Why Executable Models?

(1) if you have complex systems to develop ⇒ use models

ESAS 1.5EOR/LOR diagram, aspect annotated (model) diagram, UML formalization → does it work?

(2) if you have complex models ⇒ make them executable

nominal sim, tli-sim (error by chance, show in model diagram,UML) → shows how much people implicitly "assume" in informal models

(3) if you have executable models ⇒ verify them

tli (systematic error detection), but more errors ? → JPF scriptless (show lasJettison, stage1Abort ambiguity)
too many "impossible" defects → assumption based model checking