coefficient and
consequently the Nernst and Seebeck coefficients are obtained. In a strong
perpendicular magnetic field $B$, high degenerated LLs are formed, and the
edge states dominate the transport processes, so the Nernst (Seebeck)
coefficients are almost the same along the different chiral directions. We
find that the Nernst coefficient $N_{C}$ and the Seebeck coefficient $S_{C}$
show peaks when the Fermi energy $E_{F}$ passes the LLs. At $E_{F}=0$, because
the zeroth LL is shared by electron-like and hole-like Landau states, $N_{C}$
which is an even function of $E_{F}$ has the highest peak while $S_{C}$ which
is an odd function of $E_{F}$ vanishes. On the other hand, at zero $B$, there
is no Lorentz force to bend the trajectories of the thermally diffusing
carriers, so Nernst effect is absent. In this case, the Seebeck coefficient
$S_{C}$ is strongly dependent on the chirality of graphene ribbon. In
particular, for the insulating armchair ribbon, $S_{C}$ can be very large near
the Dirac point. At last, the crossover behavior of the thermoelectric power
from the zero magnetic field to the strong magnetic field is also studied.

The rest of the paper is organized as follows. In Section II, the models for
crossed graphene ribbon or single graphene ribbon are introduced. The
formalisms for calculating the Nernst and Seebeck coefficient are then
derived. Section III gives numerical results along with discussions. Finally,
a brief summary is presented in Section IV.

##  II model and formalism

We consider two graphene systems: a four terminal crossed graphene nanoribbon
and a two terminal graphene nanoribbon as shown in the left and right insets
of Fig.1(b). Here we consider ballistic two dimensional electron gas in which
the mean free path and the phase coherent length are greater than the device
size. In the experiment, we can use the smaller sample to reduce the device
size, and use the lower temperature or the higher magnetic field to enhance
the phase coherent length. In the tight-binding representation, the
Hamiltonian operator can be written in the following form:ref2 ; ref19 ; ref20

$\displaystyle H_{G}=\sum_{\bf i}\epsilon_{\bf i}a^{\dagger}_{\bf i}a_{\bf
i}-\sum_{<{\bf ij}>}te^{i\phi_{ij}}a_{\bf i}^{\dagger}a_{\bf j},$ (1)

where ${\bf i}=(i_{x},i_{y})$ is the index of the discrete honeycomb lattice
site which is arranged as in inset of Fig.1b, and $a_{\bf i}$ and $a_{\bf
i}^{\dagger}$ are the annihilation and creation operators at the site ${\bf
i}$. $\epsilon_{\bf i}$ is the on-site energy (i.e. the energy of the Dirac
point) which can be controlled experimentally by the gate voltage, here we set
$\epsilon_{i}=0$ as an energy zero point. The second term in Eq.(2) is the
hopping term with the hopping energy $t$. When the graphene ribbon is under a
uniform perpendicular magnetic field $B_{z}=B$, a phase $\phi_{ij}$ is added
in the hopping term, and $\phi_{ij}=\int_{i}^{j}\vec{A}\cdot
d\vec{l}/\phi_{0}$ with the vector potential $\vec{A}=(-By,0,0)$ and the flux
quanta $\phi_{0}=\hbar/e$.

With this ballistic system, the current flowing to the p-th graphene lead can
be calculated from the Landauer-B$\ddot{u}$ttiker formula:addnote1

$\displaystyle J_{p}$ $\displaystyle=$
$\displaystyle\frac{2e}{\hbar}\sum_{q}\int\frac{dE}{2\pi}[T_{pq}(E)(f_{p}(E)-f_{q}(E))].$
(2)

where $p,q=1,2,3,4$ for the four terminal system or $p,q=1,2$ for the two
terminal system, and $T_{pq}$ is the transmission coefficient from terminal-q
to terminal-p.

In Eq.(2), the transmission coefficient $T_{pq}$ can be calculated from
$T_{pq}(E)=Tr[\Gamma_{p}G^{r}\Gamma_{q}G^{a}]$, where the line-width function
$\Gamma_{p}(E)=i(\Sigma_{p}^{r}-\Sigma_{p}^{r\dagger})$. The Green’s function
$G^{r}(E)=[G^{a}(E)]^{\dagger}=\\{EI-H_{0}-\sum_{p}\Sigma^{r}_{p}(E)\\}^{-1}$
where $H_{0}$ is Hamiltonian matrix of the central region and $I$ is the unit
matrix with the same dimension as that of $H_{0}$, and $\Sigma_{p}^{r}$ is the
retarded self-energy function from the lead-p. The self-energy function can be
obtained from $\Sigma^{r}_{p}(E)=H_{c,p}g^{r}_{p}(E)H_{p,c}$, where $H_{c,p}$
($H_{p,c}$) is the coupling from central region (lead-p) to lead-p (central
region) and $g^{r}_{p}(E)$ is the surface retarded Green’s function of semi-
infinite lead-p which can be calculated using transfer matrix method.transfer
$f_{p}(E)$ in Eq.(2) is the Fermi distribution function, it is also a function
of the Fermi energy $E_{F}$ and temperature $\mathcal{T}$, and can be written
as

$f_{p}(E,E_{F}^{p},\mathcal{T}_{p})=\frac{1}{e^{(E-E^{p}_{F})/k_{B}\mathcal{T}_{p}}+1}$
(3)

where $E^{p}_{F}=E_{F}+eV_{p}$ with $e$ the electron charge and $V_{p}$ is the
external bias. In the four terminal system, the thermal gradient
$\Delta\mathcal{T}$ is added between the longitudinal terminal-1 and
terminal-3, and $\mathcal{T}_{1}=\mathcal{T}+0.5\Delta\mathcal{T}$,
$\mathcal{T}_{3}=\mathcal{T}-0.5\Delta\mathcal{T}$, $V_{1}=V_{3}=0$. Due to
the Lorentz force, the longitudinal thermal gradient induces a transverse
current $J_{2,4}$ in the closed boundary condition or a transverse bias
$V_{2,4}$ in the open boundary condition in the terminal-2 and terminal-4.
Here we consider the open boundary ($J_{2}=J_{4}=0$) and calculate the
balanced bias $V_{2,4}$. While in the two terminal system, both original
thermal gradient $\Delta\mathcal{T}$ and induced balanced bias are considered
in the longitudinal terminal-1 and terminal-2, and we have
$\mathcal{T}_{1}=\mathcal{T}+0.5\Delta\mathcal{T}$ and
$\mathcal{T}_{2}=\mathcal{T}-0.5\Delta\mathcal{T}$. Assuming small thermal
gradient and consequently the small induced external bias, the Fermi
distribution function in Eq.(3) can be expanded linearly around the Fermi
energy $E_{F}$ and the temperature $\mathcal{T}$,

$\displaystyle f_{p}(E,E_{F}^{p},\mathcal{T}_{p})$ $\displaystyle=$
$\displaystyle f_{0}+eV_{p}\left.\frac{\partial f}{\partial
E^{p}_{F}}\right|_{V_{p}=0,\mathcal{T}_{p}=\mathcal{T}}+\Delta\mathcal{T}_{p}\left.\frac{\partial
f}{\partial\mathcal{T}_{p}}\right|_{V_{p}=0,\mathcal{T}_{p}=\mathcal{T}}$ (4)
$\displaystyle=$ $\displaystyle
f_{0}+f_{0}(f_{0}-1)\left[\frac{eV_{p}}{k_{B}\mathcal{T}}+(E-E_{F})\frac{\Delta\mathcal{T}_{p}}{k_{B}\mathcal{T}^{2}}\right]$

where $f_{0}=\left[e^{(E-E_{F})/k_{B}\mathcal{T}}+1\right]^{-1}$ is the Fermi
distribution in the zero bias and zero thermal gradient. Then for the four
terminal system, the current $J_{2}$ of the terminal-2 can be rewritten as:

$\displaystyle J_{2}$ $\displaystyle=$ $\displaystyle\frac{2e}{h}\int
dE~{}f_{0}(f_{0}-1)T_{21}(E)\left[(E-E_{F})\frac{\Delta\mathcal{T}}{2k_{B}\mathcal{T}^{2}}+\frac{qV_{2}}{k_{B}\mathcal{T}}\right]$
(5) $\displaystyle+$ $\displaystyle\frac{2e}{h}\int
dE~{}f_{0}(f_{0}-1)T_{23}(E)\left[(E-E_{F})\frac{-\Delta\mathcal{T}}{2k_{B}\mathcal{T}^{2}}+\frac{qV_{2}}{k_{B}\mathcal{T}}\right]$
$\displaystyle+$ $\displaystyle\frac{2e}{h}\int
dE~{}f_{0}(f_{0}-1)T_{24}(E)\left[e\frac{V_{2}-V_{4}}{k_{B}\mathcal{T}}\right]$

Similarly, the expression for the current $J_{4}$ of the terminal-4 can also
be obtained. Using the open boundary condition with $J_{2}=J_{4}=0$ and
considering the system symmetry ($T_{21}=T_{43}$, $T_{23}=T_{41}$ and
$T_{24}=T_{42}$), the Nernst coefficient $N_{C}$ in the four terminal system
is:

$\displaystyle N_{C}$ $\displaystyle=$
$\displaystyle-\frac{V_{2}-V_{4}}{\Delta\mathcal{T}}$ (6) $\displaystyle=$
$\displaystyle\frac{1}{e\mathcal{T}}\frac{\int
dE~{}(E-E_{F})(T_{21}-T_{23})f_{0}(f_{0}-1)}{\int
dE~{}(T_{21}+T_{23}+2T_{24})f_{0}(f_{0}-1)}$

