Model-Driven Software Verification

Abstract

Abstract. In the classic approach to logic model checking, software verification requires a manually constructed artifact (the model) to be written in the language that is accepted by the model checker. The construction of such a model typically requires good knowledge of both the application being verified and of the capabilities of the model checker that is used for the verification. Inadequate knowledge of the model checker can limit the scope of verification that can be performed; inadequate knowledge of the application can undermine the validity of the verification experiment itself. In this paper we explore a different approach to software verification. With this approach, a software application can be included, without substantial change, into a verification test-harness and then verified directly, while preserving the ability to apply data abstraction techniques. Only the test-harness is written in the language of the model checker. The test-harness is used to drive the application through all its relevant states, while logical properties on its execution are checked by the model checker. To allow the model checker to track state, and avoid duplicate work, the test-harness includes definitions of all data objects in the application that contain state information. The main objective of this paper is to introduce a powerful extension of the SPIN model checker that allows the user to directly define data abstractions in the logic verification of application level programs.

Gossiping Girls Are All Alike

“…For n ≥ 7 this computational overhead becomes significant. 4 The 'winner' of our experiments is the bliss model. It is the only model which succeeds in generating all states for n = 8, albeit slowly.…”

“…Finally, the remaining elements are copied to the end of groups. In this way we keep the channel sorted without the need of an extra #include "chan-inlines.h" chan groups = [4] channel. 3 The macro remove removes one girl from the tuple (kx,sx).…”

“…Basic knowledge of graph isomorphism theory is also assumed. The approach taken for this model is based on the abstraction techniques of [4].…”

“…Note that canonical adjmat does not have the "StackOnly" decoration within its declaration. In terms of [4], canonical adjmat is the abstract graph.…”

Formal Verification of a Flash Memory Device Driver – An Experience Report

“…The second outermost loop iterates until the LS's of the current LU are completely read (line [4][5][6][7][8][9][10][11][12][13][14][15]. The third loop iterates over PUs mapped to the current LU (line [6][7][8][9][10][11][12][13][14]. The innermost loop identifies consecutive PS's that contain consecutive LS's in the current PU (line 7-10).…”