iSAQB® FM - Formal Methods

Some systems fail in ways that wreck hardware, expose sensitive data or get money wrong. For those systems the iSAQB FM module gathers the mathematical techniques that settle whether a property holds. You work on logic, on specification languages such as Isabelle/HOL, TLA+ and Alloy, and on judging where the effort pays off. The iSAQB mandates one worked example, so you see the techniques applied end to end at least once.

iSAQB Accredited Training PartnerAttendance certificate4.8/5 on ProvenExpert

What this module delivers.

Where an architecture review returns a judgement, FM returns a machine-checked proof. In the tecnovy training you specify critical properties formally and verify them with model checkers, proof assistants and SMT solvers. Correctness becomes provable, not asserted.

How the training runs

Method: Running proofs on the tools, working one example end to end
Basis: Official iSAQB curriculum FM 2024.1-rev2, English only
Outcome: 30 credit points: 10 methodical, 20 technical, no course exam

Dates & booking

Choose a date that fits

2 dates

Sessions with this symbol offer up to 25% group discount. Click “Details & Registration” to learn more.

Oct 2026 1 date

05–07 Oct 2026CEST

Mon–Wed 09:00–17:00

Germany Group Discount

City Hamburg

Language German

Trainer MS Dr. Michael Sperber

Seats 5+ seats

10% Earlybird Discount

~~2,669 $~~−267 $2,402 $

excl. VAT

Nov – Dec 2026 1 date

30–02 Nov – Dec 2026CET

Mon–Wed 09:00–17:00

Online training Group Discount

Time zone CET

Language German

Trainer MS Dr. Michael Sperber

Seats 5+ seats

10% Earlybird Discount

~~2,311 $~~−232 $2,079 $

excl. VAT

Fit

Who this module is designed for

Typical roles

You own parts of a system whose misbehaviour endangers people, money or data.
You have to evidence correctness where test coverage does not carry the proof.
You decide which verification techniques enter a project toolchain.

Prerequisites

No prerequisites

You can start right away. What you need: basic knowledge of algebra and logic. Helpful: experience with functional programming, familiarity with programming-language semantics.

Consider instead FUNAR Puts 600 of its 1080 minutes into functional modelling and macro architecture, and gets there without proof assistants or model checkers.

Curriculum

CPSA® FM Course in Detail

Curriculum 2024.1-rev2 splits FM into five parts across 1080 teaching minutes, 415 of them practice. It starts at logic, runs through specification languages and the place of formal methods in the development process to the tools, and closes on a fully worked example. The iSAQB publishes this curriculum in English only.

01Logic

This part fixes the language every later guarantee is written in.

Propositional logic: syntax, semantics, normal forms, decidability
First-order predicate logic with quantifiers, skolemization and substitution
Temporal operators and the difference between LTL and CTL
Calculi: natural deduction, sequent calculus, resolution

02Specification and Implementation

This is where the specification everything is later proved against gets written.

Examples, properties, formal and mechanized specification set apart
Specifications for functions, data types, algorithms and whole systems
Specifying qualities such as functionality, performance efficiency, security and safety
Isabelle/HOL, ACL2, TLA+ and Alloy, plus the notion of refinement

03Formal Methods and the Development Process

The shortest part answers the most expensive question: where the effort pays off.

The SPE model as a grid for how precisely software is specified
Weighing expressiveness against effort and the qualification a method demands
Entering gradually through static typing and property-based testing
Architecture evaluation with SMT/SAT solving and abstract interpretation

04Tools

Half of it is practice: 150 of the 300 minutes are hands-on tool work.

Property-based testing, and what type systems up to dependent types guarantee
Model checking over finite automata, BDDs, CTL and PLTL
Proof assistants and SMT solvers for arbitrary software systems
Abstract interpretation as a static prediction of dynamic behaviour

05Examples

To close, one complete example is worked through instead of more talk about techniques.