In the two terminal system, the current $J_{1}=-J_{2}$ is

$\displaystyle J_{1}$ $\displaystyle=$ $\displaystyle\int
dEf_{0}(f_{0}-1)T_{21}(E)\left[(E-E_{F})\frac{\Delta\mathcal{T}}{2k_{B}\mathcal{T}^{2}}+e\frac{(V_{1}-V_{2})}{k_{B}\mathcal{T}}\right]$

Let $J_{1}=0$, we have Seebeck coefficient $S_{c}$

$\displaystyle S_{C}$ $\displaystyle=$
$\displaystyle-\frac{V_{1}-V_{2}}{\Delta\mathcal{T}}$ (7) $\displaystyle=$
$\displaystyle\frac{1}{e\mathcal{T}}\frac{\int
dE~{}(E-E_{F})T_{21}(E)f_{0}(1-f_{0})}{\int dE~{}T_{21}(E)f_{0}(1-f_{0})}$

##  III numerical results and discussion

In the numerical calculations, we set the carbon-carbon distance $a=0.142nm$
and the hopping energy $t=2.75eV$ as in a real graphene sample.ref3 ; ref4
Throughout this paper the energy is measured in the unit of $t$. The magnetic
field $B$ is expressed in terms of magnetic flux $BS_{0}$ in the unit of
$\phi_{0}/\pi$ where $S_{0}=\frac{3}{2}\sqrt{3}a^{2}$ is the area of a
honeycomb unit cell and $\phi_{0}=\hbar/e$ is the flux quanta. If we set
$BS_{0}=0.001\phi_{0}/\pi$, the real magnetic field is around $4T$. The width
of the graphene ribbon is described by an integer $N$, and the corresponding
real width is $3Na$ for zigzag edge nanoribbon and $\sqrt{3}Na$ for the
armchair edge nanoribbon. In the schematic setup-1I and setup-1II in the inset
of Fig.1b, $N=2$. In the presence of the strong perpendicular magnetic field,
since transport properties are independent of the chirality, we choose the
setup-1I shown in the left inset of Fig.1(b) to study the Nernst effect and
the setup-1II shown in right inset of Fig.1(b) to study the Seebeck effect. On
the other hand, when the magnetic field is zero, the Seebeck effect strongly
depends on the edge chirality, so we will study both zigzag and armchair edge
nanoribbons, respectively.

Figure 1:  (Color online) Nernst coefficient $N_{C}$ (a) in the four terminal
system and Seebeck coefficient $S_{C}$ (b) in two terminal system vs Fermi
Energy $E_{F}$ with the strong magnetic field $BS_{0}=0.008\phi_{0}/\pi$ and
ribbon width $N=80$. Different curves are for different temperatures
$k_{B}\mathcal{T}$. The four terminal system and the two terminal system are
shown in left and right inset in panel (b), respectively.

###  III.1 the strong perpendicular magnetic field case

Firstly, we study the system with strong perpendicular magnetic field. Fig.1
shows the Nernst coefficient $N_{C}$ and Seebeck coefficient $S_{C}$ versus
Fermi energy $E_{F}$ for different temperatures $\mathcal{T}=0.001t$,
$0.003t$, $0.006t$ and $0.01t$. Considering the ambipolar nature of the
graphene and the electron-hole symmetry, the Nernst coefficient $N_{C}$ is an
even function of $E_{F}$ [$N_{C}(E_{F})=N_{C}(-E_{F})$], because both the
energy $E-E_{F}$ and the direction of the particle movement (or
$T_{21}-T_{23}$) reverse their signs under the electron-hole transformation.
From Fig.1(a), we see that the Nernst coefficient $N_{C}$ show peaks when
$E_{F}$ passes the LLs $E_{n}=sign(n)\sqrt{2e\hbar v_{F}^{2}|n|B}$ and show
valleys between adjacent LLs. With the increase of the temperature, the peak
heights roughly remain unchanged, but the valleys rise. For convenience, the
peaks are numbered and the peak at $E_{F}=0$ is denoted as the zeroth peak. In
the low temperature limits, for the $n$-th peak with $n\not=0$, the height is
$[\ln 2/|n|]$, and the zeroth peak height is $[2\ln 2]$. In Fig.2(a) we plot
inverse of the peak heights versus the peak number $n$ (see the crossed circle
symbols) at the low temperature $\mathcal{T}=0.001t$. It satisfies the
relation $[|n|/\ln 2]$. For comparison, the inverse of the peak’s height for
the conventional metal is also plotted (see dotted pentagram symbol), which is
$[(n+1/2)/\ln 2]$.

In Fig.1(b), we plot the Seebeck coefficient $S_{C}$ versus $E_{F}$ at
different temperatures $\mathcal{T}$. Similarly, the Seebeck coefficient
$S_{C}$ display peaks when $E_{F}$ passes the LLs and show valleys between
adjacent LLs. However, $S_{C}$ shows two essential differences from the Nernst
effect: First, $S_{C}$ is an odd function of $E_{F}$, which means that
contributions to $S_{C}$ from electrons and holes differ by a sign due to the
electron-hole symmetry. So the Seebeck coefficient $S_{C}$ is negative for
$E_{F}<0$. Second, when $E_{F}$ is on the zero-th LL, $S_{C}$ is zero instead
of the highest peak in the curve of $N_{C}$-$E_{F}$. This is because the zero-
th LL with the fourfold degeneracy is shared equally by electrons and holes
and the electrons and holes give the opposite contributions to $S_{C}$. The
inverse of the peak height of Seebeck coefficient at the low temperature
($k_{B}\mathcal{T}=0.001t$) is plotted in Fig.2(b). It is found that in
graphene, the pseudospin related Berry phase ref01  introduces an additional
phase shift in the magneto-oscillation of TEP. As a result of this phase
shift, the inverse of peak height is $\propto n$ (see the crossed circle
symbol in Fig.2(b)). While in the conventional metal or semiconductor with
massive carriers, there is no pseudospin related berry phase, the inverse of
peak height is $\propto n+\frac{1}{2}$ (see dotted pentacle symbol in
Fig.2(b)).

Figure 2:  (Color online) The panel (a) and (b) are respectively the inverse
of peak height of Nernst and Seebeck coefficients vs. the peak number $n$. The
crossed circle symbols are for the graphene and dotted pentagram symbols are
for the conventional metal. The temperature $k_{B}\mathcal{T}=0.001t$ and
other parameters are the same as Fig.1. In panel (a), the two lines are
$|n|/\ln 2$ and $(n+1/2)/\ln 2$ and in panel (b) the two lines are $n/\ln 2$
and $(n+1/2)/\ln 2$.  Figure 3:  (Color online) Panel (a): the magnifications
of the zeroth and first Nernst peaks in Fig.1(a). Along the arrow direction,
temperature $k_{B}\mathcal{T}$ increases from $0.001t$ to $0.029t$ with
increment of $0.002t$. Panel (b): the disorder effect of panel (a) at a fixed
temperature $k_{B}\mathcal{T}=0.01t$.

Next, we study the temperature effect. Since TEP (Nernst effect or Seebeck
effect) represents the entropy transported per unit charge, both Nernst
coefficient and Seebeck coefficient increase with the increasing temperature
which are exhibited in Fig.1(a) and (b). To take a closer look in Fig.3, we
plot the zeroth and first peak for the temperature range $\in[0.001t,0.029t]$
in the step of $0.002t$. The temperature effect of $S_{C}$ is similar to that
of $N_{C}$, so we only show the Nernst coefficient $S_{C}$ in Fig.3(a). At low
temperatures, with the increase of the temperature $k_{B}\mathcal{T}$, the
peak height and position do not vary much, but the peak half-width is
broadened proportional to $k_{B}\mathcal{T}$, so the valley between the LLs
rises. When the temperature $k_{B}\mathcal{T}$ exceeds the spacing of nearest
LLs, the Nernst and Seebeck coefficients $N_{C}$ and $S_{C}$ are enhanced in
the whole range of energies including both the peak and valley because of the
overlap of the neighboring peaks. In addition, except for the zeroth peak, the
peak positions for all other peaks shift towards the zeroth peak.

Now we study the disorder effect on the Nernst and Seeback effect. To consider
the effect of disorder, random on-site potentials $\delta\epsilon_{i}$ in the
center region are added with a uniform distribution $[-W/2,W/2]$ with disorder
strength W. The data is obtained by averaging over up to 1200 disorder
configurations. It is known that when the magnetic field is absent, the
Seebeck effect is strongly affected by the disorder, and the peaks are
suppressed even in the small disorder. On the other hand, in the presence of
the strong magnetic field, the Seebeck effect and Nernst effect are robust to
the disorder, because of the existence of the quantized Landau level. The
bigger the sample is (or the stronger the magnetic field is), the more robust
the Nernst effect and Seebeck effect. Similar to Fig.3(a), in Fig.3(b) we plot
the zeroth and first peak at fixed temperature $k_{B}\mathcal{T}=0.01t$ with
different disorder strengths. Here sample size ($N=40$) is smaller than that
in Fig.1(a) (in which $N=80$). With the smaller sample size, the zeroth
universal values of peak height $2\ln 2$ can still remain until disorder $W$
is larger than $1t$. For the first peak, the universal values of height $\ln
2/|n|$ remains at $W=0.3t$ and washes out at stronger disorder. It means that
the Nernst peak corresponding to the lower Landauer level can resist stronger
disorders. In fact, this effect of disorder has been studied for the thermal
response to the charge currenttheory1  or to the spin current.Cheng  So, in
the following, we will focus only on the clean system.

