Position paper for WIFT'98 ["Pushbutton" analysis via integration of industrial tools with formal validation]

Spacecraft fault protection software is a challenging and critical system. Our goal is to use the same specifications for the starting point of both the code development (whether manual or automated) and the formal analysis. Furthermore, we aim to automate as much as possible of the analysis process, to make it an easy-to-apply "pushbutton"-like activity. Towards this end, we are integrating an industrial tool (Rational Rose, a UML tool) with a formal methods tool (the SPIN model checker). In particular, we are developing an automatic translator from Rational Rose statecharts to Promela (the input language of SPIN). We intend to use this translator to convert statechart descriptions of fault protection designs into Promela, and to apply SPIN to check crucial properties of those designs.