Formal modelling is now widely applied for creating models of safety-critical interactive systems... more Formal modelling is now widely applied for creating models of safety-critical interactive systems. Most approaches built so far either focus on the user interface or on the functional part of a safety-critical interactive system. This paper aims to apply formal methods for modelling and specifying the user interface, interaction and functional aspects of a safety-critical system in a single model using Coloured Petri Nets (CPN). We have used CPNs because of its expressive graphic representation and the ability to simulate the system behaviour. The technique is illustrated through a case study of the Niki T34 Infusion Pump.
This paper presents an idiomatic construct for-charts which reflects the high-level specification... more This paper presents an idiomatic construct for-charts which reflects the high-level specification construct of synchronization between activities. This, amongst others, has emerged as a common and useful idea during our use of-charts to design and specify commonly-occurring reactive systems. The purpose of this example, apart from any inherent interest in being able to use synchronization in a specification, is to show how the very simple language ofcharts can used as a basis for a more expressive language built by definitional extension. 2. The basics of-charts Here we give a short introduction to the syntax and semantics of-charts. However, anyone familiar with finitestate machines will find them very familiar and easy to understand, the only significant extension being that of states which are themselves charts. Consider the upper chart in Figure 1. The chart's name Example appears in the top left-hand corner of the rectangle which delineates the chart. The double-walled oval named A is an atomic state which is also the initial state of Example. The rectangle B is another state of Example except that this time B is a state which has extra structure: it
For validation or for communication with a client, it is useful to create a visualisation of a sp... more For validation or for communication with a client, it is useful to create a visualisation of a specification. It is important that the visualisation does not mislead the user. In this work we look at how to characterise the conditions for a micro-chart visualisation to be sound. This is done by introducing a new operator to the micro-chart semantics, allowing us to use Z data refinement to find a refinement relation between a Z specification and its (claimed sound) micro-chart visualisation. If the relation does not hold, then the visualisation is not sound.
Before we combine actions and probabilities two very obvious questions should be asked. Firstly, ... more Before we combine actions and probabilities two very obvious questions should be asked. Firstly, what does “the probability of an action ” mean? Secondly, how does probability interact with nonde-terminism? Neither question has a single universally agreed upon answer but by considering these questions at the outset we build a novel and hopefully intuitive probabilistic event-based formalism. In previous work we have characterised refinement via the notion of testing. Basically, if one system passes all the tests that another system passes (and maybe more) we say the first system is a refinement of the second. This is, in our view, an important way of characterising refinement, via the question “what sort of refinement should I be using?” We use testing in this paper as the basis for our refinement. We develop tests for probabilistic systems by analogy with the tests developed for non-probabilistic systems. We make sure that our probabilistic tests, when performed on non-probabilisti...
To gain confidence in safety-critical interactive systems, formal modelling and analysis plays a ... more To gain confidence in safety-critical interactive systems, formal modelling and analysis plays a vital role. The aim of this paper is to use Coloured Petri Nets to model and analyze safety-critical interactive systems. We present a technique to construct a single Coloured Petri Net model of the user interface, interaction and functionality of safety-critical interactive systems and then analyze the achieved Coloured Petri Net model using a state space analysis method. There are several reasons for using Coloured Petri Nets. Coloured Petri Nets provides a graphical representation and hierarchical structuring mechanism, and a state space verification technique, which allows querying the state space to investigate behaviours of a system. There are several tools that supports Coloured Petri Nets including the CPN Tool which helps in building CPN models and allows simulation and analysis using state spaces. The technique to model and analyze safety-critical interactive systems is illustrated using a simplified infusion pump example.
We define interacting sequential programs, motivated originally by constructivist considerations.... more We define interacting sequential programs, motivated originally by constructivist considerations. We use them to investigate notions of implementation and determinism. Process algebras do not define what can be implemented and what cannot. As we demonstrate it is problematic to do so on the set of all processes. Guided by constructivist notions we have constructed interacting sequential programs which we claim can be readily implemented and are a subset of processes.
Electronic Proceedings in Theoretical Computer Science, 2018
Creating formal models of interactive systems has wide reaching benefits, not only for verifying ... more Creating formal models of interactive systems has wide reaching benefits, not only for verifying lowlevel correctness, but also as a tool for ensuring user interfaces behave logically and consistently. Despite this, tools for designing user experiences and tools for creating and working with formal models are typically distinctly separate systems. This work aims to bridge this divide by allowing the generation of state machine diagrams and formal models via a simple, interactive prototyping tool that mirrors the basic functionality of many modern digital prototyping applications.
