formal methods: state of the art and future directions edmund m

22

Upload: truongdieu

Post on 01-Jan-2017

213 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Formal Methods: State of the Art and Future Directions Edmund M

������������ ��������������������� ���� ���� "!#�$�%��&��'��(���(�) *,+-�) �.��/+0�1&��

2436587:9$3<;�=?>A@ BDCFE-G�BH9I3KJ$GIBH9:9$GMLNLNG�;O=6P�QR9IS>TB)CF9IGUSVQ G�;�G)@W@ XY9[Z\9]Q ^$G)C`_-Q LFa

b�c/dFe)f0gMcihjfFclkiclm$n6o)fFpMqMfFcldFd6rWm�nFs)cTt)cigMcluWpMo)v�cimIn4pxw4v�yMnFs)clv�yMnFrWklyxuMnFclkNs)m)rWz$e)cld4w`pMf�d0oHclklr w`hIrWm)q�yMm)t�gUclf|{r w}h$rWm)q/klpMv�o)uWci~�s)yMfFt)��yUf0c�yMm)t�dFpxw`n���yUf0c�dFhIdFnFclv�di�V��yMm$hjp�wVnFs)cldFcTnFclkNs)m)rWz$e)cld4yMfFcTklyUo)yM�)uWc�pxwVs)yUm)t)uWrWm)qrWm)t)e)dFn0fFrWyMu {�d0rW�Ncit�cl~$yMv�o)uWcldi�6rWm�w`yMklni�6rWm�d0pUv�c�klyUd0cid�n0s)cid0c�n0cikNs)m)rWzIe)cid/yMf0c�yUuWf0ciyMt)h��:cirWm)q�e)d0cit�pMm�yfFclqMe)uWyMf��)yMdFrWdTrWm�rWm)t)e)dFn0fFhM���$e)klklcid0d�rWm�w`pMf0v�yUu)d0oHclklr �:kiyMnFrWpMmjkiyMm��:c�yUn0nFf0rW�)e)nFclt�nFp�m)pMn0yUn0rWpMm)d�nFs)yMn�yMfFcyMkiklcldFdFrW�)uWcTnFpjdFhIdFnFclv�t)cid0rWqUm)clfFd�yMm)t�n0p�m)cl�Kv�cin0s)p$t)pMuWpMqMr cld�w}pMf�yMo)o)uWhIrWm)q/nFs)cldFc/m)pMn0yUn0rWpMm)d�cN�4clkin0rWgMciuWhM��$e)klkicldFd�rWm�gMclfFr �:klyMnFrWpMm�klyMm��Hc�yMnFn0fFrW�)e)n0citjnFp�nFs)c�t)clgMciuWpMo)v�clm$n6pxw�m)cl�<nFpIpUuWd�d0e)kNs�yMd�v�pMf0c/oHp-��clf|w}e)unFs)clpMfFclv o)fFpxgMclfFd/yMm)t�v�p$t)clu6kNs)cikN�MclfFd/n0s)yMm8��clfFc�o)fFclg$rWpMe)dFuWh�yxgxyMrWuWyM�)uWcU���6rWm)yUuWuWhM�6��c�dFe)qMqMcldFn�dFpMv�cqMcim)clfFyMu)f0cid0ciyMfFkNsjt)rWfFclkin0rWpMm)dYn0s)yMn���c��HcluWrWclgUc�yMf0c/uWrW�MciuWh�n0p�uWclyUt�n0p�n0cikNs)m)pMuWpMqMrWkiyMuMyMt)gxyMm)kicldi�:�TuWnFs)pMe)qMsrWn�rWd�t)r ��kle)uWn�n0p�o)fFclt)rWkin6��s)clfFc/n0s)c?w}e)nFe)f0c�yUt)g-yUm)klcldY��rWuWu:klpUv�cM�MpMo)nFrWv�rWd0v1yM�:pMe)n�nFs)cTm)cl~$n�qMclm)cif0yMnFrWpMmpxwHw}pMfFv�yMu$v�clnFs)pIt)d4rWd4�0e)dFnFr �:clt�rWm�gIrWci��pxwVnFs)cTo)fFpMqMfFcldFd6t)e)fFrWm)qTnFs)cTo)yMdFn�t)ciklyMt)cU�V�$e)kNs�o)f0pMqUf0cid0di�-s)px��{clgUclfi�M��rWuWu:dFn0fFpMm)qMuWh�t)cio:cim)tjpMm�kipMm$n0rWm$e)clt�d0e)o)oHpMfFn4w}pMf��)yMdFrWkTfFcldFclyMfFkNs�pMm�m)ci��dFo:clkir �:klyMnFrWpxm�uWyMm)qMe)yUqMcldyMm)t�m)cl��gUclfFr �:klyMnFrWpMm�nFclkNs)m)rWz$e)cldi���yMnFclqMpUf0rWcid6yMm)t��$e)�$�0cikln6�/cldFklfFrWo)nFpMf0di�)�/�W�M� ��� ���)�x 6¡��)�x¢U£��V��pMm$n0fFpMu:�$nFf0e)kin0e)fFc�¤Yclf|w}pMfFv�yMm)klc��Tm)yUuWhIdFrWdyMm)t��Acid0rWqUm��TrWt)d|¥[¦6§i¨N©�ªx«�©¬§®­M¯N« °N�:�/�W�M� ±�� ���)�- Y¡��)�x¢M£��6��rWklfFpMo)fFpMqMfFyMv²�Acid0rWqUm��TrWt)d|¥´³)¯®¨Nµ ¶�·Fªx¸`µ¹§iº)��/� �$� �8� »��x¼¾½-¿YÀ8¢I½i¼¾Á8�:Â4 �Ã6Ä)Å)¼RÁÇÆ4½i��È�ÁM½-È4�x¢$ÉN£���¤6clf|w}pMfFv�yMm)kicj��m)yMuWhIdFrWd�yMm)t��/cid0rWqMm8�TrWt)d|¥´³)¯®¨Nµ ¶�Ê·Fªx¸`µ¹§iº)�6�/� Ë)� ËÌ� ÍK¢)À8Ä)�-Î<Æ4½i�MÈ4ÁM½-È��-¢$ÉN£���¤6cif�w`pMfFv�yMm)klc��Tm)yMuWh$d0rWd/yMm)t��/cldFrWqMm���rWt)d�¥[¦6§-¨N©�ªx«�©�§N­U¯N« °N��/� ±)� ±�� ÏNÂ6Ð6È�½-Ñ)Ò�È�½-Ð6È4½��:Â4 �Ó��)½i��Ô\Ä:À�ÀÈ6Â�¼¾ÁM�)½i¼¾Ä:Â4É®£��]¤Yclf|w}pMfFv�yMm)klcY�Tm)yMuWh$d0rWdYyMm)tj�/cid0rWqMm\�TrWt)d|¥¦6§i¨N©�ªx«)©�§N­M¯®« °0ÕYÖ-¯®¨Nµ ¶�·Fªx¸`µ¹§iº)�$�/� ×$� �/� Ø�¢$Å)¼¾Éi½l¢$�iÙÛÚ��x�:Â4ɮܹ¢$�iÙ®ÃY¢$Ý)¢IÞ)ÏNÀ�Ð4Þ¾¢)À8¢)Â:½i�I½i¼¾Ä:ÂH£��$�/cldFrWqMm/�TrWt)d|¥³)¯®¨Nµ ¶�·Fªx¸`µ¹§iº)���/� ß)� Ëà� Ã6Ä)Å)¼RÁÇÓ�¢$Él¼RÅ:ÂH£����/cid0rWqMm���rWt)d�¥´³D¯N¨Nµ ¶�·Fªx¸`µ¹§-º)���/� á$� �8� ÏNÂH½l¢$Å)�x�)½l¢$ âÔ\¼¾�xÁIÈ4¼R½lÉ®£���/cldFrWqMm��TrWt)d|¥´³)¯N¨Nµ ¶�·0ª�¸}µ�§iº)����� �$�W��� Æ4Ä$Ü�½N¡��)�x¢äã/Â4Å)¼`Â4¢$¢I�x¼}Â�Å$£��æå�clz$e)rWf0civ�clm$n0dNçx�$o:cNkir �]kiyMn�rWpMm$dl�)��� �$� ±� Æ4Ä$Ü�½N¡��)�x¢�ã/Â4Å)¼}Â�¢I¢$�x¼}Â4Å$£���¤�f0pUqMf0yUv´èYclfFr �:klyMnFrWpMm$¥[é/°N°l¯®¨N¸`µ¹§iº·®êI¯F·0ëM¯®¨N°0Õ�·N§i¨N¨0¯F·N¸`º:¯®°N°jì)¨Û§i§`íN°N����� Ë)� �� î/�xÄ)Å)�x�:À�À8¼}Â4Å�ÃY�:Â4Å:È4�)Å)¢$ÉN£��6ï4yMm)qMe)yUqMcA��uWyMdFdFr �:klyMnFrWpMm)d|¥[ðj¯®°Nµ ñ�º�« ªxºIñ�ò]ªiñM¯N°0Õ�³)¯N¨Nó�êMµ ñ�êMÊ�«W¯NÖx¯N«�« ªxº)Êñxò)ªlñU¯N°N�6��� Ë)�W��� ÃYÄ)Å)¼¾ÁUÉ��:Â� ôÍô¢I�:Â4¼`Â4Å)É�Ä$Ü�î/�xÄ)Å)�-�:À8É®£��T�$o:clkir w}h$rWm)q�yMm)t�è6cif0r w`hIrWm)q�yMm)t�åTciyMd0pUm)rWm)qõ�s)rWd/f0cid0ciyMfFkNs�rWd/d0oHpMm)dFpMf0cit�rWm�o)yMfFnT�$h�n0s)c�bÌf0rWqMs$nTï4yM�HpMfFyMn0pUf0hU�I�Tcif0pUm)yMe)n0rWkiyMu:�$h$d0nFclv�dT��cimInFclfi�)�TrWf�)pMfFklc���yMn0cif0rWciu���pMv�v�yMm)t4�HöA�$�T�?�VyMm)t8nFs)cj��t)g-yUm)klclt�å�cldFclyMfFkNs�¤�f0px�FclklnFdT��qMclm)kih8÷}��åT¤:�/ø�e)m)t)cifqMfFyMm$n�mIe)v��:cif/�6ËMËMß)�x×i{�ùMËx{N�N{N�NËMËxú)��è�rWcl��d�yMm)t8klpUm)kluWe)dFrWpMm)d/klpMm$n0yUrWm)clt�rWm�n0s)rWd�t)p$kle)v�clm$nTyUf0c�n0s)pMdFcpxw/n0s)c�yMe)nFs)pMfFd/yMm)tdFs)pMe)uWt�m)pUn��:c�rWmInFclfFo)f0cin0cit�yMdjm)ciklcid0dFyMfFrWuWh�fFclo)fFcldFclm$n0rWm)q�px��klrWyMu�oHpMuWrWklrWcidApUf�clm${t)pMfFd0civ�clm$n0di�lcirWn0s)cif�ci~Io)fFcldFd0citjpUf�rWv�o)uWrWclt4�xpxwVb�fFrWqMs$n�ï4yM�:pMfFyMnFpMfFhApUf�n0s)c�öTm)rWnFclt��$nFyMn0cidæûüp-gUclfFm)v�clm$nl��Tt)t)fFcldFdi����pMv�o)e)nFclf��$klrWclm)kic��/cio)yMf0nFv�clm$ni�-��yMfFm)clqMrWc���cluWuWpUmjö�m)rWgMclfFd0rWn|hM�M×xúMúMú��)pUf0�Hcld6��gMclm$e)cM�x¤�rWnFnFd�{�)e)fFqMs4�M¤:���x×M�$�lËý²Ä)�-þH¼}Â4Å8ÿ��xÄ:È6Ð8ÍK¢)À��Y¢$�-ÉU�Vå�yx�0ciclg���uWe)fl����t)vje)m)t���uWyMfF�Mc/÷`klpx{�kNs)yMrWfNøN�iåTyMm)kicT��uWclyxgMcluWyUm)t4�-�/yxgIrWt�/rWuWu`����uWuWclm���v�clfFdFpMm4���$n0cio)s)clmûüyMf0uWyUm)t4���$n0cigMclm�û/clfFv�yMm4���xpUs)m�û/e)n0nFyMq)�6��mInFs)pMm$h��TyUuWu`�æõ�s)pUv�yMd�Tcim)�lrWm)qMcifl�)û/clfFyMfFt��pMuW�lv�yMm)m4�I��uWr ���xpMm)cidl�)å�pM�:cif0n�/e)fFd0s)yMm4� ��yMm)klh�ï4clgUcldFpMm4��/clm)m)cin0s���kl��rWuWuWyMm4�����p$pMf0cU�V�/pMfFpMm8¤6cluWcit4�V��v�rWf�¤�mIe)ciuWr`���xpUs)må�e)d0s$�IhU����yMnFyMf0yx�FyMm�$s)yMm)�xyMfi���xpUd0cio)s�$r w}yM�$rWdi�V¤�f0yUd0yMt�$rWdFn0uWy)�$��clfFm)s)yMfFt��$nFcN�Vcim4�I¤�rWclfFf0c/b�pUuWo:clfi���xclyUm)m)clnFn0c�b�rWm)q�÷`klpx{�kNs)yMrWfNøN����rWv´bÌpIp$t)klp$kN�:�$yMm)t�¤YyMv�cluWy�HyxgMcM�¤6cif0v�rWdFd0rWpUmAnFpTv�yU�Mc�t)rWqUrWn0yMuxpMfYs)yMf0t\klpMo)rWcidVp�w]o)yMfFn4pMf6yMuWu$pxw)n0s)rWdY��pMfF��w}pMfYo:clfFdFpMm)yMuxpMf6kiuWyMd0dFfFpIpMvOe)d0c�rWdqMfFyMm$n0citT��rWnFs)pMe)n)w`clc6o)fFpxgIrWt)citTnFs)yMn:kipMo)rWcldHyMf0cYm)pMn:v�yMt)cYpMf:t)rWdFn0fFrW�)e)nFclt�w`pMf:o)fFpx�:nHpMf:t)rWfFclkin:klpUv�v�clfFklrWyMuyMt)gxyMm$n0yUqMcTyMm)tÌn0s)yMn�klpMo)rWcidTdFs)px�<n0s)rWd/m)pMnFrWklc\pMm�n0s)c\�:f0dFn/o)yMqMc�pUfArWm)rWnFrWyMuHd0kif0ciclm�pxw�y�t)rWdFo)uWy-h�yMuWpMm)q��rWnFs�nFs)c�w}e)uWuHklrWnFyMn0rWpUm4����pMoIh$fFrWqMsInFdYw}pMf�kipMv�o:pMm)cimInFd6pxw�n0s)rWd���pMfF��px��m)clt��Ih�pMn0s)cif0d�nFs)yMm��T��� vje)dFn�:c�s)pMm)pMfFclt4���T�)dFn0fFyMkin0rWm)q���rWnFs�klfFclt)rWn/rWd�oHclfFv�rWn0nFclt4��õ4p�klpUoIh�pMnFs)clfF��rWd0cU�:nFp�fFclo)e)�)uWrWdFs4�]nFp�o:pMdFn/pMmdFclfFgMclfFdl�in0p�fFclt)rWdFnFf0rW�)e)nFc4n0p/uWrWdFn0di�MpMf6nFp/e)d0c�yMm$h�kipMv�o:pMm)cimIn)p�wVnFs)rWd6��pUf0��rWm�pMnFs)clf6��pMfF�Idi�xf0cizIe)rWfFcld4o)fFrWpMfdFo:clkir �:kjoHclfFv�rWd0dFrWpMm�yMm)t:çxpMf/y�w}cicM��¤6cif0v�rWdFdFrWpMm)dTv�yxh��:c�fFclz$e)cldFn0cit�w}fFpMv ¤�e)�)uWrWklyMnFrWpMm)d��/clo)ni�V�T�����m)kU�W�I�-×]�-×���fFpMyMt)��yxhM����cl����pMf0�H�������lúMúMËUßTöA�$�\�xw}yM~��\��÷��$�-�Mø��MßUùx{�úM±��)�M�NpMf������! �"�#�#$"&%�'$#�(*)�+, .-/%���0)�

Page 2: Formal Methods: State of the Art and Future Directions Edmund M

� � ��������� �� �������������������������

�T�HpMe)n4¤�fFpMqMfFyMv�d|¥� 8¯0·®êIªxº)µ}·Fªx«$Ö-¯®¨Nµ ¶�·Fªx¸`µ¹§iºIÕ"!MìI¯F·Nµ ¶�·0ªx¸`µ�§iº�¸¹¯F·NêUº)µ$#Nò)¯N°N�$��� ±)�W��� ÍK�)½-¿4¢)À8�)½l¼RÁM�)Þ:ÃYÄ)Å)¼¾Á�:Â4 &%4Ä)�MÀ8�)Þ�ÃY�:Â4Å:È4�)Å)¢$ÉN£��6��yMnFs)clv�yUn0rWkiyMuIï4pMqUrWkN¥� 8¯0·®êIªxº)µ`·0ªx«Y¸}ê$¯Û§i¨F¯N©�ì)¨N§iÖlµRºIñû/cim)clfFyMu)õ4clfFv�dl�6�$pxw}n|��yMfFcTcim)qMrWm)clcif0rWm)qD�lw`pMf0v�yUuIv�cin0s)p$t)dl�xs)yMfFt)��yUf0c�gMclfFr �:klyMnFrWpMm�Tt)t)rWnFrWpMm)yMu$/clh�b�pMfFt)d�yMm)t�¤�s)fFyMdFcldi���$p�w}n���yMfFcAdFo:ciklr �:kiyMn0rWpxm4�lv�p$t)clu)kNs)cikN�IrWm)qD�-nFs)clpMfFclv�o)fFpxgIrWm)q

' =)(+*�,.-0/21�Z\>3,4( /�*57698;:=<>6�8�?@69A=:CB;D�E�FG<H698;?IB;JKB;F�?�LMB&<>N+O+O.N+A=?�PKN+FQ69R=O+JTS8�D�<UN+AVB�WX6�O+?Y6�A=:ZE\[=A=W]F;N+DA�69O+N$FGJK^_`?�WX6�[aB;?`D�E=F;b=N+B�N$AaW�8;?X69B;?cN+A)W�DdLMe=O+?�fKN+FGJhgiF�b=?cO+N+j?�O+N+b=DKDK:.D9EhB;[aR=F;O+?c?�8�8;Dd8;BkN+BlL�[=Wib.Sd8;?X69F;?�8m^n&Dd8;?�D�Pd?�8Xg4B;DdLM?&D�E2F;ba?�B;?Y?�8�8;Dd8;B&L�6mJYWX69[=B;?IWX69FQ6�B�F;8�De=b=N+WIO+DB;BoD�E2LMDdA=?�JKg`F;N+LM?gpD8?�Pd?�AqbK[=L&6�ArO$N�E\?d^qstL�6�uvD8�SDK6�O>D9EwB;D9E\FG<H698;?x?]A=SN+A=?�?]8;N+A=STN+BoF;DT?]A�6�R=O+?x:a?�P?�O+Dde�?�8�BF;DYW]DA=B�F;8;[aW�F&B;JKB;F�?�LMB�F�b�6�F�Dde�?�8i6�F�?y8�?�O+Nz69R=O+JY:=?�B�e=N+F;?xF�b=N+B�W�DLoe=O+?�fKN$FGJK^|{.Aa?x<H6mJYD9E6�Wib=N+?�PKN+A=SIF;b=N+B�SdDh6�O`N+B�RKJY[=B;N+A=Sx}�~d�������>�w�m�$�a~X�9��g�<>baN$WibV6�8�?&L�6�F�b=?�L&6�F;N+WX69O�O+Jd��R�6�B;?]:O�6�A=Sd[�6�Sd?�BXgaF;?�Wib=AaN$�K[=?]BXgl69A=:xF;DKDdO$B`E�D8.B�e�?]W�N�E\JKN$AaSM6�A=:xPd?�8;N�E\JKN+A=S�B�[=WibxB;JKB;F�?�LMBm^>�.B�?wD9EE\Dd8;L�69OKLM?�F�b=DK:=Bk:=DK?�B�AaDF.�4�0����~�]�Sd[�6�8i6�AKF;?�?4W�D8�8;?�W]F;A=?�B�BX^`5.D�<`?�Pd?�8XgKF�b=?�J�WX6�AoS8;?m6�F;O+JN+A=W�8�?X6�B�?�Dd[=82[=Aa:=?�8;B�FQ69A=:=N+A=SID�E.6&B;JKB;F�?�L�RKJI8;?�Pd?X6�O+N+A=SxN+A=W�DdA=B;N+B�F;?�A=W]N$?]BXg�69L�R=N+S[=N+F�N$?]BXg6�Aa:�N+A=W]DLMeaO$?]F;?�A=?]B;B;?]B.F;b�6�F>LMN+SdbhFkDdF;b=?�8�<>N+B;?2SdD�[=A=:=?�F�?�W�F�?�:l^�>b=?>��8;B;F4e�6�8�F�D9E�F�b=N+B>8;?�e�D8�F.6�B;B�?�B;B�?�B)F;b=?�B;FQ69F;?)D�EkF;b=?2698;F>N+Ax���=�Q�m� �c�i�d�\��~d��6�A=:I�X�m�i�

� �c�i�d�\��~d�=^|�=Dd8wPd?�8;N���WX69F;N+DA�gc<`?Mb=N+SbaO$N+SdbhF�6�:=P69A=W�?�B�N+Aq��~m��]�.�Q�a�Q�i�d����x69A=:q�+�=�i~���X��3��~�m����d^c�GA&F;ba?2F;b=8�?�?2B�?�W�F;N+DdA=B.DdA�B�e�?]W�N���WX6�F�N+DAlgaLMDK:=?�O0Wib=?�WijKN+A=S�g�6�A=:&F�b=?�D8�?�L�e=8�D�P�N+A=S�ga<�?�?�fKe=O�6�N+A&<>b�6�F4<�?2Lo?X6�A&RKJ&F;b=?�S?]A=?�8Q69OkF;?�Wib=A=N+�K[=?�6�A=:&R=8�N+?i �Jx:=?]B;W�8�N$R�?�B;DLo?B;[aW�W�?�B�BGE\[=O�WX69B;?>B;F�[=:=N+?�Bc6�Aa:w<`?�O+O���jKA=D�<>A)F;DKDdO$Bm^0�>b=?`B;?�W]DA=:�e�698;FkD�E=F�b=N+B�8�?�e�D8;FkDd[=F;O+N+A=?�BE\[=F�[=8;?�:aN$8�?�W�F�N$DdA=B)N+AxE\[aA=:�6�Lo?�AKFQ69OlW�DdA=W�?�e=F�BXgkA=?]<¡LM?]F;b=DK:=B26�Aa:yF�DhDdO+BXg0N+AKF;?�Sd8Q69F;N+DAxD9ELM?]F;b=DK:=Bmg=6�A=:o?�:=[=WX69F;N+DAx69A=:MF�?�Wib=A=DO+DdSJ�F;8i6�A=B¢E\?�8m^c£Y?.W]O$DdB;?)<>N+F;boB;[=LoL�6�8�J28;?]L�6�8�jKB6�Aa:�e�DN+AKF;?]8;B>F;D�8�?�B;Dd[=8;W]?�B4E\D8>LoD8;?4N+AKE\D8�L�69F;N+DAl^

¤ =>¥K,0¦0,�2M/2§�,.¨�2M¦4-�,�GA&F;b=?)e�69B;Fmg=F;ba?7[aB;?2D9ElE\Dd8;L�69O�Lo?�F;baDh:aB�N+AMea8Q6�W]F;N+W�?2B�?�?�LM?]:�baDe�?�O+?�B;Bm^��>ba?7AaDFQ69F;N+DAaB<`?�8;?>F�DhD)DdR=B;W�[a8;?gKF�b=?>F;?�Wib=AaN$�K[=?]Bc:=N+:wAaDFkB;WX69O+?gh69A=:�F;b=?>F�DhDdOKB;[=e=e�D8�Fc<>6�BkN+A�6�:=?]�h[�6�F;?D8kF�DhD)b�698;:�F�D7[aB;?^k�>b=?]8;?.<`?�8�?>DA=O+J264E\?�<rA=DA©��F�8;N+PKNz69OKWX6�B�?>B;F;[a:=N+?�B�6�Aa:�F;DSd?�F;ba?�8cF;ba?�JB;F�N+O$Ok<`?�8;?�AaDF)W�DAKPKN+A=W�N+A=So?�A=D[aSbIF;D&F;b=?�ea8Q6�W]F;N+W�N+A=S&B;D9E\FG<H698;?�D84b�6�8�:=<H698;?�?�AaSN+A=?�?�8m^�a?�<qe�?�Dde=O+?7b�6�:&F;b=?)F�8Q6�N+A=N+A=S�F;D�[aB;?2F�b=?�Lª?i«3?]W�F;N+P?]O$J&DdAMF;ba?�uiDR�^{4A=O+J�8�?�W�?�AKF�O$JYb�6mP?�<�?�R�?]S[=AYF�D�B�?�?M6oLMDd8;?2e=8�DLoN$B�N+A=S�e=N+W�F;[a8;?�E�D8.F�b=?�E\[=F�[=8;?�D9E

E\Dd8;L�69OLo?�F;b=DK:=Bm^l�aD8kB;D9E\FG<H698;?`B;e�?�W�N���WX69F;N+DA�gN+A=:=[aB;F;8�J2N+BkDe�?�AwF�D)F;8;JKN+A=S)D[aF�AaDFQ69F;N+DAaBO+N+j?�¬YF;D­:=DKW�[=LM?]AhF26oB;JKB�F;?�LI® B)e=8�De�?�8;F�N+?�BwLoD8�?28;N+SDd8;Dd[=B;O+JK^w�aD8)b�6�8�:=<>6�8;?�Pd?�8;N���Wm6m�F;N+DdAlg�N$Aa:=[=B;F�8;JxN+B)6�:=Dde=F;N+A=SoF;?�Wib=A=N+�K[=?�B�O$N+jd?7LoDK:=?�OlWib=?]WQjKN+A=Sx6�Aa:yF�b=?�D8�?�LUea8;D�PKN+A=S�F;DW�DdLMe=O+?�Lo?�AKFwF�b=?xLMDd8;?&F;8i6�:=N+F�N$DdA�6�O4DA=?­D�E2B;N+L�[=O�6�F�N+DAl^Z�GAVR�DdF;bq698;?X69BXg>8�?�B;?m6�8;Wib=?]8;B6�Aa:�ea8Q6�W]F;N+F;N+DAa?�8;B26�8�?2e�?�8GE\Dd8;LoN$AaSwLoD8;?)6�A=:­LMD8�?.N+A=:=[aB;F;8�N�6�O���B�N+¯�?�:xWX69B;?2B�F;[=:aN$?]BXgl69A=:F;ba?�8;?�RKJ&Sh69N+A=N+A=S2F;ba?2R�?]A=?i��F�B.D�Ec[=B�N+A=S2E�D8;L&6�O�LM?�F�b=DK:=BX^

¤ = ' ¥�°)G�±IQ ²=±IB$LlQ X69³ e�?�W�N���WX69F;N+DA�N+BlF�b=?�ea8;DKW�?�B�BcD�E=:=?�B�W�8;N+R=N+A=S26´B;JKB;F�?�Lµ69A=:2N+F;B�:=?�B;N+8�?�:�e=8;Dde�?]8;F;N+?�Bm^c�=Dd8;L&6�OB;e�?�W�N���Wm6�F;N+DdA�[aB;?�B)62O�6�AaS[�69S?.<>N+F�b�6�L�6�F�b=?�L&6�F;N+WX69O+O�Jd��:a?i��A=?�:�B�JKAhFi6�fM69A=:MB�?�L�69AhF�N+W�BX^�>b=?4jhN+A=:aBcD�E0B;JKB;F�?�L¶e=8�De�?�8;F�N+?�B�LoN+SbKFlN+A=W�O+[=:a?>E\[=AaW�F;N+DA�6�O=R�?�b�6mPKN+D8mg�F;N+LMN+A=S4R�?]b�6mPKN$Dd8Xge�?�8GE\Dd8;L&6�A=W�?oWib�6�8i6�W�F�?�8;N+B;F�N+W�BXg`D8�N+AKF;?�8�A�6�O>B�F;8;[aW�F;[=8�?^ ³ DxEG6�8XgkB�e�?]W�N���WX6�F�N+DA|b�6�B�R�?�?�A

Page 3: Formal Methods: State of the Art and Future Directions Edmund M

��� ��c��=�)����� � ���� ������� ��� �������� ��k����� ��� � � z������ z�����G� � �� � �

LMDdB;F�B;[=W�W]?�B;B¢E\[=OaE\D8�R�?�b�6mPhN+Dd8Q6�OKe=8�De�?�8;F�N+?�BX^`{.Aa?�W�[a8;8;?]AhFpF;8;?]A=:�N+B�F�D.N+AKF;?�Sd8Q69F;?`:=N�«3?�8�?�AKFB;e�?�W�N���Wm6�F;N+DdAMO�6�A=Sd[�6�Sd?�BXg9?X6�Wib�69R=O+?>F;D2b�6�A=:=O+?.64:=N�«0?�8;?�AKF.69B;e�?�W�F`D�El6)B;JKB;F�?�Ly^ks4A=DF�b=?�8N+B&F;DTb�6�A=:=O+?IA=DA©��R�?�b�6mPKN+D8i6�O769B;e�?�W�F�BxD�EM6YB�JhB�F;?�L O+N$jd?xN+F;B&e�?�8GE\Dd8;L&6�A=W�?dg.8�?X6�O��GF;N+LM?W�DdA=B;F�8Q6�N+AKF;Bmg=B�?�W�[=8�N$FGJ&e�DO+N+W�N+?�BXg=69A=:x6�8�WQbaN$F�?�W�F�[=8Q69Ol:=?�B�N+SAl^³ DLo?0E\Dd8;L&6�O�Lo?�F;b=DK:=B0B�[=Wibw6�Bk¬�� ³ eaN$Pd?�J�� �"!�! #;g�$&%)n'� (DAa?�B)� �"!"*+#;g�6�A=:-,l698;Wib��/.)[=F¢�

FQ69S.6�A=:�5.D8�A=N+A=S-�����"0+#�E\DKW�[=BkDA)B;e�?�W�N�E\JKN+A=S4F;b=?cR�?�b�6mPKN+D8�D�E=B;?]�h[a?�AKF;N�6�OKB;JKB�F;?�LoBX^ ³ Fi6�F�?�B6�8�?y:a?�B;W�8�N+R�?�: N+ACF;?�8�LMBoD�Ew8�N$WibCL�69F;b=?�L&6�F�N$Wm6�O`B;F;8�[=W�F�[=8;?�BIO+N+j?xB�?�F;Bmg)8;?�O�6�F�N+DA=Bmg769A=:E\[=AaW�F;N+DAaB�1�B;FQ69F;?�F�8Q6�AaB;N+F;N+DAaB 698;?�SN+P?]AxN+AyF�?�8;LoB7D9E�e=8�?i� 69A=:ye�DB�FG�GW�DAa:=N+F;N+DA=Bm^w{4F;ba?�8LM?]F;b=DK:=B)B;[aWQbT69B-2 ³43 � 54Dh6�8�?5� �"!�6 #;g�272 ³ ��n&N+O+A=?�88���"!�9 #;g ³ FQ69F;?�Wib�698;F�B5� 57698;?�O7� �"!":+#;g�k?�LMe�D8i6�O),"DSdN$W;� 3 AK[=?]O$N<����!4��1�nx69A=A�6x69A=: 3 AK[=?]O$N-� �"�=�"1>,l69LMe�D8�F�����!?#;gk6�A=:Y��@d{6�[aF;DL&6�Fi6��/,0JKA=WibY6�A=:­��[aF;F;O+?�� �"!�: #kE\DKW�[=B4DAIB;e�?�W�N�E\JKN+A=SMF�b=?wR�?�b�6mPKN+D8)D9E�W�DAaW�[=8;8�?�AKFB;JKB�F;?�LoB�1�B;FQ69F;?�B�FGJheaN$Wm6�O+O+J�8i6�A=Sd?�D�P?�8)B�N$Loe=O+?):=DL&6�N+A=B.O+N+j?�N$AKF�?�S?�8�B2D82698;?�O+?iE\F)[=A=N+AK�F;?]8;e=8�?�F;?�:�gl6�A=:&R�?�b�6mPKN+D8`N+B>:=?i��A=?]:yN+AMF�?�8;LoB>D�EkB;?��K[=?�AaW�?�BXg�F;8�?�?�Bmg�Dd8>e�6�8�F;N�6�O0Dd8;:=?]8;B.D9E?�Pd?�AKF;BX^ ³ F�N+O$OpDF;ba?�8;B�B�[=Wib 6�BBA>s4� ³4C � D.N+?�O+B;?]AT?�F�6�OG^>� �"!"�+#H6�Aa:E,l{4�.{ ³ � � ³ {F����!":+#<`?�:MFG<`Dw:aN�«0?�8�?�AKF>LM?�F�b=DK:=BXgKDdA=?>E\Dd8�b�6�A=:=O+N+A=S28�N+WQboB;Fi6�F;?)B�e�6�W�?]B.6�A=:oDA=?4E\Dd8�b�69A=:=O+N+A=SW�DdLMe=O+?�fKN+FGJx:=[=?oF;DIW�DAaW�[=8;8�?�A=W�JK^G2`DLMLoDA&F;DY6�O+O`F;b=?]B;?&LM?�F�b=DK:=B�N$B�F;b=?&[=B�?MD�E)F;b=?L�69F;b=?]L�6�F�N+WX6�O=W]DA=W�?]e=F;B4D�E 69R=B;F�8Q69W�F;N+DAI6�A=:oW�DLoe�DdB;N+F;N+DA�^�>b=?>e=8�DhW]?�B;B`D�ElB�e�?�W]N���WX6�F�N$DdA�N+BcF;b=?.69W�FcD9E3<>8�N$F�N+A=S)F;b=N+A=SdBc:=D�<>A�e=8;?�W]N$B�?�O+Jh^k�>ba?>L�6�N+A

R�?�A=?i��F>N+A�B�Dw:=DdN+A=S2N+BcN+AKFQ6�AaSN+R=O+?�HVSh69N$AaN$AaS.62:=?]?�e�?]8>[=A=:=?�8�B;Fi6�A=:=N+A=S�D�ElF�b=?.B�JKB;F;?]L R�?i�N+A=S)B;e�?�W�N���?�:�^c�GFcN+BkF;b=8�D[=Sdb�F;b=N+BkB;e�?�W�N���Wm6�F;N+DdAMe=8�DhW]?�B;B`F;b�69Fc:=?�Pd?�O+De�?�8;B`[=A=W]D�P?�8c:a?�B;N+SA 36m<>BmgkN$AaW�DA=B�N+B;F;?]A=W�N+?�BXg>69L�R=N+S[=N+F;N+?�Bmg�69A=:YN+A=W�DdLMe=O+?�F�?�A=?�B�B;?�Bm^TsªFQ69A=SN+R=O+?�RKJd��e=8�DK:=[=W�FD�EcF�b=N+B>e=8;DKW�?�B�BXg0baD�<�?�Pd?�8Xg�N+B.6�AI6�8;F�N�E�6�W�Fmg=<>b=N+Wib&N+F;B;?]O�EcWX69AxR�?)E\D8�L�69O$O+Jw69A�6�O+JK¯�?�:�g�?d^ S�^+gWib=?�Wij?]:�F;D)R�?`N+AKF;?�8�A�6�O+O+J)W�DA=B�N+B;F;?]AhFpD8k[=B;?]:�F;D.:a?�8;N+P?`DF�b=?�8cea8;De�?�8�F;N+?�BcD9E�F;b=?>B�e�?]W�N���?�:B;JKB�F;?�LI^c�>b=?)B;e�?�W�N���Wm6�F;N+DdAxN+B.6�[=B;?iE�[=OlW�DdLML�[=AaN$Wm6�F;N+DdAw:=?]PhN+W�?�R�?�FG<`?�?�A­W�[=B;F�DLo?�8769A=::=?�B�N+SA=?�8mgKR�?]FG<�?�?]A�:a?�B;N+SAa?�8.6�A=:�N+Loe=O+?�LM?�AKF�D8Xg�69A=:MR�?�FG<`?�?�A&N+LMe=O+?�L�?�AKF�D8c6�A=:�F�?�B;F�?�8X^�GF2B�?�8;Pd?�BM6�Bw6 W�DLoe�6�A=N+DdAx:=DKW�[=Lo?�AKF7F�DxF;ba?MB;JKB�F;?�LI® B�B;D[a8;W�?oW�DK:=?gkR=[=F�6�F�6MbaN$Sdb=?�8O+?�P?]OlD�Ek:=?�B�W�8;N+e=F�N$DdAl^

