Analyzing interaction orderings with model checking

Dwyer, Matthew B.; Robby, .; Tkachuk, Oksana; Visser, W.

doi:10.1109/ase.2004.1342733

Cited by 25 publications

(32 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The graphical user model in (Dwyer et al, 2004) is similar to our generic GUI driver. That model, however, creates all types of user events after choosing a GUI object.…”

Section: Related Workmentioning

confidence: 99%

Eliminating synchronization faults in air traffic control software via design for verification with concurrency controllers

et al. 2007

View full text Add to dashboard Cite

Abstract.The increasing level of automation in critical infrastructures requires development of effective ways for finding faults in safety critical software components. Synchronization in concurrent components is especially prone to errors and, due to difficulty of exploring all thread interleavings, it is difficult to find synchronization faults. In this paper we present an experimental study demonstrating the effectiveness of model checking techniques in finding synchronization faults in safety critical software when they are combined with a design for verification approach. We based our experiments on an automated air traffic control software component called the Tactical Separation Assisted Flight Environment (TSAFE). We first reengineered TSAFE using the concurrency controller design pattern. The concurrency controller design pattern enables a modular verification strategy by decoupling the behaviors of the concurrency controllers from the behaviors of the threads that use them using interfaces specified as finite state machines. The behavior of a concurrency controller is verified with respect to arbitrary numbers of threads using the infinite state model checking techniques implemented in the Action Language Verifier (ALV). The threads which use the controller classes are checked for interface violations using the finite state model checking techniques implemented in the Java Path Finder (JPF). We present techniques for thread isolation which enables us to analyze each thread in the program separately during interface verification. We conducted two sets of experiments using these verification techniques. First, we created 40 faulty versions of TSAFE using manual fault seeding. During this exercise we also developed a classification of faults that can be found using the presented design for verification approach. Next, we generated another 100 faulty versions of TSAFE using randomly seeded faults that were created automatically based on this fault classification. We used both infinite and finite state verification techniques for finding the seeded faults. The results of our experiments demonstrate the effectiveness of the presented design for verification approach in eliminating synchronization faults.

show abstract

“…The graphical user model in (Dwyer et al, 2004) is similar to our generic GUI driver. That model, however, creates all types of user events after choosing a GUI object.…”

Section: Related Workmentioning

confidence: 99%

Eliminating synchronization faults in air traffic control software via design for verification with concurrency controllers

et al. 2007

View full text Add to dashboard Cite

show abstract

“…Another related project by Caporuscio et al focuses on compositional model checking of middleware specifications but does not consider middleware implementations which is the focus of our paper [3]. Other related work in the area of event-based systems includes a semi-automatic approach to the analysis of GUI systems using Bandera/Bogor [8], and several approaches to the analysis of distributed Java that use remote method invocation [18,6]. Another related project in the area of model checking software architectures is CHARMY which allows for the specification of UML-like diagrams for system design and verification [14].…”

Section: Related Workmentioning

confidence: 99%

Verifying Distributed, Event-Based Middleware Applications Using Domain-Specific Software Model Checking

Cai

Bradbury

Dingel

2007

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. The success of distributed event-based infrastructures such as SIENA and Elvin is partially due to their ease of use. Even novice users of these infrastructures not versed in distributed programming can quickly comprehend the small and intuitive interfaces that these systems typically feature. However, if these users make incorrect assumptions about how the infrastructure services work, a mismatch between the infrastructure and its client applications occurs, which may manifest itself in erroneous client behaviour. We propose a framework for automatically model checking distributed event-based systems in order to discover mismatch between the infrastructure and its clients. Using the SIENA event service as an example, we implemented and evaluated our framework by customizing the Bandera/Bogor tool pipeline. Two realistic Java applications are implemented to test and evaluate the framework.

show abstract

“…Even though counterexample guided techniques, such as [2,7,8], can be used to guide model checkers to refine and optimize the abstraction, such techniques still demand significant effort from the analysts to first decide if a counterexample is genuine or spurious. Unfortunately, with respect to analyzing user interface software for its human factors properties, no general solution has been proposed to assist analysts in making such decisions.…”

Section: Related Workmentioning

confidence: 99%

Formal Verification of Medical Device User Interfaces Using PVS

Masci

Zhang

Jones

et al. 2014

Fundamental Approaches to Software Engineering

View full text Add to dashboard Cite

Abstract. We present a formal verification approach for detecting design issues related to user interaction, with a focus on user interface of medical devices. The approach makes a novel use of configuration diagrams proposed by Rushby to formally verify important human factors properties of user interface implementation. In particular, it first translates the software implementation of user interface into an equivalent formal specification, from which a behavioral model is constructed using theorem proving; human factors properties are then verified against the behavioral model; lastly, a comprehensive set of test inputs are produced by exploring the behavioral model, which can be used to challenge the real interface implementation and to ensure that the issues detected in the behavior model do apply to the implementation. We have prototyped the approach based on the PVS proof system, and applied it to analyze the user interface of a real medical device. The analysis detected several interaction design issues in the device, which may potentially lead to severe consequences.

show abstract

Analyzing interaction orderings with model checking

Cited by 25 publications

References 16 publications

Eliminating synchronization faults in air traffic control software via design for verification with concurrency controllers

Eliminating synchronization faults in air traffic control software via design for verification with concurrency controllers

Verifying Distributed, Event-Based Middleware Applications Using Domain-Specific Software Model Checking

Formal Verification of Medical Device User Interfaces Using PVS

Contact Info

Product

Resources

About