Formal Methods - Science topic

Thank you and I will familiarize myself more deeply. I admit that initially the work appears to me as interesting and inspiring. I also wonder what would happen if some aspects of multiplicity theory were replaced by category theory. I see some structural advantages in this theory over multiplicity theory.

Peter Breuer Thank you for your comment, he clarified, he pointed out the precise idea that I had in mind when I asked the question; This general theoretical question arose from a practical problem: the completion of (knowledge) graphs and the need to create an ontology, based on a set of axioms, to admit or reject new links (arcs) and objects (nodes). In fact, we are talking about a monotonic extension of the given original set.

In fact, the original set of statements is implicitly assumed to be consistent (nothing to say otherwise). But here's a small detail: speaking of "consistency" could be interpreted as assuming the existence of some kind of formal system. Probably the problem should be posed as emerging from a situation in which, there being some relation (binary, for simplicity), written (of course) in some formalized language (hence w.f.f.), representing a set of non-contradictory statements (here, not contradictory means the absence of a statement and its -semantically understood- negation).

And yes, the set of all statements is a (trivial) system of axioms.

As for the assumption of the presence of some kind of logic, it is not assumed. Here, significantly, it is relevant to take into account what is meant by logic; As far as I know, despite their historical and genetic relationships (in the sense of genesis), they are not synonymous, logic (syntactic approach) is (mainly) a kind of formal system.

Well, here I end my ramblings. Thanks for the comment.

For me some basic knowledge of formal systems is essential for undergraduate CS students, as this is a necessary part of the scientific education.

If not, you might still learn a lot about software construction, but you wouldn't know nor understand its bedrock.

The first ever formal model or can say a high level language for system specification is Transition System in paper "Formal Verification of Parallel Programs" written by Robert M. Keller Princeton University 1976. . This model was proposed to formally specify parallel programs. Many of the models emerged after it such as Automata Theory, Timed Automata, Hybrid Automata, Model Checking tools specific languages are based on the original labeled transition system (LTS). The new languages like HiLLS or Business Process Model and Notation from Object Management Group and many others are basically evolved from early LTS.

Define clearly the definition of Model Checking and its related definitions. Because mode checking is suite of concepts including type of models e.g. automata models or petri-nets, etc. The verification logic languages of a model-checker. First, take some model checkers on list and then see what are the different parts: model, engine, verification language, set of verification properties. Study each model checker and its each part in detail. See what each has edge over other, what types of application each can model, compare their performance and applicability. Case studies are helpful to understand tools practically.

.Thank you for your replay. I already have read those papers, what do you think of the role of machine learning or reinforcement learning? Are they effective for counter-example search?

Here's a simple dataset for RNN training; contains number of passengers in equal time spacing.

I think you will need to address the use of formal methods in the society of engineering before you can use the methods more broadly. I am familiar with these methods, and I am quite skeptical of their application as you suggest.

However, I do believe that there is merit to the development of mathematics in the description of social behaviors on the underlying biophysical basis. A step beyond the statistical analysis and game theory so far.

Hi,

Artificial Intelligence's is important for us to checking model theorem in traditional methods.

Regards

Modeling, simulation, verification, and validation can guaranty such systems. However, we should exactly state what sort of system we're talking about. What I understood you want to analyze the performance of a Machine Learning algorithm for a specific problems in such systems with formal verification. However, a machine learning algorithm itself can be used for formal verification; it starts analyzing the system as black box. It then can find the relations in the system to predict the performance of the system. By modeling and simulation, you can:

a-Analyze a system at scale

b-Predict the behaviour of the system with different confugrations and situations.

Last but not the least, at some point, it is neither possible to analyze a real system with different configurations nor the system is available.

G.L

Thanks everyone for your answers.

So, a little more background: I am working with some fixed "background" SMT theory T. The dependencies between constants defined in those are indeed rather trivial, but the set of formulas Phi I was talking about corresponds not to the theory itself, but to a problem formulation, e.g. input to an SMT solver. As such, it will indeed contain newly invented variables (or indeed, "constants" does seem to fit better in the SMT context) with non-trivial dependencies.

