Hardware and software systems will inevitably grow in scale and functionality. Because of this increase in complexity, the likelihood of subtle errors is much greater. Moreover, some of these errors may cause catastrophic loss of money, time, or even human life. A major goal of software engineering is to enable developers to construct systems that operate reliably despite this complexity. One way of achieving this goal is by using formal methods, which are mathematically based languages, techniques, and tools for specifying and verifying such systems. Use of formal methods does not a priori guarantee correctness. However, they can greatly increase our understanding of a system by revealing inconsistencies, ambiguities, and incompleteness that might otherwise go undetected. The first part of this report assesses the state of the art in specification and verification. For verification, we highlight advances in model checking and theorem proving. In the three sections on specification, model checking, and theorem proving, we explain what we mean by the general technique and briefly describe some successful case studies and well-known tools. The second part of this report outlines future directions in fundamental concepts, new methods and tools, integration of methods, and education and technology transfer. We close with summary remarks and pointers to resources for more information.

/pdf/formal-methods-state-of-the-art-and-future-directions-10ye4ieh6c.pdf

Formal methods: state of the art and future directions

Formal methods used in developing computer systems (i.e. mathematically based techniques for describing system properties) are defined, and their role is delineated. Formal specification languages, which provide the formal method's mathematical basis, are examined. Certain pragmatic concerns about formal methods and their users, uses, and characteristics are discussed. Six well-known or commonly used formal methods are illustrated by simple examples. They are Z, VDM, Larch, temporal logic, CSP, and transition axioms. >

A specifier's introduction to formal methods

Formal methods use mathematical models for analysis and verification at any part of the program life-cycle. We describe the state of the art in the industrial use of formal methods, concentrating on their increasing use at the earlier stages of specification and design. We do this by reporting on a new survey of industrial use, comparing the situation in 2009 with the most significant surveys carried out over the last 20 years. We describe some of the highlights of our survey by presenting a series of industrial projects, and we draw some observations from these surveys and records of experience. Based on this, we discuss the issues surrounding the industrial adoption of formal methods. Finally, we look to the future and describe the development of a Verified Software Repository, part of the worldwide Verified Software Initiative. We introduce the initial projects being used to populate the repository, and describe the challenges they address.

/pdf/formal-methods-practice-and-experience-2ooioh81ba.pdf

Formal methods: Practice and experience

The B Book

We present PROB, an animation and model checking tool for the B method PROB's animation facilities allow users to gain confidence in their specifications, and unlike the animator provided by the B-Toolkit, the user does not have to guess the right values for the operation arguments or choice variables PROB contains a model checker and a constraint-based checker, both of which can be used to detect various errors in B specifications We present our first experiences in using PROB on several case studies, highlighting that PROB enables users to uncover errors that are not easily discovered by existing tools

ProB: A model checker for B

The Soil and Water Assessment Tool (SWAT) model is a robust watershed modeling tool. It typically uses the ArcSWAT interface to create its inputs. ArcSWAT is public domain software which works in the licensed ArcGIS environment. The aim of this paper was to develop an open source user interface for the SWAT model. The interface, QSWAT, is written in the Python programming language and uses various functionalities of the open source geographic information system, QGIS. The current interface performs similar functions to ArcSWAT, but with additional enhanced features such as merging small subbasins and static and dynamic visualization of outputs. The interface is demonstrated through a case study in the Gumera watershed in the Lake Tana basin of Ethiopia, where it showed a successful performance. QSWAT will be a valuable tool for the SWAT scientific community, with improved availability and functionality compared with other options for creating SWAT models. Open source software called QSWAT was developed on the QGIS platform.The software creates input data and executes the SWAT model.It can provide static and dynamic visualization of outputs.A case study utilizing the software demonstrated a very good performance.The tool is beneficial to users in developing countries.

Introducing a new open source GIS user interface for the SWAT model

The RAISE Development Method

This paper presents the RAISE1 software development method, its associated specification language, and the tools supporting it. The RAISE method enables the stepwise development of both sequential and concurrent software from abstract specification through design to implementation. All stages of RAISE software development are expressed in the wide-spectrum RAISE specification language. The RAISE tools form an integrated tool environment supporting both language and method.

The paper surveys RAISE and furthermore, more detailed presentations of major RAISE results are provided. The subjects of these are (a) an example of the use of the RAISE method and language, and (b) a presentation of the mathematical semantics of the RAISE specification language.

The RAISE language, methods and tools

This paper describes how the communication protocol of Mondex electronic purses can be specified and verified against desired security properties. The specification is developed by stepwise refinement using the RAISE formal specification language, RSL, and the proofs are made by translation to PVS and SAL. The work is part of a year-long project contributing to the international grand challenge in verified software engineering.

Specification, proof, and model checking of the Mondex electronic purse using RAISE

The reliability of software is an increasingly important demand, especially for safety critical systems. RAISE is a mathematically based method which has been shown to be useful in the development of many kinds of software systems. However, RAISE has no particular features for specifying real-time requirements, which often occur in safety critical systems. Adding timing features to RAISE makes a new specification language, Timed RAISE Specification Language (TRSL), and gives it the power of specifying real-time applications. We then have to find a theoretical foundation for TRSL. In this paper, an operational semantics of TRSL is first introduced. Then we define a pre-order and test equivalence relation for TRSL. Some proof rules for TRSL are listed, and their soundness corresponding to our operational model is also explained.

/pdf/an-operational-semantics-for-timed-raise-4cifgrjf1c.pdf

Chris George

Papers

Introducing a new open source GIS user interface for the SWAT model

The RAISE Development Method

The RAISE language, methods and tools

Specification, proof, and model checking of the Mondex electronic purse using RAISE

An Operational Semantics for Timed RAISE