Mondex , an electronic purse: specification and refinement checks with the Alloy model-finding method

Abstract

This paper explains how the Alloy model-finding method has been used to check the specification of an electronic purse (also called smart card) system, called the Mondex case study, initially written in Z. After describing the payment protocol between two electronic purses, and presenting an overview of the Alloy model-finding method, this paper explains how technical issues about integers and conceptual issues about the object layout in Z have been tackled in Alloy, giving general methods that can be used in most case studies with Alloy. This work has also pointed out some significant bugs in the original Z specification such as reasoning bugs in the proofs, and proposes a way to solve them.

On challenges of model transformation from UML to Alloy

“…On the other hand our study presented in Section 8 is used as a proof of concept for our UML2Alloy transformation and it is using concepts such as UML class diagrams and OCL, which are more familiar to the average software developer. Another study, which has successfully used Alloy to model secure systems, was conducted by Ramananandro [41]. The author exposed defects in the Z specification of a smart card system, by translating it to Alloy.…”

Formal Versus Agile: Survival of the Fittest

“…However, Alloy has been shown to scale up to larger, more realistic problems. For example, it has been used to model the Mondex electronic purse, 18 a real product in the banking world, where security is paramount.…”

A Systematic Verification Approach for Mondex Electronic Purses Using ASMs

“…Their results will all be published in [CJ07] 9 : [TR06] demonstrates that Alloy and bounded model checking can find all the problems we found and one more in the proof structure we did not use. The RAISE development in [HGS06] shows an interesting alternative to develop the protocol: it starts with a send and receive instead of a transfer operation (our ASTEP#).…”