Formal Specification and Verification of Control Software for

Microprocessor-based systems are increasingly being used to provide improved security. The t c improvements in security are often accomplished at the cost of increased complexity, as when a smar ard microprocessor replaces a simple password system for network access control. Formal methods l m are recognized as an effective means of assuring the security of systems, and have been used in severa ilitary security applications over the past 15 years [Neumann et al., 1974; Tagney et al., 1977; Feier-