See also: Method

In Data-processing, the formal methods are techniques making it possible to reason rigorously, using Logique mathematics, on computer programs, or electronic materials, in order to show their validity compared to some specification.

These methods make it possible to obtain a very strong insurance of the absence of bug in the Logiciel S, i.e. high Niveaux of evaluation of insurance.

These techniques are based on the semantic S of the programs, i.e. on formal mathematical descriptions of the direction of a program given by its Source code (or sometimes, its Object code).

However, they are generally expensive in resources (human and material) and currently reserved for the software most critical. Their improvement and the widening of their fields of application practices are the motivation many scientific research in data processing.

Example

Everyone knows the equality $(a+b)^2\; =\; a^2\; +\; b^2\; +\; 2ab$. How to check that this equality is right?

By traditional checking, it would be necessary to take all the possible values of $a$, to cross them with all the possible values of $b$, and for each couple, to calculate $(a+b)^2$, then $a^2\; +\; b^2\; +\; 2ab$, and to make sure that one obtains the same result. Of course, if the fields of $a$ and $b$ are large, this checking can be very long. And if the fields are infinite (for example realities), this checking is infinite.

By formal checking, one uses only values symbolic systems and one observes known rules. Here, the known rules would be:

• $\backslash \; forall\; X,\; x^2\; =\; X\; *\; x$
• $\backslash \; forall\; X,\; there,\; Z,\; X\; *\; (there\; +\; Z)\; =\; x*y\; +\; x*z$
• $\backslash \; forall\; X,\; there,\; x*y\; =\; y*x$
• $\backslash \; forall\; X,\; X\; +\; X\; =\; 2x$
• $\backslash \; forall\; X,\; there,\; X\; +\; there\; =\; there\; +\; X$

While being useful of these rules and on the basis of $(a+b)^2$, one easily manages to find $a^2\; +\; b^2\; +\; 2ab$.

Various techniques

The checking includes/understands several techniques, often complementary.

• the Démonstration of theorems is a technique often little automated which consists in rewriting formulas by using a whole of known rules as well as the induction.

• BDD S (for Binary Decision Diagrams), are representations of Booléennes formulas. BDDs have the advantage of being sometimes exponentially more compact than the explicit formulas than they represent. They are more canonical. This representation is especially used for the formal checking applied to the digital circuits.
• SAT is a rather general term to indicate a whole of methods aiming at solving the problem of satisfaisability. However the majority of the problems of formal checking are connected with the problem of satisfaisability.

Categories

Various mathematical corpora were used to work out formal reasoning on the software. This diversity of approach generated “families” of formal methods. In particular let us quote (“the methods based on…” ):

• the Model checking exhaustively analyzes the evolution of the system during its possible executions. For example, to show the absence of errors to the execution, one will be able to test the absence of states of error in the whole of the states accessible from the system. It is then about a form of Test (data-processing) exhaustive, but carried out using astute algorithms making it possible to enumerate the states of the system in an economic form symbolic system. In general, it is not possible to analyze the system directly, but one analyzes rather of it a data-processing model , more or less abstract compared to reality (see also abstract Interprétation). In the recent evolutions of the software model-checking , the analyzer can automatically enrich the model to obtain some less abstract; evidence can be provided afterwards iterations of this process, which can not converge.

• the static Analysis by abstract Interpretation , schematically, symbolically calculates a superset of the states accessible from the system.

• the automatic proof of theorem tends automatically to show theorems on the logical formulas describing the semantics of the program.

• the assistants of proof make it possible the user to show Théorème S on the program, with a help (more or less large) and a checking by the machine.

There exist possible gradations and mixtures between these methods. For example, an assistant of proof could be sufficiently automated automatically to prove the majority of the Lemme S utilities of a proof of programs. A model-checker could be applied to a model built using an automatic prouvor of theorems. A preliminary abstract interpretation will be able to limit the number of cases to be shown in a proof of theorems, etc

The formal methods can apply at different stage of the development process of a system (software, electronic, mixed), specification until the final realization. See the example of the Method B.

Specification

The formal methods can be used to give a specification of the system which one wishes to develop, at the desired level of details. A formal specification of the system is based on a formal language whose semantics is well defined (contrary to a specification in natural language which can give place to various interpretations). This formal description of the system can be used as reference during the development. Moreover, it can be used to check (formally) that the final realization of the system (described in a dedicated data-processing language) respects initial waitings (in particular in term of functionality).

