Linear Temporal Logic (LTL) can be used for problem-solving when all problem constraints can be specified in this logic through the use of satisfiability checking techniques. In optimization problems such as scheduling with preferences, where constraints are primarily temporal, LTL is a desirable specification formalism. However, LTL cannot be used as a standalone formalism due to the fact that it is unable to specify soft constraints. This paper introduces Optimization LTL (OLTL), an optimization-oriented extension of LTL that can specify both hard and soft constraints in optimization problems. The syntax, semantics and basic formal properties of this logic are presented, along with an encoding based on bit-vector logic and Linear Real Arithmetic (LRA). Additionally, a tool called LiTeLLab ’ ( Li near Te mporal L ogic Lab oratory) is introduced to solve optimization problems specified by OLTL. The feasibility and scalability of using OLTL as a specification formalism is demonstrated through two case studies. These problems, with multiple optimization parameters, are specified in OLTL and LiTeLLab ’ successfully generates optimal solutions.

This paper presents the collaborative European ESPRIT ProCoS projects on “Provably Correct Systems”, and associated initiatives of the 1990s. The influence of the projects in the field of formal methods is also discussed. A general overview of the projects is provided, together with a number of reminiscences by those involved with the projects, including the influence on the subsequent careers of participants. The projects addressed the issues of connecting formal approaches at different connected levels of formality, including requirements, specification, and compilation down to machine code and even directly into hardware. The investigations were based on a representative subset of the programming language Occam, which was subsequently extended by elements indicative of particular problems of compilation, yet not found in Occam, and the related Transputer microprocessor. In practice, two of the most important and enduring results after the projects were Duration Calculus and Unifying Theories of Programming, both subfields of formal methods, with associated communities of researchers and practitioners.

Recently a divergence-sensitive branching bisimilarity has been proposed and studied for the randomized CCS model. In this paper, we give an equivalent inductive characterization for the bisimilarity, which is a probabilistic extension of the previous work on the non-probabilistic model. Based on the new characterization, a novel polynomial-time verification algorithm for the divergence-sensitive branching bisimilarity is proposed.

Hoare-style inference rules for program constructs permit the copying of expressions and tests from program text into logical contexts. It is known that this requires care even for sequential programs but much more serious issues arise with concurrent programs because of potential interference to the values of variables. The “rely-guarantee” approach tackles the challenge of recording acceptable interference and offers a way to provide safe inference rules for concurrent constructs. This paper shows how the algebraic presentation of rely-guarantee ideas can clarify and formalise the conditions for safely re-using expressions and tests from program text in logical contexts for reasoning about concurrent programs; crucially this extends to handling expressions that reference more than one shared variable. A non-trivial example related to the Fischer-Galler forest representation of equivalence relations is treated.

In critical software engineering, structured assurance cases (ACs) are used to demonstrate how key system properties are supported by evidence (e.g., test results, proofs). Creating rigorous ACs is particularly challenging in the context of software product lines (SPLs), i.e, sets of software products with overlapping but distinct features and behaviours. Since SPLs can encompass very large numbers of products, developing a rigorous AC for each product individually is infeasible. Moreover, if the SPL evolves, e.g., by the modification or introduction of features, it can be infeasible to assess the impact of this change. Instead, the development and maintenance of ACs ought to be lifted such that a single AC can be developed for the entire SPL simultaneously, and be analyzed for regression in a variability-aware fashion. In this article, we describe a formal approach to lifted AC development and regression analysis. We formalize a language of variability-aware ACs for SPLs and study the lifting of template-based AC development. We also define a regression analysis to determine the effects of SPL evolutions on variability-aware ACs. We describe a model-based assurance management tool which implements these techniques, and illustrate our contributions by developing an AC for a product line of medical devices.