Figure 4:  (Color online) Seebeck coefficient $S_{C}$ vs. Fermi energy $E_{F}$
for the different temperatures $k_{B}\mathcal{T}$ at zero magnetic field.
Panel (a) is for the zigzag ribbon as sketched in the inset of panel (a), with
the width $N=40$. Panel (b) and (c) are for the armchair ribbon sketched in
inset of panel (b) with the width $N=41$ (b) and $N=40$ (c). The gray solid
curves in panels (a), (b), and (c) are the corresponding transmission
coefficients $T$. Figure 5:  (Color online) The Seebeck coefficient of
Fig.4(c) with the Fermi Energy interval $[-0.03,0.03]$.

###  III.2 the case of zero magnetic field

In this subsection, we study the TEP at zero magnetic field. Because there is
no Lorentz force to bend the trajectories of the thermally diffusing carriers,
the Nernst effect is absent and $N_{C}=0$. At $B=0$, the Seebeck coefficient
$S_{C}$ is strongly dependent on the chirality of graphene ribbon. In
addition, for the armchair edge ribbon, it is metallic when $N=3M-1$ ($M$ is
an integer) and insulator otherwise.ref5  The Seebeck coefficient $S_{C}$ has
essential difference for the metallic and insulator armchair ribbons. In the
following we consider three different systems: (1) zigzag edge ribbon with
width $N=40$ (sketched in inset of Fig.4(a)), (2) metallic armchair edge
ribbon with width $N=41$ (sketched in inset of Fig.4(b)), and (3) insulating
armchair edge ribbon with width $N=40$ (sketched in inset of Fig.4(b)).
Fig.4(a), (b), and (c) show the Seebeck coefficient $S_{C}$ versus $E_{F}$ for
the above three systems, respectively. For the convenience of discussion, we
also plot corresponding transmission coefficient $T=T_{21}=T_{12}$ versus
$E_{F}$ in each panel. We can see that $S_{C}$ is an odd function of $E_{F}$
and $S_{C}$ increases when the temperature increases. In addition, $S_{C}$
peaks when Fermi energy crosses the discrete transverse channels where
quantized transmission coefficient jumps from one step to another. These
properties are similar for the above three cases.

But there are also many essential different behaviors. (1). For the zigzag
edge ribbon, the transverse channels are equidistance with the energy interval
$\Delta=|t|\pi/(2N)$ in the conduction band or the valence band (except that
the interval from the first transmission channel in the conduction band to the
first transmission channel in the valence band is $3\Delta$). So peaks of
$S_{C}$ are uniformly distributed over energies and the peak height of $S_{C}$
satisfies $[\ln 2/2n]$ where $n$ is the peak number (see Fig.4(a)). (2). In
metallic armchair edge ribbon, however, the transverse channel and
consequently the peaks of $S_{C}$ are irregularly distributed. The peak height
of $S_{C}$ is closely related to the transmission coefficient
$T=T_{21}=T_{12}$ and it can be expressed as $2\Delta Tln2/(2T+\Delta T)$ at
low temperatures, where $\Delta T$ is the change of $T$ when $E_{F}$ scans
over the certain transverse channel. With increasing of the temperature, some
of peaks that are very close to each other merge together so that both peak
height and position are irregular (see Fig.4(b)). (3). Finally, for the
insulating armchair edge ribbon, except for the irregularly distributed peaks
for $|E_{F}|>\Delta$, the Seebeck coefficient $S_{C}$ is very large for
$E_{F}$ near the Dirac point (0) at low temperatures. Fig.5 magnifies the
curves of $S_{C}$-$E_{F}$ near the Dirac point. At low temperatures, $S_{C}$
can be very large when $E_{F}$ approaches the Dirac point. For example $S_{C}$
can reach about $10$ at $\mathcal{T}=0.0022t$. At the Dirac point the sign of
$S_{C}$ changes abruptly. This is because near the Dirac point the
transmission coefficient $T_{12}$ is zero and the carriers can’t be
transmitted. In order to balance the thermal forces acting on the charge
carriers, we have to add a very large bias leading to a very large Seebeck
coefficient near the Dirac point at low temperatures. When temperature
increase such that $k_{B}\mathcal{T}$ is greater than the gap of the
insulating armchair edge ribbon $S_{C}$ decreases gradually. We emphasize that
if the armchair edge ribbon is narrow enough (such as $W\approx 10nm$ as in
our calculation), $S_{C}\approx 10$ at the temperature
$\mathcal{T}=0.0022t/k_{B}\approx 60K$. This very large $S_{C}$ can be
observed in the present technology.

Figure 6:  (Color online) Panel (a)-(c) plot the Nernst coefficient $N_{C}$ vs
Fermi Energy $E_{F}$ at different temperatures $k_{B}\mathcal{T}=0.001t$,
$0.005t$ and $0.01t$ in the magnetic field
$BS_{0}=0.0005\phi_{0}/\pi,0.002\phi_{0}/\pi$ and $0.005\phi_{0}/\pi$,
respectively. In left panels the thermal gradient is added along the zigzag
edge ribbon as shown in the left top sketch. While in the right panels, the
thermal gradient is added along the armchair edge ribbon as shown in the right
top sketch. The ribbon width $N=80$.

###  III.3 the crossover from zero magnetic field to high magnetic field

In this subsection, we study the Nernst and Seebeck effect when the magnetic
field varies from zero to finite values (strong magnetic field). At zero
magnetic field, the Nernst coefficient $N_{C}$ is zero and the Seebeck effect
$S_{C}$ is dependent on the chirality of graphene ribbon. At high magnetic
fields, however, both $N_{C}$ and $S_{C}$ are independent of the ribbon
chirality. What happens with the magnetic field in the intermediate range?

First, we study the Nernst effect, in which two different setups (the setup-6I
and setup-6II) sketched in the top of Fig.6 are considered. In Fig.6 we plot
the Nernst coefficient $N_{C}$ versus $E_{F}$ at different temperatures and
magnetic fields. From Fig.6(a) to (c), the magnetic field increases from weak
to strong enough to form edge state. At the weak magnetic field (such as
$BS_{0}/\phi_{0}=0.0005/\pi$), the Nernst coefficient $N_{C}$ peaks sharply
near the Dirac point at low temperatures. Because on two sides of the Dirac
point, the carriers are electron-like and hole-like and they are shifted to
the opposite direction under the weak magnetic field, the Nernst effect is
largest at the Dirac point.

In particular, in the setup-6I, the Nernst coefficient $N_{C}$ is very large
at the Dirac point, which is much larger than that in setup-6II and in the
case of high magnetic field. Because for the setup-6I, the longitudinal leads
(lead-1 and lead-3) are metallic with a large transmission coefficient but the
transverse leads (lead-2 and lead-4) are almost insulator near the Dirac
point. As a result, we have to add a much larger bias to balance the thermal
current so that the Nernst coefficient $N_{C}$ is very large in the setup-6I
at the low magnetic field (see Fig.6(a1) and (b1)). With increasing of $B$,
LLs are formed one by one. The zeroth LL located at the Dirac point is formed
first (at about $BS_{0}/\phi_{0}=0.0015/\pi$, no shown), then is the first LL,
the second and so on. For example, In Fig.6(a), no LL is formed while in
Fig.6(b), the zeroth, first and second LL are formed. As soon as LLs are
formed, the Nernst coefficient $N_{C}$ will satisfy the relation that its peak
heights are equal to $\ln 2/|n|$ (or $2\ln 2$ for $n=0$). From Fig.6(c), we
can see that as $BS_{0}/\phi_{0}=0.005/\pi$, electrons (or holes) with Fermi
energy $|E_{F}|\leq 0.3t$ all belong to robust edge states. In this case, the
Nernst coefficient $N_{C}$ are almost the same for the setup-6I and setup-6II.

For the Seebeck effect, armchair edge ribbon can either be metal or insulator,
we also consider three different systems as in the case of zero magnetic
field. In Fig.7 we plot the Seebeck coefficient $S_{C}$ versus $E_{F}$ at
different temperatures and magnetic fields for three different systems. The
first column is for the zigzag edge ribbon with width $N=80$, the second
column is for metallic armchair edge ribbon with $N=80$, and the third column
is for insulating armchair edge ribbon with $N=81$. From Fig.7(a) to Fig.7(c),
the magnetic field increases gradually. We can see that in the weak magnetic
field, the peaks of $S_{C}$ are still regularly distributed for the zigzag
ribbon and are irregular for the armchair ribbon due to the different band
structure for the zigzag edge and armchair edge ribbon. Moreover, for the
insulating armchair edge ribbon, the energy gap near Dirac point is diminished
because of the magnetic field $B$, the very high and sharp $S_{C}$ at $B=0$
(see Fig.5) is gradually dropped with the increasing of $B$. But at the weak
magnetic field $BS_{0}/\phi_{0}=0.0005/\pi$, the $N_{C}$ can still reach 3
(see Fig.7(a3)), which is much larger than all peaks of $S_{C}$ in the high
magnetic field case. Similar to Fig.6, with the increasing of $B$ further, the
LLs is gradually formed from Dirac point to the high $E_{F}$, the the
properties of $S_{C}$ for three systems gradually tend to the same. At the
high magnetic field $BS_{0}/\phi_{0}=0.005/\pi$, LLs are completely formed for
$|E_{F}|<0.3$, then Seebeck coefficient $S_{C}$ for three different systems
are all the same to that in the Hall region.

