Program Slicing: A Way of Separating WHILE Programs into Precise and Approximate Portions - Zhang, Guangli

Predicting Rankings of Software Verification Tools Using Kernels for Structured Data - Czech, Mike

Verifikation von Service Kompositionen mit Spin - Dewender, Markus
.

Verifikation von Service Kompositionen mit Prolog - Heinisch, Philipp
.

Speed Up Configurable Certificate Validation by Certificate Reduction and Partitioning - Jakobs, Marie-Christine (Proceedings of the 13th International Conference on Software Engineering and Formal Methods (SEFM))
Before execution, users should formally validate the correctness of software received from untrusted providers. To accelerate this validation, in the proof carrying code (PCC) paradigm the provider delivers the software together with a certificate, a formal proof of the software’s correctness. Thus, the user only checks if the attached certificate shows correctness of the delivered software.Recently, we introduced configurable program certification, a generic, PCC based framework supporting various software analyses and safety properties. Evaluation of our framework revealed that validation suffers from certificate reading. In this paper, we present two orthogonal approaches which improve certificate validation, both reducing the impact of certificate reading. The first approach reduces the certificate size, storing information only if it cannot easily be recomputed. The second approach partitions the certificate into independently checkable parts. The trick is to read parts of the certificate while already checking read parts. Our experiments show that validation highly benefits from our improvements.

Just test what you cannot verify! - Czech, Mike; Jakobs, Marie-Christine; Wehrheim, Heike (Fundamental Approaches to Software Engineering)
Today, software verification is an established analysis method which can provide high guarantees for software safety. However, the resources (time and/or memory) for an exhaustive verification are not always available, and analysis then has to resort to other techniques, like testing. Most often, the already achieved partial verification results arediscarded in this case, and testing has to start from scratch.In this paper, we propose a method for combining verification and testing in which testing only needs to check the residual fraction of an uncompleted verification. To this end, the partial results of a verification run are used to construct a residual program (and residual assertions to be checked on it). The residual program can afterwards be fed into standardtesting tools. The proposed technique is sound modulo the soundness of the testing procedure. Experimental results show that this combinedusage of verification and testing can significantly reduce the effort for the subsequent testing.

Incremental Inductive Verification of Parameterized Timed Systems - Isenberg, Tobias (Proceedings of the 15th International Conference on Application of Concurrency to System Design (ACSD))
We propose an incremental workflow for the verification of parameterized systems modeled as symmetric networks of timed automata. Starting with a small number of timed automata in the network, a safety property is verified using IC3, a state-of-the-art algorithm based on induction.The result of the verification, an inductive strengthening, is reused proposing a candidate inductive strengthening for a larger network.If the candidate is valid, our main theorem states that the safety property holds for all sizes of the network of timed automata. Otherwise the number of automata is increased and the next iteration is started with a new run of IC3.We propose and thoroughly examine optimizations to our workflow, e.g. Feedback mechanisms to speed up the run of IC3.

Systematic Development and Re-Use of Model Tranformations - Besova, Galina

Programs from Proofs of Predicated Dataflow Analyses - Jakobs, Marie-Christine; Wehrheim, Heike (Proceedings of the 30th Annual ACM Symposium on Applied Computing)
Programs from Proofs" is a generic method which generates new programs out of correctness proofs of given programs. The technique ensures that the new and given program are behaviorally equivalent and that the new program is easily verifiable, thus serving as an alternative to proof-carrying code concepts. So far, this generic method has one instantiation that verifies type-state properties of programs. In this paper, we present a whole range of new instantiations, all based on data ow analyses. More precisely, we show how an imprecise but fast data ow analysis can be enhanced with a predicate analysis as to yield a precise but expensive analysis. Out of the safety proofs of this analysis, we generate new programs, again behaviorally equivalent to the given ones, which are easily verifiable" in the sense that now the data ow analysis alone can yield precise results. An experimental evaluation practically supports our claim of easy verification.

Grammar-based model transformations: Definition, execution, and quality properties - Besova, Galina; Steenken, Dominik; Wehrheim, Heike (Computer Languages, Systems & Structures)
Model transformation is a key concept in model-driven software engineering. The definition of model transformations is usually based on meta-models describing the abstract syntax of languages. While meta-models are thereby able to abstract from uperfluous details of concrete syntax, they often loose structural information inherent in languages, like information on model elements always occurring together in particular shapes. As a consequence, model transformations cannot naturally re-use language structures, thus leading to unnecessary complexity in their development as well as in quality assurance.In this paper, we propose a new approach to model transformation development which allows to simplify the developed transformations and improve their quality via the exploitation of the languages׳ structures. The approach is based on context-free graph grammars and transformations defined by pairing productions of source and target grammars. We show that such transformations have important properties: they terminate and are sound, complete, and deterministic.

