Chan, W., Anderson, R.J., Beame , P., Burns, S., Modugno, F., Notkin, D., Reese, J., 1998. Model Checking Large Software Specifications, IEEE Transactions on Software Engineering 24 (7) , 498-520.  Home/Search   Document Details and Download   Summary   Related Articles   Check

....applied to verification of concurrently executing state event machines. Lind Nielsen, et al. 16] applied SMV [18] for verification of hardware systems represented by VisualState state machines. Dependency analysis was used to decompose a large but naturally spatially modular systems. Chan, et al. [6] verified a complex aircraft collision software. They reported that their ad hoc solutions for the manual system partitioning frequently caused invalid results. None approaches the issues of the system redesign prior to model checking. Design guidelines for constructing testable and maintainable ....

Chan, W., Anderson, R., Beame, P., Burns, S., Modugno, F., Notkin, D., Reese, J., Model Checking Large Software Specifications, In Proc. of IEEE Transaction on Software Engineering (1998) 498-519

....are preserved. One interesting result is that multiple bounds which are not powers of two cause the BDD size to be exponential in the number of variables in the worst case. The problem of inefficient BDD representation of arithmetic constraints in symbolic model checkers has been pointed out in [7, 12]. In [7] the problem for SMV is handled by writing a preprocessor and fixing the BDD variable order. However, as we show in this paper, this extra step is not necessary since efficient BDDs can be directly constructed from a set of linear arithmetic constraints. In [12] the problem is solved ....

....One interesting result is that multiple bounds which are not powers of two cause the BDD size to be exponential in the number of variables in the worst case. The problem of inefficient BDD representation of arithmetic constraints in symbolic model checkers has been pointed out in [7, 12] In [7], the problem for SMV is handled by writing a preprocessor and fixing the BDD variable order. However, as we show in this paper, this extra step is not necessary since efficient BDDs can be directly constructed from a set of linear arithmetic constraints. In [12] the problem is solved only for ....

W. Chan, R. J. Anderson, P. Beame, S. Burns, F. Modugno, D. Notkin, and J. D. Reese. Model checking large software specifications. IEEE Transactions on Software Engineering, 24(7):498--520, July 1998.

.... [8] to more formal techniques such as model checking, theorem proving [6] and other logic based approaches (e.g. 20, 27, 28] Most techniques based on model checking facilitate automated analysis of requirements specifications and generation of counterexamples when errors are detected [2, 4, 11]. However, in contrast to our approach they presuppose complete descriptions of the initial state(s) of the system to compute successor states. Moreover, they need to apply abstraction techniques to reduce the size of the state space, and can only handle finite state systems. For example, in the ....

Anderson, R, et al. (1996). Model Checking Large Software Specifications. ACM Proc. of 4th Int. Symp. on the Foundation of Software Engineering.

....to t e first point w ere q olds. An example LTL specification for t e response property all requests for a resource are followed by granting of t e resource is [ request granted) Many e#orts ave been made to apply model c ecking to software artifacts including requirements specifications [1, 2], arc itectures [12] and implementations [6] W en model c ecking software, one describes t e software as a finite state transition system, specifies system properties wit a temporal logic formula, and c ecks, ex austively, t at all sequences of states satisfy t e formula. Specifically, in t e ....

R.Anderson,P.Beame,S.Burns,W.Chan,F.Modugno,D.Notkin,and J. Reese. Model Checking Large Sof tware Specifications, Sof tware Engineering Notes, 21(6):156--166, November 1996. 160

....of statecharts that are insu#cient for our purpose [10, 29] Others are simply di#cult to obtain [36] Since no adequate tool for the translation of statecharts to SMV is available, alternatives need to be found. Currently, the preferred approach is a modification of an algorithm presented in [6] for the translation of RSML statemachine descriptions [17] to (CMU) SMV. This algorithm needs to be extended to translate STATEMATE statecharts to Cadence SMV. Alternatives are an adaptation of the work in [10] or the implementation of the algorithms in [26, 27] However, it would be preferrable ....

