Formally verifying a product in an early phase of the design process has several advantages. First, errors and contradictions in the specification can be found early. Second, an unambiguous common understanding of the specification is created. In summary, the quality and security of a product can be significantly increased. This paper describes how formal verification can be integrated into the industrial design process of a smart card in a practical way. The described method allows to reach high assurance levels in Common Criteria certifications.

Many specifications include assumptions on the environment. If the environment satisfies the assumptions then a correct system reacts as intended. However, when the environment deviates from its expected behavior, a correct system can behave arbitrarily. We want to synthesize robust systems that degrade gracefully, i.e., a small number of environment failures should induce a small number of system failures. We define ratio games and show that an optimal robust system corresponds to the winning strategy of a ratio game, where the system minimizes the ratio of system errors to environment errors. We show that ratio games can be solved in pseudopolynomial time.