Temporal plans for software architecture reconfiguration - Ziegert, Steffen; Wehrheim, Heike (Computer Science - R & D)

From Program Verification to Time and Space: The Scientific Life of Ernst-Rüdiger Olderog - Meyer, Roland; Wehrheim, Heike (Correct System Design - Symposium in Honor of Ernst-Rüdiger Olderog on the Occasion of His 60th Birthday, Oldenburg, Germany, September 8-9, 2015. Proceedings)

Verifying Opacity of a Transactional Mutex Lock - Derrick, John; Dongol, Brijesh; Schellhorn, Gerhard; Travkin, Oleg; Wehrheim, Heike (FM 2015: Formal Methods - 20th International Symposium, Oslo, Norway, June 24-26, 2015, Proceedings)

TSO to SC via Symbolic Execution - Wehrheim, Heike; Travkin, Oleg (Hardware and Software: Verification and Testing - 11th International Haifa Verification Conference, HVC 2015, Haifa, Israel, November 17-19, 2015, Proceedings)

Correct System Design - Symposium in Honor of Ernst-Rüdiger Olderog on the Occasion of His 60th Birthday, Oldenburg, Germany, September 8-9, 2015. Proceedings

Verified Service Compositions by Template-Based Construction - Walther, Sven; Wehrheim, Heike (Proceedings of the 11th International Symposium on Formal Aspects of Component Software (FACS))
Today, service compositions often need to be assembled or changed on-the-fly, which leaves only little time for quality assurance. Moreover, quality assurance is complicated by service providers only giving information on their services in terms of domain specific concepts with only limited semantic meaning. In this paper, we propose a method to construct service compositions based on pre-verifiedtemplates. Templates, given as workflow descriptions, are typed over a (domain-independent) template ontology defining concepts and predicates. Templates are proven correct using an abstract semantics, leaving the specific meaning of ontology concepts open, however, only up to given ontology rules. Construction of service compositions amounts to instantiation of templates with domain-specific services.Correctness of an instantiation can then simply be checked by verifying that the domain ontology(a) adheres to the rules of the template ontology, and (b) fulfills the constraints of the employed template.

Untersuchung transitiver Eigenschaften der Technik "Programs from Proofs" - Korth, Philipp

Towards Systematic Configuration for Architecture Validation - Becker, Matthias; Becker, Steffen; Besova, Galina; Walther, Sven; Wehrheim, Heike (Proceedings of the 40th Euromicro Conference on Software Engineering and Advanced Applications (Work in Progress Session))

Template-based Generation of Semantic Services - Mohr, Felix; Walther, Sven (Proceedings of the 14th International Conference on Software Reuse (ICSR))
There are many technologies for the automation of processesthat deal with services; examples are service discovery and composition.Automation of these processes requires that the services are described semantically. However, semantically described services are currently not oronly rarely available, which limits the applicability of discovery and composition approaches. The systematic support for creating new semanticservices usable by automated technologies is an open problem.We tackle this problem with a template based approach: Domain independent templates are instantiated with domain specific services andboolean expressions. The obtained services have semantic descriptionswhose correctness directly follows from the correctness of the template.Besides the theory, we present experimental results for a service repository in which 85% of the services were generated automatically.

Programs from Proofs -- Approach and Applications - Wonisch, Daniel; Schremmer, Alexander; Wehrheim, Heike (Proceedings of the Software Engineering Conference (SE))
Proof-carrying code approaches aim at safe execution of untrusted code by having the code producer attach a safety proof to the code which the code consumer only has to validate. Depending on the type of safety property, proofs can however become quite large and their validation - though faster than their construction - still time consuming. In this paper we introduce a new concept for safe execution of untrusted code. It keeps the idea of putting the time consuming part of proving on the side of the code producer, however, attaches no proofs to code anymore but instead uses the proof to transform the program into an equivalent but more eﬃciently veriﬁable program. Code consumers thus still do proving themselves, however, on a computationally inexpensive level only. Experimental results show that the proof eﬀort can be reduced by several orders of magnitude, both with respect to time and space.

The behavioural semantics of Event-B refinement - Schneider, Steve; Treharne, Helen; Wehrheim, Heike (Formal Asp. Comput.)

