NewSlide.pptVIP

Practical Model Checking to Enforce Domain-Specific Interfaces and Requirements NASA OSMA SAS 04 Problem Verifying that software adheres to interface requirements is tedious, time consuming, and error prone Analysts need to check: Use of project-specific interfaces Use of APIs to commercial-off-the-shelf (COTS) components (e.g., VxWorks) Current Approach Analysis is done manually with tools that ease the tracing of code from unit to unit Experience shows ~80K of code takes weeks to analyze in an IVV setting Approach Automate the examination of many interface requirements using model-checking technology that works directly on the source code Model-checking system Built on GrammaTech’s CodeSurfer static-analysis platform Operates on the program’s interprocedural control-flow graph Based on weighted pushdown systems Fidelity is not 100%, but technology is scalable to real projects IVV experience suggests that this is a reasonable trade-off Examines one thread at a time, but still catches many concurrency-related bugs Many concurrency-related bugs are caused by the failure to adhere consistently to coding requirements Already implemented for C (and most of C++) Key Organizations and People Importance and Benefits Benefits Potential to significantly reduce the amount of labor needed to inspect the implementation of some requirements compared to current IVV inspection methodology Better inspection coverage and/or reduced cost Projects likely to realize benefits Mission-critical software projects where source code interface requirements have been formally defined (e.g., Principal Investigator Mode missions) Significant part of the effort is focused on transitioning approach to NASA IVV center to ensure that benefits are realized by a broad base of IVV practitioners. Relevance to NASA Many NASA interface requirements can be verified easily using push-down model checking Examples Proper use of COTS operating system calls Calls to operating system functions can be dangerous