Furthermore, I am interested not only in the dependencies between such constants, but more complex terms and formulas made up of them as well. The definition easily extends to this case if you take "M(e)" for some (closed?) expression e to mean the semantic value of e in the model M, be it that e is a constant, or a function application, or a quantified formula.

I have been thinking about the details of the definition - so far I had assumed a fixed T-structure A and the "models M" were the variable assignments. As I want to fit the whole into the context of SMT, I am probably going to change that to work on constants and structures, most likely constraining the models in the class C to have the same universe.

But I do think the core idea of the definition is suitable, as I already have some useful results (which should survive the transition from variables to constants).

I will have a look at the book you suggested. Even if I do not find anything on automated analyses, it will at least give me some context and be relevant as related work.

Abstraction based controller synthesis solves control problems in three steps:

1. Computing an abstraction of the plant , and an abstract version of the specification, to obtain an auxiliary control problem (pair of abstraction, abstract specification).

2. Solving the abstract control problem, to obtain an abstract controller.

3. Refining the abstract controller to obtain a controller that solves the original control problem.

For details, please see the work

[1] Reissig, Weber and Rungger, Feedback Refinement Relations for the Synthesis of Symbolic Controllers, IEEE Trans Autom Control 2017,

That work assumes a discrete-time control problem and allows for static uncertainties of the environment, by modelling the plant as a difference inclusion,

x(t+1) \in F(x(t),u(t)), t \in \mathbb{Z}_+

If the uncertanties are dynamic, that dynamics must be made part of the plant. Feedback refinement relations have, to the best of my knowledge, not yet extended to that case.

I find this paper :

A Survey on Information Diffusion in Online Social

Networks: Models and Methods

there is some work on the intersection of CTL and LTL:

The Common Fragment of CTL and LTL, Monika Maidl

The Common Fragment of ACTL and LTL, Mikolaj Bojan ́czyk ⋆

Dear André,

do you remember some of the 2/3 of your thoughts which you thought in internal language? How do you do that?

Can you rethink them and discuss them internally? How do you do that?

Are among those thoughts some which cannot come into mind like a picture (because they are in some way more abstract)? How do you remember them, rethink them, and discuss them internally?

Hi Yasir,

Here are my concerns:

MODULE main

-- this is an IVAR paragraph

  IVAR

   v1 : 0..20;

   v2 : 0..20;

-- this is a VAR paragrapgh

  VAR

    v3 : 0..100;

ASSIGN

  init(v3) := 0;

  next(v3) := case

    v2 + v1 = 0 : 10;

    TRUE : v2 + v1;

  esac;

LTLSPEC !F(v3 = 0)

But by simply changing this to VAR, we have x = 18081, y = 44541

MODULE main

-- this is a VAR paragraph

  VAR

   v1 : 0..20;

   v2 : 0..20;

-- this is a VAR paragraph

  VAR

    v3 : 0..100;

ASSIGN

  init(v3) := 0;

  next(v3) := case

    v2 + v1 = 0 : 10;

    TRUE : v2 + v1;

  esac;

LTLSPEC !F(v3 = 0)

The difference reflects from the values of y. So my question is what makes IVAR behaves differently from VAR.

Try to run the my code and compare the complexities. You should be able to know the difference. I would have modified you code but the restrictions on IVAR will not make it compile.

Dear Researcher

please check this attachments if it is helpful for you.

Regards

Thank you every one. I found a useful paper describing Scenario Markup Language for driving behavior studies. It has a good literature review on other scenario authoring languages for virtual environment. I thought it would be helpful for anyone having same question.

Gajananan, Kugamoorthy, et al. "An experimental space for conducting controlled driving behavior studies based on a multiuser networked 3D virtual environment and the Scenario Markup Language." Human-Machine Systems, IEEE Transactions on 43.4 (2013): 345-358.

Hello,

Following Luigi answer, in the CADP Publications page, you will find under "Papers about compositional verification", recent papers that contains some references you can use, in particular in :

and:

and then, more specificaly case-studies papers, in:

You are right, Event-B is well-suited for event-based system modeling

You could also have a look at COBIT 5 for a complete framework for governance including security. There is work on risk assessment there that you might find useful.