Two approaches for proving linearizability of multiset - Tofan, Bogdan; Travkin, Oleg; Schellhorn, Gerhard; Wehrheim, Heike (Sci. Comput. Program.)

A Sound and Complete Proof Technique for Linearizability of Concurrent Data Structures - Schellhorn, Gerhard; Derrick, John; Wehrheim, Heike (ACM Trans. Comput. Log.)

Quiescent Consistency: Defining and Verifying Relaxed Linearizability - Derrick, John; Dongol, Brijesh; Schellhorn, Gerhard; Tofan, Bogdan; Travkin, Oleg; Wehrheim, Heike (FM 2014: Formal Methods - 19th International Symposium, Singapore, May 12-16, 2014. Proceedings)

Handling TSO in Mechanized Linearizability Proofs - Travkin, Oleg; Wehrheim, Heike (Hardware and Software: Verification and Testing - 10th International Haifa Verification Conference, HVC 2014, Haifa, Israel, November 18-20, 2014. Proceedings)

Timed Automata Verification via IC3 with Zones - Isenberg, Tobias; Wehrheim, Heike (Formal Methods and Software Engineering - 16th International Conference on Formal Engineering Methods, ICFEM 2014, Luxembourg, Luxembourg, November 3-5, 2014. Proceedings)

Managing LTL Properties in Event-B Refinement - A. Schneider, Steve; Treharne, Helen; Wehrheim, Heike; M. Williams, David (Integrated Formal Methods - 11th International Conference, IFM 2014, Bertinoro, Italy, September 9-11, 2014, Proceedings)

Managing LTL properties in Event-B refinement - Schneider, Steve; Treharne, Helen; Wehrheim, Heike; M. Williams, David (CoRR)

Proof-Carrying Hardware via IC3 - Isenberg, Tobias; Wehrheim, Heike (CoRR)

Certification for Configurable Program Analysis - Jakobs, Marie-Christine; Wehrheim, Heike (Proceedings of the 21st International Symposium on Model Checking of Software (SPIN))
Configurable program analysis (CPA) is a generic concept for the formalization of different software analysis techniques in a single framework. With the tool CPAchecker, this framework allows for an easy configuration and subsequent automatic execution of analysis procedures ranging from data-flow analysis to model checking. The focus of the tool CPAchecker is thus on analysis. In this paper, we study configurability from the point of view of software certification. Certification aims at providing (via a prior analysis) a certificate of correctness for a program which is (a) tamper-proof and (b) more efficient to check for validity than a full analysis. Here, we will show how, given an analysis instance of a CPA, to construct a corresponding sound certification instance, thereby arriving at configurable program certification. We report on experiments with certification based on different analysis techniques, and in particular explain which characteristics of an underlying analysis allow us to design an efficient (in the above (b) sense) certification procedure.

Integrating Software and Hardware Verification - Jakobs, Marie-Christine; Platzner, Marco; Wiersema, Tobias; Wehrheim, Heike (Proceedings of the 11th International Conference on Integrated Formal Methods (iFM))
Verification of hardware and software usually proceeds separately, software analysis relying on the correctness of processors executing instructions. This assumption is valid as long as the software runs on standard CPUs that have been extensively validated and are in wide use. However, for processors exploiting custom instruction set extensions to meet performance and energy constraints the validation might be less extensive, challenging the correctness assumption.In this paper we present an approach for integrating software analyses with hardware verification, specifically targeting custom instruction set extensions. We propose three different techniques for deriving the properties to be proven for the hardware implementation of a custom instruction in order to support software analyses. The techniques are designed to explore the trade-off between generality and efficiency and span from proving functional equivalence over checking the rules of a particular analysis domain to verifying actual pre and post conditions resulting from program analysis. We demonstrate and compare the three techniques on example programs with custom instructions, using stateof-the-art software and hardware verification techniques.

Grammar-based model transformations - Besova, Galina; Steenke, Dominik; Wehrheim, Heike (Proceedings 3rd Workshop on Model Driven Approaches in System Development (MDASD))
Model transformation is a key concept in modeldrivensoftware engineering. The definition of model transformationsis usually based on meta-models describing the abstractsyntax of languages. While meta-models are thereby able to abstractfrom superfluous details of concrete syntax, they often loosestructural information inherent in languages, like information onmodel elements always occurring together in particular shapes.As a consequence, model transformations cannot naturally re-uselanguage structures, thus leading to unnecessary complexity intheir development as well as analysis.In this paper, we propose a new approach to model transformationdevelopment which allows to simplify and improve thequality of the developed transformations via the exploitation ofthe languages’ structures. The approach is based on context-freegrammars and transformations defined by pairing productions ofsource and target grammars. We show that such transformationsexhibit three important characteristics: they are sound, completeand deterministic.

