Applying Model Checking to Destructive Testing and Analysis of Software System

Recently, model checking is widely applied to software and hardware verification. It can locate hard-tofind bugs in systems by exhaustively searching executing paths. In this paper, we propose a new software design method that enables us to evaluate the fault tolerance of software behavior at the specification level: we can check software behavior, not only when the hardware and network are in good order, but also when they are out of order; we can then improve fault tolerance of the target software using the model checker. We can test software under environments in which we destroy hardware and/or networks intentionally in computer simulation. The method is explained by taking an example of a network-connected AV appliance. We model the AV appliance by the modeling language Promela and analyze it by the SPIN model checker.