Abstract
We consider a verification problem of arbiter mechanism. We use the model checking function of SCADE, where a system and its environment are modeled by a synchronous language and specifications are given by properties. As an example, we consider an auto-cruise system consisting of multiple ECU's and investigate what kind of property is verifiable.