SpringerLink
Log in

Formal Methods and their Role in the Certification of Critical Systems

  • Conference paper
Safety and Reliability of Software Based Systems

Abstract

This article describes the rationale for formal methods and considers the benefits, weaknesses, and difficulties in applying these methods to digital systems used in critical applications. It suggests factors for consideration when formal methods are offered in support of certification in a context such as DO-178B (the guidelines for software used on board civil aircraft) [40]. The presentation is intended for those to whom these topics are new. A more technical discussion of formal methods is available as a technical report [42].

This work was sponsored by the Federal Aviation Administration, FAA Technical Center, Atlantic City NJ, and by the National Aeronautics and Space Administration Langley Research Center, Langley VA, under Contract NAS1-18969.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution

Subscribe and save

Springer+ Basic
EUR 32.99 /Month
  • Get 10 units per month
  • Download Article/Chapter or Ebook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Chapter
EUR 29.95
Price includes VAT (France)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
EUR 85.59
Price includes VAT (France)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
EUR 105.49
Price includes VAT (France)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free ship** worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Similar content being viewed by others

References

  1. Biddle W. Barons of the Sky: From Early Flight to Strategic Warfare, the Story of the American Aerospace Industry. Simon and Schuster, New York, NY, 1991. Paperback edition by Henry Holt, 1993.

    Google Scholar 

  2. Boeing Commercial Airplane Group. Statistical Summary of Commercial Jet Aircraft Accidents, Worldwide Operations,1959–1994. Seattle, WA, Mar. 1995. Published annually by Boeing Airplane Safety Engineering (B-210B).

    Google Scholar 

  3. Brazendale J, and Jeffs AR. Out of control: Failures involving control systems. High Integrity Systems 1, 1 (1994), 67–72.

    Google Scholar 

  4. Burns R W. Genius at work. IEE Review 39, 5 (Sept. 1993), 187–189.

    Article  Google Scholar 

  5. Butler R W, and Finelli G B. The infeasibility of experimental quantification of life-critical software reliability. IEEE Transactions on Software Engineering 19, 1 (Jan. 1993), 3–12.

    Article  Google Scholar 

  6. Clarke E, Grumberg O, and Long D. Verification tools for finite-state concurrent systems. In A Decade of Concurrency (REX Workshop, Mook, The Netherlands, June 1994), J. W. de Bakker, W. P. de Roever, and G. Rozenberg, Eds., vol. 803 of Lecture Notes in Computer Science, Springer-Verlag, pp. 124–175.

    Google Scholar 

  7. Clarke E M, Grumberg O, Haraishi H, Jha S, Long D E, McMillan K L, and Ness L A. Verification of the Futurebus+ cache coherence protocol. Formal Methods in System Design 6, 2 (Mar. 1995), 217–232.

    Article  Google Scholar 

  8. Cooper Jr. H S F. The Evening Star: Venus Observed. Farrar Straus Giroux, New York, NY, 1993.

    Google Scholar 

  9. Cyrluk D, Rajan S, Shankar N, and Srivas M K. Effective theorem proving for hardware verification. In Theorem Provers in Circuit Design (TPCD ‘84) (Bad Herrenalb, Germany, Sept. 1994), R. Kumar and T. Kropf, Eds., vol. 910 of Lecture Notes in Computer Science, Springer-Verlag, pp. 203–222.

    Google Scholar 

  10. Dill D L, Drexler A J, Hu A J, and Yang C H. Protocol verification as a hardware design aid. In 1992 IEEE International Conference on Computer Design: VLSI in Computers and Processors (1992), IEEE Computer Society, pp. 522–525. Cambridge, MA, October 11–14.

    Google Scholar 

  11. Dornheim M A. X-31 flight tests to explore combat agility to 70 deg. AOA. Aviation Week and Space Technology (Mar. 11, 1991), 38–41.

    Google Scholar 

  12. Eckhardt D E, Caglayan A K, Knight J C, Lee L D, McAllister D F, Vouk M A, and Kelly J P J. An experimental evaluation of software redundancy as a strategy for improving reliability. IEEE Transactions on Software Engineering 17,7 (July 1991), 692–702.

    Article  Google Scholar 

  13. Federal Aviation Administration. System Design and Analysis, June 21, 1988. Advisory Circular 25.1309–1A.

    Google Scholar 

  14. Federal Aviation Administration Technical Center. Digital Systems Validation Handbook—Volume III. Atlantic City, NJ. Forthcoming.