Generierung von Eigenschaftsprüfern in einem Hardware/Software-Co-Verifikationsverfahren - Pauck, Felix

Bounded Model Checking of Graph Transformation Systems via SMT Solving - Isenberg, Tobias; Steenken, Dominik; Wehrheim, Heike (Formal Techniques for Distributed Systems - Joint IFIP WG 6.1 International Conference, {FMOODS/FORTE} 2013, Held as Part of the 8th International Federated Conference on Distributed Computing Techniques, DisCoTec 2013, Florence, Italy, June 3-5, 2013. Proceedings)

SPIN as a Linearizability Checker under Weak Memory Models - Travkin, Oleg; Mütze, Annika; Wehrheim, Heike (Hardware and Software: Verification and Testing - 9th International Haifa Verification Conference, HVC 2013, Haifa, Israel, November 5-7, 2013, Proceedings)

A High-Level Semantics for Program Execution under Total Store Order Memory - Dongol, Brijesh; Travkin, Oleg; Derrick, John; Wehrheim, Heike (Theoretical Aspects of Computing - ICTAC 2013 - 10th International Colloquium, Shanghai, China, September 4-6, 2013. Proceedings)

Temporal Reconfiguration Plans for Self-Adaptive Systems - Ziegert, Steffen; Wehrheim, Heike (Software Engineering 2013: Fachtagung des GI-Fachbereichs Softwaretechnik, 26. Februar - 2. März 2013 in Aachen)

Zero Overhead Runtime Monitoring - Wonisch, Daniel; Schremmer, Alexander; Wehrheim, Heike (Proceedings of the 11th International Conference on Software Engineering and Formal Methods (SEFM))
Runtime monitoring aims at ensuring program safety by monitoring the program's behaviour during execution and taking appropriate action before a program violates some property.Runtime monitoring is in particular important when an exhaustive formal verification fails. While the approach allows for a safe execution of programs, it may impose a significant runtime overhead.In this paper, we propose a novel technique combining verification and monitoring which incurs no overhead during runtime at all. The technique proceeds by using the inconclusive result of a verification run as the basis for transforming the program into one where all potential points of failure are replaced by HALT statements. The new program is safe by construction, behaviourally equivalent to the original program (except for unsafe behaviour),and has the same performance characteristics.

Three-Valued Abstraction and Heuristic-Guided Refinement for Verifying Concurrent Systems - Timm, Nils
Software systems are playing an increasing role in our everyday life, and as the amount of software applications grows, so does their complexity and the relevance of their computations. Software components can be found in many systems that are charged with safety-critical tasks, such as control systems for aviation or power plants. Hence, software verification techniques that are capable of proving the absence of critical errors are becoming more and more important in the field software engineering. A well-established approach to software verification is model checking. Applying this technique involves an exhaustive exploration of a state space model corresponding to the system under consideration. The major challenge in model checking is the so-called state explosion problem: The state space of a software system grows exponentially with its size. Thus, the straightforward modelling of real-life systems practically impossible. A common approach to this problem is the application of abstraction techniques, which reduce the original state space by mapping it on a significantly smaller abstract one. Abstraction inherently involves a loss of information, and thus, the resulting abstract model may be too imprecise for a definite result in verification. Therefore, abstraction is typically combined with abstraction refinement: An initially very coarse abstract model is iteratively refined, i.e. enriched with new details about the original system, until a level of abstraction is reached that is precise enough for a definite outcome. Abstraction refinement-based model checking is fully automatable and it is considered as one of the most promising approaches to the state explosion problem in verification. However, it is still faced with a number of challenges. There exist several types of abstraction techniques and not every type is equally well-suited for all kinds of systems and verification tasks. Moreover, the selection of adequate refinement steps is nontrivial and typically the most crucial part of the overall approach: Unfavourable refinement decisions can compromise the state space-reducing effect of abstraction, and as a consequence, can easily lead to the failure of verification. It is, however, hard to predict which refinement steps will eventually be expedient for verification – and which not.