##  IV conclusion

In summary, by using the Landauer-B$\ddot{u}$ttiker formula combining with the
non-equilibrium Green’s function method, the Nernst effect in the crossed
graphene ribbon and the Seebeck effect in the single graphene ribbon are
investigated. It is found that due to the electron-hole symmetry, the Nernst
coefficient $N_{C}$ is an even function while the Seebeck coefficient $S_{C}$
is an odd function of the Fermi energy $E_{F}$. $N_{C}$ and $S_{C}$ show peaks
when $E_{F}$ crosses the Landau levels at high magnetic fields or crosses the
transverse sub-bands at the zero magnetic field. In the strong magnetic field,
due to the fact that high degenerated Landau levels dominate transport
processes the Nernst and Seebeck coefficients are similar for different
chirality ribbons. The peak height of $N_{C}$ and $S_{C}$, respectively, are
$[\ln 2/|n|]$ and $[\ln 2/n]$ with the peak number $n$, except for $n=0$. For
zeroth peak, it is abnormal. Its peak height is $[2\ln 2]$ for the Nernst
effect and it disappears for the Seebeck effect. While in zero magnetic field,
Nernst effect is absent and the Seebeck effect is strongly dependent on the
chirality of the ribbon. For the zigzag edge ribbon, the peaks of $S_{C}$ are
equidistance, but they are irregularly distributed for armchair edge ribbon.
Surprisingly, for the insulating armchair edge ribbon, the Seebeck coefficient
$S_{C}$ can be very large near the Dirac point due to the energy gap. When the
magnetic field increases from zero to high values, the irregularly or
regularly distributed peaks of $S_{C}$ in different chiral ribbons gradually
tends to be the same. In addition, the nonzero values of the Nernst
coefficient $N_{C}$ appear first near the Dirac point and then gradually in
the whole energy region. It is remarkable that for certain crossed ribbons,
the Nernst coefficient $N_{C}$ at weak magnetic fields can be much larger than
that in the strong magnetic field due to small transmission coefficient in the
transverse terminals.

${\bf ACKNOWLEDGMENTS}$

We gratefully acknowledge the financial support by a RGC grant (HKU 704308P)
from the Government of HKSAR and NSF-China under Grants Nos. 10525418,
10734110, and 10821403.

## References

  * (1) K.S. Novoselov, A.K. Geim, S.V. Morozov, D. Jiang, Y. Zhang, S.V. Dubonos, I.V. Grigorieva, and A.A. Firsov, Science 306, 666 (2004).
  * (2) K.S. Novoselov, A.K. Geim, S.V. Morozov, D. Jiang, M.I. Katsnelson, I.V. Grigorieva, S.V. Dubonos, and A.A. Firsov, Nature (London) 438, 197 (2005); Y. Zhang, Y.-W. Tan, H.L. Stormer, and P. Kim, Nature (London) 438, 201 (2005).
  * (3) C.W.J. Beenakker, Rev. Mod. Phys. 80, 1337 (2008); A.H. Castro Neto, F.Guinea ,N.M.R. Peres ,K.S. Novselov, and A.K. Geim, Rev. Mod. Phys. 81, 109 (2009).
  * (4) J. R. Williams, L. Dicarlo and C. M. Marcus, Science 317, 638 (2008); A. f. Young and P. Kim, Nature Phys. 5, 222 (2009).
  * (5) K. Nakada, M. Fujita, G. Dresselhaus and M. S. Dresselhaus, Phys. Rev. B 54, 17954 (1996).
  * (6) K. Wakabayashi, M. Fujita, H. Ajiki and M. Sigrist, Phys. Rev. B 59, 8271 (1999);
  * (7) V. P. Gusynin1, and S. G. Sharapov, Phys. Rev. B 73, 245411 (2006).
  * (8) A. A. Abrikosov, Fundamentals of the Theory of Metals (North- Holland, Amsterdam, 1988); J. M. Iiman, Electrons and Phonons (Oxford University Press, Oxford, UK, 1960); C. W. J. Beenakker and A. A. M. Staring, Phys. Rev. B 46, 9667 (1992).
  * (9) M. Cutler and N. F. Mott, Phys. Rev. 181, 1336 (1969); D. K. C. Macdonald, Thermoelectricity (Dover, New York, 2006).
  * (10) A. S. Dzurak, C. G. Smith, C. H. W. Barnes, M. Pepper, L. Martín-Moreno, C. T. Liang, D. A. Ritchie, and G. A. C. Jones, Phys. Rev. B 55, R10197 (1997); R. Scheibner, H. Buhmann, D. Reuter, M. N. Kiselev, and L.W. Molenkamp, Phys. Rev. Lett. 95, 176602 (2005); R. Scheibner, E. G. Novik, T. Borzenko, M. König, D. Reuter, A. D. Wieck, H. Buhmann, and L. W. Molenkamp, Phys. Rev. B 75, 041301 (2007).
  * (11) H.-C. Ri, R. Gross, F. Gollnik, A. Beck, R. P. Huebener, P. Wagner and H. Adrian, Phys. Rev. B 50, 3312 (1994); C. Hohn, M. Galffy and A. Freimuth, Phys. Rev. B 50, 15875 (1994); Z. A. Xu, J. Q. Shen, S. R. Zhao, Y. J. Zhang and C. K. Ong, Phys. Rev. B 72, 144527 (2005);
  * (12) S. Onoda, N. Sugimoto, and N. Nagaosa, Phys. Rev. B 77, 165103 (2008); Wei-Li Lee, S. Watauchi, V. L. Miller, R. J. Cava, and N. P. Ong, Phys. Rev. Lett. 93, 226601 (2004); T. Miyasato, N. Abe, T. Fujii, A. Asamitsu, S. Onoda, Y. Onose, N. Nagaosa, and Y. Tokura, Phys. Rev. Lett. 99, 086602 (2007).
  * (13) A. Banerjee, B. Fauque, K. Izawa, A. Miyake, I. Sheikin, J. Flouquet, B. Lenoir and K. Behnia, Phys. Rev. B 78, 161103(R) (2008).
  * (14) N. Hanasaki, K. Sano, Y. Onose, T. Ohtsuka, S. Iguchi, I. K$\acute{e}$zsm$\acute{a}$rki, S. Miyasaka, S. Onoda, N. Nagaosa and Y. Tokura, Phys. Rev. Lett. 100, 106601 (2008).
  * (15) K. Behnia, M. A. M$\acute{e}$asson, and Y. Kopelevich, Phys. Rev. Lett. 98, 166602 (2007); K. Behnia, L. Balicas, Y. Kopelevich, Science 317, 1729 (2007).
  * (16) Joshua P. Small, Kerstin M. Perez, and Philip Kim, Phys. Rev. Lett. 91, 256801 (2003).
  * (17) Y. M. Zuev, W. Chang, and P. Kim, Phys. Rev. Lett. 102, 096807 (2009).
  * (18) P. Wei, W. Bao, Y. Pu, C. N. Lau, and J. Shi, Phys. Rev. Lett. 102, 166808 (2009).
  * (19) M. Cutler and N. F. Mott, Phys. Rev. 181, 1336 (1969); D. K. C. Macdonald, Thermoelectricity (Dover, New York, 2006).
  * (20) N. M. R. Peres, J. M. B. Lopes dos Santos and T. Stauber, Phys. Rev. B 76, 073412 (2007).
  * (21) B. Dóra and P. Thalmeier, Phys. Rev. B 76, 035402 (2007).
  * (22) H. Nakamura, N. Hatano, and R. Shirasaki, Solid State Commun. 135, 510 (2005).
  * (23) R. Shirasaki, H. Nakamura, and N. Hatano, e-J. Surf. Sci. Nanotechnol. 3, 518 (2005).
  * (24) M. Jonson and S. M. Girvin, Phys. Rev. B 29, 1939 (1984); H. Oji and P. Streda, Phys. Rev. B 31, 7291 (1985); J. Phys. C: Solid State Phys., 17, 3059 (1984)-3066.
  * (25) D. N. Sheng, L. Sheng, and Z. Y. Weng, Phys. Rev. B 73, 233406 (2006); Z. Qiao and J. Wang, Nanotechnology 18, 435402 (2007).
  * (26) W. Long, Q.-F. Sun, and J. Wang, Phys. Rev. Lett. 101, 166806 (2008); J. Li and S.-Q. Shen, Phys. Rev. B 78, 205308 (2008).
  * (27) In the references, [M. Jonson and S. M. Girvin, Phys. Rev. B 29, 1939 (1984) and H. Oji and P. Streda, Phys. Rev. B 31, 7291 (1985)], they pointed out that the standard Kubo formula can’t apply to the Nernst coefficient in the presence of strong magnetic fields, because that a diamagnetic surface currents and a “diathermal” surface currents appear under the strong mangetic fields. So a fundamental correction on the standard Kubo formula is necessary. However, the Landauer-Buttiker formula is to calculate the current flowing from a terminal to the center region, in which the both interior and surface currents have been included. So it is validity regardless of the magnetic field.
  * (28) D. H. Lee and J. D. Joannopoulos, Phys. Rev. B 23, 4997 (1981); ibid, 23, 4988 (1981).
  * (29) S.-G Cheng, Y. Xing, Q.-F Sun and X. C. Xie, Phys. Rev. B 78, 045302 (2008).

