A Formally Verified WCET Estimation Tool

MEMOCODE brings together researchers and practitioners interested in formal methods for system design and development to exchange research results and lessons learned. The conference focuses on the foundations and applications of formal methods in the development of hardware, firmware, middleware, and application software for systems ranging from single embedded devices to highly networked cyber-physical systems and the Internet of Things.

MEMOCODE brings together researchers and practitioners interested in formal methods for system design and development to exchange research results and lessons learned. The conference focuses on the foundations and applications of formal methods in the development of hardware, firmware, middleware, and application software for systems ranging from single embedded devices to highly networked cyber-physical systems and the Internet of Things.

Formal methods for software development receive much attention in research centres, but are rarely used in industry for the development of (large) software systems. One of the reasons is that little is known about the integration of formal methods in the software process, and the exact role of formal methods in the software life-cycle is still unclear. In this paper, a detailed examination is made of the application of, and the benefits resulting from, a generally applicable formal method (VDM) in a standard model for software development (DoD-STD-2167A). Currently, there is no general agreement on how formal methods should be used, but in order to analyse the use of formal methods in the software process, a clear view of such use is essential. Therefore, we show what is meant by ‘using a formal method’. The different activities of DoD-STD-2167A are analysed with regard to their suitability for applying VDM and the benefits that may result from applying VDM for that activity. Based on this analysis, an overall view on the usage of formal methods in the software process is formulated.

Formal methods encompass a wide choice of techniques and tools for the specification, development, analysis, and verification of software and hardware systems. Formal methods are widely applied in industry, in activities ranging from the elicitation of requirements and the early design phases all the way to the deployment, configuration, and runtime monitoring of actual systems. Formal methods allow one to precisely specify the environment in which a system operates, the requirements and properties that the system should satisfy, the models of the system used during the various design steps, and the code embedded in the final implementation, as well as to express conformance relations between these specifications. We present a broad scope of successful applications of formal methods in industry, not limited to the well-known success stories from the safety-critical domain, like railways and other transportation systems, but also covering other areas such as lithography manufacturing and cloud security in e-commerce, to name but a few. We also report testimonies from a number of representatives from industry who, either directly or indirectly, use or have used formal methods in their industrial project endeavours. These persons are spread geographically, including Europe, Asia, North and South America, and the involved projects witness the large coverage of applications of formal methods, not limited to the safety-critical domain. We thus make a case for the importance of formal methods, and in particular of the capacity to abstract and mathematical reasoning that are taught as part of any formal methods course. These are fundamental Computer Science skills that graduates should profit from when working as computer scientists in industry, as confirmed by industry representatives.

necessity of formal methods education has developed from its increasing assimilation into systems development within industry. Organizations responsible for a wide range of applications have found it necessary to find an improved means of intellectual control over their complex system development and that formal methods can meet this need. To this end, the International Survey of Industrial Applications of Formal Methods concluded and recommended: The current educational base in the US is weak in teaching formal methods in the context of software engineering . . . There is a clear need for improved integration of formal methods techniques with other software engineering practices[2]There exists a number of articles in the current literature expressing the belief that the current educational program offered for a computer science degree does not stress the fundamental mathematical and engineering principles that should form the basis of software engineering[3,4,5,6]. theory learned in mathematics and science classes is applied in other engineering classes, but unfortunately has not been applied in software engineering. inability to apply logic in practical circumstances prevents the student from doing the systematic analysis necessary to solve practical problems.For these reasons, it is desirable to include the definition and application of a formal method into the undergraduate curriculum with the goal of increasing the complex problem solving skills of the software engineer. Formal analysis should be introduced early into the undergraduate curriculum to ensure substantial learning, use, and training in formal methods application.