Programs from Proofs – A PCC Alternative - Wonisch, Daniel; Schremmer, Alexander; Wehrheim, Heike (Proceedings of the 25th International Conference on Computer Aided Verification (CAV))
Proof-carrying code approaches aim at safe execution of untrusted code by having the code producer attach a safety proof to the code which the code consumer only has to validate. Depending on the type of safety property, proofs can however become quite large and their validation - though faster than their construction - still time consuming. In this paper we introduce a new concept for safe execution of untrusted code. It keeps the idea of putting the time consuming part of proving on the side of the code producer, however, attaches no proofs to code anymore but instead uses the proof to transform the program into an equivalent but more eﬃciently veriﬁable program. Code consumers thus still do proving themselves, however, on a computationally inexpensive level only. Experimental results show that the proof eﬀort can be reduced by several orders of magnitude, both with respect to time and space.

Knowledge-Based Verification of Service Compositions - An SMT approach - Walther, Sven; Wehrheim, Heike (Proceedings of the 18th IEEE International Conference on Engineering of Complex Computer Systems (ICECCS))
In the Semantic (Web) Services area, services are considered black boxes with a semantic description of their interfaces as to allow for precise service selection and conﬁguration. The semantic description is usually grounded on domain-speciﬁc concepts as modeled in ontologies. This accounts for types used in service signatures, but also predicates occurring in preconditions and effects of services. Ontologies, in particular those enhanced with rules, capture the knowledge of domain experts on properties of and relations between domain concepts. In this paper, we present a veriﬁcation technique for service compositions which makes use of this domain knowledge. We consider a service composition to be an assembly of services of which we just know signatures, preconditions, and effects. We aim at proving that a composition satisﬁes a (user-deﬁned) requirement, speciﬁed in terms of guaranteed preconditions and required postconditions. As an underlying veriﬁcation engine we use an SMT solver. To take advantage of the domain knowledge (and often, to enable veriﬁcation at all), the knowledge is fed into the solver in the form of sorts, uninterpreted functions and in particular assertions as to enhance the solver’s reasoning capabilities. Thereby, we allow for deductions within a domain previously unknown to the solver. We exemplify our technique on a case study from the area of water network optimization software.

Proving Linearizability of Multiset with Local Proof Obligations - Travkin, Oleg; Wehrheim, Heike; Schellhorn, Gerhard (ECEASST)

Model evolution and refinement - Ruhroth, Thomas; Wehrheim, Heike (Sci. Comput. Program.)

How to Prove Algorithms Linearisable - Schellhorn, Gerhard; Wehrheim, Heike; Derrick, John (Computer Aided Verification - 24th International Conference, CAV 2012, Berkeley, CA, USA, July 7-13, 2012 Proceedings)

Predicate Analysis with Block-Abstraction Memoization - Wonisch, Daniel; Wehrheim, Heike (Proceedings of the 14th International Conference on Formal Engineering Methods (ICFEM))
Predicate abstraction is an established technique for reducing the size of the state space during verification. In this paper, we extend predication abstraction with block-abstraction memoization (BAM), which exploits the fact that blocks are often executed several times in a program. The verification can thus benefit from caching the values of previous block analyses and reusing them upon next entry into a block. In addition to function bodies, BAM also performs well for nested loops. To further increase effectiveness, block memoization has been integrated with lazy abstraction adopting a lazy strategy for cache refinement. Together, this achieves significant performance increases: our tool (an implementation within the configurable program analysis framework CPAchecker) has won the Competition on Software Verification 2012 in the category “Overall”.

Heuristic-Guided Abstraction Refinement for Concurrent Systems - Timm, Nils; Wehrheim, Heike; Czech, Mike (Proceedings of the 14th International Conference on Formal Engineering Methods (ICFEM))
Predicate abstraction is an established technique in software verification. It inherently includes an abstraction refinement loop successively adding predicates until the right level of abstraction is found. For concurrent systems, predicate abstraction can be combined with spotlight abstraction, further reducing the state space by abstracting away certain processes. Refinement then has to decide whether to add a new predicate or a new process. Selecting the right predicates and processes is a crucial task: The positive effect of abstraction may be compromised by unfavourable refinement decisions. Here we present a heuristic approach to abstraction refinement. The basis for a decision is a set of refinement candidates, derived by multiple counterexample-generation. Candidates are evaluated with respect to their influence on other components in the system. Experimental results show that our technique can significantly speed up verification as compared to a naive abstraction refinement.

Block Abstraction Memoization for CPAchecker - Wonisch, Daniel (Proceedings of the 18th International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS))
Block Abstraction Memoization (ABM) is a technique in software model checking that exploits the modularity of programs during verification by caching. To this end, ABM records the results of block analyses and reuses them if possible when revisiting the same block again. In this paper we present an implementation of ABM into the predicate-analysis component of the software-verification framework CPAchecker. With our participation at the Competition on Software Verification we aim at providing evidence that ABM can not only substantially increase the efficiency of predicate analysis but also enables verification of a wider range of programs.