Cheers,

Adrian.

It would appear to me that others may also have thought about using DSM for forming an autonomous organization. I would like to hear from anyone who may have implemented this concept and learn of their experience. Has anyone published anything on it?

And I would like to know of anyone who may be interested in the Explainer.I have used the Explainer to show how Congress can solve some of the problems that cause them to be in gridlock. But I have not seen any evidence that these problems are being solved. If anyone else has come up with such a method, I would like to hear about it. Maybe someone has come up with such a method and they have also had trouble getting people to look below the surface to see how it works and can be used.

Don

Very interesting question and discussion.

----Available VDM Tools----

SpecBox-Syntax Checking,Document Printing,Semantic Analysis

VDM through Pictures(VtP)-for Editing,Visual Specification

mural-Proof Support

VDM Domain Compiler-Code Generation

I think it strongly depends on the viewpoint and - above all - on the objective of the analysis. For instance, from the hw-sw control viewpoint we usually divide the system into subsystems like train supervision, traffic management, route management and train control. Dividing a complex system into domains is a modelling task and as such it would greatly benefit from appropriate and more formal approaches, like the ones based on UML/SysML. Otherwise, it is difficult - if not impossible - to say what division is correct and what is wrong.

Dear Stefan,

I see the point you are making, say if I try to prove:

((1/0) < x) --> ((1/0) <x) 

Formally: "((4::int) div 0 < x) --> ((4::int) div 0 < x)"

I would reach such a situation that a operation would be undefined. However, in Isabelle, the logic does not have natural expression for partial functions, where things could go wrong. We know that division by zero is undefined, but in Isabelle that would be defined as zero. 

I believe that in case of Isabelle, the problem is the mechanism to infer the types. In this case, I am using a quantified variable which has some type assigned to it. If I let Isabelle to infer the types, the inference system will infer the most generic types possible, thus the quantified variable at the left of --> will be assigned to a type, say T1, and the quantified variable at the right of --> will be assigned to another type, say T2. If I explicitely say that the types must be the same, then the theorem infers true using the axiom "A-->A" of HOL.

Thanks for made me aware of strict vs. non-strict evaluation. I already hear of lazy evaluation, but I was not aware of the other terms for this concept. 

Thanks for your answer, 

Diego Dias

Gerhard's point regarding automated self-tests suites run after any change to a system is key.  This is actually a good practice, although it is difficult to sustain with comprehensiveness in realistic situations where new features (requirements) are being introduced frequently  and rapidly (agile)--Gerhard's other point.   Because requirements typically evolve, rather remain "specified", I would argue that automating emerging requirements need more consideration.  On the other hand, there are situations, like your virtual robot, that may indeed have "hard" requirements--i.e., they can be specified up front, rather than being allowed to evolve.  Peoples needs continually shift, so that reflects as changing requirements in most of the world's systems.  How does this argument fit with automated robots testing in your situation?  Stories, features, etc. rule a great deal of the world's software systems development these days partly because requirements evolve.

I’m not familiar with your domain, so I’ll make some general comments on dealing with “rare” events that happen too often.

Perhaps the “rare” events occur too often with respect to a particular proposed probability model. A mixture model, entertaining other distributions or parameterizations, would allow various component models in the mixture to address various modes of reality (non-intentional events, intentional events, …)

If you believe events group in time or location (or some other dimension), you might want to entertain models similar to MRFs used in computer vision. An approach to constructing maximum entropy probability models to replicate observed statistical characteristics is discussed in:

Zhu, Song Chun, Yingnian Wu, and David Mumford. "Filters, random fields and maximum entropy (FRAME): Towards a unified theory for texture modeling." International Journal of Computer Vision 27.2 (1998): 107-126.

Ola Ola,

Sound decision making is dictated by logical deductions. This means that a decision support system should better be a binary decision tree. Just like a binary plant determination table is a good example of a binary decision tree developed to decide with which plant species one is dealing.

Actually when an outcome is potential, it is an outcome which is by definition attributed a level of uncertainty. I have put this forward in an earlier thread, when you cannot boil down a series of questions in a decision tree to a yes or no answer (binary decision), then the question or problem is ill defined and hence only potentially apt for an absolutely certain decision.

