Incomputer science,formal methods aremathematically rigorous techniques for thespecification, development,analysis, andverification ofsoftware andhardware systems.[1] The use of formal methods for software and hardware design is motivated by the expectation that, as in other engineering disciplines, performing appropriate mathematical analysis can contribute to the reliability and robustness of a design.[2]
Formal methods employ a variety oftheoretical computer science fundamentals, includinglogic calculi,formal languages,automata theory,control theory,program semantics,type systems, andtype theory.[3]
Formal methods can be applied at various points through thedevelopment process.
Formal methods may be used to give a formal description of the system to be developed, at whatever level of detail desired. Further formal methods may depend on this specification to synthesize a program or to verify the correctness of a system.
Alternatively, specification may be the only stage in which formal methods is used. By writing a specification, ambiguities in the informal requirements can be discovered and resolved. Additionally, engineers can use a formal specification as a reference to guide their development processes.[4]
The need for formal specification systems has been noted for years. In theALGOL 58 report,[5]John Backus presented a formal notation for describingprogramming language syntax, later namedBackus normal form then renamedBackus–Naur form (BNF).[6] Backus also wrote that a formal description of the meaning of syntactically valid ALGOL programs was not completed in time for inclusion in the report, stating that it "will be included in a subsequent paper." However, no paper describing the formal semantics was ever released.[7]
Program synthesis is the process of automatically creating a program that conforms to a specification. Deductive synthesis approaches rely on a complete formal specification of the program, whereas inductive approaches infer the specification from examples. Synthesizers perform a search over the space of possible programs to find a program consistent with the specification. Because of the size of this search space, developing efficient search algorithms is one of the major challenges in program synthesis.[8]
Formal verification is the use of software tools to prove properties of a formal specification, or to prove that a formal model of a systemimplementation satisfies its specification.
Once a formal specification has been developed, the specification may be used as the basis forproving properties of the specification, and by inference, properties of the system implementation.
Sign-off verification is the use of a formal verification tool that is highly trusted. Such a tool can replace traditional verification methods (the tool may even be certified).[citation needed]
Sometimes, the motivation for proving thecorrectness of a system is not the obvious need for reassurance of the correctness of the system, but a desire to understand the system better. Consequently, some proofs of correctness are produced in the style ofmathematical proof: handwritten (or typeset) usingnatural language, using a level of informality common to such proofs. A "good" proof is one that is readable and understandable by other human readers.
Critics of such approaches point out that theambiguity inherent in natural language allows errors to be undetected in such proofs; often, subtle errors can be present in the low-level details typically overlooked by such proofs. Additionally, the work involved in producing such a good proof requires a high level of mathematical sophistication and expertise.
In contrast, there is increasing interest in producing proofs of correctness of such systems by automated means. Automated techniques fall into three general categories:
Someautomated theorem provers require guidance as to which properties are "interesting" enough to pursue, while others work without human intervention. Model checkers can quickly get bogged down in checking millions of uninteresting states if not given a sufficiently abstract model.
Proponents of such systems argue that the results have greater mathematical certainty than human-produced proofs, since all the tedious details have been algorithmically verified. The training required to use such systems is also less than that required to produce good mathematical proofs by hand, making the techniques accessible to a wider variety of practitioners.
Critics note that some of those systems are likeoracles: they make a pronouncement of truth, yet give no explanation of that truth. There is also the problem of "verifying the verifier"; if the program that aids in the verification is itself unproven, there may be reason to doubt the soundness of the produced results. Some modern model checking tools produce a "proof log" detailing each step in their proof, making it possible to perform, given suitable tools, independent verification.
The main feature of the abstract interpretation approach is that it provides a sound analysis, i.e. no false negatives are returned. Moreover, it is efficiently scalable, by tuning the abstract domain representing the property to be analyzed, and by applying widening operators[9] to get fast convergence.
![[icon]](/mt/?noimg=&dark=on&url=https%3a%2f%2fwikipedia.org%2fwiki%2fFile%3aWiki_letter_w_cropped.svg) | This sectionneeds expansion. You can help byadding to it.(June 2024) |
Formal methods includes a number of different techniques.
