1. 25 November 2002 DeSIRE, Pisa Methods and Tools for Formal Design and Validation Michael Butler University of Southampton mjb@ecs.soton.ac.uk

2. DeSIRE, Pisa 25 November 2002 Other Contributors Thierry Lecomte, ClearSy (FR) Thierry Lecomte, ClearSy (FR) Colin O’Halloran, QinetiQ (UK) Colin O’Halloran, QinetiQ (UK) Jerome Falampin, Siemens Transportation (FR) Jerome Falampin, Siemens Transportation (FR) Michael Goldsmith, Formal Systems (UK) Michael Goldsmith, Formal Systems (UK) Traian Muntean, CNRS (FR) Traian Muntean, CNRS (FR) Kaisa Sere, Åbo Akademi (FIN) Kaisa Sere, Åbo Akademi (FIN) Ursula Martin, University of St Andrews (UK) Ursula Martin, University of St Andrews (UK) (Mostly MATISSE Partners)

3. DeSIRE, Pisa 25 November 2002 FMs and Dependability Fault Prevention (SW / HW) Fault Prevention (SW / HW) Code / design verification (MC / TP) Code / design verification (MC / TP) Property languages (TL) Property languages (TL) Assertion languages (e.g. JML, Ada Compliance Notation) Assertion languages (e.g. JML, Ada Compliance Notation) Correct by construction (e.g., VDM, B, Z) Correct by construction (e.g., VDM, B, Z) Stepwise design from system-level models Stepwise design from system-level models Verification conditions at each step discharged using MC / TP Verification conditions at each step discharged using MC / TP Final step: automatic code generation Final step: automatic code generation Fault Removal Fault Removal Code / design verification (MC / TP) Code / design verification (MC / TP) Model-based testing Model-based testing

4. DeSIRE, Pisa 25 November 2002 FMs and Dependability Fault Tolerance Fault Tolerance Validation of fault tolerance mechanisms through inclusion of faults in formal models Validation of fault tolerance mechanisms through inclusion of faults in formal models E.g., verify that a high-integrity system continues to satisfy safety/security property in the presence of faults/attacks Validation of failure modes Validation of failure modes Fault Evaluation Fault Evaluation Use of model checking to discover whether / how component faults can lead to system failures Use of model checking to discover whether / how component faults can lead to system failures Combine with risk analysis to target verification effort Combine with risk analysis to target verification effort

5. DeSIRE, Pisa 25 November 2002 FMs and Dependability Certification Certification Formal models of system-level behaviour to aid identification and analysis of hazards Formal models of system-level behaviour to aid identification and analysis of hazards Specification reviews Specification reviews Proofs of safety preservation in design Proofs of safety preservation in design Stronger validation of SW control wrt control laws Stronger validation of SW control wrt control laws Fully verified code / more thorough testing Fully verified code / more thorough testing

6. DeSIRE, Pisa 25 November 2002 MATISSE Experience Based on B Method and Atelier-B Based on B Method and Atelier-B Previous formal experience varied Previous formal experience varied Railway: Formal relationship between system- level model and SW model Railway: Formal relationship between system- level model and SW model Smart Cards: formally developed applet verifier Smart Cards: formally developed applet verifier Modest increase in effort – for significant decrease in design / programming errors Modest increase in effort – for significant decrease in design / programming errors Healthcare: analysis of fault tolerance and failure modes for diagnostic device (UML+B) Healthcare: analysis of fault tolerance and failure modes for diagnostic device (UML+B)

7. DeSIRE, Pisa 25 November 2002 Challenges More complex fault models at system level More complex fault models at system level Stronger integration of hazard analysis with formal modelling and verification Stronger integration of hazard analysis with formal modelling and verification Integration of numerical analysis / simulation tools with verification tools Integration of numerical analysis / simulation tools with verification tools More powerful verification tools More powerful verification tools Make formal modelling and verification more appealing to systems engineers Make formal modelling and verification more appealing to systems engineers Develop domain-specific specialisations / tools Develop domain-specific specialisations / tools Gather domain-specific evidence Gather domain-specific evidence

8. DeSIRE, Pisa 25 November 2002 Application Areas Aerospace Aerospace Defence Defence Transportation Transportation Utilities Utilities E-commerce - security, dependable transactions E-commerce - security, dependable transactions Fault-tolerant communications infrastructures Fault-tolerant communications infrastructures Ubiquitous computing devices and infrastructures Ubiquitous computing devices and infrastructures

9. DeSIRE, Pisa 25 November 2002 IST Projects using FMs MATISSE (rail, smart cards, healthcare) MATISSE (rail, smart cards, healthcare) RISE (automotive) RISE (automotive) SAFEAIR, DAEDALUS (aerospace) SAFEAIR, DAEDALUS (aerospace) ADVANCE (telecoms) ADVANCE (telecoms) MAFTIA (comms infrastructures) MAFTIA (comms infrastructures) DSoS (dependable systems) DSoS (dependable systems) PROTOCURE (healthcare) PROTOCURE (healthcare) VERIFICARD (smart cards) VERIFICARD (smart cards) SYMBAD, PUSSEE (embedded electronics) SYMBAD, PUSSEE (embedded electronics) …