Weaving-based configuration and modular transformation of multi-layer systems - Besova, Galina; Walther, Sven; Wehrheim, Heike; Becker, Steffen (Proceedings of the 15th International Conference on Model Driven Engineering Languages & Systems (MoDELS))
In model-driven development of multi-layer systems (e.g. application, platform and infrastructure), each layer is usually described by separate models. When generating analysis models or code, these separate models rst of all need to be linked. Hence, existing model transformations for single layers cannot be simply re-used. In this paper, we present a modular approach to the transformation of multi-layer systems. It employs model weaving to dene the interconnections between models of dierent layers. The weaving models themselves are subject to model transformations: The result of transforming a weaving model constitutes a conguration for the models obtained by transforming single layers, thereby allowing for a re-use of existing model transformations. We exemplify our approach by the generation of analysis models for component-based software.

Bounded Retransmission in Event-B{\(\parallel\)}CSP: a Case Study - Schneider, Steve; Treharne, Helen; Wehrheim, Heike (Electr. Notes Theor. Comput. Sci.)

Mechanically verified proof obligations for linearizability - Derrick, John; Schellhorn, Gerhard; Wehrheim, Heike (ACM Trans. Program. Lang. Syst.)

ReL: A Generic Refactoring Language for Specification and Execution - Ruhroth, Thomas; Wehrheim, Heike; Ziegert, Steffen (37th EUROMICRO Conference on Software Engineering and Advanced Applications, SEAA 2011, Oulu, Finland, August 30 - September 2, 2011)

Verifying Linearisability with Potential Linearisation Points - Derrick, John; Schellhorn, Gerhard; Wehrheim, Heike (FM 2011: Formal Methods - 17th International Symposium on Formal Methods, Limerick, Ireland, June 20-24, 2011. Proceedings)

Sound and Complete Abstract Graph Transformation - Steenken, Dominik; Wehrheim, Heike; Wonisch, Daniel (Formal Methods, Foundations and Applications - 14th Brazilian Symposium, SBMF 2011, São Paulo, Brazil, September 26-30, 2011, Revised Selected Papers)

A CSP Account of Event-B Refinement - Schneider, Steve; Treharne, Helen; Wehrheim, Heike (Proceedings 15th International Refinement Workshop, Refine@FM 2011, Limerick, Ireland, 20th June 2011.)

Selected papers on Integrated Formal Methods (iFM09) - Leuschel, Michael; Wehrheim, Heike (Science of Computer Programming)

Reputation-based Reliability Prediction of Service Compositions - Besova, Galina; Wehrheim, Heike; Wagner, Annika (Electronic Notes in Theoretical Computer Science)
Today, the concept of service oriented architectures provides a way of building integrated solutions out of existing services. To this end, services from different providers are composed using advanced orchestration and choreography techniques. However, while this principle allows for greater flexibility at a smaller cost, the use of third party services also includes a risk: Deployed services might not work as claimed by their providers. In this paper, we propose a technique for analyzing the expected reliability of service compositions based on ratings given by (previous) service users. Every service thereby comes with a reputation, and the analysis computes an overall reliability of a service composition from the reputations of its constituent services. The proposed model-driven approach proceeds by translating statechart models of service compositions into input for a probabilistic model checker (PRISM) using state-of-the-art model transformations techniques. The approach has been implemented as an Eclipse plug-in and is fully compliant with UML.

Function Specification Inference Using Craig Interpolation - Schremmer, Alexander

A CSP Approach to Control in Event-B - Schneider, Steve; Treharne, Helen; Wehrheim, Heike (Integrated Formal Methods - 8th International Conference, IFM 2010, Nancy, France, October 11-14, 2010. Proceedings)

{SLAB:} A Certifying Model Checker for Infinite-State Concurrent Systems - Dräger, Klaus; Kupriyanov, Andrey; Finkbeiner, Bernd; Wehrheim, Heike (Tools and Algorithms for the Construction and Analysis of Systems, 16th International Conference, TACAS 2010, Held as Part of the Joint European Conferences on Theory and Practice of Software, ETAPS 2010, Paphos, Cyprus, March 20-28, 2010. Proceedings)

Towards A Shape Analysis for Graph Transformation Systems - Steenken, Dominik; Wehrheim, Heike; Wonisch, Daniel (CoRR)

Model transformations across views - Derrick, John; Wehrheim, Heike (Sci. Comput. Program.)

