Jim Woodcock, Susan Stepney, David Cooper, John A. Clark, Jeremy L. Jacob.
The certification of the Mondex electronic purse to ITSEC Level E6.

Formal Aspects of Computing 20(1):5-19, 2008


Ten years ago the Mondex electronic purse was certified to ITSEC Level E6, the highest level of assurance for secure systems. This involved building formal models in the Z notation, linking them with refinement, and proving that they correctly implement the required security properties. The work has been revived recently as a pilot project for the international Grand Challenge in Verified Software. This paper records the history of the original project and gives an overview of the formal models and proofs used.

More on the

  author = "Jim Woodcock and Susan Stepney and David Cooper
           and John A. Clark and Jeremy L. Jacob",
  title = "The certification of the {M}ondex electronic purse to {ITSEC} Level {E6}",
  journal  = "Formal Aspects of Computing",
  volume = 20,
  number = 1,
  pages = "5--19",
  year = 2008