Our approach for modelling interactive systems has been to develop models for the interface and i... more Our approach for modelling interactive systems has been to develop models for the interface and interaction which are lightweight but with an underlying formal semantics. Combined with traditional formal methods to describe functional behaviour, this provides the ability to create a single formal model of interactive systems and consider all parts (functionality, user interface and interaction) with the same rigorous level of formality. The ability to convert the different models we use from one notation to another has given us a set of models which describe an interactive system (or parts of that system) at different levels of abstraction in ways most suitable for the domain but which can be combined into a single model for model-checking, theorem proving etc. There are, however, many benefits to using the individual models for different purposes throughout the development process. In this chapter we provide examples of this using the nuclear power plant control system as an example.
Building models of safety-critical interactive systems (in healthcare, transport, avionics and fi... more Building models of safety-critical interactive systems (in healthcare, transport, avionics and finance, to name but a few) as part of the design process is essential. It is also advised for non-safety critical interactive systems if we want to be certain they will behave as intended in all circumstances. However, modelling interactive systems is also challenging. The levels of complexity in modern user interfaces and the wealth of interaction possibilities means that modelling at a suitable level of abstraction is crucial to ensure our models remain reasonably sized, readable, and therefore usable. The decisions we make about how to abstract the system to retain enough detail to be able to reason about it without running into known modelling problems (state-explosion, verbosity, unreadability) are complex, even for experienced modellers. We have identified a number of commonly seen problems in such models based on occurrences of common properties of interactive systems, and in order to help both experienced and novice modellers we propose modelpatterns as a solution to this.
We show how a theory of specification refinement and program development can be constructed as a ... more We show how a theory of specification refinement and program development can be constructed as a conservative extension of our existing logic for Z. The resulting system can be set up as a development method for Z, or as a generalisation of a refinement calculus (with a novel semantics). In addition to the technical development we illustrate how the theory can be used in practice.
2015 11th European Dependable Computing Conference (EDCC), 2015
Building secure applications requires significant expertise. Secure platforms and security patter... more Building secure applications requires significant expertise. Secure platforms and security patterns have been proposed to alleviate this problem. However, correctly applying patterns to use platform features is still highly expertisedependent. Patterns are informal and there is a gap between them and platform features. We propose the concept of reusable verified design fragments, which package security patterns and platform features and are verified to provide assurance about their security properties. Design fragments can be composed through four primitive tactics. The verification of the composed design against desired security properties is presented in an assurance case. We demonstrate our approach by securing a Continuous Deployment pipeline and show that the tactics are sufficient to compose design fragments into a secure system. Finally, we formally define composition tactics, which are intended to support the development of systems that are secure by construction.
We provide an introduction to the specification language Z from a logical perspective. The possib... more We provide an introduction to the specification language Z from a logical perspective. The possibility of presenting Z in this way is a consequence of a number of joint publications on Z logic that Henson and Reeves have co-written since 1997. We provide an informal as well as a formal introduction to Z logic and show how it may be used, and extended, to investigate issues such as equational logic, the logic of preconditions, operation and data refinement, and monotonicity.
ABSTRACT The 16th BCS-FACS Refinement Workshop was co-located with iFM 2013 held in Turku, Finlan... more ABSTRACT The 16th BCS-FACS Refinement Workshop was co-located with iFM 2013 held in Turku, Finland on June 11th, 2013. This volume contains the 6 papers selected for presentation at the workshop following a peer review process. The papers cover a wide range of topics in the theory and application of refinement. Refinement is one of the cornerstones of a formal approach to software engineering: the process of developing a more detailed design or implementation from an abstract specification through a sequence of mathematically-based steps that maintain correctness with respect to the original specification.
In this paper we show, by a series of examples, how the-chart formalism can be translated into Z.... more In this paper we show, by a series of examples, how the-chart formalism can be translated into Z. We give reasons for why thisan interesting and sensible thing to do and what it might be used for. 1 IntroductionIn this paper we show, by a series of examples, how the-chart formalism (asgiven in [9]) can be translated into Z. We also discuss why this is a useful andinteresting thing to do and give some examples of work that might be done inthe future in this area which combines Z and-charts. It might seem obvious that we should simply ...
