What causes a system to satisfy a specification?.

Hana Chockler*, Joseph Y. Halpern, Orna Kupferman

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

53 Scopus citations


Even when a system is proven to be correct with respect to a specification, there is still a question of how complete the specification is, and whether it really covers all the behaviors of the system. Coverage metrics attempt to check which parts of a system are actually relevant for the verification process to succeed. Recent work on coverage in model checking suggests several coverage metrics and algorithms for finding parts of the system that are not covered by the specification. The work has already proven to be effective in practice, detecting design errors that escape early verification efforts in industrial settings. In this article, we relate a formal definition of causality given by Halpern and Pearl to coverage. We show that it gives significant insight into unresolved issues regarding the definition of coverage and leads to potentially useful extensions of coverage. In particular, we introduce the notion of responsibility, which assigns to components of a system a quantitative measure of their relevance to the satisfaction of the specification.

Original languageEnglish
Article number20
Pages (from-to)20:1-20:26
Number of pages26
JournalACM Transactions on Computational Logic
Issue number3
StatePublished - 1 Jun 2008


  • Causality
  • Coverage metrics
  • Model checking
  • Responsibility


Dive into the research topics of 'What causes a system to satisfy a specification?.'. Together they form a unique fingerprint.

Cite this