Formal methods should be taught as part of any degree in computing science or software engineering. We believe that discrete mathematics is the foundation upon which software development can be lifted up to the heights of a true engineering discipline. The transfer of formal methods to industry cannot be expected to occur without first transferring, from academia to industry, graduates who are well grounded in suchmathematical techniques. These graduatesmust bring a positive, yet realistic, view on the application of formal methods. Our goal is to produce software engineers who will go out into industry understanding the principles of specification, design and implementation. As these graduates develop their engineering skills, in an industrial setting, they should have the means, and the motivation, to integrate formality and rigour into any environment in which they are found. In this way, the formal methods should start to 'sell themselves'. This paper reports on our first attempt to teach a formal methods course as part of a degree in software engineering. Rather than concentrating on one particular method, we worked on a set of small case studies, using the mathematics in a flexible and intuitive manner, where the students could appreciate the need for formality. Each case study was intended to illustrate, in turn, the need for some fundamental formalism. An unexpected result was that we also identified weaknesses in our understanding of formal methods: students' naive questioning helped us to identify how the methods, and the teaching of these methods, could be improved. In brief, it was not just the students who were learning!

Relying on implementations in verification results in specifications and implementations that do not lend themselves well to reuse. Moreover, conventional verification tells engineers rather little about actual software or design quality ("Trust me, it's good."). We regard ease of formal specification, quality assessment and specification reuse, particularly in the form of declarative specifications, to be decisive factors in furthering the application of formal methods in software development. We aim to provide new, tool-supported techniques combining, and enabling, practical specification formalisms, implementation less model checking of structured specifications and complex measures for specification quality.

The automotive industry makes increasing usage of Simulink-based software development. Typically, automotive Simulink designs are analyzed using non-formal test methods, which do not guarantee the absence of errors. In contrast, formal verification techniques aim at providing formal guarantees or counterexamples that the analyzed designs fulfill their requirements for all possible inputs and parameters. Therefore, the automotive safety standard ISO 26262 recommends the usage of formal methods in safety-critical software development.

Formal methods are crucial in program specification and verification. Instead of building cases to test functionalities, formal methods specify functionalities as properties and mathematically prove them. Nevertheless, the applicability of formal methods is limited in most development processes due to the requirement of mathematical knowledge for developers. To promote the application of formal methods, we formulate formalism-driven development (FDD), which is an iterative and incremental development process that guides developers to adopt proper formal methods throughout the whole development lifespan. In FDD, system graphs, a variant of transition systems optimized for usability, are designed to model system structures and behaviors with representative properties. System graphs are built iteratively and incrementally via refinement. Properties of system graphs are specified in propositional and temporal logics and verified by model-checking techniques with interpretation over transition system. In addition, skeleton programs are generated based on system graphs and expose implementable interfaces for executing external algorithms and emitting observable effects. Furthermore, we present Seniz, a framework that practicalizes and automates FDD. In this paper, we explicate the concepts and taxonomy of FDD and discuss its practice.

Nanometer-scale structures suitable for computing have been investigated by several research groups in recent years. A common feature of these structures is their dynamic evolution through cascaded local interactions embedded on a discrete grid. Finding configurations capable of conducting computations is a task that often requires tedious experiments in laboratories. Formal methods—though used extensively for the specification and verification of software and hardware computing systems—are virtually unexplored with respect to computational structures at atomic scales. This paper presents a systematic approach toward the application of formal methods in this context, using techniques like abstraction, model-checking, and symbolic representations of states to explore and discover computational structures. The proposed techniques are applied to a system of CO molecules on a grid of Copper atoms, resulting in the design of a complete library of combinational logic gates based on this molecular system. The techniques are also applied on (more general) systems of cellular automata that employ an asynchronous mode of timing. The use of formal methods may narrow the gap between Physical Chemistry and Computer Science, allowing the description of interactions of nanometer scale systems on a level of abstraction suitable to devise computing devices.

Since it is too difficult to develop a feasible tool to execute the stepwise refinement automatically, the applications of formal methods have mainly been limited to safety critical domains. With the development of the theory and practice of modeling by the integration of UML and formal methods, formal methods usually play a role of representing the behavior models. Thanks to the information provided by the architecture models, such as the concrete data structure, limit conditions, invariants and so on, the automatic refinement tools become possible. This paper presents an automatic operation refinement approach of formal methods, which bases on the theorem of automatic theorem proving (ATP). Plenty of rules and patterns have been already defined or can be defined by the users, which relate to the concrete data structure and context. Driven by these rules and patterns, and even the users' manual direction, the refinement results can be finally obtained in the form of an operation sequence.