Figure 7:  (Color online) Panel (a)-(c) plot the Nernst coefficient $N_{C}$ vs
Fermi Energy $E_{F}$ at different temperatures $k_{B}\mathcal{T}$ and
different magnetic fields $BS_{0}/\phi_{0}$. The other parameters and the
chirality of ribbon for the first, second, and third column panels are the
same as Fig.4(a), (b), and (c), respectively.


MoXIchecker:
An Extensible Model Checker for MoXI

11institutetext: LMU Munich, Munich, Germany

#  MoXIchecker:
An Extensible Model Checker for MoXI

Salih Ates Dirk Beyer Po-Chun Chien Nian-Ze Lee

###### Abstract

MoXI is a new intermediate verification language introduced in 2024 to promote
the standardization and open-source implementations for symbolic model
checking by extending the SMT-LIB 2 language with constructs to define state-
transition systems. The tool suite of MoXI provides a translator from MoXI to
Btor2, which is a lower-level intermediate language for hardware verification,
and a translation-based model checker, which invokes mature hardware model
checkers for Btor2 to analyze the translated verification tasks. The
extensibility of such a translation-based model checker is restricted because
more complex theories, such as integer or real arithmetics, cannot be
precisely expressed with bit-vectors of fixed lengths in Btor2. We present
MoXIchecker, the first model checker that solves MoXI verification tasks
directly. Instead of translating MoXI to lower-level languages, MoXIchecker
uses the solver-agnostic library PySMT for SMT solvers as backend for its
verification algorithms. MoXIchecker is extensible because it accommodates
verification tasks involving more complex theories, not limited by lower-level
languages, facilitates the implementation of new algorithms, and is solver-
agnostic by using the API of PySMT. In our evaluation, MoXIchecker uniquely
solved tasks that use integer or real arithmetics, and achieved a comparable
performance against the translation-based model checker from the MoXI tool
suite.

###### Keywords:

Formal verification Symbolic model checking Intermediate language MoXI Btor2
SMT SAT PySMT Exchange formats

##  1 Introduction

Symbolic model checking [1, 2] embraces a wide range of automatic techniques
to formally verify a model against a specification by encoding and searching
the state space symbolically. It has been applied to hardware, software, and
cyber-physical systems to ensure their safety and correct functionality.
However, symbolic model checking has not been adopted as widely as other
“push-button” techniques for quality assurance, such as testing, especially in
industry. A major challenge is the lack of standardized exchange formats and
open-source implementations [3, 4]. Even though model checkers from the same
research community work on the same type of computational models, they often
use different input formats, which hinders the propagation of techniques.
Moreover, some model checkers are closed-source and make the comparison of
verification algorithms complicated, because techniques may need to be re-
implemented in a different framework to achieve fair comparison (this makes
expensive transferability studies necessary [5, 6]).

Recently, a new intermediate verification language MoXI [3], the model
exchange interlingua, has been proposed to address the aforementioned
challenge. MoXI aims to be (1) as expressive as necessary to accommodate real-
world applications described in user-facing, higher-level modeling languages
and (2) as simple as possible to facilitate its translation to tool-oriented,
lower-level intermediate languages, for which efficient and effective model
checkers are available. It augments the SMT-LIB 2 [7] format with constructs
to define state-transition systems by using formulas in first-order logic to
encode their initial and transition conditions. MoXI inherits the
expressiveness of SMT-LIB 2 and offers abundant background theories to
represent various computational models, ranging from hardware circuits and
software programs to cyber-physical systems. The precise semantics of SMT-LIB
2 also enables the translation from MoXI to lower-level intermediate
languages. Using SMT formulas to precisely describe state-transition systems
has also been studied in the VMT [8] intermediate language.

Compared to other intermediate verification languages, such as the SMV [9]
language for finite-state transition systems or the Boogie [10] language for
software programs, using MoXI to represent model-checking problems separates
the process of encoding the semantics of computational models into SMT
formulas from the implementation of SMT-based verification approaches. This
separation will help decompose monolithic model checkers into several modular
and reusable components, e.g., standalone translators from higher-level
languages to MoXI and model-checking engines for MoXI verification tasks. A
deeper discussion can be found in a recent survey on transformation for
verification [11].

###  1.1 Existing Tool Suite for MoXI

The tool suite of MoXI [12] offers translators from SMV to MoXI and from MoXI
to the word-level modeling language Btor2 [13], the prevailing format for
hardware model checking. The tool suite also implements a translation-based
model checker, MoXI-MC-Flow, by translating a MoXI task to an equisatisfiable
Btor2 task and invoking Btor2 model checkers, such as AVR [14], BtorMC [13],
and Pono [15], on the translated task. Translation-based verification
approaches have been actively studied in the literature. For example,
sequential circuits in Verilog [16] can be translated to SMV models [17, 18]
or C programs [19] for verification. Btor2 circuits have been translated to C
programs and analyzed by software verifiers [20, 21, 22]. C programs can also
be translated to SMV or Btor2 models and verified by hardware model checkers
[23, 24].

While MoXI-MC-Flow can solve MoXI verification tasks by translating them to
Btor2 [12], the translation-based approach limits the expressiveness of the
model-checking flow because verification problems cannot be precisely
represented in Btor2 if they involve more complex background theories, such as
integer or real arithmetics. Moreover, to extend MoXI-MC-Flow with new
algorithms, tool developers need to dig into the Btor2 model checkers.

###  1.2 Motivation to Develop MoXIchecker

To address the extensibility gap of the translation-based model-checking flow
for MoXI, we implemented MoXIchecker, the first model checker that solves MoXI
verification tasks directly without translating them to other intermediate
languages. MoXIchecker takes as input a MoXI verification task, constructs the
SMT formulas used to define the task, and implements its verification
algorithms using the API of PySMT [25], a solver-agnostic Python library for
SMT solvers. Currently, MoXIchecker supports the quantifier-free theories of
bit-vectors, arrays, integers, and reals, and the implemented algorithms
include BMC [26], k-induction [27], and IC3/PDR [28].

The benefits of MoXIchecker compared to MoXI-MC-Flow are threefold. First,
MoXIchecker enjoys the complete expressiveness of SMT-LIB 2 and is applicable
to verification tasks involving more complex background theories, as long as
there exists an SMT solver supporting the used theory. In contrast, MoXI-MC-
Flow is inadequate if the used theory is not representable in lower-level
intermediate languages focusing on bit-vectors of fixed lengths and arrays.
Second, MoXIchecker allows for convenient extension and fast prototyping of
model-checking algorithms. To develop a new algorithm in MoXIchecker, one can
simply work with the SMT formulas describing the model and manipulate them via
the API of PySMT. In contrast, adding a new algorithm to the hardware model
checkers used by MoXI-MC-Flow may involve encoding the semantics of hardware
circuits. Moreover, MoXIchecker enables fair comparison of algorithms because
the number of confounding variables (e.g., from translation) is kept to a
minimum. Third, MoXIchecker has a robust frontend design because constructing
SMT formulas that describe a MoXI verification task via PySMT is purely
syntactical and less error-prone than translating the SMT formulas to Btor2.

Furthermore, MoXIchecker is meant for use in education. It is an ideal
framework for playing around with algorithms in course projects. The tool has
a clean architecture and a slim code base.

Contributions. To sum up, our contributions in this paper include:

  1. 1.

MoXIchecker, the first model checker that verifies MoXI tasks directly,

  2. 2.

implemented as an extensible framework to accommodate various background
theories and facilitate the development of algorithms for MoXI,

  3. 3.

MoXIchecker’s first three algorithms, BMC, k-induction, and IC3/PDR, and

  4. 4.

an evaluation of MoXIchecker with MoXI-MC-Flow on about 400 MoXI verification
tasks.

In our experiments, MoXIchecker solved a similar number of bit-vector tasks as
MoXI-MC-Flow, which used highly-optimized Btor2 model checkers as backend.
Moreover, MoXIchecker was able to uniquely solve tasks using real arithmetics,
which MoXI-MC-Flow cannot handle. These contributions are significant and
novel because MoXIchecker supports the standardization of symbolic model
checking around MoXI and provides an extensible framework for open-source
implementations of verification algorithms for MoXI.

##  2 Background

In this section, we provide background knowledge for symbolic model checking
and the intermediate verification language MoXI.

###  2.1 Symbolic Model Checking

The problem of symbolic model checking [1, 2] is to decide whether a model,
usually represented as a state-transition system [29, 30], satisfies a
specification. A state-transition system $\mathcal{M}$ can be described by an
initial condition $I(s)$, a transition condition $T(s,s^{\prime})$, and an
invariance condition $Inv(s)$, where $s$ and $s^{\prime}$ range over possible
states of $\mathcal{M}$. Condition $I(s)$ evaluates to $\top$ if state $s$ is
an initial state of $\mathcal{M}$, and $T(s,s^{\prime})$ evaluates to $\top$
if state $s$ can transit to state $s^{\prime}$ via one step in $\mathcal{M}$
(we use $\top$ for $\mathit{true}$). A state $\widehat{s}$ is reachable if
$I(\widehat{s})$ evaluates to $\top$ or $I(s_{0})\land
T(s_{0},s_{1})\land\ldots\land T(s_{k-1},\widehat{s})$ is satisfiable for some
$k\geq 1$. Condition $Inv(s)$ is a constraint imposed on all reachable states
in $\mathcal{M}$ (a reachable state that violates $Inv$ is excluded for
analysis).

