Chapter 40 — Verification laboratory II

Chapter 40 — Verification laboratory II

Lesson map

Lesson 40 published. Map, example, EX118.

flowchart TD
  N0["Learning outcomes"]
  N1["40.1 Combined methods"]
  N2["40.2 Comparing evidence"]
  N3["40.3 Verification report"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX118"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["40.1 Combined methods"]
  N2["40.2 Comparing evidence"]
  N3["40.3 Verification report"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX118"]

[Learning outcomes]
    |
    v
[40.1 Combined methods]
    |
    v
[40.2 Comparing evidence]
    |
    v
[40.3 Verification report]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX118]

Learning outcomes

You will (1) verify the whole system with combined methods; (2) compare evidence across methods; (3) produce a verification report.

40.1 Combined methods

In the second verification laboratory, Jonas brings together methods: unit and property tests, invariant replay of three months of test-network logs, role policy checks, reconciliation, end-to-end tests, the external review and monitoring records. The EthTrust specification notes that thorough evaluation uses multiple approaches, each finding different issues. Jonas maps each requirement to the methods that verified it, looking for requirements covered by only one method or none. He builds the mapping as a simple table in the repository, with each cell naming the evidence file, so assessors can follow any requirement to its proof.

40.2 Comparing evidence

The mapping shows that minting controls are verified by five methods, transfer correctness by four, and governance by three. Redemption reporting is verified only by end-to-end tests. Jonas adds a reconciliation of redemption reports against burn events, which immediately finds one day where a report was generated twice due to a scheduler retry. Comparing evidence across methods shows where verification is thin and exposes issues that a single method would miss. The duplicate is fixed and a test is added so the scheduler cannot generate a second report for the same day.

40.3 Verification report

Jonas writes a verification report: scope, methods, coverage by requirement, findings and their resolution, residual risks and limitations. He states that verification shows the system meets its requirements under tested conditions, not that it is free of defects, echoing the EthTrust statement that no review can guarantee security against all vulnerabilities. Dr Nwosu and the board accept the report as evidence for the production decision. The report lists each residual risk with its owner and planned treatment, and it is stored with the dossier so assessors and future reviewers can see what was and was not verified.

Worked example

Coverage mapping shows redemption reporting verified by only one method; a new reconciliation finds a duplicated report; a verification report states residual risks.

Synthetic case. Methods, findings and reports are synthetic; EEA EthTrust is a real source.

Errors and limits

Relying on a single verification method leaves requirements weakly checked.

Exercises

• EX118 — Thin coverage. Which requirement had only one method? Rubric: 3 = redemption reporting;; 2 = redemption;; 1 = minting;; 0 = none.
• EX119 — New finding. What did the new reconciliation find? Rubric: 3 = a report generated twice by a scheduler retry;; 2 = duplicate;; 1 = vague;; 0 = none.
• EX120 — Report claim. What does the report claim? Rubric: 3 = requirements met under tested conditions, not defect-free;; 2 = bounded;; 1 = perfect;; 0 = none.

Synthesis

Combining methods and mapping coverage gives honest, well-supported verification.

Continue studying — chapter 40 of 50

← Chapter 39 (draft) · Course chapter index · Chapter 41 (draft) →