Formal methods (FM) are mathematically-based techniques that provide a rigorous basis for software development: the application of FMs makes it possible to achieve provable correctness and reliability in the various steps of system design and implementation. This article is a tutorial presentation of formal methods and description techniques that address modeling and analysis of distributed systems and concurrent processes in telecommunications and protocol engineering. The aim of the article is to introduce to non-practitioners the main formal methods for communication protocols. For each method, a synthetic description of its textual or graphical syntax is provided. Also, the modeling capabilities and the basic communication features are pointed out by the application of the method to a common case study, a simple retransmission protocol. The tutorial description is completed by examples of recent applications of FMs to the specification and analysis of transmission and signaling protocols in industrial and research projects, which describe the methods' application domain and offer selected references for further readings.

The title of this paper provides an answer to the question posed by Larry King in his panel paper titled "Do formal methods really belong in the toolbox of the practicing engineer?" Yes, formal methods do indeed belong to the toolbox of the practicing engineer. The capabilities of today's computers are truly impressive and as a result have opened door to the design and development of increasingly ambitious systems. An almost unavoidable by-product of these systems is the growing consequences associated with their failure. Another attribute shared by most of these systems is that their complexity is of an unprecedented nature. Thus, these systems live in the cross section (or shall I say cross-hairs) of high consequence and high complexity. For these reasons, attaining and developing the ability to construct highly reliable software is be coming a significant concern. Furthermore, software manufacturers as well as consumers are getting more and more fed-up with missed deadlines, bugs crashing and freezing hardware, and in the worst case, causing havoc to organizations, as bugs/incompleteness lead to allowing trojan horses for hackers through viruses and attacks. This is leading to attempts to replace ad hoc techniques in system design by more systematic methods. What is the role that formal methods, as a field of study, can play in addressing these issues? If by formal methods, one is exclusively referring to formal verification methods for software, such tools will probably not be part of a practicing engineer's tool in the near future. King's note reflects the prevailing confusion about formal methods, what can be achieved using them, and what cannot be achieved using them, and their overall role in system design and development.

An FMS is a typical real-time concurrent system composed of a number of computer-controlled machine tools, automated material handling and storage systems that operate as an integrated system under the control of host computer(s). The growing demand for higher performance and flexibility in these systems and the interlocking factors of concurrency, deadline-driven activities, and real-time decision making pose a significant challenge to FMS design, especially in terms of control and scheduling. A formal engineering approach that helps handle the complexity and dynamics of FMS modeling, design and analysis is needed. A real-time architectural specification (RAS) model and its application in the modeling of flexible manufacturing system (FMS) are presented. RAS combines mature operational and descriptive formal methods, in particular time Petri nets (TPN) and real-time computational tree logic (RTCTL), to form an integrated system model for architectural specification and analysis of real-time concurrent systems such as FMS. The contribution of RAS is twofold: First, it provides a formal system to systematically maintain a strong correlation between (real-time) requirements and design and to verify the conformance of the design to the requirements, which helps enhance traceability and thus to help us to achieve high assurance in design. Second, it offers better scalability in modeling and analysis, which provides an effective way to deal with complexity in the application of formal methods. These two features together make RAS a suitable model for the design of FMS.

We present a case study on the application of formal methods in the railway domain. The case study is part of the FormaSig project, which aims to support the development of EULYNX — a European standard defining generic interfaces for railway equipment — using formal methods. We translate the semi-formal SysML models created within EULYNX to formal mCRL2 models. By adopting a model-centric approach in which a formal model is used both for analyzing the quality of the EULYNX specification and for automated compliance testing, a high degree of traceability is achieved. The target of our case study is the EULYNX Point subsystem interface. We present a detailed catalog of the safety requirements, and provide counterexamples that show that some of them do not hold without specific fairness assumptions. We also use the mCRL2 model to generate both random and guided tests, which we apply to a third-party software simulator. We share metrics on the coverage and execution time of the tests, which show that guided testing outperforms random testing. The test results indicate several discrepancies between the model and the simulator. One of these discrepancies is caused by a fault in the simulator, the others are caused by false positives, i.e. an over-approximation of fail verdicts by our test setup.