W. Chan, R.J. Anderson, P. Beame, S. Burns, F. Modugno, D. Notkin, and J.D. Reese. Model Checking Large Software Specifications. IEEE Transactions on Software Engineering, 24(7):498--520, July 1998.

.... Valuation status: stable, unstable Transition Activity updates 1 EventVal val: true, false BasicGuardVal val: true, false is in step taken in Figure 10.7 Meta model of implementation We have also experimented with a second implementation that is based on existing approaches [34, 126] to verify statecharts with symbolic model checkers like for example NuSMV. In the second implementation, the syntax of an activity hypergraph is encoded directly as input for a symbolic model checker; the semantics that the symbolic model checker attaches to the input coincides with the ....

....data and real time cannot be explicitly modelled. Strong fairness constraints can also be specified in LTSA, but Karamanolis et al. 107] do not focus on loops in workflow schemas. Our work is also closely related to the work done on model checking Statemate and UML statecharts. Chan et al. [34] and Mikk [126] have defined model checking for Statemate statecharts or variants thereof, using SMV [125] and Spin [99] Latella et al. 116] present a translation for a subset of UML statecharts to Spin [99] None of the implementations discussed in these papers provide a graphical ....

W. Chan, R. Anderson, P. Beame, S. Burns, F. Modugno, D. Notkin, and J. Reese. Model checking large software specifications. IEEE Transactions on Software Engineering, 24(7):498--520, 1998.

....[21] Only process models that have no loops are supported. The process modelling language neither has external events nor temporal events. The authors do not address strong fairness. Our work is also closely related to the work done on model checking Statemate and UML statecharts. Chan et al. [5] and Mikk [30] have defined model checking for Statemate statecharts or variants thereof, using SMV [29] and Spin [21] Latella et al. 27] present a translation for a subset of UML statecharts to Spin [21] All these authors encode the syntax of the statechart explicitly in the input language and ....

W. Chan, R. Anderson, P. Beame, S. Burns, F. Modugno, D. Notkin, and J. Reese. Model Checking Large Software Specifications. IEEE Transactions on Software Engineering, 24(7):498--520, 1998.

....techniques has been mainly restricted to hardware systems and communication protocols. Lind Nielsen, et. al [15] applied SMV [16] model checker for verification of hardware systems represented by VisualState machines. Dependency analysis was used to decompose large complex systems. Chan, et.al [4] verified control algorithms of a complex aircraft collision system modeled using the UML notation. They reported that their ad hoc solutions for the manual system partitioning frequently caused invalid results. Sharygina, et.al [23] applied the SPIN model checker [8] for verification of the ....

Chan, W., Anderson, R., Beame, P., Burns, S., Modugno, F., Notkin, D., Reese, J., Model Checking Large Software Specification, In Proc. of IEEE SE Trans. (1998) 498-519

....which is a part of UML [1] are essentially state machines. Model checking is a technique for verifying properties of state machines. Initially model checking was used for verifying hardware designs. Recently researchers have started investigating applications of model checking to software [2, 3]. References: 1. Model checking, E.M. Clarke, O. Grumberg, and D.A. Peled, MIT Press, 2000. 2. The Model Checker Spin, G.J. Holzmann, IEEE Transactions on Software Engineering (TSE) Vol 23 5, pages 279 295, May 1997. 3. Model Checking for Programming Languages using VeriSoft, P. Godefroid, ....

W. Chan, R.J. Anderson, P. Beame, S. Burns, F. Modugno, D. Notkin, and J.D. Reese. Model checking large software specifications. IEEE Transactions on Software Engineering, 24(7):498--520, July 1998.

....the model checker SMV [9] We further assume that safety constraints have been derived separately and are encoded in the temporal logic CTL. A variety of extant case studies that use model checkers to analyze realistic systems lend plausibility to these assumptions. One example case study is TCAS[8], where the own aircraft logic of a traffic collision and avoidance system is specified in SMV. Another example case study is FGS[22] where the mode logic for a flight guidance system has been specified and analyzed in a variety of formal notations, including SMV[28] Our basic idea is that ....

W. Chan, R. J. Anderson, P. Beame, S. Burns, F. Modugno, D. Notkin, and J. D. Reese. Model checking large software specifications. IEEE Transactions on Software Engineering, 24(7):498 -- 520, July 1998.