The need for the formal methods was felt for a long time. In the report/ratio ALGOL 60, John Backus presented a formal notation to describe the syntax of the computer programming languages (notation called Backus-Naur form, BNF).

Development

Once a specification was developed, it can be used as reference during the development of the concrete system (developed of the algorithms, realization in software and/or electronic circuit). For example:

• If the formal specification is equipped with an operational semantics, the behavior observed of the concrete system can be compared with the behavior of the specification (which itself must be able achievable or be simulated). Moreover, one such specification can be the subject of an automatic translation towards the target language.
• If the formal specification is equipped with an axiomatic semantics, the preconditions and postconditions of the specification can become assertions in the achievable code. These assertions can be used to check the correct operation of the system during its execution (or simulation), or better still of the static methods (proof of theorem, model-checking) can be used to check that these assertions will be satisfied for any execution with the system.

Checking

A specification can be used as bases to prove properties on the system. The specification is generally an abstract representation (with less details) of the system under development: removed from cumbersome details, it is in general simpler to prove properties on the specification than directly on the complete and concrete description of the system.

Certain methods, like the Method B, are based on this principle: the system is modelled on several levels of abstraction, on the basis of most abstract and going to most concrete (this process is called “refinement” since he adds details progressively); methodology ensures that all the properties proven on the abstract models are preserved on the concrete models. This guarantee is brought by a whole of evidence known as “of refinement”.

Formal evidences

The formal methods take all their interest when the evidence themselves is guaranteed correct formally. One can distinguish two main categories of tools allowing the proof of property on formal models:

• the automatic proof of theorem, which consists in letting the computer prove the properties automatically, being given a description of the system, a whole of axioms and a whole of rules of inférences. However the search for proof is known to be a problem not décidable in general (in traditional logic), i.e. one knows that there does not exist (and will exist never) any algorithm making it possible to decide in finished time if a property is true or false. There exist cases or the problem is décidable (fragment kept of first order logic for example) and where algorithms can thus be applied. However even in these cases, time and the essential resources so that the properties are checked can exceed acceptable times or the resources available to the computer. In this case there exist interactive tools which make it possible the user to guide the proof. The proof of theorem, compared to the model-checking, with the advantage of being independent of the size of the space of the states, and can thus apply to models with a very great number of state, where even on models of which the number of state is not given (generic models).
• the Model checking, which consists in checking properties by an exhaustive and astute enumeration (according to the algorithms) of the accessible states. The effectiveness of this technique depends in general on the size of the space of the accessible states and thus find its limits in the resources of the computer to handle the whole of the accessible states. Techniques of abstraction (possibly guided by the user) can be used to improve the effectiveness of the algorithms.

Formal or semi-formal methods

• Approach based on states
• Z to see Notation Z
• SAZ
• traditional Method B seeing Method B
• ASM
• TLA+

• Approach based on events

• Action Systems
• event-driven Method B to see Method B
• VHDL
• Estelle
• SDL
• E-LOTOS
• EB3

• Algebraic:

• Larch :Larch family
• CASL : Common Algebraic Specification Language

• Another approach

• Cock (software)
• Petri net
• Algebra of process

Principal tools

• Cock: assistant of assistance to proof (IE, formalization of evidence and semi-automated demonstration).

• special minutes: assistant of assistance to the proof.
• ACL2 : demonstration of theorems automated.
• SMV, NuSMV: demonstration of properties with BDDs and SAT.
• ZChaff : demonstration with SAT.
• Murφ : demonstration of properties.

See too

• formal Checking

• Evaluation Insurance Level

Reference

• Henri Habrias and Marc Frappier Software Specification Methods , ISTE Ltd, 2006, ISBN 1-905209-34-7

• Jean-François Monin Understanding Formal Methods , Springer, 2003, ISBN 1-85233-247-6

External bonds

• the international site of the formal methods, to see * The Formal site Methods Europe, to see

Random links:

Dong Zhuo | Haj Mohamed Benjelloun Touimi | Dick Huemer | Rajčevce | Morpho cypris | Mecque,_la_Californie