From NuSMV to SPIN: Experiences with model checking flight guidance systems

Abstract

Model checking has become a promising technique for verifying software and hardware designs; it has been routinely used in hardware verification, and a number of case studies and industrial applications show its effectiveness in software verification as well. Nevertheless, most existing model checkers are specialized for limited aspects of a system, where each of them requires a certain level of expertise to use the tool in the right domain in the right way. Hardly any guideline is available on choosing the right model checker for a particular problem domain, which makes adopting the technique difficult in practice, especially for verifying software with high complexity.In this work, we investigate the relative pitfalls and benefits of using the explicit model checker Spin on commercial Flight Guidance Systems (FGSs) at Rockwell-Collins, based on the author's prior experience with the use of the symbolic model checker NuSMV on the same systems. This has been a question from the beginning of the project with RockwellCollins. The challenge includes the efficient use of Spin for the complex synchronous mode logic with a large number of state variables, where Spin is known to be not particulary efficient. We present the way the Spin model is optimized to avoid the state space explosion problem and discuss the implication of the result. We hope our experience can be a useful reference for the future use of model checking in a similar domain.

Formal Verification of a Flash Memory Device Driver – An Experience Report

“…In [26], a case study on model checking a flight guidance system (FGS) is reported. FGS is encoded in a larger number of BDD variables, but shows better performance than that of MSR; one of the FGS models was encoded with 839 BDD variables and the peak number of nodes was 3,213,168.…”

“…Our experiment results show that the selection of model checking technique makes significant effects on the performance of verifying MSR as well as verification effort to create and maintain a model which is also a crucial factor for successful application of model checking in industry. Although there exist a number of case studies on comparisons between different model checkers [26,9,11], comparison from the view-point of data-intensive application has not seen intensive study thus far; we believe that this issue is crucial to the success of verifying flash software. Furthermore, the empirical studies of the three different model checkers can provide valuable insight to the relative strengths and weaknesses of these popular model checking techniques.…”

Formal specification and verification of a coordination protocol for an automated air traffic control system

“…Although [23] pointed out weaknesses of model checkers in handling complex data structures and arithmetic operations, model checking is still a powerful tool for verifying safety-critical protocols and several case studies on model checking various aerospace systems have been published [6,21,31]. Our study is carried out early in the design phase before any system implementation is available.…”

“…Our study is carried out early in the design phase before any system implementation is available. Our system model and specifications for model validation and model verification are generated directly from natural language, while [31] generates the system model from the source code, and [6,21] generate NuSMV models automatically from another formal language.…”

Analysis of the Model Checkers' Input Languages for Modeling Traffic Light Systems

“…(Choi, 2007) were compared on a model of Flight Guidance System (FGS). The purpose of this study is to investigate whether SPIN more suitable than NuSMV in term of scability and usability.…”