The design of a computing system can be expressed using a specification language, which is a formal language that includes a proof system. Using this proof system, formal verification tools can reason about the specification and establish that a system adheres to the specification.[10]
A binary decision diagram is a data structure that represents aBoolean function.[11] If a Boolean formula expresses that an execution of a program conforms to the specification, a binary decision diagram can be used to determine if is a tautology; that is, it always evaluates to TRUE. If this is the case, then the program always conforms to the specification.[12]
A SAT solver is a program that can solve theBoolean satisfiability problem, the problem of finding an assignment of variables that makes a given propositional formula evaluate to true. If a Boolean formula expresses that a specific execution of a program conforms to the specification, then determining that is unsatisfiable is equivalent to determining that all executions conform to the specification. SAT solvers are often used in bounded model checking, but can also be used in unbounded model checking.[13]
Formal methods are applied in different areas of hardware and software, includingrouters,Ethernet switches,routing protocols, security applications, andoperating systemmicrokernels such asseL4. There are several examples in which they have been used to verify the functionality of the hardware and software used indata centres.IBM usedACL2, a theorem prover, in theAMD x86 processor development process.[citation needed] Intel uses such methods to verify its hardware andfirmware (permanent software programmed into aread-only memory)[citation needed].Dansk Datamatik Center used formal methods in the 1980s to develop a compiler system for theAda programming language that went on to become a long-lived commercial product.[14][15]
There are several other projects ofNASA in which formal methods are applied, such asNext Generation Air Transportation System[citation needed], Unmanned Aircraft System integration in National Airspace System,[16] and Airborne Coordinated Conflict Resolution and Detection (ACCoRD).[17]B-Method withAtelier B,[18] is used to develop safety automatisms for the various subways installed throughout the world byAlstom andSiemens, and also forCommon Criteria certification and the development of system models byATMEL andSTMicroelectronics.
Formal verification has been frequently used in hardware by most of the well-known hardware vendors, such as IBM,Intel, and AMD. There are many areas of hardware, where Intel have used formal methods to verify the working of the products, such as parameterized verification of cache-coherent protocol,[19] Intel Core i7 processor execution engine validation[20] (using theorem proving,BDDs, and symbolic evaluation), optimization for Intel IA-64 architecture using HOL light theorem prover,[21] and verification of high-performance dual-portgigabit Ethernetcontroller with support forPCI express protocol and Intel advance management technology using Cadence.[22] Similarly, IBM has used formal methods in the verification of power gates,[23] registers,[24] and functional verification of the IBM Power7 microprocessor.[25]
Insoftware development, formal methods are mathematical approaches to solving software (and hardware) problems at the requirements, specification, and design levels. Formal methods are most likely to be applied to safety-critical or security-critical software and systems, such asavionics software. Software safety assurance standards, such asDO-178C allows the usage of formal methods through supplementation, andCommon Criteria mandates formal methods at the highest levels of categorization.
For sequential software, examples of formal methods include theB-Method, the specification languages used inautomated theorem proving,RAISE, and theZ notation.
Infunctional programming,property-based testing has allowed the mathematical specification and testing (if not exhaustive testing) of the expected behaviour of individual functions.
TheObject Constraint Language (and specializations such asJava Modeling Language) has allowed object-oriented systems to be formally specified, if not necessarily formally verified.
For concurrent software and systems,Petri nets,process algebra, andfinite-state machines (which are based onautomata theory; see alsovirtual finite state machine orevent driven finite state machine) allow executable software specification and can be used to build up and validate application behaviour.
Another approach to formal methods in software development is to write a specification in some form of logic—usually a variation offirst-order logic—and then to directly execute the logic as though it were a program. TheOWL language, based ondescription logic, is an example. There is also work on mapping some version of English (or another natural language) automatically to and from logic, as well as executing the logic directly. Examples areAttempto Controlled English, and Internet Business Logic, which do not seek to control the vocabulary or syntax. A feature of systems that support bidirectional English–logic mapping and direct execution of the logic is that they can be made to explain their results, in English, at the business or scientific level.[citation needed]
Semi-formal methods are formalisms and languages that are not considered fully "formal". It defers the task of completing the semantics to a later stage, which is then done either by human interpretation or by interpretation through software like code or test casegenerators.[26]
Some practitioners believe that the formal methods community has overemphasized full formalization of a specification or design.[27][28] They contend that theexpressiveness of the languages involved, as well as the complexity of the systems being modelled, make full formalization a difficult and expensive task. As an alternative, variouslightweight formal methods, which emphasize partial specification and focused application, have been proposed. Examples of this lightweight approach to formal methods include theAlloy object modelling notation,[29] Denney's synthesis of some aspects of theZ notation withuse case driven development,[30] and the CSKVDM Tools.[31]
There are a variety of formal methods and notations available.
Many problems in formal methods areNP-hard, but can be solved in cases arising in practice. For example, the Boolean satisfiability problem isNP-complete by theCook–Levin theorem, butSAT solvers can solve a variety of large instances. There are "solvers" for a variety of problems that arise in formal methods, and there are many periodic competitions to evaluate the state-of-the-art in solving such problems.[33]
{{cite journal}}:Cite journal requires|journal= (help)
