GemClassifier, a formally developed smart card

In a previous paper [Lan-00] we explained that smart cards could be the ideal domain for applying formal methods. We said that the need of formal methods has three origins: mastering the complexity of the new operating systems, certifying at a high level a part of the smart card and reducing the cost of the test. We believed that these reasons were enough to introduce formal methods in the software live cycle. Unfortunately the efforts for integrating data and behavior in a same framework for generating automatically test cases, have not yet been successful. For the certification, the certification obtained by Multos (ITSEC EAL 6) did not encourage the other smart card manufacturers to propose high level certification. If certification helps to introduce formal methods it will be just as a side effect. Finally it was the complexity of the operating systems and the need to avoid vulnerabilities that initiated the GemClassifier smart card development.