Abstract We report on a case study in applying different formal methods to model and verify an architecture for administrating digital signatures. The architecture comprises several concurrently executing systems that authenticate users and generate and store digital signatures by passing security relevant data through a tightly controlled interface. The architecture is interesting from a formal-methods perspective as it involves complex operations on data as well as process coordination and hence is a candidate for both data-oriented and process-oriented formal methods. We have built and verified two models of the signature architecture using two representative formal methods. In the first, we specify a data model of the architecture in Z that we extend to a trace model and interactively verify by theorem proving. In the second, we model the architecture as a system of communicating processes that we verify by finite-state model checking. We provide a detailed comparison of these two different approaches to formalization (infinite state with rich data types versus finite state) and verification (theorem proving versus model checking). Contrary to common belief, our case study suggests that Z is well suited for temporal reasoning about process models with complex operations on data. Moreover, our comparison highlights the advantages of proving theorems about such models and provides evidence that, in the hands of an experienced user, theorem proving may be neither substantially more time-consuming nor more complex than model checking.

The authors' goal is to establish a flexible programming support for evolving systems that will enable one to modify programs using less labor, while maintaining good quality during service life. EVA (evolution mechanism for flexible agent) was developed to allow a flexible programming support system to be constructed based on their programming method for evolving systems. They consider that programming methods for evolving systems need to satisfy the following essential conditions. First, they need to make it easy to specify changes in a system in terms of new requirements. Second, they need to have a procedure for transmitting the new requirements to a program. Third, they need to be able to guarantee that the resultant program will meet the new requirements. Finally, because of the repetitive nature of much evolving systems work, they need to provide for the reuse of similar modifications during programming. In order to overcome limitations in program modification techniques which have only considered programming products, programming processes have been introduced into the method. To achieve their goal, they have formulated programming products and programming processes using such formal techniques as functional programming, type theory, modules, parameterized programming and natural deduction, and have constructed a mechanism of reusing these formal programming processes. The paper explains a case study which shows how to develop an evolving system using EVA and it discusses how one can use EVA's mechanism effectively.