New Opportunities for Integrated Formal Methods

Abstract

Formal methods have provided approaches for investigating software engineering fundamentals and also have high potential to improve current practices in dependability assurance. In this article, we summarise known strengths and weaknesses of formal methods. From the perspective of the assurance of robots and autonomous systems (RAS), we highlight new opportunities for integrated formal methods and identify threats to the adoption of such methods. Based on these opportunities and threats, we develop an agenda for fundamental and empirical research on integrated formal methods and for successful transfer of validated research to RAS assurance. Furthermore, we outline our expectations on useful outcomes of such an agenda. AcronymsAI artificial intelligence ASIL automotive safety integrity level DA dependability assurance DAL design assurance level DSE dependable systems engineering DSL domain-specific language FDA Food and Drug Administration FI formal inspection FM formal method HCI human-computer interaction iFM integrated formal method IT information technology MBD model-based development MDE model-driven engineering ML machine learning RAS robots and autonomous systems RCA root cause analysis RE requirements engineering SACM Structured Assurance Case Meta-model SC systematic capability SIL safety integrity level SMT Satisfiability Modulo Theory SWOT strengths, weaknesses, opportunities, and threats SysML Systems Modelling Language UML Unified Modelling Language UTP Unifying Theories of ProgrammingWe view robots and autonomous systems as both dependable systems and highly automated machines capable of achieving a variety of complex tasks in support of humans. We can consider such systems by looking at four layers: the plant or process composed of the operational environment and the machine; the machine itself; the machine's controller, and the software embedded into this controller. Based on these layers, we treat "embedded system" and "embedded software" as synonyms. Machine, controller, and software can all be distributed.By dependable systems engineering, we refer to error-avoidance and error-detection activities in control system and embedded software development (e.g. according to the V-model). Avizienis et al.[7] devised a comprehensive terminology and an overview of the assessment and handling of a variety of faults, errors, and failures. For critical systems, such activities are expected to be explicit (e.g. traceable, documented), to employ best practices (e.g. design patterns), and to be driven by reasonably qualified personnel (e.g. well-trained and experienced engineers or programmers).The need for dependability often arises from the embedding of software into a cyber-physical context (i.e., an electronic execution platform, a physical process to be controlled, and other systems or human users to interact with). Dependability assurance (DA), or assurance for short, encompasses the usually cross-disciplinary task of providing evidence for an assurance case (e.g. safety, security, reliability) for a sys...

Evolution of Formal Model-Based Assurance Cases for Autonomous Robots

“…Our framework is based on Isabelle/UTP whose semantic foundations allow one to express the system model for the construction of the assurance case in various but precisely linked formalisms, for example, relations and dL. This linking, paramount to the engineering of many critical systems [14], enables the step-wise refinement of the system model including data refinement and the simultaneous extension of an existing assurance case, resulting in an evolved assurance case readjusting or increasing the level of confidence of the argument. In [15], we discuss how model-based engineering can accommodate the way how innovation typically drives the evolution of requirements and designs.…”

Isabelle/SACM: Computer-Assisted Assurance Cases with Integrated Formal Methods

“…We recently demonstrated formal verification facilities for a statechart-like notation [12,13], and are also working towards tools to support hybrid dynamical languages [15] like Modelica and Simulink. Our overarching goal is a comprehensive assurance framework supported by a variety of integrated formal methods in order to support complex certification tasks for cyber-physical systems such as autonomous robots [18,19].…”

“…Despite its age, we see Tokeneer as a highly relevant benchmark specification, particularly since it is one of the grand challenges of the "Verified Software Initiative" [33]. As we have argued elsewhere [19], such benchmarks allow us to conduct objective analyses of assurance techniques to aid their transfer to other domains. The issues highlighted in [34] are systematic design problems that can be fixed by a change of the benchmark (e.g.…”

“…Consequently, ACs usually combine informal and formal content, and so tools must support this. Moreover, there is a need to integrate several FMs [26], potentially with differing computational paradigms and levels of abstraction [22], and so it is necessary to manage the resulting heterogeneity [19].…”

Skill-Based Verification of Cyber-Physical Systems

“…We illustrate informal safety guarantees for the three skills s 1 , s 6 , and s 9 . elimination of severe mistakes [9], there is still a remarkable lack of formal methods integrated in the software development cycle [16,17]. The challenge is to derive modeling and verification approaches that are applicable in the early development stages (e.g., requirements analysis and design time).…”