Evaluating the effectiveness of Z: The claims made about CICS and where we go from here

There have been few genuine success stories about industrial use of formal methods. Perhaps the best known and most celebrated is the use of Z by IBM (in collaboration with Oxford University's Programming Research Group) during the development of CICS/ESA (version 3.1). This work was rewarded with the prestigious Queen's Award for Technological Achievement in 1992 and is especially notable for two reasons: 1) because it is a commercial, rather than safety- or security-critical, system and 2) because the claims made about the effectiveness of Z are quantitative as well as qualitative. The most widely publicized claims are: less than half the normal number of customer-reported errors and a 9% savings in the total development costs of the release. This paper provides an independent assessment of the effectiveness of using Z on CICS based on the set of public domain documents. Using this evidence, we believe that the case study was important and valuable, but that the quantitative claims have not been substantiated. The intellectual arguments and rationale for formal methods are attractive, but their widespread commercial use is ultimately dependent upon more convincing quantitative demonstrations of effectiveness. Despite the pioneering efforts of IBM and PRG, there is still a need for rigorous, measurement-based case studies to assess when and how the methods are most effective. We describe how future similar case studies could be improved so that the results are more rigorous and conclusive.

The development of an advanced ship evacuation simulation software product and associated large scale testing facility for the collection of human shipboard behaviour data

When designing a new passenger ship or modifying an existing design, how do we ensure that the proposed design and crew emergency procedures are safe from an evacuation point of view? In the wake of major maritime disasters such as the Herald of Free Enterprise and the Estonia and in light of the growth in the numbers of high density, high-speed ferries and large capacity cruise ships, issues concerned with the evacuation of passengers and crew at sea are receiving renewed interest. In the maritime industry, ship evacuation models offer the promise to quickly and efficiently bring evacuation considerations into the design phase, while the ship is "on the drawing board". maritimeEXODUS-winner of the BCS, CITIS and RINA awards - is such a model. Features such as the ability to realistically simulate human response to fire, the capability to model human performance in heeled orientations, a virtual reality environment that produces realistic visualisations of the modelled scenarios and with an integrated abandonment model, make maritimeEXODUS a truly unique tool for assessing the evacuation capabilities of all types of vessels under a variety of conditions. This paper describes the maritimeEXODUS model, the SHEBA facility from which data concerning passenger/crew performance in conditions of heel is derived and an example application demonstrating the models use in performing an evacuation analysis for a large passenger ship partially based on the requirements of MSC circular 1033.

Acoustic emission testing of paper

Using Acoustic Emission Testing (AET) to determine the onset of paper damage will be demonstrated on tensile coupons made from mechanical pulp. This technique is part of an EU funded project named the Fifth Frame Program. Its aim is to develop methods for determining specific damage mechanisms through AET. Various such techniques of damage detection will be demonstrated in the coming work.

Self-adaptability and man-in-the-loop: a dilemma in autonomic computing systems

This paper addresses some controversial issues relating to two main questions. Firstly, we discuss 'man-in-the loop' issues in SAACS. Some people advocate this must always be so that man's decisions can override autonomic components. In this case, the system has two subsystems - man and machine. Can we, however, have a fully autonomic machine - with no man in sight; even for short periods of time? What kinds of systems require man to always be in the loop? What is the optimum balance in self-to-human control? How do we determine the optimum? How far can we go in describing self-behaviour? How does a SAACS system handle unexpected behaviour? Secondly, what are the challenges/obstacles in testing SAACS in the context of self/human dilemma? Are there any lesson to be learned from other programmes e.g. Star-wars, aviation and space explorations? What role human factors and behavioural models play whilst in interacting with SAACS?.

Report on the Testing and Systematic Evaluation of the airEXODUS Aircraft Evacuation Model

This report covers the testing and evaluation of the airEXODUS evacuation model. airEXODUS has been developed for evacuation certification testing, crew training and aircraft design. The report demonstrates the effectiveness of the model.

Predictive reliability, prognostics and risk assessment for power modules

This paper describes a framework that is being developed for the prediction and analysis of electronics power module reliability both for qualification testing and in-service lifetime prediction. Physics of failure (PoF) reliability methodology using multi-physics high-fidelity and reduced order computer modelling, as well as numerical optimization techniques, are integrated in a dedicated computer modelling environment to meet the needs of the power module designers and manufacturers as well as end-users for both design and maintenance purposes. An example of lifetime prediction for a power module solder interconnect structure is described. Another example is the lifetime prediction of a power module for a railway traction control application. Also in the paper a combined physics of failure and data trending prognostic methodology for the health monitoring of power modules is discussed.

Start-up and running forces on bulk solids feeders: experimental findings versus available models

Many different models have been postulated over the years for sizing of feeder drives; these models have different bases, some rationally based and others more rule-of-thumb. Experience of Jenike & Johanson and likewise of The Wolfson Centre in trouble-shooting feeder drives has shown that drive powers are often poorly matched, so there is clearly still some way to go towards establishing a universally-used reliable approach. This paper presents an on-going programme of work designed to measure feeder forces experimentally on a purpose designed testing rig, and to compare these against some of the best known available models, and also against a full size installation. One aspect which is novel is the monitoring of the transition between the “filling stress field” load on the feeder and the “flowing stress field” load.

Investigation into a modular rule-based testing method for testing business rules in scheduling applications

Rule testing in transport scheduling is a complex and potentially costly business problem. This paper proposes an automated method for the rule-based testing of business rules using the extensible Markup Language for rule representation and transportation. A compiled approach to rule execution is also proposed for performance-critical scheduling systems.