Model checking large software specifications

Abstract

Abstract-In this paper, we present our experiences in using symbolic model checking to analyze a specification of a software system for aircraft collision avoidance. Symbolic model checking has been highly successful when applied to hardware systems. We are interested in whether model checking can be effectively applied to large software specifications. To investigate this, we translated a portion of the state-based system requirements specification of Traffic Alert and Collision Avoidance System II (TCAS II) into input to a symbolic model checker (SMV). We successfully used the symbolic model checker to analyze a number of properties of the system. We report on our experiences, describing our approach to translating the specification to the SMV language, explaining our methods for achieving acceptable performance, and giving a summary of the properties analyzed. Based on our experiences, we discuss the possibility of using model checking to aid specification development by iteratively applying the technique early in the development cycle. We consider the paper to be a data point for optimism about the potential for more widespread application of model checking to software systems.

Verifying Statemate Statecharts Using CSP and FDR

“…For example, in Matlab Stateflow, transitions are taken according to their relative locations in the statechart diagram in clockwise order starting at the "twelve o'clock" position. 1 Our compiler treats nondeterminism as an error which would be returned by the system. This could be altered straightforwardly, but in some cases it would lead to our tool being less efficient as it presently exploits the determinism of statecharts.…”

An Abductive Approach for Analysing Event-Based Requirements Specifications

“…[20,27,28]). Most techniques based on model checking facilitate automated analysis of requirements specifications and generation of counterexamples when errors are detected [2,4,11]. However, in contrast to our approach they presuppose complete descriptions of the initial state(s) of the system to compute successor states.…”

Using abstraction and model checking to detect safety violations in requirements specifications

“…All six properties in the WCP SRS, including the two properties listed above, are transition invariants. (Also interesting to note is that all properties of the TCAS II requirements specification [30] analyzed by Anderson et al [2], except one designed to expose circular definitions, 3 are state invariants. )…”

“…3. In contrast to Anderson et al [2], who use model checking to check for circular definitions, the SCR method uses consistency checking [30], a form of static analysis. The use of static analysis to detect circularities is possible because SCR's step semantics is much simpler than the step semantics of RSML [30], the Statecharts variant used to specify TCAS II.…”