This paper describes the experiences of Rockwell Avionics & Communications in using the CORE and SCR methods to specify the requirements for the mode logic of a Flight Guidance System for a General Aviation class aircraft. The example was first specified by hand using the CORE method,inspected, then entered into a prototype tool supporting the SCR method provided by the Naval Research Lab. Despite careful review of the CORE model, use of the SCR tool revealed 27 errors, many of them sign& cant. Difficulties encountered, a brief analysis of the errors discovered, and issues for industrial use are discussed.
{"title":"Specifying the mode logic of a flight guidance system in CoRE and SCR","authors":"Steven P. Miller","doi":"10.1145/298595.298856","DOIUrl":"https://doi.org/10.1145/298595.298856","url":null,"abstract":"This paper describes the experiences of Rockwell Avionics & Communications in using the CORE and SCR methods to specify the requirements for the mode logic of a Flight Guidance System for a General Aviation class aircraft. The example was first specified by hand using the CORE method,inspected, then entered into a prototype tool supporting the SCR method provided by the Naval Research Lab. Despite careful review of the CORE model, use of the SCR tool revealed 27 errors, many of them sign& cant. Difficulties encountered, a brief analysis of the errors discovered, and issues for industrial use are discussed.","PeriodicalId":125560,"journal":{"name":"Formal Methods in Software Practice","volume":"35 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1998-03-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123827538","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
1. ABSTRACT In this paper, we formally analyze an audio control protocol developed by Philips. We use real time process algebra to model the protocol and weak bisimulation to verify its implementation against its specification. 1.1 Keywords Communication protoco1, real time system formal methods, process algebra, weak bisimulation. 2. INTRODUCTION In [4], Bosscher, Polak and Vaandrager have formally analyzed, based on weak timed forward simulation by using the timed I/O automata, a simple version of an audio control protocol developed by Philips for the physical layer of an interface bus that connects the various devices of some stereo equipment. The protocol, which uses Manchester encoding, has to deal with a significant uncertainty in the timing events due to both hardware and software constraints. It is a very nice example and therefore it has been suggested as a benchmark for other researchers to test their methods on, just as the Cizt and Mouse example of [lo] and the Gas Burner example of [ 143. Process algebra such as CCS [ll], CSP [9] and ACP [3] have been used to describe and analyze concurrently executing systems including communication protocols. The notion of weak bisimulation provides simple and elegant proof techniques for showing an implementation (usually a parallel process) meets its specification (usually a Permission IO make di&l/hard copy of all or pan of this work for personal or classroom use is gaated without fee provided that copies ate not made of dishibuted for profit or commerci al advantage, the copyright notice, tbe tide of the publication aad its date appear, aad notice is given that copying is by permission of ACM, Inc. To copy otherwise, to republish. to post oa servets or to redistribute to lists, requires prior SpeGifiC permission sad/or a fee. sequential process). There are many applications of process algebra for the formal verification of concurrent systems based on weak bisimulation [7,12,13] Recently there are many proposals and resultson real time process algebra. Most of the published .results regard completeness, de&lability and expressiveness issues. Unlike the untimed case, the timed version of weak bisimulation bears criticism of being too fine to be useful in formal verification of real time systems. So far there are very few published results in verification of real time systems (even toy examples) based on timed weak bisimulation. In this paper, we will present a formal analysis of the Philips's audio control protocol based on timed …
{"title":"Verification of an audio control protocol within real time process algebra","authors":"Liang Chen","doi":"10.1145/298595.298860","DOIUrl":"https://doi.org/10.1145/298595.298860","url":null,"abstract":"1. ABSTRACT In this paper, we formally analyze an audio control protocol developed by Philips. We use real time process algebra to model the protocol and weak bisimulation to verify its implementation against its specification. 1.1 Keywords Communication protoco1, real time system formal methods, process algebra, weak bisimulation. 2. INTRODUCTION In [4], Bosscher, Polak and Vaandrager have formally analyzed, based on weak timed forward simulation by using the timed I/O automata, a simple version of an audio control protocol developed by Philips for the physical layer of an interface bus that connects the various devices of some stereo equipment. The protocol, which uses Manchester encoding, has to deal with a significant uncertainty in the timing events due to both hardware and software constraints. It is a very nice example and therefore it has been suggested as a benchmark for other researchers to test their methods on, just as the Cizt and Mouse example of [lo] and the Gas Burner example of [ 143. Process algebra such as CCS [ll], CSP [9] and ACP [3] have been used to describe and analyze concurrently executing systems including communication protocols. The notion of weak bisimulation provides simple and elegant proof techniques for showing an implementation (usually a parallel process) meets its specification (usually a Permission IO make di&l/hard copy of all or pan of this work for personal or classroom use is gaated