A systematic literature review of the use of formal methods in medical software systems

Microprocessors increasingly control and monitor our most critical systems, including automobiles, airliners, medical systems, transportation grids, and defense systems. The relentless march of semiconductor process technology has given engineers exponentially increasing transistor budgets at constant recurring cost. This has encouraged increased functional integration onto a single die, as well as increased architectural sophistication of the functional units themselves. Additionally, design cycle times are decreasing, thus putting increased schedule pressure on engineers. Not surprisingly, this environment has led to a number of uncaught design flaws. Traditional simulation-based design verification has not kept up with the scale or pace of modern microprocessor system design. Formal verification methods offer the promise of improved bug-finding capability, as well as the ability to establish functional correctness of a detailed design relative to a high-level specification. However, widespread use of formal methods has had to await breakthroughs in automated reasoning, integration with engineering design languages and processes, scalability, and usability. This book presents several breakthrough design and verification techniques that allow these powerful formal methods to be employed in the real world of high-assurance microprocessor system design.

This volume contains the proceedings of the First International Workshop of Formal Techniques for Safety-Critical Systems (FTSCS 2012), held in Kyoto on November 12, 2012, as a satellite event of the ICFEM conference. The aim of this workshop is to bring together researchers and engineers interested in the application of (semi-)formal methods to improve the quality of safety-critical computer systems. FTSCS is particularly interested in industrial applications of formal methods. Topics include: - the use of formal methods for safety-critical and QoS-critical systems, including avionics, automotive, and medical systems; - methods, techniques and tools to support automated analysis, certification, debugging, etc.; - analysis methods that address the limitations of formal methods in industry; - formal analysis support for modeling languages used in industry, such as AADL, Ptolemy, SysML, SCADE, Modelica, etc.; and - code generation from validated models. The workshop received 25 submissions; 21 of these were regular papers and 4 were tool/work-in-progress/position papers. Each submission was reviewed by three referees; based on the reviews and extensive discussions, the program committee selected nine regular papers, which are included in this volume. Our program also included an invited talk by Ralf Huuck.

The title of this paper provides an answer to the question posed by Larry King in his panel paper titled "Do formal methods really belong in the toolbox of the practicing engineer?" Yes, formal methods do indeed belong to the toolbox of the practicing engineer. The capabilities of today's computers are truly impressive and as a result have opened door to the design and development of increasingly ambitious systems. An almost unavoidable by-product of these systems is the growing consequences associated with their failure. Another attribute shared by most of these systems is that their complexity is of an unprecedented nature. Thus, these systems live in the cross section (or shall I say cross-hairs) of high consequence and high complexity. For these reasons, attaining and developing the ability to construct highly reliable software is be coming a significant concern. Furthermore, software manufacturers as well as consumers are getting more and more fed-up with missed deadlines, bugs crashing and freezing hardware, and in the worst case, causing havoc to organizations, as bugs/incompleteness lead to allowing trojan horses for hackers through viruses and attacks. This is leading to attempts to replace ad hoc techniques in system design by more systematic methods. What is the role that formal methods, as a field of study, can play in addressing these issues? If by formal methods, one is exclusively referring to formal verification methods for software, such tools will probably not be part of a practicing engineer's tool in the near future. King's note reflects the prevailing confusion about formal methods, what can be achieved using them, and what cannot be achieved using them, and their overall role in system design and development.

Formal methods for software development receive much attention in research centres, but are rarely used in industry for the development of (large) software systems. One of the reasons is that little is known about the integration of formal methods in the software process, and the exact role of formal methods in the software life-cycle is still unclear. In this paper, a detailed examination is made of the application of, and the benefits resulting from, a generally applicable formal method (VDM) in a standard model for software development (DoD-STD-2167A). Currently, there is no general agreement on how formal methods should be used, but in order to analyse the use of formal methods in the software process, a clear view of such use is essential. Therefore, we show what is meant by ‘using a formal method’. The different activities of DoD-STD-2167A are analysed with regard to their suitability for applying VDM and the benefits that may result from applying VDM for that activity. Based on this analysis, an overall view on the usage of formal methods in the software process is formulated.

Formal methods tools have been shown to be effective at finding defects in and verifying the correctness of safety-critical systems such as avionics systems. The recent release of DO-178C and the accompanying Formal Methods Supplement DO-333 will make it easier for developers of software for commercial aircraft to obtain certification credit for the use of formal methods. However, most developers of avionics systems are unfamiliar with formal methods, and most developers of formal methods tools are unfamiliar with certification requirements and processes. This article provides a brief overview of the certification process for commercial aircraft, as well as some of the issues related to the use of formal methods tools in this context.