Typically, when you cannot make a decision tree for example to determine plant species, you will never be able to identify new species in the plant world. The same is true for any other problem area in science. One is never absolutely certain that all solutions for a problem area are identified. Hence solutions are always doted with a level of uncertainty which you have to reduce as much as possible by a rigorous evaluation of the problem area by developing a binary decision tree, which requires thorough study and knowledge acquisition of the problem area. In many ways sound decision making is the art of reducing the uncertainty of known solutions in a specific problem area as much as possible. As if it were a statistical law, the more solutions found in a problem area the lower the uncertainty of each of these solutions.

No?

The more plant species known, the lower the uncertainty on erroneous determinations. Why else do botanists put so much effort in finding and describing new plant species and studying the relationships between the determined 'solutions', nature has developed over thousands of millenia.

Cheers,

Frank

I'd say it depends on what you are designing. If you look at it from a process perspective, the whole software development process is like a funnel, from vague requirements over a (hopefully) not so vague design to a concrete implementation.

While this is usually fine for systems where there is no "right" or "wrong" solution (the look and feel of a web shop, for example), other systems are much more restrictive. You don't want to be vague about alarm and shutdown criteria in the control software of a nuclear power plant or in aircraft control.

So I think using formal methods will be worthwile in only some scenarios, while in others semi-formal notation (such as UML) will suffice.

Scade provides safe state machines to describe state-based behavoir. But you're right everything is finally mapped to an (at least locally) synchronous execution model,

However, when using UPPAAL or another model checker you usually do the design in another framework and build a verification model to prove your properties. That's is often non-trivial since the design model has to be abstracted effectively (e.g. UPPAAL comes to its limits easily if the system contains a lot of variables and clocks). Second, the abstraction-refinement relation has to be proven property preserving for the relevant properties, otherwise verifying something for the verification model may not tell anything about the design model.

So my first question would be whether you already have some design models for your systems, or do you constsruct your own verification models only?

It's a matter of value. In Scrum, the PO has to be convinced that formal modelling (or other formal techniques) have value above cost. If so convinced, the PO can make the corresponding engineering practices part of the Definition of Done. The Product Owner may herself use formal specification techniques if they are made transparent and if it can be shown that the benefit outweighs the cost. Both of these, of course, depend on doing true Scrum where the PO really is the boss and really has final say over the product vision, final say over the PBIs on the Product Backlog, and the wherewithal to come together with the team on the corresponding components of the Definition of Done.

To disagree slightly with Nick: Keep in mind that working code is not the first priority — it's self-organisation and feedback in Agile, and it's people and Kaizen mind in Lean and in Scrum. Few formal methods cater well to that agenda.

To disagree slightly with Yasar: Agile says nothing against tedious work.

To disagree with Maria: A system is as weak as its weakest link. Using formal methods on one part to robustify it does not make the system robust; there are many formal proofs around this concept. What she describes takes quite advanced risk analysis techniques; these are the purview of the PO, supported by input from the development team.

I second Mohammed Younis: for a case study, measuring the fault detection capability is an important aspect. When mutating the code, it is best to do it according to some fault model.

You could also measure test coverage on the specification, according to some coverage criterion, to get an approximation on how well your tests cover the specification. But there is quite some disagreement whether/when coverage is a good approximation to the fault detection capability.

Since ioco is formal, you could also validate your testing method formally, by proving that it is sound and complete (i.e. exhaustive).

Depending on the approach of the paper could be: International Journal of Advanced Studies in Computers, Science and Engineering or International Journal of Pervasive Computing and Communications or the Journal of Universal Computer Science.

If the approach is more of a interaction model it could be the International Journal of Human-Computer Interaction.

I know most of these journals are too broad themed but i've seen many papers on ubiquitous computing published there.

Thanks Nick, it is very helpful

I've seen an article before. It was about "Generating JML specifications from UML state diagrams" for verification purpose. They proposed a tool "AutoJML".

Dear Reza,

The easiest way to find a research topic for the application of JML is to explore some related work that you can find in publishing websites such as: Springer, Elsevier, IEEE and so on.