....extended finite state machines: there is a finite set of logical states, transitions between these states, and an internal memory or store. Where the internal store is finite, there is an overall finite state structure and it is possible to check properties quasi exhaustively using model checking [41, 30, 11]. However, even where the internal store is finite, the number of possible values for this may make model checking infeasible. It might be possible to use an approach similar to conditioned slicing to reduce this problem: given a property being checked, aspects that are not relevant to this ....

CHAN, W., ANDERSON, R. J., BEAME, P., BURNS, S., MODUGNO, F., AND NOTKIN, D. Model checking large software specifications. IEEE Transactions on Software Engineering 24 (1998), 498--519.

.... approach proposed in this paper: the Traffic Alert and Collision Avoidance System (TCAS) TCAS is an on board aircraft conflict detection and resolution system used by all US commercial aircraft, whose specification can be found in [28] TCAS has been studied by both the industry and the academia [1], 18] 24] and can be considered as a benchmark for safety critical applications. In what follows, TCAS is informally described and then the different experiments carried out using SAVE are presented. 5.1 TCAS TCAS continuously monitors the radar information to check whether there is any ....

Richard J. Anderson, Paul Beame, Steve Burns, William Chan, Francesmary Modugno, David Notkin, and Jon D. Reese. "Model checking large software specifications," IEEE Transactions on Software Engineering, 24(7):498-520, 1998.

....4 Scade, 5 ASCET 6 are routinely used at different stages in the development process for control software. e.g. 27] reports on the use of the Scade tool to generate airborne software and the induced cost benefits. Indeed, the same concern about safety has caused companies like Boeing [3] and British Aerospace [6] to also assess the use of formal verification methods. Similarly, in automotive, the incentive to reduce development costs by letting model checking catch errors early on in the development process, or the use of modelchecking to create a golden reference model in the ....

R. Anderson, P. Beame, S. Burns, W. Chan, F. Modugno, D. Notkin, and J. Reese, "Model checking large software specifications," IEEE Transactions on Software Engineering, Vol. 24, No. 7, pp. 498--520, 1998.

....For a transition t, define Exits(t) resp. Enters(t) as the set of states that a system exits (resp. enters) on taking transition t. For example, we have that Exits(t 1 ) foffg and Enters(t 1 ) fon, coffee, idle, money, emptyg. The formal definition for Exits(t) and Enters(t) can be found in [7]. The scope of a transition t, denoted by scope(t) is defined as the lowest OR state in the state hierarchy that is a proper ancestor of both source(t) and target(t) For example, scope(t 2 ) cvm and scope(t 3 ) coffee. Two transitions t and t 0 conflict if scope(t) is an ancestor of ....

W. Chan, R.J. Anderson, P. Beame, S. Burns, F. Modugno, D. Notkin, and J.D. Reese, "Model Checking Large Software Specifications," IEEE Transactions on Software Engineering, Vol. 24, No. 7, pp. 498-520, July 1998.

.... with other techniques, such as abstraction and composition [6] It is important to note that most of the involved techniques are only good in a heuristic sense: although theoretically their computational complexity is extremely large, practically, on many examples, they prove to be efficient [7, 1]. Successful verification of real world hardware, software and protocols has been achived with these techniques. However, even with these combinations, the verification of large and complex designs often requires too much resources and is either not possible, due to the complexity of the ....

R. J. Anderson, P. Beame, S. Burns, W. Chan, F. Modugno, D. Notkin, and R. Reese. Model checking large software specifications. In 4 th Symposium on the Foundations of Software Engineering, pages 156--166. ACM/SIGSOFT, Oct. 1996.

....the model checker generates a counterexample in the form of a trace or sequence of states, if possible. Although model checking began as a method for verifying hardware designs, there is growing evidence that it can be applied to specifications for large software systems, such as TCAS II [7]. In addition to verifying properties of software, model checking is being applied to test generation and test coverage evaluation [2, 6, 10, 11] In both uses, one begins with selection of a test criterion [12] that is, a decision about what properties of a specification must be exercised to ....

