th FM 2009, the 16 International Symposium on Formal Methods, marked the 10th an- versary of the First World Congress on Formal Methods that was held in 1999 in Toulouse, France. We wished to celebrate this by advertising and organizing FM 2009 as the Second World Congress in the FM series, aiming to once again bring together the formal methods communities from all over the world. The statistics displayed in the table on the next page include the number of countries represented by the Programme Committee members, as well as of the authors of submitted and accepted papers. Novel this year was a special track on tools and industrial applications. Subm- sions of papers on these topics were especially encouraged, but not given any special treatment. (It was just as hard to get a special track paper accepted as any other paper.) What we did promote, however, was a discussion of how originality, contri- tion, and soundness should be judged for these papers. The following questions were used by our Programme Committee.

Increasing the designer's con dence that a piece of software or hardwareis c- pliant with its speci cation has become a key objective in the design process for software and hardware systems. Many approaches to reaching this goal have been developed, including rigorous speci cation, formal veri cation, automated validation, and testing. Finite-state model checking, as it is supported by the explicit-state model checkerSPIN, is enjoying a constantly increasingpopularity in automated property validation of concurrent, message based systems. SPIN has been in large parts implemented and is being maintained by Gerard Ho- mann, and is freely available via ftp fromnetlib.bell-labs.comor from URL http: //cm.bell-labs.com/cm/cs/what/spin/Man/README.html. The beauty of nite-state model checking lies in the possibility of building \push-button" validation tools. When the state space is nite, the state-space traversal will eventually terminate with a de nite verdict on the property that is being validated. Equally helpful is the fact that in case the property is inv- idated the model checker will return a counterexample, a feature that greatly facilitates fault identi cation. On the downside, the time it takes to obtain a verdict may be very long if the state space is large and the type of properties that can be validated is restricted to a logic of rather limited expressiveness.

Why would you read this preface? As we start thinking what to write here, we wonder who is going to read these words. Fromourperspective-thatofwritersaddressinganaudienceofreaders-you are most likely Willem-Paul de Roever. Willem: our main motivation in putting together this Festschrift is to honor you on the occasion of your retirement. In terms of scienti?c ancestry, you are a father to two of us, and a grandfather to 1 the third , and you have had a profound impact on our formation as computer scientists.Atthepersonallevel,weknowyouasakind-hearted,generousperson. We are grateful to know you in these ways, and hope to have encounters with you in many years to come. AnotherlikelypossibilityisthatyouareCorinneorJojanneke,wifeordau- ter of Willem; the two strong pillars on which so much in his life is founded. You share the honor,respect, and love that went into the writing, as will be ackno- edged by those contributing authors that know you - which are almost all. Also, we would like to thank you for your help in sending us photographs for inclusion in this book, and for your encouragement. The next option is that you are one of the contributing authors. In this case you may wonder why it took us so long to get this work published. After all, wasn'tit"almostdone"alreadyattheretirementeventinJuly2008?Theanswer is twofold: we gave everyone ample time to revise their submissions in line with the recommendations by the referees; and we ourselves took ample time to put everything together. Our hope is that this will be visible in the quality of the ?nal result.