IKJML N4OQP�RTSVU�N4WYXQPZR4[

H]\_^+\�`c^>{4fE�D8;:Z�.A=N+P?]8;B;N+FGJq69A=:V�G_>n 54[=8;B�O+?�Ja,l69R�Dd8Q69F;D8�N+?�B&W�DO+O�6�R�D8i6�F;?]:VN+AVF;b=?����!"9�B`DAo[=B;N+A=SM¬­F;D�E\Dd8;L�69O+N$¯]?>e�6�8�F>D�E��G_>nY® B�2`[=B�F;DLo?�8>�GAKE\Dd8;L&6�F;N+DdAb2`DdAhF�8;DdO ³ JKBG�F;?�LIg�69A DdAK�GO$N+A=?&F�8Q6�AaBQ6�W]F;N+DAVea8;DKW�?�B�B;N+A=STB�JKB;F;?]L <>N+F;b|F;baD[=Bi6�A=:=BoD�E2N+A=B;Fi6�O+O�6�F�N$DdA=B<�Dd8;O+:=<>N+:=?�� 54D[=B�F;DAT69A=:dc7N+A=SY� �"�4�e#;^�n ?X6�B�[=8;?�Lo?�AKF;B2Fi6�jd?�AYRKJx�G_Hn F�b=8;Dd[=SbaD[=FF;b=?�:=?�P?]O$Dde=LM?]AhF>ea8;DKW�?�B�B2N+A=:=N+WX6�F�?�:y69AxD�P?�8i6�O+O0N+LMe=8�D�P?�Lo?�AKF�N+A&F;ba?w�K[�69O$N+FGJ�D9E�F;b=?e=8;DK:=[aW�FXg`6&8;?�:a[=W�F;N+DdA N+AYF�b=?MAK[=L�R�?�82D9E7?�8�8;D8�B�:=N+B;W�D�Pd?�8;?]:lg�69A=:Y?X6�8�O+N$?]8w:=?]F;?�W�F�N+DAD�E�?]8;8;Dd8;B4E\Dd[=A=:IN$A­F;b=?�e=8;DKW�?]B;BX^��G_>n 69O+B;DM?]B;F;N+L&6�F;?]:y6���fª8;?�:=[aW�F;N+DAYN+AxF�b=?�F;DFi6�O:=?�Pd?�O+De=Lo?�AKFcW�DB�F>D�ElF�b=?)A=?�<C8;?�O+?X69B;?^p�>b=?.B�[=W�W�?�B�B)D�ElF;baN$B><`D8�j�N+B�<`?�O+O���jKA=D�<>AM69A=:8;?�B�[=O+F;?�:­N$AoF;b=?8g.[a?�?�Al® B.s4<H698;:oE\Dd8��k?�Wib=A=DdO+DSN+WX69O�s4Wib=N+?�P?�Lo?�AKFX^k�GF>N+A=B�e=N+8;?�:&L�69AKJDF�b=?�8;B>F�D�E\DO+O+D�<|B;[=N+Fm^

H]\_hi^ `c^0�GAj� �"��k 3 8Q6�fKN+B2:=?]O$N+Pd?�8;?�:YF�DxF;ba?���cl2`N+PKN$Oks4PhN�69F;N+DAIs.[=F�b=D8�N+FGJyF�b=?�272>�%4N$B�e=O�6mJ)�GAKE\D8�L�69F;N+DA ³ JhB�F;?�LIg6)e�698;FcD9E3F�b=?.Aa?�<V6�N+8kF;8Q6+mMW.L&6�A�69S?�Lo?�AKF0B;JKB;F�?�L E\Dd8,0DdA=:=DA�® Bk6�N+8;B�e�6�W]?&� 5769O+OM�����"*+#¢^n27%.� ³ N$Bc64:=N+B;F�8;N+R=[=F�?�:lgmEG6�[=O+FG�GF;DdO+?�8Q69AhF�B;JKB;F�?�L¡N+Loe=O+?i�LM?�AKF�?�:wDdA�A=?X698;O+J5� 9"94W�DdLMe=[=F�?�8;BpO$N+A=jd?�:�N$AM64:=[�6�O�O$DKWX69O�6�8�?X6)A=?]FG<�Dd8;j0^ 3 8Q6�fKN+Bc[=B�?�:E\D8�L�69O�Lo?�F;b=DK:=B)6�B26�A­N$AKF�?�S8i6�Oke�6�8�F.D9E�F;b=?�:=?�Pd?�O+De=Lo?�AKF.e=8�DKW�?�B;B�6�A=:xN+AxW]DAXui[aA=Wi�F;N+DA�<>N+F;b�DF�b=?�8cB�D�E\FG<>6�8�?>?�A=SN+A=?]?�8;N+A=S�ge=8�DXui?�W]FcL�69A�6�Sd?�LM?�AKFmgX6�Aa:��h[�6�O+N+FGJ 69B;B�[=8Q69A=W�?F;?�Wib=AaN$�K[=?]BX^Q%.[a8;N+A=S.8�?��K[=N+8;?�Lo?�AKF;Bk6�A�69O$JKB�N$BmgiE\Dd8;L&6�O�:=?�B�W�8;N+e=F�N+DA2B�[=e=e=O+?�Lo?�AKF;?�:2N+AKE�D8G�

Page 4: Formal Methods: State of the Art and Future Directions Edmund M

� � ��������� �� �������������������������

L�69Oh6�Aa:wB�F;8;[aW�F;[=8�?�:&8;?��K[=N+8�?�LM?�AKF�B�AaDFQ69F;N+DAaBX^�s>F�F�b=?>B;JKB�F;?�L¶B�e�?]W�N���WX6�F�N+DA�B;Fi6�Sd?gh69A6�R=B�F;8i6�W�F $&%)ntLMDK:=?�O0<>6�B4:=?�P?]O$Dde�?]:xN+A�W]DAXui[aA=W�F;N+DdA�<>N+F�bxW�DAaW�8;?�F�?w[aB;?�8)N+AKF;?�8¢E�6�W�?:=?i��AaN$F�N+DA=BmgcB;?]LMN��\E�D8;L&6�Ok:=?i��A=N+F;N+DA=B�D�E)F;b=?­W�DA=W][=8;8�?�AKFMR�?�b�6mPKN+D8Xg`6�A=:r:=?i��AaN$F�N+DA=BD�E�?]fhF�?�8;A�6�OcN+AKF;?�8¢E�6�W]?�BX^B%4[=8;N+A=S&:=?]B;N+SAlg"F;b=?�6�R=B�F;8i6�W�F-$<%)n�<>6�B)8;?v��A=?�:YN+AKF;DoLMD8�?W�DAaW�8;?�F�?wLoDK:=[=O+?)B;e�?�W�N���WX69F;N+DA=Bm^.s>F)6�O+D�<`?�8>O+?�P?�OGgaF;b=?�B;D9E\FG<H698;?)E�D8>F;ba?w:=[�6�O ,"s�D<H69B�B�e�?]W�N���?�:Y6�A=:o:=?�P?]O$Dde�?]:&E\D8�L�69O$O+J2[aB;N+A=SB272 ³ ^3 8;DK:=[aW�F;N+PKN+FGJwDdAMF;ba?7ea8;DXui?]W�F><H69B�F�b=?.Bi6�Lo?>D8`R�?�F�F;?�84F;b�69AMDdA�W�DLoe�6�8i6�R=O+?>e=8�DXui?�W�F�BWX6�8�8;N+?�:VDd[=F�[=B�N$AaSTN+AKE\Dd8;L�69O�Lo?�F;baDh:aBX^V�>ba?�8;?I<H69BXg>N+A|DF�b=?�8o<�Dd8;:=Bmg>A=DYA=?�F&W�DdB;FN+Ay[=B�N+A=SoE\D8�L�6�OkLo?�F;b=DK:=Bm^�5.D�<`?�Pd?�8Xg�F;b=?oe�?]8;W�?�N+Pd?�: 69A=:yLo?X6�B�[=8;?]:Y�h[�6�O+N+FGJxD�E>F;b=?B;D9E\FG<H698;?`<H69BcL�[=Wib2b=N+Sdb=?�8X^��>b=?>:=?]O$N+Pd?�8;?�:�B�D�E\FG<>6�8�?>b�6�:�64:=?iE\?]W�F�8i6�F�?>D�El6�R�D[=F)9a^/:"6E�6�[aO$F�B>e�?]87F�b=D[aBQ6�Aa:xO+N$Aa?�B>D�E�W]Dh:a?g06���Sd[=8;?2FG<`D�F;DoF;?�AIF;N+Lo?�B�R�?�F�F;?�82F�b�6�A­F;b�69F>E\Dd8e=[=R=O+N+B;ba?�:Me=8�DXui?�W]F;B769A=:&DAoW�DLoe�6�8i6�R=O+?>B;D9E\FG<>6�8;?)N+A�69N+8�F�8Q6 mMW)W�DdAKF;8;DdOl6�e=eaO$N+WX69F;N+DAaBF;b�69F�:aN$:&A=DdF>[=B;?4E\Dd8;L&6�O�LM?�F�b=DK:=BX^

H��>J������QR R \�� ����c^ 3 8Q6�fKN+Bkb�6�B�R�?]?�Aw8�?�W�?�AKF�O$J�<�Dd8;jKN+A=S.<>N+F;b-,"DhWijKb=?�?]:�DAw69A�6�O+JK¯�N+A=SF;b=?�W�DK:=?�E\Dd8)F;b=?M6mPKN+DA=N+W2B�D�E\FG<>6�8�?wD9EHF�b=?�,0DKWijKb=?�?�:E2<� 0"9 ( �/2`8�D�fE�D8;:I6�A=: ³ [=F�F;DA�����"6 #�R�?�N+A=S�B;[ae=e=O+N+?�:MF�D2F;b=?)� ³ s.N+8>�=Dd8;W�?)6�A=:iA>s)��^d�>b=?4B;D�E�FG<H698;?.N+B`W�DK:=?�:oN$AoF;b=?³43 s&AVc4�¢69A=A=DFi6�F�?�:wB�[=R=B�?�F�D9E3s4:�6=^ ³ e�?�W�N���WX69F;N+DAaB�6�8�?><>8;N+F;F�?�AMN+A�F;b=? ³ D9E\FG<>6�8;? 3 8�D��:=[=W�F�N+PhN+FGJi2`DA=B�D8;F�N+[=Ly® B72>{&A C A=DdFQ6�F�N+DAY� ³43 2 ���"��0 #;gK<>b=N+WibxN+B>R�6�B�?�:IDA 3 6�8;A�6�BX® BFQ69R=[=O�6�84B;e�?�W�N���WX69F;N+DA=Bi� 5.?�AaN$AaS?�8B����!"9=1 (K6�A=N+WijKN�?]Fw6�OG^Q�����"* #;^�nx6�AKJx<`D[=O+:I?�fKe�?]W�FF;b�69F.F�b=?w[aB;?�D�E ³43 s<A7c¶<`D[aO$:x69:=:yF�DMF�b=?wW]DB;F�D�EcF;b=?�B�D�E\FG<>6�8�?g�<>b=N+O+?2N+LMe=8�D�PhN+A=SN+F;B2�K[�69O$N+FGJK^��>b=?M69:=:=?�:r�h[�6�O+N+FGJhg�b=D�<`?�P?]8Xgk:=?�W]8;?X69B;?�:|F;ba?MD�P?]8Q6�O+OcW]DB;F�D�E>B;D9E\FG<>6�8;?:=?�Pd?�O+De=Lo?�AKF.R�?�WX6�[aB;?MD9EHF�b=?�bK[=S?�Bi6mPKN$AaSB)N+AyF�?�B;F�N$AaS�^��>b=?�[aB;?�D�E ³43 s<A7c 69A=A=D��FQ69F;N+DA=B4F;D&B;e�?�W�N�E\J­F;b=?�R�?]b�6mPKN$Dd8)D�E�F�b=?wLoDK:=[=O+?�B.O+?�:IF;DoB;D9E\FG<H698;?�<>b=N+WibyN+B.W]O$DdB;?�F;DR�?]N$AaS��;W�Dd8;8�?�W�F�RhJIW�DdA=B;F�8;[=W�F�N+DA�Y6�A=:Yba?�A=W�?oe�6�B�B;?�B�N+F;B�F;?�B�F;B�N+A=B;F�?X6�:YD9E.8;?��K[=N+8�N$AaS?�fKe�?]A=B;N+P?�8;?�<`D8�j3^

H��8\��i`c^��GAYF;b=?�?X6�8�O+JE�����"9�Bmg0F;ba? ³ 6mE\?]FGJ��2`8;N+F�N$Wm6�O ³ JKB;F�?�LMB-A>?]B;?X698;WibE.)8;Dd[=eY6�F)F;b=?�.A=N+Pd?�8;B�N$FGJ�D9E 2>69O$N�E\Dd8;A=N�6ag��G8;PKN+A=?���A=D�<C6�F>F;ba?7�4A=N+P?�8�B;N+FGJMD9E�£T69B;b=N+A=SdF;DA��ke=8;DK:=[aW�?�:6oE\Dd8;L�69Ok8;?��K[=N+8;?]LM?�AKF;B�B�e�?]W�N���WX6�F�N+DAYE�D8�F;b=?o��8i6 mMW�2`DdO$O+N+B;N+DdAys4PDN+:�69A=W�? ³ JKB;F;?]L����2`s ³ ���;��gp8;?��K[=N+8;?]:VDAV6�O+O>W�DdLMLo?�8;W�N�69OH69N$8�W�8Q6 E\F� �JKN+A=SIN$A|��^ ³ ^c6�N+8;B�e�6�W�?d^q�>ba?�J[=B;?]:qF�b=? A´?��K[=N+8;?�Lo?�AKF;B ³ Fi6�F;?Ynx69WQbaN$Aa? ,�6�A=Sd[�6�Sd?��ZA ³ n;,��]g`<>b=N+WQbCN+BMR�69B;?�: DdA³ FQ69F;?�Wib�698;F�Bw<>N+F;bYWib�69A=S?]BwL&6�:=?�F;DID�P?�8�W�DLo?w:aN mMW][=O+F;N+?�B)E\Dd[=A=:Y:=[a8;N+A=SxF�b=?MB�e�?�Wv�N���WX6�F�N+DA|e=8;DKW�?]B;BX^ s4O+F;b=Dd[=SbV6�AZN$Aa:=[=B;F�8;J|S8�D[=eZ<H69B�6�F�F;?�Loe=F;N+A=SIF;Dre=8;D�PKN+:=?y69AC A=SdO$N+B�bYOz69A=S[�6�S?�B�e�?]W�N���WX6�F�N+DA 69FwF�b=?&BQ69LM?�F;N+Lo?glF�b=?MW]DLMeaO$?]fhN+FGJxD9E.��2`s ³ N$L �e�?]:=?�:|F;b�69F�e=8;DKW�?]B;B�14?�Pd?�AKF;[�69O$O+JrF;b=? C A=SdO+N$B�bTB�e�?�W]N���WX6�F�N$DdA|?i«3Dd8;Fo<H69B�69R�6�A=:aDA=?�:6�A=:oF;b=?-A ³ n;,­B;e�?�W�N���WX69F;N+DA&<>6�B>6�:=Dde=F;?�:&N+A=B�F;?X69:l^ks>E\F�?�8.6�S8;Dd[=eMD9E�N+A=:=[aB;F;8�J�69A=:[=A=N+P?]8;B;N+FGJo8;?�e=8�?�B;?]AhFi6�F�N$Pd?�B�e=8;DK:=[=W]?�:@6���8;B�F):=8Q6 E\F.D9E F�b=?���2`s ³ ���>B;e�?�W�N���WX69F;N+DAlg�6e=8;N+P69F;?>W�DdLMe�69AhJ�DA�R�?�b�69O�E�D�ElF�b=?2�=?]:=?�8Q69O0s.PKN�6�F�N$DdAws4:=LMN+A=N+B�F;8Q69F;N+DA�F;DKDdj�D�P?�8`F;b=?B;e�?�W�N���WX69F;N+DAY?v«3Dd8;F�1pDmMW�N�69Oc��2`s ³ ���2:=DKW�[=Lo?�AKFQ6�F�N+DAIB;F;N+O+Oc[=B�?�BBA ³ n;,p^0_`DF;brF;b=?e=8;N+P69F;?kW�DLoe�6�AKJ.69A=:)F;b=?`D8�N$SdN+A�6�Om[=A=N+P?]8;B;N+FGJ)8;?]B;?X698;Wib=?�8�Bcb�6mP?pe=8;DK:=[=W]?�:�69[=F;DdL�69F;?�:F;DKDO+B4E\Dd8&A ³ n;,rN$AaW�O+[=:=N+A=S&B;N+L�[=O�6�F�D8�BXg=F�?�B;F�WX69B;?�S?]A=?�8Q69F;Dd8;B�6�A=:IDF�b=?�82F�?�B;F2F�DKDO+BXg6�A=:|Bi6mE\?�FGJ|6�A�69O+JhB�N+B�F;DKDO+BX^Z�>b=?x��2`s ³ ���wB�e�?]W�N���WX6�F�N+DACb�6�B�R�?�?�Aq69[=F;DdL�69F;N+WX6�O+O+JWib=?�Wij?�: E\D8>L&6�F;ba?�L�69F;N+WX6�OaW�DLoe=O+?�F;?�Aa?�B;B)6�A=:xW]DA=B�N$B�F;?�AaW�JY� 54?�N+LM:�69b=O06�A=: ,"?�P?]B;DA�����"* #=6�A=:�e=8�D�P6�R=O+Jd��W]D8;8�?�W�FcW]Dh:a?>WX6�A�A=D�<rR�?>6�[aF;DL&6�F�N$Wm6�O+O+J.S?]A=?�8Q69F;?�:�E�8;DL A ³ n ,B;e�?�W�N���WX69F;N+DAaBX^�>b=?���2`s ³ �;�4e=8;Dmui?�W�F�:=?�LoDA=B�F;8Q69F;?�:������)F;ba?�e=8Q69W�F;N+WX69O$N+FGJ&D�E><>8;N+F�N$AaS 6 E\Dd8;L&6�Ol8�?i��K[=N+8;?�Lo?�AKF;B`B;e�?�W�N���WX69F;N+DAoE\Dd8H6�W�DLoe=O+?�f0gea8;DKW�?�B�BG�GW�DAKF;8�DOkB;JKB�F;?�LU69A=:���k��`F;ba?.E�?X6�B�N��

Page 5: Formal Methods: State of the Art and Future Directions Edmund M

��� ��c��=�)����� � ���� ������� ��� �������� ��k����� ��� � � z������ z�����G� � �� � �

R=N+O+N$FGJ�D�EcR=[aN$O+:=N+A=S�6�E\D8�L�6�OaLMDK:=?�O0D9E 6�B;JKB�F;?�L�F�b�6�F>N+B>8;?m6�:�69R=O+? 69A=:&8;?�PKN+?�<>6�R=O+?2RKJ6�e=eaO$N+WX69F;N+DA�?]fhe�?�8�F;B)<>N+F;b=Dd[=F�B�e�?]W�N�6�OlF�8Q69N$AaN$AaS�^{4F;b=?�8pWX6�B�?>B;F;[a:=N+?�B�N+A)E�D8;L&6�OdB;e�?�W�N���WX69F;N+DA�b�6mPd?>R�?]?�A�e�?]8GE\Dd8;LM?]:we=8�N+L�6�8�N+O$J4DA�W�DL �

LM?]8;W�N�6�O`6�A=:YBi6mE\?�FGJd�GW�8;N+F�N$Wm6�O`B;JKB;F�?�LMBm^ ³ DLo?�698;?�e=8�De=8�N$?]FQ6�8�JYD82O�69WQjI:=DKW�[=Lo?�AKFQ69F;N+DAF;b�6�F`<�?4WX6�A&W�N+F;?d^k��D�SN+P?>F�b=?)8;?X69:=?�8.6�B;?�A=B�?2D�ElF�b=?26�e=eaO$N+WX69R=N+O+N$FGJ)D9ElE\Dd8;L�69OKLM?�F�b=DK:=BXg<`?7O+N+B;F>R�?�O+D�<VB�DLM?´E\D8><>baN$Wibo<�?2Wm6�A&e=8;D�PKN+:=?48;?iE\?]8;?�A=W]?�BX^HahKN4L�N=O N [�R4[d^ks.A&5 3 n ?�:=N+WX6�O��GA=B;F�8;[=Lo?�AKF;B48;?X69O��GF;N+Lo?.:�69FQ6�R�6�B;?4E\Dd8>B;F�D8;N+A=S�e�6�F;N+?�AKFLMDdA=N+F;D8�N+A=S)N$A©E\D8�L�6�F�N+DAi� _`?X698-���"�=��#;^

HahKR���� �R4[d^�sY��?]jhF�8;DdA=N+f>E�69LMN+O+JcD�E=DB�W�N+O+O$DdB;W�Dde�?]B)�/%4?�O+N$B�O+?�6�Aa:_.�6�8;O�69A������"9+# 1m6 ³ Wib=O+[=L��R�?]8;S?]8.O+N+A=?.D9E�b=Dd[=B;?�baDO+:&?�O+?�W�F;8�N+W�N+FGJ�Lo?�F;?]8;B-� s.8�A=DO+:M?]F76�OG^ �����"* #;^

H��KN���-N��R0^0s.A�� D7n­{ ³  �Dh6�F�N+A=S.e�DN+AKFle=8�DKW�?�B;B�D8<� _H698;8;?]F;F�� �"!"�+#�1XF�b=?`PhN+8�F;[�69OhWib�69AK�A=?�O>e=8�DKW�?�B;B�D8oN$Ar� D7nx{ ³ ® B����"9�9"9­F;8Q69A=B;ea[=F;?�8;� _>6�8�8;?�F�F �����"6+#¢^ ��s4O$B�DyB�?�? ³ ?]W�F;N+DAk=^/k=^/ka^ �

H�� R�� �N=PQ^��>b=?)2`O+N+A=N+WX69O"D.?][=F;8�DA2�>b=?]8Q6�eKJ ³ JhB�F;?�L¡69FlF�b=?c�.AaN$Pd?�8;B�N+FGJ7D9E�£T6�B�b=N+A=SF�DA��W�JKW�O+DdF;8;DdA&W�DAKF;8�DO+O+?�8 �<� (K6�WijKJ;���"��6 #;^

HaI� � PZR N��=^�s48;SDdA=A=?�D769F;N+DA�69O",l69R�Dd8Q6�F�D8�N$?]BX®m<�Dd8;j)DA)F�b=? A´?X6�W]F;D8 ³ 6mE�?�FGJ ³ JKB;F;?]L E\Dd8F;b=? C fKe�?�8�N+LM?�AKFQ69O_`8;?�?]:=?�8)A´?X6�W�F�D8¢�����>� 2`baN$B�DO+LV?�Fc69O�^�����!":41 c)O u]6�N+Wib7?]F 69OG^���"!�� #�1mF;b=?B;bK[=F�:=D�<>A2B;JKB�F;?�L D�E=F;b=?7%)6�8�O$N+A=SdF;DdA�D.[aW�O+?X6�8>.)?�Aa?�8Q69F;N+A=S ³ JhB�F;?�L N+A_2>69A�6�:�6-� s.8�WQbaN��A=D�«x?�F)6�OG^ ���"��9 #;^

H]`�R �� ����ZL��c^"�>b=?2B;?]W�[=8;N+FGJ&e�DO+N+W�J�LMDK:=?�O�E�D8>F;ba?-D.sc�.{ s.N+8�2`DLoL�69A=:�69A=:;2`DAKF;8�DO³ JKB;F�?�L � _�DdB;<`?�O+O������"6+# 1`F�b=?yB�?�W�[=8�?yF�8Q69A=B;LoN$B�B;N+DA|D9E :�6�FQ69S8i6�LMB�N+A|F;b=?yn [=O+F;N+A=?�F.26�F�?�<>6mJ ³ JKB�F;?�L �/%4N+A=DO+Fk?�F769OG^M� �"!? #�1F�b=?)��Ddj?�A©��R�69B;?�:&s4W�W�?�B�B_2`DdAKF;8;DdO ³ JKB;F�?�L D9EF;b=?4�w^ ³ ^ D)6�F;N+DdA�6�O=�GAaB;F;N+F�[=F;?)D�E ³ FQ69A=:�698;:=B.69A=:��k?�Wib=A=DO+DdSJ;� c)[=b=A�69A=:5%48i6mJ5� �"�"9+#;^

H��>R P�R X �QJ����c^=$�6�8�N$Dd[=B�E\?X69F;[=8�?�B�D9Elsc���4�2® B 6 Cc³=³ F�?�O+?�e=b=DdA=?.B�<>N$F�Wib=N+A=S)B;JKB;F�?�L¶[=B�N$AaSC B;F�?�8;?]O � (h6�SK6�:=?]?�BQ69A2?�F�69OG^"�����"*+#h6�A=:2W]DL�R=N+A�69F;N+DA=BaD�E�¬�6�A=:82 ³43 ��nx6�Fi6�SK6>6�A=:2¬06mP?�����"641K¬06mP?B� �"�"6=1=¬06mP?26�Aa:�(h69WijhB�DAE� �"��* #�1F�b=?)�.A=N+Pd?�8;B�N$FGJoD�E 3 6�B�BQ6�[x69A=: ³ N+?�LM?�AaBD.N+fK:=D8¢E ® B.uiDdN$AKF�<`D8�j DdAVW�[=B�F;DdLMN+¯X6�RaO$?­F;?�O+?�e=baDA=?IB;?�8�PKN$W]?�By6�Aa:|E\?X69F;[=8�?�BY� ³ F;?i«0?�A?�F.6�OG^�� �"�"*+#;g8�?�W�?�AKF;O+Jo:=DA=? E\D87%4?�[=F;B�Wib=?w�k?�O+?�jdDLI^

H����N�� [ X>J��L�N=L���J��`^=�>b=?c69[=F;DdL�6�F�N+WlF;8i6�N+A)e=8;DdF;?�W]F;N+DA2B�JKB;F;?]LCE\D80F�b=? 3 6�8�N$Bln ?�F;8�D��/2>6�8�A=DF?�Fc6�OG^"� �"��k41.)[=N+b=D)6�A=:�5.?�AaA=?�R�?�8;F<�����"9 #�1]_�8�N$F�N+B;bBA.6�N+OG® B0B;N+SA�6�O+N+A=S>8;[=O+?�B7� c)N+A=S�� �"�? #�16�A=:oF;b=?�DAK�GR�DK6�8�:�6mPKN+DA=N+W�B`B;D9E\FG<H698;?4E\Dd8.6�AM�GB�8Q69?�Oc6�N+8;W�8i6mE\F<� 57698;?�O����"��k #;^³ ?�?26�O+B�D��/2`8Q6�N+Sd?�AM?�F.69OG^M� �"�"0d641 2`8Q69N$Sd?�AM?]F.6�OG^M� �"��0�R 1 2`8Q69N$Sd?�AM?]F.6�OG^M� �"� ?M1 2`8Q6�N+Sd?�A

?�F26�OG^�� �"�"6+#lE\Dd876 :=?�B;W]8;N+e=F;N+DdAxD�E�FG<`?�O+P?�WX6�B�?wB�F;[=:=N+?�B)N+AoE\D8�L�69O0LM?�F�b=DK:=B�� LMDB�F>W�N+F;?�:6�R�D�P?���^

¤ = ¤�� GDC¹Q ²=±IB$LlQ XY9�><`Dx<�?]O$O��G?�B;Fi6�R=O+N+B;ba?�: 69e=e=8;DK6�Wib=?�B�F�DyPd?�8;N���Wm6�F;N+DdA 6�8�?MLoDh:a?�O�Wib=?]WQjKN+A=SY6�A=:rF;b=?]D8;?]Le=8�D�PhN+A=S�^k�>b=?�J&SD�DAa?2B;F�?�exR�?�JDdA=:&B;e�?�W�N���WX69F;N+DA 1�F�b=?�B;? E\D8�L�6�O�LM?]F;b=DK:=B.698;?)[=B;?]:xF;D6�A�6�O+JK¯�?262B�JhB�F;?�LªE�D8>:=?�B�N+8;?�:xea8;De�?�8�F;N+?�BX^

k=^/k=^����I~m��]�! l�a�Q�i�d����#"7n&DK:=?]O>WQba?�WijhN+A=SIN+Bw6&F�?�Wib=A=N+�K[=?&F;b�69F28;?�O+N+?�B�DArR=[=N+O+:=N+A=Sx6��A=N+F�?7LoDK:=?�O�D�E�6�B;JKB�F;?�L�6�A=:oWib=?�WijKN$AaS�F;b�69F.62:=?]B;N+8;?�:&e=8�De�?�8;FGJ&b=DdO+:=B�N+AoF;b�69F�LoDh:a?�OG^A>Dd[=SbaO$J�B;e�?X6�jKN+A=S2F�b=?>Wib=?�Wij�N+Bce�?]8GE\Dd8;LM?]:M6�B�69A�?�fKb�6�[=B�F;N+P?>B�FQ69F;?.B�e�6�W]?.B;?m6�8;Wibo<>b=N+WQbN+BwSd[�6�8i6�AKF;?]?�:VF;DIF;?]8;LMN+A�69F;?oB;N+A=W�?&F;ba?xLMDK:=?�O`N+B2��A=N+F;?^r�>b=?xF�?�Wib=A=N+WX6�O>Wib�69O+O$?]A=S?&N+ALMDK:=?]OWib=?�WijKN+A=S)N$B�N+A2:=?�PKN+B;N+A=S26�O+SdD8;N+F�b=LMB06�A=:�:�6�Fi6.B�F;8�[=W�F;[a8;?�B`F;b�69F�69O$O+D�<I[=BkF;D4b�6�A=:aO$?

Page 6: Formal Methods: State of the Art and Future Directions Edmund M

� � ��������� �� �������������������������

O�6�8�S?xB�?X6�8�WQb B�e�6�W]?�BX^ªn&DK:=?�O)Wib=?�WijKN$AaS b�6�BMR�?�?�A [aB;?�:Ce=8;N+L&6�8;N+O+JYN+AVb�698;:=<>6�8�?@69A=:e=8�DF;DKW�DdOlPd?�8;N���WX69F;N+DAY�/2`O�6�8�j?769A=:ic)[=8;B�b�6�AG�����"* #�1dF;b=?�W�[=8;8�?�AKF.F�8;?�A=:IN+B>F;DM69e=e=O+J�F;b=N+BF;?]WQbaA=N+�h[a?2F;DM69A�6�O+JK¯�N+A=S2B�e�?�W]N���WX6�F�N$DdA=B.D9E�B�D�E\FG<>6�8�?7B�JKB;F;?]LMBX^�><�D�S?�A=?]8Q6�Ok6�e=ea8;Dh69Wib=?�B>F;D�LMDK:=?]O�Wib=?�WijKN+A=SM6�8�?)[=B;?�:&N+AMea8Q6�W]F;N+W�?)F;DK:�6mJK^l�>ba?.��8;B;Fmg

���X�´�©~d�;�9���w~m��]���i�=�i�i����d�g�N+B 6 F;?�Wib=A=N+�K[=?�:=?]P?�O+De�?�:YN+A=:=?]e�?�Aa:=?�AKF;O+JYN+AyF�b=?;����!"99B7RKJ2`O�6�8�j?.6�Aa: C Lo?�8;B�DA;�/2`O�6�8�j?>6�A=: C Lo?�8;B�DA;� �"!4�e#�6�A=:�RKJBg.[a?�N+O$O+?>6�A=: ³ N�EG6�jKN+B �/g4[=?�N+O+O+?6�Aa: ³ N�E�69jKN$B;� �"!�k #;^ �GAqF�b=N+Bx6�e=e=8�Dh69WQbCB;e�?�W�N���Wm6�F;N+DdA=By6�8�?y?]fhea8;?�B�B;?�: N+Aq6rF;?�Loe�Dd8Q69OO+DSdN$W8� 3 AK[=?�O+N)� �"!4�e#�6�A=:&B�JhB�F;?�LoB7698;?2LoDh:a?�O+?�:�69B>��A=N+F�?7B�FQ69F;?2F�8Q6�AaB;N+F;N+DA&B�JhB�F;?�LoBX^`s.A?�mMW�N+?�AKF`B;?X698;Wib&e=8;DKW�?]:=[=8;?)N+B`[=B;?�:oF;D&�Q�a�i�Q�4N�E"6�SN+Pd?�A���A=N+F;?4B;Fi6�F;?4F;8i6�A=B�N$F�N+DA�B;JKB�F;?�L¶N+B6&��~X�d���dE\D8>F�b=?)B;e�?�W�N���WX69F;N+DA�^���GA�F;b=?4B;?�W]DA=:x6�eae=8;DK6�WiblgdF;b=?4B;e�?�W�N���WX69F;N+DAoN$BpSN+P?�AM69BH69AM6�[=F�DL&6�F;DdA 1�F�b=?�AMF�b=?.B�JKBG�

F;?]Lyg=6�O+B�DwLoDh:a?�O+?�:�69B.6�Ax6�[=F�DL&6�F;DdAlg�N+B>W�DdLMe�698;?�:oF;D�F;ba?2B;e�?�W�N���WX69F;N+DA­F;D�:=?�F;?]8;LMN+A=?<>b=?�F�b=?�8>Dd8�A=DdF�N+F�B�R�?�b�6mPKN+D8`W�DA©E\D8�LMBcF�DwF�b�6�F`D�ElF�b=?)B;e�?�W�N���WX69F;N+DAl^>%4N�«0?�8;?�AKF>A=DdF;N+DAaBD�EkW�DA©E\D8�L�6�AaW�?.b�6mPd?.R�?�?�Ax?]fheaO$Dd8;?�:�gKN$AaW�O+[=:=N+A=S�Oz69A=S[�6�S?>N+A=W]O$[aB;N+DAd� 5)6�8m® C Ol6�A=:Kc7[a8G�B;b�6�Aj�����"9=1�c)[=8;B�b�6�A ���"� ?h6+#¢g�8�?i��A=?�Lo?�AKF2D8�:=?�8�N$AaSB��/2`O+?X6mP?]Oz69A=:I?�Fw6�OG^Q�����"0=1 A´DB;W]Dh?�����? #¢gd6�A=:�DdR=B;?�8�P6�F�N$DdA�6�O�?��K[=N+P6�O+?�AaW�?-�/2`O$?m6mP?�O�6�Aa:w?�F>6�OG^ �����"041d�=?�8�A�6�Aa:=?�¯)?�F>6�OG^4�����"*=1A>D�J�6�Aa:M:=? ³ N+LMDdA=?<���"��9 #;^n$�6�8�:=N369A=:M£YDdO+e�?�8 � $`6�8;:aN369A=:M£YDdO$e�?�8<����!"* #�B;b=D�<`?�:&b=D�<F;ba?wF�?�LMe�D8i6�O���O+DdSN+W.LoDh:a?�O���Wib=?�WijKN+A=S�e=8�DR=O+?�L�W�Dd[=O+:xR�?w8�?�WX6�B�F)N$A­F;?�8�LMB.D9EH6�[aF;DL&6�Fi6=gF;bK[=B>8�?�O�6�F�N$AaS�F;b=?�B�?2FG<`D�69e=e=8;DK6�Wib=?�Bm^�GAVW�DdAhF�8Q69B;FMF�DTF�b=?�D8�?�L ea8;D�PKN+A=S�g`LMDK:=?]O>WQba?�WijhN+A=S|N+BMW]DLMeaO$?]F;?�O+JT6�[aF;DL&6�F�N$Wx69A=:

