Model checking large software specifications

Abstract

In this paper we present our results and experiences of using symbolic model checking to study the specification of an aircraft collision avoidance system. Symbolic model checking has been highly successful when applied to hardware systems. We are interested in the question of whether or not model checking techniques can be applied to large software specifications.To investigate this, we translated a portion of the finitestate requirements specification of TCAS II (Traffic Alert and Collision Avoidance System) into a form accepted by a model checker (SMV). We successfully used the model checker to investigate a number of dynamic properties of the system.We report on our experiences, describing our approach to translating the specification to the SMV language and our methods for achieving acceptable performance in model checking, and giving a summary of the properties that we were able to check. We consider the paper as a data point that provides reason for optimism about the potential for successful application of model checking to software systems. In addition, our experiences provide a basis for characterizing features that would be especially suitable for model checkers built specifically for analyzing software systems.The intent of this paper is to evaluate symbolic model checking of state-machine based specifications, not to evaluate the TCAS II specification. We used a preliminary version of the specification, the version 6.00, dated March, 1993, in our study. We did not have access to later versions, so we do not know if the properties identified here are present in later versions.

Property specification patterns for finite-state verification

“…The same appears true in formal speci cation languages for concurrent and reactive systems. While there are a number of very expressive formalisms, such as CTL* and the modal mu-calculus, the speci cations that are documented in the literature, for example in 1,6,12,14,24,27], appear relatively simple. They can be expressed fairly simply in existing speci cation formalisms and don't require advanced, complex features.…”

Linear Temporal Logic Symbolic Model Checking

“…That said, several full-scale air traffic control systems in a similar vein have been successfully verified using model checking techniques stemming from those we discussed here. For example, symbolic model checking in SMV was used to verify the Traffic Alert and Collision Avoidance System (TCAS II), an air traffic guidance system required on-board large commercial aircraft [164]. Properties checked included the absence of undesirable non-determinism, mutual exclusion, termination, absence of references to undefined parameters, and elimination of inconsistencies in the protocol specification.…”

Implementing statecharts in PROMELA/SPIN

“…However, first encouraging results in model checking software specifications also exists (e.g. [2,5]). …”