Citation Context

... relationships among the atomic formulas instead of treating them as independent propositions. The initial abstract model is constructed by adapting the existential abstraction techniques proposed in =-=[8, 10]-=- to our framework. Then, a traditional model checker is used to determine whether ACTL? properties hold in the abstract model. If the answer is yes, then the concrete model also satisfies the property...

Citation Context

...be a method for generating a reduced version of the global state space given a description of how the system is structured and specifications of how the components interact. Clarke, Long and McMillan =-=[4]-=- describe a similar attempt. Both methods will still produce large state graphs if most of the states in the system are not equivalent, and much of the verification must be redone if part of the syste...

Citation Context

...of Internet-based technologies, the significance of state machines has only increased. In particular, security protocols and communication protocols are naturally specified in terms of state machines =-=[3]-=-, [4], [5]. Similar applications of state machines can be found in other safety-critical domains including medicine and aerospace. Moreover, the dramatic change of focus from relatively monolithic sys...

Citation Context

...ined semantics that is amenable to formal analysis. Finally, Formal Tropos comes with a methodology for the automated analysis and animation of specifications [21], based on model checking techniques =-=[9]-=-. As an example, Figure 2 presents the specification for the Buy Media Items and Continuous Supply goal dependencies. Notice that this specification provides additional information not present in the ...

Citation Context

...a special kind of a transition system. The validity of CTL-formulas over finite-state automata can be established by fully automated techniques such as model checking [32], [65]; for an overview, see =-=[25]-=-. The basis of model checking CTL is a systematic, usually exhaustive, state-space exploration to check whether a property is satisfied in each state of the model, thereby using effective methods to c...

Citation Context

...oach is more likely to scale in the interprocedural case than ours. The SLAM project [2] aims to verify temporal safety properties by using a combination of predicate abstraction [15], model checking =-=[4]-=-, and predicate discovery. Our approach and the SLAM approach have di#erent goals: SLAM is a verification tool intended for small, bug-prone pieces of larger systems. It is e#ective within these scala...

Citation Context

...y system errors do not emerge unless some intricate sequence of events occurs. In practice, this means that most systems have errors that only trigger after days or weeks of execution. Model checking =-=[4]-=- is an e#ective way to find such subtle errors. It takes a simplified description of the code and exhaustively tests it on all inputs, using techniques to explore vast state spaces e#ciently. Unfortun...