W. Chan, R. J. Anderson, P. Beame, S. Burns, F. Modugno, D. Notkin, and J. D. Reese. Model checking large software specifications. IEEE Transactions on Software Engineering, 24(7):498 -- 520, July 1998.

....they resist and sometimes actively subvert the application of formal methods to do meaningless busy work. When the project fails, partially due to the subversion, they gleefully blame the formal methods for the failure. Successful experimental applications of formal methods to real projects [21, 18, 10, 7, 13, 1, 2, 5, 31, 3, 19, 4] failed to convince most software engineers of the effectiveness of formal methods. The perception is that the project team got lucky or had other strengths going for it or that the project had special security or safety needs that could not be handled with ordinary methods, needs that are not ....

....began exploring ways to make formal methods more attractive. Most of these were technical solutions aimed at making the formal language, the method, the tools, etc. more palatable, more easily used, more powerful, more automatic, less ambitious, more realistic, more incremental, and even more fun [18, 10, 7, 13, 11, 1, 2, 5, 31, 3, 19, 4]. Each paper about one of these new approaches bemoans the lack of general use of formal methods, diagnoses the lack as the result of some particular problem in the use of formal methods, and offers a new approach that avoids, mitigates, or solves the identified problem. However, none of these has ....

Chan, W., Anderson, R., Beame, P., Burns, S., Modugno, F., Notkin, D., and Reese, J.D., "Model Checking Large Software Specifications," Technical Report, Computer Science Department, University of Washington, Seattle, WA (September 1997).

....results by just doing the software twice at the cost of about 100 more. However, for highly safety and security critical systems, for which the cost of failure is death or is considered very high, FMs are necessary to achieve the required correctness and are well worth the cost. David Notkin [9] observes about model checking that sometimes it is necessary to make simplifying assumptions in the model to get a model tractable enough to be checked. This necessity creates a dilemma. Without simplification, the specification cannot be analyzed and critical problems might be overlooked. ....

Chan, W., Anderson, R. J., Beame, P., Burns, S., Modugno, F., Notkin, D., and Reese, J. D., "Model Checking Large Software Specifications," IEEE Transactions on Software Engineering, SE-24:7, 498--520, July 1998

....automatic generator) Produce auxiliary Is Counterexample Reachable I an invariant of Is S Salsa I = New I L Fig. 1. Process for applying Salsa. Related Work. The use of SMV [28] and SPIN [25] on software specifications for consistency and invariant checking has been well documented [2, 9, 16, 22]. SCR [23] is a toolset that includes a consistency checker which uses a method based on semantic tableaux extended to handle simple constraints over the integers and reals. This tool has proved very useful in a number of practical case studies; however, the tool is unable to complete the checks ....

William Chan, Richard J. Anderson, Paul Beame, Steve Burns, Francesmary Modugno, David Notkin, and Jon D. Reese. Model checking large software specifications. IEEE Trans. on Softw. Eng., 24(7), July 1998.

....automatic generator) Produce auxiliary Is Counterexample Reachable I an invariant of Is S Salsa I = New I L Fig. 1. Process for applying Salsa. Related Work. The use of SMV [28] and SPIN [25] on software specifications for consistency and invariant checking has been well documented [2, 9, 16, 22]. SCR [23] is a toolset that includes a consistency checker which uses a method based on semantic tableaux extended to handle simple constraints over the integers and reals. This tool has proved very useful in a number of practical case studies; however, the tool is unable to complete the checks ....

R. J. Anderson, P. Beame, et al. Model checking large software specifications. In Proc. Fourth ACM FSE, October 1996.

....demonstrate how these extensions were integrated into an abstraction tool that performs automated predicate abstraction of Java programs. 1. INTRODUCTION Model checking is becoming an increasingly successful technique for analyzing software requirement specifications and software design models [1, 4, 9]. The main reason for this trend is that, at high levels of abstraction, the limitations of model checking are often avoided with minimal cost. This is convenient because it is well known that discovering errors early in the software life cycle is very cost effective. However, it is also the case ....

