Overview over the Project 1 Structure of Quest

The software development project Quest provides tools to build correct software, especially for embedded systems. It connects the CASE-tool AutoFocus to the formal development tool VSE II, and the model checker SMV. To increase quality of non-formally developed programs a test environment is realized, containing a connection to the test-case classiication tool CTE. Proving the correctness of the emergency closing system of a storm surge barrier is a running example within the project Quest. The project Quest is carried out for the German \Bundesamt f ur Sicherheit in der Informationstechnik" (BSI). One of the main tasks of the BSI is to increase the assurance and trustworthiness of security and safety critical systems. Therefore the aim of the project Quest is to enrich the practical software development process by the coupling existing methods and tools using formal techniques in order to ensure the correctness of critical parts of systems. For the development of large systems a scalable concept is required. To achieve this goal we choose hierarchical, graphical description techniques (supported by CASE-tools) and a compositional logic with theorem prover support. For small systems model checkers can be used to verify critical properties automatically. The combination with traditional software engineering methods is achieved by speciication-based test methods to generate test-cases for non-critical components. The tools developed within Quest translate the graphical concepts into a logical formalism and systematically generate test-cases. To support an integrated , iterative development process a graphical visualization of some formulas is planned by retranslating them to the CASE-tool. The main phases of the project Quest are: the analysis phase, where the tools AutoFocus (CASE-tool), VSE II (theorem prover), SMV (model checker) and CTE (test case assistant) have been selected, the design phases, where the translation concepts have been xed, and the implementation phase where the translators are realized and integrated into the tools. Quest started out at 1.10.1997 and will end at 30.9.1999. The project Quest and also this paper are structured into four parts: the connection from AutoFocus to VSE II, the connection from