The specification of a generic multicomputer using Lotos

For safety critical systems, hardware is often preferred over software because it is easier to achieve safety goals in hardware alone and because hardware is considered more reliable than software. But as systems become more complex, software solutions will also be important. Here we demonstrate, using a simple example, that formal methods are a useful tool for developing software specifications for safety critical systems, since they reduce ambiguity in the design and can be proven consistent. Using formal methods for specifications will enable the development of dependable, high-performance, reliable hardware/software safety critical systems. The method we describe is the first step in our work to establish a hardware/software development process for safety critical systems.

Formal methods (FM) are mathematically-based techniques that provide a rigorous basis for software development: the application of FMs makes it possible to achieve provable correctness and reliability in the various steps of system design and implementation. This article is a tutorial presentation of formal methods and description techniques that address modeling and analysis of distributed systems and concurrent processes in telecommunications and protocol engineering. The aim of the article is to introduce to non-practitioners the main formal methods for communication protocols. For each method, a synthetic description of its textual or graphical syntax is provided. Also, the modeling capabilities and the basic communication features are pointed out by the application of the method to a common case study, a simple retransmission protocol. The tutorial description is completed by examples of recent applications of FMs to the specification and analysis of transmission and signaling protocols in industrial and research projects, which describe the methods' application domain and offer selected references for further readings.

The field of application for distributed algorithms is growing with the ongoing demand for new network applications. Wherever a global goal must be achieved by a number of peers, a distributed algorithm consisting of local computations and communication protocols must be developed. In asynchronous environments the design of a distributed algorithm must respect the fact that processes may vary in speed and that messages might be delayed for an arbitrarily long time. Moreover, it is often required that the algorithm still works in the presence of crash failures, i.e., in scenarios, where some processes stop working at some time. The complex nature of concurrent executions in distributed systems often hinder the application of common methods for modeling and verification. Although many different formal approaches for modeling fault tolerant distributed algorithms, like e.g. I/O automata and process calculi have been proposed, many works in the field of distributed systems use informal pseudo-code representations to introduce new algorithms. On most cases this leads to informal and crude arguments for correctness, which usually become incomprehensible if all race conditions must be taken into account. This work proposes new formal strategies to model and verify distributed algorithms, whereas we focus on two main goals. Firstly, we introduce a means to satisfy a designer’s demands by using methods that are easy to understand and to work with and which are very similar to common applied methods as e.g. TLA and Abstract State Machines. Secondly, our strategies are suitable for the formal use in a theorem proving environment. This enables mechanical verification of our algorithms and therefore, we are able to produce machinechecked proofs for correctness. Our model adopts abstractions from the work of Fuzzati, which examines two similar distributed algorithms in a logical framework. We lifted these abstractions to a more general level to make them suitable and reusable for as many distributed algorithms as possible. Furthermore, we present a new method to place local computation steps in the respective global context. The advantage of our method is that, on the on hand, like with pseudo code, computations can be described as local steps, but, on the other hand, it is possible to formally reason over global system states. Our model for communication mechanisms comprises modules for different kinds of message passing, broadcasts, and shared memory access. We are convinced that our model can easily be extended to support almost all kinds of communication infrastructures that can formally be described. We show how properties that have to be verified can be expressed in terms of our model to enable formal reasoning. Furthermore, we present appropriate strategies to verify different classes of properties. For the theorem proving environment Isabelle/HOL we provide a library which incorporates all introduced abstractions and can, therefore, be reused and extended for further applications, new algorithms, and further verification projects. Finally, we present case studies for the verification of different distributed algorithms to demonstrate the applicability of our strategies. Four known algorithms are verified in our model using our framework for Isabelle/HOL. The algorithms vary in complexity, the used communication infrastructure, the failure model, and other constraints, so that many different modeling and verification aspects are exemplified.

Many critical control systems are developed using formal methods. When software applied to such systems is developed, the employment of formal methods in the software requirements specification and verification will provide increased assurance for such applications. Earlier error of overlooked requirement specification can be detected using formal specification method. Also the testing and full verification to examine all reachable states using model checking to undertake formal verification are able to be completed. In this paper, we proposed an eclectic approach to incorporate Z(Zed) formal language and ‘Statemate MAGNUM’ which is formal method tools using Statechart. Also we applied the proposed method to safety-critical railway signaling systems for the formal requirement specification and analyzed the specification results.

