Cadence Design Systems

Abstract. This paper reports as a case study an attempt to model check the control subsystem of an operational NASA robotics system. Thirty seven properties including both safety properties and liveness properties were formulated for the system. Twenty two of the thirty seven properties were successfully model checked. Several significant flaws in the original software system were identified and corrected during the model checking process. The case study presents the entire process in a semi-historical mode. The goal is to provide reusable knowledge of what worked, what did not work and why. 1