Welcome to the second installment of IJBDCN. This issue contains three research papers and a comprehensive survey article on mobile ad hoc networks. We would like to publish a couple of survey or tutorial articles per year as we believe this to be of value to our readers. Many research papers are necessarily focused and do not allow for a " panoramic " view of a particular subject. This is the gap that well-written survey or tutorial papers can fill. We are also planning a guest-edited special issue for the last quarter of this year and welcome your suggestions for future special issues of the journal. This second issue starts with a paper entitled " An Approach to Solving the Surviv-able Capacitated Network Design Problem " where Sridhar and Park studied the problem of selecting links of a network to construct primary and secondary routes for transfer of commodity traffic between nodes of the network. Their technique allows the design of survivable and cost-effective networks. In the second paper, " Query Processing Strategies for Location-Dependent Information Services " , Jayaputera and Taniar propose a new approach to generate a query result for location-dependent information services (LDIS). They argue that choosing a square as the scope of a query and dividing it into four equal regions, where a user is a center point of the scope, results in a faster searching time to find targets queried and brings a bigger chance to get rare targets. In addition, by avoiding resubmitting the same queries when the query results missed, the approach reduced bandwidth use at both the server and client sides. The third paper, " Addressing SPAM E-Mail Using Hashcash " by Curran and Honan tackles a problem experienced by most of us. The authors present the Hashcash proof-of-work approach and investigate the feasibility of implementing a solution based on that mechanism along with what they called a " cocktail " of antispam measures designed to keep junk mail under control. Finally , in the last paper, entitled " MANET: Applications, Issues, and Challenges for the Future " , Dhar presents an informative survey of mobile ad hoc networks, describing the main characteristics of those networks and how they are being used, and discussing the most pressing issues and challenges associated with these temporary wireless networks. We hope that you enjoy this and the upcoming issues of IJBDCN. Our goal is to …

International Journal of Business Data Communications and Networking

Invited Talk.- The Embedded Systems Design Challenge.- Interactive Verification.- The Mondex Challenge: Machine Checked Proofs for an Electronic Purse.- Interactive Verification of Medical Guidelines.- Certifying Airport Security Regulations Using the Focal Environment.- Proving Safety Properties of an Aircraft Landing Protocol Using I/O Automata and the PVS Theorem Prover: A Case Study.- Invited Talk.- Validating the Microsoft Hypervisor.- Formal Modelling of Systems.- Interface Input/Output Automata.- Properties of Behavioural Model Merging.- Automatic Translation from Circus to Java.- Quantitative Refinement and Model Checking for the Analysis of Probabilistic Systems.- Real Time.- Modeling and Validating Distributed Embedded Real-Time Systems with VDM++.- Towards Modularized Verification of Distributed Time-Triggered Systems.- Industrial Experience.- A Story About Formal Methods Adoption by a Railway Signaling Manufacturer.- Partially Introducing Formal Methods into Object-Oriented Development: Case Studies Using a Metrics-Driven Approach.- Specification Refinement.- Compositional Class Refinement in Object-Z.- A Proposal for Records in Event-B.- Pointfree Factorization of Operation Refinement.- A Formal Template Language Enabling Metaproof.- Progrmming Languages.- Dynamic Frames: Support for Framing, Dependencies and Sharing Without Restrictions.- Type-Safe Two-Level Data Transformation.- Algebra.- Feature Algebra.- Education.- Using Domain-Independent Problems for Introducing Formal Methods.- Formal Modelling of Systems.- Compositional Binding in Network Domains.- Formal Modeling of Communication Protocols by Graph Transformation.- Feature Specification and Static Analysis for Interaction Resolution.- A Fully General Operational Semantics for UML 2.0 Sequence Diagrams with Potential and Mandatory Choice.- Formal Aspects of Java.- Towards Automatic Exception Safety Verification.- Enforcer - Efficient Failure Injection.- Automated Boundary Test Generation from JML Specifications.- Formal Reasoning About Non-atomic Java Card Methods in Dynamic Logic.- Programming Languages.- Formal Verification of a C Compiler Front-End.- A Memory Model Sensitive Checker for C#.- Changing Programs Correctly: Refactoring with Specifications.- Mechanical Verification of Recursive Procedures Manipulating Pointers Using Separation Logic.- Model Checking.- Model-Based Variable and Transition Orderings for Efficient Symbolic Model Checking.- Exact and Approximate Strategies for Symmetry Reduction in Model Checking.- Monitoring Distributed Controllers: When an Efficient LTL Algorithm on Sequences Is Needed to Model-Check Traces.- PSL Model Checking and Run-Time Verification Via Testers.- Industry Day: Abstracts of Invited Talks.- Formal Methods for Security: Lightweight Plug-In or New Engineering Discipline.- Formal Methods in the Security Business: Exotic Flowers Thriving in an Expanding Niche.- Connector-Based Software Development: Deriving Secure Protocols.- Model-Based Security Engineering for Real.- Cost Effective Software Engineering for Security.- Formal Methods and Cryptography.- Verified Software Grand Challenge.