Model-Driven Development with Mechatronic UML - Schäfer, Wilhelm; Wehrheim, Heike (Graph Transformations and Model-Driven Engineering - Essays Dedicated to Manfred Nagl on the Occasion of his 65th Birthday)

On Symmetries and Spotlights - Verifying Parameterised Systems - Timm, Nils; Wehrheim, Heike (Formal Methods and Software Engineering - 12th International Conference on Formal Engineering Methods, ICFEM 2010, Shanghai, China, November 17-19, 2010. Proceedings)

Showing Full Semantics Preservation in Model Transformation - A Comparison of Techniques - Hülsbusch, Mathias; König, Barbara; Rensink, Arend; Semenyak, Maria; Soltenborn, Christian; Wehrheim, Heike (Integrated Formal Methods - 8th International Conference, IFM 2010, Nancy, France, October 11-14, 2010. Proceedings)

Compositional CSP Traces Refinement Checking - Wehrheim, Heike; Wonisch, Daniel (Electr. Notes Theor. Comput. Sci.)

Static Class Elements for Object-Z - Ruhroth, Thomas; Wehrheim, Heike (Electr. Notes Theor. Comput. Sci.)

Measure, Diagnose, Refactor: A Formal Quality Cycle for Software Models - Ruhroth, Thomas; Voigt, Hendrik; Wehrheim, Heike (35th Euromicro Conference on Software Engineering and Advanced Applications, SEAA 2009, Patras, Greece, August 27-29, 2009, Proceedings)

Integrated Formal Methods, 7th International Conference, IFM 2009, Düsseldorf, Germany, February 16-19, 2009. Proceedings

Refinement in the Presence of Unknowns - Wehrheim, Heike (Electr. Notes Theor. Comput. Sci.)

Alloy as a Refactoring Checker? - Estler, H.{-}Christian; Wehrheim, Heike (Electr. Notes Theor. Comput. Sci.)

Integrating a formal method into a software engineering process with UML and Java - Möller, Michael; Olderog, Ernst-Rüdiger; Rasch, Holger; Wehrheim, Heike (Formal Asp. Comput.)

Slicing Abstractions - Brückner, Ingo; Dräger, Klaus; Finkbeiner, Bernd; Wehrheim, Heike (Fundam. Inform.)

From UML Activities to TAAL - Towards Behaviour-Preserving Model Transformations - Engels, Gregor; Kleppe, Anneke; Rensink, Arend; Semenyak, Maria; Soltenborn, Christian; Wehrheim, Heike (Model Driven Architecture - Foundations and Applications, 4th European Conference, ECMDA-FA 2008, Berlin, Germany, June 9-13, 2008. Proceedings)

Mechanizing a Correctness Proof for a Lock-Free Concurrent Stack - Derrick, John; Schellhorn, Gerhard; Wehrheim, Heike (Formal Methods for Open Object-Based Distributed Systems, 10th IFIP WG 6.1 International Conference, FMOODS 2008, Oslo, Norway, June 4-6, 2008, Proceedings)

Decomposition for Compositional Verification - Metzler, Björn; Wehrheim, Heike; Wonisch, Daniel (Formal Methods and Software Engineering, 10th International Conference on Formal Engineering Methods, ICFEM 2008, Kitakyushu-City, Japan, October 27-31, 2008. Proceedings)

Bounded Model Checking for Partial Kripke Structures - Wehrheim, Heike (Theoretical Aspects of Computing - ICTAC 2008, 5th International Colloquium, Istanbul, Turkey, September 1-3, 2008. Proceedings)

On using data abstractions for model checking refinements - Derrick, John; Wehrheim, Heike (Acta Inf.)

Extending a Component Specification Language with Time - Metzler, Björn; Wehrheim, Heike (Electr. Notes Theor. Comput. Sci.)

Modelchecking Correctness of Refactorings - Some Experiments - Estler, H.{-}Christian; Ruhroth, Thomas; Wehrheim, Heike (Electr. Notes Theor. Comput. Sci.)

