Table Of ContentLecture Notes in Computer Science 1680
Editedby G.Goos,J. Hartmanisand J.van Leeuwen
3
Berlin
Heidelberg
NewYork
Barcelona
HongKong
London
Milan
Paris
Singapore
Tokyo
Dennis Dams Rob Gerth
Stefan Leue Mieke Massink (Eds.)
Theoretical and
Practical Aspects of
SPIN Model Checking
5th and 6th International SPIN Workshops
Trento, Italy, July 5, 1999
Toulouse, France, September 21 and 24, 1999
Proceedings
1 3
VolumeEditors
DennisDams
EindhovenUniversityofTechnology,DepartmentofElectricalEngineering
andDepartmentofMathematicsandComputerScience
5600MBEindhoven,TheNetherlands
E-mail:[email protected]
RobGerth
IntelMicroprocessorProductsGroup,StrategicCADLaboratories
5200NEElamYoungParkway,JFT-104Hillsboro,OR97124-6497,USA
E-mail:[email protected]
StefanLeue
UniversityofWaterloo,DepartmentofElectricalandComputerEngineering
Waterloo,OntarioN2L3G1,Canada
E-mail:[email protected]
MiekeMassink
C.N.R.-Ist.CNUCE
viaSantaMaria36,56126Pisa,Italy
E-mail:[email protected]
Cataloging-in-Publicationdataappliedfor
DieDeutscheBibliothek-CIP-Einheitsaufnahme
TheoreticalandpracticalaspectsofSPINmodelchecking:5thand6th
internationalSPINworkshops,Trento,Italy,July5,1999,Toulouse,France,
September21and24,1999;proceedings/DennisDams...(ed.).-Berlin;
Heidelberg;NewYork;Barcelona;HongKong;London;Milan;Paris;
Singapore;Tokyo:Springer,1999
(Lecturenotesincomputerscience;Vol.1680)
ISBN3-540-66499-8
CRSubjectClassification(1998):F.3,D.2.4,D.3.1
ISSN0302-9743
ISBN3-540-66499-8Springer-VerlagBerlinHeidelbergNewYork
Thisworkissubjecttocopyright.Allrightsarereserved,whetherthewholeorpartofthematerialis
concerned,specificallytherightsoftranslation,reprinting,re-useofillustrations,recitation,broadcasting,
reproductiononmicrofilmsorinanyotherway,andstorageindatabanks.Duplicationofthispublication
orpartsthereofispermittedonlyundertheprovisionsoftheGermanCopyrightLawofSeptember9,1965,
initscurrentversion,andpermissionforusemustalwaysbeobtainedfromSpringer-Verlag.Violationsare
liableforprosecutionundertheGermanCopyrightLaw.
(cid:2)c Springer-VerlagBerlinHeidelberg1999
PrintedinGermany
Typesetting:Camera-readybyauthor
SPIN10704313 06/3142–543210 Printedonacid-freepaper
Preface
Increasingthe designer’sconfidencethatapiece ofsoftwareorhardwareis com-
pliant with its specification has become a key objective in the design process
for software andhardwaresystems. Many approachesto reachingthis goalhave
been developed, including rigorous specification, formal verification, automated
validation, and testing. Finite-state model checking, as it is supported by the
explicit-statemodelcheckerSPIN,isenjoyingaconstantlyincreasingpopularity
in automated property validation of concurrent, message based systems. SPIN
has been in large parts implemented and is being maintained by Gerard Holz-
mann, andis freely available via ftp fromnetlib.bell-labs.comor from URL
http://cm.bell-labs.com/cm/cs/what/spin/Man/README.html.
The beauty of finite-state model checking lies in the possibility of building
“push-button” validation tools. When the state space is finite, the state-space
traversal will eventually terminate with a definite verdict on the property that
is being validated. Equally helpful is the fact that in case the property is inval-
idated the model checker will return a counterexample, a feature that greatly
facilitates fault identification. On the downside, the time it takes to obtain a
verdict may be very long if the state space is large and the type of properties
that can be validated is restricted to a logic of rather limited expressiveness.
