Program Specifications and Their Proofs

SNCF is responsible for putting into service all interlocking systems on the French railway network. It is therefore essential, especially for computerized SIL4 systems that, SNCF has its own approval process to ensure that new interlocking systems are safe in the context of the French network. Checks and tests before putting safety facilities into service as well as the results of these tests are essential, time consuming and may show great variations between each other. Economic constraints and the increasing complexity associated with the development of computerized tools tend to limit the capacity of the classic approval process (manual or automatic). A reduction of the validation cover rate could result in practice. The method and the tool presented in this paper makes it possible to formally validate new computerized systems or evolutions of existing French interlocking systems with real-time functional interpreted Petri nets. The aim of our project is to provide SNCF with an effective method for the formal validation of French interlocking systems. A formal proof method by assertion, which is applicable to industrial automation equipment such as interlocking systems, and which covers equally the specification and its real software implementation, is presented in this paper. With the proposed method and its associated tools we completely verify that the system follows all safety properties at all times and does not show superfluous conditions: it replaces all the indoor checks (not the outdoor checks). It can easily be included in the existing SNCF testing procedures. The immediate advantages expected are a significant reduction of testing time and of the related costs, an increase of the test coverage rate, an answer to the new demand of railway infrastructure maintenance engineering to modify and validate computerized interlocking systems. Formal methods mastery by infrastructure engineers is surely a key to prove that more safety is not necessarily more expensive.

This white paper argues that formal methods need to be better rooted in higher education curricula for computer science and software engineering programmes of study. To this end, it advocates improved teaching of formal methods; systematic highlighting of formal methods within existing, ‘classical’ computer science courses; and the inclusion of a compulsory formal methods course in computer science and software engineering curricula. These recommendations are based on the observations that formal methods are an essential and cost-effective means to increase software quality; however computer science and software engineering programmes typically fail to provide adequate training in formal methods; and thus there is a lack of computer science graduates who are qualified to apply formal methods in industry. This white paper is the result of a collective effort by authors and participants of the 1st International Workshop on Formal Methods – Fun for Everybody which was held in Bergen, Norway, 2–3 December 2019. As such, it represents insights based on learning and teaching computer science and software engineering (with or without formal methods) at various universities across Europe.

PROOF CHECKING THE RSA PUBLIC KEY ENCRYPTION ALGORITHM

Software is becoming increasingly involved in safety-critical systems. Such systems are ideal fields of application of formal methods. A rigorous development accompanied by formal proofs is a guarantee of the correctness of the development. We summarize our experience of using the B formal method in the development of safety-critical railway signalling applications. Our applications range in size from 2000 lines to 22000 lines. They are specified, refined and implemented in B. Issues (technical and non technical) related to the utilization of B are discussed and solutions presented.KeywordsFormal MethodPreliminary DesignProof ObligationControl Flow GraphInformal SpecificationThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

This paper is concerned with the application of theorem proving techniques to the formal proof of hardware. More precisely, we aim at providing a methodology for applying provers like Nqthm or Acl2 to the formal verification of parameterized replicated circuits. Nqthm (the Boyer–Moore theorem prover) and its successor Acl2 are induction-based systems; their formalisms are respectively a simplified Lisp-like language and Common Lisp. Hence, the circuits we consider must be given a purely functional representation. Moreover, our work puts the emphasis on the integration of formal proof techniques in CAD (Computer Aided Design) environments which support Hardware Description Languages in which replication is expressed by iteration. Therefore, we associate with the iterative statement of the VHDL language a functional semantics that guarantees an easy translation from VHDL to Nqthm/Acl2 while simplifying the subsequent inductive proofs. The approach has been successfully applied to one-dimensional as well as two-dimensional structures.

Formal methods encompass a wide choice of techniques and tools for the specification, development, analysis, and verification of software and hardware systems. Formal methods are widely applied in industry, in activities ranging from the elicitation of requirements and the early design phases all the way to the deployment, configuration, and runtime monitoring of actual systems. Formal methods allow one to precisely specify the environment in which a system operates, the requirements and properties that the system should satisfy, the models of the system used during the various design steps, and the code embedded in the final implementation, as well as to express conformance relations between these specifications. We present a broad scope of successful applications of formal methods in industry, not limited to the well-known success stories from the safety-critical domain, like railways and other transportation systems, but also covering other areas such as lithography manufacturing and cloud security in e-commerce, to name but a few. We also report testimonies from a number of representatives from industry who, either directly or indirectly, use or have used formal methods in their industrial project endeavours. These persons are spread geographically, including Europe, Asia, North and South America, and the involved projects witness the large coverage of applications of formal methods, not limited to the safety-critical domain. We thus make a case for the importance of formal methods, and in particular of the capacity to abstract and mathematical reasoning that are taught as part of any formal methods course. These are fundamental Computer Science skills that graduates should profit from when working as computer scientists in industry, as confirmed by industry representatives.