E�69B;FXg�B�DLM?]F;N+LM?�B`e=8�Dh:a[=W�N+A=S�69Ay6�AaB;<`?�8)N$Ax6 L�6�F�F;?�84D�EcLMN+AK[=F�?�BX^.n Dh:a?�OkWQba?�WijhN+A=SoWX6�AR�?�[aB;?�:|F;DIWib=?�Wij|e�6�8�F;N�6�O`B;e�?�W�N���Wm6�F;N+DdA=BXg>6�Aa: B�DyN+F�WX6�A|e=8�D�PKN$:a?M[=B�?iE\[=O>N+AKE\Dd8;L&6�F;N+DdA6�R�D[aF.6�B;JKB;F�?�Ly® B`W�D8�8;?�W�F�A=?�B�B2?�P?]AxN�E�F;ba?2B;JKB;F�?�Lªb�6�B>A=DdF>R�?]?�AxW�DdLMe=O+?�F�?�O+J�B;e�?�W�N���?�:l^s.R�D�P?`6�O+OGg�LMDK:=?]OWib=?�WijKN+A=S�® B���~��K�`���}�~���Q��N+B0F;b�69FkN$F0ea8;DK:=[=W�?]BcW�D[aAhF�?�8;?]f©69LMe=O+?�Bmgm<>b=N+WQb[=B�[�6�O+O+Jw8�?�e=8�?�B;?�AKF4B;[=R=F�O+?.?�8�8;D8�B>N+A�:=?�B;N+SdAlgh69A=:MF�bK[=B�Wm6�A�R�?7[aB;?�:oF;Dw69N$:�N+A�:=?]R=[=SSdN+A=S�^�>b=?&L�69N$AY:aN$Bi6�:=P69AKFQ6�Sd?MD9E7LMDK:=?]O>WQba?�WijhN+A=SYN+B�F�b=?xB;Fi6�F�?x?�fKe=O+DB�N$DdATe=8�DR=O+?�LI^T�GA

����!":In&WXn&N+O+O�6�A|[=B�?�:V_`8;Jh69AKFX® Bx~����m�;�i���m���=�d���Y��i�m�+����~�V�d���X�d�;�d�2� ��_7%<%.B �;� _`8;Jh69AKF����!"*+#�F;Dx8�?�e=8�?�B;?�AKFoB;FQ69F;?oF;8Q69A=B;N+F�N$DdAYB;JKB;F�?�LMB�?�mMW�N+?�AKF;O+JKgkF;b=?�8�?�RKJYN+A=W�8;?m6�B;N+A=SIF;ba?MB;N+¯�?D�E>F;ba?MB;JKB�F;?�LoB2F;b�69F2W�Dd[=O+:yR�?MPd?�8;N���?�:�^�{4F;ba?�8wea8;DLoN+B;N+A=S�69e=e=8�Dh6�Wib=?]BwF�D 69O+O$?]PhN�69F;N+A=SB;Fi6�F�?�?�fKe=O+DB;N+DdAyN+A=W�O+[=:a?wF�b=?�?�fKe=O+DN+FQ69F;N+DA&D9EHe�698;F�Nz69OkD8;:a?�82N+AKE\Dd8;L�69F;N+DAd� 3 ?]O$?]: � �"�"*+#;gO+DKWX6�O+N+¯X6�F�N+DAI8;?�:=[aW�F;N+DA]� c)[=8;B�b�6�A �����?h6=1>c)[=8�B;b�69Aa�����?dR #;gc6�A=:YB�?�L�69AhF�N+WMLMN+A=N+L�N�¯X6m�F;N+DdA � C O+B;?X69N+:=JM?�F.69OG^����"��* #0F;D�?�O+N+LMN+A�69F;?>[=AaA=?�W�?�B�BQ698;JxB�FQ6�F�?�B>E�8;DLª62B�JhB�F;?�L�LoDK:=?�OG^n&DK:=?�O=Wib=?]WQjd?�8;B`F;DK:�6mJ�6�8;?>8�D[=F�N+A=?�O+J2?�fKe�?�W�F;?]:�F�D)b�6�A=:aO$?>B�JKB;F;?]LMBk<>N+F;b�R�?�FG<`?�?�Ad��9�9

6�Aa:�k"9�9>B;Fi6�F�?�P698;N�6�R=O+?�Bm^0�>b=?�J)b�6mPd?�Wib=?]WQjd?�:�N$AKF�?�8;?�B�F;N+A=S)B;JKB�F;?�LoBl<>N+F;b�� 9�� �k8;?m6�Wib�6�RaO$?B;Fi6�F�?�B7� _`[=8�WQb�?�Fc6�OG^����"� ?#;gX69A=:2RKJ)[=B;N+A=S)6�e=ea8;Dea8;N�6�F�?�6�R=B�F;8i6�W�F�N$DdAwF�?�Wib=A=N+�K[=?�Bmg�F;b=?]J2WX6�AWib=?�WijxB�JhB�F;?�LoB)<>N$F�by6�A­?�B;B�?�AKF;N�6�O+O+Jx[=A=O+N+LMN+F�?�:MAK[=L�R�?�8.D9E�B;Fi6�F�?�BB� 2`O�698;j?�?�F26�OG^ � �"�"k+#;^s.B`6)8;?�B�[=O+FXgdLMDK:=?�OKWib=?�WijKN+A=S�N$BkA=D�<|e�D�<�?]8GE\[=Oa?�A=D[aSb�F;b�6�FcN+FkN+BcR�?]W�DLoN$AaS.<>N+:=?�O+J2[=B�?�:N+AMN+A=:=[aB;F;8�J&F;D�6�N+:&N$AoF;b=?�P?�8�N���WX6�F�N$DdAMD9E�A=?�<>O+Jo:=?�P?]O$Dde�?]:x:=?�B�N$SdA=BX^

IKJML N4OQP�RTSVU�N4WYXQPZR4[

Ha^�S�S S�� QL� ��R O� [��x^k�GAE�����"kB2`O�6�8�j?26�Aa:xb=N+B.B�F;[=:=?]AhF�B26�F&2>698;A=?]SN+?wn&?�O+O+DA&[=B�?�:³ ni$F��n&WXn&N+O+O�6�Aj�����"0+#HF�DyPd?�8;N�E\JYF�b=?&WX6�Wib=?&W�Ddb=?�8;?]A=W�?Ie=8;DdF;DKW�DO>:a?�B;W�8�N+R�?�:ZN$ArF;b=?� C>C>C �=[=F�[=8;?]R=[=B�� ³ FQ69A=:�698;:E!"��*=^��i�������4�K� 2`O�698;j?�?]F�69O�^ ���"��041>,"DA=SE� �"��0 #;^M�>ba?�J

� ��~$s)yMe)dFn0rWgUc�dFn0yUn0c�dFo)yMklc�dFclyUf0kNs4�xpMf�f0ciyMkNs)yM�)rWuWrWn�h�yMm)yMuWh$d0rWdi�lt)yMnFcld6�)yUkN��n0p\n0s)c�clyMfFuWrWcldFn4o)yMo:cif0d6pUmj¤6cin0fFr�Tcin0di�6õ�s)cTnFclfFv��Fv�pIt)ciuMkNs)clkN�$rWm)q�����yMd�klpUrWm)clt��$h���uWyUf0�Mc�yUm)t ��v�clfFd0pUm�� ��uWyMfF�Mc�yMm)t ��v�clfFd0pMm¬�lù��)�N£��

Page 7: Formal Methods: State of the Art and Future Directions Edmund M

��� ��c��=�)����� � ���� ������� ��� �������� ��k����� ��� � � z������ z�����G� � �� � �

W�DAaB;F;8�[=W�F�?�:¡6Ye=8�?�W�N+B;?YLoDK:=?�O>D�E�F;b=?Ie=8;DdF;DKW�DdO7N+AVF�b=? ³ ni$UN+A=ea[=FMO�6�AaS[�69S?y69A=:F;b=?]AY[=B;?�: ³ ni$¶F;D­B;b=D�< F;b�6�F)F;b=?o8;?�B�[=O+F;N+A=S&F;8i6�A=B�N+F;N+DAYB�JhB�F;?�L Bi6�F;N+B¢��?�:T6oE\Dd8;L&6�OB;e�?�W�N���WX69F;N+DA&D9E�WX69WQba?2W�Dba?�8;?�AaW�?^`�>b=?�J E\D[=Aa:�6�AK[=L�R�?�8�D9E�e=8�?�PKN+D[=B�O$J�[aA=:=?�F�?�W�F;?]:?�8;8�D8�B76�Aa:�e�DF�?�AKF;N�6�O0?]8;8;Dd8;B)N+AMF�b=?2:=?�B�N+SA&D�EkF;b=?2ea8;DF�DKW�DOG^k�>b=N+B.6�eae�?X698;B4F;D�R�?2F;b=?��8;B�F)F;N+LM?4F;b�69F 69Ay6�[aF;DL&6�F�N$W4P?�8�N���WX6�F�N+DAxF�DhDdOkb�6�B4R�?�?]AY[=B;?�:IF;D ��A=:x?]8;8;Dd8;B2N+Ay69A� C>C>C B;FQ69A=:�698;:l^Is.O+F�b=D[=SdbYF;b=?o:=?�Pd?�O+De=Lo?�AKF2D�E.F�b=?&e=8;DdF;DKW�DO`R�?�Sh69ATN+Aj����!"!=gc69O+Oe=8;?]PhN+Dd[=B.6�F�F;?�Loe=F;B`F;D�P69O$N+:�69F;?4N$F`<`?�8;?2R�6�B;?]:x?�AKF;N+8;?]O$JoDAoN$A©E\D8�L�6�OaF;?�Wib=A=N+�K[=?�Bm^

Ha^�S�S SF`Q\-^�^0�GAG���"��ki%.N+O+Oc6�A=:Ib=N+B2W�DdO+O$?m6�S[a?�B26�F ³ Fi6�AKE�D8;:I:=?�Pd?�O+De�?�:YF;ba?Mn&[=8;eab=N��A=N+F;?�B;Fi6�F�?�P?�8�N���WX6�F�N$DdAyB�JKB;F;?]L 69A=:IP?�8�N���?�:YF;b=?�Wm6�Wib=?�W�Ddb=?�8;?]A=W�?&e=8;DdF;DKW�DdOcD�E>F;b=?³ WX69Oz69R=O+?)2`Dba?�8;?�AKFk�GAKF;?�8¢E�6�W]?g� C C>Cy³ FQ6�Aa:�6�8�:5� 6"�"* �e� �"��k��/%4N+O$Od?�Fc6�OG^"� �"��k #;^��>b=? ³ 2`�B;Fi6�A=:�698;:�:=?v��A=?�B>B�?�P?�8i6�O�e=8;DdF;DKW�DdO$BmgK?X6�WibM6)B�[=R=B�?�F>D�E0F;b=?4A=?�fKFX^k�>ba?�JwW]DA=B�F;8;[aW�F;?�:I6LMDK:=?�OKD9E"6 ��FGJKe=N+WX6�O �)e=8;DdF;DKW�DdO�6�A=:�B�[=e=e=O+N+?�:M6)B�e�?]W�N���WX6�F�N+DAMD9E3ea8;De�?�8�F;N+?�B`A=?�W�?�B�BQ698;JE\D84WX6�Wib=?�W�Ddb=?�8;?]A=W�?^��kDM6mPdDN+:x?�8�8;D8�B2N+AxF;ba?wF�8Q6�AaB;O�6�F�N$DdAlg�F;b=?]JxR�6�B�?�:IF;b=?�N+8)LMDK:=?]O:=N+8;?�W]F;O+JxDAIF;ba?�2 W�DK:=?�F�b�6�F)N+B)SN+P?�AI6�Bw6 :=?i��A=N+F�N$DdAyD9EHF�b=? ³ 2`�4B;FQ69A=:�698;:l^ ³ N+A=W�?F;b=?�AK[=L�R�?�8.D9E�B;Fi6�F;?]B2D�E�F�b=?�LMDK:=?�OkW�Dd[=O+:xR�?�Pd?�8;J­Oz698;Sd?g�F;b=?�J­P?�8�N���?�:YDA=O+J&B;L&6�O+ON+A=B;Fi6�A=W�?]B.D�EkF;b=?�B;JKB;F�?�Ly^ C P?�A­<>N$F�bMF�b=N+B.B;N+Loe=O+N���WX6�F�N$DdAlg�F�b=?�JoE\D[aA=:MB�?�P?�8i6�Ok?�8�8;D8�BN+AwF�b=?>e=8;DdF;DKW�DdO�g98Q6�AaSN+A=S4E\8;DdL¡DdLMN+B;B�N$DdA=BlD9E3P698;N�6�RaO$?pN$AaN$F�N�6�O+N+¯X6�F�N$DdA=B0F;D�B;[=R=F�O+?>O$DdSN+WX69O?�8;8�D8�BX^k�>b=?�B�?>?�8;8�D8�Bc?�fKN+B;F;?]:�N$A�F;ba?�8i6�F;ba?�8cR�69B;N+W�B�[=R=B�?�F�F�b�6�FkF�b=?�J2:=?v��A=?�:lgK6�O+F�b=D[=SdbF;b=?)e=8�DF�DhW]DOlb�6�:MR�?�?�A­?�fKF;?�A=B�N+P?�O+J&:=N+B;W�[aB;B;?]:lg�B;N+L�[=O�6�F�?�:lgK6�A=:o?�P?�A­N$Loe=O+?�LM?]AhF�?�:l^

H]`�L�R �R J � JMWYX>J��QR � L[^�{4A=?MD9E.F;b=?�?]LM?�8�SN+A=Sx6�e=eaO$N+WX69F;N+DAI:=DdL�6�N+A=B4D�E.6�[=F�DL&6�F;N+WP?�8�N���WX6�F�N+DAIN$B)F�b=?M:=?]B;N+SAID�E>bKJhRa8;N+:YB;JKB;F�?�LMBmgl<>baN$WibIW�DAaB;N+B;F2D9EHR�DF�bY:=N+B;W�8�?�F;?x69A=:W�DAKF�N$AK[=Dd[=B.W]DLMe�DAa?�AKF;BX^´�GA � �"�?�g=_`DB�B;Wib=?�8mg 3 DO�69j3g�6�A=: $�669A=:=8Q69S?�84<�DdAx6�R�?�B;F¢�e�6�e�?�826m<>6�8;: E\D8)e=8�D�PhN+A=SoL�69Ah[�6�O+O+JwF�b=?�W�D8�8;?�W]F;A=?�B�BwD9E´6 W�DAKF�8;DOpe=8;DdF;DKW�DOk[=B�?�:YN+A3 b=N+O+N+e=BwB�F;?�8�?�DTW]DLMe�DAa?�AKF;B;� _�DdB;B�WQba?�8M?�F&6�OG^7�����? #¢^r�GA]�����"6=gk54DT6�A=:|£YDdA=S��G�kDNP?�8�N���?�:�69A�69R=B;F�8Q6�W]F;N+DAoD�E�F�b=?)e=8;DdF;DKW�DdO0[=B;N+A=S�F;b=?4B;JKL�R�DO+N+W>LMDK:=?�O=Wib=?]WQjd?�8.54JK��?]WQb6�A=:�N+AKE�?�8;8�?�:lgdE\[=O+O+Jw69[=F;DdL�6�F�N+WX6�O+O+Jg�6)LMDd8;?`?�mMW�N+?�AKF`F;N+LMN+A=S4D�ElF;ba?.e=8�DF;DKW�DdO�F�b�6�AoF;b=?DA=?�[aB;?�:rRhJ 3 b=N+O+N$eaB�� 5.Dx6�A=:Y£YDdA=S��G�kDN����"��6 #;^�s4O$B�DxN+A � �"��6=gQ%76m<>B269A=:���D�PKN+A=?[=B;?]:MF;ba?.P?]8;N���WX69F;N+DAoF;DKDO4c)8�DA=DdB&�/%)6m<>B�6�Aa:���D�PKN+A=?<���"��6 #�F�DwWib=?]WQjM69[=F;DdL�69F;N+WX6�O+O+J6�O+O0F;ba?we=8�De�?�8;F�N+?�B)B;FQ69F;?�:I6�A=:xb�6�A=:=ea8;D�P?]:xRKJ�_`DB�B;Wib=?�8)?�F269O�^`�GAY�����"*ag=_`?�A=SF�B;B�DA6�A=:&b=N+B>W�DdO+O$?m6�S[a?�B>LMDK:=?�O0Wib=?]WQjd?�:IF;b=?2?]AhF�N+8;?2e=8�DF�DhW]DOGgKF;bK[=B4W�DLoe=O+?�F;N+A=S�F;b=?)�K[=?�B�FD�E0E\[aO$O+J�6�[=F�DL&6�F;N+A=S)62bK[=L&6�A�e=8;DKD9E�F;b�6�F>6�B`O$N+F�F;O+?.6�B>FG<`D2J?m6�8;B.69SD2<>6�B`W�DdA=B;N+:=?�8�?�:E�6�8`D[aF>D�E�8�?X6�Wib&E�D8>6�O+SDd8;N+F;b=LoN+W>LM?�F�b=DK:=B&� _`?�A=SdF;B;B�DAx?]F.6�OG^������"* #;^

Ha^ ` hiI��4^ `����^��>b=?>D.?]<�2`D A>? 3 8;DXuv?�W�Fk<H69BlF�b=?k��8�B;F�E\[=O+O���B�WX6�O+?k6�e=e=O+N+WX69F;N+DA)D�EKE\Dd8;L&6�OP?�8�N���WX6�F�N+DA&LM?�F�b=DK:=B.N+Ax6�8�D[=F�N+A=?2B;D9E\FG<>6�8;?�:=?�B;N+SdAxe=8;Dmui?�W�F)<>N+F;b=N+A&sc���4� �/2`b�6mP?]B�����"k41�54DO+¯�L�69A=AE� �"�? #;^)�>b=?wea8;DXui?]W�FwO�69B;F;?]:xE\8�DL � �"!"� [=AKF;N+O�� �"�"ka^2�=Dd8;L&6�OlLoDK:K�?�O+N+A=S�69A=:@69[=F;DdL�69F;?�:xPd?�8;N���Wm6�F;N+DdAy<`?�8;?M69e=e=O+N+?�:IF;D&F;b=?�:a?�P?�O+Dde=LM?�AKF4D�E>F;b=?��GAKF;?]8G�A�6�F�N+DA�69Oh�k?�O+?�W]DLML�[aA=N+WX6�F�N$DdA=B0�.AaN$DdA �+E\Dd8;Lo?�8;O+J�272`�G�>� �k� ³ %�D<@��G� 3>3 � � ³ % DV�.B�?�83 6�8;F 3 8�DKW�DF�DO ��^os F;?X69L D9E���P? �;Pd?�8;N���Wm6�F;N+DdAy?�AaSN+A=?�?�8�B �&E�D8;L&6�O+N+¯�?�:E� ? 6o8;?]�h[aN$8�?i�LM?�AKF�B�N$A|F�?�LMe�D8i6�O>O+DSdN$WdgH69A=:|8;?�Aa:=?�8;?]: F;b=?Ie=8;DKD9E\B�<>N+F;bVF�b=?xb=?�O+eVD9Ew6IB;e�?�W�N�6�O��e=[=8�e�DdB;?�LMDK:=?�OkWib=?�Wij?]8�� 5.DO+¯�L&6�A=AY� �"�"k=1�5.DO+¯�L&6�A=Ax69A=: 3 6�F�F;N�� �"!"�+#;^.s F;DdFQ69O�D9E:=g/6"9�9`O+N$Aa?�BkD�E ³ e�?]W�N���WX6�F�N+DAM6�Aa:b%4?�B�W�8;N+e=F�N$DdAb,�6�A=Sd[�6�Sd? � ³ %<,���B;Dd[=8;W]?.W�DK:=?�� ?�fKW�O+[=:K�N+A=S)W�DLoLM?�AKF;B �0<>6�BcPd?�8;N���?]: 1��"� k.?]8;8;Dd8;B`<�?]8;?.8�?�P?m6�O+?�:���6�A=:���fh?]:��kN+A�F;b=?>baN$SdbK�GO$?]P?�O:=?�B�N$SdA=B�1069e=e=8;D�fKN+L�69F;?�O+JB6"6�f¶D9E�F;b=?�D8;N+SdN$A�6�O0:=?�B�N+SAx8�?��K[=N+8;?�Lo?�AKF;B)<�?]8;?2:=N+B�W�D�P?�8�?�:F;D�R�?�O$DdSN+WX69O$O+J2N+A=W]DA=B�N$B�F;?�AKFm^

H��ih �V\�^Ks¡5.N+SdbK��O+?�Pd?�O %)6�Fi6B,0N+A=j�2`DAKF�8;DO+O+?�8�� 5&%<, 2 �`F�8Q6�AaB;LMN+F�F;?�8>W�Dd8;?2<>6�B>R�?�N+A=S:=?�B�N$SdA=?�:Y6�F)F;ba?�_�?�O+O),�6�R=B2n&N+W�8�DK?�O+?�W�F;8�DA=N+W�BB%4?�B;N+SdA 2`?�AKF�?�82N+A@n­6�:=8�N$:�g ³ e�69N$A­E\Dd8

Page 8: Formal Methods: State of the Art and Future Directions Edmund M

� � ��������� �� �������������������������

6�AIs.e=eaO$N+WX69F;N+DA©� ³ e�?�W�N���W��GAKF;?�Sd8Q69F;?�:E2`N+8;W][=N+F7O+N+R=8i6�8;J­D�E�F�?�O+?�W�DLoL�[=A=N+WX69F;N+DA&L�69W�8;D9�W�?�O+O+BX^k�>b=?4B;Fi6�A=:�698;:&:=?�B�N+SA&e=8;DKW�?]B;B.N+A=W]O$[a:=?�:&WX6�eaF;[=8�? 69F�F�b=?)8;?�SdN+B;F;?]8G�GF;8Q69A=BGE�?�8)O$?]P?�O[=B;N+A=SB$45&%<,cgKB�N+L�[=O�6�F;N+DdAlgh69A=:&B;JKAKF;b=?]B;N+BX^`�GAE� �"�"*agKO�6�F;?)N+A&F;b=?�e=8;DKW�?�B�BXg0F�b=?)E\Dd8;L&6�OP?�8�N���WX6�F�N+DAMF�?X6�L�6�F`_`?�O+O ,l69R=B>D�«0?�8�?�:xF;D�8�[=A&B;DdLM?769:=:=N+F;N+DdA�6�OaE\[=A=W]F;N+DA�69O�Pd?�8;N���Wm6m�F;N+DAIDAIF;ba?�:=?�B;N+SdAj� 2>69O+?�8;D&?�Fw69OG^>�����": #;^ ³ N+A=W�?�F�b=N+B2:=?�B�N+SAY<>6�B)W�DAaB;N+:=?�8�?�:TF�DxR�?e=8Q69W�F;N+WX69O+O$J���A=N+B�b=?�:lgKN+F`<H69B�A=DdF�?]fhe�?�W�F�?�:IF;b�69FH69AhJ�?�8�8;D8�B.<`D[=O+:�R�?4E\D[=Aa:l^l£ZN$F�b=N+A��P?)b=Dd[=8;B4D�Ek<�Dd8;j0g=B�N$foe=8;Dde�?]8;F;N+?�B)<`?�8;?�B;e�?�W�N���?�:Y6�A=:o��Pd?)<�?�8�?2P?]8;N���?�:lg�[=B�N+A=S�F;b=?�=Dd8;L&6�O 2`b=?�Wij&P?�8�N���WX6�F�N+DAIF;DKDO��/%4? 3 6�O+L&6�6�A=:E.)O�69B;?�8�� �"��* #;^��>b=?MB�N$fKF�bye=8�De�?�8;FGJ<H69B)E\Dd[=A=:YRKJT�=Dd8;L&6�O 2`b=?�Wij&F;D­E�6�N+OGg0[=AaW�D�P?�8�N+A=S@6 R=[=SIF;b�69F2<�Dd[=O+:Yb�6mP?&6�F2O+?X69B;F8;?�:a[=W�?�:xF�b=?2F�b=8;Dd[=Sb=ea[=F>D�EkF;b=?)5&%<,n2VWib�69A=A=?�OG^cn&Dd8;?)O+N$jd?�O+JhgdF;baN$B>Ra[=S�<�Dd[=O+:Mb�6mPd?W�DA©E\[=B;?]:�F�b=?)b=N+Sb=?]8�O+?�Pd?�O0e=8;DdF;DKW�DdO$B>Wm6�[=B�N$AaSwO+DB�F�F�8Q69A=B;LoN$B�B;N+DAaBX^��GF>F;DKDj.ui[aB;F>6)E\?]<LMN+AK[=F;?]B�F�D�N$:a?�AKF;N�E\J�69A=:&e=8;Dde�DdB;?w6���f�E�D8.6�:=?�B�N+SAx?�8�8;Dd8.F;b�6�F.L&6�A�69S?�:�F�DM?�B�WX6�e�?L�69AhJ�b=Dd[=8;B4D�E�O+DdSN+W.B�N$L�[aOz69F;N+DA�^l�>b=?)?�8�8;Dd87<>6�B>W]D8;8�?�W�F�?�:@69A=:&F;b=?�W�D8�8;?�W�F�N+DAx<>6�BE\D8�L�69O$O+J2Pd?�8;N���?]:�[aB;N+A=SM�aD8;L&6�O 2`b=?�Wij0^ 3 O�6�A=B)6�8;?)A=D�<CN+A&F;b=?2<`D8�jKB.6�F>F;ba?wnx6�:a8;N+::=?�B�N$SdA&W�?�AKF;?�84F;D�N+A=W�O+[=:a?7LoDK:=?�O�WQba?�WijhN+A=SM69B>e�6�8�F>D�EcF;ba?7B�FQ69A=:�6�8�:&:=?�B;N+SdAxe=8;DKW�?]B;BX^

H � J�-R � `��N4P�R&�GA � �"��6x6xSd8;Dd[=e 69Fw_`[=O+O>N+ATW�DdO$O�69R�Dd8Q6�F�N+DAY<>N+F;br8;?�B�?X6�8�WQba?�8;B&D�E)F;b=?$c?�8�N$L&6�S�,�6�R�D8Q69F;Dd8;J�[=B;?�:i,l{4�.{ ³ F;D2:a?�B;W�8�N+R�?)F;ba?>e=8;DKW�?�B�B;Dd8;BXgaLM?�LoD8�J7W]DAKF;8�DO+O+?�8Xg6�A=:IR=[=B�6�8�R=N+F;?�8�D�E.F;ba?�L�[=O+F;N+e=8;DKW�?]B;B;Dd8w6�8�Wib=N+F;?�W�F�[=8;?&WX69O+O$?]: 3 D�<`?�8 ³ WX6�O+?^&�>baN$B�6�8G�Wib=N+F;?�W�F�[=8;?�N+B.R�69B;?�:IDA­�G_HnY® B 3 D�<`?�8 3 2 LoN$W]8;Dea8;DKW�?�B�B;D8)6�A=:­N$B4[=B;?]:yN+A&_�[aO$OG® B C BG�WX6�O�6 B;?�8�N$?]BwD9EHB�?�8;Pd?�8;B�6�A=:I<`D8;jKB�FQ6�F�N+DA=B ^��>b=?�JIN+:=?�AKF;N���?]:xE\Dd[=8)W�D8�8;?�W]F;A=?�B�B�e=8;DdeK�?�8;F�N+?�BXg�<>b=N+WibY?�fKe=8;?�B�BwF�b=?�?�B�B;?�AKF;N�69O�8�?��K[=N+8;?�Lo?�AKF;B)E\Dd826Mea8;De�?�8)E�[=A=W�F�N$DdA=N+A=S&D�E>F;b=?6�8�R=N+F;8Q69F;N+DAI6�O+SDd8;N+F;b=LIg�69A=:xE�D8;L&6�O+N+¯�?�:&F;ba?�e=8;Dde�?�8�F;N+?�B�6�A=:Y6�O+SdD8;N+F�b=L�N+AyF�?�8;LoB7D9ER=N+B;N+L�[=O�6�F�N�DdAY8;?�O�6�F�N+DA=B � LMDK:=[=O+Dy69R=B;F�8Q6�W]F;N+DA=B ��R�?�FG<`?�?�AZ��A=N+F;?&O�6�R�?�O+O+?�:|F;8Q69A=B;N+F�N$DdAB;JKB;F�?�LMBm^`�.B;N+A=S�F�b=?2W�DdLMe�DB�N$F�N+DA�69O369A=:xDA©��F�b=?i�� �J&LMDK:=?�O0Wib=?�WijKN+A=SMF�?�Wib=A=N+�K[=?�B4N$L �e=O+?�LM?]AhF�?�:�N+A�F;b=?����������� ��������� ���E%4?�P?]O$Dde=LM?]AhF 3 6�Wij69S?����� ���� �pF;DKDO+R�D�f0gF;b=?�W]D8;8�?�W�F�A=?�B;B�D9EHF�b=?M6�8�R=N+F;8i6�F;N+DdA@69O$SdD8�N$F�b=L�<>6�B2?�B�FQ69R=O+N$B�b=?�:T69[=F;DdL�6�F�N+WX6�O+O+JMN+AY6E\?�<VLoN+Ah[aF;?�B<�/2`b=?�b�69N$R�6�8>?�F.69O�^�� �"��* #;^

H � ���P � ��!�[#"c�GAY� �"�"6�W�N+PKN+Ol?�A=SdN+A=?�?�8�B76�F D.Dd8;F;b;2>698;DO+N+A�6 ³ FQ69F;?2�4A=N+P?�8�B;N+FGJM[aB;?�:IF;b=?2`DA=W][=8;8�?�A=W�Jo£YD8;jKR�?�A=Wib&F;D�6�A�69O+Jh¯]?.F;ba?7F�N+LMN+A=S.ea8;De�?�8�F;N+?�B.D9E 6):aN$B�F;8�N$Ra[=F;?�:x69W�F;N+P?B;F�8;[=W�F�[=8Q69OkW�DAKF;8�DO�B;JKB;F�?�L � C O+B;?X69N$:aJ�?�F769O�^�� �"��* #;^l�>ba?2B;JKB;F�?�L�N+A&�h[a?�B;F�N$DdA&<H69B>:=?i�B;N+SAa?�:yF�DxL�69j?2Ra[=N+O$:aN$AaSB.LoD8�?w8�?�B;N+B;Fi6�AKF2F�D�?m6�8;F�b=�K[�6�jd?�B�RhJ­BQ6�Loe=O+N+A=S�F;b=?�E�D8;W]?�BR�?]N$AaS 69e=e=O+N+?�:�F;D)F;b=?>B�F;8�[=W�F;[a8;?26�A=:�[=B�N$AaS7bKJK:=8i6�[=O+N+WH69W�F;[�6�F;Dd8;BcF�D)?�fK?�8;F`W�D[aAhF�?�8;P69N+O��N+A=S2E�D8;W]?�BX^>�>ba?2?�A=SdN$Aa?�?�8;B4��8�B;F)W�DK:=?�:­F;b=?�N+84:=?�B;N+SdAxN+A 6�F�N+LM?�:&P?]8;B;N+DdA�D9EcF;b=?�272 ³O�6�A=Sd[�6�Sd?"1�F;b=?�8�?�B;[=O+F�N$AaS�LoDK:=?�OlW]DAKFQ69N$Aa?�:yN+AI?�fKW�?�B�BwD9E k�$���k&%&� 9�(')B;Fi6�F�?�B�69A=:x<>6�BA=DF`:=N+8;?]W�F;O+JM6�A�6�O+JK¯X6�R=O+?^�5.D�<`?�Pd?�8XgaRhJ�[aB;N+A=S�F;b=?)B;?]L�6�AKF�N$W>LoN+A=N+L�N$¯m6�F;N+DdA)E\?X69F;[=8�?7D9EF;b=?-2`DdA=W�[=8�8;?�A=W]Jy£YDd8;jKR�?]A=Wiblg=F�b=?�J&<�?]8;?w69R=O+?7F�D�W�DAaB;F;8�[=W�F26�[aF;DL&6�F�N$Wm6�O+O+Jw6�L�[=WibB;L&6�O+O+?�8�B�JKB;F;?]LU<>N+F;bxF�b=?�BQ6�Lo?2F;N+LoN$AaSwe=8�De�?�8;F�N+?�B2F;b�6�F.W]D[=O+:xR�?�69A�6�O+JK¯�?�:�^.�GAIF;b=?W�D[a8;B;?oD�E>F;b=?]N$8�6�A�6�O+JKB;N+B)F;b=?�JY[aA=W�D�P?]8;?�:|6�AY?�8�8;D8�N+A@6 F;N+LM?�8)B�?�F;F�N$AaSyF�b�6�FmglN�E>[=AK�:=?�F�?�W�F;?]:lglW]D[=O+:xb�6mPd?2WX69[=B;?�:IF;ba?�69W�F;N+P?�B;F;8�[=W�F�[=8Q69O�W�DdAKF;8;DdOkW�DLoe�DdA=?�AKF>F;Do<�Dd8;B;?]Alg8Q69F;b=?�8`F;b�6�AM:�6�LMe�?�AlgdF;ba?.PKN+R=8Q69F;N+DA�?�fKe�?�8;N+?�AaW�?�:xRKJ�R=[=N+O+:=N+A=SdB�:a[=8;N+A=S�?X6�8�F;b=�K[�69j?�Bm^

{4F;b=?�8pB;[=W�W]?�B;B¢E\[=O0N+A=:=[=B�F;8�Nz69O���B�N$¯]?�:wWm6�B;?>B�F;[=:aN$?]BcN+AwLoDh:a?�OKWQba?�WijhN+A=S2698;?>F;DKD)AK[=LM?]8;D[aBF;D)O+N+B;Fm^ C PKN+:=?�AaW�?>F;b�69FcLMDK:=?]OhWib=?]WQjKN+A=S)b�69B��;W�DdLM?i�GD�E �¢69S? �>N+BkF;b�69FcN+A=:=[=B�F;8�JwN+BkR=[=N+O+:=N+A=SF;ba?�N+8cD�<>AwLoDK:=?�OWib=?]WQjd?�8;B>Dd8kB;N+LMe=O+J4[=B;N+A=S)?�fKN+B;F�N$AaS7DdA=?�Bm^>,0N+B;F�?�:�R�?]O$D�<|6�8�?>B;DLo?c<`?�O+O��jKA=D�<>A&LMDK:=?�O0Wib=?]WQjd?�8;Bmgl8�D[=Sdb=O+JMWX69F;?�SdD8�N$¯]?�:y6�W]W�D8�:=N+A=SMF�D�<>b=?�F;ba?�8)F;b=?�B;e�?�W�N���WX69F;N+DA

) ¤6px��cifÛ�$kiyMuWcTyUm)t��d0kiyMuWy�yMfFc/f0ciqMrWd0nFclfFclt�nFf0yMt)civ�yMfF�Id4pxw���e)uWu`�

Page 9: Formal Methods: State of the Art and Future Directions Edmund M

��� ��c��=�)����� � ���� ������� ��� �������� ��k����� ��� � � z������ z�����G� � �� � �

F;ba?�JMWib=?�Wij&N+B>SN+P?]A�6�B.6�O+DdSN+WX6�OaE\Dd8;L�[=O�64D8.69B.6�L�6�Wib=N+A=?��H��>R WYX>J��N4PBP�J !�� �EWYJ�nR P ���QR��� R��"[d^V�>ba?xP?�8�Jr��8;B�F�FG<`DYLMDK:=?]O.Wib=?�Wij?]8;B&<�?]8;?