R. J. Anderson, P. Beame, S. Burns, W. Chan, F. Modugno, D. Notkin, and J. D. Reese. Model checking large software specifications. In Proceedings of the 4th ACM SIGSOFT Symposium on the Foundations of Software Engineering, volume 21 of SIGSOFT Software Engineering Notes, pages 156--166. ACM, October 1996.

....user guidance. Verification Engine. The verification engine that is central to the work described here is the Bell Labs model checker SPIN [12] 1 Until now, to user of a model checking system will typically manually define an abstract model that captures the essential aspects of an application [2], 13] Properties can then be formulated as assertions, or more generally as formulae in propositional temporal logic [20] SPIN can perform either an exhaustive check that proves whether or not the model satisfies the property, or it can deliver a best effort estimate of this fact within given ....

Chan, W., Anderson, R.J., Beame, P., et al., Model checking large software specifications. IEEE Trans. on Software Engineering, Vol. 24, No. 7, pp. 498-519, July 1998.

....higher order functions, and can thus be approximated by an iterative MTDD approach. Although it is di#cult to obtain precise estimates for the time complexity of model checking using MTDDs (as with BDDs and MTBDDs) the success of (MT)BDD based model checkers for large scale examples (for BDDs [13] and for MTBDDs [24, 26] provides su#cient evidence to investigate MTDDs for our setting. For instance, 24] reports experimental results of the computation of steady state probabilities for discrete time Markov chains of over 10 27 states. Organisation of the paper. Section 2 introduces MTDDs ....

W. Chan, R. Anderson, P. Beame, S. Burns, F. Modugno, D. Notkin and J.D. Reese. Model checking large software specifications. IEEE Trans. on Softw. Eng., 24(7): 498--519, 1998.

....the model checker generates a counterexample in the form of a trace or sequence of states, if possible. Although model checking began as a method for verifying hardware designs, there is growing evidence that it can be applied to specifications for large software systems, such as TCAS II [7]. In addition to verifying properties of software, model checking is being applied to test generation and test coverage evaluation [2, 6, 10, 11] In both uses, one begins with selection of a test criterion [12] that is, a decision about what properties of a specification must be exercised to ....

W. Chan, R. J. Anderson, P. Beame, S. Burns, F. Modugno, D. Notkin, and J. D. Reese. Model checking large software specifications. IEEE Transactions on Software Engineering, 24(7):498 -- 520, July 1998.

....mutants generated by all operators, and k be the number of mutants killed. The coverage is k=N . We use this metric to compare operators in Section 3.4. 2. 1 Applicability Model checking, a vital part of the method, can be applied to specifications for large software systems, such as TCAS II [9]. 1 After [15] a test criterion is a decision about what properties of a specification must be exercised to constitute a thorough test. To avoid the model checker s state space explosion problem, several approaches are used, such as abstraction, partial order reduction, and symmetry [10] A ....

W. Chan, R. J. Anderson, P. Beame, S. Burns, F. Modugno, D. Notkin, and J. D. Reese. Model checking large software specifications. IEEE Transactions on Software Engineering, 24(7):498 -- 520, July 1998.

....causal inconsistencies, and to detect nondeterminism in the reactive software. The clock calculii in Lustre and Signal, as well as constructive semantics in Esterel can be seen as verification support provided directly by the compiler (comparable to several properties verified by model checking in [2]) Most of the works reported within this community, however, apply verification techniques to check the controller on its own. To attack the class of properties arising as a result of interaction between the controller and the controlled environment, we need to explicitly model those aspects of ....

W. Chan, R.J. Anderson, P. Beame, S. Burns, F. Modugno, D. Notkin, and J.D. Reese. Model Checking Large Software Specifications. IEEE Transactions on Software Engineering, 24:498--519, July 1998.

....components, but these tools see only the proof obligations and do not have access to the full specification. When a different kind of analysis is desired for example, checking of invariants then a different translator and a different back end tool (e.g. a model checker) may be required [13]. By contrast, the structural embedding of tables in PVS allows all the capabilities of PVS to be applied to the full specification, including use of its model checker to examine invariants [31] Checking of proof obligations with a back end tool is not without difficulties. First is the question ....

