Formal methods reality check: Industrial usage

Based on a systematic survey and analysis of the use of formal methods in the development of a dozen industrial applications, we summarize the methods being used, characterize the styles of industrial usage, and provide recommendations for evolutionary enhancements to the technology base of formal methods. The industrial applications ranged from reverse engineering to system certification; code scale ranges from 1 KLOC to 10 KLOC's. Applications included a software infrastructure for oscilloscopes; a shutdown system for a nuclear generating station; a train protection system; an airline collision avoidance system; an engine monitoring system for shipboard engines; attitude control of satellites; security properties of both a smartcard device and a network; arithmetic units; transaction processing; a real-time database for a medical instrument; and a restructuring program for COBOL.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

The use of formal methods is often recommended to guarantee the provision of necessary services and to assess the correctness of critical properties, such as functional safety, cybersecurity, and reliability, in medical and health care devices. In the past, several formal and rigorous methods have been proposed and consequently applied for trustworthy development of medical software and systems. In this paper, we perform a systematic literature review on the available state of the art in this domain. We collect the relevant literature on the use of formal methods for modeling, design, development, verification, and validation of software‐intensive medical systems. We apply standard systematic literature review techniques and run several queries in well‐known repositories to obtain information that can be useful for people who are either already working in this field or planning to start. Our study covers both quantitative and qualitative aspects of the subject.

This volume contains the proceedings of the First International Workshop of Formal Techniques for Safety-Critical Systems (FTSCS 2012), held in Kyoto on November 12, 2012, as a satellite event of the ICFEM conference. The aim of this workshop is to bring together researchers and engineers interested in the application of (semi-)formal methods to improve the quality of safety-critical computer systems. FTSCS is particularly interested in industrial applications of formal methods. Topics include: - the use of formal methods for safety-critical and QoS-critical systems, including avionics, automotive, and medical systems; - methods, techniques and tools to support automated analysis, certification, debugging, etc.; - analysis methods that address the limitations of formal methods in industry; - formal analysis support for modeling languages used in industry, such as AADL, Ptolemy, SysML, SCADE, Modelica, etc.; and - code generation from validated models. The workshop received 25 submissions; 21 of these were regular papers and 4 were tool/work-in-progress/position papers. Each submission was reviewed by three referees; based on the reviews and extensive discussions, the program committee selected nine regular papers, which are included in this volume. Our program also included an invited talk by Ralf Huuck.

The authors report on the use of formal methods for the development of parallel operating systems for two experimental declarative systems over a five-year period. A common specification approach has evolved as part of the development of these two very different systems: one being for a parallel graph reduction machine and written in a functional language enhanced with state-based objects, the other was written in C/sup ++/. A brief overview of each system is given before concentrating on the use of formal methods. A description is given of how both a technique for formally specifying sequential systems (VDM) and a technique for specifying concurrent systems (temporal logic) have been used together. In both cases, the issue of verification is addressed. >

Formal methods tools have been shown to be effective at finding defects in and verifying the correctness of safety-critical systems such as avionics systems. The recent release of DO-178C and the accompanying Formal Methods Supplement DO-333 will make it easier for developers of software for commercial aircraft to obtain certification credit for the use of formal methods. However, most developers of avionics systems are unfamiliar with formal methods, and most developers of formal methods tools are unfamiliar with certification requirements and processes. This article provides a brief overview of the certification process for commercial aircraft, as well as some of the issues related to the use of formal methods tools in this context.

In Flagship, we have attempted to perform a very gradual introduction of the use of formal methods without proclaiming it to be the answer to all of our problems. Since this is not a formal methods project, our primary concern has been to gain some benefit from the use of formal methods, rather than to research their use in an industrial environment.

SOFTWARE METHODOLOGY FOR A LARGE-SCALE INTEGRATED CAD/CAM SYSTEM

The title of this paper provides an answer to the question posed by Larry King in his panel paper titled "Do formal methods really belong in the toolbox of the practicing engineer?" Yes, formal methods do indeed belong to the toolbox of the practicing engineer. The capabilities of today's computers are truly impressive and as a result have opened door to the design and development of increasingly ambitious systems. An almost unavoidable by-product of these systems is the growing consequences associated with their failure. Another attribute shared by most of these systems is that their complexity is of an unprecedented nature. Thus, these systems live in the cross section (or shall I say cross-hairs) of high consequence and high complexity. For these reasons, attaining and developing the ability to construct highly reliable software is be coming a significant concern. Furthermore, software manufacturers as well as consumers are getting more and more fed-up with missed deadlines, bugs crashing and freezing hardware, and in the worst case, causing havoc to organizations, as bugs/incompleteness lead to allowing trojan horses for hackers through viruses and attacks. This is leading to attempts to replace ad hoc techniques in system design by more systematic methods. What is the role that formal methods, as a field of study, can play in addressing these issues? If by formal methods, one is exclusively referring to formal verification methods for software, such tools will probably not be part of a practicing engineer's tool in the near future. King's note reflects the prevailing confusion about formal methods, what can be achieved using them, and what cannot be achieved using them, and their overall role in system design and development.

