Physical means of securing information, such as sealed envelopes and scratch cards, can be used to achieve cryptographic objectives, including ones that are hard or impossible by electronic means. So far, descriptions of such mechanisms have been informal, and as a consequence so has the associated reasoning. This paper3 takes a formal methods approach to these physical cryptography primitives....

This paper describes the lessons we learned over a thirteen year period while helping to develop the shutdown systems for the nuclear generating station at Darlington, Ontario, Canada. We begin with a brief description of the project and then show how we modified processes and notations developed in the academic community so that they are acceptable for use in industry. We highlight some of the...

Current research treats walkability in cities as an urban asset, to be identified by formal methods in order to let people benefit from it. In this paper, we take an activity-based view on the subject, arguing that walkability is not an end in itself but must always be seen from the standpoint of a specific activity to be performed. More precisely, we look at the specific walkability when seeki...

In this paper we review and extend the analysis of moral hazard response in two relatively unexamined empirical directions: (1) how insurance changes in one program affects employee participation in other programs at a point in time (inter-program moral hazard), and (2) how the consumption of program benefits now tends to affect employees behavior over time (benefits consumption capital). We de...

For a period starting in 2015, Apple, Google, and Microsoft became the most valuable companies in the world. Each was marked by an external developer ecosystem. Anecdotally, at least, developers matter. Using a formal model of code spillovers, we show how a rising number of developers can invert the firm. That is, firms will choose to innovate using open external contracts in preference to clos...

Formal methods may be at the crossroads of acceptance by a wider industrial community. In order for the techniques to become widely used, the gap between theorists and practitioners must be bridged e ectively. In particular, safety-critical systems o er an application area where formal methods may be engaged usefully to the bene t of all. This paper discusses some of the issues concerned with t...

Since the late 1990s voting in the Netherlands proceeds largely via voting machines. These are dedicated computers that record and store votes. These machines are under control of local governments, who put them up in voting stations on election days. These voting machines (and all new versions of them) have undergone independent evaluation before being admitted. However the internal mechanics ...

Over the past several years, a number of techniques have been developed to address various issues involving software reuse, such as component classification, retrieval, and integration. However, it is not adequate to only have reuse techniques that address reuse issues separately. Instead, a seamless integration of these reuse techniques is critical to achieve effective reuse. In this paper, we...

Formal methods may be at the crossroads of acceptance by a wider industrial community. In order for the techniques to become widely used, the gap between theorists and practitioners must be bridged eeectively. In particular, safety-critical systems ooer an application area where formal methods may be engaged usefully to the beneet of all. This paper discusses some of the issues concerned with t...