From ProCoS to Space and Mental Models–A Survey of Combining Formal and Semi-formal Methods

  • Bettina ButhEmail author
Part of the NASA Monographs in Systems and Software Engineering book series (NASA)


This contribution reports of work done after the official end of the ProCoS project in 1995. Most of this work was done while the author was affiliated with Bremen University. The aim of this contribution is to show the effect of ProCoS on these projects, which comprises analysis of systems from two different application domains: space and aerospace. In both examples, the basic approach involves abstraction to CSP specifications and model-checking using FDR. Another common factor is the use of other techniques in combination with model-checking.


Model Check International Space Station Verification Task Pitch Mode Mode Confusion 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


  1. 1.
    Buth, B.: Formal and Semi-Formal Methods for the Analysis of Industrial Control Systems. Bremen University (2002)Google Scholar
  2. 2.
    Buth, B.: Analysing mode confusion: an approach using FDR2. In: Heisel, M., Liggesmeyer, P., Wittmann, S. (eds.) Computer Safety, Reliability, and Security. Lecture Notes in Computer Science, vol. 3219, pp. 101–114. Springer, Heidelberg (2004)Google Scholar
  3. 3.
    Buth, B., Peleska, J.: Formal methods for large-scale industrial applications – deadlock and livelock analysis for the international space station. In: Tutorial Material for the Advanced Summer School in Formal Methods and Applications, Beijing, China, October 1999Google Scholar
  4. 4.
    Buth, B., Cardell-Oliver, R., Peleska, J.: Combining tools for the verification of fault-tolerant systems. In: Berghammer, R., Buth, B., Peleska, J. (eds.) Tools for Software Development and Verification. BISS Monographs, vol. 1. Shaker-Verlag (1996) (in print)Google Scholar
  5. 5.
    Buth, B., Kouvaras, M., Peleska, J., Shi, H.: Deadlock analysis for a fault-tolerant system. In: Johnson, M. (ed.) Algebraic Methodology and Software Technology. Proceedings of AMAST’97. LNCS, vol. 1349 , pp. 60–75. Springer, December 1997Google Scholar
  6. 6.
    Buth, B., Peleska, J., Shi, H.: Combining methods for the analysis of a fault-tolerant system. In: Haeberer, A.M. (ed.) Algebraic Methodology and Software Technology, Proceedings of AMAST’98. LNCS, vol. 1548, pp. 124–139. Springer, January 1999Google Scholar
  7. 7.
    Buth, B., Peleska, J., Shi, H.: Combining methods for the analysis of a fault-tolerant system. In: Proceedings of Quality Week ’99, May 1999. (CDrom)Google Scholar
  8. 8.
    Davies, J.: Specification and Proof in Real-Time CSP. Cambridge University Press, New York (1993)CrossRefzbMATHGoogle Scholar
  9. 9.
    Dill, D.: The mur\(\phi \) verification system. In: Alur, R., Henzinger, T. (eds.) Computer Aided Verification, CAV’96. LNCS, vol. 1102. Springer, Heidelberg (1996)Google Scholar
  10. 10.
    Formal Systems (Europe) Lts. FDR2 User Manual, FDR 2.97 edition.
  11. 11.
    Gibson-Robinson, T., Armstrong, P., Boulgakov, A., Roscoe, A.W.: FDR3 — a modern refinement checker for CSP. Tools and Algorithms for the Construction and Analysis of Systems. Lecture Notes in Computer Science, vol. 8413, pp. 187–201. Springer, Heidelberg (2014)Google Scholar
  12. 12.
    Hoare, C.A.R.: Communicating Sequential Processes. Red Series. Prentice-Hall International, Englewood Cliffs (1985)zbMATHGoogle Scholar
  13. 13.
    inmos ltd. occam 2 Reference Manual. Series in Computer Science. Prentice Hall International (1988)Google Scholar
  14. 14.
    Lamport, L., Shostak, R., Pease, M.: The byzantine generals problem. ACM Trans. Program. Lang. Syst. 4(3), 382–401 (1982)CrossRefzbMATHGoogle Scholar
  15. 15.
    Leveson, N.G., Palmer, E.: Designing automation to reduce operator errors. In: Proceedings of the IEEE Systems, Man, and Cybernetics Conference (1997)Google Scholar
