I:Selection of Papers Presented at 5thSPIN99 -- Integrated Formal Verification: Using Model Checking with Automated Abstraction, Invariant Generation, and Theorem Proving -- Runtime Efficient State Compaction in Spin -- Distributed-Memory Model Checking with SPIN -- Partial Order Reduction in Presence of Rendez-vous Communications with Unless Constructs and Weak Fairness -- Divide, Abstract, and Model-Check -- II: Papers Presented at 6thSPIN99 -- Formal Methods Adoption: What’s Working, What’s Not! -- Model Checking for Managers -- Xspin/Project - Integrated Validation Management for Xspin -- Analyzing Mode Confusion via Model Checking -- Detecting Feature Interactions in the Terrestrial Trunked Radio (TETRA) Network Using Promela and Xspin -- Java PathFinder A Translator from Java to Promela -- VIP: A Visual Interface for Promela -- Events in Property Patterns -- Assume-Guarantee Model Checking of Software: A Comparative Case Study -- A Framework for Automatic Construction of Abstract Promela Models -- Model Checking Operator Procedures -- Applying Model Checking in Java Verification -- The Engineering of a Model Checker: the Gnu i-Protocol Case Study Revisited. -- Embedding a Dialect of SDL in PROMELA -- dSPIN: A Dynamic Extension of SPIN.

Increasing the designer’s con dence that a piece of software or hardwareis c- pliant with its speci cation has become a key objective in the design process for software and hardware systems. Many approaches to reaching this goal have been developed, including rigorous speci cation, formal veri cation, automated validation, and testing. Finite-state model checking, as it is supported by the explicit-state model checkerSPIN,is enjoying a constantly increasingpopularity in automated property validation of concurrent, message based systems. SPIN has been in large parts implemented and is being maintained by Gerard Ho- mann, and is freely available via ftp fromnetlib.bell-labs.comor from URL http://cm.bell-labs.com/cm/cs/what/spin/Man/README.html. The beauty of nite-state model checking lies in the possibility of building \push-button" validation tools. When the state space is nite, the state-space traversal will eventually terminate with a de nite verdict on the property that is being validated. Equally helpful is the fact that in case the property is inv- idated the model checker will return a counterexample, a feature that greatly facilitates fault identi cation. On the downside, the time it takes to obtain a verdict may be very long if the state space is large and the type of properties that can be validated is restricted to a logic of rather limited expressiveness.