A. Joe TurnerThe role of formal methods for program development and verification in computer science curricula will be discussed. The panel members will address the questions1) What should be taught?2) When should it be taught?3) What are the objectives in teaching this material?4) What are the problems in teaching this material at this level?The panel members and an outline of their positions is given below.Susan L. GerhartCertain things are understood to be needed for applying verification technology to actual software. The basic knowledge needed to apply verification methods using current technology to large-scale problems will be discussed, based on actual experience in using the technology in such areas as database systems, operating systems, and communications systems.Eric C. HehnerThe Dijkstra/Gries approach to program development is an important and useful component of the computer science curriculum. Good programmers use this approach informally, and instruction in the formal methods can provide the understanding that will improve average programmers. Although the subject matter is currently taught at the senior/graduate level at Toronto, it should be taught earlier, for example during the second year. Teaching the material earlier does require a different approach, however, and good student preparation in logic would be essential for success.Harlan D. MillsFormal methods and a large structured set of principles for program design and verification should be taught early in the computer science curriculum. Instruction in programming can be improved by teaching a large set of small principles, and teaching by apprenticeship. Students learn easier and faster when they are freshmen than later after they have become hackers.

Background: Children and young people’s (CYP) health outcomes in England are variable and often poor. Health systems throughout high income countries are struggling to adapt to epidemiological transitions, social change, rising demand, and budget cuts. There was a 58% rise in CYP attending EDs between 2007 and 2016, projected to rise 50-60% more by 2030. CYP from the most deprived backgrounds are 60-70% more likely to go to A&E than the least deprived. The majority of ED attendances by CYP are manageable in primary care or integrated models, yet 85% of ED attendances are for minor illnesses, increasing 5% annually. The Children and Young People’s Health Partnership (CYPHP) is a health system strengthening initiative implementing and evaluating a new model of care. Methods: Health system strengthening using the WHO building blocks model included service design by analysis of population need, systematic literature reviews, and extensive patient and public involvement. An evidence-based implementation plan was agreed for a child population of 90,000 in London, and we are evaluating using a cluster randomised control trial (cRCT) design with nested process evaluation and qualitative studies to assess CYP health and wellbeing, healthcare quality, patterns of healthcare use, and cost effectiveness. Results: CYPHP’s comprehensive care includes health promotion and supported self-management, proactive case-finding, biopsychosocial assessment and self-referral via a patient portal, with care delivered by a multidisciplinary team. Services are integrated vertically and horizontally incorporating physical and mental healthcare. Implementation has taken two years longer than anticipated due to technical and cultural challenges of health system strengthening. Early results indicate a reduction of 72 ED contacts per 100 children with asthma, 30 for children with epilepsy, and 15 for children with constipation. We estimate cost savings per 100 asthma patients to be over £15,000, for epilepsy over £6,000, and for constipation over £3,000. Of the first 200 patients, most were from socially deprived areas and 68% were from black and minority ethnic groups. Families report more confidence in managing their child’s condition. Discussion: As a clinical academic partnership, CYPHP combines pragmatic quality improvement and rigorous health services research. CYPHP demonstrates that health system strengthening in high income countries is feasible and effective for implementing and testing new models of care to improve child health. Conclusions: Early results suggest encouraging impact on patterns of healthcare use and potential cost savings. CYPHP’s population health approach provides care for those with greatest health and social need. Lessons learned: Rigorous health services and systems research is feasible in large scale system change in the NHS. Health system strengthening is a new concept in high income countries. It is slow and difficult, but important for effective implementation of new models of care. Fully integrated comprehensive models of care for children may improve health and healthcare outcomes. Limitations: Results are preliminary and reflect early implementation. Suggestions for future research: Rigorously designed health services research for ongoing large-scale health systems changes are an important source of new knowledge. There are few examples of such opportunistic research, representing new avenues for opportunity.

Obesity is increasing among people residing in nursing homes, and resident obesity substantially affects services needed, equipment and facilities provided, and morbidity in this setting. The purpose of this article is to describe the scope and depth of evidence regarding the impact of obesity among nursing home residents in the United States. A systematic literature review was performed in PubMed, EMBASE, CINAHL, and Web of Science databases as well as additional hand-searched documents. Included articles were published from 1997 to March 2017. The characteristics and content of the included articles were systematically reviewed and reported. Twenty-eight studies met inclusion criteria for review. The median study size was 636 residents (interquartile range 40-11,248); 18 (64%) studies were retrospective and 10 (36%) were prospective in nature. Ten (36%) studies examined medical and functional morbidity, 10 (36%) examined health system effects, and 5 (18%) examined the risk of admission to nursing homes. Most studies found that obesity poses serious issues to resident health and the provision of health care, as well as broad health system and nursing challenges in the provision of high-quality nursing home care and services. Although obesity affects about one in four nursing home residents in the United States, relatively limited evidence exists on the complex challenges of obesity for their residents and their care. A continued focus on resident quality of life, health system improvement, and nursing best practices for properly caring for individuals with obesity is needed.

