Assume-guarantee verification of source code with design-level assumptions

Model checking is an automated technique that can be used to determine whether a system satisfies certain required properties. To address the "state explosion" problem associated with this technique, we propose to integrate assume-guarantee verification at different phases of system development. During design, developers build abstract behavioral models of the system components and use them to establish key properties of the system. To increase the scalability of model checking at this level, we have previously developed techniques that automatically decompose the verification task by generating component assumptions for the properties to hold. The design artifacts are subsequently used to guide the implementation of the system, but also to enable more efficient reasoning of the source code. In particular, we propose to use assumptions generated for the design to similarly decompose the verification of the actual system implementation. We demonstrate our approach on a significant NASA application, where design models were used to identify and correct a safety property violation, and the generated assumptions allowed us to check successfully that the property was preserved by the implementation.

1. Introduction

Our work is motivated by an ongoing project at NASA Ames Research Center on the application of automated verification techniques to autonomous software. Autonomous systems involve complex concurrent behaviors for reacting to unpredicted environmental stimuli without human intervention. Extensive verification is a pre-requisite for the deployment of missions that involve autonomy.