A specification $\varphi$ can be represented by a formula in linear temporal
logic (LTL) [31], which is evaluated over the execution traces of a state-
transition system. In the following, we refer to the tuple
$(\mathcal{M},\varphi)$ as a verification task, which asks if state-transition
system $\mathcal{M}$ satisfies specification $\varphi$. Reachability safety is
an essential category of specifications, inspecting the reachability of some
target states marked by a reachable condition $Q(s)$. A reachability-safety
verification task is described by the tuple $(I,T,Inv,Q)$, where $I$, $T$, and
$Inv$ define a state-transition system $\mathcal{M}$ and $Q$ defines an LTL
formula “always $\lnot Q$” as a specification $\varphi$ for $\mathcal{M}$. A
reachability-safety verification task is safe (resp. unsafe) if the target
states are unreachable (resp. reachable).

In the research community of hardware model checking, verification tasks of
sequential circuits can be encoded by the word-level language Btor2 [13].

###  2.2 The Intermediate Verification Language MoXI

MoXI [3] extends the SMT-LIB 2 [7] format with constructs to describe
verification tasks. Inheriting the expressiveness of SMT-LIB 2, MoXI offers a
variety of background theories, ranging from bit-vectors and arrays (QF_BV and
QF_ABV) to linear and nonlinear arithmetics over integers and reals (QF_LIA,
QF_LRA, QF_NIA, and QF_NRA), to represent models of hardware, software, and
cyber-physical systems. As for specifications, MoXI supports reachability-
safety queries with fairness constraints. We refer interested readers to the
language design of MoXI [3] for more details. In the following, we use an
example to show how a verification task is represented in MoXI.

Figure 1 shows a verification task of a three-bit counter in MoXI. Line 1 sets
the background theory to QF_BV, which allows for quantifier-free formulas over
the theory of bit-vectors with fixed sizes. Lines 2 to 8 define the behavior
of the three-bit counter with command define-system and name the counter main.
Counter main has an output variable s, which is a bit-vector of length three
(attribute :output in line 4). Counter main has no inputs or local variables
(attributes :input in line 3 and :local in line 5, respectively).

⬇ 1(set-logic QF_BV) 2(define-system main 3 :input () 4 :output ((s (_ BitVec
3))) 5 :local () 6 :init (= s #b000) 7 :trans (= s’ (bvadd s #b010)) 8 :inv
true) 9(check-system main 10 :input () 11 :output ((s (_ BitVec 3))) 12 :local
() 13 :reachable (rch_1
(= (bvurem s #b010) #b001)) 14 :query (qry_rch_1 (rch_1)))

Figure 1: An example verification task in MoXI

The initial condition in line 6 (attribute :init) initializes output s of
counter main to #b000. The transition condition in line 7 (attribute :trans)
increments the value of s by #b010 in each step. Note that a primed variable
is treated as the next-state variable of its unprimed counterpart by MoXI.
That is, s’ holds the value of s after one step. The invariance condition in
line 8 (attribute :inv) imposes true as a constraint on all reachable states
of counter main. The specification for counter main is described by command
check-system. The reachability condition rch_1 in line 13 (attribute
:reachable) states that the value of s is an odd number, i.e., the remainder
of s divided by #b010 equals #b001. Line 14 poses a query qry_rch_1 (attribute
:query) to examine whether the LTL formula “always $\lnot$rch_1” is satisfied
by all execution traces of counter main.

The MoXI tool suite [12] provides an alternative representation of MoXI
verification tasks in JSON format to facilitate tool development and
information exchange. Figure 2 shows the corresponding JSON file for the
verification task in Fig. 1. Our tool MoXIchecker takes MoXI verification
tasks in JSON format as input. For details of the JSON representation, we
refer interested readers to the MoXI JSON
schema111https://github.com/ModelChecker/moxi-mc-flow/tree/main/json-schema in
the tool suite.

⬇

1[ { "command": "set-logic", "logic": "QF_BV" },

2 { "command": "define-system",

3 "symbol": "main",

4 "input": [],

5 "output": [{

6 "symbol": "s",

7 "sort": { "identifier": { "symbol": "BitVec", "indices": [3] }}}],

8 "local": [],

9 "init": {

10 "identifier": { "symbol": "=", "indices": [] },

11 "args": [{ "identifier": "s" }, { "identifier": "#b000" }]},

12 "trans": {

13 "identifier": { "symbol": "=", "indices": [] },

14 "args": [

15 { "identifier": "s’" },

16 {"identifier": { "symbol": "bvadd", "indices": [] },

17 "args": [{ "identifier": "s" }, { "identifier": "#b010" }]}]},

18 "inv": { "identifier": "true" }},

19 { "command": "check-system",

20 "symbol": "main",

21 "input": [],

22 "output": [{

23 "symbol": "s",

24 "sort": { "identifier": { "symbol": "BitVec", "indices": [3] }}}],

25 "local": [],

26 "reachable": [

27 { "symbol": "rch_1",

28 "formula": { "identifier": { "symbol": "=", "indices": [] },

29 "args": [

30 {"identifier": { "symbol": "bvurem", "indices": [] },

31 "args": [{ "identifier": "s" }, { "identifier": "#b010" }]},

32 { "identifier": "#b001" }]}}],

33 "query": [{ "symbol": "qry_rch_1", "formulas": ["rch_1"] }]}]

Figure 2: A JSON representation of the MoXI verification task in Fig. 1

To analyze a MoXI verification task, the model checker MoXI-MC-Flow in the
MoXI tool suite translates the MoXI task to an equisatisfiable Btor2
verification task and invokes hardware model checkers for Btor2, e.g., AVR
[14], BtorMC [13], and Pono [15], from the Hardware Model Checking
Competitions [32].

##  3 Software Architecture of MoXIchecker

Figure 3 shows the software architecture of MoXIchecker, the first model
checker for MoXI without translating verification tasks to lower-level
languages. Implemented in the programming language Python, MoXIchecker is
open-source on GitLab222https://gitlab.com/sosy-lab/software/moxichecker and
released under the Apache License 2.0. On a MoXI verification task in JSON
format, MoXIchecker uses the standard JSON package of Python to load the input
file and constructs SMT formulas for the initial, transition, invariance, and
reachable conditions by calling the API of the solver-agnostic library PySMT
[25] for SMT solvers. It then performs model checking on the reachability-
safety verification task $(I,T,Inv,Q)$. The output of MoXIchecker on a MoXI
verification task is a verdict to indicate whether the task is safe or unsafe.

Different from MoXI-MC-Flow in the MoXI tool suite [12], which translates
verification tasks in MoXI to Btor2 [13] and invokes hardware model checkers,
MoXIchecker implements its model-checking engines using the API of PySMT.
Currently, MoXIchecker supports QF_BV, QF_ABV, QF_LIA, QF_LRA, QF_NIA, and
QF_NRA as the background theory. The elegant software architecture facilitates
adding new background theories to MoXIchecker.

We adapted and integrated the implementations of BMC [26], k-induction [27],
and IC3/PDR [28] in PySMT
333https://github.com/pysmt/pysmt/blob/master/examples/model_checking.py into
our framework. In addition, we demonstrate the extensibility of MoXIchecker by
contributing a k-induction implementation that takes advantage of incremental
solving of SMT solvers by reusing solver stacks. Compared to the non-
incremental version in PySMT, the incremental k-induction was more efficient
and solved more tasks in the evaluation.

###  3.1 Example

We demonstrate the working of MoXIchecker by invoking it on the verification
task in Fig. 1. MoXIchecker consumes the JSON file of the MoXI verification
task in Fig. 2 as input and constructs SMT formulas $s=0$, $s^{\prime}=s+2$,
$\top$, and $s\%2=1$, as the initial, transition, invariance, and reachability
conditions, respectively. Note that variable $s$ is a bit-vector of length
three, and variable $s^{\prime}$ is its next-state counterpart. To honor the
invariance condition, MoXIchecker conjoins it with initial and transition
conditions, respectively. As the invariance condition is $\top$ in the example
verification task, we omit it in the following explanation.

MoXI verification task(in JSON format)Formula construction(using PySMT)Task
$(I,T,Inv,Q)$Model-checking engine(using PySMT)BMC [26]k-Induction [27]IC3/PDR
[28]New algorithmVerdict

Figure 3: Software architecture of MoXIchecker

To solve the verification task, MoXIchecker considers “always $\lnot(s\%2=1)$”
as the specification for the state-transition system. By applying k-induction
[27], MoXIchecker shows that both the base case
$(s=0)\Rightarrow\lnot(s\%2=1)$ and the step case
$\lnot(s\%2=1)\land(s^{\prime}=s+1)\Rightarrow\lnot(s^{\prime}\%2=1)$ for
$k=1$ hold. Therefore, MoXIchecker concludes that counter main in Fig. 1
satisfies its specification.

###  3.2 Current Limitations

MoXI is an expressive and versatile intermediate language for describing
verification tasks. The current version of MoXIchecker (release 0.1) still
misses some language support for MoXI. For instance, MoXI allows the
composition of multiple state-transition systems via attribute :subsys in
command define-system and fairness constraints via attribute :fairness in
command check-system. In addition, MoXI defines a format for _verification
witnesses_ [33, 34], e.g., an error trace if the specification is violated or
an invariant if the specification is satisfied. We are actively working on
supporting these language features to make MoXIchecker more comprehensive.

##  4 Evaluation

To demonstrate the performance and extensibility of MoXIchecker, we compared
it to MoXI-MC-Flow, the translation-based model checker for MoXI [12], which
invokes hardware model checkers for Btor2 as backend. Our experiments aim to
answer the following research questions:

  * $\bullet$

RQ1: Is MoXIchecker effective and efficient compared to MoXI-MC-Flow on QF_BV
tasks?