C n;2 �/2`O�6�8�j?M69A=: C LM?�8�B;DdAj���"!=�"1�2`Oz698;jd?M?�FM69O�^�����!"*=1c_`8;D�<>A=?&?�FM69O�^�����!"*+#´69A=:2�� ³ s&A �/g4[=?�N+O+O$?Y6�Aa: ³ N�E�69jKN$Bd����!"k41��=?]8;A�69A=:=?�¯Y?�FI6�OG^<���"��* #;^ ³ ni$ ��n&WXn&N+O+O�6�A�����"0 #`N$B�F�b=?o��8;B�F�LMDK:=?�O`Wib=?�Wij?]8MF;DI[=B�?x_ %<%4BX^r�>b=? ³ e=N+ArB;JKB;F�?�L �/.)?]8;F;b|?�FM69OG^�����"641d5.DdO+¯�L�69A=A;�����4��#l[aB;?�B4e�6�8�F;N�6�O0Dd8;:=?�848;?�:a[=W�F;N+DdA�F�D�8;?�:a[=W�?�F;b=?)B;Fi6�F�?2?�fKe=O+DB�N$DdAe=8;DdR=O+?�L � 5.DdO$¯]L�6�AaA�6�Aa: 3 ?�O+?�: � �"� ?M1 3 ?�O+?�: � �"��* #;^.n&[=8�e=b=N7�/%4N$O+O0?�F269O�^Q� �"�"k+# 69A=:��$ � c26�O+F;?�AKR�69Wib � �"�? #�6�8;?�R�6�B;?]:YDAIF;b=?��4A=N+FGJxe=8;DdS8i6�LMLoN�A=S�O�69A=S[�69S?��/2`b�69A=:=J6�A=:In&N+B;8Q6d� �"!"!+#;^.�>b=?B2`DAaW�[=8;8�?�A=W�JI£YD8�jKR�?�AaWQbG�/2`O+?X6mP?�O�69A=:x?�F26�OG^n���"��0 #cP?]8;N���?�B272 ³ ea8;DKW�?�B�B;?�B�E\Dd8)e=8;Dde�?�8�F;N+?�B�?�fKe=8;?]B;B;?]: 69B2L�[K�GWX6�O+W�[aO$[aB>E\Dd8;L�[=O�6�Bm^ ³ $ C ���lN+O+jDd8;A?�F>6�OG^4�����? #¢gd�l{<A.n&sp� �/%)6�LoL ?�F>6�OG^M� �"��641"%)6�LoLµ69A=:�%4?�O+Sh6�:aD�� c7O+DKDB ���"��* #;g69A=:2�$a�/%��?�b�698;R�?�6�A=:�_�Dd8;8;N+DdA=?&� �"��6 #h6�O+O9E\DKW�[=BkDA2b�6�8;:a<H698;?cPd?�8;N���WX69F;N+DA�^05.JK�k?�Wib5� s4O$[a8?�Fc6�OG^"� �"��* #hN+Bc6>LoDK:=?�OWib=?]WQjd?�8kE\Dd8lbKJKR=8;N+:�B;JKB;F�?�LMB 1c)8;DdA=DB7�/%)6m<>B�6�Aa: ��D�PKN+A=?������"6=15.?�Aa¯�N+A=S?�8>?]F76�OG^�� �"�? #;g�E\Dd8�8�?X6�O��GF;N+LM?>B�JKB;F;?]LMBX^

H �-R �QN ���ZJ���� J�����J��WYN�� �R ���QR���MR �"[d^ �>ba?E2`DB;e�6�AM@d�=Dd8;L�69O 2`b=?�WijTB�JhB�F;?�L � %4?i�3 6�O+L�646�A=:�.)O�69B;?�8�� �"��*41�5)6�8X® C O06�Aa:Bc7[a8;B;b�6�A � �"��9 #�N+BcR�69B;?�:oDA�B�b=D�<>N+A=S2N+A=W�O+[=B�N$DdAR�?]FG<�?�?]AYDLM?]Sh6�6�[aF;DL&6�Fi6=^)� %<A'�/A>DdB;W�DK?i���"� ?#kWQba?�WijhB�8;?i��Aa?�LM?�AKF2R�?�FG<`?�?�AE2 ³43e=8;DdS8i6�LMB 1cLoDB;F�8;?�W�?]AhF�O+Jhg`N+Fwb�6�B�R�?�?�AV[=B�?�:|F;DIP?�8�N�E\J 69A=:T:=?]R=[=SYF;ba?5D4?�?�:=b�6�L��³ Wib=8;DK?�:a?�8c6�[=F�b=?�AKF;N+WX69F;N+DA)e=8�DF;DKW�DdOM�/,0D�<`?)� �"��* #;^��>b=?)2`DAaW�[=8;8�?�A=W�J�£YD8;jKR�?�A=WibB�/2`O$?m6mP?i�O�6�A=:�?�F>6�OG^ �����"0 #�WQba?�WijhB.6�B;N+LoN$O�698lA=DdF;N+DAoD�El8;?v��A=?�Lo?�AKF�R�?�FG<`?�?�A;272 ³ e=8�DSd8Q6�LoB�1dN+F6�A=:oF;b=?�F;DKDO�s.[=F�D;� A´D�J�69A=:&:=? ³ N+LoDA=?-� �"�"9+#lL�6mJ�6�O+B;D�R�?2[=B;?]:xF;D�LoN$AaN$L�N+¯�?>B�JKBG�F;?�LoB><>N+F;bx8�?�B;e�?�W�F2F�DMDdR=B;?�8�P6�F�N$DdA�6�O�?��K[=N+P6�O+?�A=W]?w6�A=:­F;DM:a?�F;?�8�LMN+A=?2N�EcFG<`D�B;JKB;F�?�LMB6�8�?7DdR=B;?]8;P6�RaO$J�?]�h[aN$P69O+?�AKFX^

H]\&J WdO � �QN4L �ZJ�� ���QR���MR �"[d^._`?�8�j?�O+?�J0® B)5 ³ � ³ � 5.DXu�69F;N�?�Fw6�OG^n���"��0 #kW�DL�R=N+A=?]B.LMDK:=?]OWib=?�WijKN$AaSM<>N+F;bxO�69A=S[�69S?)N+A=W�O+[=B�N$DdA 1 ³ FQ69AKE\Dd8;:l® B ³ ��? 3 � _3ud8;A=?]87?]F76�OG^n���"��* #kB;JKB;F�?�Lyg<>N+F;b�:=?�:=[=W]F;N+P?>Lo?�F;b=DK:=B 1h69A=:8$.� ³ � _�8i6mJKF;DA�?�F�69OG^4�����"* #;gm<>N+F;b�O+DSN+W`B;JKAKF;b=?]B;N+BX^k�>b=?3 $ ³ F;b=?�Dd8;?�Lte=8;D�Pd?�8B��{.<>8�?w?]F 69OG^ �����"k+#�b�69B 6 LMDK:=?�O�Wib=?�Wij?�8 E\D84F;b=?�LMDK:�69O0L�[K�WX6�O+W�[aO$[aB&�/A.6]u�6�A�?�F.6�OG^ �����"6 #;^ln C �ks7�a8Q6�Lo?-� ³ F;?i«0?�A&?�F>6�OG^ ���"��* #0N+BH69A�?�AKPhN+8�DA=Lo?�AKFF;b�69F�B�[=e=e�D8�F;B)LMDK:=?�O�Wib=?�WijKN+A=S�N+A�F�b=?)?�AKF;N+8;?�B;D�E�FG<H698;?):=?�Pd?�O+De=Lo?�AKF�e=8�DKW�?�B;Bm^k=^/k=^/k��0�a�Q~d�;�m�� >��~�m����#".�>b=?]D8;?]L e=8�D�PKN$AaSwN+B.6�F;?�Wib=A=N+�K[=?2<>ba?�8;?2R�DF�b&F;b=?2B�JKB;F;?]L

6�Aa:YN$F�B2:=?�B�N+8;?�:|e=8�De�?�8;F�N$?]B�698;?M?]fhea8;?�B�B;?�:V6�B�E\Dd8;L�[=O�6�B4N+AYB;DLo?wL&6�F�b=?�L�69F;N+WX69OlO+DSdN$Wd^�>b=N+B.O+DdSN+W2N+B.SdN$Pd?�AxRKJx62}�~d�������k���m�v���m�wg�<>b=N+Wiby:a?i��A=?�B26oB;?]F7D9EH6�fKN+DLoBH69A=:y6oB;?]F7D9EN+AKE\?�8�?�A=W�?&8�[=O+?�BX^­�>b=?�D8�?�L�e=8�D�PKN$AaSxN+BwF�b=?Me=8�DKW�?�B;B�D9E>��A=:=N+A=SI6&e=8;DKD9E.D�E76&e=8�De�?�8;FGJE\8�DL¶F�b=?w6�fKN+DLoBkD�EcF;b=?)B�JhB�F;?�LI^ ³ F;?]e=B.N+A&F;b=?)e=8�DKD�E�6�e=e�?X69O0F;D�F;ba?w6�fKN+DLoB 69A=:&8;[=O+?�Bmg6�Aa:Te�DB;B�N+R=O+JY:=?�8;N+Pd?�:|:=?i��A=N+F�N$DdA=BM6�Aa:TN+AKF;?�8�LM?�:=N�69F;?MO+?�LoL�69BX^x£Zb=N+O$?oe=8;DKD9E\BwWm6�A|R�?W�DdA=B;F�8;[=W�F�?�:CRhJrb�6�Aa:lg`b=?�8;?dg><�?oE\DKW�[aBMDAaO$JYDdA|L�6�Wib=N+A=?v�¢69B;B;N+B�F;?�:|F;ba?�D8�?�L e=8;D�PKN+A=S�^�>b=?�Dd8;?�Lte=8;D�Pd?�8;B�6�8;?�N+A=W�8�?X6�B�N$AaSO+JxR�?�N+A=S&[=B;?�:YF�DK:�6mJ&N$AIF;ba?wLo?�Wib�6�A=N+WX69OkP?�8�N���WX6�F�N$DdAD�EkBQ6 E\?�FGJd��W]8;N+F;N+WX69Ole=8�De�?�8;F�N$?]B.D�Ekb�6�8�:=<>6�8;?�6�A=:oB;D�E�FG<H698;?):=?�B�N$SdA=BX^�>b=?�Dd8;?�L e=8�D�P?�8�B�WX69AMR�?.8�D[=Sdb=O+J2W�O�6�B�B;N���?�:oN$AM6 B;e�?�W�F;8�[=L E\8;DdL¡b=N+SbaO$J�6�[=F�DL�69F;?�:�g

S?]A=?�8Q69O���e=[a8;e�DB;?�e=8�DS8i6�LoB�F�D�N$AKF�?�8Q69W�F;N+P?�B;JKB;F�?�LMB><>N+F;b&B�e�?�W]Nz69O���e=[a8;e�DB;?�WX69e�6�R=N+O+N+F;N+?�Bm^�>b=?&6�[=F�DL�69F;?�:YB�JKB;F;?]LMB�b�6mP?�R�?�?�A|[=B�?iE\[=O.69BwSd?�A=?�8i6�O>B;?m6�8;Wib|e=8�DhW]?�:=[=8�?�B�69A=:Tb�6mPd?b�69:MA=DdF;?�<`D8�F;bKJ�B;[=W]W�?�B;B4N+AMB;DdO+PhN+A=S�P6�8;N+Dd[=BcW�DdL�R=N+A�6�F�D8;N�69Ohea8;DRaO$?]LMBX^��>b=?4N$AKF�?�8Q69W�F;N+P?B;JKB�F;?�LoB>b�6mP?)R�?�?�AILMD8�?.B�[=N+FQ6�RaO$?4E\Dd8>F;b=?)B�JhB�F;?�L&6�F�N$W4E\Dd8;L&6�O�:=?�P?]O$Dde=LM?]AhF`D�EcL&6�F;ba?i�L�69F;N+W�B>6�A=:oN+A�Lo?�Wib�6�AaN$¯]N$AaS)E\D8�L�69O�Lo?�F;b=DK:=Bm^�GAYW�DAKF�8Q6�B�FwF�DxLMDK:=?]OcWib=?�WijKN$AaS�gkF;ba?�D8�?�L�e=8�D�PhN+A=S­WX6�Ar:=?X6�O`:=N+8;?]W�F;O+JI<>N$F�bTN+AK��AaN$F�?

B;Fi6�F�?2B;e�69W�?�Bm^>�GF>8;?�O+N+?�B4DA&F;?�Wib=AaN$�K[=?]B7O+N+j?4B;F�8;[=W�F�[=8Q69OcN+A=:=[=W]F;N+DA&F;D�ea8;D�P?)D�Pd?�8.N+AK��AaN$F�?

Page 10: Formal Methods: State of the Art and Future Directions Edmund M

��� � ��������� �� ��;�`�����2������9�������

:=DdL�6�N+A=Bm^C�GAhF�?�8Q69W�F;N+Pd?yF�b=?�D8�?�L e=8�D�P?�8�BXg4RhJ|:=?v��A=N+F;N+DA�g>8;?��K[=N+8�?yN+AKF;?�8i6�W�F�N+DAV<>N+F;bC6bK[=L�69Alg�B�D)F;b=?`F;b=?]D8;?]L¡e=8�D�PhN+A=S4e=8;DKW�?]B;B`N$B�B;O+D�<T6�Aa:wD9E\F;?�A�?�8;8�D8G�Ge=8�DA=?^p�GA2F;ba?>e=8;DKW�?�B�BD�E`��A=:aN$AaSxF;b=?�ea8;DKD�EQg�b=D�<`?�P?]8Xg�F;b=?obh[aL�6�A­[=B;?�8�D�E�F;?�AYSK6�N+A=B)N+AhP69O+[�6�R=O+?2N+A=B�N+SbKF)N$AKF�DF;ba?7B�JKB;F;?]L�D8>F;ba?2e=8;Dde�?]8;FGJMR�?�N+A=S�e=8�D�P?�:�^

IKJML N4OQP�RTSVU�N4WYXQPZR4[

H]`�� � � ��� [ �ZJ��EN4P ! J�����L �QWV^k�GAE� �"��6�2`O�6�8�j?g�.)?]8;L�69Alg=6�Aa:y¬�b�6�D�[aB;?�:Y6�[=F�DL&6�F;N+WF;b=?]D8;?]L��Ge=8;D�PKN+A=S�F;?]WQbaA=N+�h[a?�B2R�69B;?�:IDAIB;JKL�R�DO+N+W 69O+S?�R=8i6�N+W2L&6�A=N+e=[=O�69F;N+DAoF;DMea8;D�P?F;b=?IW�Dd8;8;?]W�F;A=?]B;BYD�E�6�A ³ A ��:=N+PhN+B�N$DdAq6�O+SdD8;N+F�b=L B�N+LMN+O�6�8�F;D|F;b=?IDAa?yN+ACF;b=? 3 ?�AK�F;N+[=L'� 2`O�698;j?>?]F.6�OG^4�����"*+#¢^"�>b=N+B�Pd?�8;N���WX69F;N+DA�Lo?�F;baDh:�8�[=A=B>6�[=F�DL&6�F;N+WX69O+O$J269A=:MW�Dd[=O+:b�6mP?�:=?�F;?]W�F;?�:rF;b=?�?]8;8;Dd82N+AxF;ba? 3 ?�AKF;N+[=LIg�<>b=N+WQbI<>6�B)WX6�[aB;?�:YRKJx6 E�6�[=O+FGJo�h[aDF;N+?�AKF:=N+SN+F0B;?]O$?]W�F;N+DA�Fi6�R=O+?^Q,l69F;?�8>A´[=?���g ³ b�6�Aaj6�8Xgd6�A=: ³ 8;N+P6�Bk[=B�?�: ³ A>��® B�S?�A=?]8Q6�O��Ge=[=8�e�DdB;?F;b=?]D8;?]L¶e=8;D�Pd?�8Xg 3 $ ³ ��{4<>8;?4?�F>6�OG^M� �"��k #;g�DA�F�b=N+B�Bi6�Lo?>?�f=6�LMeaO$?<�/A>[=?��?�F>6�OG^4� �"�"*+#;^

H � �J��R4[ [�J�� nR4[ � !��>[^|�>b=? $c?�8;N+FGJrP?�8�N���WX6�F�N$DdA|F;DKDO8� c)[=?]b=O+L�6�AaAT?�F&6�OG^7�����"6 #.N+B<>N+:=?�O+JM[=B�?�:I<>N$F�b=N+A&�G_Hn N+A&F;ba?w:=?]B;N+SAxD9EcL�6�AKJ�e=8�DKW�?�B;B�D8�B2B;[=WibY6�B>F�b=? 3 D�<`?�8 3 26�A=: ³ JKB;F�?�L5@�0"��9=^�s.e=eaO$N+?�:YN+AY6ob=N+?�8Q698;Wib=N+WX6�O`L�69A=A=?�8mg0F;ba?�F;DKDOcWm6�AYb�69A=:=O+?�?�AKF;N+8;?e=8;DKW�?]B;B;Dd8>:=?�B�N$SdA=B`W�DAKFQ69N+A=N+A=S2LMN+O+O+N�DdA=BlD9ElF;8Q69A=B;N+B�F;D8�B&� s4e=e�?]A=¯�?�O+O+?�8.6�Aa:�c)[=?�b=O+L&6�A=A�����"6 #;^C�.B�N+A=STF�b=N+BMF;DKDdO�g´F;b=?­E\[=A=W]F;N+DA�69O.R�?�b�6mPKN+D8oD�Ew6Yb�698;:=<>6�8�?yB�JKB;F;?]L 6�FoF;b=?8;?�SdN+B;F;?]8cF;8i6�A=B¢E\?�8`O$?]P?�OGg�SK6�F;?`O+?�P?]O�g9D8cF�8Q6�AaB;N+B;F�D8cO+?�Pd?�OGg�N+B�LoDK:=?�O+?�:�6�Bc64R�DKDO+?X69A�B;Fi6�F;?F;8i6�A=B�N$F�N+DA)E\[aA=W�F;N+DdAl^ls4O+SD8�N+F;b=LoB0R�6�B�?�:wDdAw_7%<%4B 698;?`[=B;?]:�F;D)Wib=?�WijwF�b=?`?��K[=N+P6�O+?�A=W�?D�EkF;b=?)B;Fi6�F�?2F;8i6�A=B�N$F�N+DA�E�[=A=W�F�N$DdA=B`E\Dd8>:=N�«3?�8�?�AKF.:=?]B;N+SA&O+?�P?]O$Bm^

H�� JML J��JMP�N���������^r�GA � �"�=��_�D�Jd?�8�69A=: �`[ W]DA=B�F;8;[aW�F;?�: 6�A D.�KF;baL � _`D�J?�8M69A=:n&DKD8�?E����:"�41´_�D�Jd?�8�69A=:Vn&DKD8;? ���"!�! #)B;e�?�W�N���WX69F;N+DAVD9E2F;b=?yn DF;Dd8;DdOz6Y*�!"9�k"9­LMN��W�8;Dde=8;DKW�?]B;B;Dd8���N+A=W�O+[=:aN$AaS�!"9�f¡D9ElF;b=?4[=B;?]8G�GLMDK:=?.N+A=B�F;8�[=W�F;N+DdA=B � � _�D�Jd?�8H69A=: ��[;� �"�"*+#;^�>b=?�J)[=B�?�:�F;b=?`B;e�?�W�N���Wm6�F;N+DdAwF�D7ea8;D�P?`F;ba?�W�Dd8;8�?�W�F;Aa?�B;B`D�E�L&6�AKJ.RaN$A�6�8;J)L&6�Wib=N+A=?cW�DK:=?e=8;DdS8i6�LMBke=8�DK:=[=W�?�:­RhJ�W�DdLMLM?]8;W�N�6�OaW�DLoe=N+O$?]8;BkE\8�DL B;Dd[=8;W]?7W]Dh:a?7N+AoB;[=WibMbaN$SdbK�GO$?]P?�OO�6�A=Sd[�6�Sd?�B26�B2s4:�6=g>,"N$B�elgk6�A=:E2)^k�=Dd8)?�f=6�LMeaO$?dg ��[IP?]8;N���?�:rF;b=?&n;27*"!�9"k"9oR=N+A�698;JW�DK:=?>e=8�Dh:a[=W�?�:oRhJ�F;ba? �;SdW�W �2W]DLMeaN$O+?�8"E\D8�k4�`D�ElF�b=?�k"k-2 e=8;DdS8i6�LMBkN+A�F;ba?>_�?�8�j?�O+?�JB;F�8;N+A=S�O$N+R=8i6�8�Jh^

H�� �]h� ������^.�GAE� �"��6�n&DKD8;?�6�Aa:;c26�[KE\L&6�A=AoD�E 2`DdLMe=[aFQ6�F�N+DA�69O ,"DSN+Wga�GA=W^+gl69A=:,0JKA=WibMD9E�s4:=P6�A=W]?�:yn&N+W�8�Db%4?�PKN+W�?�Bmg=�GA=W^+gaW�DO+O�6�R�D8i6�F;?]:MF;D�e=8�D�P?)F;b=?)W�Dd8;8�?�W�F;Aa?�B;B2D9E,0JKA=Wibl® B)LMN+W�8�DhW]Dh:a?)E\D84 �DK6�F�N$AaSMe�DN+AKF.:=N+PKN+B;N+DAxDdAyF�b=?�s7n %&6 c-!"*=^ ³ FQ6�8�F;N+A=SoE\8�DL6�ArN$A©E\D8�L�6�Ope=8;DKD�E2D9E7W�Dd8;8;?]W�F;A=?]B;BxF�b=?�JYE�D8;L&6�O+N+¯�?�:YF�b=?�N+8M6�8�S[=Lo?�AKFwN+ATF�b=?xs�27,nkO+DSN+Wd� c269[KE\L�69A=AT6�Aa:qn&DKD8�? � �"��6 #76�Aa:VWib=?�Wij?�:ZN$Fo<>N+F;b|F;b=?­s�27, kILM?]WQb�6�A=N+WX69OF;b=?]D8;?]LUe=8�D�P?�8m^b.�6�e=B26�Aa:xLMN+B;Fi6�jd?�B.<`?�8;?�E�D[=A=:IN+AxF;ba?�N$A©E\D8�L�6�O ��e=8;DKD9E �&R=[=F)N+AF;b=?4?�A=:oF;b=?4LMN+W�8;DKW�DK:=?><>6�BpLM?�Wib�69A=N+WX6�O+O+J)B;b=D�<>AoF;D2R�?.W�Dd8;8�?�W�F���n&DKDd8;?>?�F>6�OG^4� �"�"*+#;^�>b=?�?�AKF;N+8;?�?i«0D8;F)F�DhDdjx6�R�D[=F)A=N+A=?2<`?�?�jKBm^w�>ba?wLo?�Wib�6�A=N+WX69Ole=8�DKD�E�?�Aa:=?�:I:=D[=RaF7D9EF;b=?oW�DK:=?® B�W�D8�8;?�W�F�A=?�B�B�6�Aa: 6�O+O+D�<`?�:yF�?�B;F�?�8;BoF;D&E�DhW][=BwDdAYDF�b=?�8�8;D[aF;N+A=?�Bm^y�GAj� �"��*A>[=B�B;N+A=D9«T[=B;?�:Ys�27,nkoF;D&Wib=?�WijyF�b=?�W�Dd8;8;?]W�F;A=?]B;B�D�E>F;ba?2 �DK6�F�N$AaS�e�DN+AKF.B��K[�6�8�?�8;DKDFLMN+W�8�DhW]Dh:a?;� A´[=B;B�N+A=D�«]���"��* #;^x54?�E\Dd[=A=:YR=[aSB�N$ArF;b=?oLMN+W�8�DhW]Dh:a?MN+F;B�?�O�E�1�6 E\F;?�8�F;ba?�J<�?]8;?)��fK?�:�g�F�b=?)��A�6�OlPd?�8;B�N+DA&D�EcF;ba?2B;�K[�698;?�8;DKDF>LoN$W]8;DKW�DK:=?)<H69B769O$B�DwLo?�Wib�6�AaN$Wm6�O+O+Je=8;D�Pd?�:&W�D8�8;?�W]FX^

H�� JML J��JMP�NY\�� ��^�%4[=8;N+A=S;� �"��km�����"��*2_`8;DKWijxD9E 2`DLoe=[=FQ69F;N+DA�6�O�,0DSdN+Wg=�GA=Wd^$g�<`D8�j�N+A=S&N$AIW�DdO$O�69R�Dd8Q6�F�N+DAI<>N$F�b@n DF;Dd8;DdOz6o:=?]B;N+SA=?]8;BXgp:=?�Pd?�O+De�?�:T6�AYs�27,nk&B;e�?�W�N���WX69F;N+DAD�E�F�b=?�?�AKF;N+8;?�n&DF�D8�DO�6�2`DdLMe=O+?�f�s48;N+F;b=Lo?�F;N+W 3 8;DKW�?�B�B;D8 �Z2`s 3 ��g�6�LMN+W�8�De=8�DKW�?�B;B�D8

Page 11: Formal Methods: State of the Art and Future Directions Edmund M

� � ��c��a�7����� � ��� �\� �\� � � �������� ���9��� �"� � � +� ���� +������� � �� � � �

E\D8�:=N+SN+Fi6�O`B;N+SA�69O�ea8;DKW�?�B�B;N+A=S���% ³43 ��^k�>ba? 2`s 3 N$B�F�b=?&LMDdB;F�W�DLoe=O+N$Wm6�F;?]:YLMN+W�8;D9�e=8;DKW�?]B;B;Dd8.Jd?�F`E\D8�L�69O$N+¯�?]:lg�<>N+F;bx6�F;b=8�?�?2B;Fi6�Sd?7eaN$e�?�O+N+A=?gKB�N$foN+A=:=?�e�?�A=:=?]AhF4LM?�LoD8�N$?]BXgE\D[a8.L�[=O+F;N+e=O+N+?�8¢�¢69W�W�[=L�[=O�6mF�D8;Bmg=D�Pd?�8-k"6"9oe=8�DSd8Q6�LoLM?�8¢��PKN+B;N+R=O�?)8;?�SdN$B�F;?�8�BXgc69A=:@69AyN+AK�B;F�8;[=W�F�N+DA&B;?�F.69O+O$D�<>N+A=S)F�b=?)B;N+L�[=O+FQ69A=?�D[aBcLMDK:=N���WX69F;N+DA�D9E�<`?�O+O�D�Pd?�8-��9�928�?�SN+B�F;?�8�B.N+A6&B;N+A=SdO+?MN+A=B;F�8;[=W]F;N+DAl^ �>b=?�E\Dd8;L&6�OcB�e�?�W]N���WX6�F�N$DdATF�8Q6�Wijd?�:|F;b=?&?�PdDO+PKN$AaS�:a?�B;N+SAV69A=:N+A=W�O+[=:=?�:T6oB�N$Loe=O+?�8)A=DA©��e=N+e�?�O+N+A=?�:IPhN+?�< F�b�6�F2<>6�B)e=8�D�P?�:Y?]�h[aN$P69O+?�AKF2DAY6&W�?�8�FQ69N$AW�O�6�B�B>D�Ece=8;DdS8i6�LMBm^���N+A�6�O+O+JKg_`8;DKWij&[=B;?�:­s�27, k�F;DoP?�8�N�E\JMF�b=?2R=N+A�698;JMLoN+W�8;DKW�DK:=?4E\Dd8B;?�Pd?�8Q69O % ³43 6�O+SdD8;N+F�b=LMB7� _�8�DKWQj&?�F.69OG^����"��* #;^

H�� ��� � l^Q%4[=8;N+A=S8�����"0m�������"6 ³ 8�N+P6�BlD9E�F;ba? ³ FQ69AKE\D8�:�A>?]B;?X698;WibM�GA=B�F;N+F;[aF;?>6�A=:�n&N+O+O$?]8D�E-A>DKWijh<`?�O+O.�GAKF�?�8;A�69F;N+DA�6�O>W�DdO$O�69R�Dd8Q6�F�?�:|DAVF�b=?xB�e�?�W]N���WX6�F�N$DdAq6�Aa: Pd?�8;N���Wm6�F;N+DdA D9EF;b=?i2`DO+O+N+A=B�2`DLoLM?�8�W�N�6�Oks.PKN+DAaN$W]Bws4s7n 3 6­LMN+W�8�De=8�DKW�?�B;B�D8m^Y�>b=?�JY[=B�?�: 3 $ ³ F;DB;e�?�W�N�E\Jj� 9"!­D�E7F�b=?;k"9��&s.s)n 3 6IN+A=B;F�8;[=W]F;N+DA=BM69A=:TPd?�8;N���?]: F�b=?&LMN+W�8�DhW]Dh:a?�E\Dd85���8;?�ea8;?�B�?�AKFQ6�F�N+P?2N+A=B�F;8;[aW�F;N+DAaB���n&N+O+O$?]8H69A=: ³ 8�N+P6�B-�����"6+#¢^s.Bc<>N+F�b�LMDK:=?�O=Wib=?]WQjKN+A=S�gh69A�N$AaW�8;?X69B;?)N+A�F;b=?>AK[=L�R�?�8�69A=:�jKN+A=:=BcD9ElF;b=?�Dd8;?�L e=8;D�Pd?�8;B

e=8�D�PhN+:=?]B�?�PKN$:a?�A=W�?&E�D8M6IS8�D�<>N+A=SyN+AKF;?]8;?�B�FMN+ATF�b=?�D8�?�L e=8�D�PhN+A=S�^T�>ba?�8;?xb�6�BMR�?�?�AC6W�Dd8;8;?]B;e�DA=:=N+A=S|N+A=W�8�?X6�B�?yN+A|F;ba?yAK[=L�R�?�8M6�Aa: jKN+A=:=BoD�E2?�f=6�Loe=O+?�B�F;Dr<>b=N+WibVF;b=?]D8;?]Le=8�D�P?�8�B�b�6mP?�R�?�?�AV6�eae=O+N$?]:l^x_`?�O+D�<¶N+B�6 O$N+B�FwD9E.B;DLo?�<�?]O$O��GjKA=D�<>AYF;b=?]D8;?]L�e=8;D�Pd?�8;BmgWX69F;?�SdD8;N+¯�?]:x8;Dd[=Sb=O+J�RKJMF�b=?�N+8>:=?�Sd8;?�?�D�E�6�[=F�DL&6�F;N+DdA �H �i[�R �

�!� �� nR N� QL JMWYN4L � � nR �L �ZJ�� L J�JMP [d^ ³ JKB;F;?]LMB�O+N+j?&s�27, kG� c26�[KE�L�6�AaA

6�A=:|n&DKD8�? � �"��6 #;g C P?]B �/2`8Q69N$Sd?�AT?]F�6�OG^�����!"! #;g>, 3 �/.2698;O�6�Aa:T6�A=:j.)[=F�FQ69S � �"!"!+#;gD.�KF;baL � _�D�Jd?�8�69A=: n DhDd8;?Y����:"�+#¢gQA>?]P?Y�/,0?�B�WX6�A=Aa? � �"!�0 #;gc6�A=:GA�A ,]� c 69e=[=8M69A=:n&[=B�B;?�8-� �"!":+#"698;?)S[aN$:a?�:&RhJM6�B;?]�h[a?�A=W�?2D9E�O+?�LoL�6�Bc69A=:M:=?v��A=N+F;N+DAaB>R=[=F`?X6�Wib&F;b=?]D��8;?�L N+Bce=8�D�P?�:M69[=F;DdL�69F;N+WX6�O+O+J.[aB;N+A=S)R=[=N+O+FG�GN+Awb=?][=8;N+B;F�N+W�BcE�D8cN+A=:=[aW�F;N+DA�gO+?�LoL�6]�G:=8;N+P?]A8;?�<>8�N+F;N+A=S�gd6�A=:�B;N+LMeaO$N���Wm6�F;N+DdAl^4D4�hF�b=LygmF�b=?>_�D�Jd?�8G�;n&DKD8�?>F;b=?]D8;?]Lµea8;D�P?]8Xgdb�6�BkR�?�?�A[=B;?]:MF;D�WQba?�WijM62e=8�DKD�ElD�E .��Dd:=?�OG® Bk��8;B�F�N+A=W]DLMeaO$?]F;?�A=?]B;B`F;b=?�Dd8;?�LIgh69A=:�N+AM6)P6�8�N+?�FGJwD9EO�6�8;Sd?i�GB;WX69O$?4P?�8�N���WX6�F�N+DA&?i«0D8;F�BX^

H � �J�J � ���QR���MR �"[d^ C f=6�Loe=O+?�B�N$AaW�O+[=:=? 2`DK�]�/2`D8;Aa?�BM?�F&6�OG^7�����"6+#¢gp57{<, �/.)Dd8;:=DdA����!": #;g, C .2{ �/,"[=D26�A=: 3 DO+O�6�Wij�� �"��k #;g, 2>� � . D8;:aDA�?�F�6�OG^4� �":�� #;g�6�A=:BD4[=e=8;OQ�/2`DAK�B;Fi6�R=O+?2?�F269O�^n����!"* #;^`�>b=?�J­b�6mP?2R�?�?�AI[=B�?�:yF�D�E\Dd8;L&6�O+N+¯�?769A=:xP?]8;N�E\J&b�6�8�:xe=8�DR=O+?�LoBN+AML�69F;b=?]L�6�F�N+W�B�6�Aa:MN+A&e=8;DdS8Q69L¶P?]8;N���WX69F;N+DAl^

H]\&J WdO � �QN4L �ZJ�� X��J�� R �"[^Cs.A�6�O+JKF;N+WX6G�/2`O�6�8;jd?y6�Aa: ¬�b�6�D]�����"0 #;gp<>b=N+WQbZW�DL�R=N+A=?]BF;b=?]D8;?]L�e=8;D�PKN+A=SI<>N+F;bTF�b=?&B;JKL�R�DO+N+W�69O$Sd?�R=8i6xB�JhB�F;?�L nx69F;b=?�L&6�F�N$Wm6=gkb�69BwB�[=W�W�?�B�BG�E\[=O+O+Jyea8;D�P?]: B�DLo?�b�6�8�: AK[=L�R�?�8¢��F�b=?�D8�?�F;N+W&e=8�DR=O+?�LoBw:=[a?�F�D A46�L&6�AK[Xu�69Lx^x_`DF;b3 $ ³ ��{4<>8;?4?�F�69O�^=���"��k #369A=: ³ �k? 3 � _0ud8;A=?�8p?�FH69OG^4�����"* #�W�DL�R=N+A=?pe�D�<`?�8GE�[=O�:a?�W�N+B;N+DAe=8;DKW�?]:=[=8;?]BM6�A=:rLMDK:=?�OcWib=?]WQjKN+A=SI<>N+F;bYN+AKF;?�8i6�W�F�N$Pd?Me=8�DKD�EQ^ 3 $ ³ b�6�B�R�?]?�A|[=B;?�:rF;DP?�8�N�E\Jx6MAK[=L�R�?�8)D�E>b�698;:=<>6�8�?w:=?]B;N+SA=B�6�A=:I8;?X69W�F;N+Pd?gl8�?X6�O��GF;N+LM?dg369A=:­E�6�[=O+F¢��F�DO+?�8Q69AKF6�O+SDd8;N+F;baLMBX^

� =)§�Zl,�Z�-/2&1>(+-A2�>0,.(�/�*�¥�>b=?>D�Pd?�8Q698;Wib=N+A=S2SdDh6�OKD9E�E\Dd8;L&6�OLo?�F;baDh:aBcN+B�F�D2b=?�O+e�?�AaSN+A=?�?�8�B�W]DA=B�F;8;[aW�F�LoD8�?�8�?�O+Nz69R=O+?B;JKB�F;?�LoBX^M�aD8�L�6�OkLo?�F;b=DK:=B)N+B)F;bK[=Bw69AT6�8�?X6&F;b�6�F)W�[=F�B�69W�8;DdB;Bw69O$LoDB�F76�O+OcDdF;b=?]8w6�8�?X6�BN+Aj2`DLMea[=F;?�8 ³ W�N+?�AaW�?^C�GF;B E\D[=Aa:�6�F�N$DdA=B�O$N+?&B;�K[�698;?�O+JrN$A|L&6�F;ba?�L�69F;N+W�BXgkN+F�B�N$AKF�?�A=:=?�:6�eae=O+N$Wm6�F;N+DdA=BM6�8�?yb�698;:=<>6�8�?@69A=:VB�D�E\FG<>6�8�?xB;JKB;F�?�LMBmg769A=:VN+F;Boe�DdF;?�AKF�Nz69O)[=B;?�8�By6�8�?@69O+O:=?�Pd?�O+De�?�8;B4N+AhPdDO+P?]:MN+AMF�b=?2B;JKB�F;?�Lª?�A=SdN$Aa?�?�8;N+A=Soe=8;DKW�?]B;BX^�k8;?�Lo?�A=:=Dd[=B�69:=P6�A=W]?�B&N$AZF;b=?Ye�69B;F&:=?�Wm6�:=?Yb�6mPd?xR�?�?�A L�69:=?xDdA 69O$O´E\8;DdAKF;BX^ s.B

F;?]WQbaA=DO+DSdJ)N$Loe=8;D�Pd?�BXg]N+FlR�?�W�DLo?�BlLoD8�?lE�?X6�B�N$RaO$?pF;D769F;Fi6�Wij2b�698;:=?�8c69A=:2O�6�8�S?�8�e=8;DdR=O+?�LMBm^