Anyway, here's a research paper that might be helpful:

I was involved in a European project called DEPLOYED where the objective was to help Industry partners integrate Formal methods development techniques and tools in their development process. Conversely, the project also helped research partners in fine tuning their formal methods and tools to address Industry pilot cases. The main methods put forward in the project were Event-B but others were addressed.

In the DEPLOY project, my research center CETIC was involved in the collection of evidence related to achievement made by these Industry pilots as well as other effort.

I can suggest that you take a look at http://www.fm4industry.org which resulted from the project and present various achievements from the project.

With regards to formal method development, one of the most challenging part to dramatically improve their Industry take-up is to integrate a complete chain of tools. Currently, very few examples exist where formal models can automatically lead to the generation executable proven correct code. I know of Siemens Transport System that used B (not event B) to generate Subway controller of the driver-less subway line in Paris among others. This example is presented at the website mentioned above.

The pilot on test case generation from a UML-like workflow notation from SAP is also explained at this website.

The main problem is that if you only use formal method here and there, then the final results can not be proven correct and a heavy testing effort remains required. The formal models are then just another complex artifact to maintain throughout the system and software life cycle (development, maintenance, evolution until retirement).

If you undertake Industry pilots as part of you research please consider contributing your pilot results to the wiki above.

Nick: You are absolutely right, regarding trade-offs of a very abstract model or a fine-grained one. But I presume there for sure are tools to transform an abstract Activity Diagram to a code in any target language, then it will be useless any research in that type of code generation even if the transformation is with some Formal Proofs, with transforming back and forth between models, using side Tools.

Actually, I was also thinking of a declarative programming language, like Haskel, as the code's target language, that way we fill some gaps between the source and any imperative language as we focus more on what to do rather than how and omit some details that way. (Like your example Nick)

Could it compensate the weaknesses of an abstract source model?

Yes, it looks doable. You will have to decide which formal analyses you want to perform. Model-checking will probably require abstraction. If you have really huge AD you might want to resort to static analysis.

Prof.Peter T. Breuer, Thank you very much for your answer.

What I mean by control dependence between transitions is based on many articles like " Dependence Analysis in Reduction of Requirement Based Test Suites",

Control Dependence captures the notion that one node in program control graph may affect the execution of another node. This definition is extended on the above article to Extended Finite State Machine "EFSM".

Control dependence in EFSM exits between transitions and captures the notion that one transition may affect traversal of another transition.

The article states that control dependence between transitions is defined similarly as control dependence between nodes of program control graph, i.e, in terms of the concept of post-dominance.

Node Z post-dominates node Y iff Z is on every path from Y to the exit node.

However there is another type of dominance called pre-dominance

Node Z pre-dominates node Y iff Z is on every path from the initial node to Y.

Therefore, as I understand, post-dominance is on a relation with exit node wile pre-dominance is with initial node.

My question is " can we use pre-dominance instead of post-dominance in EFSM control dependency? If yes, what are the conditions for determining the control dependence between two transitions in EFSM". Thank you in advance.

Very interesting.

I looked at a converted postscript version the first time.

A quick first scan indicated the standard tools of parsing and execution of tokens. Toward the back of the document, the text appeared to apply these techniques to groups of unknown symbols (I could not read the symbols).

I looked at another copy of the work , this evening, and I can read all of the pages (all known symbols.)

So, there must have been a mixup in the language and symbol set in the first document that I scanned.

Take care and have fun,

Joe

I suggest software product line specification and verification -- but there are many others.

Partial Evaluation is a certain application of program specialization. Program specialization: Fix a subset of a program's arguments (i.e., a function's parameters) and specialize the code according to the values of the fixed ("static") parameters. The resulting program will be smaller, lighter, faster.

Using this kind of specializer, interpreters can be specialized for programs that must be interpreted quite often. Thus, the resulting program is a (kind of) compiled version of the original program. I think this is what just-in-time compilers (like in the JVM) do. You can push this further (it's called Futamura's projections, then): Specialize the specializer for a given interpreter (resulting in a compiler) or even specializing the specializer for itself (resulting in a compiler generator).

