36419235
CICS Project Report: Experiences and Results from the use of Z in IBM
This paper describes some experiences and results arising from the use of Z in two major projects at the Hursley Park laboratory of IBM 1 United Kingdom Laboratories Ltd. The first project involved the use of Z in the development of a major new release of IBM's transaction processing system CICS 1 (Customer Information Control System), while the second project is a more recent one, concerning the formal specification of the CICS Application Programming Interface (API). The version of CICS which used Z in its development process was released to selected customers on an Early Support Programme in June 1989, and was made generally available in June 1990. Many process measurements were made during the development of the product, and early results show an encouraging improvement in quality, particularly in the parts of the release that were formally specified. The API specification project involved the description of an already existing interface, currently described informally in various manuals in the CICS library. Since this is purely a specification project, no figures are available for the success of the work in terms of reduction of errors, but the motivation for and experiences from the work are described below. Thus this report concentrates on describing results from the use of Z for the development of the CICS product, and experiences from the use of Z for the specification of the CICS API.
206586397
Extending Ravenscar with CSP Channels
The Ravenscar Profile is a restricted subset of the Ada tasking model, designed to meet the requirements of producing analysable and deterministic code. A central feature of Ravenscar is the use of protected objects to ensure mutually exclusive access to shared data. This paper uses Ravenscar protected objects to implement CSP channels in Ada – the proposed implementation is formally verified using model checking. The advantage of these Ravenscar channels is transforming the data-oriented asynchronous tasking model of Ravenscar into the cleaner message-passing synchronous model of CSP. Thus, formal proofs and techniques for model-checking CSP specifications can be applied to Ravenscar programs. In turn, this increases confidence in these programs and their reliability. Indeed, elsewhere, we use the proposed Ravenscar channels as the basis for a cost-effective technique for verifying concurrent safety-critical system.
13998805
Using the SPARK Toolset for Showing the Absence of Run-Time Errors in Safety-Critical Software
This paper reports the results of a study into the effectiveness of the SPARK toolset for showing the absence of run-time errors in safety-critical Ada software. In particular, the toolset is examined to determine how effective it is in finding run-time errors in a SPARK program, and how much of the process of proving freedom from run-time errors can be performed automatically. The study identifies areas where automatic run-time checks are not so effective and, where possible, gives recommendations about the design of the software so that the toolset is as effective as possible in automatically proving absence of run-time errors. 
 
The results will be of interest to anyone contemplating the use of the SPARK toolset for ensuring the absence of run-time errors, both as guidance in planning the effort required, and for practical advice on making the best use of the toolset.
35771145
The Value of Verification: Positive Experience of Industrial Proof
This paper describes the use of formal development methods on an industrial safety-critical application. The Z notation was used for documenting the system specification and part of the design, and the SPARK subset of Ada was used for coding. However, perhaps the most distinctive nature of the project lies in the amount of proof which was carried out: proofs were carried out both at the Z level -- approximately 150 proofs in 500 pages--and at the SPARK code level--approximately 9000 verification conditions generated and discharged. The project was carried out under UK Interim Defence Standards 00-55 and 00-56, which require the use of formal methods on safety-critical applications. It is believed to be the first to be completed against the rigorous demands of the 1991 version of these standards. 
 
The paper includes a comparison of proof with the various types of testing employed, in terms of their efficiency at finding faults. The most striking result is that the Z proof was substantially more efficient at finding faults than the most efficient testing phase. Given the importance of early fault detection, this helps to demonstrate the significant benefit and practicality of large-scale proof on projects of this kind.
6299029
Ravenscar-Java: a high integrity profile for real-time Java
For many, Java is the antithesis of a high integrity programming language. Its combination of object-oriented programming features, its automatic garbage collection, and its poor support for real-time multi-threading are all seen as particular impediments. The Real-Time Specification for Java has introduced many new features that help in the real-time domain. However, the expressive power of these features means that very complex programming models can be created, necessitating complexity in the supporting real-time virtual machine. Consequently, Java, with the real-time extensions as they stand, seems too complex for confident use in high integrity systems. This paper presents a Java profile for the development of software-intensive high integrity real-time systems. This restricted programming model removes language features with high overheads and complex semantics, on which it is hard to perform timing and functional analyses. The profile fits within the J2ME framework and is consistent with well-known guidelines for high integrity software development, such as those defined by the U.S. Nuclear Regulatory Commission.
2013482
Is Proof More Cost-Effective Than Testing?
The paper describes the use of formal development methods on an industrial safety-critical application. The Z notation was used for documenting the system specification and part of the design, and the SPARK subset of Ada was used for coding. However, perhaps the most distinctive nature of the project lies in the amount of proof that was carried out: proofs were carried out both at the Z level (approximately 150 proofs in 500 pages) and at the SPARK code level (approximately 9000 verification conditions generated and discharged). The project was carried out under UK Interim Defence Standards 00-55 and 00-56, which require the use of formal methods on safety-critical applications. It is believed to be the first to be completed against the rigorous demands of the 1991 version of these standards. The paper includes comparisons of proof with the various types of testing employed, in terms of their efficiency at finding faults. The most striking result is that the Z proof appears to be substantially more efficient at finding faults than the most efficient testing phase. Given the importance of early fault detection, we believe this helps to show the significant benefit and practicality of large-scale proof on projects of this kind.
172433042
Paradox 1.1: more power and less pain
61999192
Dataflex multi-user features
181027586
High-speed thrills
63453716
A database program generator for Turbo Pascal
173123777
What's new in DataFlex 2.2