Logic checkers

Syntactic and logic checkers - tools to verify that the code being written makes sense, covers all eventualities and that the development environment will be able to compile the code when required. 

Such logical relationships between dynamic properties can be very useful in the analysis of (both simulated as well as empirical) scenarios, especially when used in combination with the TTL Checker Tool mentioned earlier. For example, for the empirical trace 1, checking GPl pointed out that this properly was not satisfied. As a result, by a refutation process (following the tree in Fig. 6 top-down) it could be concluded that either IPl or IP2 failed (or a comhinafion of them). When, after further checking, 1P2 was found to be the cause of the failure, the analysis could proceed by focusing on LPl and LP2. Evenmally, LPl was found satisfied, whereas LP2 failed. Thus, (part of) the source of the incident could he reduced to failure of LP2, i.e., there was an agent (namely the pilot of the Hercules) that believed to have the permission to take off, whilst this was not communicated by the tower. A discussion with our domain expert confirmed that this was indeed the case. One level deeper, such local properties can even be related to executable properties. For instance, the failure of LP2 can be explained because the Hercules pilot applied property EPS. A full connection of local properties to executable properties is beyond the scope of this paper, but a detailed discussion can be found in [10]. 

Types of Automation Theorem Provers - fully formal machine-checked proofs, in which the theorem prover attempts to produce a formal proof, given a description of tbe system, a set of logical axioms and a set of inference rules. Model Checkers - automated proof of model against tbe specification, in which the model checker verifies certain properties by means of a search of possible states of a system. 

Cau, A., Moszkowski, B. and Zedan, H. (1997) Interval Temporal Logic Proof Checker Manual. In preparation. 

The rest of the paper is structured as follows. First we give the syntax and semantics of CTL and review the theory of alternating automata. In sections 3.2(b) and 3.3 we discuss our efficient implementations for, respectively, CTL and CTL model checkers, based on the algorithms in Bemholtz (1995). We then show how alternating automata can be used to determine sub-logics of CTL for which linear model checking algorifiims exist Section 4 briefly describes the Rainbow framework and... 

For a given state machine M and a temporal logic expression e, we can perform model checking. A model checker searches all possibilities of behaviors produced by M and checks whether the behaviors satisly the expression e. If the behaviors satisfy e then the model checker outputs yes otherwise no. For the latter case, it also produces a counter-example which is a concrete trace that violates e. 

This step aims to verify the software at the code level against the safety requirements which are expressed in the formal specification in step 2. After formalizing the safety requirements, this step can be done in two different ways 1) using a model checker for formal verification [22], or 2) using a model checker to generate corresponding test cases [17]. A model checker takes as input a model of the software and the property of interest, which is written in temporal logic and... 

Researchers informal logic, model checkers, and control theory have recently developed a set of tools that capture specification of tasks using more intuitive language/algorithms (Kress-Gazitetal., 2009 Wongpiromsametal., 2009). Con-... 

Model checkers such as SPIN do not have a notion of quantitative time and can therefore not analyze requirements on timeliness, e.g., "if x, then y must occur within 10 ms". There are however tools for model checking of real-time systems that rely on timed automata for modeling and Computation Tree Logic (CTL) (Clarke Emerson, 1982) for checking. 

In the case of violation of the expected behavior, the (reaction) handles the resulting errors. Within the (reaction) block, a set of (malfunction) => (action) pairs can be specified. The malfunctions determine which corresponding (action) shall be executed. Malfunctions are derived from the specific effects of errors detected by the software safety requirement. For exampie, the malfunctions detected by a range checker are lower and upper limits vioiations, denoted by VALUE-BELOW RANGE and VALUE.ABOVE.RANGE, resp. Similarly, a control-flow requirement has temporal and logical state-transition violations as malfunctions. 

We consider CADP like a black-box. Yet, we should provide all inputs our translation generates LNT file, additional inputs must be presented depending on the concerned tool. For example, model-checker tool verifies if LNT specification satisfies a property expressed in temporal logic. In this case, we also specify a set of properties as a second input. After analyzing, CADP gives useful results for the correction of the initial model. For example, model-checker gives a false/true response for every checked property. 

---