  * $\bullet$

RQ2: Can MoXIchecker solve tasks using more complex background theories, which
MoXI-MC-Flow cannot solve?

###  4.1 Experimental Setup

We evaluated MoXIchecker and MoXI-MC-Flow on two sets of MoXI verification
tasks in JSON format. The first benchmark set consists of $225$ safe and $157$
unsafe QF_BV tasks, taken from the MoXI tool suite [12]. Due to the lack of
publicly available verification tasks involving more complex theories, we
handcrafted $9$ tasks using the theories of QF_LIA, QF_LRA, QF_NIA, and QF_NRA
to show the extensible theory support of MoXIchecker.

We used MoXIchecker version 0.1 and MoXI-MC-Flow at commit 6240207d in the
experiments. MoXIchecker called SMT solvers Z3 [35] and MathSAT5 [36] for
QF_BV, QF_LIA, and QF_LRA tasks; for tasks using nonlinear arithmetics,
MoXIchecker employed Z3. MoXI-MC-Flow invoked Btor2 model checkers AVR [14]
and Pono [15] to solve QF_BV tasks; QF_LIA and QF_NIA tasks were also solved
by Btor2 model checkers via encoding integers with 32 bits. The version of
MoXI-MC-Flow used in our evaluation had no support for reals. Both MoXIchecker
and MoXI-MC-Flow used k-induction for verification. (For MoXI-MC-Flow, AVR and
Pono were configured to use k-induction on translated Btor2 tasks.)

All experiments were conducted on a machine that runs a GNU/Linux operating
system (x86_64-linux, Ubuntu 22.04 with Linux kernel 5.15) and is equipped
with $2\text{\,}\mathrm{T}\mathrm{B}$ of RAM in total and two
$2.0\text{\,}\mathrm{G}\mathrm{H}\mathrm{z}$ AMD EPYC 7713 CPUs with 128
processing units each. Each task was limited to 2 CPU cores,
$15\text{\,}\mathrm{m}\mathrm{i}\mathrm{n}$ of CPU time, and
$15\text{\,}\mathrm{G}\mathrm{B}$ of RAM. We used BenchExec [37] to ensure
reliable resource measurement and reproducible results.

###  4.2 Experimental Results

RQ1: Performance of MoXIchecker. Table 1 summarizes the experimental results
of MoXIchecker and MoXI-MC-Flow on $382$ QF_BV verification tasks.
MoXIchecker, when using MathSAT5 as the backend solver and incremental
solving, delivered the most correct results. Notably, MoXIchecker solved $17$
tasks that MoXI-MC-Flow failed to translate to Btor2.

Despite being implemented in Python, MoXIchecker demonstrated a comparable
performance to MoXI-MC-Flow, which employs highly-optimized hardware model
checkers written in C++ as backend. This is mainly because the bottleneck of
SMT-based verification algorithms lies in solving SMT formulas. A preliminary
run-time profiling for MoXIchecker by cProfile showed that solving formulas
accounted for more than $90\text{\,}\%$ of the run-time for the more time-
consuming tasks. The results suggest that using Python to construct and
manipulate SMT formulas does not incur much overhead for MoXIchecker.

Table 1: Summary of verification results on $382$ QF_BV tasks Tool | MoXIchecker | MoXI-MC-Flow
---|---|---
Backend | MathSAT | MathSATincr | Z3 | Z3incr | AVR | Pono
Correct results | $169$ | 178 | $169$ | $174$ | $175$ | $172$
Proofs | $44$ | $46$ | 47 | 47 | $45$ | $45$
Alarms | $125$ | 132 | $122$ | $127$ | $130$ | $127$
Errors and Unknown | $213$ | $204$ | $213$ | $208$ | $207$ | $210$

$0$$20$$40$$60$$80$$100$$120$$140$$160$$180$$1$$10$$100$$1\,000$n-th fastest
correct resultCPU time
()MoXIchecker$\cdot$MathSATMoXIchecker$\cdot$MathSATincrMoXI-MC-
Flow$\cdot$AVRMoXI-MC-Flow$\cdot$Pono

Figure 4: MoXIchecker vs. MoXI-MC-Flow on $382$ QF_BV tasks

$0.1$$1$$10$$100$$1\,000$$0.1$$1$$10$$100$$1\,000$MoXI-MC-Flow$\cdot$AVR
()MoXIchecker$\cdot$MathSATincr ()

Figure 5: Efficiency of MoXIchecker vs. MoXI-MC-Flow on QF_BV tasks

$0.1$$1$$10$$100$$1\,000$$0.1$$1$$10$$100$$1\,000$MoXIchecker$\cdot$MathSAT
()MoXIchecker$\cdot$MathSATincr ()

Figure 6: Effect of incremental SMT solving in MoXIchecker on QF_BV tasks

In our evaluation, MoXIchecker was also more efficient than MoXI-MC-Flow in
terms of CPU-time consumption. Figure 4 shows a quantile plot comparing
MoXIchecker and MoXI-MC-Flow on the QF_BV tasks. A data point $(x,y)$ in the
plot indicates that there are $x$ tasks, each of which can be correctly solved
by the respective tool within a time bound $y$ seconds. The figure shows that
MoXIchecker ran faster than MoXI-MC-Flow, especially for tasks that can be
solved quickly, because MoXI-MC-Flow had a slower startup time due to its
translation process (note the higher y-intercept of roughly
$3\text{\,}\mathrm{s}$ in Fig. 4).

Figure 6 shows a head-to-head comparison of MoXIchecker (cf.  in Fig. 4) and
MoXI-MC-Flow (cf.  in Fig. 4) in a scatter plot. A data point $(x,y)$ in the
plot represents a task that was solved by both MoXI-MC-Flow and MoXIchecker,
for which the former took x seconds, while the latter took y seconds. The
figure shows that the efficiency of MoXIchecker was competitive against MoXI-
MC-Flow. In particular, out of the $161$ tasks solved by both, MoXIchecker was
faster than MoXI-MC-Flow on 117 tasks.

In addition to the comparison with MoXI-MC-Flow, we evaluated the impact of
backend solvers and incremental solving on MoXIchecker. From Table 1, observe
that MathSAT5 and Z3 delivered similar performance, with the former being
slightly more effective. In contrast, incremental SMT solving had a more
pronounced effect on both the effectiveness and efficiency of MoXIchecker. The
performance improvement of our k-induction implementation
(MoXIchecker$\cdot$MathSATincr) over the implementation provided by PySMT
(MoXIchecker$\cdot$MathSAT) is also evident in Fig. 4 and Fig. 6.

RQ2: Extensibility of MoXIchecker. Table 2 lists the results of MoXIchecker
and MoXI-MC-Flow on $9$ handcrafted model-checking problems involving integer
and real arithmetics. MoXIchecker correctly solved all tasks. In contrast,
MoXI-MC-Flow produced wrong results or timeouts for the tasks containing
integers (upper half of Table 2) and had no support for tasks containing reals
(lower half of Table 2). Unlike MoXIchecker, which utilized Z3 and thus
supported the theories over integers and reals, MoXI-MC-Flow approximated
integers with bit-vectors (of length 32 by default). Due to the potential
issues of overflow and underflow in bit-vector arithmetics, such approximation
is both unsound and incomplete, therefore causing the incorrect verification
results in Table 2. This illustrative experiment shows that, compared to MoXI-
MC-Flow, MoXIchecker is (1) more reliable, as it does not yield wrong results
due to approximation, and (2) more versatile, as it supports many background
theories.

Table 2: MoXIchecker vs. MoXI-MC-Flow on tasks using integers and reals Task | Theory | Verdict | MoXIchecker | MoXI-MC-Flow
---|---|---|---|---
FibonacciSequence | QF_LIA | safe | safe | unsafe
IntIncrement | QF_LIA | unsafe | unsafe | safe
IntCounter | QF_LIA | safe | safe | timeout
IntMultiply | QF_NIA | safe | safe | unsafe
BoundedLinearGrowth | QF_LRA | safe | safe | unsupported
DoubleDelay2 | QF_LRA | unsafe | unsafe | unsupported
OscillatingRatio | QF_NRA | safe | safe | unsupported
SafeNonlinearGrowth | QF_NRA | safe | safe | unsupported
NonlinearGrowth | QF_NRA | unsafe | unsafe | unsupported

##  5 Conclusion

We introduced MoXIchecker, the first model checker for MoXI that performs
model checking with the SMT formulas describing a MoXI task directly. Compared
to MoXI-MC-Flow [12], which translates verification tasks to Btor2 [13] and
invokes hardware model checkers, MoXIchecker accommodates MoXI verification
tasks with various background theories, facilitates the implementation of new
model-checking algorithms, abstracts from specific SMT solvers using the API
of PySMT, and has a robust frontend design that avoids potential translation
bugs. Currently, MoXIchecker supports the quantifier-free theories of bit-
vectors, arrays, integers, and reals, and implements BMC [26], k-induction
[27], and IC3/PDR [28] for verification. In our evaluation, MoXIchecker
achieved a comparable performance against MoXI-MC-Flow on bit-vector tasks and
uniquely solved tasks using integer or real arithmetics. We envision
MoXIchecker to facilitate open-source implementations for model-checking
techniques around MoXI and become a cornerstone for wider adoption of symbolic
model checking. For future work, we will enhance the language support of
MoXIchecker, improve the existing verification algorithms and implement new
ones, and apply MoXIchecker to software programs or cyber-physical systems.

####  5.0.1 Data-Availability Statement

The MoXIchecker release 0.1 is available at Zenodo [38] and at
https://gitlab.com/sosy-lab/software/moxichecker.