We present a framework for the formal modeling of state-based systems in the context of the Lean4 programming language and proof assistant. In this context, the main objective is to support a step-wise refinement methodology inspired conceptually by the Event-B formal method. As a starting point, the LeanMachines framework proposes Lean4 constructions for the main Event-B concepts such as contexts, machines and events. Most importantly, the associated refinement principles are introduced in the form of typeclass constructions inspired by (and in fact built upon) the Mathlib mathematical framework. Beyond the basic concepts and structures, we also experiment with extensions of the framework. First, we develop an algebra of event combinators that allow to compose complex event structures out of simpler ones. These combinators are based on algebraic structures – functors, arrows, etc. – that have been developed and studied in the context of (functional) programming language theory. Our proposed formalization of the Event-B concepts is very shallow in the sense that all the constructions are directly based on the Lean4 logic and abstractions. One benefit is that proof obligations can be discharged using the tactic language of Lean4 with almost no embedding overhead such as an abstraction barrier that would require syntactic conversions, or the necessity to use some dedicated proof tactics. As an important design guideline, we enforce the fundamental principle of correctness-by-construction: machine states, events structures and refinement steps cannot be fully constructed without discharging the prescribed proof obligations.

Bigraphs provide a versatile modeling framework by combining spatial and connectivity relationships, making them valuable in graph transformations, model transformations, the design of programming languages, and the simulation of reactive systems. However, practical approaches to bigraph rewriting often rely on constraint satisfaction or SAT-solving techniques, which can be computationally intensive and limit usability in large-scale applications. This article addresses the challenge of efficient bigraph rewriting by leveraging the graph transformation engine GrGen.NET . We propose a novel approach to translate bigraphical rules into SPO-based graph transformation rules, enabling fast bigraph rewriting. Our solution is implemented in the tool BiGGer , which includes a command-line interface and a Java library for seamless integration. Through experimental evaluation, we demonstrate the correctness of our approach and its ability to significantly improve execution efficiency. Additionally, we implemented tracking rules that maintain semantic fidelity during the translation process and enable identity tracing across reactions, adding a feature to bigraphs that extends their applicability beyond static analysis.

In this article, we consider a special class of liveness properties for systems consisting of concurrent objects. These properties ensure the termination of methods calls under certain fairness assumptions and thus the progress of the execution. Liveness properties are defined for concurrent objects and they typically include lock-freedom , wait-freedom , deadlock-freedom , starvation-freedom, and obstruction-freedom . It is known that these five liveness properties are decidable for sequential consistency (SC) memory model of finite-state programs with a bounded number of processes. However, the problem of decidability of liveness for finite state concurrent programs running on relaxed memory models remains open. In this article, we address the decidability problem of liveness properties of concurrent objects for the total store order (TSO) memory model which is used in the x86 architecture. In particular, we prove that for a bounded number of processes, lock-freedom, wait-freedom, deadlock-freedom and starvation-freedom are undecidable, and that obstruction-freedom is decidable on TSO for a bounded number of processes. Further on, we investigate the verification problem of k -bounded wait-freedom , a bounded version of wait-freedom, and show that for each bound k , the problem of checking k -bounded wait-freedom is decidable on TSO for a bounded number of processes. We show that the complexity for checking obstruction-freedom and checking k -bounded wait-freedom are both non-primitive recursive. We also discover an interesting difference between liveness on TSO and that on SC. Our finding is that wait-freedom implies k -bounded wait-freedom for some k on SC memory model, but this implication does not hold on the TSO model. We prove this by generating a concrete object on TSO that is wait-free but not k -bounded wait-free for any k .

Swarm robotic systems consist of numerous simple robots coordinating in a decentralised manner to achieve a common goal. Ensuring that individual robot behaviours lead to the desired swarm-level outcomes is challenging due to the lack of a central controller. This article uses two frameworks to facilitate formal specification and verification of robot swarms: (1) NuXMV, which models the system as a Finite State Machine, specifies properties using temporal logic, and verifies them through model checking with BDDs and SMT-solvers; and (2) GROOVE, which models the system as a Graph Grammar, specifies properties using temporal logic with graphical states, and verifies them via graph-specific model checking algorithms. We compare these formal approaches by modelling the Alpha swarm aggregation algorithm, which ensures that any robot disconnected from the swarm, capable only of short-range wireless communications, will eventually return to it. We find that GROOVE effectively leverages symmetry to reduce the state space, while NuXMV excels in handling models requiring extensive calculations and data manipulations not optimally expressed through graphs. We discuss the suitability of each approach for different systems and properties, suggesting future directions that combine the strengths of both approaches.