Formal System Model Research Articles

Designing specification languages for process control systems

Previously, we defined a blackbox formal system modeling language called RSML (Requirements State Machine Language). The language was developed over several years while specifying the system requirements for a collision avoidance system for commercial passenger aircraft. During the language development, we received continual feedback and evaluation by FAA employees and industry representatives, which helped us to produce a specification language that is easily learned and used by application experts. Since the completion of the RSML project, we have continued our research on specification languages. This research is part of a larger effort to investigate the more general problem of providing tools to assist in developing embedded systems. Our latest experimental toolset is called SpecTRM (Specification Tools and Requirements Methodology), and the formal specification language is SpecTRM-RL (SpecTRM Requirements Language). This paper describes what we have learned from our use of RSML and how those lessons were applied to the design of SpecTRM-RL. We discuss our goals for SpecTRM-RL and the design features that support each of these goals.

Syndetic Modelling

User and system models typically are viewed as independent representations that provide complementary insights into aspects of human-computer interaction. Within system development, it is usual to see the 2 activities as separate, or at best loosely coupled, with either the design artifact or some third "mediatiag" expression providing the context in which the results of modelling can be related. This article proposes that formal system models can be combined directly with a representation of human cognition to yield an integrated view of human-system interaction: a syndetic model. Aspects of systems that affect usability then can be described and understood in terms of the conjoint behavior of user and computer. This article introduces and discusses, in syndetic terms, 2 scenarios with markedly different properties. We show how syndesis can provide a formal foundation for reasoning about interaction.

Cold War Imperatives and Quarrelsome Clients

This study extends a formal systems model on the political and strategic consequences of great power arms transfers. Using the United States and the Soviet Union as the exporters (or patrons) and Pakistan and India as the importers (clients), tests of the model's components reveal the following: the superpowers were indifferent to the effects of their arms supplies on the relationships between the importers, changes over time in the importers' arms acquisitions from third countries depended on the relationships between the importers and on the record of superpower supplies, subsequent superpower transfers were influenced not by the consequences of past transfers but by the political relationships between the exporters and importers and by the arms trade behavior of the importers, and each importer would be penalized by its arms transfer patron with decreased future supplies for excessive third-country arms shipments and for receiving arms from the opposing superpower.

Commonalities in Reengineered Business Processes: Models and Issues

Process reengineering advocates making radical changes in how processing systems are structured, such as moving away from systems that use the principles of division of labor and division of management. Using formal system models from queueing theory, this paper explores the conditions under which such radical changes in system structure are likely to be appropriate. In general, a fairly high degree of variability in task times seems to be necessary.

Politics and the Environment: Nonlinear Instabilities Dominate

This analysis investigates a formal nonlinear systems model characterizing longitudinal change in the environment as a function of oscillating partisan control of the White House. It is assumed that one political party will tend to favor help for the environment despite some economic costs, whereas the other party will generally favor economic growth over environmental concerns. These policy changes affect the environment interactively with both public concern for particular environmental problems and the economic costs relating to environmental repair. This interaction with policy changes causes a disruption in the continuously evolving balance between the social factors that damage the environment and the environment's own ability to recover. The disruptive potential to the environment is considerably ameliorated with a reduction in the electoral cycling.

Formal process modelling

As the use of formal methods for computer systems development is now widely taught and commonly practised, their use for business process modelling is now considered. In the same way that formal system models are used to rationalize the implementations of complex computer systems, formal process models may be used to rationalize system requirements of complex business processes. The paper examines this thesis by way of a case study in the use of formal modelling to analyse systems requirements for an order fulfilment process.

Nonlinear Transformation in a Landslide: Johnson and Goldwater in 1964

This study investigates mass electoral behavior during the 1964 landslide presidential election in the United States. The aggregate contextual characteristics of such elections of large magnitude and rapid change have not been examined thoroughly in the extant literature on voting. Here, a formal systems model of partisan competition is developed and evaluated with respect to a complete collection of county-level electoral data. The model is a system of two interdependent differential equations that characterize rapid and large-scale aggregate partisan change. It is found that the 1964 landslide election involved a highly complex and contextually conditioned set of aggregate voting behaviors. The masses were guided in their partisan choices by a variety of nonlinear social processes. Fundamental to this analysis is a discussion of whether societies necessarily vote within a state of aggregate political equilibrium during a landslide. I find that in the deep southern states, the process of partisan competition was not completed by the time the election occurred. Evidence is offered that suggests that the electorate in the Deep South did not vote in a state of regional equilibrium. The opposite is true of aggregate voting in areas outside the Deep South. These findings have implications with regard to the meaning of elections during periods of rapid partisan change.

Formal and Simulation Models for a Phlebotomy Station Service System

The behavior of a central phlebotomy station for an out-patient medical care facility is analyzed by a formal service system model (queuing theory) and by a computer simulation model. Although the distributions of the intervals between successive patient arrivals and the duration of individual phlebotomies do not conform to the requirements of the formal model, some calculated system characteristics, such as the efficiencies of individual phlebotomists, agree quite closely with the results generated by simulation. The two models yield different values for the optimal number of phlebotomists in an econometric analysis, however.

Silicon photovoltaic cells and the utilization of solar energy

Erroneous human behavior is often cited as a major factor to system failure. However, the complexity of the human-automation interaction can make it difficult for engineers to anticipate how erroneous human behavior can contribute to failures. In this work, we introduce a novel method for generating human errors based on the task-based taxonomy of erroneous human behavior. This allows erroneous acts to manifest as divergences from task models. We implement our method using the Enhanced Operator Function Model. We further show how the method can be used with formal system modeling and formal verification with model checking to prove whether or not potentially unanticipated erroneous behavior could contribute to system failures. We evaluate how our method scales and use it to evaluate three case studies: a radiation therapy machine, a pain medication pump, and an Apache helicopter. We discuss these results and explore options for future work.