We describe the design of VIP, a graphical front-end to the model checker SPIN. VIP supports a visual formalism, called v-Promela that connects the model checker to modern hierarc...
For software executing several threads in parallel, testing is unreliable, as it cannot cover all thread schedules. Model checking, however, can cover all possible thread interlea...
We show how to determine statically whether it is safe for untrusted machine code to be loaded into a trusted host system. Our safety-checking technique operates directly on the u...
SAL 2 augments the specification language and explicit-state model checker of SAL 1 with high-performance symbolic and bounded model checkers, and with novel infinite bounded and...