William Chan, Richard J. Anderson, Paul Beame, Steve Burns, Francesmary Modugno, David Notkin, and Jon D. Rees. Model checking large software specifications. IEEE Transactions on Software Engineering, 24(7):498--520, July 1998.

....orders of magnitude. As a result, we were able to guarantee that we could find the liveness property violation and perform exhaustive verification within 512MB after adding the fix. 7 RELATED WORK Although model checking is becoming popular for the analysis of software specifications and designs [1, 2, 6], it is not commonly used for analyzing implementations. Holzmann and Smith developed a system whereby a Promela model is constructed directly from stylized C code [14] There technique differs from ours since abstraction is done during translation, whereas we abstract the source before ....

R. J. Anderson, P. Beame, S. Burns, W. Chan, F. Modugno, D. Notkin, and J. D. Reese. Model checking large software specifications. In Proceedings of the 4th ACM SIGSOFT Symposium on the Foundations of Software Engineering, volume 21 of SIGSOFT Software Engineering Notes, pages 156--166. ACM, October 1996.

....meet these criteria. Earlier attempts to apply automated verification techniques to distributed software applications generally have relied on hand crafted abstract models, often produced by verification experts over a period of months in collaboration with the developers of the application, e.g. [CAB98][S98] Because of the time required to construct models by hand, significant changes in the source application cannot easily be tracked without a significant reinvestment of time and energy. By eliminating the need for hand crafted models, the FeaVer system can be used to verify virtually every ....

Chan, W., Anderson, R.J., Beame, P., et al., Model checking large software specifications. IEEE Trans. on Software Engineering, Vol. 24, No. 7, pp. 498-519, July 1998.

....they are relatively easy to use and understand for all stake holders in a specification effort. These languages allow automated verification of properties such as completeness and consistency [12, 15] and efforts are underway to model check state based specifications of large software systems [2, 5]. Even so, none of the tools supporting these languages met the requirements that we established for a prototyping environment. SCR and the original RSML tool did not allow as flexible nor as easy an integration of component models as we desired. Statemate provides the ability to integrate with ....

W. Chan, R.J. Anderson, P. Beame, S. Burns, F. Modugno, D. Notkin, and J.D. Reese. Model checking large software specifications. IEEE Transactions on Software Engineering, 24(7):498--520, July 1998.

....verification, symbolic model checking, binary decision diagrams, requirements specification, statecharts, fault tolerance. 1 INTRODUCTION Symbolic model checking [4] shows promise as an aid to producing industrial strength software specifications in which developers have increased confidence [6, 19]. The formal languages for writing such specifications allow developers to produce specifications in a number of different styles. Just as the way that a program is written affects how This work was supported in part by National Science Foundation grant CCR 970670. W. Chan s work was supported in ....

....study of applying symbolic model checking based on binary decision diagrams (BDDs) 3] to a statecharts specification developed by the Boeing Commercial Airplane Group. Previously, the same technique was applied to the requirements specification of the airborne collision avoidance system TCAS II [6, 7] written in the Requirements State Machine Language (RSML) 13] a language also based on statecharts. The observations and the optimization technique described in this paper result from the combined experience of these two case studies. To elaborate, in symbolic model checking, the state space ....

[Article contains additional citation context not shown here]

W. Chan, R. J. Anderson, P. Beame, S. Burns, F. Modugno, D. Notkin, and J. D. Reese. Model checking large software specifications. IEEE Transactions on Software Engineering, 24(7):498--520, July 1998.

No context found.

R. J. Anderson, P. Beame, S. Burns, W. Chan, F. Modugno, D. Notkin, and J. D. Reese. Model checking large software specifications. In Pro11 ceedings of the Fourth ACM SIGSOFT Symposium on the Foundations of Software Engineering, pages 156--166, October 1996.

No context found.

Chan, W., Anderson, R.J., Beame , P., Burns, S., Modugno, F., Notkin, D., Reese, J., 1998. Model Checking Large Software Specifications, IEEE Transactions on Software Engineering 24 (7) , 498-520.

No context found.

W. Chan, R. Anderson, P. Beame, S. Burns, F. Modugno, D. Notkin and J.D. Reese. Model checking large software specifications. IEEE Trans. on Softw. Eng., 24(7): 498--519, 1998.