####  5.0.2 Funding Statement

This project was funded in part by the Deutsche Forschungsgemeinschaft (DFG) –
378803395 (ConVeY) and 536040111 (Bridge).

## References

  * [1] Burch, J.R., Clarke, E.M., McMillan, K.L., Dill, D.L., Hwang, L.J.: Symbolic model checking: $10^{20}$ states and beyond. In: Proc. LICS. pp. 428–439. IEEE (1990). doi:10.1109/LICS.1990.113767
  * [2] McMillan, K.L.: Symbolic Model Checking. Springer (1993). doi:10.1007/978-1-4615-3190-6
  * [3] Rozier, K.Y., Dureja, R., Irfan, A., Johannsen, C., Nukala, K., Shankar, N., Tinelli, C., Vardi, M.Y.: MoXI: An intermediate language for symbolic model checking. In: Proc. SPIN. LNCS , Springer (2024)
  * [4] Beyer, D., Wehrheim, H.: Verification artifacts in cooperative verification: Survey and unifying component framework. In: Proc. ISoLA (1). pp. 143–167. LNCS 12476, Springer (2020). doi:10.1007/978-3-030-61362-4_8
  * [5] Beyer, D., Lee, N.Z., Wendler, P.: Interpolation and SAT-based model checking revisited: Adoption to software verification. J. Autom. Reasoning (2024). doi:10.1007/s10817-024-09702-9, preprint: https://doi.org/10.48550/arXiv.2208.05046
  * [6] Beyer, D., Chien, P.C., Jankola, M., Lee, N.Z.: A transferability study of interpolation-based hardware model checking for software verification. Proc. ACM Softw. Eng. 1(FSE) (2024). doi:10.1145/3660797
  * [7] Barrett, C., Stump, A., Tinelli, C.: The SMT-LIB Standard: Version 2.0. Tech. rep., University of Iowa (2010), https://smtlib.cs.uiowa.edu/papers/smt-lib-reference-v2.0-r10.12.21.pdf
  * [8] Cimatti, A., Griggio, A., Tonetta, S.: The VMT-LIB language and tools. In: Proc. SMT. CEUR Workshop Proceedings, vol. 3185, pp. 80–89. CEUR-WS.org (2022). https://ceur-ws.org/Vol-3185/extended9547.pdf
  * [9] McMillan, K.L.: The SMV system. In: Symbolic Model Checking, pp. 61–85 (1993). doi:10.1007/978-1-4615-3190-6_4
  * [10] DeLine, R., Leino, R.: BoogiePL: A typed procedural language for checking object-oriented programs. Tech. Rep. MSR-TR-2005-70, Microsoft Research (2005). https://www.microsoft.com/en-us/research/publication/boogiepl-a-typed-procedural-language-for-checking-object-oriented-programs/
  * [11] Beyer, D., Lee, N.Z.: The transformation game: Joining forces for verification. Springer (2024). https://www.sosy-lab.org/research/pub/2024-Katoen60.The_Transformation_Game_Joining_Forces_for_Verification.pdf
  * [12] Johannsen, C., Nukala, K., Dureja, R., Irfan, A., Shankar, N., Tinelli, C., Vardi, M.Y., Rozier, K.Y.: Symbolic model-checking intermediate-language tool suite. In: Proc. CAV. LNCS , Springer (2024)
  * [13] Niemetz, A., Preiner, M., Wolf, C., Biere, A.: Btor2, BtorMC, and Boolector 3.0. In: Proc. CAV. pp. 587–595. LNCS 10981, Springer (2018). doi:10.1007/978-3-319-96145-3_32
  * [14] Goel, A., Sakallah, K.: AVR: Abstractly verifying reachability. In: Proc. TACAS. pp. 413–422. LNCS 12078, Springer (2020). doi:10.1007/978-3-030-45190-5_23
  * [15] Mann, M., Irfan, A., Lonsing, F., Yang, Y., Zhang, H., Brown, K., Gupta, A., Barrett, C.W.: Pono: A flexible and extensible SMT-based model checker. In: Proc. CAV. pp. 461–474. LNCS 12760, Springer (2021). doi:10.1007/978-3-030-81688-9_22
  * [16] IEEE standard for Verilog hardware description language (2006). doi:10.1109/IEEESTD.2006.99495
  * [17] Minhas, M., Hasan, O., Saghar, K.: Ver2Smv: A tool for automatic Verilog to SMV translation for verifying digital circuits. In: Proc. ICEET. pp. 1–5 (2018). doi:10.1109/ICEET1.2018.8338617
  * [18] Irfan, A., Cimatti, A., Griggio, A., Roveri, M., Sebastiani, R.: Verilog2SMV: A tool for word-level verification. In: Proc. DATE. pp. 1156–1159 (2016), https://ieeexplore.ieee.org/document/7459485
  * [19] Mukherjee, R., Tautschnig, M., Kroening, D.: v2c: A Verilog to C translator. In: Proc. TACAS. pp. 580–586. LNCS 9636, Springer (2016). doi:10.1007/978-3-662-49674-9_38
  * [20] Beyer, D., Chien, P.C., Lee, N.Z.: Bridging hardware and software analysis with Btor2C: A word-level-circuit-to-C translator. In: Proc. TACAS (2). pp. 152–172. LNCS 13994, Springer (2023). doi:10.1007/978-3-031-30820-8_12
  * [21] Ádám, Z., Beyer, D., Chien, P.C., Lee, N.Z., Sirrenberg, N.: Btor2-Cert: A certifying hardware-verification framework using software analyzers. In: Proc. TACAS (3). pp. 129–149. LNCS 14572, Springer (2024). doi:10.1007/978-3-031-57256-2_7
  * [22] Tafese, J., Garcia-Contreras, I., Gurfinkel, A.: Btor2MLIR: A format and toolchain for hardware verification. In: Proc. FMCAD. pp. 55–63. IEEE (2023). doi:10.34727/2023/ISBN.978-3-85448-060-0_13
  * [23] Chien, P.C., Lee, N.Z.: CPV: A circuit-based program verifier (competition contribution). In: Proc. TACAS (3). pp. 365–370. LNCS 14572, Springer (2024). doi:10.1007/978-3-031-57256-2_22
  * [24] Griggio, A., Jonáš, M.: Kratos2: An SMT-based model checker for imperative programs. In: Proc. CAV. pp. 423–436. Springer (2023). doi:10.1007/978-3-031-37709-9_20
  * [25] Gario, M., Micheli, A.: PySMT: A solver-agnostic library for fast prototyping of SMT-based algorithms. In: Proc. SMT (2015)
  * [26] Biere, A., Cimatti, A., Clarke, E.M., Zhu, Y.: Symbolic model checking without BDDs. In: Proc. TACAS. pp. 193–207. LNCS 1579, Springer (1999). doi:10.1007/3-540-49059-0_14
  * [27] Sheeran, M., Singh, S., Stålmarck, G.: Checking safety properties using induction and a SAT-solver. In: Proc. FMCAD, pp. 127–144. LNCS 1954, Springer (2000). doi:10.1007/3-540-40922-X_8
  * [28] Bradley, A.R.: SAT-based model checking without unrolling. In: Proc. VMCAI. pp. 70–87. LNCS 6538, Springer (2011). doi:10.1007/978-3-642-18275-4_7
  * [29] Hughes, G.E., Cresswell, M.J.: A New Introduction to Modal Logic. Routledge (1996). https://www.worldcat.org/isbn/978-0-41512-600-7
  * [30] Clarke, E.M., Henzinger, T.A., Veith, H., Bloem, R.: Handbook of Model Checking. Springer (2018). doi:10.1007/978-3-319-10575-8
  * [31] Piterman, N., Pnueli, A.: Temporal logic and fair discrete systems. In: Handbook of Model Checking, pp. 27–73. Springer (2018). doi:10.1007/978-3-319-10575-8_2
  * [32] Biere, A., van Dijk, T., Heljanko, K.: Hardware model checking competition 2017\. In: Proc. FMCAD. p. 9. IEEE (2017). doi:10.23919/FMCAD.2017.8102233
  * [33] Beyer, D., Dangl, M., Dietsch, D., Heizmann, M., Lemberger, T., Tautschnig, M.: Verification witnesses. ACM Trans. Softw. Eng. Methodol. 31(4), 57:1–57:69 (2022). doi:10.1145/3477579
  * [34] McConnell, R.M., Mehlhorn, K., Näher, S., Schweitzer, P.: Certifying algorithms. Computer Science Review 5(2), 119–161 (2011). doi:10.1016/j.cosrev.2010.09.009
  * [35] de Moura, L.M., Bjørner, N.: Z3: An efficient SMT solver. In: Proc. TACAS. pp. 337–340. LNCS 4963, Springer (2008). doi:10.1007/978-3-540-78800-3_24
  * [36] Cimatti, A., Griggio, A., Schaafsma, B.J., Sebastiani, R.: The MathSAT5 SMT solver. In: Proc. TACAS. pp. 93–107. LNCS 7795, Springer (2013). doi:10.1007/978-3-642-36742-7_7
  * [37] Beyer, D., Löwe, S., Wendler, P.: Reliable benchmarking: Requirements and solutions. Int. J. Softw. Tools Technol. Transfer 21(1), 1–29 (2019). doi:10.1007/s10009-017-0469-y
  * [38] Ates, S., Beyer, D., Chien, P.C., Lee, N.Z.: MoXIchecker release 0.1. Zenodo (2024). doi:10.5281/zenodo.12787654