Formal Verification of a Space System's User Interface With the IVY Workbench

Abstract

This paper describes the application of the IVY workbench to the formal analysis of a user interface for a safetycritical aerospace system. The operations manual of the system was used as a requirements document and this made it possible to build a reference model of the user interface, focusing on navigation between displays, the information provided by each display and how they are interrelated. Usability related property specification patterns were then used to derive relevant properties for verification. This paper discusses both the modeling strategy and the analytical results found using the IVY workbench. The purpose of the reference model is to provide a standard against which future versions of the interface may be assessed. a senior researcher at HASLab/INESC TEC, in Braga, Portugal. His research focuses on the application of software engineering techniques and tools to the modeling and analysis of interactive systems, aiming at bringing closer the software engineering and human-computer interaction (HCI) fields. Besides leading the development of the IVY workbench, current and recent funded research includes applying model-based testing to user interfaces, prototyping ambience intelligence systems using virtual reality simulations, and reverse engineering user interfaces.

Ivy 2

“…IVY is a model-based interactive computing systems analysis tool, based on the NuSMV model checker. The tool has successfully been applied in a number of different contexts, from aerospace systems [3] to medical devices [12].…”

Verification of User Interface Software: The Example of Use-Related Safety Requirements and Programmable Medical Devices

“…To ease the modeling process, a first order notation oriented around actions was used to describe user actions that were provided by the infusion pump. The notation that was used [modal action logic (MAL)], and its mapping to SMV and analysis using NuSMV is supported by the IVY tool [7], [34]. MAL is a simple state transition language, easily translated from state transition diagrams or the SCR tabular format [21].…”

The MAL Interactors Animator

“…Recent examples of using formal reasoning tools to analyse system designs include the use of model checking to support the safety analysis of the control logic for a neonatal haemodialysis machine [9], the user interfaces of components of a satellite launch system [1], clinical infusion devices [8] as well as the use of theorem proving in similar contexts, for example [10].…”

“…IVY is a model based tool for the analysis of interactive systems. The tool has been used in the automotive domain [2], for space systems [1] and for medical devices [9]. IVY adopts a plugin based architecture to support experimentation with dierent functionalities and features.…”