Page 12: Formal Methods: State of the Art and Future Directions Edmund M

�i� � ��������� �� ��;�`�����2������9�������

3 8�DS8�?�B;BkN+A)F;b=?>6�8�?X6>:a?�e�?]A=:=BkDA):=DdN$AaS`E\[=A=:�69LM?�AKFi6�O�8;?]B;?X698;WiblgdN$AKPd?�AKF;N+A=S>A=?�<YLo?�F;baDh:aB6�Aa:wR=[aN$O+:=N+A=S4A=?�<rF;DKDO+BXg9N$AKF�?�S8i6�F;N+A=S):=N�«0?�8;?]AhFpLM?�F�b=DK:=BkF;D)<�Dd8;j2F�DSd?�F;b=?]8XgK6�A=:�L�69jhN+A=SW�DdA=W�?�8�F;?�:r?i«3Dd8;F�BwRKJx8�?�B;?X698;Wib=?�8�B�F;D&<`D8;j­<>N$F�byea8Q6�W]F;N+F;N+DAa?�8;B2F�D&F;8Q69A=BGE�?�8wF�?�Wib=A=DdO$DdSJ?i«0?�W�F�N$Pd?�O+Jh^

� = ' §47:9$3VBH5�G)9ILlBH@�>�X69X±UG�°ILN_³ N+SAaN���WX6�AKF769:=P6�AaW�?�B2N+AxF�b=?�e=8Q69W�F;N+WX69Oc[=B�?�D�EcE\Dd8;L&6�OlLo?�F;baDh:aB.b�6mPd?w8�?�O+N$?]:yDdAxE\[aA=:�6m�LM?]AhFi6�O�8;?�B�[=O+F;B):=8Q6m<>A­E\8�DL�6�O+Oc6�8;?m6�B)N+A 2`DLoe=[=F;?]8 ³ W�N+?�A=W�?dglA=DdF)A=?�W�?�B�BQ698;N+O+Jx:=N+8;?�W]F;O+JN+AKF;?�A=:a?�:&E\Dd8cE\Dd8;L&6�O=Lo?�F;b=DK:=Bm^c�=[a8;F;ba?�8.<`D8�j�A=?�?�:=B)F�DwR�?2:=DdA=?)N$AoF;b=?�6�8;?m6�B>D�E

H]\&J WYX>J�[���L �ZJ��>^=£Y?`A=?�?�:oF;D)[=A=:=?]8;B;Fi6�A=:ob=D�<|F;D)W�DdLMe�DB;?>Lo?�F;baDh:aBXg�W�DdLMe�DB�?�B�e�?�Wv�N���WX6�F�N+DA=BmgKW�DLoe�DdB;?.LoDK:=?�O+BXgdW�DLoe�DdB;?)F;ba?�D8�N$?]BXg�69A=:&W�DLoe�DdB;?4e=8;DKD�E�BX^

HahKR � JMWYX J [ �ZL � J��>^.£Y?2Aa?�?�:YF;D&:=?]P?�O+DeILMDd8;?2?emMW�N+?�AKF2LM?�F�b=DK:=B4E\D84:=?�W�DdLMe�DB�N$AaS62W]DLMea[=FQ69F;N+DA�69O+O$J�:=?�L&6�A=:aN$AaS2SO+DR�6�O�e=8;Dde�?�8�FGJ&N$AKF�D�O$DKWX69O0e=8;Dde�?]8;F;N+?�B)<>b=DdB;?2Pd?�8;N��=�WX6�F�N+DAIN$B)W�DdLMe=[aFQ6�F�N+DA�69O$O+JoB;N+LMe=O+? � ?^ S�^+g0F�b=?�FQ69B;jx:=?]W�DLoe�DdB;N+F;N+DAY6�Aa:yO+DKWX6�O+N+¯X69F;N+DA8;?�:a[=W�F;N+DdA�Lo?�F;baDh:aB>D�E � c)[=8�B;b�69A � �"� ?R # ��^

H��BO>[ L��N�� L���J��H^7A´?X6�OkB;JKB�F;?�LoB 698;?�:=N mMW�[=O+F.F�D&B;e�?�W�N�E\Jy69A=:xP?]8;N�E\J&<>N+F;b=Dd[=F26�R=B�F;8Q69Wi�F;N+DAaBX^o£Y?wA=?]?�:TF�DxN+:=?�AKF;N�E\Jx:aN�«0?�8�?�AKFwjKN+A=:=B2D9E´69R=B;F�8Q69W�F;N+DAaBXgke�?�8;b�69e=B�FQ6�N+O+D8�?�:IE\Dd8W�?�8�FQ6�N+AYjKN+A=:=B2D9EHB�JKB;F;?]LMB2Dd82e=8;DdR=O+?�LU:aDL�69N+A=BXg06�Aa:Y<�?�A=?]?�:TF�D�:a?�P?�O+DdeY<H6mJKB)F;Dui[=B�F;N�E\J�F;ba?�L¶E�D8;L&6�O+O+Jg�e�?�8;b�6�e=B4[=B;N+A=S�LM?�Wib�69A=N+WX6�O0ba?�O+el^

H�BR >[�N=O P�RYWYJ�nR P [iN�� L��QR J�����R [d^;A.69F;b=?]8wF�b�6�Ar:=?i��A=N+A=SILMDK:=?]O$B�6�A=:YF�b=?�D8�N+?�BE\8;DdL B�W�8Q69F;WibI?X6�WibIF;N+LM?26�Aa?�<µ69e=e=O+N+WX6�F�N$DdAMN+B.Fi6�WijKO+?�:lg0N+F><`D[=O+:xR�?wR�?�F�F;?�8)F;D&b�6mPd?8;?�[aBQ6�RaO$?269A=:&e�6�8i6�LM?]F;?�8�N$¯]?�:&LMDK:=?�O+B>6�A=:&F;ba?�D8�N$?]BX^

H]\&J WdO � �QN4L �ZJ�� [VJ �7WYN4L�� R WYN4L � �N4PnL �QR J�����R4[^0nx69AKJwBi6mE\?�FGJd�GW�8;N+F�N$Wm6�O0B;JKB�F;?�LoB�b�6mPd?R�DdF;br:=N+SN+FQ69OH69A=:V6�A�69O$DdSxW�DdLMe�DA=?�AKF�BX^r�>b=?�B;?­bhJKR=8�N+:TB;JKB�F;?�LoB�8;?��K[=N+8;?&8�?X6�B�DA=N+A=S6�R�D[=F`R�DF;b&:=N+B�W�8;?�F�?�69A=:&W�DAKF�N$AK[=Dd[=B`L�6�F�b=?�L&6�F;N+W�Bm^³ JKB;F�?�L�:=?�Pd?�O+De�?�8;B�<`D[aO$:YO+N+j?�F�DxR�? 69R=O+?�F;DIe=8;?]:=N+W�F�b=D�< <�?]O$O`F;ba?�N+8wB�JhB�F;?�L <>N+O+ODe�?�8Q69F;?�N+AxF�b=?���?�O+:l^��GA=:=?�?�:rF;b=?]JxD�E\F�?�AIWX6�8�?�LMD8�?w6�R�D[aF7e�?�8¢E\D8�L�6�AaW�?wF�b�6�AIW�Dd8G�8;?�W]F;A=?�B�BX^ 3 ?�8GE\Dd8;L&6�A=W�?&LoDh:a?�O+N$AaSyR�D8�8;D�<>BMB�F;8�DA=SdO$J E\8;DdL ea8;DR�6�R=N+O+N+FGJhgkB�FQ6�F�N+B;F;N+W�Bmg6�A=:o�K[=?�[=?�N+A=S�F�b=?�Dd8;JK^

HahKN4L�NY[ L��� �L ��R4[-N�� N4P !MJ����ZL��QWE[�^c�kDob�6�A=:aO$?�Oz698;Sd?�8.B�?X6�8�WQbIB;e�6�W�?�B269A=:xO�6�8�S?�8B;JKB;F�?�LMBmg=A=?]< :�6�Fi6�B;F;8�[=W�F�[=8;?�B�6�A=:y69O+SD8�N+F;b=LoBXgd?^ S�^+gKLMDd8;?)W�DAaW�N+B;?�:�6�Fi6�B;F;8�[=W�F�[=8;?�BE\D8`8;?]e=8;?�B�?�AKF;N+A=S&R�DhDdO+?X6�A E\[=A=W�F�N+DA=Bmg�6�8�?)A=?�?�:=?]:l^

� = ¤ ;�GML��$XV3H_�BH9$3M,�X4X6@ _D.D>DdA=?cLo?�F;b=DK:)D8�F;DKDO�Wm6�A2B�?�8;Pd?H69O$O�ea[=8;e�DB�?�BX^k£Y?cAa?�?�:2F�D.B;[ae=e�Dd8;Fk6�O+O�:=N�«3?]8;?�AKFkjKN$Aa:=BX^�a8;DL e�6�B;Fk?�fKe�?�8;N+?�AaW�?g=<`?`b�6mP?`O+?X6�8�A=?�:�<>b�6�FkjKN+A=:=BkWX6�A�b�6mPd?�F�b=?�LoDB�FlN+LMe�69W�FX^"��D4R�?6�F�F;8i6�W�F�N$Pd?)F;D�e=8i6�W�F�N$F�N+DA=?�8�BXg�LM?]F;b=DK:=B.69A=:&F;DKDO+B`B;b=Dd[=O+:�Bi6�F�N$B¢E\JMF�b=?)E\DdO+O$D�<>N+A=S)W�8�N+F;?�8�Nz6a^£Y?�8;?X69O$N+¯�?�F;b�6�F2B�DLM?�D�E�F�b=?�B;?oW�8;N+F�?�8;N�6x698;?�N$:a?X6�O+BXg"R=[=F2F�b=?�Jy698;?�B;F�N+O$OkSdDhDK:IF;D&B;F�8;N+P?E\Dd8X^

HaS7N��P �jXQN ��OQN����c^2n&?�F�b=DK:=Bw6�Aa:yF�DhDdO+B7B�b=D[aO$:­e=8;D�PKN+:=?�B;N+SA=N���Wm6�AKF)R�?�Aa?i��F;B�6�O+LMDdB;F6�B`B;DKDAx69B>e�?�Dde=O+?2R�?�SN+A&F;D�[=B;?�F;b=?�LI^

Ha^ � ���R WYR � L N4P�!MN�� � ��J�� � � ���R WYR��nL�N=P&R��)J��LK^Y_�?]A=?i��F�BMB;baD[=O+:TN+A=W]8;?X69B;?y69B�:=?i�P?�O+Dde�?�8�B2S?]FwLoD8;?�6�:a?�e=F2Dd82e=[=F2LoD8�?w?i«0D8�FwN+AKF;D&<>8�N$F�N+A=SxB;e�?�W�N���Wm6�F;N+DdA=BwDd82[=B�N$AaSF;DKDO+Bm^

Page 13: Formal Methods: State of the Art and Future Directions Edmund M

� � ��c��a�7����� � ��� �\� �\� � � �������� ���9��� �"� � � +� ���� +������� � �� � ���

H�� QPZL �ZXQP R [ R0^2�GF2B�b=D[aO$:IR�?�e�DdB;B;N+R=O+?�F;Dx6�LoD8�F;N+¯�?�F;b=?�W�DdB;F2D9EH6oLM?�F�b=DK:yDd8)F;DKDOD�P?�8�L�69AKJx[=B;?]BX^V�aD82?�f=69LMe=O+?gkN+F�B;b=Dd[=O+:TR�?�e�DB�B;N+R=O+?MF�Dy:a?�8;N+P?&R�?�A=?i��F;B�E�8;DL 6B;N+A=SdO$?4B;e�?�W�N���WX69F;N+DAx69F�B�?�P?�8i6�O�e�DdN$AKF�B>N$A&62ea8;DSd8Q69Ly® BcO+N�E\?>W�JKW�O+? �cN+Ao:=?�B;N+SdA 69A�6�O+JKB;N+BmgW�DK:=?)De=F�N+LMN+¯X6�F�N+DAlg�F�?�B;F4WX6�B�?2S?]A=?�8Q69F;N+DA�g=6�A=:&8;?]S8;?]B;B;N+DdAxF;?�B�F;N+A=S�^

Ha^ � L R !��N=L�R >[ R3^�n&?�F;baDh:aBH69A=:�F;DKDO+BcB�b=D[aO$:�<`D8�jwN+A�W�DAmui[=A=W�F�N+DA�<>N+F;b�?X69WibMDF�b=?�86�A=:)<>N+F;b)W�DdLMLoDA>e=8�DS8i6�LoLMN�AaScO�6�A=Sd[�6�Sd?�Bl6�A=:)F�?�Wib=A=N+�K[=?�BX^>%4?�Pd?�O+De�?�8;B�B;b=Dd[=O+:)A=DFb�6mP?�F;D �;R=[=JIN+AKF;D��x6&Aa?�<¶LM?]F;b=DK:=DdO$DdSJ&W�DdLMe=O+?�F�?�O+JxF;DxR�?�SdN$AY8�?�W�?�N+PKN+A=SxR�?�A=?i��F;BX^�>b=?2[=B�?wD9E�F;DKDdO$B´E\D8´E\D8�L�69O0LM?�F�b=DK:=B>B;b=Dd[=O+:xR�?wN+AKF;?�Sd8Q69F;?�:I<>N+F;bxF�b�6�F4D�E�F�DhDdO+B>E\Dd8F;8i6�:=N+F;N+DdA�6�O�B;D9E\FG<H698;?):=?�Pd?�O+De=Lo?�AKFXgd?^ S�^+gKW�DdLMe=N+O+?�8;B>6�Aa:�B�N+L�[=O�6�F;Dd8;Bm^

HaS7NM[ RjJ � >[ R3^ ��DKDdO$B�B;b=Dd[=O+: R�?x6�B�?X6�B�JTF�DY[=B;?x6�B�W]DLMeaN$O+?�8�BXgc69A=:TF�b=?�N+8�D[=F�e=[=FB;b=Dd[=O+:MR�?w6�B>?m6�B;JoF;D�[=Aa:=?�8;B�FQ69A=:l^

HaS � ���ZR � ���c^4�kDhDdO+B.B;baD[=O+:xL&6�j?)?�mMW]N$?]AhF)[=B�?�D�EH6 :=?�Pd?�O+De�?�8X® B2F�N$Lo?^4��[a8;A�698;D[aA=:F;N+LM?�<>N+F;bw69A2N+AhF�?�8Q69W�F;N+Pd?�F�DhDdOB�b=D[=O+:2R�?`W�DLoe�6�8i6�R=O+?kF;D4F;b�69FlD�E�A=D8�L�6�O�W]DLMeaN$O�69F;N+DAl^%4?�P?�O+Dde�?�8�B�698;?&O+N+j?�O+JxF�DyR�?&LMD8�?�e�6�F�N+?�AKFXgkb=D�<`?�P?]8Xgc<>N+F�bYW�DLoe=O+?�F;?�O+JY6�[=F�DL&6�F;N+WF;DKDO+B`F;b�69F>e�?]8GE\Dd8;LªLMD8�?.?�fKF�?�A=B;N+Pd?w6�A�69O+JhB�N+BX^

HaS7NM[ R J � P�R N������ ��!k^aD4DFi6�F;N+DdA=Bx6�A=:VF�DKDO+BMB�b=D[=O+:Ce=8;D�PKN+:=?y6rB�FQ6�8�F;N+A=S|e�DN+AKF�E\Dd8<>8;N+F;N+A=S4E\Dd8;L&6�OKB;e�?�W�N���WX69F;N+DAaBcE\Dd8c:=?�Pd?�O+De�?�8;B`<>b=D2<`D[aO$:�AaDFcDdF;b=?�8�<>N+B;?.<>8�N+F;?.F�b=?�LI^�>b=?2jKA=D�<>O+?�:=Sd?)D�EcE\Dd8;L&6�O�B;e�?�W�N���WX69F;N+DA=B)A=?]?�:=?�:YF�D�B;FQ698;F)8;?m6�O+N+¯�N+A=S�R�?]A=?i��F�B2B;b=Dd[=O+:R�?)LoN$AaN$LM69OG^

HaS ���J�� nR L R � L���J�� J����ZR �nL�R`^0n&?�F;baDh:aB.6�A=:oF;DKDO+B`B;b=Dd[=O+:MR�?7Dde=F;N+LoN$¯]?�:�E\D8p��A=:aN$AaS?�8;8�D8�BXgKA=DdFkE\D8pW�?�8;F�N�E\JKN$AaS2W�D8�8;?�W]F;A=?�B�BX^>�>ba?�JwB�b=D[aO$:oB;[=eae�Dd8;F`S?�A=?]8Q6�F�N+A=S2W�Dd[=AKF;?�8�?�fd�6�Loe=O+?�B�6�B.6�Lo?X6�AaB�D9E�:=?�Ra[=SSdN$AaS�^

H ��J��� [ RYN��QN4P � [ � [d^ln&?�F�b=DK:=B.6�Aa:MF;DKDdO$BpB;b=Dd[=O+:MR�?7SdDKDh:M69FH69A�6�O+JK¯�N+A=Sw69F�O+?X69B;F`DA=?6�B�e�?�W]F2D�E.6oB;JKB;F�?�L <�?�O+OGg0?^ S�^$g"F;b=?�W�DAKF�8;DOp �D�< D�EH6oe=8�DF;DKW�DdOG^w�>ba?�JyAa?�?�:YA=DdF2R�?SDKDK:�69F.6�A�69O$JK¯�N+A=S�6�O+Ol6�B�e�?�W]F;B)D�Ec62B�JhB�F;?�LI^

HaS � JMP QL���J�� N�����nR �MR P�JMXQWYR � Ld^�n&?�F�b=DK:=B26�A=:IF;DKDdO$B>B�b=D[aO$:­B;[=e=e�D8�F)?�PDdO$[aF;N+DA�698;JB;JKB;F�?�L :a?�P?�O+Dde=LM?�AKF�RKJV6�O+O+D�<>N+A=Sye�6�8;F�N�6�O)B;e�?�W�N���WX69F;N+DA 6�Aa:q6�A�69O+JhB�N+BMD�E2B�?�O+?�W�F;?]:6�B�e�?�W]F;B.D9E 6�B�JhB�F;?�LI^

n&D8�?x6�L�R=N+F;N+Dd[=B;O+JKgk8Q6�F�b=?�8oF;b�69A Ra[=N+O$:V6IB�N$AaSO+?&F;DKDOGg`<�?­WX6�AVRa[=N+O$: �;Lo?�FQ6 ��F�DhDdO+B �<>b=N+Wib2F;ba?�LMB�?�O+P?�B�e=8;DK:=[=W]?�F�DhDdO+BlW�[=B�F;DdLMN+¯�?�:4E\Dd8�6>e�6�8;F�N+W�[=O�6�80e=8�DR=O+?�L :aDL�69N+A-� ³ F;?i«0?�A?�Fc6�OG^����"��* #;giE�D8;L&6�O�A=DdFQ69F;N+DA��/2`O+?X6mPd?�O�6�A=:)?�Fc6�OG^����"��6 #;g�Dd8kO$DdSN+W7�/.)D8�:=DA�� �"!�:41 c)N$Aa:=8;?�:6�Aa:M£VN+A=Si�����"* #;^0�>ba?�B;?2Lo?�FQ6 ��F�DKDO+BXgdO+N$jd?>W�DLoe=N+O+?�8cS?]A=?�8Q69F;Dd8;BXg�e=8�D�PKN$:a?76�A&6�[=F�DL&6�F;N+W<>6mJ�F;D�R=[=N+O+:MB�e�?]W�N�6�O+N+¯�?�:xLoDh:a?�O�Wib=?]WQjd?�8;B)Dd8>e=8;DKD�EkWib=?�Wij?�8�BX^��N$A�6�O+O+Jhg©E\D826�AKJxAa?�< LM?�F�b=DK:yDd87F�DKDOGg0N+F;B):=?�Pd?�O+De�?�8�B;b=Dd[=O+:yB�FQ6�F�?�?�fKe=O+N+W�N+F;O+J&<>b�6�F

N+F;BoB;F;8�?�A=SdF;b=Bmg2O+N+LMN+FQ69F;N�DdA=BXgpLMDK:=?�O+N+A=SY6�B�B;[=Loe=F;N+DAaBXg>?X69B;?ID�EwN+AKF;?]S8Q69F;N+DAZ<>N$F�bVDF�b=?�8LM?]F;b=DK:=B26�Aa:yF�DhDdO+BXgl69A=:yB�FQ698;FG�G[=eYW�DdB;F�B�698;?^�2`O+?X698)B;?�O+?�W�F�N+DAYW�8�N$F�?�8;N�6&ba?�O+eye�DF�?�AKF;N�6�O[=B�?�8;B4:=?�W�N+:=?2<>b�6�F>LM?]F;b=DK:MDd8>F;DKDO0N+B>LoDB;F`6�e=e=8�De=8�N�6�F;?4E\Dd8>F;b=?)e=8�DR=O+?�L�6�F>b�6�A=:l^

� = � (¾9$LNGMS6C�B$LlQ X69�X���;ÌGML��IX43:_.)N+P?]A7F�b�6�F�A=D.DdA=?kE\Dd8;L&6�OmLM?�F�b=DK:7N+B�O$N+jd?�O+J>F;D.R�?cB�[=N+FQ6�RaO$? E\D8�:=?�B;W]8;N+R=N+A=S769A=:w69A�6�O+JK¯�N+A=S?�Pd?�8;J&6�B;e�?�W�F4D�Ec6�W�DLoe=O+?�fwB�JKB;F;?]Lyg=6�e=8i6�W�F�N$Wm6�Ol6�eae=8;DK6�Wib&N$B`F;D�[aB;?):=N�«3?]8;?�AKF.Lo?�F;baDh:aBN+AMW�DdL�R=N+A�6�F�N+DAl^0£Zb=?�A&W�DL�RaN$AaN$AaS2LM?�F�b=DK:=B`N$F`N+B>N+LMe�D8;Fi6�AKFcF�D�W�DA=B�N+:=?�8.R�DF�b �

Hq��N$Aa:=N+A=Sw6�B;[aN$Fi6�R=O+?)B;FGJKO+?4E\D8`[=B�N$AaS�:=N�«3?�8�?�AKF.Lo?�F;b=DK:=B`F;DdS?�F�b=?�8 1369A=:Hq��N$Aa:=N+A=Sw6�B;[aN$Fi6�R=O+?)LM?m6�A=N+A=S)E�D8`[=B;N+A=S�:=N�«0?�8;?]AhF4LM?�F�b=DK:=B`F;DSd?�F;ba?�8X^

Page 14: Formal Methods: State of the Art and Future Directions Edmund M

� � � ��������� �� ��;�`�����2������9�������

$c?�8�JwD9E\F;?�A�Aa?�N+F;b=?�8>N+B�69:=:=8�?�B;B�?�:x6�:=?��K[�69F;?�O+JK^���6�N+O+[=8�?�F�D2��Aa:M6)B;[=N+Fi6�R=O+?>B;FGJKO+?.LoN+B;B;?]BD[aFMDAZF;b=?IF;8�[=?@69:=P6�AKFi6�S?]BMD�E�W�DL�R=N+A=N+A=S­LM?�F�b=DK:=BX^ �=Dd8M?�f=69LMe=O+?g`F;ba?@¬CB�WQbaDhDdOB;F�8;?�B�B;?�B)F�b=?.N+LMe�D8�FQ69A=W�?>D�Elea8;?�B�?�AKFQ6�F�N+DA&D�ElB�e�?�W]N���WX6�F�N$DdA=B>N+AM6�A&6�W�W�?]B;B;N+R=O+?4E\Dd8;Lyg9<>N$F�be=O+?�AKFGJMD9E�A�69F;[=8i6�O0O�6�AaS[�69S?^��>b=N+B>?�LMeab�6�B�N$B`b�69B�b=?]O$e�?�:xN+Aoe�Dde=[=O�6�8�N$¯]N$AaSwN+F;B>AaDFQ69F;N+DA�^s.AKJoW�DL�R=N+A�69F;N+DA�L�[=B�F�e=8�?�B;?]8;P?�F;baN$B>B�FGJKO$?)D9E�e=8�?�B;?�AKFi6�F;N+DdAl^��69N+O$[a8;?�F;Dy69F;F;?]A=:TF�DxF;b=?�F�b=?�Dd8;?�F�N$Wm6�O`E\Dd[=A=:�69F;N+DA=B�D�E>F;b=?oW�DL�R=N+A�69F;N+DA­LMN+B;B�?�B)D[=F

DA­F;b=?�F;8�[=?M6�:=P69AKFQ6�Sd?�B.D9EcE\Dd8;L�69O+N$FGJd^��GA­WQba?�LMN+B;F�8;JKg06�:=N+B;F�N+A=W�F;N+DdAxN+B7:a8Q6m<>AxR�?�FG<`?�?�A6x��� � � �K���w6�Aa:y6&�i~�´�©~ �h�a�^)�GAy6�LoN$fKF�[=8;?gaF;b=?�N+A=S8�?�:=N+?�AKF;B4LM?�8�?�O+JMLoN$AaSO+?.F�DS?]F;b=?�8 1N+A�6�W�DdLMe�D[=Aa:lgF�b=?)N+A=S8�?�:=N+?�AKF;B>R�?�W�DdLM?.Wib=?]LMN+WX6�O+O+J�[=A=N+F;?�:�^ ³ D�N+F�N+B`<>N$F�b&W�DL�R=N+A=N+A=S:=N�«0?�8;?�AKF�E\D8�L�69O�Lo?�F;baDh:aBX^o��E.F;b=?oLM?X69A=N+A=SMD9E.F;b=?oW�DL�R=N+A�69F;N+DA&N+B�A=DF2ea8;De�?�8�O$JI?�fd�e=O�6�N+A=?]:lg�F;ba?�A�F;b=?>8�?�B;[aO$FpN$BkLo?�8;?�O+Jw64LoN$fKF�[=8;? �"A=DF�b=N+A=S.LoD8;?`WX69AwR�?>:=?�:=[aW�?�:�E�8;DL F;b=?uiDdN$AKFc:a?�B;W�8�N+e=F;N+DAoF;b�69A�E\8;DdL F;b=?4B;?�e�698Q69F;?)DA=?]BX^k��ElF;ba?7Lo?X6�AaN$AaS.D�ElF�b=?.W]DL�R=N+A�69F;N+DA2N+B?�fKe=O�6�N+A=?]:lgF�b=?�AoF;b=?48;?�B�[=O+F�N+BcL�[=Wib�LMDd8;?>e�D�<�?�8¢E\[=OG^��GFcF;b=?]AMR�?�W�DLo?�B`e�DdB;B;N+R=O+?>F�Dwb�6mPd?FG<`D2PKN$?]<>B>D�E�6�B;JKB;F�?�L¶B;e�?�W�N���Wm6�F;N+DdAlg�69A=:�F;D�8;?X69B;DdA�<>N+F�bM6�A=:o8;?i��Aa?7DdA=?.PKN+?�<2g=69A=:�F;D[=A=:a?�8;B�FQ6�Aa:xF;b=?�W�DA=B�?��K[=?�A=W]?�B)N$A&F�b=?)DF;ba?�8.PKN+?�<2^

0=^/0=^����I~m��]�� l�=�i�i����d�y�d�=� �0�=�i~���X� >��~�m����#"7{4A=?�D9EHF�b=?�LMDB�F)e=8;DdLMN+B;N+A=S�:=N+8�?�Wi�F;N+DdA=BMN+A|LM?�F�b=DK:|N$AKF�?�S8i6�F;N+DdA N+BoN$A|W�DdL�R=N+A=N+A=SxLoDh:a?�O.Wib=?�WijKN+A=S 69A=:|F;b=?]D8;?]L e=8�D�P�N+A=SE� c)[=8;B�b�6�AT69A=: ,�6�Loe�Dd8;FB�����"041QA.6]u�6�AY?�F�6�OG^)� �"��641�_3ud8;A=?]8w?�F�6�OG^>� �"��* #;glN+:=?m6�O+O+JF;D&R�?�A=?i��F)E\8;DdLUF�b=?�69:=P6�AKFi6�S?]B7D9E�R�DF;bY6�eae=8;DK6�Wib=?�Bm^M{4A=?�<H6mJ&N+B)F;D&?�Loe=O+D�JMLMDK:=?]OWib=?�WijKN+A=SM6�B.6�:=?�W�N+B�N$DdA&e=8;DKW�?�:a[=8;?�<>N+F;b=N+A�6�:=?�:a[=W�F;N+Pd?)E\8Q69LM?�<`D8�j0gh69B>N$B`:=DdA=?)N$A&F�DhDdO+BB;[aWQbI6�B 3 $ ³ 6�A=: ³ �k? 3 ^=�=Dd8>?�f=6�Loe=O+?g=6�B;[ mMW]N$?]AhF�O+JM?�fKe=8�?�B;B�N$Pd?wO+DdSN+W)WX6�A&R�?2[=B;?]:xF;D:=?i��A=?wF�?�LMe�D8i6�O0Dde�?�8i6�F�D8;B4D�P?�8´��A=N+F;?)B�FQ6�F�?wF�8Q69A=B;N+F;N+DdA�B�JKB;F;?]LMB>N+AxF;?]8;LMB>D9EcL�6�fKN+LM6�OD84LMN+A=N+LM6�O©��fK?�:xe�DN+AKF;BX^>�aD8`��AaN$F�?2B;Fi6�F�?2F;8i6�A=B�N$F�N+DA&B;JKB;F�?�LMBmg�F;b=?�B�?2��fh?]:xe�DdN+AhF�B>WX6�AR�?�?�P6�O+[�69F;?�:Y[=B�N+A=Sx6&LMDK:=?�OkWib=?�Wijd?�8�69Bw6o:=?�W�N+B�N$DdAYe=8;DKW�?]:=[=8;?d^x�=Dd87B�F;8�[=W�F;[a8;?�Bo<>N$F�b[=AKR�D[=A=:a?�:&B;FQ69F;?2B�e�6�W]?�BXg�F;ba?7F�?�LMe�D8i6�O0e=8�De�?�8;F�N+?�B.WX69A&R�?2Pd?�8;N���?]:�RKJoLM?X69A=B�D9El��fK?�:e�DN+AKF�N+A=:=[aW�F;N+DA�^s.A=DdF;b=?]8w<>6mJxD�E.W]DL�R=N+A=N+A=So:=?�:=[=W]F;N+P?&6�A=:YLoDh:a?�OcWib=?�WijKN+A=Sy6�eae=8;DK6�Wib=?�B�N+B2F;DI[=B;?

:=?�:a[=W�F;N+DdA F�DyDdR=FQ69N+A 6 ��A=N+F;?oB;FQ69F;?x6�RaB;F;8i6�W�F�N+DA|D�E26�ATN+Loe=O+?�LM?�AKFi6�F;N+D�AIF;b�69FwWm6�A|R�?P?]8;N���?�:I[=B;N+A=S�LoDK:=?�OlWib=?]WQjKN+A=S�^ ³ [aWQbY6�RaB;F;8i6�W�F�N+DA=B)6�8;?�W�DdLMLMDdA=O+Jw[aB;?�:IN+A�ea8;?�e�698;N+A=S6&e=8�DR=O+?�LtE\Dd82LMDK:=?]O�Wib=?]WQjKN+A=SIR=[=Fw698;?oB;?�O+:=DdL 8�N+SD8�D[=B�O+JxP?�8�N���?�:l^d%.?]:=[=W�F�N$DdAYWX6�A6�O+B�D7R�?.[aB;?�:oF;D)P?�8�N�E\J�69B;B�[=LMe=F�N+DAK�GW�DLoL�N�F�L�?�AKF0e=8;DKD�ElDdR=O+N+Sh6�F�N+DA=B�S?�A=?]8Q6�F�?�:MRKJ�W�DL �e�DB;N+A=S�W�DdLMe�DA=?�AKF`N+LMe=O+?�L�?�AKFi6�F;N+DdA=BkF;b�69F�b�6mPd?.R�?�?�AxB�?�e�698Q6�F�?�O+JMPd?�8;N���?�:oRKJ�LM?X69A=B�D9ELMDK:=?]O=Wib=?�WijKN$AaS�^k�GA=:=[aW�F;N+DAoWX6�A&R�?.W�DdL�R=N+A=?�:�<>N+F;b�LoDK:=?�O�WQba?�WijhN+A=S�F;D�P?]8;N�E\J�B;JKB;F�?�LMBW�DdLMe�DB;?]:MD�EcA=?]FG<�Dd8;jKB>D�Ek��A=N+F�?7B�FQ69F;?)e=8;DKW�?]B;B;?]BX^

0=^/0=^/k��i�=�\�G�d�;�d�\��~d���c���+�C�$�a��� �m�����X���2�m�X�]�$~v�3���X�=� >�;~m�i���i��".�aD8�L�6�O4LM?�F�b=DK:=B&WX6�AW�DdLMe=O+?�Lo?�AKF�O+?�B�B.E�D8;L&6�O0Lo?�F;b=DK:=B4F;b�69F26�8;?�[=B�?�:yN+AxF�b=?�D�P?�8i6�O+OlB�JhB�F;?�Lt:=?�Pd?�O+De=Lo?�AKFe=8�DhW]?�B;Bm^>�>b=?�J&W�Dd[=O+:�R�?2[=B�?�:IA=DF>N+A=B�F;?X69:xD�EQgKRa[=F.N+Ax6�:=:aN$F�N+DAMF�D�gaN$A©E\D8�L�6�OaLM?�F�b=DK:=BXg6�B)<>6�B2:aDA=?�RKJ 3 8Q69fKN$B�N$A­F;b=?�27%4� ³ ?�f=6�LMeaO$?d^ ³ D&EG6�8>E�D8;L&6�O�LM?�F�b=DK:=B)b�6mP?�B;b=D�<>AF;ba?�N+82B;F�8;?�A=SdF;brN$AYF�b=?�N+82[=B�?MN+AIB;e�?�W�N���WX69F;N+DA|6�A=:YPd?�8;N���WX69F;N+DA�^��GF2N+B2<`D8;F�bY?�fKe=O+D8�N$AaSb=D�<VF�b=?�J&WX69A�R�?)[=B;?]:xN+A�8�?��K[=N+8;?�Lo?�AKF;B.69A�6�O+JKB;N+BXgK8�?i��A=?]LM?�AKFXg=69A=:&F;?�B�F;N+A=S�^

H�BR� �� �R WYR � L [�N�� N=P � [ � [ A=?�W�?]B;BQ698;N+O+JT:=?m6�O+Bw<>N+F�bTW�[=B�F;DdLM?�8�B�<>b=DyD9E\F;?]ATb�6mPd? 69AN+LMe=8�?�W�N+B;?>N+:=?X6�D�Ek<>b�6�F`F;ba?�J�<H69AKF�1dE\Dd8;L�69OKLM?�F�b=DK:=B�Wm6�AMba?�O+eMW�[=B�F;DdLM?�8�B>A�6�N+O�:=D�<>AF;b=?]N$8>B�JKB;F;?]L 8�?��K[=N+8;?�Lo?�AKF;B.LoD8�?.e=8�?�W�N+B;?�O+JK^

H�BR����QR WYR �nL�N+B>F;ba?78�?�P?]8;B;?�D�EcP?�8�N���WX6�F�N+DA 1dN+F>N$B`F;ba?2e=8;DKW�?]B;B.D9E�Fi6�jKN+A=SwDdA=?)O+?�P?�O0D9EB;e�?�W�N���WX69F;N+DA � D8`N+LMe=O+?�L�?�AKFi6�F;N+DdA��06�A=:�F�b=8;Dd[=Sb&6)B;?]8;N+?�B`D�E �;W]D8;8�?�W�F�A=?�B;B¢��ea8;?�B�?X8�PhN+A=S

Page 15: Formal Methods: State of the Art and Future Directions Edmund M

� � ��c��a�7����� � ��� �\� �\� � � �������� ���9��� �"� � � +� ���� +������� � �� � � �

F;8i6�A=B¢E\D8�L�6�F�N+DA=B �cB;JKAKF;b=?]B;N+¯�N+A=S76´O+D�<�?�8¢��O+?�Pd?�OB�e�?]W�N���WX6�F�N+DA � D8lN+Loe=O+?�L�?�AKFQ69F;N+DA��]^=s4O��F;b=Dd[=Sb�L�[aWQb�F�b=?�Dd8;?�F�N$Wm6�Ol<`D8�j�DAo8;?i��Aa?�LM?�AKF`b�6�B`R�?�?�A&:=DAa?g=F�b=?.8�?�B;[=O+F�B.b�6mPd?>A=DFF;8i6�A=B¢E\?�8;8�?�:xF�D�e=8Q69W�F;N+W�?2Jd?�FX^