Published results show that various models may be obtained by combining parallel composition with probability and with or without non-determinism. In this paper we treat this problem in the setting of process algebra in the form of ACP. First, probabilities are introduced by an operator for the internal probabilistic choice. In this way we obtain the Basic Process Algebra with probabilistic choice prBPA. Afterwards, prBPA is extended with parallel composition to ACP+π. We give the axiom system for ACP+π and a complete operational semantics that preserves the interleaving model for the dynamic concurrent processes. Considering the PAR protocol, a communication protocol that can be used in the case of unreliable channels, we investigate the applicability of ACP+π. Using in addition only the priority operator and the preabstraction operator we obtain a recursive specifications of the behaviour of the protocol that can be viewed as a Markov chain.

Numerous formal specification methods have been proposed in the literature, such as the Z language, the Unified Modeling Language (UML), the B method, Petri nets, and action systems. Comparing the different specification methods is not an easy task but it is meaningful in many aspects. In this paper, we discuss the properties of five formal specification methods theoretically and address their differences by designing a particular part of the ABM system using each method, and further compare these methods by analyzing their strengths and weaknesses.

Various methods are used to describe communication protocols. The search for suitable description methods for communication protocols in the 1980s yielded a broad range of approaches out of which some fundamental methods have crystallized. These methods constitute the basis of the semantic models of the various formal description techniques. Therefore we first consider the most important description methods in this chapter before we turn to the formal description techniques. From these, finite state machines, Petri nets, process calculi, and temporal logics have crystallized as the most important and most common ones. Apart from these methods, other approaches were also investigated, such as the use of grammars, data flow languages, and functional languages. They did not receive wider attention because they were not applied to real-life protocols. The use of high-level programming languages was considered likewise. Programming languages support the algorithmic description of protocol procedures as well as the generation of prototypes, but they usually do not possess a formally defined semantics. In addition, programming languages are primarily implementation languages and not specification languages. They often yield descriptions which are close to an implementation. For that reason, high-level programming languages are not used for protocol description. Many formal description techniques, however, use programming language features.

A communication protocol is first presented as a set of rules that determine the behaviour of a communication system in terms of the exchange of messages between communication entities. Then a protocol is also described as an artificial language which specifies this behaviour. The concepts of the abstract and the transfer syntax of protocol messages are explained and the importance of the rules for the behaviour of protocol entities is emphasised. The difference between informal and formal specification is explained, and the importance of the formal description techniques to assure nonambiguous specifications is emphasised. The basic techniques for informal and formal specification are presented. The difference between the functionality specifications that are based on the finite state machine model, and those which are based on process algebras, is pointed out. Then some of the most important formal languages are overviewed: ACT ONE and ASN.1 for message specification, SDL, Estelle and LOTOS for protocol specification, and also UML, MSC and TTCN for communication protocols design. The chapter contains five figures.

The paper present an approach the use Z specification language for development aggregate formal specifications. The use of Z schemas in aggregate model permits mathematically strictly define data structures used in system description. Modified aggregate approach permits to specify dynamic behaviour of distributed information systems. The presented approach permits to describe systems in different abstraction levels. It is illustrated by two specifications of commerce logistics centre which one is used for developing simulation model and other for creating of information system specification.

Currently, digital technologies for modeling buildings and infrastructure are successfully used in international and national practice for the implementation of complex construction projects and large-scale programmes. At the same time, the transition to machine-readable standards, implemented in many countries to improve the quality of design documentation and automate its verification, faces serious methodological and technical challenges. First of all, these challenges are due to the complexity of digital models, as well as the variety of requirements formulated in natural languages and imposed on these models at the state, regional, departmental, and corporate levels. Attempts to create catalogs of requirements and software tools for their management and use generally have specific purposes and do not provide necessary completeness, normalization, consistency, interconnectedness, unambiguity, traceability, and validability of requirements description. In this regard, it seems reasonable to use formal methods for specification and verification of requirements that have proven themselves in system and software engineering. This paper provides a comparative analysis of software tools for automated verification of regulatory requirements in the construction domain. There is a growing interest in tools focused on international standards, such as Industry Foundation Classes (IFC) and Information Delivery Specification (IDS), that allow one to control the completeness of the object and attribute composition of models, as well as the clarification of acceptable domains of values values. However, the IDS standard is not formalized and does not enable the specification of requirements expressed in terms of arbitrary algebraic conditions. The EXPRESS object-oriented data modeling language, in which the IFC data schema is specified, seems promising for the formal specification and verification of requirements for digital models used in the construction industry. As a substantiation, it is shown that IDS specifications can be represented by logical expressions and EXPRESS functions, as well as that arbitrary algebraic conditions can be specified as EXPRESS declarative rules. To illustrate the proposed approach, we consider some examples of the formalization of requirements from national construction standards and sets of rules concerning the safety of buildings, structures, and processes. The possibility of harmonizing the proposed formal approach with the IDS standard by defining new facets for the representation of local, uniqueness, and global EXPRESS rules is also discussed.

