Stefan Leue – författare

Visual notations and languages continue to play a pivotal role ˆ in the design of complex software systems. In many cases visual notations are used to - scribe usage or interaction scenarios of software systems or their components. While representing scenarios using a visual notation is not the only possibility, a vast majority of scenario description languages is visual. Scenarios are used in telecommunications as Message Sequence Charts, in object-oriented system design as Sequence Diagrams, in reverse engineering as execution traces, and in requirements engineering as, for example, Use Case Maps or Life Sequence Charts. These techniques are used to capture requirements, to capture use cases in system documentation, to specify test cases, or to visualize runs of existing systems. They are often employed to represent concurrent systems that int- act via message passing or method invocation. In telecommunications, for more than 15 years the International Telecommunication Union has standardized the Message Sequence Charts (MSCs) notation in its recommendation Z. 120. More recently, with the emergence of UML as a predominant software design meth- ology, there has been special interest in the development of the sequence d- gram notation. As a result, the most recent version, 2. 0, of UML encompasses the Message Sequence Chart notation, including its hierarchical modeling f- tures. Other scenario-?avored diagrams in UML 2. 0 include activity diagrams and timing diagrams.

Visual notations and languages continue to play a pivotal role ˆ in the design of complex software systems. In many cases visual notations are used to - scribe usage or interaction scenarios of software systems or their components. While representing scenarios using a visual notation is not the only possibility, a vast majority of scenario description languages is visual. Scenarios are used in telecommunications as Message Sequence Charts, in object-oriented system design as Sequence Diagrams, in reverse engineering as execution traces, and in requirements engineering as, for example, Use Case Maps or Life Sequence Charts. These techniques are used to capture requirements, to capture use cases in system documentation, to specify test cases, or to visualize runs of existing systems. They are often employed to represent concurrent systems that int- act via message passing or method invocation. In telecommunications, for more than 15 years the International Telecommunication Union has standardized the Message Sequence Charts (MSCs) notation in its recommendation Z. 120. More recently, with the emergence of UML as a predominant software design meth- ology, there has been special interest in the development of the sequence d- gram notation. As a result, the most recent version, 2. 0, of UML encompasses the Message Sequence Chart notation, including its hierarchical modeling f- tures. Other scenario-?avored diagrams in UML 2. 0 include activity diagrams and timing diagrams.

The SPIN workshop series brings together researchers and practitioners int- ested in explicit state model checking technology as it is applied to the veri?- tion of software systems. Since 1995, when the SPIN workshop series was instigated, SPIN workshops have been held on an annual basis at Montr´ eal (1995), New Brunswick (1996), Enschede (1997), Paris (1998), Trento (1999), Toulouse (1999), Stanford (2000), andToronto(2001). Whilethe?rstSPINworkshopwasastand-aloneevent,later workshopshavebeenorganizedasmoreorlesscloselya?liatedeventswithlarger conferences, in particular with CAV (1996), TACAS (1997), FORTE/PSTV (1998), FLOC (1999), World Congress on Formal Methods (1999), FMOODS (2000), and ICSE (2001). This year, SPIN 2002 was held as a satellite event of ETAPS 2002, the European Joint Conferences on Theory and Practice of Software. The co-location of SPIN workshops with conferences has proven to be very successful and has helped to disseminate SPIN model checking technology to wider audiences. Since 1999, the proceedings of the SPIN workshops have appeared in Springer-Verlag’s “Lecture Notes in Computer Science” series. The history of successful SPIN workshops is evidence for the maturing of model checking technology, not only in the hardware domain, but increasingly also in the software area. While in earlier years algorithms and tool development 1 around the SPIN model checker were the focus of this workshop series, the scopehasrecentlywidenedtoincludemoregeneralapproachestosoftwaremodel checking. Current research in this area concentrates not so much on completely verifyingsystemmodels,butratheronanalyzingsourcecodeinordertodiscover software faults.