H��>R4[ L�� ��!wN+B�69A�698;?X6)F�b�6�F`N+BcDAa?.D�E0F;ba?.LMDdB;FcW]DB;F�O+JwN+AM6�O+O=B�D�E\FG<>6�8�?.e=8�DXui?�W]F;BX^`�=Dd8;L&6�OLM?�F�b=DK:=B)WX6�Are=O�6mJy6&8�DO+?MN+AYF;ba?MP6�O+N+:�69F;N+DAxea8;DKW�?�B�BXgc?d^ S�^+gl[=B�N+A=S&E\Dd8;L�69OkB;e�?�W�N���WX6 �F;N+DAaB�F�DwSd?�A=?�8i6�F;?�F;?�B�F.B;[aN$F�?�B-�/A>N+Wib�6�8�:=B;DdAM?�F.69OG^M� �"!"�+#;gh69A=:M[=B�N+A=SwLoDK:=?�O06�A=:&e=8�DhD9EWib=?�WijKN$AaS�F;DKDO+B.F�D�:=?�F�?�8;LoN$Aa?)E\D8�L�69O�8�?�O�6�F;N+DdA=B;b=N+e=B>R�?�FG<`?�?�AIB;e�?�W�N���WX69F;N+DAaB 69A=:&F;?�B�FB;[=N+F�?�B.6�A=:&R�?�FG<`?�?�AxF�?�B;F4B;[=N+F;?]B76�Aa:�W]Dh:a?^

� = � 24367X±$B$LlQ X69äBH9$3M,�G�± �:9IXY@ X:SHa2,/C¹BH9$_ �0GDCC :=[aWX6�F�N$DdAxN+B>PKN$Fi6�O�F;D�F;ba?wB�[=W�W�?�B�B2D�EcF�b=?)E\Dd8;L�69O0LM?�F�b=DK:=BX^`�>b=?]8;?�6�8;?�:=N�«3?�8�?�AKF.jKN+A=:=BD�Ec6�[=:aN$?]A=W�?�B �

H�� �� �R4[ R N������YX>R R��"[d^ ³ DLo?�D9ElD[=8`S8�?X6�F�?�B;F>B�j?�e=F�N+W�BH698;?4D[=8`D�<>A�W�DO+O+?X69S[=?�Bm^k£Y?WX6�A­D�P?�8�W�DLo?2F;b=N+B4B;j?]e=F;N+W�N+B;LtRKJ�W]DO+O�6�R�D8Q69F;N+A=S�<>N+F;bxF�b=?�L 69A=:xF�b=?�N+8)B;F;[a:=?�AKF;B2DdAB;JKB;F�?�LMB>F�b�6�F>F�b=?�JoWX6�8�?w6�R�D[=Fm^

H � �N�� L���L���J�� R �"[^ ��?]WQbaA=DO+DSdJTF�8Q6�AaBGE\?�8oB;b=Dd[=O+:VR�?xFQ69j?�A|P?]8;J|B;?�8�N+D[=B�O$JrE\8�DL F;b=?P?�8�JwR�?�SdN$AaA=N+A=S�^0�>ba?>8;?�W�?]AhF>B�e=8;?m6�:�D�E�E\Dd8;L�69OKLM?�F�b=DK:=BkN$Bk:=N+8�?�W�F;O+J�8;?�O�69F;?�:oF;D)?i«0D8;F�BL�69:=?>RKJM8;?]B;?X698;Wib=?�8�B2N+AMF;?m6�Wib=N+A=S�F;ba?�N+8>F;?�Wib=A=N+�K[=?�B4F;D�N+A=:=[aB;F;8�Jh^�=Dd82?i«0?�W�F�N$Pd?&F;?�Wib=A=DdO+DSJIF;8i6�A=B¢E\?�8mgcb=D�<`?�P?]8Xgc<`?ML�[aB;F2jd?�?�eTN+AYLoN$Aa:yF�b�6�F�B;[=W]W�?�B;BE\D8�N+A=:=[=B�F;8�JY:=?�e�?�A=:=BoDA �oF;N+LM?]O$J­:=?�O+N+P?�8�JhgpW�DAKF;N+AK[=Dd[=B;O+Jd��?]A=b�6�AaW�?�:rE\[=A=W]F;N+DA�69O+N$FGJKg[=A=:=?]8;B;Fi6�A=:aN$AaS�W][=B;F�DLM?]8;BX®�A=?�?]:=BXgk8�?i��[aB;?MD9E�O+?�Sh69W�JIW�DK:=?g�W�DLoLMN+F;L�?�AKF`F;Dx�K[�69O+N$FGJKg?�O+N+LMN+A�6�F�N+D�AwD9E ?]8;8;Dd8;Bmg=W�DdB;FG�G?i«0?�W�F�N$Pd?w:a?�P?�O+Dde=LM?�AKFmg=6�A=:o8;?X69O��GF;N+Lo?.e�?�8GE\Dd8;L&6�A=W�?d^

H]`�L� nR � L�[��"N4L7N4P�P�P�R�� R P [d^ ³ DLo?kS8Q69:=[�69F;?ce=8�DSd8Q6�LoB0A=D�<YN+A=W�Dd8;e�D8Q69F;?pE\D8�L�69OXLo?�F;bK�DK:=B>N+A�F�b=?�N+8>W�[=8�8;N+W�[=O�6F�/.2698;O�6�Ao?�F769O�^�� �"��641={4fdE\D8�: � �"��* #;^ C :=[=WX69F;D8�B26�8;?)B�FQ6�8�F;N+A=SF;D�W�DdA=B;N+:=?]87F�?X6�Wib=N+A=S E\D8�L�69O0LM?�F�b=DK:=B.6�F4F;b=?2[aA=:=?�8�S8Q69:=[�69F;?�O$?]P?�OG^ ³ F�[=:=?�AKF�B7Aa?�?�:F;D&[=A=:a?�8;B�FQ6�Aa:YA=DF�uv[=B;F)b=D�< F;DxR=[aN$O+:xB�N+A=SO+?�B;FQ69A=:K�;6�O+DAa?�e=8;DdS8Q69LMB´E\8;DdLUB;W]8Q6�F�WiblgR=[=F.69O$B�DwbaD�<qF�DwW�DdA=B;F�8;[=W]F7O�698;S?)B�JhB�F;?�LoBXgae�?�8�b�6�eaB.[=B�N$AaSwD9«��GF;b=?v��B�b=?�O�E�W�DdLMe�DA=?�AKF�B6�A=:&b=D�< F�D�L�69N$AKFi6�N+AMO+?�SK6�W�JoW�DK:=?"10F�b=?�J&A=?�?�:IF;DojKA=D�<qAaDF�uv[=B;F4b=D�< F;DoW�DK:=?g�R=[=F6�O+B;D�b=D�<VF�D�:=D�b=N+Sb©��O+?�Pd?�O�B�JKB;F;?]L�:=?�B;N+SdAl^

� =�>l/2*\>��6Z�1>(+*��|-A2�;�¦.-���¥2`DLoLM?�8�W�N�6�O=ea8;?�B�B;[=8�?�F;D�e=8�Dh:a[=W�?2b=N+Sdb=?�8G�G�K[�6�O+N+FGJ�B;D9E\FG<>6�8;?)N+B.6�O+<>6mJKB>N$AaW�8;?X69B;N+A=S�^��aD8G�L�69O)LM?�F�b=DK:=Bxb�6mPd?T6�O+8;?X69:=JV:=?]LMDAaB;F;8i6�F�?�:¡B�[=W�W�?�B�BYN+A B;e�?�W�N�E\JKN+A=SVW�DdLMLM?]8;W�N�6�O269A=:BQ6 E\?�FGJd�GW�8;N+F;N+WX69OlB�D�E\FG<>6�8�?"106�A=:&N+A&P?�8�N�E�JhN+A=S�ea8;DF�DKW�DO�B;FQ69A=:�698;:=B26�Aa:�b�6�8;:a<H698;?2:=?]B;N+SA=Bm^�GA�F;ba?>E\[=F�[=8;?dgK<�?>?�fKe�?�W�F>F�b�6�FcF�b=?.8�DO+?>D�E0E�D8;L&6�OKLM?]F;b=DK:=BcN+A�F;b=?4?�AKF;N+8;?4B;JKB;F�?�L¶:=?]P?�O��DeaLM?�AKFce=8�DKW�?�B;B)<>N+O+O�N+A=W]8;?X69B;?ga?�B;e�?�W�N�6�O+O+J�69B>F;b=?)F�DhDdO+BH69A=:&LM?�F�b=DK:=B�B�[=W�W�?]B;BGE�[=OkN$AoDA=?:=DdL�6�N+AxWm6�8;8�JyD�Pd?�82F�DxDF�b=?�8;Bm^ 3 8�DSd8;?�B�BXgcbaD�<�?�Pd?�8Xg�<>N+O+OcB;F�8;DAaSO+Jy:a?�e�?]A=:TDdAYW�DAKF;N+AK�[=?�:&B�[=e=e�D8;F´E\D8`R�69B;N+W)8;?�B�?X6�8�WQbIDAoA=?�<CB;e�?�W�N���WX69F;N+DA­Oz69A=S[�6�S?]BH69A=:MA=?]< P?�8�N���WX6�F�N$DdAF;?]WQbaA=N+�h[a?�BX^�G:=?X69O$O+JKgKB;JKB;F�?�L�:=?�Pd?�O+De�?�8;B)<`D[=O+:x6�O+O0R�?2F;8i6�N+A=?�:­B;[ mMW�N+?�AKF�O$Jo<�?]O$O�F;b�69F.F�b=?�J&<�Dd[=O+:

A=DdF>?�P?�A&F�b=N+A=j�F;b�69F>F;b=?]J�6�8�?)[=B;N+A=SM6 E\D8�L�69O=LM?�F�b=DK:MDd8>F;DKDOG^��>b=?�JM<`D[aO$:o8;Dd[=F;N+A=?�O+J[=B�?2F;b=?�L�6�F�b=?�L&6�F;N+W�Bp[=A=:=?�8�O+JhN+A=S�F�b=?)A=DFi6�F�N$DdA&D�E 6�E�D8;L&6�O�B;e�?�W�N���WX69F;N+DA­Oz69A=S[�6�S?)6�BB;N+Loe=O+Jw62Lo?X6�AaB�D9ElW�DLoL�[=A=N+WX6�F�N+A=S.N+:=?X69B�F�D�DF�b=?�8;B>DdAMF�b=?�N+8�F�?X6�LªD8`D�El:aDhW][=LM?�AKF�N$AaSF;ba?�N+82D�<>Ay:a?�B;N+SAY:a?�W�N+B;N+DAaBX^&�>b=?�JI<`D[=O+:I8;D[aF;N+A=?�O+Jx[=B�?MF�DhDdO+B7O+N+j?�LMDK:=?]O 69A=:Ye=8�DhD9EWib=?�Wij?]8;B.<>N+F�b�6�B>L�[aWQb�?m6�B;?269B>F;b=?�Jo[=B;?)W�DdLMe=N+O+?�8�BX^��>b=?�8;?vE\D8�?g�69B�8�?�B;?X698;Wib=?�8�B2N+A�69A=:

Page 16: Formal Methods: State of the Art and Future Directions Edmund M

� � � ��������� �� ��;�`�����2������9�������

?�:=[aWX6�F�D8;BoD�E4E\D8�L�6�O`LM?]F;b=DK:=Bmgc<`?�B�b=D[aO$:|B�F;8;N+Pd?�F�DYL�69j?MDd[=8�A=DFi6�F;N+DdA=BM6�A=:|F�DhDdO+B6�W]W�?�B;B�N+R=O+?2F;D�A=DdAK�G?�fKe�?�8�F;Bm^�kD�<H698;:=B)F;baN$B�N$:a?X6�OGg�b=D�<�?]P?�8mgkN$F)L&6�j?]B7B�?�A=B�?�F�DxW�[=O+F�N$P69F;?M6oA=?�< WX6�8�?�?�8�e�69F;bIE\Dd8

B;e�?�W�N�69O$N+B�F;B.N+A&E�D8;L&6�O�LM?�F�b=DK:=BX^`�>b=?]J�W]D[=O+:xR�?2?�fKe�?�8;F�B7N+AxF�b=?2[=B�?2D�E`DA=?)LM?]F;b=DK:&D8F;DKDdO�gdD8pF;b=?�J�W]D[=O+:MR�?.jKA=D�<>O+?�:aS?X69R=O+?>N$A�L&6�AKJKgXD9«3?]8;N+A=S�F;b=?�N+8>6�:=PKN+W�?>DdAM<>b=N+Wib�F;D�[=B;?E\Dd8�6)SN+Pd?�A�69e=e=O+N+WX6�F�N+DAl^0£ZN$AaS7?]AhPKN+B;N+DdA=?�:�D�P?]8cF;?�AoJ?X698;B>6�SdD7F�b=?.N+:=?m6.D9Ec���©�i�m� �c�i�����~��c�����)� £VN+A=SB����!"6+#¢g�69A�6�O+DSdD[=B�F;Dw698;Wib=N+F;?]W�F;[=8�?26�A=:�O�6m<Y��8�LMBXg9<>b=DB�?>?�LMe=O+D�Jd?�?�Bk<�Dd[=O+:R�?Mb=N+8;?]:IE\D82F�b=?�N+82B�jhN+O+O+B)N$AIE�D8;L&6�O�LM?�F�b=DK:=BX^o�>b=N+B2PKN+B;N+DAIb�6�B�R�?�?]A 8�?X6�O+N+¯�?�:YRKJIF;b=?S8�D�<>F;boR�DdF;bMN+A�F�b=?)Ah[aL�R�?�8pD�E�N+AK�Gb=Dd[=B;?4F;?X69LMBcF�b�6�F`W�DAaB;[=O+F`DAMea8;DXui?]W�F;B><>N+F;baN$AoO�6�8;Sd?W�Dd8;e�D8Q69F;N+DAaB���?^ S�^+gKsc���4� 6�A=:&�GAKF;?]O �46�A=:&N+AMF�b=?2AK[=L�R�?�8`D�EcN+A=:=?�e�?�A=:=?]AhF4W�DLoe�6�AaN$?]B��?d^ S�^+g"2`DLoe=[=FQ69F;N+DA�6�O ,"DSdN$Wdg��GA=W^+g�c7?]B;F;8�?�O0�GA=B�F;N+F;[=F�?g=6�Aa:M{&A´s �kF�b�6�FpB;e�?�W�N�6�O+N+¯�?>N+A�F;b=?[=B�?.D�E0E�D8;L&6�OKLM?]F;b=DK:=B�69A=:�:=D2W]DAKF;8i6�W�F><`D8�j2E\Dd8cN+A=:=[=B�F;8�J�69A=:MSdD�P?�8�A=LM?�AKFc6�Sd?�A=W�N+?�Bm^³ DdLM?MW]DLMe�6�A=N+?�BmgkB;[=WibV6�B 3 8i6�fKN+BXg`[=B�?ME�D8;L&6�O`LM?�F�b=DK:=B�6�BM6­8;D[aF;N+A=?&e�6�8�F�D�E)F;b=?�N+8:=?�Pd?�O+De=Lo?�AKF�ea8;DKW�?�B�BX^��N$A�6�O+O+JhgdE\Dd84E\[=8;F�b=?�828�?X6�:aN$AaS�g0B�?�?�F;b=?�s4e=8;N+O7�����"* N$B�B;[=?�D9E ������� c~d�>� �h���m��g�<>b=N+WQb

W�DdAhFi6�N+A=Bw6­8;Dd[=A=:=Fi6�R=O+?�:=N+B�W�[=B;B�N+DATDdAIE\D8�L�69O�Lo?�F;baDh:aBXgc6�Aa:YF;b=?K([=A=?d�����"*&N+B;B�[=?MD9E������� ���©�i�m�\� �h��gk<>b=N+WibTSdN$Pd?�Bw69ATD�P?]8;PKN+?�<¶D�E.LoDK:=?�OcWib=?�WijKN+A=S�^Y{4AK�GO+N$Aa?�E\Dd8;[=LoB7N+AK�W�O+[=:=?�F;b=?2Aa?�F)A=?�<>B;Sd8;Dd[=elg������ �����������������������0g6�Aa:xN+F;B.B�[=R=A=?]<>S8;Dd[=e=B4E\Dd8>B;e�?�W�N���WLM?]F;b=DK:=B 1�6�Aa:YF;b=?oE\Dd8;L�69OkLM?�F�b=DK:=B2L�69N+O$N+A=SoO+N$B�FXg���������������! #" �$��% �&�� 0^��>b=?&{4fE�D8;:�.AaN$Pd?�8;B�N+FGJ3® B><`?�R&e�6�Sd?

' ���# ($)�)�*#*�* ������,+��- �$��.��$������ 0/,)#��1�� ' ��2���)����1��,��+#30�,��� ' �����4� ' ���,+e�DN+AKF;B`F;Dw6)<`?X69O$F�bMD9ElN$A©E\D8�L�6�F�N+DAw69R�Dd[=FkE\Dd8;L�69OKLM?�F�b=DK:=BXgdN+A=W�O+[=:=N+A=S2e�6�e�?�8;BmgK8;?�e�D8�F;BXgF;DKDdO$BmgKW�DA©E\?�8;?]A=W�?�BmguiD[a8;A�69O$BmgKe=8;Dmui?�W�F�BXg06�A=:oe�?]De=O+?^

5�6�76�5�6�8,9�6;:<�=�>?�@;A BC@ED�FHGI�JKGL�FH?�@M�BC@ENGOPD�Q�@R�B STDUB �iùMùMß)� ��e)n0pUv�yMn0rWk�dFhIv��:pMuWrWkYgMclfFr �:klyMnFrWpMm�pxwVcivj�Hclt${t)cit�d0h$d0nFclv�di�EVTW,W�WYX)¨0ªxº)°lªM·®¸`µ¹§iº)°�§-º2!V§`íN¸[Z�ªx¨0¯�W�ºIñ�µ¾º:¯F¯N¨NµRºIñ]\H\M�)Ë)�H���)�!^]��ú)�M�

<�_E_�F`GIaF`=�=HFH?�@�bcB4R�B�NGOed�>�F`f=ag�NGG�@ < B �lùMù$×$� �)pMfFv�yMu�gMclfFr �:klyUn0rWpMmÌpxw�y�¤6px��cif0¤���v�r {kif0pMo)fFp$klcldFdFpMfN���|mih?¨Û§N·F¯F¯0­xµRºIñx°§`í�¸`êI¯UVTW�W,WjVNº)¸�¯®¨Nº:ªx¸`µ¹§iº:ªx«�k�§iºlíl¯®¨0¯Nº:·F¯�§iºlk�§i©/ì)òI¸�¯®¨jðj¯®°Nµ ñ�ºm V`k4k4ðon pHq!r\÷}��e)d0nFrWm4�Mõ�s��#t�kinl�H�lùMùI×Mø®�Mo)o4�]á�ù�^��M±)�

<�?EufJKGQ�vHv@�w BFHx N=�B �iùMùMú)� è6cif0r �:kiyMn0rWpUmAp�w:n0s)c�d0s$e)nFt)p-��m\d0h$d0nFclvKdFpxw}n|��yMfFc�yMn6nFs)c��/yMfFuWrWm)qMnFpMm��e)kluWclyUf�û/cim)clfFyMnFrWm)q��$h$d0nFclv�� ��myV®º)¸`« z{kæ§iºlí&z�§iº|kæ§iº)¸`¨Û§-«üª�º:­}VNº)°N¸`¨Nò$©�¯®º)¸¹ª�¸}µ�§iºKµ¾º�~/ò)·N«W¯Fªx¨V®º)°N¸�ªx«¾«Wªx¸`µ¹§iº)°\÷¹û/uWyUd0qMpx�/�I�$kipMn0uWyUm)t4�-��yxh��lùUùMúIø®�

<�?GQ�=�O�@�< B�@4��FHL�NH��@4bcBC@�NGOeA�NO�Q�>��@���B S�R�B��lùMùMßD� õ�s)c�clv��:cit)t)clt�dFpxw`n���yUf0c�pxw�yMm�ciuWclk®{nFf0rWkirWn�h�v�clnFclfi�6�Tm�cl~$o:cif0rWcim)klc�rWm�e)d0rWm)q\�)pMf0v�yUu:��clnFs)pIt)d�rWm�yMm�rWm)t)e)d0nFfFrWyMuIo)fFpx�0ciklni��!:·Nµ`¯Nº:·F¯�§`ík�§i©AìDòI¸�¯N¨�h�¨Û§|ñx¨0ª�©j©�µ¾ºIñD�

�4N??�F`xx�@Uw B �lù��Mù)� �)pMfFv�yMu/v�clnFs)p$t)d�yMo)o)uWrWcltOn0p�y��:pMyMnFrWm)qx{�o:pMr mIn�m$e)vj�Hclf�dFhIdFn0civ���VTW,W�WX)¨Fªxº)°!zæ§iº2!V§¹íN¸[z�W?ºIñ�z��Hqx�:×�÷}��yxh)øN�Mß)�U�!^IßI�$�U�

�4N??�F`xx�@;w�B �lùMù$×$� ��p$t)clu)kNs)cikN�IrWm)q�rWm�o)fFyMklnFrWklcU�)õ�s)cAnFùMúMúUúTg$rWf0nFe)yMu$kNs)yMm)m)cluMo)fFp$klcldFdFpMfl�$VTW,W�WX)¨Fªxº)°!zæ§iº2!V§¹íN¸[z�W?ºIñ�z�\E�x�:��÷}�)ci�4� øN�MßUù�^]á��)�

��F`N?�@;��B �lùMù)�U� �Tm�pxgMclfFgIrWci��pxw ��¤6{0�$ï�����mUh?¨Û§N·&zæ§`íj³Hðk yn pH���T¦6§i¨N©�ªx«Ið�¯NÖx¯N«¾§Fì)©�¯Nº)¸= ¯®¸`ê]§N­x°U�è6pUuWe)v�cA×M×$�/pxw,�4¯F·N¸`òI¨F¯U~j§-¸¹¯®°�µ¾º�kæ§i©/ì)ò$¸¹¯®¨c!:·Nµ`¯Nº:·F¯�÷F�lùMùD�-øN�I�$o)fFrWm)qMcif�{�è6cif0uWyMq$�

��F`GL�x�!�!Q�G�@���B�@�w�?JKvHvHJKQ�FHG�@��lBC@d�?JK�!xQ�vHv�FH?�$F`G�@dcB�@��N?�$F`G�@�dcBC@;��N?�!�!Q�G�@��4BC@;R4F`xx�F`?�!�!Q�G�@R�BC@HNGOP��J[@E�jB �lùUùMß)� è6cif0r �:kiyMnFrWpMm/pxwVyMm�yMe)t)rWp�o)f0pMnFp$klpMux��rWnFsj�)e)d6kipMuWuWrWdFrWpMm�e)dFrWm)qTöTo)o)��yMu`���mPA B�<�=�>?]NGO�M�B�D�F`GI�JKGL�FH? ��t)di�W��kæ§i©/ì)ò$¸¹¯®¨NÊ}é�µ}­U¯0­K³)¯N¨Nµ ¶�·0ª�¸}µ�§iº�n pE�D�:ï4clkin0e)fFc��TpUn0cidTrWm��pMv�o)e)nFclf��$klrWclm)kic��M�iúI�$�Mo)o4�]��±M±�^]�M×�ß)���$o)fFrWm)qMcif�{�è6cif0uWyxq)�

������?G�F`?�@H� BEFHx�N=EB �lùMùMßD� �$õ4ci¤T�l�/cit)e)klnFrWgMcN{�yxuWqMpMf�rWnFs$v�rWk)gMclfFr �:klyMnFrWpMm�pxw)fFclyMkin0rWgMcHyMm)t/f0ciyMu {�n0rWv�cdFhIdFnFclv�di����m�h?¨Û§®·!z�§`í�¸`êI¯P�M¸`ê�V®º)¸�¯N¨Nº:ªx¸`µ¹§-º:ªx«Uk�§iºlíl¯®¨0¯Nº:·F¯�§iºlk�§i©/ì)òI¸�¯®¨NÊ}é�µ}­M¯F­�³)¯N¨Nµ ¶�·0ª�¸}µ�§iº6���e)vj�Hclf��U�lúI��rWmÌïVciklnFe)f0c �TpUn0cidArWm���pMv�o)e)nFclf/�$klrWclm)kic�÷/�xe)uWh8�lùMùMßIø®�:o)o4�:±D�-×�^I±)�!�)�]�$o)fFrWm)qMclf|{è6cif0uWyUq)�

Page 17: Formal Methods: State of the Art and Future Directions Edmund M

� � ��c��a�7����� � ��� �\� �\� � � �������� ���9��� �"� � � +� ���� +������� � �� � � �

�4Q��!�!uf�FH?�@�b B�@�R�Q�=�N � @��!BC@�NGO���NNGO�?N�L#F`?�@U��B �lùMùU±)� è6cif0r �:kiyMnFrWpMmp�wjyMm�yUe)t)rWpx{�klpMm$n0fFpMuo)fFpMnFpIkipMu`���|myD B���NGL#g�NN�u � @c�jB STR�B�O�F�A4Q#F���F`?�@�NGO|��B����xQ#_`JK=���t)di�W�A¦�X��XV¦ X p��¦6§i¨N©�ªx«�X:¯F·NêMº)µ+#Nò)¯N°�µRº��T¯Fªx« Ê�¸`µ¾©�¯�ªxº:­�¦4ªxò$« ¸`Ê�¸0§i«W¯N¨Fªxº)¸c!)óx°N¸�¯N©�°M�:ï4clkin0e)fFc��TpUn0cidArWm���pMv�o)e)nFclf�$kirWclm)klc��UßMË)�Io)o4�)�xáxú�^:�lù$�$���$o)fFrWm)qMcif�{�è6cif0uWyMqD�

�4Q��� UF`=�=�@�<UB �lùMùI×]� �$oHclklr �:kiyMnFrWp-m/yMm)t�gxyMuWrWt)yMnFrWpMm/pxw:y�dFclkie)f0rWn�h/oHpMuWrWklh/v�p$t)clu`��VTW,W�WjX)¨0ª�º)°!zY§-º!V§`í®¸[Zæªx¨F¯�W?ºIñxµRº:¯0¯®¨Nµ¾ºIñ]\E���D�¬÷`�)cl�4� ø®�MßMË�^Iß��D�

�4Q��F`?�@�A BNGOP��>�@�cB �lùMùMßD�"�Te)nFpMv�yMnFclt�o)fFpIp�w}d6pxw6pM�$�FclklnYklp$t)c�w}pMf�yj��rWt)ciuWhje)dFclt�v�rWklfFpMo)fFpx{kicldFd0pMfi���:§iòI¨Nº:ª�«Y§¹í�¸`êI¯/é kh ���M�4��÷ �xyUmIe)yMfFh)øN�$�lßMß�^H�lùI�$�

�4Q��F`?�@A B;��BENGO��}Q�Q�?�F0@��B��B �lùIá�ù)� é k�§i©AìDòI¸�ªx¸`µ¹§-º:ªx«E�6§�ñ�µ}·N�)��klyMt)civ�rWk6¤�fFcldFdi���Tcl� ��pMf0�H��4Q��F`?�@�A B;��B�NGO��}Q�Q�?�F@��B���B �lù��*�)� é kæ§-©Aì)ò$¸�ªx¸`µ¹§iº:ª�«0�6§|ñxµ`·��\ªxº:­��N§l§Në��V��klyMt)civ�rWk�¤�f0cid0di�

��cl� ��pMfF�:��4?N`�xQ�G�@�A B�FHx{N=�B �lùMùUß)�"è �0�H�M�KdFhIdFnFclv²w}pUf�gMcif0r �:kiyMnFrWpMm/yMm)t�d0h$m$n0s)cid0rWdi����mPh�¨Û§®·!zT§`í/¸`êI¯��U¸}ê

V®º)¸�¯N¨Nº:ªx¸`µ¹§-º:ªx«,k�§iºlíl¯®¨0¯Nº:·F¯�§iº�k�§i©AìDòI¸�¯N¨NÊ`é�µ}­M¯F­³)¯®¨Nµ ¶�·Fªx¸`µ¹§iºY���Te)v��:cifT�M�iúI��rWm�ï4clkin0e)fFc��TpMnFcldrWm���pMv�o)e)n0cif��$klrWcim)klc\÷ �xe)uWh��iùMùMßIø®�-o)o4�$±I�xË�^$±I�Má$�M�$o)f0rWm)qUclf|{¹èYclfFuWyMq$�

�4?�Q�u � @���B�@�d�NE>vEg�NGG�@���B�@�NGO�� Q�Q�?�F0@,��B���B �lùMùMßD� �Tciy-g$h�rWm$w}cif0cim)klcM�/õ�s)clpUf0civ�dTyM�HpMe)nkipMv�v�clfFklrWyxu6v�rWkif0pMo)fFp$klcNdFd0pMfFdN���|m���B���?J���N�}NGOe< B���N�g�JK=�=HF`?J���t)di�W�æ¦6§i¨N©�ªx«l 8¯N¸`ê]§®­x°�µRºk�§i©AìDòI¸�¯N¨NÊ`é�µ}­M¯F­jð�¯N°NµWñxº m ¦= �kVé�ðPn pE�Tr\÷ ��pxgMclv��:cif��iùMùMßIø®�-o)o4�)÷`nFpAyUo)o:clyUfÛø®�-�$o)fFrWm)qMclf|{�è6clfFuWyMq)�

�4?�Q� �G�F0@���B���BC@���=�N? � F0@���B ��BC@Hb�JK=�=E@Hb B���BC@HNGO!�}JK�!f?N�@��B �lù*�Mß)� �Te)nFpMv�yMnFrWk4gMclfFr �:klyMnFrWpMmpxw/d0cizIe)cimInFrWyMu6kirWf0kie)rWn0d/e)dFrWm)q�nFclv�o:pUf0yMuYuWpMqMrWkM��VTW,W�W X)¨0ªxº)°lªU·N¸`µ¹§iº)°§iº|k�§i©AìDòI¸�¯N¨N°�k6Ê"�Eq����-�$��lúUËI×�^:�lúU±M±$�

�4?`�HNGx�@�A B���B �iù��Mß)� û/fFyMo)s${��)yMdFclt�yUuWqMpMfFrWn0s)v�d/w`pMf��:p$pMuWclyMmÌw}e)m)kin0rWpUmv�yMm)rWo)e)uWyUn0rWpxm4�#VTW,W�WX)¨Fªxº)°!zæ§iº�k�§i©/ì)òI¸�¯®¨N°}k6Ê"�Eq����)�

�4>?�uf�@���B4A BC@#� =�N? � F0@���B$��BC@4��Q�GL�@�b B���B�@$�}u��}JK=�=�NG�@�dcB4��BC@4NGOeb�JK=�=�@4bcB���B �lùMùM±)��$h$vj�HpMuWrWk�v�pIt)ciu�kNs)cikN�IrWm)q�w}pUfjdFclz$e)clm$n0rWyUu�kirWf0kie)rWn�gMclfFr �:klyUn0rWpMmH�#VTW,W�W XD¨0ªxº)°!z�§iº|k�§i©AìDòI¸�¯N¨NÊé�µ`­M¯0­�ð�¯N°NµWñxºä§¹í�V®º)¸�¯}ñ�¨0ªx¸�¯0­]kYµ¾¨0·®òIµR¸}°�ªxº:­4!)óx°N¸�¯N©�°��%�M�)±�÷`�To)fFrWu¾øN�$±Mú)�!^$±I�x±)�

��N=HF`?EQ�@4��B�@�A4Q�g�NG�@���BC@�NGO R#N=Hg�N�@4w B�bcB �lùMùIá$� ��o)fFyMkin0rWkiyMu6t)cldFrWqMm�kiyMdFc�e)dFrWm)q�w}pUf0v�yMugMcif0r �:kiyMnFrWpMm:����mPh�¨Û§®·!zA§`í/ð�¯N°NµWñxº)Ê�!)òxìI¯®¨Hkæ§iºn p�&Ì÷F�lùMùIáUøN�Mõ4p�yMo)oHclyMfi�

��N?GQ�x�@���BC@Hb�N���JK='��N�@(��BC@HbUFHf�)�Q�G�F`J[@E��B�@�NGO*��F`J���N�@H�4B �lùMùI�$� ��f0fFpMf|{`w}fFclc4d0p�w}n���yMfFc6t)clgMciuWpMo${v�cimIn$w`pMf:kif0rWnFrWklyMuid0h$dFn0civ�d:e)dFrWm)q�nFs)c6��{�v�clnFs)pIt)pUuWpMqMhx�/��m}XYêMµ¾¨F­�V®º)¸�¯N¨Nº:ªx¸`µ�§iº:ªx«HV�W�W,W�!)ó-©/ì]§-°Nµ¾ò$©§iº�!V§`íN¸[Z�ªx¨0¯+�T¯®« µ`ª��NµR« µR¸}ócW�ºIñ�µ¾º:¯F¯N¨NµRºIñ8÷0�iùMùI�Mø®�

��fNGO��@�d B�NGO�� JK�!?N�@#��B �lù*���)� h�ªx¨0ªx«R« ¯®«#h�¨N§�ñx¨Fªx© ð�¯®°Nµ ñxº)�$�Tt)t)rWdFpMm${�b�cldFuWclhU���fN ��F`��@,��B �lùUùI�$� �)pUf0v�yMuHv�clnFs)pIt)d�yUnT�6õ$,/õ/�6�TmÌrWm)t)e)d0nFf0rWyUu)e)d0yMqUcAfFcloHpMfFnl�$��m}h�¨Û§®·!z�¦6§i¨N©�ª�«ð�¯N°l·®¨Nµ ì)¸`µ�§iº�X:¯F·NêMº)µ+#Nò)¯N°�VI³.-o�`pHpH�8÷ �TpMfFn0s${/��pMuWuWyMm)t4�$�lùMùI�Mø®�Mo)o4���MË�^$ùMú)�

��f�F`fNJ�)�N?�@�w BC@ w�N?N ��F`=�@UD B�@+�}Q�>GJ�F`?�@���B�@�M�N �)�J[@��UBC@�NGO0/�>=�JKNG�@��4B �lùMùMß)� �$oHclkir {�:kiyMn0rWpUm�yMm)t�gMcif0r �:kiyMn0rWpUm�pxwænFs)c�o:px��cif0dFklyUuWcA�)e)d/yMfF�)rWnFf0yMnFrWpMm�o)fFpMnFpIkipMu`����mrWm)t)e)dFn0fFrWyMuHcl~$o:clfFr {v�cimIn)��rWnFs�ï�t�õ4tA�H����mUh?¨Û§®·0¯F¯0­�µ¾ºIñx°j§`í�¦$12� X#W43Hh0!�X/³4n pE�¬÷ /yMrWdFclfFd0uWyUe)n0cif0m/÷�û/clfFv�yMm$h]ø®�N�lùMùUßIøN���s)yMo)v�yUm5, ��yMuWu`�

��fJK�!Q�=Hg�@ w�B�@�d�=H��NJKuf�@���B�@,�g�JKxf�@���B�@�NGO���Q#��uJ � @�< B �lù��$á$���Tm8yMo)o)f0pUyMkNs�nFp�nFs)cjgUclfFr �){kiyMn0rWpUm�p�wTy�w`yMe)uWn|{¹nFpMuWcif�yMm$nN�)klpMv�o)e)nFclf|{��)y-dFclt�f0ciyMklnFpMf�d0yxw`cln�h�d0h$dFn0civ��A� klyMdFcjdFnFe)t)h�e)dFrWm)q�yMe${nFpMv�yMnFclt�fFclyMdFpMm)rWm)q�÷}gUpMuWe)v�c��M�:rWm$n0cif0rWv f0cio:pMfFnÛø®�Mõ4clkNs)m)rWkiyMu4åTcloHpMfFn��T¤Y{¹±UùI�x±�÷/�xyMm4� ø®� ��uWclkin0fFrWk¤6px��clf�å�cldFclyMfFkNs ��m)dFn0rWnFe)n0cU�-¤YyMuWpj��uWn0pD�]�����)¤�f0cio)yMfFclt��$h��TfFqMpMm)m)c ��yMnFrWpMm)yMu)ï4yM�:pUf0yMnFpMfFhM�

