Conclusions

• We have a lot of gripes about SPIN
• We have a lot of infrastructure / framework for formally verifiying other parts of Fluke
  • scripts, tools, hacks
  • code for base abstractions, testing interface
• We would rather be skiing today
• Verification is feasible and fruitful
• Is SPIN the right tool?