No context found.

W. Chan, R. J. Anderson, P. Beame, S. Burns, F. Modugno, D. Notkin, and J. D. Reese. Model checking large software specifications. IEEE Transactions on Software Engineering, 24(7):498--520, July 1998.

No context found.

Chan W, Anderson R, Beame P, Burns S, Modugno F, Notkin D, Reese J. Model checking large software specifications. IEEE Trans Software Eng 1998;24(7):498--520

No context found.

William Chan, Richard J. Anderson, Paul Beame, Steve Burns, Francesmary Modugno, David Notkin, and Jon D. Reese. Model Checking Large Software Specifications. IEEE Transactions on Software Engineering, 24(7):498--520, 1998.

No context found.

Chan, W., Anderson, R., Beame, P., Burns, S., Modugno, F., Notkin, D., and Reese, J. (1998). Model Checking Large Software Specifications. IEEE Transactions on Software Engineering, 24(7):498--520.

No context found.

W. Chan, R. Anderson, P. Beame, S. Burns, F. Modugno, D. Notkin, and J. Reese. Model checking large software specifications, 1998.

No context found.

William Chan, Richard J. Anderson, Paul Beame, Steve Burns, Francesmary Modugno, David Notkin, and Jon D. Reese. Model Checking Large Software Specifications. IEEE Transactions on Software Engineering, 24(7):498--520, 1998.

No context found.

William Chan, Richard J. Anderson, Paul Beame, Steve Burns, Francesmary Modugno, David Notkin, and Jon D. Reese. Model Checking Large Software Specifications. IEEE Transactions on Software Engineering, 24(7):498--520, 1998.

No context found.

R. J. Anderson, P. Beame, S. Burns, W. Chan, F. Modugno, D. Notkin, and J. D. Reese. Model checking large software specifications. In Proceedings of the 4th ACM SIGSOFT Symposium on the Foundations of Software Engineering, volume 21 of SIGSOFT Software Engineering Notes, pages 156--166. ACM, October 1996.

No context found.

W. Chan, R. J. Anderson, P. Beame, S. Burns, F. Modugno, D. Notkin, and J. D. Reese. Model checking large software specifications. IEEE Transactions on Software Engineering, 24(7):498--520, July 1998.

No context found.

Richard J. Anderson, Paul Beame, Steve Burns, William Chan, Francesmary Modugno, David Notkin, and Jon D. Reese. Model checking large software specifications. ACM SIGSOFT Software Engineering Notes, 21(6):156--166, November 1996.

No context found.

R. Anderson, P. Beame, S. Burns, W. Chan, F. Modugno, D. Notkin, and J. Reese. Model checking large software specifications. In Proceedings of the Fourth A CM SIGSOFT Symposium on the Foundation of Software Engineering, pages 156-166, 1996.

No context found.

Anderson, R., et al. (1996). Model Checking Large Software Specifications. ACM SIGSOFT Proceedings of 4th International Symposium on Foundation of Software Engineering, San Francisco, USA, October 16-18, pp. 156-166

No context found.

Richard J. Anderson, Paul Beame, Steve Burns, William Chan, Francesmary Modugno, David Notkin, and Jon Damon Reese. Model checking large software specifications. IEEE Transactions on Software Engineering, 24(7):498--520, July 1996.

No context found.

Richard J. Anderson, Paul Beame, Steve Burns, William Chan, Francesmary Modugno, David Notkin, and Jon D. Reese. Model checking large software specifications. In Proceedings of the Fourth ACM SIGSOFT Symposium on the Foundations of Software Engineering, pages 156--166, 1996.

No context found.

W. Chan, R. J. Anderson, P. Beame, S. Burns, F. Modugno, D. Notkin, and J. D. Reese. Model checking large software specifications. IEEE Transactions on Software Engineering, 24(7):498--520, July 1998.

No context found.

W. Chan, R. Anderson, P. Beame, S. Burns, F. Modugno, D. Notkin, and J. Reese. Model checking large software specifications. IEEE Transactions on Software Engineering, 24(7):498--519, 1998.

First 50 documents  Next 50

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC