How To Research Formally
How To Research Formally
◦ The systems where safety or security is important, to help ensure that errors are
not introduced into the development process.
3
Formal vs. Informal Methods
4
Mathematics vs. Natural Language for System
Specification
Deficiencies of natural language
◦ Can be ambiguous
◦ Can be self-contradictory
◦ Can be incomplete
◦ Encourages imprecise thinking
◦ Cannot easily handle abstractions
5
Mathematics – good features
◦ Easily handle abstractions
◦ Can be used for reasoning about, and describing a system
◦ Is concise
◦ Is non-ambiguous
6
Mathematics – good features
◦ Is applied widely to the real world
7
Formal Notation – Drawbacks
◦ The customer cannot easily understand the specification
8
Formal Methods Parts
1. Formal specification
2. Formal verification
3. Automated theorem proving
4. Model checking
9
1.Formal Specification
A definition of what a computer program is expected to do
It can be
◦ informal, in which case it can be considered as a blueprint or user
manual from a developer point of view, or
◦ formal, in which case it has a definite meaning defined in
mathematical or programmatic terms.
10
Purpose of FS
oTo state what system should do without describing how to do it
omay be used to give a description of the system to be developed, at any level
Semantics - rules for interpreting the sentences in a precise, meaningful way within the domain
Proof Theory - rules for inferring useful information from the specification
2.Formal Verification
o Deciding the undecidable
o formally proving that system does exactly what is stated in the program specification.
o more specific because it verifies the code itself, not only some abstract model
of the program.
13
Simulation vs FV
Simulation is input-driven, FV is output-driven:
◦ Mind-set in simulation: first to generate input vectors and then to
derive reference outputs
◦ In FV: user starts out by stating what output behavior is desirable
and then lets the formal checker prove or disprove it.
◦ Simulation checks one output point at a time, while FV: checks a
group of output points at time.
3.Automated Theorem Proving
o Semi automatic
o Uses logic
16
4.Model checking
o Fully automatic
17
How does Model Checking work?
Finite State
Model
System meets
Model Checker or not
Properties
18
Model checking
Used in studying behaviors of reactive systems
Typically involves three steps:
◦ Create a finite state model (FSM) of the system design
◦ Specify critical correctness properties
◦ Validate the model w/r to the specifications
Variety of formal methods
o System is described in a number of small Z modules, which can cross-refer each other
o Each module is expected to have some descriptive English text to help users understand it
- Based on set theory and first order predicate logic
- Unified Modeling Language (UML)
◦ provides system architects…with one consistent language for
◦ specifying,
◦ visualizing,
◦ constructing,
◦ documenting the artifacts of software systems..
Do we really need Formal Methods?
Digital systems can fail in catastrophic ways leading to death or tremendous
financial loss.
Potential causes of failure include:
o physical failure
o human error
o environmental factors
o design errors- Design errors are the major culprit.
Effects of Design Errors
Between June 1985 and January 1987, a computer-controlled radiation therapy machine, called
the Therac-25 , massively overdosed six people, killing two.
On April 30, 1999 Titan I cost taxpayers 1.23-billion dollars, all due to a software malfunction
(incorrectly entered roll rate filter constant)
o Improve SW Quality
o Reduce specification errors and provide a rational basis for choosing test data
o Business Processes
o Biological Processes
o Security