Software model checking takes off

Abstract

practice AlTHOUGH FOrMAl METHODS have been used in the development of safety-and security-critical systems for years, they have not achieved widespread industrial use in software or systems engineering. However, two important trends are making the industrial use of formal methods practical. The first is the growing acceptance of model-based development for the design of embedded systems. Tools such as MATLAB Simulink 6 and esterel Technologies SCADe Suite 2 are achieving widespread use in the design of avionics and automotive systems. The graphical models produced by these tools provide a formal, or nearly formal, specification that is often amenable to formal analysis.The second is the growing power of formal verification tools, particularly model checkers. For many classes of models they provide a "push-button" means of determining if a model meets its requirements. Since these tools examine all possible combinations of inputs and state, they are much more likely to find design errors than testing.Here, we describe a translator framework developed by Rockwell Collins and the University of Minnesota that allows us to automatically translate from some of the most popular commercial modeling languages to a variety of model checkers and theorem provers. We describe three case studies in which these tools were used on industrial systems that demonstrate that formal verification can be used effectively on real systems when properly supported by automated tools.

Hybrid Theorem Proving of Aerospace Systems: Applications and Challenges

“…Both software model checking [37] and abstract interpretation [6,38] have been shown to help verifying the complex software of nowadays aircraft.…”

“…Indeed, such analysis needs to consider the behavior of the aircraftin addition to its embedded software-within its operational environment. This property makes aircrafts essentially hybrid, because they involve both continuous flight dynamics and discrete control software, which is a combination that is out of scope for software model checking [37] and abstract interpretation [6,38]. Formal verification and validation techniques for hybrid systems such as theorem proving [8,9,12] are suitable, as we have illustrated in the collision avoidance case study of Section III.…”

Logic and Epistemology in Safety Cases

“…The simulation environments that support these modeling activities are themselves software and they could, with difficulty, be represented within a logicbased assurance framework (this is already feasible for Simulink, whose models can be imported into many verification environments [16]). However, this is not the main obstacle to the use of simulation models within formalized assurance cases.…”

Event Analytics

“…For a restricted version of model checking called bounded model checking, which often suffices in many practical settings, the scope of applicability is further enhanced by the so called SMT solvers [DeB08]. As a result many industries have started to actively invest in model checking technology [MWC10].…”