When applying formal verification to a system that interacts with the real world, we must use a model of the environment. This model represents an abstraction of the actual environment, so it is necessarily incomplete and hence presents an issue for system verification. If the actual environment matches the model, then the verification is correct; however, if the environment falls outside the abstraction captured by the model, then we cannot guarantee that the system is well behaved. A solution to this problem consists in exploiting the model of the environment used for statically verifying the system’s behaviour and, if the verification succeeds, using it also for validating the model against the real environment via runtime verification. The article discusses this approach and demonstrates its feasibility by presenting its implementation on top of a framework integrating the Agent Java PathFinder model checker. A high-level Domain Specific Language is used to model the environment in a user-friendly way; the latter is then compiled to trace expressions for both static formal verification and runtime verification. To evaluate our approach, we apply it to two different case studies: an autonomous cruise control system and a simulation of the Mars Curiosity rover.

中文翻译：

---

迈向自主认知系统验证和确认的整体方法

在将形式验证应用于与现实世界交互的系统时，我们必须使用模型的环境。这个模型代表了一个抽象实际环境，所以它必然是不完整的，因此提出了系统验证的问题。如果实际环境与模型匹配，则验证正确；但是，如果环境不在模型捕获的抽象范围内，则我们无法保证系统运行良好。该问题的解决方案在于利用用于静态验证系统行为的环境模型，如果验证成功，则还使用它通过运行时验证针对真实环境验证模型。本文讨论了这种方法并通过在集成了 Agent Java PathFinder 模型检查器的框架之上展示其实现来展示其可行性。使用高级领域特定语言以用户友好的方式对环境进行建模；然后编译后者以跟踪静态形式验证和运行时验证的表达式。为了评估我们的方法，我们将其应用于两个不同的案例研究：自主巡航控制系统和好奇号火星探测器的模拟。