However,lookingatthe numberandtype ofpracticalapplications itseems that
finite-state model checking technology is moving towards becoming engineering
practice.Thisdevelopmentcanlargelybeattributedtotherelativeeaseofhand-
lingandthepotentialforautomationofthe validationprocesswhichmakesthis
technology accessible to the software designer and even the domain expert.
TheSPINworkshopserieswasinitiatedbyJean-CharlesGr´egoirewhohosted
thefirstSPINworkshopinOctober1995atINRST´el´ecommunicationsinMont-
r´eal.Its successled tosubsequentSPINworkshopsheldin New Brunswick(Au-
gust 1996), Enschede (April 1997) and Paris (November 1998). At a time when
the number of formal methods events is increasing, two conferences expressed
interest in hosting SPIN workshops in 1999: the Federated Logic Conference
(FLoC’99) held in Trento in June/July, and the World Congress on Formal
Methods in the Development of Computing Systems (FM’99) held in Toulouse
inSeptember.InordertogiveSPIN-relatedresearchanexposureatbothevents
it was decided to organize two SPIN workshops in 1999. However, both events
were to focus on different aspects. The 5th International SPIN Workshop on
Theoretical Aspects of Model Checking (5thSPIN99) was held on July 5, 1999
as a satellite workshopof FLoC’99,while the 6th International SPIN Workshop
on Practical Aspects of Model Checking (6thSPIN99) was held as a user group
meeting within FM’99 on September 21 and 24, 1999.
5thSPIN99 featured an invited talk by John Rushby, 6 research paper pre-
sentations that were selected out of 12 submitted papers, an overview of SPIN
release3.3.0 by GerardHolzmann, an invited tutorial by Kousha Etessami,and
a paneldiscussion.6thSPIN99offereda keynoteaddressby Dan Craigen,anin-
vited tutorial by Rob Gerth, 12 researchpaper presentations that were selected
out of 25 submitted papers, and two tool demonstrations. Papers presented at
both workshops are included in this volume.
Acknowledgements. The editors of this volume wish to thank all referees for
theirtremendoushelpinputting togetherastrongprogramforbothworkshops.
Stefan Leue thanks Piotr Tysowski and Mohammad Zulkernine for their sup-
port in organizing the paper review process for 6thSPIN99 and for their aid
in putting this volume together. Dennis Dams and Mieke Massink are grateful
to the FLoC’99 organization, and in particular to Adolfo Villafiorita, for their
support. They also wish to thank Bell-Labs and C.N.R.-Ist. CNUCE for their
supportoftheinitiative.RobGerthandStefanLeuewishtoexpresstheirgrati-
tude to Dines Bjørner for initiating the idea of a SPINworkshopduring FM’99,
and to the FM’99 organizers for hosting the event.