The SPIN workshop series brings together researchers and practitioners int- ested in explicit state model checking technology as it is applied to the veri?- tion of software systems. Since 1995, when the SPIN workshop series was instigated, SPIN workshops have been held on an annual basis at Montr´ eal (1995), New Brunswick (1996), Enschede (1997), Paris (1998), Trento (1999), Toulouse (1999), Stanford (2000), andToronto(2001). Whilethe?rstSPINworkshopwasastand-aloneevent,later workshopshavebeenorganizedasmoreorlesscloselya?liatedeventswithlarger conferences, in particular with CAV (1996), TACAS (1997), FORTE/PSTV (1998), FLOC (1999), World Congress on Formal Methods (1999), FMOODS (2000), and ICSE (2001). This year, SPIN 2002 was held as a satellite event of ETAPS 2002, the European Joint Conferences on Theory and Practice of Software. The co-location of SPIN workshops with conferences has proven to be very successful and has helped to disseminate SPIN model checking technology to wider audiences. Since 1999, the proceedings of the SPIN workshops have appeared in Springer-Verlag’s “Lecture Notes in Computer Science” series. The history of successful SPIN workshops is evidence for the maturing of model checking technology, not only in the hardware domain, but increasingly also in the software area. While in earlier years algorithms and tool development 1 around the SPIN model checker were the focus of this workshop series, the scopehasrecentlywidenedtoincludemoregeneralapproachestosoftwaremodel checking. Current research in this area concentrates not so much on completely verifyingsystemmodels,butratheronanalyzingsourcecodeinordertodiscover software faults.

Increasing the designer’s con dence that a piece of software or hardwareis c- pliant with its speci cation has become a key objective in the design process for software and hardware systems. Many approaches to reaching this goal have been developed, including rigorous speci cation, formal veri cation, automated validation, and testing. Finite-state model checking, as it is supported by the explicit-state model checkerSPIN,is enjoying a constantly increasingpopularity in automated property validation of concurrent, message based systems. SPIN has been in large parts implemented and is being maintained by Gerard Ho- mann, and is freely available via ftp fromnetlib.bell-labs.comor from URL http://cm.bell-labs.com/cm/cs/what/spin/Man/README.html. The beauty of nite-state model checking lies in the possibility of building \push-button" validation tools. When the state space is nite, the state-space traversal will eventually terminate with a de nite verdict on the property that is being validated. Equally helpful is the fact that in case the property is inv- idated the model checker will return a counterexample, a feature that greatly facilitates fault identi cation. On the downside, the time it takes to obtain a verdict may be very long if the state space is large and the type of properties that can be validated is restricted to a logic of rather limited expressiveness.

Increasing the designer’s con dence that a piece of software or hardwareis c- pliant with its speci cation has become a key objective in the design process for software and hardware systems. Many approaches to reaching this goal have been developed, including rigorous speci cation, formal veri cation, automated validation, and testing. Finite-state model checking, as it is supported by the explicit-state model checkerSPIN,is enjoying a constantly increasingpopularity in automated property validation of concurrent, message based systems. SPIN has been in large parts implemented and is being maintained by Gerard Ho- mann, and is freely available via ftp fromnetlib.bell-labs.comor from URL http://cm.bell-labs.com/cm/cs/what/spin/Man/README.html. The beauty of nite-state model checking lies in the possibility of building \push-button" validation tools. When the state space is nite, the state-space traversal will eventually terminate with a de nite verdict on the property that is being validated. Equally helpful is the fact that in case the property is inv- idated the model checker will return a counterexample, a feature that greatly facilitates fault identi cation. On the downside, the time it takes to obtain a verdict may be very long if the state space is large and the type of properties that can be validated is restricted to a logic of rather limited expressiveness.

This book constitutes the thoroughly refereed post-workshop proceedings of the 12th International Workshop on Formal Methods for Industrial Critical Systems, FMICS 2007, held in Berlin, Germany, in July 2007 - colocated with CAV 2007, the 19th International Conference on Computer Aided Verification. The 15 revised full papers presented together with the abstracts of 2 invited lectures were carefully selected during two rounds of reviewing and improvement from 31 initial submissions. The papers strive to promote research and development for the improvement of formal methods and tools for industrial applications and they are organized in topical sections on control systems, scheduling and time, verification, software, and testing.