Despite our best efforts, any sufficiently complex computer system has vulnerabilities. It is safe to assume that such vulnerabilities can be exploited by attackers who will be able to penetrate the system. Intrusion tolerance attempts to maintain acceptable service despite such intrusions. This paper presents an application of intrusion-tolerance concepts to Enclaves, a software infrastructure for supporting secure group applications. Intrusion tolerance is achieved via a combination of Byzantine fault-tolerant protocols and secret sharing techniques.

Groupware applications require secure communication and group-management services. Participants in such applications may have divergent interests and may not fully trust each other. The services provided must then be designed to tolerate possibly misbehaving participants. Enclaves is a software framework for building such group applications. We discuss how the protocols used by Enclaves can be modified to guarantee proper service in the presence of nontrustworthy group members. We show how the improved protocol was formally specified and proven correct.

Software for safety critical systems must deal with the hazards identified by safety analysis. This paper investigates, how the results of one safety analysis technique, fault trees, are interpreted as software safety requirements to be used in the program design process. We propose that fault tree analysis and program development use the same system model. This model is formalized in a real-time, interval logic, based on a conventional dynamic systems model with state evolving over time. Fault trees are interpreted as temporal formulas, and it is shown how such formulas can be used for deriving safety requirements for software components.

The authors report on a formal requirements analysis experiment involving an avionics control system. They describe a method for specifying and verifying real-time systems with PVS. The experiment involves the formalization of the functional and safety requirements of the avionics system as well as its multilevel verification. First level verification demonstrates the consistency of the specifications whilst the second level shows that certain system safety properties are satisfied by the specification. They critically analyze methodological issues of large scale verification and propose some practical ways of structuring verification activities for optimizing the benefits.

Abstract We introduce NewThink, a specification language designed specifically for real-time safety-critical systems. NewThink is a component of an overall Orwellian development method for safety-critical systems which consists of a specification language, a programming language and a set of sound decomposition rules. In this paper, we present the syntax and semantics of NewThink. We demonstrate a relationship between timed and static specifications, which potentially allows us to continue using techniques from the static case in the timed case. We also prove that our extension for real-time is conservative, which is very much in keeping with our Orwellian philosophy.

This paper surveys the state of the art in the use of formal verification for hardware design and discusses the transfer of such methods to industrial practice. We examine the characteristics of the VLSI engineering process and propose a set of criteria for evaluating the applicability of various formal approaches to the design of digital systems. We also discuss some topics for future research to enable effective technology transfer of formal methods to VLSI engineering practice

Abstract In this paper we consider the current practices involved in the storage of explosive articles and substances. In the spirit of Defence standard 00-55, we formalize the safety requirements of the ACS software which is used to manage certain MOD holdings in the United Kingdom using the specification language VDM. We also prove some properties of these safety requirements and comment on a similar OBJ3 specification.

This paper defines the algebraic specification language implemented by the UMIST OBJ system. It also illustrates the use of the language for the definition of abstract, executable specifications of the behaviour of computer programs. The system implements an executable subset of J.A. Goguen's OBJ language, which is based on the algebraic definition of abstract data types. The language permits data type and operations to be defined abstractly, i.e. independently of any particular representation. Moreover, the definitions of an OBJ specification can be treated as an abstract program, by regarding the equations contained in a specification as a set of left-right rewrite rules which may be used to simplify terms. This makes the language useful for formulating and exploring the consequences of abstract designs, and developing relevant parts of the theory of the associated problem domain. The ability to exercise descriptions of the theory of a problem domain is a powerful tool for the programmer. By providing timely feedback on the correctness of design decisions, such use of the language encourages and reinforces the exploration of design possibilities. With these features, UMIST OBJ embodies the foundation of a framework for effective software engineering. It provides an accessible basis for both mechanisable formal notations for program description and semantically motivated support tools.