    Google Scholar 

  15. Fielder J H, and Birsch D, Eds. The DC-10 Case: A Case Study in Applied Ethics, Technology, and Society. State University of New York Press, 1992.

    Google Scholar 

  16. Gerhart S L, and Yelowitz L. Observations of fallibility in modern programming methodologies. IEEE Transactions on Software Engineering SE-2, 3 (Sept. 1976), 195–207.

    Article  MathSciNet  Google Scholar 

  17. Guiho G, and Hennebert C. SACEM software validation. In 12th International Conference on Software Engineering (Nice, France, Mar. 1990), IEEE Computer Society, pp. 186–191.

    Google Scholar 

  18. Har’El Z, and Kurshan R P. Software for analytical development of communications protocols. AT&T Technical Journal 69, 1 (Jan./Feb. 1990), 45–59.

    Google Scholar 

  19. Hayes I J, and Jones C B. Specifications are not (necessarily) executable. IEE/B CS Software Engineering Journal 4, 6 (Nov. 1989), 320–338.

    Google Scholar 

  20. Hecht H. Rare conditions: An important cause of failures. In COMPASS ‘83 (Proceedings of the Eighth Annual Conference on Computer Assurance) (Gaithersburg, MD, June 1993), IEEE Washington Section, pp. 81–85.

    Google Scholar 

  21. Jones C B. Systematic Software Development Using VDM, second ed. Prentice Hall International Series in Computer Science. Prentice Hall, Hemel Hempstead, UK, 1990.

    MATH  Google Scholar 

  22. Joyce J. Multi-Level Verification of Microprocessor-Based Systems. PhD thesis, University of Cambridge, Dec. 1989.

    Google Scholar 

  23. Kasuda R, and Packard D S. Spacecraft fault tolerance: The Magellan experience. In Proceedings of the Annual Rocky Mountain Guidance and Control Conference (Keystone, CO, Feb. 1993), R. D. Culp and G. Bickley, Eds., vol. 81 of Advances in the Astronautical Sciences, American Astronautical Society, pp. 249–267.

    Google Scholar 

  24. Kelly J C, Sherif J S, and Hops J. An analysis of defect densities found during software inspections. Journal of Systems Software 17 (1992), 111–117.

    Article  Google Scholar 

  25. Keutzer K. The need for formal verification in hardware design and what formal verification has not done for me lately. In Proceedings of the 1991 International Workshop on the HOL Theorem Proving System and its Applications (Davis, CA, Aug. 1991), P. Windley, Ed., IEEE Computer Society, pp. 77–86.

    Google Scholar 

  26. Knight J C, and Leveson N G. An experimental evaluation of the assumption of independence in multiversion programming. IEEE Transactions on Software Engineering SE-12,1 (Jan. 1986), 96–109.

    Google Scholar 

  27. Lamport L, and Melliar-Smith P M. Synchronizing clocks in the presence of faults. J. ACM 32, 1 (Jan. 1985), 52–78.

    Article  MathSciNet  MATH  Google Scholar 

  28. Lamport L, and Merz S. Specifying and verifying fault-tolerant systems. In Formal Techniques in Real-Time and Fault-Tolerant Systems (Lübeck, Germany, Sept. 1994), H. Langmaack, W.-P. de Roever, and J. Vytopil, Eds., vol. 863 of Lecture Notes in Computer Science, Springer-Verlag, pp. 41–76.

    Google Scholar 

  29. Lamport L, Shostak R, and Pease M. The Byzantine Generals problem. ACM Trans. Program. Lang. Syst. 4, 3 (July 1982), 382–401.

    Article  MATH  Google Scholar 

  30. Leveson N G. Safeware: System Safety and Computers. Addison-Wesley, 1995.

    Google Scholar 

  31. Leveson N G, and Turner C S. An investigation of the Therac-25 accidents. IEEE Computer 26, 7 (July 1993), 18–41.

    Google Scholar 

  32. Lincoln P, and Rushby J. A formally verified algorithm for interactive consistency under a hybrid fault model. In Fault Tolerant Computing Symposium 23 (Toulouse, France, June 1993), IEEE Computer Society, pp. 402–411.