September 1999 Dennis Dams
Rob Gerth
Stefan Leue
Mieke Massink
Organization
Organization of 5thSPIN99
Program Committee
Dennis Dams (Eindhoven University, The Netherlands)
Mieke Massink (CNR-Ist. CNUCE, Italy)
Gerard Holzmann (Bell Laboratories,USA)
Ed Brinksma (Univ. of Twente, The Netherlands)
Marco Daniele (ITC-IRST, Italy)
Bengt Jonsson (Uppsala University, Sweden)
Local Organization
Adolfo Villafiorita
Referees
R. Alur L. Holenderski M. Nilsson
D. Boˇsnaˇcki B. Jonsson A. Nymeyer
D. Dams R. Kaivola J. Nystro¨m
M. Daniele J.-P. Katoen T. Ruys
G. Faconti D. Latella N. Sidorova
M. Geilen G. Lenzini R. de Vries
S. Gnesi M. Massink
Organization of 6thSPIN99
Organizers
Rob Gerth (Intel Corp., USA)
Gerard Holzmann (Bell Laboratories,USA)
Stefan Leue (University of Waterloo, Canada)
Referees
K. Etessami M. Kamel P. Tysowski
R. Gerth G. Karjoth M. Zulkernine
J.-C. Gr´egoire S. Leue
G. Holzmann W. Liu
Table of Contents
Part I: Selection of Papers Presented at 5thSPIN99
1. Keynote Address
Integrated Formal Verification: Using Model Checking with Automated
Abstraction, Invariant Generation, and Theorem Proving ............... 1
John Rushby (SRI International)
2. Theory
Runtime Efficient State Compaction in Spin .......................... 12
J. Geldenhuys, P.J.A. de Villiers (University of Stellenbosch)
Distributed-Memory Model Checking with SPIN ....................... 22
Flavio Lerda, Riccardo Sisto (Politecnico di Torino)
PartialOrderReductioninPresenceofRendez-vousCommunicationswith
Unless Constructs and Weak Fairness................................. 40
Dragan Boˇsnaˇcki (Eindhoven University of Technology)
Divide, Abstract, and Model-Check .................................. 57
Karsten Stahl, Kai Baukus, Yassine Lakhnech, and Martin Steffen
(Christian-Albrechts Universita¨t zu Kiel)
Part II: Papers Presented at 6thSPIN99
1. Keynote Address
Formal Methods Adoption: What’s Working, What’s Not!............... 77
Dan Craigen (ORA Canada)
2. Methodology
Model Checking for Managers ....................................... 92
Wil Janssen (Telematica Instituut), Radu Mateescu (INRIA Rhoˆne-
Alpes), Sjouke Mauw (Eindhoven University of Technology and CWI),
Peter Fennema (Telematica Instituut), and Petra van der Stappen
(Telematica Instituut)
Xspin/Project - Integrated Validation Management for Xspin ........... 108
Theo C. Ruys (University of Twente)
X Table of Contents
3. Applications I
Analyzing Mode Confusion via Model Checking........................ 120
Gerald Lu¨ttgen, Victor Carren˜o (NASA Langley Research Center)
DetectingFeatureInteractionsintheTerrestrialTrunkedRadio(TETRA)
Network Using Promela and Xspin ................................... 136
Carl B. Adekunle, Steve Schneider (University of London)
JAVA PathFinder, A Translator from Java to Promela.................. 152
Klaus Havelund (NASA Ames Research Center)
VIP: A Visual Interface for Promela.................................. 153
Moataz Kamel, Stefan Leue (University of Waterloo)
4. Specification and Validation
Events in Property Patterns......................................... 154
Marsha Chechik, Dimitrie O. Pa˘un (University of Toronto)
Assume-GuaranteeModelCheckingofSoftware:AComparativeCaseStudy168
Corina S. Pa˘sa˘reanu, Matthew B. Dwyer, and Michael Huth
(Kansas State University)
A Framework for Automatic Construction of Abstract Promela Models ... 184
Maria-del-Mar Gallardo, Pedro Merino (University of Malaga)
5. Applications II
Model Checking Operator Procedures ................................ 200
Wenhui Zhang (Institute for Energy Technology)
Applying Model Checking in Java Verification ......................... 216
KlausHavelund(NASAAmes ResearchCenter),JensUlrik Skakkebæk
(Stanford University)
6. Extensions
The Engineering of a Model Checker: The Gnu i-Protocol Case Study
Revisited .........................................................232
Gerard J. Holzmann (Bell Laboratories)
Embedding a Dialect of SDL in PROMELA........................... 245
Heikki Tuominen (Nokia Telecommunications)
dSPIN: A Dynamic Extension of SPIN................................ 261
ClaudioDemartini,RaduIosif,andRiccardoSisto(PolitecnicodiTorino)
Author Index ................................................. 277