  16. 16.
    Levevson, N.G., Pinnel, L.D., Sandys, S.D., Koga, S., Rees, J.D.: Analyzing software specifications for mode confusion potential. In: Johnson, C.W. (ed.) Proceedings of a Workshop on Human Error and System Development, Glasgow, Scotland, Glasgow Accident Analysis Group, Technical Report GAAG-TR-97-2, pp. 132–146, March 1997Google Scholar
  17. 17.
    Lüttgen, G., Carreño, V.: Analyzing mode confusion via model checking. Technical Report NASA/CR-1999-209332, ICASE Report No. 99-18, ICASE - NASA Langley Research Center, May 1999.
  18. 18.
    Miller, S.P., Potts, J.N.: Detecting mode confusion through formal modeling and analysis. Technical Report NASA/CR-1999-208971, NASA Langley Research Center, January 1999.
  19. 19.
    Palmer, E.: Oops, it didn’t arm. A case study of two automation surprises. In: Jensen, R.S., Rakovan, L.A. (eds.) Proceedings of the 8th International Symposium on Aviation Psychology, Columbus, OH, The Aviation Psychology Department of Aerospace Engineering, Ohio State University, pp. 227–232, April 1995.Google Scholar
  20. 20.
    Peleska, J., Buth, B.: Formal methods for the international space station iss. In: Olderog, E.R., Steffen, B. (eds.) Correct System Design - Recent Insights and Advances. Lecture Notes in Computer Science, vol. 1710, pp. 363–389. Springer, Heidelberg (1999)CrossRefGoogle Scholar
  21. 21.
    Peleska, J., Shi, H., Kouvaras, M.: Combining methods for the analysis of a fault-tolerant system. In: Proceedings of the 1999 Pacific Rim International Symposium on Dependable Computing (PRDC 1999) (1999) (Submitted)Google Scholar
  22. 22.
    Rushby, J., Crow, J., Palmer, E.: An automated method to detect potential mode confusions. In: 18th AIAA/IEEE Digital Avionics Systems Conference, St. Louis (MO) (1999)Google Scholar
  23. 23.
    Roscoe, A.W.: Model-checking CSP. In: A Classical Mind, Eassys in Honour of C.A.R. Hoare. Prentice-Hall International (1997)Google Scholar
  24. 24.
    Roscoe, A.W.: The Theory and Practice of Concurrency. Prentice-Hall International, Upper Saddle River (1997)Google Scholar
  25. 25.
    Roscoe, A.W.: The Theory and Practice of Concurrency. Prentice-Hall International, Upper Saddle River (1998)Google Scholar
  26. 26.
    Roscoe, A.W.: Understanding Concurrent Systems, 1st edn. Springer, New York (2010)CrossRefzbMATHGoogle Scholar
  27. 27.
    Rushby, J.: Using model checking to help discover mode confusion and other automation surprises. In: Proceedings of the 3rd Workshop on Human Error, Safety, and System Development (HESSD’99), Liege, Belgium (1999)Google Scholar
  28. 28.
    Rushby, J.: Using model checking to help discover mode confusions and other automation surprises. In: Reliability Engineering and System Safety (2002)Google Scholar
  29. 29.
    Sarter, N.B., Woods, D.D., Billings, C.E.: Automation surprises. In: Salvendy, G. (ed.) Handbook of Human Factors and Ergonomics. Wiley, New York (1997)Google Scholar
  30. 30.
    Schrönen, M.: Methodology for the Development of Microprocessor-Based Safety-Critical Systems. Monographs of the Bremen Institute of Safet Systems 8, Bremen University (1998). Shaker Verlag, AachenGoogle Scholar
  31. 31.
    Schneider, S.: Concurrent and Real-Time Systems: The CSP Approach. Wiley, New York (1999)Google Scholar
  32. 32.
    Twele, L., Schlingloff, H., Szczerbicka, H.: Performability analysis of an avionics-interface. In: Proceedings of IEEE Conference on Systems, Man and Cybernetics, San Diego, N.J., pp. 499–504 (1998)Google Scholar
  33. 33.
    University of Oxford. FDR3 User Manual, FDR 3.4 edition.

Copyright information

© Springer International Publishing AG 2017

Authors and Affiliations

  1. 1.HAW HamburgHamburgGermany

Personalised recommendations