FM 2006 : Formal Methods : 14th International Symposium on Formal Methods Hamilton, Canada, August 21-27, 2006 : proceedings

We present a formal operational semantics for Stateflow, the graphical Statecharts-like language of the Matlab/Simulink tool suite that is widely used in model-based development of embedded systems. Stateflow has many tricky features but our operational treatment yields a surprisingly simple semantics for the subset that is generally recommended for industrial applications. We have validated our semantics by developing an interpreter that allows us to compare its behavior against the Matlab simulator. We have used the semantics as a foundation for developing prototype tools for formal analysis of Stateflow designs.

An operational semantics for stateflow

On June 1, 2009, Air France Flight 447 from Rio de Janeiro to Paris crashed into the Atlantic Ocean, killing all 216 passengers and 12 crew members. Prior to the disappearance of the A330 aircraft, the automatic reporting system sent messages indicating disagreement in the airspeed readings, which led investigators to believe that the pilot probe sensors did not “accurately” measure airspeed and the autopilot may have automatically disengaged. Like the above probes, many systems are increasingly being used in safety-critical domains, such as medicine, transportation systems, chemical plants, etc. There is hence a dire need to ensure the accuracy of such systems as a system bug, or error, may endanger human life or lead to a significant financial loss. In order to ensure error-free systems, the system design process is usually accompanied by a rigorous system analysis to check if the designed system would exhibit the desired behavior. The core of system analysis is based on mathematics and the fundamental idea is to create a mathematical model of the system and then use logical or mathematical reasoning to verify that the desired properties hold for this model. Traditionally, system analysis is done by paper-and-pencil proof methods. However, considering the complexity of present age systems, such kind of analysis is notoriously difficult, if not impossible, and is quite error prone due to the human error factor. Moreover, it is quite often the case that mathematicians forget to pen down all the assumptions that are required for the validity of their analysis. This fact may also result in designing erroneous systems. With the advent of computers, many computer based software tools based on the principle of testing or simulation have been introduced for system verification. Due to the reliable and efficient bookkeeping characteristic of computers, large systems can be analyzed and thus one of the limitations of paper-and-pencil proof methods can be overcome. However, the main problem with such kind of analysis is its completeness as the system is checked only for a subset of possible inputs since exhaustive testing is not possible for any system with a significant number of inputs due to the exponential growth of the test patterns. In Dijkstra’s words “Program testing can be a very effective way to show the presence of bugs, but it is hopelessly inadequate for showing their absence.” Moreover, testing or simulation cannot be used to precisely verify properties about continuous systems due to the usage of computer arithmetic, like floating-point or fixed-point representations of real numbers. The above mentioned inaccuracy limitations of commonly used system analysis techniques can be held responsible for many unfortunate incidents that happened due to an erroneous system deployed in a safety-critical domain For example, the Therac-25 software bug and the Intel Pentium’s floating-point division unit error).