without fee provided that copies ate not made of dishibuted for profit or commerci al advantage, the copyright notice, tbe tide of the publication aad its date appear, aad notice is given that copying is by permission of ACM, Inc. To copy otherwise, to republish. to post oa servets or to redistribute to lists, requires prior SpeGifiC permission sad/or a fee. sequential process). There are many applications of process algebra for the formal verification of concurrent systems based on weak bisimulation [7,12,13] Recently there are many proposals and resultson real time process algebra. Most of the published .results regard completeness, de&lability and expressiveness issues. Unlike the untimed case, the timed version of weak bisimulation bears criticism of being too fine to be useful in formal verification of real time systems. So far there are very few published results in verification of real time systems (even toy examples) based on timed weak bisimulation. In this paper, we will present a formal analysis of the Philips's audio control protocol based on timed …","PeriodicalId":125560,"journal":{"name":"Formal Methods in Software Practice","volume":"16 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1998-03-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116505938","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
David Y. W. Park, J. U. Skakkebæk, M. Heimdahl, Barbara J. Czerny, D. Dill
Abstract : The increasing use of software in safety critical systems entails increasing complexity, challenging the safety of these systems. Although formal specifications of real-life systems are orders of magnitude simpler than the system implementations, they are still quite complex. It is easy to overlook problems in a specification, ultimately compromising the safety of the implementation. Since it is error-prone and time consuming to check large specifications manually, mechanical support is needed. The challenge is to find the right combination of deductive power (i.e., how rich a logic and what theories are decided) and efficiency to complete the verification in reasonable time. In addition, it must be possible to explain why a proof fails. As an initial approach to solving this problem, we have adapted the Stanford Validity Checker (SVC), a highly efficient, general-purpose decision procedure for quantifier-free first-order logic with linear arithmetic, to check the consistency of specifications written in Requirements State Machine Language (RSML). We have concentrated on a small but complex part of version 6.04a of the specification of the (air) Traffic alert and Collision Avoidance System (TCAS II). SVC was extended to produce a counter-example in terms of the original specification. The efforts discovered an undesired inconsistency in the specification, which the maintainers of the specification independently discovered and subsequently fixed in the most recent version. The case study demonstrates the practicality of uncovering problems in real-life specifications with a modest effort, by selective application of state-of-that-art formal methods and tools. The logic of SVC was sufficiently expressive for the properties that we checked, but more work is needed to extend the class of formulae that SVC decides to cover the properties found in other parts of the TCAS II specification.
{"title":"Checking properties of safety critical specifications using efficient decision procedures","authors":"David Y. W. Park, J. U. Skakkebæk, M. Heimdahl, Barbara J. Czerny, D. Dill","doi":"10.1145/298595.298603","DOIUrl":"https://doi.org/10.1145/298595.298603","url":null,"abstract":"Abstract : The increasing use of software in safety critical systems entails increasing complexity, challenging the safety of these systems. Although formal specifications of real-life systems are orders of magnitude simpler than the system implementations, they are still quite complex. It is easy to overlook problems in a specification, ultimately compromising the safety of the implementation. Since it is error-prone and time consuming to check large specifications manually, mechanical support is needed. The challenge is to find the right combination of deductive power (i.e., how rich a logic and what theories are decided) and efficiency to complete the verification in reasonable time. In addition, it must be possible to explain why a proof fails. As an initial approach to solving this problem, we have adapted the Stanford Validity Checker (SVC), a highly efficient, general-purpose decision procedure for quantifier-free first-order logic with linear arithmetic, to check the consistency of specifications written in Requirements State Machine Language (RSML). We have concentrated on a small but complex part of version 6.04a of the specification of the (air) Traffic alert and Collision Avoidance System (TCAS II). SVC was extended to produce a counter-example in terms of the original specification. The efforts discovered an undesired inconsistency in the specification, which the maintainers of the specification independently discovered and subsequently fixed in the most recent version. The case study demonstrates the practicality of uncovering problems in real-life specifications with a modest effort, by selective application of state-of-that-art formal methods and tools. The logic of SVC was sufficiently expressive for the properties that we checked, but more work is needed to extend the class of formulae that SVC decides to cover the properties found in other parts of the TCAS II specification.","PeriodicalId":125560,"journal":{"name":"Formal Methods in Software Practice","volume":"21 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1998-03-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121205865","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
京公网安备 11010802042870号
京ICP备2023020795号-1
扫码关注我们
求助内容：
应助结果提醒方式：