In recent years, the world's health system faces with increasing trend of costs. In this regard, Hospital is one of the environments that consumes a large share of the total expenditure of the health system. Medications are one of the most expensive components in hospitals, which require appropriate measurements to control and reduce costs. The present systematic review was conducted to identify strategies and actions for cost containment in hospital. Using the PRISMA protocol, a systematic review of the texts was performed to identify strategies and actions for reducing drug cost. In this systematic review, the selected keywords were searched in the following databases: web of sciences, Scopus, PubMed, Google Scholar, and Embase. The inclusion criteria included English-language articles, hospital-level studies, and those studies performed on reducing and controlling hospital costs. The exclusion criteria also included the followings: primary health care studies, non-English language studies, health system studies, and studies solely focussed on the cost-effectiveness of a particular drug. The quality of these articles was investigated using the checklist adapted and modified in the present study. A total of 4696 articles were identified from the reviewed databases and 26 articles were identified from some other sources. After removing duplicate studies and reviewing the title, summary, and full text of articles using reference check and supplemental search, 21 articles were finally included. A number of strategies or managerial actions were extracted from the final articles. According to the qualitative results, qualitative meta-synthesis was used and after eliminating duplicate solutions, the data were classified into five groups: procurement, storage, distribution, prescription, and use. According to the increasing cost of medicines, some hospital managers now attempt to reduce hospital costs using drug chain management. Drug cost reduction strategies can be applied for any component of drug chain management such as procurement, storage, distribution, prescription, and use. Also, proper implementation of these strategies and rationalisation of drug use will result in more efficiency of the hospital.

The proper use of formal methods in software development strongly influences the nature and relationships between the various kinds of documentation produced. Rather than being a mass of heterogeneous information produced mainly for immediate use and then discarded, product documentation should be a coherent collection of information of lasting value in the continuing life of the product. In this paper we look first at the nature of product documentation in a mature product developed with the aid of formal methods. Next we consider how different people in a software development organisation interact with product documentation in their work. Finally we examine the problems that face managers of existing products who wish to construct product documentation in the mould described here.

The paper shows the outlines of the SLAM system that allows for an effective use of Formal Methods (FM) in Rapid Application Development (RAD) and other prototyping processes. The SLAM system, includes an expressive object oriented specification language and a development environment that, among other features, is able to generate efficient and readable code in a high level object oriented language (Java, C++, ...). SLAM is able to generate prototypes that can be used to validate the requirements with the user. The additional advantage is that the prototype is not throw-away because most part of the generated code can be directly used and the other part can be optimised with the additional help of assertions automatically included.

Systematic Reviews of the Literature: So What? Why Bother? Who Cares

In Flagship, we have attempted to perform a very gradual introduction of the use of formal methods without proclaiming it to be the answer to all of our problems. Since this is not a formal methods project, our primary concern has been to gain some benefit from the use of formal methods, rather than to research their use in an industrial environment.

The authors report on the use of formal methods for the development of parallel operating systems for two experimental declarative systems over a five-year period. A common specification approach has evolved as part of the development of these two very different systems: one being for a parallel graph reduction machine and written in a functional language enhanced with state-based objects, the other was written in C/sup ++/. A brief overview of each system is given before concentrating on the use of formal methods. A description is given of how both a technique for formally specifying sequential systems (VDM) and a technique for specifying concurrent systems (temporal logic) have been used together. In both cases, the issue of verification is addressed. >

Recently, formal methods have been used in large industrial organisations (including AWS, Facebook/Meta, and Microsoft) and have proved to be an effective part of a software engineering process finding important bugs. Perhaps because of that, practitioners are interested in using them more often. Nevertheless, formal methods are far less applied than expected, particularly for safety-critical systems where they are strongly recommended and have the most significant potential. We hypothesise that formal methods still seem not applicable enough or ready for their intended use in such areas. In critical software engineering, what do we mean when we speak of a formal method? And what does it mean for such a method to be applicable both from a scientific and practical viewpoint? Based on what the literature tells about the first question, with this manifesto, we identify key challenges and lay out a set of guiding principles that, when followed by a formal method, give rise to its mature applicability in a given scope. Rather than exercising criticism of past developments, this manifesto strives to foster increased use of formal methods in any appropriate context to the maximum benefit.