��=�N? � F@(��BC@�w�FH?�g�NG�@���B�@NGO�/�fNEQ�@76 B �iùMùMß)�"è6cif0r w`hIrWm)q\n0s)c/�$å6õ�t)rWg$rWd0rWpUmjyMuWqUpMf0rWnFs)v²e)d0rWm)qnFs)clpMfFclv o)f0pxg$rWm)q�n0cikNs)m)rWzIe)cidl�$��m�h�¨Û§®·!zj§`í¬¸}ê$¯ �U¸}êPVNº)¸�¯N¨Nº:ª�¸}µ�§iº:ªx«�k�§iºlíl¯®¨0¯Nº:·F¯§iºek�§i©AìDòI¸�¯N¨NÊé�µ`­M¯0­K³)¯®¨Nµ ¶�·Fªx¸`µ¹§iº6� ��e)vj�Hclf\�M�lúI��rWm�ï4ciklnFe)f0c���pMnFcld/rWm��pMv�o)e)nFclfT�$kirWclm)klc¬÷ �xe)uWhÌ�lùMùMß$øN�)o)o4��M�U�!^:�-�M�]���$o)fFrWm)qMclf|{�è6clfFuWyxq)�

��=�N? � F@���BENGOPd�>?�!fNG�@�AUB ÷0�iùMùMßIø®� ��pMv�o)e)nFclf|{��TrWt)clt/è6cif0r �:kiyMnFrWpMm4�$V�W�W,Wo!Mì$¯0·®¸`¨NòI©8���M�Mß)�ß)�&^IßIá$�

��=�N? � F@���BENGO�/�fNEQ�@(6 B �lùMùUË)� �Tm)yUuWhInFrWkly)�H��nFs)clpMfFclvKo)fFp-gUclfHw}pMf4��yMnFs)clv�yMnFrWklyD�;XYêI¯� 8ªx¸`êMʯ®©�ªx¸`µ`·0ª9�:§iòI¨Nº:ª�«}�:×xßa^]á$�M�

��=�N? � F@!��B+��B�NGO:�4g�FH?�!Q�G�@���B�< B �lù��D�M� �$h$mInFs)cldFrWd�pxw�d0h$m)kNs)fFpMm)rW�lyxnFrWpMmdF�MciuWclnFpMm)d�w}pMf�)fFyMm)kNs)rWm)q/n0rWv�c\n0civ�o:pMfFyMu)uWpMqMrWkU����m}�6§|ñxµ}·�§`í�h?¨Û§|ñx¨0ªx©�°!��;§-¨0ëx°Nê]§Fì$Õ*<:§i¨0ë�¸0§�Z�º��\¯NµWñxêM¸`°0Õ4~9<:Õ 8ªxó �Hpa�E�H�:è6pMuWe)v�c\�lË)�/pxw,�4¯0·®¸}ò$¨0¯ ~j§i¸�¯N°\µ¾º�k�§i©AìDòI¸�¯N¨p!:·Nµ}¯®º:·0¯�÷F�lù��D�-øN�M�$o)fFrWm)qMclf|{�è6clfFuWyMq$�

��=�N? � F@���B���B�@=�4g�FH?�!Q�G�@���B< B�@�NGO���JK�!x=�N�@;< BR�B �lù��Uß)� ��e)n0pUv�yMn0rWk�gMcif0r �:kiyMn0rWpUmAp�w)�:m)rWn0c®{dFn0yUn0c�klpMm)kie)f0fFclm$n:dFh$d0nFclv�d4e)dFrWm)qTnFclv�o:pUf0yMuxuWpMqUrWk�d0oHclklr �:kiyMnFrWpMmIdi�lé kh X$1�h,�4ék!]�M�I�$�I��±M±�^]�xßUË)�

Page 18: Formal Methods: State of the Art and Future Directions Edmund M

� � � ��������� �� ��;�`�����2������9�������

��=�N? � F@��B(��BC@#w�?�>�g4);F`?EL�@���B�@�D�JK?NJK�!fJ[@�D B�@���fN�@���B�@���Q�GL�@�bcB(��BC@ � u��}JK=�=�NG�@�dcB�� B�@�NGO��F`�!��@,��B�<UB �lùMùMËD� è6cif0r �:kiyMnFrWpMm�pxwTn0s)c��)e)nFe)fFcl�)e)d �<kiyMkNs)cjkipMs)clfFclm)kic�o)fFpMn0p$klpUu`� �|mih?¨Û§N·&zk�Tð���÷F�lùMùUËIøN�

��=�N? � F@��B(��BC@#w�?�>�g4);F`?EL�@�� B�@�NGO���Q�GL�@#bcB ��B �lùMùI�$����pIt)ciu:kNs)clkN�$rWm)q�yMm)t�yM�)dFn0fFyMklnFrWpMm4���mPh�¨N§N·!zA§¹í4h�¨NµRº:·Nµ ì)« ¯®°¬§¹í�h?¨Û§�ñaz,�4ªxºIñ�z�÷F�lùMùI�Mø®�

��=HF`N ��FH=�NGO�@A B�@=�}NO#F`=�NJKG�F@=��B�@�NGO ��J�g���@���B �lùMùI×$� û/clm)cif0yMnFrWm)qYw}fFpMmInYclm)t)dHw}pMfYgMclfFr �:klyMnFrWpMmnFpIpUuWdl� ��m���B��4?JKG � �$g�N�@�A B � =HFHN ��F`=�NGO�@�d B���N?�$FHG�@�NGOe��B4��x�F`vHvEF`G���t)di�W�UXV§i§i« °�ªxº:­é�« ñI§i¨NµR¸`êM©j°Tíx§i¨�¸}ê$¯}kæ§-º)°N¸}¨Nò)·N¸`µ�§iºäª�º:­�é�º:ªx« ó-°NµR°¬§¹í`!)ó-°N¸�¯®©j° m XIé kVé !ln pHq&rM�:è6pUuWe)v�c��lú)�lù�p�w�4¯F·N¸`ò$¨0¯�~�§i¸�¯N°�µRº�kæ§i©/ì)ò$¸¹¯®¨k!:·Nµ}¯®º:·0¯ü÷}��yMf0s$e)di�M�Acim)v�yMfF�:�l��yxh��lùMùI×Mø®�xo)o4�)�-×xË�^:�xáxË)�-�$o)fFrWm)qMclf|{è6cif0uWyUq)�

��=HF`N ��FH=�NGO�@�A B�@�R�N??EQ� c@���B�@�NGOy��x�F`vHvEF`G�@,��B �iùMùMË)� õ�s)c���pUm)kle)fFf0cim)klh�bOpMfF�I�Hclm)kNs4�T�dFclv�yMm$nFrWkld|{¹�$yMdFclt�nFpIpUulw`pMf4n0s)cYgMclfFr �:klyMnFrWpMm�pxw)klpUm)kle)fFf0cimIn)dFhIdFnFclv�di�Ûé kh X$1,h��4ék!��`qx�I��÷ ��yMm4� øN�ËMßa^]áM�$�

��Q�G�!xHN�)�=aF0@�A B�F`x}N=�B,�lù��MßD� V®©Aì)«W¯N©�¯Nº)¸`µRºIñ7 8ªx¸`êI¯®©�ª�¸}µ`·N° Z�µR¸`ê�¸`êI¯�~üòah4�4� h?¨Û§l§¹íjð�¯NÖx¯N«¾§Fì)Ê©�¯Nº)¸,W?º)ÖlµR¨Û§iº)©�¯Nº)¸`�:¤�f0cimInFrWklc®{ ��yMuWu`�

��Q�?G�FH��@5� B�@���Q�>?NGx�@���BC@���JK=�=�J��Nx?�F0@4��B S � B�@4D�>�F`x�@ w�B�@+�}NGQ�>?H��@ R�B�@4R�N�>=�JKG�S'�}Q�f?JKGL�@� B�@��}>GQ�I�@ � B�@+�}>?Hxf��@���B�@�R#N?�F`Gx�@�� B�@���N�� ��)EJ[@�< B�@�NGOe�eFH?G�F`?�@4��B �lùMùI×]� õ�s)ckipIz�o)fFp$pxwTyMdFd0rWdFn0yUmIn�fFcNw`clfFclm)kicjv�yMm$e)yMu6gUclfFd0rWpMm�×$�W�lúD�Võ4clkNs)m)rWkiyMu�åTcloHpMfFn��-áMáÌ÷/�xe)uWh]ø®� �/��å ���\��� ��� ��� ��)�� "�����)�+ - "�'��$" )�-��*���+�%�����#���# �, � +�%�������'�0�- �� ��U�

��?NJKL�FHG�@�bcBC@�w�F`?fN?Hx�@���BC@4NGO A�N=��!xQ�G�@4M�B �lùMùMËMyD� ��m�rWmInFclfFm)yMnFrWpMm)yxu6d0e)fFgMcih�p�wArWm)t)e)d|{nFf0rWyUu�yMo)o)uWrWklyMnFrWpMm$d�pxw�w}pMfFv�yMu�v�clnFs)p$t)dl�:õ4cikNs)m)rWklyMu�å�clo:pUf0n�� �0�$õ û���å ùMËIçxß$�xß�÷`gMpMuWdi����yMm)t�Mø\÷`��yMf0kNs:ø®�4ö�� �H� �TyMnFrWpMm)yMu ��m)dFn0rWnFe)nFc�pxwA�$nFyMm)t)yMfFt)d�yMm)t�õ4clkNs)m)pMuWpUqMhM�)�TuWdFp�o)e)�)uWrWd0s)cit��Ih�nFs)cö\� �H� ��yxg-yUu:åTcid0ciyMfFkNs�ïVyU�:pMfFyMnFpMf0h¬÷}�)pMfFv�yMuHåTclo4�)×M×x±Mß�{¹ùUËx{�ùI×��M�$�M�$o:clni�:�iùMùMËIø®�MyMm)t�nFs)c���nFpMv�rWk��m)clfFqMh���pMmInFfFpMu)��pMyMfFt�pxwæ��yMm)yUt)y)�

��?NJKL�FHG�@�bcB�@�w�FH?fN?`x�@,��B�@�NGO�A�N=��!xQ�G�@�M�B �lùMùMËU�4� t��)d0cif0gxyMnFrWpMm)d�pMm�rWm)t)e)dFn0fFrWyMu)o)fFyMklnFrWklce)dFrWm)q/w}pUf0v�yMu)v�cin0s)p$t)di�&��mPh�¨N§N·!z4�`qx¸`ê�V®º)¸ z�kæ§iºlí&z?§iº�!V§`íN¸[Z�ªx¨0¯�W�ºIñaz6÷}��yxh��lùMùUËIøN�

��?NJKL�FHG�@�bcBC@�w�FH?fN?Hx�@���B�@�NGO�A�N=��!xQ�G�@,M�B �lùMùM±D� �)pUf0v�yMu4v�cin0s)p$t)dTrWm�kif0rWnFrWklyUu:dFhIdFn0civ�dl�VTW,W�W­!V§`íN¸[Z�ªx¨0¯c�H���V��÷/�xyMm4� ø®�

��?NJKL�FHG�@�bcBC@0w�FH?fN?Hx�@���B�@NGO�A�N=��!xQ�G�@�M�B �iùMùI×$�"�)pMfFv�yMu$v�clnFs)pIt)dYf0ciyMuWrWn�h�kNs)clkN�H����m)t)e)d|{nFf0rWyUu)e)d0yMqUcM�EVTW,W�WYX)¨0ªxº)°!zT§iº2!V§`í®¸[Zæªx¨F¯�W?ºIñxµRº:¯0¯®¨Nµ¾ºIñ \E�x�:��÷`�)cl�4� ø®�MùMú�^Iù��D�

��?NJKL�FHG�@�bcBC@,d�?�Q#g�Q�O�J�g�Q�FH=H��Q�@���BC@2��F`JK�$F`=���@4�!B�@���FHJK=��!Q�G�@�< B�@�R�N�$F@���B�@�NGOe��NN=!xJKG � @ ��B�lù*���)� v�{/��è ���H�:��nFpIpUu6w`pMf/gMclfFr w}h$rWm)q�d0p�w}n���yMfFcM����m�h?¨Û§N·F¯0¯F­xµRºIñx°ä§`í¬¸`êI¯P���i¸`ê V®º)¸�¯N¨Nº:ªx¸`µ�§iº:ªx«k�§iºlíl¯®¨0¯Nº:·F¯�§iº2!V§`í®¸[Zæªx¨F¯�W?ºIñxµRº:¯0¯®¨Nµ¾ºIñ8÷��$rWm)qMyMoHpMf0cU�l�To)fFrWu6�iù����Iø®�Mo)o4�IËI��±�^IËMËMËD�

��?�Q�v�Q�?O�@2��B�NGOy��>xxQ�G�@���B �lùUùI×$����f0ciyM�$rWm)qjnFs)f0pUe)qMs�n0s)c\è�yMm)t�èÇ�HpMn0nFuWclm)cikN�:���|m h?¨Û§iÊ·F¯0¯F­xµRºIñx°�§`íAé�­Mª�µ¾ºPW�ò$¨Û§Fì$¯c�HpHpHq8÷F�lùMùI×UøN�I�$o)fFrWm)qMclf|{�è6clfFuWyxq)�

b�N�g�g�@E�jB�NGO bUF`=�L�NO�Q0S�d�=�Q�Q���@ � B �lùMùUß)� h�¨0ªU·N¸`µ}·Fªx«I¦6§i¨N©�ªx«X 8¯N¸`ê]§®­x°Víx§i¨2��ªx¨F­�Zæª�¨0¯�ðj¯®°Nµ ñ�º)�ï4clkin0e)fFc ��pMnFcld�rWm���pUv�o)e)n0cifæ�$kirWclm)klcU���$o)fFrWm)qMcif�{�è6cif0uWyxq)�xõ4p�yMo)o:ciyMfl�

b�N�g�g�@��lBC@��EQ�� � Q�@4��B�@�NGOe��uf=��Q�?�@4A B �lùUùI×$� !Mì$¯0·®µ ¶�·Fªx¸`µ¹§iº�ªxº:­K³)ªx« µ}­Mªx¸`µ�§iºK©�¯®¸}ê)§N­x°�í-§-¨h?¨Û§�ñ�¨0ªx©�©jµRºIñ��4ªxºIñ�ò]ªlñU¯N°/ªxº:­c!)óx°N¸�¯N©�°N�-��s)yMo)nFclf6�$oHclklr �:kiyMnFr pMm�yUm)t�gMclfFr �:klyUn0rWpMm�p�w �fO�=l{��)yMdFcltdFhIdFnFclv�{�uWclgMcNu$s)yMfFt)��yUf0c�t)cldFrWqMm)dl�Mo)o4�MËUË)�!^I±)�iú)�Et�~Mw`pMf0t�ö�m)rWgMclfFdFrWn�hj¤�fFcldFdl�

b�N ���@7��BNGO ��Q��JKG�F@#��B �lùMùI×]�"õ���p�ci~IyMv�o)uWcid4pxw6gMclfFr �:klyMnFrWpMm/pxw6v�e)uWn0rWfFyMnFc�nFrWv�clt�yMe)nFpMv�yMnFy��rWnFs�/å4t ��t/�H����m h�¨Û§®·!z��HpHp`q�VTW,W�W���¯0ªx« Ê$XYµ¾©�¯l!)óx°N¸�¯N©�°0!)óx©Aì)§i°Nµ¾ò$©�Õ ��X=!�!,n pHq�÷}¤�rWdFy)����nFyMuWhM��/clkU�)�lùMùI×UøN���/� � �[��pMv�o)e)nFclf��$p$klrWcin�h�¤�fFcldFdl�

b��F`fN?�);F0@bcBNGO}�4Q�??JKQ�G�F0@bcB �lùUùI×$�"�$clv�yMm$n0rWkid4pxwVy�gMclfFr �:klyUn0rWpMmU{�pMfFr cimIn�cit�dFe)�)d0cin6pxw7�fO�=$���m R�B � N�g�>?NHxJ�NGOPDUB=�$��F � JKGL ��t)di�W�#k�Té��l PWUn pHqlÕ�kæ§i¨N¨F¯0·®¸ �\ªx¨0­�Z�ªx¨0¯Tð�¯®°Nµ ñxº�ªxº:­�³D¯N¨Nµ¾Ê¶�·Fªx¸`µ¹§iº. 8¯N¸`ê]§®­x°M�$è6pMuWe)v�c�ù��Iáüpxw��4¯F·N¸`ò$¨0¯�~j§i¸�¯®°AµRº�kæ§i©/ì)ò$¸¹¯®¨k!:·Nµ}¯®º:·0¯ü÷}�)fFyMm)�Uw}e)fFnl�-ûüclfFv�yMmIhU�t�klni�:�iùMùI×Mø®�Mo)o4�]�xùUË�^IË)�lúD���$o)fFrWm)qMclf|{�è6clfFuWyxq)�

bUF`=�JK�!=aF0@�� B#NGO w�N?=�NG�@�bcB �lùMùMúD� �²w`pMfFv�yMu4d0oHclklr �:kiyMnFrWp-m�p�wæyMmÌpMd0kirWuWuWpMdFklpMoHcM�EVTW,W�WY!V§¹íN¸`ÊZ�ªx¨0¯*&i�:×�÷��$clo)ni� øN�M�xù�^$ËMß)�

bUF`R�N=ag�N�@,w�B�NGOyw�=�N�$F`?�@�<UB �lùMùMßD� �)pUf0v�yMu4gMcif0r �:kiyMnFrWpMm�yMe)qMv�cimInFd�dFrWv�e)uWyMn0rWpUm4�;W?« ¯F·N¸`¨Û§iº)µ`·W?ºIñxµRº:¯0¯®¨Nµ¾ºIñ]X6µR©�¯®°M�]×�ß)�

b�JK=�=�@�bcB���B�@�b�?�F`�=aF`?�@�<UB���B�@�D�>�@�< B���B�@�NGO]��NGL�@ � B�DUB �lùMùI�]� ¤�f0pMnFp$klpMuHgMclfFr �:klyMnFrWpMm�yMdy�s)yMfFt)��yMf0c/t)cid0rWqMm�yMrWt4���|m VTW�W,WeV®º)¸�¯N¨Nº:ªx¸`µ�§iº:ªx«�kæ§iºlíi¯N¨0¯®º:·0¯�§iºyk�§i©/ì)òI¸�¯®¨üð�¯N°NµWñxº��³��a!EV�µRºk�§i©AìDòI¸�¯N¨N°�ªxº:­ch?¨Û§N·F¯N°N°-§-¨N°�÷0�lùUùI�Mø®�-o)o4�)×M�M��^]×U�M×$�

Page 19: Formal Methods: State of the Art and Future Directions Edmund M

� � ��c��a�7����� � ��� �\� �\� � � �������� ���9��� �"� � � +� ���� +������� � �� � ��

b�JKGQ�=!x�@,w B,FHx N=EB,�lù*�M±)����e)uWn0rWm)cin�qMyMnFcl��y-hU¥�nFp-��yMfFt)d�����klcif0nFr �:klyUn0rWpxm4����m�VTW�W,WI!)óx©/ìzü§-º!:¯F·Nò$¨Nµ¾¸`ó�ª�º:­Uh?¨Nµ¾Ö-ªU·Nó�÷F�lù��M±$øN�

��=��$FHNJKO��@�jB�@���=HF`N ��F`=�NGO�@A B�@HNGOP�4N�>L�f�@���B �lùMùMß)����p$t)cluWrWm)q�yMm)t�gMcif0r w`hIrWm)q�yUklnFrWgMc�dFnFf0e)k®{nFe)f0yUu-kipMm$n0fFpMuldFh$d0nFclv�di�i!:·Nµ}¯®º:·0¯�§`í�kæ§i©/ì)ò$¸�¯N¨,h?¨Û§�ñ�¨0ªx©�©jµRºIñ)�$õVp�yMo)o:ciyMfi�0��o)fFcluWrWv�rWm)yMfFh�gUclfFd0rWpMmpxw6nFs)rWd�o)yMo:cif�yUo)o:clyUf0d6rWm�n0s)c�h?¨Û§N·F¯F¯0­xµRºIñx°�§`í/¸`êI¯c�HpHp ��¯0ªx« Ê$XYµ¾©�¯`!)ó-°N¸�¯®©j°k!)óx©Aì)§i°Nµ¾ò$©��

��FH?GNGO�FHI�@���B S � B�@#w�N?N ��F`=�@,D B�@�dUF`?�)�?NHx�@�< B�@�}NHx�F�FH�!u>�@�A B�@�}Q�>GJ�F`?�@���B�@�NGO���JKL�fJK?�F�SNG>�@(��B �lùMùMß)�"���T�/¤K÷������$�TåAç��Tï4� ������åT� �1t)clgMciuWpMo)v�clmMnHo)yMkN�xyMqMcxøN�)�Ko)f0pUn0p$klpMuUg-yUu {rWt)yMnFrWpMm�yMm)t�gMcif0r �:kiyMn0rWpUm�n0p$pMuW�:px~H� ��mch?¨Û§N·&zY§¹í�¸`êI¯��U¸}ê�V®º)¸¹¯®¨Nº:ªx¸`µ¹§iº:ª�«#k�§iºlíl¯®¨0¯Nº:·F¯j§iº}k�§i©AìDòI¸�¯N¨NÊé�µ`­M¯0­ ³)¯®¨Nµ ¶�·Fªx¸`µ¹§iº6� ��e)vj�Hclf8�M�lúI�àrWmÇï4ciklnFe)f0c���pMnFcld�rWmÇ��pUv�o)e)n0cif��$klrWcim)klc�÷/�xe)uWh²�lùMùUßIøN��$o)fFrWm)qMclf|{�è6clfFuWyxq)�

��JK= � Q�?G�@�M�BC@#��ufG�FHJKO�FH?�@�DUBC@#��ufQ�=�I�@�<UBC@���x?N�!�$F`?�@�< B�@�NGO]�}N? � F`GxJKG�@#R�B �lùMùM±D� �$è �ö�d0cif�� djûüe)rWt)cM�:õ4clkNs)m)rWkiyMu6å�clo:pUf0n��H� �<��õ��$� �N{0�$è �Y{N�M���$rWciv�clm)d��Tû�����pMfFo:pMfFyMnFc�åTcid0ciyMf0kNsyMm)t��/cigMcluWpMo)v�cimIni�l��e)m)rWkNs4�

w�N?=�NG�@�bcBC@H<+)EQ� �O�@�w B�@��EN�u � �!Q�G�@;b B�@HM4Q�g�NH� � Q�@���BC@HNGOo� JKGL�@E��B �lùMù$×$� õ�s)cT����öK��yUd�{nFclf6p�w��$pxw`n���yUf0c���m)qMrWm)clcif0rWm)qT��pUf0c/��e)f0fFrWkle)uWe)v����|m h�¨Û§®·0¯F¯F­xµ¾ºIñ�°¬§`íü¸}ê$¯4W�µWñxêM¸`ê>!EW�Vck�§iºlíl¯®¨0¯Nº:·F¯§iº�!V§¹íN¸[Zæª�¨0¯cW�ºIñ�µ¾º:¯F¯N¨Nµ¾ºIñ WT­xò)·Fªx¸`µ¹§iº m k=!EW�W�rM�4è6pMuWe)v�c �MùI×�p�w��4¯0·®¸}ò$¨0¯P~j§i¸�¯®°�µ¾ºek�§i©/ì)òI¸�¯®¨!:·®µ}¯Nº:·F¯\÷ ��cl�et�f0uWciyMm)dl�$��yMf0kNs��iùMùI×Mø®�Mo)o4�IßI×�^��Mß)�I�$o)fFrWm)qMclf|{�è6clfFuWyxq)�

w�N?=�NGO�@���B���BNGO�w�>xxHN�L�@���B(� B �lù*���)� ��m)t)e)kin0rWgMc�v�cin0s)p$t)d4w`pMf�fFclyUd0pMm)rWm)q/yM�HpMe)n�yM�)d0nFfFyMklnt)yMnFy�n�h$o:cidl� ��myh?¨Û§®·!z�§`í̸`êI¯��`qx¸`êM!)óx©Aì)§i°Nµ¾ò$© §iº h�¨NµRº:·Nµ ìD« ¯®°à§`íPh?¨Û§�ñ�¨0ªx©�©jµRºIñ��4ªxºIñ�ò]ªlñU¯N°÷F�lù����$øN�xo)o4�]�$�iù�^]�M���D�

w�F`?Hxf�@A B�@R4FH=HF`O�@�bcB�@���N?O�J[@(��B��cB�@NGO}��Q�=H_EF`?�@R�B �lùMùI×$� �$rWv�o)uWc�pUm${¹nFs)cN{[�:h/yMe)nFpMv�yMnFrWkgMcif0r �:kiyMnFrWpMmTpxw)uWrWm)clyUfVnFclv�oHpMfFyMuluWpMqUrWkM����mch?¨Û§N·&z0VF¦�VTh23 ;�����z[�k!)óx©Aì0zY§-º�h?¨Û§i¸0§N·N§i«!Mì$¯0·®µ ¶�·Fªx¸`µ¹§iºIÕX:¯®°N¸`µ¾ºIñlÕ?ªxº:­³)¯®¨Nµ ¶�·Fªx¸`µ¹§iºK÷`b�yMfFd0yx�/�$¤6pMuWyMm)t4���xe)m)c��lùUùI×Mø®�

w�Q�?O�Q�G�@��B �lù��Iá$� ��t�ï��H�<o)f0p$pxw4qMclm)cif0yMnFrWm)qTdFh$d0nFclv²w`pMf�s)rWqMs)clf|{�pMfFt)clf4uWpMqMrWkU����m[³��=!EVp!Mì$¯0·®µ¾Ê¶�·Fªx¸`µ¹§iºIÕ�³)¯®¨Nµ ¶�·Fªx¸`µ¹§iº�ªxº:­´!)óxº)¸}ê$¯N°Nµ¾°�÷F�lù��IáMø®��/uWeI��clfi�

w�Q�?O�Q�G�@ ��BE��B�@��}JK=�G�F`?�@E< B��BC@;NGOP�}NO��� �Q�?Hxf�@(��BR�B �lù$áxù)� WT­xµRº(�Nò$¨}ñxêc��kV¦��Mè6pUuWe)v�cTá��pxw,�4¯F·N¸`ò$¨0¯U~�§i¸�¯N°�µRº�kæ§i©/ì)ò$¸�¯N¨c!:·®µ}¯Nº:·F¯N�4�$o)f0rWm)qMcif�{�è6cif0uWyUqI�

w�>JKfQ�@#w BENGO{D�FHGG�F�);F`?Hx�@�� B �lùMùUú)� �$�T� ���´dFpxw`n���yUf0c�gxyMuWrWt)yMnFrWpMm4� ��m]X�Z�¯N« íN¸`ê�V®º)¸�¯N¨Nº:ªx¸`µ�§iº:ªx«k�§iºlí!zæ§-º2!V§`íN¸[Z�ªx¨0¯�W�ºIñ�µ¾º:¯F¯N¨NµRºIñ8÷0�iùMùMúIø®�

w�>xxHN�L�@���B�NGO�D�Q�?GJKGL�@���B �lùMùUË)� �4ªx¨0·®êH� �4ª�ºIñxò)ªlñM¯®°�ªxº:­}XV§i§i« °�í-§i¨/¦6§i¨N©�ª�«=!MìI¯F·Nµ ¶�·0ªx¸`µ�§iº)��$o)fFrWm)qMclf|{�è6clfFuWyxq)�lb�fFrWnFn0cim���rWnFs��H� �$�)û/yMfFuWyMm)t4�&�� �����xpMm)cidl�$���)��pIt)cinl�MyMm)t �$� �8�)b�rWm)q)�

D�N=�=E@�< B �lùUùMß)�"öTdFrWm)q�w}pUf0v�yMu$v�clnFs)p$t)d�nFpjt)cigMcluWpUojyMm��6õT�1rWm$w}pMfFv�yMnFrWp-m�dFhIdFn0civ��EV�W�W�Wx!V§¹íN¸`ÊZ�ªx¨0¯c��\U�]ß�÷`��yMfFkNs:øN�MßMßa^]áxß)�

D�N?�FH=�@�bcB �lù��Iá]� �$n0yUn0cikNs)yMf0nFdi�M��g$rWd0e)yMuiw`pMf0v�yUuWrWd0vàw}pMfHklpMv�o)uWci~TdFhIdFn0civ�dl��!:·Nµ`¯Nº:·F¯j§`í�k�§i©/ì)òI¸�¯®¨h?¨Û§�ñ�¨0ªx©�©jµRºIñ]�M�V��Ë)�!^]�Má�±)�-¤�fFcluWrWv�rWm)yMfFh�gMcif0dFrWpMm4�6õ4clkNs4�)åTcio:pMfFn����$�M±x{�úI×$�$õ�s)c�b�clrW�iv�yMm)m ��m${dFn0rWnFe)nFcTpxw��$klrWcim)klcU�-å�cls)pxgMpMni����dFf0yMciu`�M�)cl�)fFe)yMfFh��lù��M±D�

D�N?�FH=�@bcB �lùMùI�$� ��rWnFrWm)qAnFs)c�dFrWuWgMclf6�)e)uWuWcinl�HõVpx��yMfFt�y��)f0rWqUsInFclfHw}e)nFe)fFc6w`pMf�dFh$d0nFclv²t)clgMciuWpMo)v�cNm$nl�VTW,W�WYkæ§i©/ì)ò$¸�¯N¨c\Eqx�4��÷/�xyMm4� ø®����^]�xúD�

D�N?�� ��=�@(/�BNGO}d�>?�!fNG�@�AUBR�B �lùUùMú)� �$pxw`n���yUf0c�w`pMf�yUm)yMuWhInFrWklyUu-t)cigMcluWpUo)v�clm$n:pxw4klpMv�v�e)m)rWklyx{nFrWpMm)d�o)f0pMnFp$klpMuWdi��é X��X�/¯®«¾«��4ª��N§i¨0ªx¸0§i¨Nµ`¯N°}X:¯F·NêUº)µ}·Fªx« �:§iòI¨Nº:ª�«���px�4�j÷/�xyMm4� ^$�)cl�4� ø®�-±I×�^]×xù)�

D�FHJ�g�ONf=�@(��B;NGO �,F���F`�!Q�G�@� B �iùMùMß)�"��pMv�o)uWclnFclm)cid0d4yMm)t�klpUm)d0rWdFn0cim)klh/rWm�s)rWclfFyMfFkNs)rWklyxuMdFn0yUn0c®{�)yMdFclt�f0cizIe)rWfFclv�cimInFdi��V�W�W,W X)¨0ª�º)°lªM·N¸`µ¹§-º)°?§iº>!V§¹íN¸[Zæª�¨0¯,W?ºIñxµRº:¯0¯®¨Nµ¾ºIñ´!EW�Ê \`\M�-ß\÷ ��e)m)c-ø®�ÛËUßMË�^IËIáUá$�

D�FHGJKGL�FH?�@dcB �iù��Mú)� �$oHclkir w}h$rWm)q�dFpxw}n|��yMfFc�f0cizIe)rWfFclv�cimIn�d$w`pMf6kipMv�o)uWcl~�dFhIdFnFclv�di���Tci�nFclkNs)m)rWz$e)cldyMm)t�nFs)clrWf�yUo)o)uWrWklyMnFrWpxm4�aVTW,W�WYX)¨0ªxº)°!z�§iº2!V§`í®¸ z�W?ºIñ�z��i�4��÷ ��yMm4� øN�I��^:�lË)�

D�FHGI�JKGL�FH?�@�M�BE< BC@E��JKuQ�=�=�JKG�@�6UBC@;��JKv!N � JK��@;��B�@�NGOc��Q��JKG�F0@0��B �lùMùM±D� �$hIv��:pUuWrWk6v�pIt)ciuxkNs)clkN�U{rWm)q/w`pMf�fFclyMu {�nFrWv�c�d0h$d0nFclv�di�EV®ºlí-§i¨N©�ªx¸`µ¹§iº8ªxº:­}k�§i©AìDòI¸�ªx¸`µ¹§-º��H�H�x�4�M�M�&^]�x±M±)�D�Q�@�R�B S�D B#NGO���Q�GLSTM4Q�J[@�D B �lùMùI×$����e)n0pMv�yUn0cit�yMm)yMuWh$d0rWd�pxw�yMm�yMe)t)rWp�kipMmInFfFpMu:o)fFpMnFpIkipMu`����m

R�BH��Q�=H_EF`?���t4�W�#k�§i©/ì)òI¸�¯®¨NÊ}é�µ}­M¯F­�³)¯®¨Nµ ¶�·Fªx¸`µ¹§iº�n p`q:�Mï4ciklnFe)f0c �TpMnFcld4rWm���pMv�o)e)nFclfV�$kirWclm)kic6ùMËMù)�o)o4�MË��D�!^IËMùM±D���$o)fFrWm)qMclf|{�è6clfFuWyMq)�

D�QN?�F@ ��B�<UB�AUB �lù��I×]� kæ§i©�©jò$º)µ}·Fªx¸`µ¾ºIñ4!:¯�#Nò)¯Nº)¸`µ`ªx«#h?¨Û§N·F¯N°N°l¯®°N�:¤�fFclm$nFrWklcN{/��yMuWu��|mInFclfFm)yMnFrWpMmIyUu`�D�Q#��NHxJ[@�A B�@��4?NH�xQ�G�@�A B�@�NGO}d�>?�!fNG�@�AUB �lùMùMËD� ���/��{��)yMd0citjt)ci�)e)qMqMrWm)q�pxwVt)cid0rWqMm)dYe)d0rWm)quWyMm)qUe)yMqMc�klpUmInFyMrWm)v�clmUn�yMm)t�w`yMrWf���õ�ï�� �|m���B���Q�>?EuQ�>�);F`xJK����t4�W�4h�¨Û§®·0¯F¯F­xµ¾ºIñ�°ô§`í̸`êI¯�q�¸}êV®º)¸�¯N¨Nº:ªx¸`µ¹§-º:ªx«4kæ§-ºlíl¯N¨F¯Nº:·F¯ §-ºyk�§i©AìDòI¸�¯N¨NÊ`é�µ}­M¯F­[³D¯N¨Nµ ¶�·Fªx¸`µ¹§-º6� �Te)v��:cif�ßMùIá�rWm�ï4clkin0e)fFc �TpMnFcldrWm���pMv�o)e)n0cif��$klrWcim)klc\÷0�lùUùMËIø®�Mo)o4�M±)�!^]×Má]�I�$o)f0rWm)qMcif�{�è6cif0uWyUqI�

Page 20: Formal Methods: State of the Art and Future Directions Edmund M

� � � ��������� �� ��;�`�����2������9�������

D�Q�=�IHg�NGG�@�w B �lùMù)�U� ð�¯N°NµWñxº�ªxº:­�³)ªx« µ}­Mªx¸`µ�§iºô§`í{kæ§-©Aì)ò$¸�¯N¨Uh?¨Û§i¸0§N·N§i« °N�V¤�fFclm$n0rWkicN{/�TyMuWu`����m)qMuWc®{��pIp$t���uWr �4dl�$�Tci� ��clfFd0cihM�

D�Q�=�IHg�NGG�@Uw B �iùMùI�$� ¤�f0yUklnFrWklyMu�v�clnFs)pIt)düw}pMf�nFs)c�w`pMf0v�yUu�gxyMuWrWt)yMnFrWpMm8pxwü�$�/ï<dFo:ciklr �:kiyMn0rWpUm)dl�k�§i©AìDòI¸�¯N¨{kæ§i©�©jò$º)µ}·Fªx¸`µ¹§-º)°M�:�$o:clkirWyMu$rWd0dFe)c/pMm�¤�f0yUklnFrWklyMu$öTdFcld�pxw6�6�/õ � dl�

D�Q�=�IHg�NGG�@�w B �lùUùM±)� õ�s)c�nFs)clpMfFhTyUm)t�o)f0yUklnFrWklc6pxw)y�w}pMfFv�yMuxv�clnFs)p$t4� ��cl�T��pMå�cM����mUh?¨Û§N·&z#VF¦�V�h;8§i¨N« ­ kæ§i©/ì)ò$¸�¯N¨ k�§iºIñx¨0¯®°N°j÷ �TyUvj�)e)fFq)�Mû/clfFv�yMm$hM�M�Te)qUe)d0n��lùMùM±$øN�

D�Q�=�IHg�NGG�@ w B�NGO|R�NHxxJ[@���B �iù��Mù)� è6yMuWrWt)yUn0rWm)q�$�/ï�dFo:ciklr �:klyUn0rWpMm$di���Tm<ci~IoHclfFrWv�clm$nN� ��m� B ��JK�!�$F`?��NGO���BE��?JKG � �$g�N ��t)di�W�Eh?¨Û§N·&z�px¸`êUV®º)¸[z�k�§iºlíj§iº h?¨Û§i¸0§N·N§i«K!MìI¯F·Nµ ¶�·0ª�¸}µ�§iºIÕcXH¯N°N¸`µ¾ºIñiÕªxº:­8³)¯N¨Nµ ¶�·0ª�¸}µ�§iºIÕ�VT~*;��43HV0¦�V�h ÷}õ���clm$nFcM����clnFs4�W� �xe)m)c\�lù��Mù$øN�

