Model Checking Complete Requirements Specifications Using Abstraction

  • Authors:

  • Ramesh Bharadwaj;Constance L. Heitmeyer

  • Affiliations:

  • Center for High Assurance Computer Systems (Code 5546), Naval Research Laboratory, Washington, DC 20375. ramesh@itd.nrl.navy.mil;Center for High Assurance Computer Systems (Code 5546), Naval Research Laboratory, Washington, DC 20375. heitmeyer@itd.nrl.navy.mil

  • Venue:
  • Automated Software Engineering
  • Year:
  • 1999

Quantified Score

Hi-index 0.00

Visualization

Abstract

Although model checking has proven remarkably effective in detectingerrors in hardware designs, its success in the analysis of softwarespecifications has been limited. Model checking algorithms forhardware verification commonly use Binary Decision Diagrams (BDDs) to represent predicates involvingthe many Boolean variables commonly found in hardware descriptions.Unfortunately, BDD representations may be less effective for analyzingsoftware specifications, which usually contain not only Booleansbut variables spanning a wide range of data types. Further, softwarespecifications typically have huge, sometimes infinite, state spacesthat cannot be model checked directly using conventional symbolic methods.One promising but largely unexplored approach to model checking softwarespecifications is to apply mathematically sound abstraction methods.Such methods extract a reduced model from the specification, thus makingmodel checking feasible. Currently, users of model checkers routinelyanalyze reduced models but often generate the models in ad hoc ways. Asa result, the reduced models may be incorrect.This paper, an expanded version of (Bharadwaj and Heitmeyer, 1997), describes how one can model check a complete requirementsspecification expressed in the SCR (Software Cost Reduction) tabular notation.Unlike previous approaches which applied model checking to mode transitiontables with Boolean variables, we use model checking to analyze propertiesof a complete SCR specification with variables ranging over many data types.The paper also describes two sound and, under certain conditions, completemethods for producing abstractions from requirements specifications. Theseabstractions are derived from the specification and the property to beanalyzed. Finally, the paper describes how SCR requirements specificationscan be translated into the languages of Spin, an explicit state model checker,and SMV, a symbolic model checker, and presents the results of model checkingtwo sample SCR specifications using our abstraction methods and the twomodel checkers.