I am interested in this topic because we work with DSLs a lot (domain specific languages). 25 yrs ago, this wasn't a use case, because we only hat lex/yacc then for building industry-level DSLs. It would be useful to generate code generators from interpreters - we could be sure that both have identical semantics. I am currently developing a self-applicable specializer for the Xtend language.

Would be great to find people interested in this very topic... the PE community seems to be a bit inactive currently...

Event-B is a rigorous formal method for system specification. Rodin is an Eclipse-based IDE that provides tool support for Event-B. One Rodin plug-in is UML-B which, as its name suggests, combines UML and B. You may want to google Colin Snook (EECS/Univ Southampton), which is the main designer and maintainer of UML-B, I believe. He has also authored several papers on this approach.

A sample motivating scenario from the healthcare domain for the patients medical records management can be found in our paper. In our paper, we have briefly discussed a context-aware scenario, that illustrates the need for the incorporation of context information in the access control processes. Also, you can have a look on the Prototype section.

Kristie:

Lets assume that the metric covers the total range of system components.

Further lets assume the requirements are not static bu dynamic, like a dynamic threat environment.

I developed the "Secure Adaptive Response Potential (SARP)," a system security metric to focus on all aspects of security requirements.

You may be able to adapt the SARP approach to other areas.

A link to the SARP paper is:

Take care and have fun,

Joe

There are some really misguided applications of bibliometrics. For instance, a national body responsible for assessing and grading graduate programs in computer science has classified events according to H-index.

First, this is statistically flawed as there is an obvious bias to favor very large conferences against small events.

Second, it is far from simple to collect correctly such a massive amount of data, as the same event might go through name changes, merge with another event, and so forth.

So, even though bibliometrics might be useful in some situations, their widespread and indiscriminate usage make them a threat to the future of science funding, at least in some parts of the world.

This is best said in the San Francisco Declaration on Research Assessment (DORA) http://am.ascb.org/dora/.

Thank you Alexandre Chapoutot...

A folklore example is swapping the value of two (integer) references without using a local variables. Take a programming language with call-by-reference and the following function:

swap(&int a, &int b) {

a := a - b; // value of a is a0 - b0

b := a + b; // value of b is a0 - b0 + b0 = a0

a := b - a; // value of a is a0 - a0 + b0

}

Assume the value of a is a pointer to the value a0 and b to b0. Then after a call to swap(a, b) the value pointed to by a and b are swapped ... except if a and b both point to the same memory address, in which case they point to the value 0.

This is more an example of the problems related to reasonning about programs in the presence of pointers but I think that it qualifies as an example of tricky algorithm.

Axiomatic semantics is just one way of providing program semantics, in which program statements semantics is defined by using sequent-like rules. If I recall correctly the idea dates back to Floyd and was formalized by Hoare (receiver of a Turing award for his contributions to programming languages definition and semantics). These rules allow one to prove in a sequent calculus style the validity of a Hoare triple {Pre} Program {Post} (all the states that satisfy the precondition and for which the program terminates must satisfy the postcondition). Dijkstra showed how to translate these assertions to first-order logic formulas using the computation of the weakest precondition.

So, regarding verification, the relationship comes in two flavors: you can PROVE that a Hoare triple is valid by using Hoare's proof calculus (and this implies that the program is correct w.r.t. the provided pre and post conditions). Also, you can compute the weakest precondition and obtain a first-order formula (under the assumption that loops loop a bounded number of times) and use proof methods for first-order logic in order to verify the validity of Hoare triples. The latter approach is very much used in automated static analysis resorting to SMT solving or SAT solving, or related techniques.

I know the answer is not self-contained, but includes a few keywords for which abundant information is available on the web.

The book "The Science of Programming" by David Gries is a wonderful source for an introduction to this topic.

Hi,

Finding a deadlock plus shortest path leading to it can be done using a breadth-first search of the stategraph for a state without outgoing edge. In the worst-case (no deadlock) all states must be explored, so the algorithm is trivially linear in the size of the state graph. However the stategraph itself may be exponential in the size of the system description (e.g. a promela specification). I recommend reading the Spin book, a good read.

Cheers,

Frederic.