Industrial Perspective. From an industrial perspective, we claim that our approach can add value to techniques that use co-simulation tools alone. For one, our experience is that once a co-simulation model has been developed, the construction of the archi- tectural model in Isabelle/HOL is mostly straightforward, and fundamentally automatable from the INTO-SysML diagram: merely knowledge about inter- nal direct dependencies has to be provided by the engineer. Well-formedness proofs of the architectural model can moreover be fully automated, using the tactics that we have presented in Section 5 and selecting one of the two strategies for discharging caveats about the control graph. Reasoning about the behavioural FMI model is more challenging, and does require expertise and knowledge in formal modelling and theorem proving. However, our results show that a cleanly developed co-simulation model translates more easily into a mechanised model. The fact that we only have to consider relational computations limits expertise to being familiar with state-based verification methods and laws. A basic knowledge in Isabelle/UTP and the refinement calculus [29] ought, in practice, suffice to formulate the abstract co-simulation model. For proof, we have to elicit and prove suitable invariants of the FMUs in order to val- idate, for instance, holistic and safety properties. Despite this, there are ways to aid the formal engineer in writing those models and conducting the proofs. For instance, the centralised FMU state is partially derivable from the INTO-SysML model; and bespoke tactics for Hoare logic turn out useful to subdivide and structure proofs. Finding local FMU invariants adds value to the analysis, as it helps the engineer to understand the assumptions and commitments that are made by various parts of the system (FMUs). The last step in the proof is the refinement into a continuous model. Tech- niques of data refinement are applicable here out-of-the-box. Once again, it is universally acknowledged that refinement is a human-driven process, though, in certain cases, it can be automated with high-level tactics and strategies. Automation typically requires the specification and target to be of a particular known shape. There exist various examples in the literature of refinement strategies that profit from well-defined target models [31, 38, 27], and our reactive model of an FMI co-simulation in INTO-CPS Deliverable D2.3c satisfies this property, too.
Industrial Perspective. Although a technical and academic success, XMOS does not plan to integrate the formal ISA model into its existing design flow. The company has, however, al- lowed it to be published as open-source: it has been made available on the website of the EU industrial formal methods project “Deploy”, and XMOS’s own open- source website. This approach has stimulated comment and questions in the forum of XMOS’s tech-savvy customer developers. Thus, the model will be further main- tained and developed by the academic and industrial communities, and the possi- bility exists for its uptake in the future, when tools and model are more mature and resource is available. Such an approach is possible for the ISA of the machine as this is the lowest level of functionality intended for the public domain, and contrasts with the highly proprietary nature of its micro-architectural implementation.
