The Use of Formal Methods

Some of these methods can be difficult to apply in a HIT setting. For example, FTA and ETA use diagrammatic methods to link events and behavionrs to hazards. However, for the techniques to work there generally has to be a clear relationship between cause and effect in the system, i.e. if A occurs and B occurs then C will occnr. HIT solutions tend to be highly complex systems and the occnrrence of harm is nearly always, at least to some degree, inflnenced by the system s human operators. Users are notoriously unpredictable in their actions and a system behaviour which might contribute to harm for one user may not for another. Thus the cause-effect relationship becomes loose and some systematic methods difficult to apply. 

It should be remembered though that this limitation does not necessarily hold true for aU parts of the system. Some components may exhibit a clear cause and effect relationship, particnlarly components that do not require user interaction for example messaging between two or more systans or the execution of automated 

---

Ideally, define the assessment endpoint so that it relates directly to the management goal. If this is not practical, (e.g., if the management goal refers to population sustainability but the assessment endpoint refers to individual mortality), define in advance how the assessment endpoint will be interpreted. If this involves subjective judgments then consider the use of formal methods. 

MOLECULAR molecular orbitals for molecules consisting of three or more atoms, but more complex ORBITALS FOR cases benefit from the use of formal methods of group theory. The process uses the LARGER MOLECULES following steps ... 

As more and more standards in the field of dependability recommend the use of formal methods for risk assessment, this demand will be articulated more emphatic in the near futures, so that the quahtative jump may be done by going from analytical calculations to Monte Carlo simulations within Petri nets. 

From a technical point of view, safety and security concerns are certainly similar, but there is one very important difference. While we can get a reasonable confidence level from a safety pomt of view by empirically observing reliability (this plane has flown thousands of hours with not one observed safety defect), we are not nearly so ready to accept this kind of empirical evidence for security. The fact that someone could walk by the World Trade Center buildings every day for decades and see them still standing did not prove they were invulnerable to attack. When it comes to security, the use of formal methods becomes more attractive. It is comforting to be able to prove mathematically that a program meets its security requirements. We will discuss later on whether this is achievable in practice. 

As part of the DO-178C effort, a formal methods technology supplement has been developed, which will at last allow credit for the use of formal methods. 

The use of formal methods for requirements or design allows some of the verification objectives to be satisfied by the use of formal methods. The formal methods technology supplement provides specific guidance as to how formal methods can be used to conduct analyses of the high-level requirements, low-level requirements, software architecture and source code. Formal analysis of the execu-... 

Technological matters are dealt with in the fifth session one paper discusses the challenges imposed by the use of multicore processor architectures in critical systems, and the second takes a pragmatic look at the use of formal methods. 

Formal methods are mathematically based techniques for the specification, development, and verification of hardware and software systems. The use of formal methods is motivated by the expectation that design requirements can be proven correct mathematically. However, the high cost of using formal methods means that they are usually only used in the development of high-integrity systems where safety is of utmost importance. 

As noted above, lack of development in the use of formal methods limits the claims which might be made. 

Again as noted above, lack of development in the use of formal methods limits the claims which might be made. Typically, software requirements are documented using structured English. There are no overriding barriers to more rigorous approaches other than the lack of trained staff. 

Our approach is to look at the use of formal methods at key points in the development lifecycle and assess the benefits to be gained and the cost implications compared to existing techniques. By assessing how we manage issues like complexity and traceability at each phase of the lifecycle with traditional (semi-formal) techniques we can establish what aspects need to be addressed by a formal development approach. 

The safety-critical nature of the SSI data means that this validation procedure should be implemented with a high degree of confidence. This entails the use of formal methods in the specification, design and implementation of the validation procedure, and the need for a sound mathematical model of our validation strategy. The intention is to use Z on this project. 

Safety engineers are now encouraged to use fault prevention techniques (e.g. through the publication of [MOD 91]), in particular the use of formal methods to the development of safety-critical software. To maximise the benefit of this approach the safety engineer would be wise to adopt the security principles of the "reference monitor concept" and security policy modelling. However, as in the case of security, the safety engineer would also be wise to utilise the more traditional safety engineering approach of fault tolerance in harmony with the new fault preventative approach. 

In the French railway field, the use of formal methods, including the use of method B [ABR %], is increasingly common in the development of critical systems. The software of these safety systems (railway signaUng, automatic driving) must meet strict criteria for quality, reliability, and robustness. One of the first applications of these formal methods was done retrospectively on SACEM [GUI 90]. More recent projects, such as CTDC, KVS or SAET-METEOR [BEH 93 BEH 96], used method B throughout the development process (from the specifications to the code). 

---