Formal Verification Methods

Programmable logic controllers (PLCs) are heavily used in industrial control systems, because of their high capacity of simultaneous input/output processing capabilities. Characteristically, PLC systems are used in mission critical systems, and PLC software needs to conform real-time constraints in order to work properly. Since PLC programming requires mastering low-level instructions or assembly like languages, an important step in PLC software production is modelling using a formal approach like Petri nets or automata. Afterward, PLC software is produced semiautomatically from the model and refined iteratively. Model checking, on the other hand, is a well-known software verification approach, where typically a set of timed properties are verified by exploring the transition system produced from the software model at hand. Naturally, model checking is applied in a variety of ways to verify the correctness of PLC-based software. In this paper, we provide a broad view about the difficulties that are encountered during the model checking process applied at the verification phase of PLC software production. We classify the approaches from two different perspectives: first, the model checking approach/tool used in the verification process, and second, the software model/source code and its transformation to model checker's specification language. In a nutshell, we have mainly examined SPIN, SMV, and UPPAAL-based model checking activities and model construction using Instruction Lists (and alike), Function Block Diagrams, and Petri nets/automata-based model construction activities. As a result of our studies, we provide a comparison among the studies in the literature regarding various aspects like their application areas, performance considerations, and model checking processes. Our survey can be used to provide guidance for the scholars and practitioners planning to integrate model checking to PLC-based software verification activities.

An overview of model checking practices on verification of PLC software

This paper reports the story of the introduction of formal methods in the development process of a railway signaling manufacturer. The first difficulty for a company is due to the many different formal methods proposals around; we show how this difficulty has been addressed and how the choice of a reference formal specification notation and of the related tools has been driven by many external factors related to the specific application domain, to the company policies, to european regulations. Cooperation with University has been fundamental in this process, which is now at the stage in which internal acceptance of the chosen formalisms and tools is established.

/pdf/a-story-about-formal-methods-adoption-by-a-railway-signaling-52hv6f2337.pdf

A story about formal methods adoption by a railway signaling manufacturer

The Metrô Rio case study

Notwithstanding the large amount of attempts to formally verify them, railway interlocking systems still represent a challenging problem for automatic verification Interlocking systems controlling sufficiently large stations, due to their inherent complexity related to the high number of variables involved, are not readily amenable to automatic verification, typically incurring in state space explosion problems The study described in this paper aims at evaluating and experimenting the industrial application of verification by model checking for this class of systems The choices made at the beginning of the study, also on the basis of specific requirements from the industrial partner, are presented, together with the advancement status of the project and the plans for its completion

Validation of Railway Interlocking Systems by Formal Verification, A Case Study

Introduction of formal model-based practices into the development process of a product in a company implicates changes in the verification and validation activities. A testing process that focuses only on code is not comprehensive in a framework where the building blocks of development are models, and industry is currently heading toward more effective strategies to cope with this new reality. This paper reports the experience of a railway signalling manufacturer in changing its unit level verification process from code-based testing to a two-step approach comprising model-based testing and abstract interpretation. Empirical results on different projects, on which the overall development process was progressively tuned, show that the change paid back in terms of verification cost reduction about 70%, bug detection, and correction capability.

Adoption of Model-Based Testing and Abstract Interpretation by a Railway Signalling Manufacturer

This paper reports on the Simulink/Stateflow based development of the on-board equipment of the Metro Rio Automatic Train Protection system. Particular focus is given to the strategies followed to address formal weaknesses and certification issues of the adopted tool-suite. On the development side, constraints on the Simulink/Stateflow semantics have been introduced and design practices have been adopted to gradually achieve a formal model of the system. On the verification side, a two-phase approach based on model based testing and abstract interpretation has been followed to enforce functional correctness and runtime error freedom.

Quantitative results are presented to assess the overall strategy: the effort required by the design activities is balanced by the effectiveness of the verification tasks enabled by model based development and automatic code generation.

Matteo Tempestini

Papers

A story about formal methods adoption by a railway signaling manufacturer

The Metrô Rio case study

Validation of Railway Interlocking Systems by Formal Verification, A Case Study

Adoption of Model-Based Testing and Abstract Interpretation by a Railway Signalling Manufacturer

The metrô rio ATP case study