Formal Methods in Software Systems

(SE318)

Introduction to Formal
Methods
DR KASHIF SAGHAR
FAST
kashif.saghar@gmail.com
 Outline
Software Testing
What is Formal Methods?
Where FM can be used?
How we can use FM
 Software Testing
• What is Software Testing?
– Verification and Validation activity that is
performed by executing program code
– A program performs its intended functions
– Demonstration that errors are not present in the
code
– Removing and Fixing Errors from code
• None of above is effective software testing
– Solution?
– Will be discussed later
 A Definition

• “Software Testing is a process of executing a

program with the intent of finding error”
Glen Myers
 Software Testing

• “Program testing can be a very effective way

to show the presence of bugs, but it is
hopelessly inadequate for showing their
absence”.
Edsgar W. Dijkstra
 Software Testing
• Functional Testing
– Not enough to find all bugs in a program
• What to do?
– Pre and Post conditions may help
– Identifying exhaustive conditions is not
straightforward
• Solution : Formal Methods
– Bridges the gap between Paper-and-pencil proof
methods and testing
– As precise as a mathematical proof
– But not as straightforward to use as functional testing
 Software Budget
Allocation
• In Europe and USA
– Design and Coding : 10-20%
– Verification : 40-60%
– Other activities: 20-30%
• In Pakistan and Asia:
– Design and Coding : 95-99%
– Verification : 1-5%
 Formalization
• Formal methods are a particular kind of
mathematically based techniques for the
specification, development and verification of
software and hardware systems
• A formal model of a system is a mathematical
model of it, at some chosen level of
abstraction
– Purpose is to permit precise understanding,
specification, and analysis of the system
 A Definition
“Software engineers want to be real engineers.
Real engineers use mathematics.
Formal methods are the mathematics of
software engineering.
Therefore, software engineers should use formal
methods”.
Mike Holloway, NASA
 essence of a Formal
Method
• The system meets its specification
• Based on Mathematical techniques
– Construct a computer-based mathematical model of
the program (implementation)
– Use mathematical reasoning to check if the
implementation satisfies the properties of interest
(specifications) in a computerized environment
• Formal Language has
– Well defined syntax, semantics and rules
– Reason about relationship between expressions
 Why Formalize?
• Removes ambiguity and improves precision
• To verify that the requirements have been met
– Evidence is needed to justify confidence that requirements are
met
– Testing alone may not provide enough evidence
• To reason about the requirements/designs
– Properties can be checked automatically
– Test for consistency, explore consequences, etc.
• To animate/execute specifications
– Helps with visualization and validation
• Because we have to formalize eventually anyway
– Need to bridge from the informal world to a formal machine
domain
 FM in Embedded System

Yes OR No
Apply Properties
If No....... Why No?
 Where Formal Modeling
can be used?
• Specification Stage
– Give a description of the system to be developed, at whatever level(s)
of detail desired
– Used to guide further development activities
– Used to verify that the requirements for the system being developed
have been completely and accurately specified
• Development
– Once a formal specification has been produced, the specification may
be used as a guide while the concrete system is developed during the
design process (realized typically in software, but also potentially in
hardware
• Verification
– Once a formal specification has been developed, the specification may
be used as the basis for proving properties of the specification
 Current Formal
Verification Applications
• Software specification
– Software Industry is moving towards formal specifications
• Control System
– Many CS have hard requirements
– When the brake pedal is pressed, appropriate pressure is applied promptly at the wheels
• Real Time Systems
– How to include explicit reference to time in models and specifications?
– After the lift starts moving, the doors are never opened until the lift has
stopped
– When the brake is applied the lift stops within 0.5 seconds
• Protocol verification
– Very successful
• Hardware verification
– Industry has adopted formal verification in equivalence checking
 Why People Don’t
Formalize!!!
• Formal Methods tend to be lower level than other
techniques
– They include too much detail
• Formal Methods concentrate on consistent, correct models
– …most of the time developed models are inconsistent,
incorrect, incomplete…
• People get confused about which tools are appropriate:
– specification of program behavior
– vs. modeling of requirements
– formal methods advocates get too attached to one tool!
• Formal methods require more effort
– ...and the payoff is deferred
Formal Verification groups
 Using Formal Methods
Partially
• Selective use of Formal Methods
– Amount of formality can vary
– Need not build complete formal models
• Apply to the most critical pieces
• Apply where existing analysis techniques are weak
– Need not formally analyze every system property
• E.g. check safety properties only
– Need not apply FM in every phase of development
• E.g. use for modeling requirements, but don’t formalize the system design
– Can choose what level of abstraction (amount of detail) to model
• Lightweight Formal Methods
– Lightweight use of FMs - selectively apply FMs for partial modeling
 Formal Modeling
Prerequisites
• Understanding of the system that requires to
be analyzed
• Requires strong understanding of
– Computer Programming
– Logic
– Mathematics
• A vast variety of open research issues
– very challenging
 Why Formal Modeling?
• Distinct languages for specification and system
model
• System Model: finite state machine, …
• Specification: temporal logic, …
• Satisfaction established by some notion of Model
• Can be fully automated for finite state models
• On failure can provide a counter-example to aid
Debugging
• Model checkers: SPIN, NSMV, STATEMATE,
UPPAAL, KRONOS, …
Behavior Checking
 Summary
• Employ formal methods to model and analyze
systems
• Detect bugs early in design lifecycle
• Model-checking can
– Demonstrate that a model has required properties
– Be used in practice by engineers with only limited
mathematical knowledge
• UPPAAL and SPIN are the model checker that are
freely available, widely used and highly respected