    Google Scholar 

  33. Lloyd E, and Tye W. Systematic Safety: Safety Assessment of Aircraft Systems. Civil Aviation Authority, London, England, 1982. Reprinted 1992.

    Google Scholar 

  34. Lutz RR. Analyzing software requirements errors in safety-critical embedded systems. In IEEE International Symposium on Requirements Engineering (San Diego, CA, Jan. 1993), pp. 126–133.

    Google Scholar 

  35. Mackall D A. Development and flight test experiences with a flight-crucial digital control system. NASA Technical Paper 2857, NASA Ames Research Center, Dryden Flight Research Facility, Edwards, CA, 1988.

    Google Scholar 

  36. Mellor P. CAD: Computer-aided disaster. High Integrity Systems 1, 2 (1994), 101–156.

    MathSciNet  Google Scholar 

  37. Miller S P, and Srivas M. Formal verification of the AAMP5 microprocessor: A case study in the industrial use of formal methods. In WIFT ‘85: Workshop on Industrial-Strength Formal Specification Techniques (Boca Raton, FL, 1995), IEEE Computer Society, pp. 2–16.

    Google Scholar 

  38. Owre S, Rushby J, Shankar N, and von Henke F. Formal verification for fault-tolerant architectures: Prolegomena to the design of PVS. IEEE Transactions on Software Engineering 21, 2 (Feb. 1995), 107–125.

    Article  Google Scholar 

  39. Parnas D L, and Weiss D M. Active design reviews: Principles and practices. In 8th International Conference on Software Engineering (London, UK, Aug. 1985), IEEE Computer Society, pp. 132–136.

    Google Scholar 

  40. Requirements and Technical Concepts for Aviation. DO-178B: Software Considerations in Airborne Systems and Equipment Certification. Washington, DC, Dec. 1992. This document is known as EUROCAE ED-12B in Europe.

    Google Scholar 

  41. Rumbaugh J, Blaha M, Premerlani W, Eddy F, and Lorensen W. Object-Oriented Modeling and Design. Prentice Hall, Englewood Cliffs, NJ, 1991.

    Google Scholar 

  42. Rushby J. Formal methods and the certification of critical systems. Tech. Rep. SRI-CSL-93–7, Computer Science Laboratory, SRI International, Menlo Park, CA, Dec. 1993. Also issued under the title Formal Methods and Digital Systems Validation for Airborne Systems as NASA Contractor Report 4551, December 1993.

    Google Scholar 

  43. Rushby J, and von Henke F. Formal verification of algorithms for critical systems. IEEE Transactions on Software Engineering 19, 1 (Jan. 1993), 13–23.

    Article  Google Scholar 

  44. Spivey J M, Ed. The Z Notation: A Reference Manual, second ed. Prentice Hall International Series in Computer Science. Prentice Hall, Hemel Hempstead, UK, 1993.

    Google Scholar 

  45. UK Ministry of Defence. Interim Defence Standard 00–55: The procurement of safety critical software in defence equipment, Apr. 1991. Part 1, Issue 1: Requirements; Part 2, Issue 1: Guidance.

    Google Scholar 

  46. Vincenti W G. What Engineers Know and How They Know It: Analytical Studies from Aeronatical History. Johns Hopkins Studies in the History of Technology. The Johns Hopkins University Press, Baltimore, MD, 1990.

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Computer Science Laboratory, SRI International, Menlo Park, California, USA

    John Rushby

Authors
  1. John Rushby
    View author publications

    You can also search for this author in PubMed Google Scholar

Editor information

Editors and Affiliations

  1. ERA Technology Limited, Cleeve Road, KT22 7SA, Leatherhead Surrey, UK

    Roger Shaw

Rights and permissions

Reprints and permissions

Copyright information

© 1997 Springer-Verlag London Limited

About this paper

Cite this paper

Rushby, J. (1997). Formal Methods and their Role in the Certification of Critical Systems. In: Shaw, R. (eds) Safety and Reliability of Software Based Systems. Springer, London. https://doi.org/10.1007/978-1-4471-0921-1_1

Download citation

  • DOI: https://doi.org/10.1007/978-1-4471-0921-1_1

  • Publisher Name: Springer, London

  • Print ISBN: 978-3-540-76034-4

  • Online ISBN: 978-1-4471-0921-1

  • eBook Packages: Springer Book Archive

Publish with us

Policies and ethics

Search

Navigation