The SPIN Model Checker is used for both teaching software verification techniques, and for validating large scale applications. The growing number of users has created a need for a more comprehensive user guide and a standard reference manual that describes the most recent version of the tool. This book fills that need. SPIN is used in over 40 countries. The offical SPIN web site, spinroot.com receives between 2500 and 3000 hits per day. It has been estimated that up to three-quarters of the $400 billion spent annually to hire programmers in the United States is ultimately spent on debugging

The SPIN Model Checker: Primer and Reference Manual

Model checkers and other finite-state verification tools allow developers to detect certain kinds of errors automatically. Nevertheless, the transition of this technology from research to practice has been slow. While there are a number of potential causes for reluctance to adopt such formal methods, we believe that a primary cause is that practitioners are unfamiliar with specification processes, notations, and strategies. In a recent paper, we proposed a pattern-based approach to the presentation, codification and reuse of property specifications for finite-state verification. Since then, we have carried out a survey of available specifications, collecting over 500 examples of property specifications. We found that most are instances of our proposed patterns. Furthermore, we have updated our pattern system to accommodate new patterns and variations of existing patterns encountered in this survey. This paper reports the results of the survey and the current status of our pattern system.

/pdf/patterns-in-property-specifications-for-finite-state-126awsf84j.pdf

Patterns in property specifications for finite-state verification

In this paper, we review current requirements engineering (RE) research and identify future research directions suggested by emerging software needs. First, we overview the state of the art in RE research. The research is considered with respect to technologies developed to address specific requirements tasks, such as elicitation, modeling, and analysis. Such a review enables us to identify mature areas of research, as well as areas that warrant further investigation. Next, we review several strategies for performing and extending RE research results, to help delineate the scope of future research directions. Finally, we highlight what we consider to be the "hot" current and future research topics, which aim to address RE needs for emerging systems of the future.

/pdf/research-directions-in-requirements-engineering-2kckbdavsh.pdf

Research Directions in Requirements Engineering

Finite-state verification (e.g., model checking) provides a powerful means to detect errors that are often subtle and difficult to reproduce. Nevertheless, the transition of this technology from research to practice has been slow. While there are a number of potential causes for reluctance in adopting such formal methods in practice, we believe that a primary cause rests with the fact that practitioners are unfamiliar with specification processes, notations, and strategies. Recent years have seen growing success in leveraging experience with design and coding patterns. We propose a pattern-based approach to the presentation, codification and reuse of property specifications for finite-state verification.

/pdf/property-specification-patterns-for-finite-state-54kiobhf1o.pdf

Property specification patterns for finite-state verification

The specification of reactive and real-time systems must be supported by formal, mathematically-founded methods in order to be satisfactory and reliable. Temporal logics have been used to this end for several years. Temporal logics allow the specification of system behavior in terms of logical formulas, including temporal constraints, events, and the relationships between the two. In the last ten years, temporal logics have reached a high degree of expressiveness. Most of the temporal logics proposed in the last few years can be used for specifying reactive systems, although not all are suitable for specifying real-time systems. In this paper we present a series of criteria for assessing the capabilities of temporal logics for the specification, validation, and verification of real-time systems. Among the criteria are the logic's expressiveness, the logic's order, presence of a metric for time, the type of temporal operators, the fundamental time entity, and the structure of time. We examine a selection of temporal logics proposed in the literature. To make the comparison clearer, a set of typical specifications is identified and used with most of the temporal logics considered, thus presenting the reader with a number of real examples.

Temporal logics for real-time system specification

This article describes a graphical interval logic that is the foundation of a tool set supporting formal specification and verification of concurrent software systems Experience has shown that most software engineers find standard temporal logics difficult to understand and use The objective of this article is to enable software engineers to specify and reason about temporal properties of concurrent systems more easily by providing them with a logic that has an intuitive graphical representation and with tools that support its use To illustrate the use of the graphical logic, the article provides some specifications for an elevator system and proves several properties of the specifications The article also describes the tool set and the implementation

/pdf/a-graphical-interval-logic-for-specifying-concurrent-systems-3418ephnv9.pdf

A graphical interval logic for specifying concurrent systems

Graphical Interval Logic (GIL) is a temporal logic in which all reasoning is done by means of diagrammatic formulae. It is a discrete linear-time modal logic in which the basic temporal modality is the interval. Future Interval Logic (FIL) provides the logical foundation for GIL. In this paper we present an automata-theoretic decision procedure for FIL with complexity DTIME$(2^{O(n^k )} )$, where n is the size of the formula and k is the depth of interval nesting. For formulae with bounded depth but length unbounded, the satisfiability problem for FIL is shown to be PSPACE-complete. We believe that this is the first result giving a direct decision procedure of elementary complexity for an interval logic. We also show that the logic is transparent to finite stuttering over the class of ω-sequences, a feature that is useful for composition and refinement.

An Automata-Theoretic Decision Procedure for Future Interval Logic

We present a description of a graphical interval logic that is the foundation of a toolset we are developing to support formal specification and verification of concurrent software systems. Experience has shown that most software engineers find standard temporal logics difficult to under- stand and to use. Our objective is to enable software engineers to specify and reason about temporal properties of concurrent systems more easily by providing them with a logic that has an intuitive graphical representation and with tools that support its use. To illustrate the use of our graphical interval logic, we provide a specification for a readers/writers database system and prove several properties of the specification.

Graphical specifications for concurrent software systems

Real-Time Future Interval Logic is a visual logic in which formulae have a natural graphical representation, resembling timing diagrams. It is a dense real-time temporal logic that is based on two simple temporal primitives: interval modalities for the purely qualitative part and duration predicates for the quantitative part. We give a decision procedure for the logic by reduction to the emptiness problem for Timed Buchi Automata. The decision procedure forms the core of a proof checker for the logic that we have recently implemented. The logic does not admit instantaneous states, and is invariant under realtime stuttering. These properties facilitate proof methods based on abstraction and refinement. Two natural extensions of the logic lead to nonelementariness and undecidability.

A Real-Time Interval Logic and Its Decision Procedure

We describe a prototype toolkit for reasoning about Graphical Interval Logic (GIL) specifications of concurrent systems. GIL is a visual temporal logic that is intended to be more intuitive and easier to use than standard textual temporal logics. The GIL toolkit helps system designers to create graphical specifications of concurrent systems, to verify properties of those systems from their specifications, and to generate models that satisfy the specifications. The toolkit provides a visual interface with specifications, proofs, and models all depicted graphically. The paper describes the toolkit, discusses its implementation, and provides an illustration of its use. >

P. M. Melliar-Smith

Papers

A graphical interval logic for specifying concurrent systems

An Automata-Theoretic Decision Procedure for Future Interval Logic

Graphical specifications for concurrent software systems

A Real-Time Interval Logic and Its Decision Procedure

Visual tools for temporal reasoning