Formal modelling is now widely applied for creating models of safety-critical interactive systems... more Formal modelling is now widely applied for creating models of safety-critical interactive systems. Most approaches built so far either focus on the user interface or on the functional part of a safety-critical interactive system. This paper aims to apply formal methods for modelling and specifying the user interface, interaction and functional aspects of a safety-critical system in a single model using Coloured Petri Nets (CPN). We have used CPNs because of its expressive graphic representation and the ability to simulate the system behaviour. The technique is illustrated through a case study of the Niki T34 Infusion Pump.
This paper presents an idiomatic construct for-charts which reflects the high-level specification... more This paper presents an idiomatic construct for-charts which reflects the high-level specification construct of synchronization between activities. This, amongst others, has emerged as a common and useful idea during our use of-charts to design and specify commonly-occurring reactive systems. The purpose of this example, apart from any inherent interest in being able to use synchronization in a specification, is to show how the very simple language ofcharts can used as a basis for a more expressive language built by definitional extension. 2. The basics of-charts Here we give a short introduction to the syntax and semantics of-charts. However, anyone familiar with finitestate machines will find them very familiar and easy to understand, the only significant extension being that of states which are themselves charts. Consider the upper chart in Figure 1. The chart's name Example appears in the top left-hand corner of the rectangle which delineates the chart. The double-walled oval named A is an atomic state which is also the initial state of Example. The rectangle B is another state of Example except that this time B is a state which has extra structure: it
For validation or for communication with a client, it is useful to create a visualisation of a sp... more For validation or for communication with a client, it is useful to create a visualisation of a specification. It is important that the visualisation does not mislead the user. In this work we look at how to characterise the conditions for a micro-chart visualisation to be sound. This is done by introducing a new operator to the micro-chart semantics, allowing us to use Z data refinement to find a refinement relation between a Z specification and its (claimed sound) micro-chart visualisation. If the relation does not hold, then the visualisation is not sound.
Before we combine actions and probabilities two very obvious questions should be asked. Firstly, ... more Before we combine actions and probabilities two very obvious questions should be asked. Firstly, what does “the probability of an action ” mean? Secondly, how does probability interact with nonde-terminism? Neither question has a single universally agreed upon answer but by considering these questions at the outset we build a novel and hopefully intuitive probabilistic event-based formalism. In previous work we have characterised refinement via the notion of testing. Basically, if one system passes all the tests that another system passes (and maybe more) we say the first system is a refinement of the second. This is, in our view, an important way of characterising refinement, via the question “what sort of refinement should I be using?” We use testing in this paper as the basis for our refinement. We develop tests for probabilistic systems by analogy with the tests developed for non-probabilistic systems. We make sure that our probabilistic tests, when performed on non-probabilisti...
To gain confidence in safety-critical interactive systems, formal modelling and analysis plays a ... more To gain confidence in safety-critical interactive systems, formal modelling and analysis plays a vital role. The aim of this paper is to use Coloured Petri Nets to model and analyze safety-critical interactive systems. We present a technique to construct a single Coloured Petri Net model of the user interface, interaction and functionality of safety-critical interactive systems and then analyze the achieved Coloured Petri Net model using a state space analysis method. There are several reasons for using Coloured Petri Nets. Coloured Petri Nets provides a graphical representation and hierarchical structuring mechanism, and a state space verification technique, which allows querying the state space to investigate behaviours of a system. There are several tools that supports Coloured Petri Nets including the CPN Tool which helps in building CPN models and allows simulation and analysis using state spaces. The technique to model and analyze safety-critical interactive systems is illustrated using a simplified infusion pump example.
We define interacting sequential programs, motivated originally by constructivist considerations.... more We define interacting sequential programs, motivated originally by constructivist considerations. We use them to investigate notions of implementation and determinism. Process algebras do not define what can be implemented and what cannot. As we demonstrate it is problematic to do so on the set of all processes. Guided by constructivist notions we have constructed interacting sequential programs which we claim can be readily implemented and are a subset of processes.
Electronic Proceedings in Theoretical Computer Science, 2018
Creating formal models of interactive systems has wide reaching benefits, not only for verifying ... more Creating formal models of interactive systems has wide reaching benefits, not only for verifying lowlevel correctness, but also as a tool for ensuring user interfaces behave logically and consistently. Despite this, tools for designing user experiences and tools for creating and working with formal models are typically distinctly separate systems. This work aims to bridge this divide by allowing the generation of state machine diagrams and formal models via a simple, interactive prototyping tool that mirrors the basic functionality of many modern digital prototyping applications.