The use of formal methods for real-time system provides an analysis and a validation of the accomplished specifications, however, the complexity encumbers their interest in the industrial developments. This causes a gap between the real needs of the practical users (industrial) and the scientific community. The design based on components emerges as a design technique to reduce the complexity and the validation process of software development. Moreover, in the real-time system design where the object oriented design has demonstrate its validity, the use of predefined components can strongly improve and reduce the design, implementation and validation phases. In this paper we present an tool to design real-time control systems from a set of specific components. The tool provides a graphical interface to define component levels. Each component has associated a High Level Time Petri Net and an Ada code which are composed to build a prototype and a design specification.KeywordsGraphical InterfaceCoordination MechanismPeriodic TaskSporadic TaskInput PlaceThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Formal methods for software development receive much attention in research centres, but are rarely used in industry for the development of (large) software systems. One of the reasons is that little is known about the integration of formal methods in the software process, and the exact role of formal methods in the software life-cycle is still unclear. In this paper, a detailed examination is made of the application of, and the benefits resulting from, a generally applicable formal method (VDM) in a standard model for software development (DoD-STD-2167A). Currently, there is no general agreement on how formal methods should be used, but in order to analyse the use of formal methods in the software process, a clear view of such use is essential. Therefore, we show what is meant by ‘using a formal method’. The different activities of DoD-STD-2167A are analysed with regard to their suitability for applying VDM and the benefits that may result from applying VDM for that activity. Based on this analysis, an overall view on the usage of formal methods in the software process is formulated.

Microprocessors increasingly control and monitor our most critical systems, including automobiles, airliners, medical systems, transportation grids, and defense systems. The relentless march of semiconductor process technology has given engineers exponentially increasing transistor budgets at constant recurring cost. This has encouraged increased functional integration onto a single die, as well as increased architectural sophistication of the functional units themselves. Additionally, design cycle times are decreasing, thus putting increased schedule pressure on engineers. Not surprisingly, this environment has led to a number of uncaught design flaws. Traditional simulation-based design verification has not kept up with the scale or pace of modern microprocessor system design. Formal verification methods offer the promise of improved bug-finding capability, as well as the ability to establish functional correctness of a detailed design relative to a high-level specification. However, widespread use of formal methods has had to await breakthroughs in automated reasoning, integration with engineering design languages and processes, scalability, and usability. This book presents several breakthrough design and verification techniques that allow these powerful formal methods to be employed in the real world of high-assurance microprocessor system design.

Recently, formal methods have been used in large industrial organisations (including AWS, Facebook/Meta, and Microsoft) and have proved to be an effective part of a software engineering process finding important bugs. Perhaps because of that, practitioners are interested in using them more often. Nevertheless, formal methods are far less applied than expected, particularly for safety-critical systems where they are strongly recommended and have the most significant potential. We hypothesise that formal methods still seem not applicable enough or ready for their intended use in such areas. In critical software engineering, what do we mean when we speak of a formal method? And what does it mean for such a method to be applicable both from a scientific and practical viewpoint? Based on what the literature tells about the first question, with this manifesto, we identify key challenges and lay out a set of guiding principles that, when followed by a formal method, give rise to its mature applicability in a given scope. Rather than exercising criticism of past developments, this manifesto strives to foster increased use of formal methods in any appropriate context to the maximum benefit.

The main current trend in applied formal methods can be characterized by the term “lightweight”. Historically, formal methods have been viewed as pure alternatives to traditional development methodologies, demanding a revolutionary change in industry to adopt them. With a pragmatic, lightweight approach, the use of formal methods is complementing and improving existing development practices in a company in an evolutionary way, demonstrating more clearly the cost-effectiveness of formal methods. This paper presents our view on lightweight formal methods as a strategy for successful formal methods technology transfer to industry.KeywordsFormal MethodGraphical NotationMetro SystemTechnology Transfer ProcessSoftware Life CycleThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

This paper summarises our experience in teaching Formal Methods to Computer Science and Software Engineers students from various universities around the world, including the University of Madeira in Portugal, the Pontificia Universidad Javeriana and the University of The Andes in Colombia, Carnegie Mellon University (CMU) in the USA, and Innopolis University (INNO) in Russia. We report challenges we have faced during the past 10 to 15 years when teaching formal methods using the Event B formalism, and describe how we have evolved the structure of our courses to respond to those challenges. We strive to help students to build skills on Formal Methods that they can employ later on in their future IT jobs in software Industry. Our goal is to promote the wide use of Formal Methods by software Industry. We consider that this goal cannot be achieved without first universities transferring to Industry students with a strong background in Formal Methods and related formal tools. Formal Methods are key to software development because they are based on Discrete Mathematics which can be used to properly reason about properties that the software one develops should have. We have conducted two surveys among our students, the first one at CMU and the second one at INNO, that we use here to document and justify our decisions in terms of the course structure. The first survey is about the use of Event B as main mathematical formalism, and the second one is about the organisation of teams of students within the classroom to work on software projects that use Event B as main mathematical formalism. Our hope is that our work can be reused by other Faculty to make their own decisions on course structure and content in the teaching of their Formal Methods courses.

Formal methods have traditionally been used for specification and development of software. However there are potential benefits for the testing stage as well. The panel session associated with this paper explores the usefulness or otherwise of formal methods in various contexts for improving software testing. A number of different possibilities for the use of formal methods are explored and questions raised. The contributors are all members of the UK FORTEST Network on formal methods and testing. Although the authors generally believe that formal methods are useful in aiding the testing process, this paper is intended to provoke discussion. Dissenters are encouraged to put their views to the panel or individually to the authors.