Formal Modelling and Simulation in the Development of a Security-critical Message Processing System

This paper describes an experiment evaluating the application of formal tech niques to the modelling and development of a security critical system to high IT SEC levels of assurance The experiment has been done in a commercial envi ronment by engineers working within an existing development process Two in dependent teams of engineers in British Aerospace have been concurrently devel oping a message processing system a trusted gateway Both teams use CASE technology Yourdon with Ward Mellor s extensions supported by requirements traceability tools but one team additionally uses the formal speci cation language VDM SL Tool support is available for both the CASE techniques and VDM SL In this paper we consider the merits of various forms of speci cation of the trusted gateway emphasising the value of validating the speci cation by using it as a direct simulation of the system