D�Q�=�IHg�NGG�@ w B�NGO R4F`=HFHO�@�bcB �lùMùM±D� ��m<rWv�o)fFp-gUclv�clm$n�rWmKw}pMfFv�yMu�gMclfFr �:klyMnFrWpMmH����meh?¨Û§N·&z¦$14��X#W�p�K÷`��clfFm)cM�I�$��rWnF�lcif0uWyMm)t4�Ht�klnFpM�:cifT�iùMùM±Iø®�

D�Q�>�!xQ�G�@ �!B�NGO�d�JKGL�@���B �lùMù)�M��� �0����o)f0px�Fclkin�fFcloHpMf0ni� ��~$o:cif0rWcim)klcldYyMm)t�fFcldFe)uWn0dYw}fFpMv e)d0rWm)q�Y����m�h?¨Û§N·&z\§¹í³:ðk n p`����¦6§i¨N©�ªx«�ð�¯NÖx¯N«¾§Fì)©�¯Nº)¸c ¯®¸`ê]§N­x°U�6è6pMuWe)v�c�×M×$�jp�w��4¯0·®¸}ò$¨0¯ ~�§i¸�¯N°�µRºk�§i©AìDòI¸�¯N¨p!:·Nµ}¯®º:·0¯\÷F�lùMù)�-ø®�I�$o)fFrWm)qMclf|{�è6clfFuWyMq$�

������� �lù��Iá]� ��m$w}pMfFv�yMnFrWpMm �$hIdFnFclv�d<¤�f0p$klcid0dFrWm)q�^;t�oHclm �$hIdFnFclv�d ��m$nFclfFklpMm)m)cikln�rWpMmU¥�ï�t�õ4tA�H�õ4clkNs)m)rWkiyMu$f0cio:pMfFnl���|mInFclfFm)yMnFrWpMm)yxu]�$nFyMm)t)yMfFt)d,t�f0qUyMm)rW�lyMnFrWpMm�� �0� ���MúIá]�

��NEu � ��@���B �lùUùI×$� �$oHclkir w}h$rWm)q�yjdFyxw`cln�hU{�klfFrWn0rWkiyMuIkipMm$n0fFpMu)dFhIdFn0civ�rWm �6��VTW,W�WYX)¨0ªxº)°!zT§iº�!V§`íN¸[Z�ªx¨0¯W?ºIñxµRº:¯0¯®¨Nµ¾ºIñ \E�x�:��÷`�)cl�4� ø®�MùMù�^:�lúUß)�

��NEL�NO#F�FH�!NG�@���B�@R�>ufQ�=E@(� B�@NGO � =�GfN�>�$F`G�@#��B��UB �lùMùMßD�"��w`pMfFv�yMuIyUo)o)f0pMyUkNs�n0p�fFclyMkin0rWgMcdFhIdFnFclv�dTdFpxw`n���yUf0cU�A� n0ciuWclklpUv�vje$m)rWkNyMnFr pMm)d�yUo)o)uWrWklyMnFrWpMm�rWm ��dFn0cif0ciu`�V¦6§i¨N©�ªx«�é/°�ì$¯0·®¸`° §`í kæ§i©�Êì)ò$¸`µ¾ºIñ �M�:��÷`��yMf0kNs:ø®�)�-�xËa^:�-×$�M�

��NGJKu � J[@�A B�@�R�N?GN��@�bcB���B�@�NGO /�>u � F`?�@,��B �lùMùUß)��õVyU�)e)uWyMf/f0cio)f0cid0cimInFyMnFrWp-m)d�rWmÌf0ciuWyMn0rWpUm)yMut)p$kle)v�cimInFdN���|m���B��4?JKG � ��t4�W�7�T¯®« ª�¸}µ�§iº:ªx«� 8¯N¸`ê]§®­x°�µRºyk�§i©/ì)òI¸�¯®¨>!:·Nµ}¯®º:·0¯��æ�$o)fFrWm)qMclf|{�è6clfFuWyMq)�õ4p�yMo)oHclyMfi�

��Q�G�F`��@ � B#��B �lù��Uß)� !)óx°N¸�¯N©�ªx¸`µ}·`!V§`í®¸[Zæªx¨F¯�ðj¯®Ö-¯®« §FìD©�¯®º)¸��4°NµRºIñ³Hð� Ì�:¤�fFclm$n0rWkicN{/�TyMuWu �|mInFclfFm)yx{nFrWpMm)yMu`���Tci� ��pMfF�:�

d�N=!x�F`G�)EN�uf�@(��B �iùMùM±)� ��pIt)ciuIkNs)cikN�IrWm)q�w`pMf6ö � ��õ �j�$õ4clkNs)m)rWklyUuMåTcio:pMfFn4õ�åTùM±x{�Ë)�/÷`�/clkM� ø®�xõ�s)cö�m)rWgMclfFd0rWn|h�pxw�õ4cl~$yMd�yMn���e)d0nFrWm4�

d�N�_`>?�@bcBENGO�� >�!�$FH?�@�bcB �lù*�Iá$� ¤�f0p$pxw:�$h�klpUm)d0rWdFn0cim)klhU�®é�¨N¸`µ ¶�·Nµ}ª�«;V®º)¸¹¯®«¾« µ ñU¯Nº:·F¯!�E�x�)�x�M×�^:�-×Uá$�d�N�>vEg�NGG�@+��B,NGO �}Q�Q�?�F0@,��B���B �iùMùI×$� é k#��\H��é k�§i©AìDòI¸�ªx¸`µ¹§-º:ªx«,�6§�ñ�µ}·�íx§i¨�é?ìMì)« µ}·Fªx¸`µ¾Ö-¯

k�§i©j©�§iº��6µR°�ìIÕ X6êI¯��4°l¯®¨En °. 8ªxº)ò)ªx« m ³)¯®¨N°Nµ¹§iºe��zC�$rx�4w}nFo4� çMçiw`n0o4� kiuWr`� kipMv�çxoIe)�:çiyMkNu¾�Uçxg)�N{/�MçxyMkNu¾�i{dFpMe)fFklcldNçxt)p$klç��Tõ���ï6çxyMkiu¾�i{}t)p$kx� s$n�v�u`�

d�JKGO�?�FHO�@#bcB�NGO��yJKGL�@���B �iùMùMß)���)yMd0ni�)yMe)nFpMv�yMnFrWkTkNs)clkN�$rWm)q�pxw6dFclkie)f0rWn�h�o)fFpMnFpIkipMuWdi�&��m}h?¨Û§N·&z§`í\¸`êI¯��K!EW�~4V�� ;§i¨0ë�°Nê]§Fìä§-ºoW�«W¯F·N¸`¨Û§iº)µ`·}kæ§-©j©�¯N¨0·F¯�h?¨Û§i¸0§N·N§i« °�÷F�lùMùMßIø®�xõVp�yUo)o:clyUfl�

d�JKGL�@�M�B �lùUùM±)���)pMfFv�yMuWrWd0rWm)q���fFrWn0rWdFs�åTyMrWu � d/dFrWqMm)yMuWuWrWm)q�f0e)uWcidl� ��m¦a oW n p � VNº:­xò$°N¸`¨Nµ}ªx« /¯Nº:¯R¶�¸§`í/¦6§i¨N©�ªx«h 8¯N¸`ê]§®­x°M�)è6pMuWe)v�c �Iá�Ëjpxw,�4¯F·N¸`ò$¨0¯U~�§i¸�¯N°�µRº�kæ§i©/ì)ò$¸�¯N¨`!:·Nµ}¯®º:·0¯�÷F�lùMùU±IøN�xo)o4�I±$×�^]×x±)��$o)fFrWm)qMclf|{�è6clfFuWyxq)�

d�=H��NJKuf�@#��B�@��g�JKxf�@���B�@NGO}��Q�� uJ � @�< B �lù*�Mù)� �)pMf0v�yUu)gMclfFr �:klyMnFrWpMm�p�wVw`yMe)uWn6nFpMuWclfFyMm)kic�e)d0rWm)qnFs)clpMfFclv�{�o$f0pxg$r m)q�n0cikNs)m)rWzIe)cidl�HVTW,W�WYX)¨0ªxº)°lªM·®¸`µ¹§iº)°�§-º�kæ§i©/ì)ò$¸�¯N¨N° �H�M�)ËMßMß�^$ËIáxß)�d�>�F`f=Hg�NGG�@#< B�@���?JKGJ���N�!NG�@�< BC@�NGO���NR�Q�xJKG�@bcB�R�B �lùUùI×$�"è6cif0rWn�h�{�y�w`pMf0v�yUu)gMclfFr �:klyMnFrWpMmo)fFpMqMfFyMv²w}pUfTkle)dFnFpMv ��� t/�ÌklrWfFkle)rWnFdl�EV 0 �:§iò$¨Nº:ªx«T§`í��T¯®°l¯0ª�¨0·Nê�ªxº:­�ð�¯NÖ-¯®« §Ûì)©�¯®º)¸!�Epx���-çM�$��l±Uù�^:�lßI×]�

d�>fG�@�bcB�NGO�b�?N`��@#��B �lùUùMú)�"�)pMfFv�yMu:dFo:ciklr �:kiyMn0rWpUm�yMm)t�gUclfFr �:klyMnFrWpMm�pxw�klpUmInFf0pUuIdFpxw}n|��yMfFc�w}pMfkif0h$o)n0pUqMf0yUoIs)rWk�clz$e)rWo)v�clm$nl�!��m�!)µ �x¸`ê]kæ§i©/ì)ò$¸¹¯®¨c!:¯F·Nò$¨Nµ¾¸`ó�é?ìMì)« µ}·Fªx¸`µ¹§iº)°Pkæ§iºlíi¯N¨0¯®º:·0¯�÷F�lùMùMú$øN�

d�>?�!fNG�@�A B�NGO ��N�g�_`Q�?`x�@,��B �lùMùMË)� è6cif0r �:kiyMn0rWpUm�p�wAy���e)uWnFrWo)uWrWclfi��ßM±���rWnFd�yMm)t8��clhMpMm)t4���m ��B2��Q�>?EuQ�>�);F`xJK� ��t4�W�4k�§i©/ì)òI¸�¯®¨jé�µ}­M¯F­[³D¯N¨Nµ ¶�·Fªx¸`µ¹§-º6�6è6pMuWe)v�c�ßMùIá�pxw4�4¯F·N¸`òI¨F¯ ~j§i¸�¯®°jµRºk�§i©AìDòI¸�¯N¨p!:·Nµ}¯®º:·0¯\÷F�lùMùMËIø®�Mo)o4�:�ißMß�^:�-á�ù)���$o)fFrWm)qMcif�{�è6cif0uWyxq)�

d�>?�!fNG�@�A B;R�B �iùMùM±My)� kæ§-©Aì)ò$¸�¯N¨NÊ}é�µ`­M¯F­ä³D¯N¨Nµ ¶�·Fªx¸`µ¹§-ºä§`íck�§l§i¨0­�µ¾º:ªx¸`µ¾ºIñ h?¨Û§N·F¯N°N°l¯®°N�I¤�f0rWm)kiclnFpMmö�m)rWgMclfFd0rWn|h�¤�fFcldFdi�

d�>?�!fNG�@�A BER�B �lùMùU±M�4� õ�s)cT��pUv�o)uWcl~$rWn�h/pxw:è6clfFr �:klyUn0rWpMm4�!��m�h?¨Û§®·!z�\;�-¸}êjé kK C!)óx©Aì)§i°Nµ¾ò$© §-ºXYêI¯Û§-¨Nó�§`í k�§i©/ì)òI¸`µRºIñ m !�X$1�k�r�÷}��pMm$n0fFclyUu`�I�lùUùM±Iø®�Mo)o4�IËMßI×�^IËIá$�M�

��N�g�_`Q�?Hx�@��B �lù��M±D�"õ�s)c�n0civ�o:pMfFyMu$uWpMqMrWk�pxw6yMklnFrWpMm)di�Ié kh X 1�h��4ék!�� �$áM��^IùI��Ë)��,F`�!uNGG�F@�R�B �lù��UË)� ��pMv�o)e)nFclf/cl~$o:cif0rWv�cimInFd/��rWn0s�nFs)c�å ��è ��nFclfFv fFcl��fFrWn0rWm)q�dFhIdFnFclv qMcim${cif0yMnFpMfi����m�h�¨N§N·F¯0¯F­xµ¾ºIñ�°à§¹í�¸`êI¯}���-¸}ê�!)óx©Aì)§i°Nµ¾ò$© §-ºih?¨Nµ¾º:·Nµ ì)«W¯N° §¹í�h?¨Û§|ñx¨0ªx©�©�µ¾ºIñ��4ªxºIñ�ò]ªlñU¯N°

Page 21: Formal Methods: State of the Art and Future Directions Edmund M

� � ��c��a�7����� � ��� �\� �\� � � �������� ���9��� �"� � � +� ���� +������� � �� � � �

÷`�Te)dFn0rWm4�Mõ4ci~IyMdi� ��yMm4�:�lù*�MËIø®�Mo)o4�IùMù�^H�lú��)���Q�GL�@bcBH��B �lùMùMË)����p$t)cluUkNs)clkN�$rWm)q)�NyM�)d0nFfFyMklnFrWpMm4�0yUm)tjkipMv�o:pMdFrWnFrWp-m)yUulfFclyMdFpMm)rWm)q)�F¤�s4�x���-nFs)cldFrWdl���yMfFm)clqUrWcT��cluWuWpMm���pUv�o)e)n0cifæ�$kirWclm)klc��/cio)yMf0nFv�clm$ni�

��Q� UF0@;w�B �lùMùUß)� ��fFclyM�$rWm)q�yMm)t/�:~$rWm)q�n0s)c���clcit)s)yMv�{0�$kNsIfFpIt$clf)o)e)�)uWrWk®{��Mclh�o)fFpMnFpIkipMuxe)d0rWm)q��6�/å����m XV§l§i« °�ªxº:­�é�« ñ$§i¨Nµ¾¸`êM©�°Aíx§i¨�¸`êI¯]kæ§iº)°N¸`¨Nò)·N¸`µ¹§-º�ªxº:­�é�º:ªx« óx°Nµ¾° §¹í>!)óx°N¸�¯N©�°M�VèYpMuWe)v�c��iúI×M×�p�w�4¯F·N¸`ò$¨0¯�~j§i¸�¯®°jµRºik�§i©/ì)òI¸�¯®¨�!:·®µ}¯Nº:·F¯\÷}��yMfFkNs��lùUùMßIø®�I�$o)f0rWm)qMcif�{�è6cif0u yMq)�

��>Q�@7/�B;NGO R�Q�=�=�NEu � @�A B �lùMùI�$�"ï ��û�tKo)fFpIp�w:t)clgMciuWpMo)v�clmMn4dFhIdFnFclv��:ö�d0cif�� d�v�yMm$e)yMu`�-õ4cikNs)m)r {kiyMu:å�clo:pUf0n �æ���U{�ï4�6���U{�ùI�i{0�$�M�/÷`��yxh)øN�)��pMv�o)e)nFclf��$kirWclm)klc��/clo)ni�W�MöTm)rWgMcif0dFrWn�h�pxw ��t)rWm$�)e)f0qUs4���Guf�@E� BHNGOcM�>xx=aF0@���B �lù��Iá$� �TrWcif0yMfFkNs)rWklyUulklpUf0fFclkin0m)cid0d$o)f0p$pxw`d$w}pMf4t)rWdFn0fFrW�)e)n0cit�yMuWqMpMfFrWnFs)v�dl�õ4clkNs)m)rWkiyMu$f0cio:pMfFnT÷`�To)fFrWu¾ø®�I� ��õKï4yM�:pMfFyMnFpMfFh/w}pMfT��pUv�o)e)n0cif��$klrWcim)klcM�I��yUvj�)fFrWt)qMcM�x�����

�}NGGN�@(/�BENGO{R�G>�FH=�J[@H< B �lùUù)�M� X6êI¯�X:¯N©/ì]§-¨0ªx«;�6§|ñxµ`·ü§¹í2��¯0ªM·®¸`µ¾Ö-¯\ªxº:­ckæ§-º:·Nò$¨N¨0¯Nº)¸=!)óx°N¸�¯N©�°N��$o)fFrWm)qMclf|{�è6clfFuWyxq)����cl� ��pUf0�H�

�}NHx`NEL�N�@ER�BHNGO*/�N ��F@�R�B �lùMù$×$� ��e)uWnFrWo)yMf0yUt)rWqMv�d0oHclkir �:klyMnFrWpMm�pxwIyUm��6õ$,/õ�d0��rWnFkNs)rWm)q�d0h$d0nFclv����m9��B#w B�D�JKGuf�F`�}NGO]��B�R�B��4Q� UF`G��t)di�W�]é�ìUì)« µ`·0ª�¸}µ�§iº)°�§`íA¦6§-¨N©�ªx«K ¯®¸`ê]§N­x°U�Io)o4�IË$áM×�^IËMù*�)�¤�f0cimInFrWklc®{/�TyMuWu$��m$n0cif0m)yMnFrWpMm$yMu`�

�}u��}JK=�=�NG�@�dcB���B �lùMùUË)� !)óx©!�Û§-« µ`·. �§N­M¯®«�k6êI¯F·0ë�µ¾ºIñ��é�º�é�ìMìD¨Û§NªM·®ê�¸0§ ¸}ê$¯.!)¸�ªx¸�¯ W �®ì)« §-°Nµ¹§iºh?¨Û§ �®« ¯®©j��/uWe$��cif��TkiyMt)clv�rWk�¤�e)�)uWrWdFs)clfFdl�

�}JK=�=HFH?�@���B�R�BNGO���?J���N��@ ��B �lùMùI×]�"�)pMf0v�yUu)gMclfFr �:klyMnFrWpMm�p�wVnFs)cA���T��¤�×�v�rWklfFpMo)f0p$klcNdFdFpMfl�)�kiyMd0c�dFnFe)t)h�rWm�n0s)c�rWm)t)e)d0nFfFrWyMuxe)d0c�pxw:w`pMf0v�yUuIv�cin0s)p$t)dl� ��m ;{V0¦ X n pHq��*;§-¨0ëx°Nê]§Fì§-º V®º:­xò$°N¸`¨Nµ}ªx« Ê!)¸`¨0¯®ºIñx¸`ê�¦6§i¨N©�ªx«�!MìI¯F·Nµ ¶�·Fªx¸`µ¹§-ºlX:¯F·NêMº)µ+#Nò)¯N°�÷`��pIkiy�åTyMnFpMm4�)�6ï��4�lùMùI×Mø®�)o)o4�:��^:�lß)�$�/� ���<��pMv�{o)e)nFclf��$pIkirWcln�hU�

�}JK=�G�F`?�@�<UB �lù��MúD� é k�ª�« ·®òI« òI°�§`íPk�§i©j©�ò$º)µ}·Fªx¸`µ¾ºIñ)!)óx°N¸�¯N©�°N�:è6pUuWe)v�c�ùI��pxw��4¯F·N¸`ò$¨0¯c~j§i¸�¯®°jµRºk�§i©AìDòI¸�¯N¨p!:·Nµ}¯®º:·0¯®�V�$o)fFrWm)qMclf|{�è6clfFuWyMq$�

�}Q�Q�?�F0@ ��Bl��BC@ ��Guf�@ M�BC@ NGO d�N�>vEg�NGG�@ ��B �lùUùMß)� � v�clkNs)yMm)rWkiyMuWuWh kNs)clkN�Mcito)fFpIp�w pxw nFs)c klpUf0fFclkin0m)cid0d pxw n0s)c �����ü× �Uß �:pUyMn0rWm)q�o:pMrWm$n,t)rWgIrWdFrWpMm"yUuWqMpMfFrWn0s)v���� ��� ��� � ��� "�� -/��+�� - � ����)$#�- � � ��������� ����'�+ � � � "�� " � ��� � "��$" � � - �� ��]�

��J�FH=��$F`G�@7��B�@�D�N ��F`=�>GO�@�dcBC@#�}N�L�G�F`?�@�dcBC@#NGO�w�F`Q�?�L#F0@ ��B �iù��Mù)��õ�s)c�å�� �0�$�OuWyMm)qMe)yMqMcU�v�cin0s)p$tjyUm)t�nFpIpMuWdi�I¦6§i¨N©�ªx«Véü°�ìI¯F·N¸`°�§`í{kæ§i©/ì)ò$¸`µ¾ºIñ}��� �$×�^:�M�l±D�

�� �?�F0@���BC@#A�>�!f�)E��@���BC@#NGO���fNG � N?�@,� B �lùUùI�$� ¤�èA�H�H�Ço)fFpMnFpMn�h$o:cTgUclfFr �:klyMnFrWpMm�d0h$d0nFclv��$��mbcBd�N�_`>? ��t4�W���`�x¸`ê�V®º)¸¹¯®¨Nº:ªx¸`µ¹§iº:ª�«�k�§iºlíl¯®¨0¯Nº:·F¯�§-º¬é�ò$¸0§i©�ªx¸�¯0­�ð�¯F­xò)·N¸`µ¹§iº m kVéTð�W�rM�$è6pMuWe)v�cßMú$á/pxw,�4¯0·®¸`òI¨0¯ ~j§i¸�¯®°jµRº¬é�¨N¸`µ ¶�·Nµ}ª�«#VNº)¸�¯®«¾« µ ñM¯®º:·0¯�÷/�xe)m)c\�lùMùI�Mø®�Mo)o4�]á�±���^]áM×U�$���$o)fFrWm)qMcif�{�è6cif0uWyxq)�

���v�Q�?O6� �lùMùMßD� ��� ��� ����� -/+�%, ��!)���- %���- )�+�- � ��*"�0 � ���Ì�)��yUd0nFclf � d�pxwæ�$kirWclm)klc�rWm��$pxw}n���yMfFc ��m${qMrWm)ciclfFrWm)q)�R4F`=aF`O�@�bcB �iùMùMß)� ��pMv��)rWm)rWm)qTo)yUf0nFrWyMu$pMf0t)cif�fFclt)e)kin0rWpUm)dV��rWnFs�pMm${�nFs)cN{[�:h/v�pIt)ciu {¹kNs)cikN�Ir m)q)���:§iò$¨Nʺ:ªx«�§`í/¦6§i¨N©�ªx«h 8¯N¸`ê]§®­x°�µRº2!)óx°N¸¹¯®©j°/ðj¯®°Nµ ñ�º�� m �!rx�$ËMù�^IßM±D�-��uWd0p�yMo)oHclyMfFclt�rWm�nFs)c�h�¨N§N·!zA§¹í�¸`êI¯�i¸`êoV®º)¸�¯N¨Nº:ªx¸`µ�§iº:ªx«�kæ§-ºlíl¯N¨F¯Nº:·F¯§iºekæ§-©Aì)ò$¸�¯N¨�é�µ}­M¯F­<³)¯N¨Nµ ¶�·0ª�¸}µ�§iºe�HpHp�D���$n0yMm$w`pMfFt ���\�6öA�$�\�ï4clkin0e)fFc ��pMnFcld�rWm���pUv�o)e)n0cifæ�$kirWclm)klc��D���)�]�$o)fFrWm)qMcif�{�è6cif0u yMq)�lË$áMái{�ËMùMú)�

R�G>�F`=�J[@�<UB �lù��)�U� �<nFclv�oHpMf0yUuIuWpMqUrWkTpxw�kipMm)kle)fFfFclm$nVo)fFpMqMfFyMv�di�#XYêI¯N§i¨!z�k�§i©/ìz�!:·®µ�z,�%�M�)±I×�^IßMúD���>�F`JK=�=aF0@,��B�NGOy��JKv!N � JK��@���B �lù*�I�$� �$oHclklr �:kiyMnFrWp-m�yMm)t�gMcif0r �:kiyMnFrWp-m�pxw�klpMm)kie)f0fFclm$n�d0h$dFn0civ�dTrWm�����$�Tå\����m}h?¨Û§N·&z?§¹íA¦�µ íN¸`ê�V¢!Eh ÷0�lù*�I�Mø®�A�N�� NG�@���B�@���fNG � N?�@�� B�@4NGOj��?J���N��@+��B �lùMùI×$� �TmOrWmInFclqUf0yMnFrWpMm�p�wAv�p$t)clu {�kNs)clkF�IrWm$q���rWnFsyMe)nFpMv�yMnFclt�o)fFpIpxw�kNs)clkN�$rWm)q)����mPR�B���Q�=a_�F`? ��t4�W��kæ§i©/ì)ò$¸�¯N¨NÊ}é�µ`­M¯0­K³)¯®¨Nµ ¶�·Fªx¸`µ¹§iº|n pHqH�4è6pMuWe)v�cùMËUù�pxw0�4¯F·N¸`ò$¨0¯�~j§i¸�¯®°�µ¾º}kæ§-©Aì)ò$¸�¯N¨0!:·®µ}¯Nº:·F¯�÷`ï4rWclqMcU�N��cluWqMrWe)v����xe)m)c��iùMùI×Mø®�lo)o4� �M±�^Iù$á$�Û�$o)fFrWm)qMclf|{è6cif0uWyUq)�

A�JKufN?O��!Q�G�@4bcB�@ � � � N=�=HF`��@,M�B�@�NGO �}Q�Q�?�F@$��B,M�B �lù*�Mù)� �To)o)fFpMyMkNs)cld�n0p�dFo:ciklr �:klyUn0rWpMm${�)yMdFcltÌn0cid0nFrWm)q)� ��m�é kh ª!EV �0!71�¦�X �Ep�� X6êUµ¾¨0­)!)óx©/ì]§i°NµRòI© §-ºM!V§`í®¸ Z�ªx¨0¯]X:¯®°N¸`µ¾ºIñlÕ/é�º:ªx« óx°Nµ¾°0Õªxº:­8³)¯N¨Nµ ¶�·0ª�¸}µ�§iº�÷`�/clkU�:�lù��UùIøN�

A4Q��!uQ#F0@�< B �lùMùU±)����p$t)clu {�kNs)cikN�IrWm)qj���$¤�����m <UB�A�Q��!uQ�F��t4�W�Vé k6«Wªx°N°Nµ}·Fªx«= �µRº:­���W?°N°lªxóx°�µRº��§iºV§iò$¨�§`í{k�z é z � z ��§Nªx¨0¯�÷F�lùMùM±$øN�x¤�fFclm$nFrWklcN{/��yMuWu`�

A4Q��@ �UBNGOPO#Fc��J�g�Q�G�F@A B �iùMùMú)� �Te)nFpIçx��e)n0pMqUf0yMo)sH����m ��B(��=�N? � F NGO AUB�d�>?�!fNG ��t)di�W�k�§i©AìDòI¸�¯N¨NÊ`é�µ}­M¯F­�³)¯®¨Nµ ¶�·Fªx¸`µ¹§iº|n p��D�4è6pMuWe)v�c/Ë�pxw�ð�V� �é k=!�!:¯N¨Nµ`¯N°�§iº ð\µR°l·N¨0¯®¸¹¯` 8ªx¸`êI¯N©�ªx¸`µ}·®°ªxº:­�X6ê$¯Û§i¨F¯N¸`µ}·Fªx«Uk�§i©/ì)òI¸�¯®¨.!:·Nµ`¯Nº:·F¯�÷`¤�rWdFklyMnFyx��yxhU��� �$���xe)m)c��lùMùUúIøN�Ho)o4���xË$×�^]�M×xúD�]��v�clfFrWklyMm��yMnFs)clv�yMnFrWklyxu)�$pIkirWcln�hU�

Page 22: Formal Methods: State of the Art and Future Directions Edmund M

�m� � ��������� �� ��;�`�����2������9�������

A4>�F � @,D BC@,��fNG � N?�@�� B�@�NGOy��?J���N��@4��B �lùUùMß)����pIt)e)uWyMf�gMclfFr �:klyUn0rWpMm�p�w?�$å6õ²t)rWg$rWd0rWpMm4�$��mh?¨Û§N·&zA§`í�¸`êI¯��M¸`ê V®º)¸�¯N¨Nº:ªx¸`µ�§iº:ªx«4k�§iºlíl¯®¨0¯Nº:·F¯�§iº kæ§-©Aì)ò$¸�¯N¨NÊ}é�µ`­M¯F­�³)¯N¨Nµ ¶�·0ª�¸}µ�§iº6� �Te)v��:cif/�M�lúI�rWm�ïVciklnFe)f0c �TpMnFcld�rWm���pMv�o)e)nFclf��$klrWclm)kic/÷ ��e)uWh��lùMùMßIø®�Mo)o4�)�-�xËa^:�lËM±)�M�$o)fFrWm)qMclf|{�è6clfFuWyMq)�

A4>�!�!JKGQ�vHv@ bcB �lùUùMß)� ��v�clkNs)yUm)rWklyMuWu hkNs)cikN�Mclt�o)fFp$pxw�pxwjnFs)c�klpMfFfFclklnFm)cldFd�pxw�n0s)c������ ü×�:pMyUn0rWm)qx{�oHp-rWm$n4d0z$e)yMfFcTfFpIpUn�yMuWqMpMfFrWn0s)v��x�$e)�)v�rWn0nFclt4�

��R��/� �iùMùMË)�"��pMm)dFpMf0nFrWe)vKf0cizIe)rWfFclv�cimIn|d:clm)qUrWm)clclfFrWm)q�qMe)rWt)cl�HpIpM�H�Nõ4clkNs)m)rWklyUuMåTcio:pMfFn6�$¤æ�Y{�ùI�xúUßMúx{�����KgMcif0dFrWpMm�ú)�M� úMúD� úMù)�M�$pxw}n���yMfFc/¤�fFpIt)e)kin0rWg$rWn�h���pMm)dFpMfFn0rWe)v����Tcif0m)t)pMm4�Mè4�\�

�_`J���FH��@4��B2��B �lù��*�)� V®º)¸`¨Û§N­�ò]·®µ¾ºIñ�����ª2!Mì$¯0·®µ ¶�·Fªx¸`µ¹§iº �4ªxºIñxò)ªlñM¯8ªxº:­8µR¸}°j¦6§-¨N©�ªx«�!:¯N©�ªxº)¸`µ}·®°N���yMv��)fFrWt)qMc�öTm)rWgMcif0dFrWn�h�¤�fFcldFdi�]��yMv��)f0rWt)qUcM�

��x�F`vHvEF`G�@���B�@��}N?�L�N?JKN�@ M�B�@5� =�N � FHG�@ <UBC@�NGO|��?NE>G�@ � B �lùMùUß)� õ�s)c���cin0y � ùI×8clm$g$r {fFpMm)v�clm$ni����m k�§i©/ì)òI¸�¯®¨NÊ}é�µ}­M¯F­ ³)¯®¨Nµ ¶�·Fªx¸`µ¹§iº n pE�D��ï4clklnFe)fFc��TpMnFcld���pMv�o)e)nFclf��$klrWcim)klc�÷ �Tci���fFe)m)d0��rWkN�H��� �]� ��e)uWh��lùMùMßIø®�I�$o)fFrWm)qMclf|{�è6clfFu yUq)����~IoHclfFrWclm)klc�å�cloHpMf0nYw}pUf�n0s)c ��m)t)e)dFn0fFh��/yxhM�

��x�F`vHvEF`G�@���B�@ � N?EL�N?JKN�@4M�BC@2��=�N � FHG�@�< B�@���?NE>G�@$� B�@�NGO�A�F`JKx�FHG�$_`J�F � @��B �lùMùMß)����mcimIg$rWf0pUm)v�cNmIn/w`pMf�nFs)c�kif0ciyMnFrWpMmp�würWm$nFcluWuWrWqMcimIn�m)cin���pMf0�8dFclfFgIrWkicldi� ��m �!B+��B�� Q�G�!Q�?`xJK>�g ��t4�W�V®º)¸�¯N«¾« µ ñU¯Nº)¸4~�¯®¸[Z?§i¨0ë�°!�oVT~�3Mé�V�~ X:¯F·NêMºV§-« §|ñxµ}¯®°0Õ 1Yì$¯N¨0ªx¸`µ�§iº)°0Õ`!:¯N¨NÖiµ}·F¯N°0Õ�ª�º:­�é?ìMì)« µ}·Fªx¸`µ¹§iº)°�-�ék�§i©AìD¨0¯NêI¯®º)°Nµ¾Öx¯��T¯|ì]§i¨N¸/÷���s)rWklyMqMp ��ï��H�lùMùMßIø®�Mo)o4�I���Iá�^IËMúMú)�!��mIg$rWnFclt�klpMm$n0fFrW�)e)nFrWpMm:�x�TuWdFp�rWmIg$rWn0citnFpjnFs)c�é�º)º)ò]ª�« ��¯NÖiµ}¯&Zâ§`í{kæ§i©�©jò$º)µ}·Fªx¸`µ¹§-º)°N� � �æ���4�lùMùUß)�Mo)o4�Iù)�iù�^IùMËI×]�

��N?O�J[@2��B��cB�NGO���Q�=H_�FH?�@�R�B �lù��Uß)���Tm�yMe)nFpMv�yMnFyx{�nFs)cNpMf0cNnFrWkTyUo)o)f0pMyUkNs�n0p�yMe)n0pUv�yMn0rWk�o)f0p�{qMfFyMv�gMcif0r �:kiyMnFrWpMm:����mPh�¨Û§®·!zA§`í��6§�ñ�µ}·�µRº�kæ§i©/ì)ò$¸�¯N¨c!:·®µ}¯Nº:·F¯�÷0�iù��MßIø®�

� JKGL�@4��B �iù��I×$� �$o:ciklr �:klyUn0rWpMm��:fFv�dl��� gIrWdFrWpMmÌw}pMf�nFs)c�w`e)n0e)fFcM����m�h�¨N§N·F¯0¯F­xµ¾ºIñ�°ä§`í�¸`êI¯]XYêMµ¾¨0­V®º)¸�¯N¨Nº:ªx¸`µ¹§-º:ªx« ;8§i¨0ëx°Nê)§Fìô§-ºM!V§`í®¸ Z�ªx¨0¯´!MìI¯F·Nµ ¶�·0ªx¸`µ�§iºÇªxº:­�ð�¯®°Nµ ñxº1÷}ï4pMm)t)pMm4�)��e)q)���iù��I×Mø®�:o)o4��x±D�!^]�x±MËD�

/�N ��F@�R�B �lùMùI×]� �$clkif0cin0dYpxw�klyUuWu$w}pMfF��yUf0t)rWm)q)�H�<d0oHclkir �:klyMnFrWpMm�kiyMd0c/dFn0e)t)hU����moh?¨Û§®·0¯F¯0­�µ¾ºIñx°�§¹í�¸`êI¯W?µ ñ�êM¸`êoVNº)¸�¯®¨Nº:ªx¸`µ¹§iº:ªx«�VF¦�V�h kæ§iºlíi¯N¨0¯®º:·0¯�§iº¦6§i¨N©�ªx«�ð�¯N°l·®¨Nµ ì)¸`µ�§iºeX:¯F·NêMº)µ+#Nò)¯N°Tí-§-¨jð�µR°N¸`¨Nµ �Nò$¸�¯0­!)óx°N¸�¯N©�°�ª�º:­�kæ§i©�©�òIº)µ`·0ªx¸`µ�§iº)°�h?¨Û§i¸0§N·N§i« ° m ¦$14��X#W�� p`q!r�÷0�iùMùI×Mø®�)o)o4�6�-×xË�^H�lß��)�)��s)yMo)v�yMm�,��yMuWu`�

/�N ��F@ R�B4NGOl��N�u � �!Q�G�@ ��B �iùMùMß)� b�s)clfFc�t)ppUo:clfFyMnFrWpMm)d�kipMv�c�w}fFpMv�� � v�e)uWn0rWo)yUf0yMt)r qMvdFo:ciklr �:klyUn0rWpxm�nFclkNs)m)rWz$e)cM�#VTW�W,W X)¨0ªxº)°lªM·®¸`µ¹§iº)°�§iº&!V§`íN¸[Z�ªx¨0¯PW�ºIñ�µ¾º:¯F¯N¨Nµ¾ºIñ \H\M�Tá8÷/�xe)uWh)øN��×xú���^×M� �)