Assuring Consistency of Business Process Models and Web Services Using Visual Contracts - Engels, Gregor; Güldali, Baris; Soltenborn, Christian; Wehrheim, Heike (Applications of Graph Transformations with Industrial Relevance, Third International Symposium, AGTIVE 2007, Kassel, Germany, October 10-12, 2007, Revised Selected and Invited Papers)

Analysis of UML Activities Using Dynamic Meta Modeling - Engels, Gregor; Soltenborn, Christian; Wehrheim, Heike (Formal Methods for Open Object-Based Distributed Systems, 9th IFIP WG 6.1 International Conference, FMOODS 2007, Paphos, Cyprus, June 6-8, 2007, Proceedings)

Refactoring Object-Oriented Specifications with Data and Processes - Ruhroth, Thomas; Wehrheim, Heike (Formal Methods for Open Object-Based Distributed Systems, 9th IFIP WG 6.1 International Conference, FMOODS 2007, Paphos, Cyprus, June 6-8, 2007, Proceedings)

The Challenges of Building Advanced Mechatronic Systems - Schäfer, Wilhelm; Wehrheim, Heike (International Conference on Software Engineering, ISCE 2007, Workshop on the Future of Software Engineering, FOSE 2007, May 23-25, 2007, Minneapolis, MN, USA)

Proving Linearizability Via Non-atomic Refinement - Derrick, John; Schellhorn, Gerhard; Wehrheim, Heike (Integrated Formal Methods, 6th International Conference, IFM 2007, Oxford, UK, July 2-5, 2007, Proceedings)

Optimizing Slicing of Formal Specifications by Deductive Verification - Brückner, Ingo; Metzler, Björn; Wehrheim, Heike (Nord. J. Comput.)

Model Transformations Incorporating Multiple Views - Derrick, John; Wehrheim, Heike (Algebraic Methodology and Software Technology, 11th International Conference, AMAST 2006, Kuressaare, Estonia, July 5-8, 2006, Proceedings)

Incremental Slicing - Wehrheim, Heike (Formal Methods and Software Engineering, 8th International Conference on Formal Engineering Methods, ICFEM 2006, Macao, China, November 1-3, 2006, Proceedings)

Formal Methods for Open Object-Based Distributed Systems, 8th IFIP WG 6.1 International Conference, FMOODS 2006, Bologna, Italy, June 14-16, 2006, Proceedings

Specification and (property) inheritance in CSP-OZ - Olderog, Ernst-Rüdiger; Wehrheim, Heike (Sci. Comput. Program.)

Slicing techniques for verification re-use - Wehrheim, Heike (Theor. Comput. Sci.)

Checking the Validity of Scenarios in UML Models - Rasch, Holger; Wehrheim, Heike (Formal Methods for Open Object-Based Distributed Systems, 7th IFIP WG 6.1 International Conference, FMOODS 2005, Athens, Greece, June 15-17, 2005, Proceedings)

Slicing an Integrated Formal Method for Verification - Brückner, Ingo; Wehrheim, Heike (Formal Methods and Software Engineering, 7th International Conference on Formal Engineering Methods, ICFEM 2005, Manchester, UK, November 1-4, 2005, Proceedings)

Non-atomic Refinement in Z and CSP - Derrick, John; Wehrheim, Heike (ZB 2005: Formal Specification and Development in Z and B, 4th International Conference of B and Z Users, Guildford, UK, April 13-15, 2005, Proceedings)

Slicing Object-Z Specifications for Verification - Brückner, Ingo; Wehrheim, Heike (ZB 2005: Formal Specification and Development in Z and B, 4th International Conference of B and Z Users, Guildford, UK, April 13-15, 2005, Proceedings)

Refinement and Consistency in Component Models with Multiple Views - Wehrheim, Heike (Architecting Systems with Trustworthy Components, International Seminar, Dagstuhl Castle, Germany, December 12-17, 2004. Revised Selected Papers)

Linking CSP-OZ with UML and Java: A Case Study - Möller, Michael; Olderog, Ernst-Rüdiger; Rasch, Holger; Wehrheim, Heike (Integrated Formal Methods, 4th International Conference, IFM 2004, Canterbury, UK, April 4-7, 2004, Proceedings)

Refinement and Consistency in Multiview Models - Wehrheim, Heike (Language Engineering for Model-Driven Software Development, 29. February - 5. March 2004)

Behavioral Subtyping Relations for Active Objects - Wehrheim, Heike (Formal Methods in System Design)

Preserving Properties Under Change - Wehrheim, Heike (Formal Methods for Components and Objects, Second International Symposium, FMCO 2003, Leiden, The Netherlands, November 4-7, 2003, Revised Lectures)

Inheritance of Temporal Logic Properties - Wehrheim, Heike (Formal Methods for Open Object-Based Distributed Systems, 6th IFIP WG 6.1 International Conference, FMOODS 2003, Paris, France, November 19.21, 2003, Proceedings)