Our approach for modelling interactive systems has been to develop models for the interface and i... more Our approach for modelling interactive systems has been to develop models for the interface and interaction which are lightweight but with an underlying formal semantics. Combined with traditional formal methods to describe functional behaviour, this provides the ability to create a single formal model of interactive systems and consider all parts (functionality, user interface and interaction) with the same rigorous level of formality. The ability to convert the different models we use from one notation to another has given us a set of models which describe an interactive system (or parts of that system) at different levels of abstraction in ways most suitable for the domain but which can be combined into a single model for model-checking, theorem proving etc. There are, however, many benefits to using the individual models for different purposes throughout the development process. In this chapter we provide examples of this using the nuclear power plant control system as an example.
Building models of safety-critical interactive systems (in healthcare, transport, avionics and fi... more Building models of safety-critical interactive systems (in healthcare, transport, avionics and finance, to name but a few) as part of the design process is essential. It is also advised for non-safety critical interactive systems if we want to be certain they will behave as intended in all circumstances. However, modelling interactive systems is also challenging. The levels of complexity in modern user interfaces and the wealth of interaction possibilities means that modelling at a suitable level of abstraction is crucial to ensure our models remain reasonably sized, readable, and therefore usable. The decisions we make about how to abstract the system to retain enough detail to be able to reason about it without running into known modelling problems (state-explosion, verbosity, unreadability) are complex, even for experienced modellers. We have identified a number of commonly seen problems in such models based on occurrences of common properties of interactive systems, and in order to help both experienced and novice modellers we propose modelpatterns as a solution to this.
We show how a theory of specification refinement and program development can be constructed as a ... more We show how a theory of specification refinement and program development can be constructed as a conservative extension of our existing logic for Z. The resulting system can be set up as a development method for Z, or as a generalisation of a refinement calculus (with a novel semantics). In addition to the technical development we illustrate how the theory can be used in practice.
2015 11th European Dependable Computing Conference (EDCC), 2015
Building secure applications requires significant expertise. Secure platforms and security patter... more Building secure applications requires significant expertise. Secure platforms and security patterns have been proposed to alleviate this problem. However, correctly applying patterns to use platform features is still highly expertisedependent. Patterns are informal and there is a gap between them and platform features. We propose the concept of reusable verified design fragments, which package security patterns and platform features and are verified to provide assurance about their security properties. Design fragments can be composed through four primitive tactics. The verification of the composed design against desired security properties is presented in an assurance case. We demonstrate our approach by securing a Continuous Deployment pipeline and show that the tactics are sufficient to compose design fragments into a secure system. Finally, we formally define composition tactics, which are intended to support the development of systems that are secure by construction.
We provide an introduction to the specification language Z from a logical perspective. The possib... more We provide an introduction to the specification language Z from a logical perspective. The possibility of presenting Z in this way is a consequence of a number of joint publications on Z logic that Henson and Reeves have co-written since 1997. We provide an informal as well as a formal introduction to Z logic and show how it may be used, and extended, to investigate issues such as equational logic, the logic of preconditions, operation and data refinement, and monotonicity.
ABSTRACT The 16th BCS-FACS Refinement Workshop was co-located with iFM 2013 held in Turku, Finlan... more ABSTRACT The 16th BCS-FACS Refinement Workshop was co-located with iFM 2013 held in Turku, Finland on June 11th, 2013. This volume contains the 6 papers selected for presentation at the workshop following a peer review process. The papers cover a wide range of topics in the theory and application of refinement. Refinement is one of the cornerstones of a formal approach to software engineering: the process of developing a more detailed design or implementation from an abstract specification through a sequence of mathematically-based steps that maintain correctness with respect to the original specification.
In this paper we show, by a series of examples, how the-chart formalism can be translated into Z.... more In this paper we show, by a series of examples, how the-chart formalism can be translated into Z. We give reasons for why thisan interesting and sensible thing to do and what it might be used for. 1 IntroductionIn this paper we show, by a series of examples, how the-chart formalism (asgiven in [9]) can be translated into Z. We also discuss why this is a useful andinteresting thing to do and give some examples of work that might be done inthe future in this area which combines Z and-charts. It might seem obvious that we should simply ...
Uploads
Papers by Steve Reeves