Fault-tolerant clock synchronization is the foundation of synchronous architectures such as the Time-Triggered Architecture (TTA) for dependable cyber-physical systems. Clocks are typically local counters that are increased with a given rate according to real time, and clock synchronization algorithms ensure that any two clocks in the system read about the same value at about the same point in real time. This is achieved by a clock synchronization algorithm that changes the current values of the clocks, the clocks' rate, or both. This paper presents a diagnosis algorithm and a clock-rate correction algorithm as layered services on top of the TTEthernet clock synchronization algorithm, which itself is a clock-state correction algorithm. We analyze the algorithms' properties and explore and understand their behavior using a bounded model checker for infinite data types. We use our formal framework for both simulation and formal proof. To the best knowledge of the authors this has been the first time that formal methods, should they be theorem provers or model checkers, have been applied to the problem of rate-correction for fault-tolerant clock synchronization. Furthermore, the formal development process itself demonstrates how easily existing models can be utilized in the development of new algorithms and their formal verification.

Given recent high-profile successes in formal verification of security-related properties (e.g., for seL4), and the rising popularity of applying formal methods to cryptographic libraries and security protocols like TLS, we revisit the meaning of security-related proofs about software. We re-examine old issues, and identify new questions that have escaped scrutiny in the formal methods literature. We consider what value proofs about software systems deliver to end-users (e.g., in terms of net assurance benefits), and at what cost in terms of side effects (such as changes made to software to facilitate the proofs, and assumption-related deployment restrictions imposed on software if these proofs are to remain valid in operation). We consider in detail, for the first time to our knowledge, possible relationships between proofs and side effects. To make our discussion concrete, we draw on tangible examples, experience, and the literature.

An interactive proof checker is a system which is able of building a formal proof (in some deductive calculus) by executing commands provided by the user. Proof checkers are useful both for making experiments in proof construction within various formal systems and for proving theorems in those fields of mathematics (such as mathematical theory of computation) where proofs are necessarily very large and unfeasible by hand. Two levels may be distinguished in a proof checker. The lower one implements the proof management routines, and is independent of any particular logic. The higher one implements the inference rules of a particular logical calculus. Powerful higher level rules are also needed to make the use of the checker practical. Almost all routine steps may be then generated automatically, and the user has just to give some “hints” to the checker, which transforms an “informal argument” into a formal proof.

This paper summarises our experience in teaching Formal Methods to Computer Science and Software Engineers students from various universities around the world, including the University of Madeira in Portugal, the Pontificia Universidad Javeriana and the University of The Andes in Colombia, Carnegie Mellon University (CMU) in the USA, and Innopolis University (INNO) in Russia. We report challenges we have faced during the past 10 to 15 years when teaching formal methods using the Event B formalism, and describe how we have evolved the structure of our courses to respond to those challenges. We strive to help students to build skills on Formal Methods that they can employ later on in their future IT jobs in software Industry. Our goal is to promote the wide use of Formal Methods by software Industry. We consider that this goal cannot be achieved without first universities transferring to Industry students with a strong background in Formal Methods and related formal tools. Formal Methods are key to software development because they are based on Discrete Mathematics which can be used to properly reason about properties that the software one develops should have. We have conducted two surveys among our students, the first one at CMU and the second one at INNO, that we use here to document and justify our decisions in terms of the course structure. The first survey is about the use of Event B as main mathematical formalism, and the second one is about the organisation of teams of students within the classroom to work on software projects that use Event B as main mathematical formalism. Our hope is that our work can be reused by other Faculty to make their own decisions on course structure and content in the teaching of their Formal Methods courses.

We propose an approach to quantify interference in a simple imperative language that includes a looping construct. In this paper we focus on a particular case of this definition of interference: leakage of information from private variables to public ones via a Trojan Horse attack. We quantify leakage in terms of Shannon’s information theory and we motivate our definition by proving a result relating this definition of leakage and the classical notion of programming language interference. The major contribution of the paper is a quantitative static analysis based on this definition for such a language. The analysis uses some non-trivial information theory results like Fano’s inequality and the [Formula: see text] inequality to provide reasonable bounds for conditional statements. While-loops are handled by integrating a qualitative flow-sensitive dependency analysis into the quantitative analysis.

Methods called pathway analysis have emerged whose purpose is to identify significantly impacted signaling pathways in a given condition. Most of these methods employ graphs to model the interactions between genes. Graphs have some limitations in accurately modeling various aspects of the interactions in the signaling pathways. As a result, formal methods as practiced in computer science is suggested for modeling signaling pathways. Using formal methods, various types of interactions among biological components are modeled, which can reduce the false-positive rates compared to other methods. Formal methods can also model the concurrent and stochastic behavior of signaling pathways.

An empirical evaluation of a formal approach versus ad hoc implementations in robot behavior planning

Formalization and proof of design guidelines within the scope of testing formally specified electronic product catalogues

VHSIC hardware description language (VHDL) is a very rich and flexible language, which offers large possibilities in the simulation domain. The current state of the art of the formal proof technique does not enable handling all these possibilities. It applies only to synchronous descriptions. The author proposes definitions of the main object semantics to be used in a synchronous description. The resulting VHDL guidelines are described. These make up the bases of a VHDL subset suitable for formal proof and also for synthesis tools. >