At least one worked example is mandatory in every licensed course
180 minutes, 60 of them practice time
The iSAQB deliberately does not prescribe the type or structure of the examples
They may follow the systems and interests of the participants

Official syllabus

Outcome

What you will be able to do afterwards

01
You state critical system properties in propositional and predicate logic instead of prose.
02
You compare Isabelle/HOL, ACL2, TLA+ and Alloy by expressiveness and effort.
03
You use the SPE model to determine which parts of a system are open to formal methods.
04
You partition a system so that component properties compose into system properties.
05
You introduce formal methods gradually through static typing and property-based testing.
06
You verify properties of finite automata through model checking.
07
You translate project requirements into proof obligations for a proof assistant.
08
You check constraints of a software system with SMT solvers.

Credit points toward CPSA-A

Methodical competence: 10
Technical competence: 20
Communicative competence: 0

30 of 70 points toward CPSA-A admission

Open the Credit Planner iSAQB Board → Credit point rules Guide →

Certificate of participation

The tecnovy certificate of participation records your attendance of the FM training, not a passed examination.

Open the Certificate Showroom tecnovy →

≥80%attendance

Trainers

Dr. Michael Sperber

iSAQB®

Why tecnovy

What you get on top with us

iSAQB® Accredited Provider

We are an officially accredited Training Provider of the International Software Architecture Qualification Board.

Certificate Showroom

Get your certificate of participation and, if you have one, add your exam certificate from E-Learning. Fully automated, beautifully designed. Just for you, only at tecnovy.

No Slideshow, Hands-On!

Promised: no PowerPoint marathon. We work in groups, tie theory to practice, and you get real project examples from our experienced trainers plus the exchange with like-minded people.

Attend Twice, Pay Once

You are welcome to attend the training online again within a year as a refresher.

Learn from Experts

We always guarantee you the use of didactically and methodically first-class qualified trainers who draw their knowledge from training experience as well as professional practical and project experience.

Flexible Date Change

If you are not able to attend the course, you can rebook your training free of charge up to one week before the start of the training.

FAQs

Frequently asked questions

01Do I need CPSA-F to attend the tecnovy FM training?

No. The iSAQB curriculum for the FM module names basic knowledge of algebra and logic as prerequisites, not a certification. For the later CPSA-A certification, CPSA-F is mandatory.

02Is there an FM examination?

No. There is no examination for the FM module. The tecnovy FM training earns you 30 credit points and a certificate of participation; the assessment comes later on the path to CPSA-A certification and covers all modules together.

03How many credit points does FM carry?

FM earns you 30 credit points in the tecnovy training, split into 20 technical and 10 methodical. The communicative area stays at zero, which you should plan around: CPSA-A admission requires 70 points in total and at least 10 in each of the three areas of competence. The iSAQB may re-evaluate point allocations every 12 months; these figures are as of August 2026.

04How does the CPSA-A certification work?

CPSA-A certification consists of a written assignment. Two examiners recognised by the iSAQB assess it, and you then defend it in discussion with them. You can take it in German or English, and tecnovy is glad to help if you have questions about the process.

05How long is the FM training?

The tecnovy FM training runs for three days. The iSAQB curriculum sets a minimum of three days and 1080 teaching minutes, which is 18 hours, spread across five parts. 415 of those minutes are set aside as practice time.

06What is the difference between FM and FUNAR?

FM establishes properties of a system using logic, proof assistants, model checkers and SMT solvers. FUNAR designs systems functionally and spends 600 of its 1080 minutes on functional modelling and macro architecture, with no proof tooling at all. Both modules carry the same 30 credit points at 20 technical to 10 methodical, so the points decide nothing for you.

07How much mathematics does FM require?

You should bring basic knowledge of algebra and logic; the iSAQB curriculum for the FM module asks for nothing beyond that. The 180 minutes of the first part build the logic up together, from propositional logic through predicate logic to temporal operators. A mathematics degree is not a prerequisite for the tecnovy FM training.

08Is FM a purely theoretical module?

No. The curriculum reserves a fifth part for worked examples and requires every licensed course to present at least one of them. Across the module 415 of the 1080 minutes are set aside as practice time, 150 of them in the Tools part alone. That fifth part is also the only one the curriculum explicitly marks as non-examinable.

09Do I get the flipcharts from the FM training?

Yes. You receive every flipchart produced during the three days of the tecnovy FM training afterwards as a photo protocol.

What does your training at tecnovy look like?

FMFM - Formal Methods

Ready for the next step?

Choose a public date or plan the course for your team.