How can a design be checked without the machine?

With formal methods, applied to the design rather than to the code or the built machine.

In general terms — this describes the family of techniques, not a promise about any one engagement:

• The states and transitions written in a design are put into a form that can be handled mathematically.
• A machine then examines the combinations of states that can occur, including orderings nobody thought to try.
• If a path exists along which a safety condition breaks, that path comes back as a concrete sequence of events — a counterexample. Not a warning: a reproduction procedure.

How this differs from testing

Testing checks the range that was tried. “We tested, and it did not occur” is the absence of an observation. “The state cannot be reached” is the absence of the event. The two answer different questions, and one does not replace the other.

What it needs

A design artefact that already exists. The detailed design already states what states the machine has, in what order it moves, and under what conditions the interlocks engage. No hardware is required.

Where it sits

It is a layer above the tools that build models. Existing modelling tools, the PLC toolchain and in-house design management stay as they are.

Human-readable versions: What is the difference between testing and formal methods? · What a counterexample is

Back to the question list.