Ubiquitous embedded systems are revolutionizing our daily lives. Whole systems on a chip deliver unprecedented computation power at ever decreasing costs. However, their complexity makes their design with traditional RTL-based flows extremely challenging. Complexity in such systems arises not only from the diversity of the technologies, from RF front-ends to baseband DSP software, that must be integrated on-chip, but also from the fact that such systems must be increasingly built from parts that have been designed separately and using different tools and flows. High abstraction levels and component reuse are essential. Often such systems are highly networked and rely on sophisticated communication mechanisms. Architectural design and performance analysis of such networked system-chips is a crucial part of the embedded system design process.Two basic methods for tackling the growing complexity of system-on-chip design are emerging. Formal specification and design methods, and platform-based design. Formal methods are essential to capture precisely the designer intent at the highest possible level of abstraction, and to guide him down towards an implementation. Design errors are reduced by the use of synthesis techniques, as well as by the availability of a variety of validation techniques. Moreover, the orthogonalization of concerns (e.g., computation vs. communication, function vs. architecture) promotes extensive reuse of both parts of an application (derivative designs) and of previously used architectures.A platform in this context is the precise specification of a high-level implementation target that supports both a variety of lower level implementations, and a variety of higher-level applications. A classical example is the PC, that has supported an explosive growth of both applications and implementations. In embedded systems-on-chip platform clearly need to be application-specific. A typical platform includes one or more processors, memory, one or more bus hierarchy levels, and peripherals devoted to application-specific functions (e.g., MPEG decoding, filtering, A/D conversion, ...). Mapping to a platform involves identifying which portions of the application will be implemented on each computation and communication resource. Communication must be refined from high-level primitives (e.g., FIFOs) down to platform primitives (e.g., interrupts, memory buffers, ...). Functionality must be synthesized and scheduled based on platform-specific cost, memory and performance constraints.In this tutorial we will cover both aspects in detail, illustrating first the languages and Models of Computation available to the system-level designer to capture precisely and unambiguously the requirements. We will discuss for what application domain and platform each language is most appropriate, focusing mostly on platform-independent languages and MOCs, since they support the greatest freedom in mapping choice. We will then discuss how the architecture of the platform, and the services it offers to the application designer, can also be formally and compactly captured and specified. We will show how the mapping paradigm can be used to select an implementation for the functional blocks and their communication, and how simulation and implementation methods can be derived automatically. In particular, we will describe how software estimation and synthesis for reactive real-time systems can be competitive with hand design, while retaining the ease of re-use typical of high-level specifications.In the next part of the tutorial, we will establish the importance of on-chip communication architectures in determining the performance of System-on-Chips (SoCs). We will track several on-chip communication architectures that are in use today, including different types of bus architectures, token ring architectures, and crossbar switches. We will analyze the performance of the existing communication architectures under different classes of on-chip communication traffic. We will also describe novel on-chip communication architectures that are being developed to satisfy the growing needs of fast and concurrent on-chip communication in very high-performance systems like network processors. Next, we will describe efficient methodologies that can be used to analyze and design customized on-chip communication architectures for new application-specific platforms, as well as optimally map an application's communication requirements to the communication architecture present in an existing platform. We will also discuss reconfigurable on-chip communication architectures that allow runtime adaptation of the communication protocols to changing communication demands of the platform. Besides performance, we will analyze the energy consumed by on-chip communication architectures, and describe techniques to minimize such energy consumption. Lastly, we will analyze the impact of deep sub-micron technologies on SoC communication, and discuss the needs for development of noise-aware on-chip communication.

Integral: Petri-net approach to distributed software development

Standardization of Formal Specification Languages

This paper proposes a method for validating the design of a real-time system. The method is based on the formal specification of the target system and the verification of its timing requirements. The main contribution consists in introducing the design issues (e.g. the tasks parameters or the scheduling algorithm) in the system specification. It will allow to check how these design issues may affect the stated timing requirements.

Deals with the formal specification of dynamic constraints. First of all, we introduce two dynamic constraints which we formally characterise using the B formal specification method. These two dynamic constraints, namely the faithfulness and existence dependency of a binary relationship, are defined using the three mathematical bases of B, viz. predicate logic, set theory and substitution theory. Moreover, we provide for each constraint what is called a proof obligation against which the system's operation specifications must be checked in order to determine whether or not they obey the constraint. This study has raised a general methodology for supporting the specification of a particular type of dynamic constraints in B. The outline of this methodology is presented. We finally show that the constraints we proposed have real-life applications and especially for formally defining the concept of composition in UML (Unified Modeling Language) as an example.