formal specifications
DESCRIPTION
Formal Specifications. Formal Methods. Formal specification is part of a more general collection of techniques that are known as ‘formal methods’ These are all based on mathematical representation and analysis of software Formal methods include Formal specification - PowerPoint PPT PresentationTRANSCRIPT
![Page 1: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/1.jpg)
Formal Specifications
![Page 2: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/2.jpg)
Formal Methods
Formal specification is part of a more general collection of techniques that are known as ‘formal methods’ These are all based on mathematical representation and analysis of software
Formal methods include– Formal specification– Specification analysis and proof– Transformational development– Program verification
![Page 3: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/3.jpg)
Acceptance of Formal Methods
Formal methods have not become mainstream software development techniques as was once predicted– Other software engineering techniques have been successful
at increasing system quality. Hence the need for formal methods has been reduced
– Market changes have made time-to-market rather than software with a low error count the key factor. Formal methods do not reduce time to market
– The scope of formal methods is limited. They are not well-suited to specifying and analyzing user interfaces and user interaction
– Formal methods are hard to scale up to large systems
![Page 4: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/4.jpg)
Use of Formal Methods Their principal benefits are in reducing the number of
errors in systems so their main area of applicability is critical systems:– Air traffic control information systems– Railway signalling systems– Spacecraft systems– Medical control systems
In this area, the use of formal methods is most likely to be cost-effective
Formal methods have limited practical applicability
![Page 5: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/5.jpg)
Specification in the Software Process Specification and design are inextricably
mixed.
Architectural design is essential to structure a specification.
Formal specifications are expressed in a mathematical notation with precisely defined vocabulary, syntax and semantics.
![Page 6: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/6.jpg)
Specification and Design
Architecturaldesign
Requirementsspecification
Requirementsdefinition
Softwarespecification
High-leveldesign
Increasing contractor involvement
Decreasing client involvement
Specification
Design
![Page 7: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/7.jpg)
Specification in the Software Process
Requirementsspecification
Formalspecification
Systemmodelling
Architecturaldesign
Requirementsdefinition
High-leveldesign
![Page 8: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/8.jpg)
Specification Techniques
Algebraic Approach– The system is specified in terms of its
operations and their relationships Model-Based Approach
– The system is specified in terms of a state model that is constructed using mathematical constructs such as sets and sequences
– Operations are defined by modifications to the system’s state
![Page 9: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/9.jpg)
Formal Specification Languages
![Page 10: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/10.jpg)
Z (“zed”) Notation
Formal specification language– most successful one -> easy to find faults, can prove correctness
Requires set theory, functions, and discrete math– also difficult to learn because of special symbols
Z specifications consists of 4 sections– given sets, data types, and constants
• sets that get defined in detail– state definition
• variable declarations & predicates that constrain values– initial state– operations
![Page 11: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/11.jpg)
Use of Formal Specification
Formal specification involves investing more effort in the early phases of software development
This reduces requirements errors as it forces a detailed analysis of the requirements
Incompleteness and inconsistencies can be discovered and resolved!!!
Hence, savings as made as the amount of rework due to requirements problems is reduced
![Page 12: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/12.jpg)
Development Costs with Formal Specification
Specification
Design andImplementation
Validation
Specification
Design andImplementation
Validation
Cost
Without formalspecification
With formalspecification
![Page 13: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/13.jpg)
Interface Specification
Large systems are decomposed into subsystems with well-defined interfaces between these subsystems
Specification of subsystem interfaces allows independent development of the different subsystems
Interfaces may be defined as abstract data types or object classes
The algebraic approach to formal specification is particularly well-suited to interface specification
![Page 14: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/14.jpg)
Sub-System Interfaces
Sub-systemA
Sub-systemB
Interfaceobjects
![Page 15: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/15.jpg)
The Structure of an Algebraic Specification
sort < name >imports < LIST OF SPECIFICATION NAMES >
Informal descr iption of the sor t and its operations
Operation signatures setting out the names and the types ofthe parameters to the operations defined over the sort
Axioms defining the operations over the sort
< SPECIFICATION NAME > (Gener ic Parameter)
introduction
description
signature
axioms
![Page 16: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/16.jpg)
Specification in Z Scenario: We maintain a membership list
and an associated phone database.[Person, Phone]|----PhoneDB-----------------------------------|members: P Person (‘set of’ person)|phones : Person Phone (relation)|-------------------------------------------------------|dom phones ⊆ members (invariant)|---------------------------------------------------
![Page 17: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/17.jpg)
Z Operation: Assign a Phone Scenario: Someone would like a phone.
(Note: Missing precondition)|----Assign-----------------------------------| p? : Person; n? : Phone| PhoneDB|-------------------------------------------------------| phone’ = phone union { p? n? }| members’ = members|---------------------------------------------------
![Page 18: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/18.jpg)
Example members {jim, sue} phones {(jim, 1231), (sue, 3956)} Assign(alice, 1231)
Cool Z property: Can calculate minimal preconditions!!
Simple analysis: Leave out preconditions and find minimum constraint to maintain invariants!
![Page 19: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/19.jpg)
Behavioural Specification
Algebraic specification can be cumbersome when the object operations are not independent of the object state
Model-based specification exposes the system state and defines the operations in terms of changes to that state
![Page 20: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/20.jpg)
Abstract State Machine Language (AsmL)
AsmL is a language for modeling the structure and behaviour of digital systems
AsmL can be used to faithfully capture the abstract structure and step-wise behaviour of any discrete systems, including very complex ones such as:Integrated circuits, software components, and devices that combine both hardware and software
![Page 21: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/21.jpg)
Abstract State An AsmL model is said to be abstract because it encodes
only those aspects of the system’s structure that affect the behaviour being modeledThe goal is to use the minimum amount of detail that accurately reproduces (or predicts) the behaviour of the system
Abstraction helps us reduce complex problems into manageable units and prevents us from getting lost in a sea of details
AsmL provides a variety of features that allow you to describe the relevant state of a system
in a very economical, high-level way
![Page 22: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/22.jpg)
Abstract State Machine and Turing Machine
An abstract state machine is a particular kind of mathematical machine, like the Turing machine (TM)
But unlike a TM, ASMs may be defined a very high level of abstraction
An easy way to understand ASMs is to see them as defining a succession of states that may follow an initial state
![Page 23: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/23.jpg)
State Transitions The behaviour of a machine (its run) can always
be depicted as a sequence of states linked by state transitions
• Moving from state A to state B is a state transition
paint in green
paint in redA B
![Page 24: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/24.jpg)
Configurations
Each state is a particular “configuration” of the machine
The state may be simple or it may be very large, with complex structure
But no matter how complex the state might be, each step of the machine’s operation can be seen as a well-defined transition from one particular state to another
![Page 25: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/25.jpg)
Evolution of State Variables
paint in green
paint in redA B
We can view any machine’s state as a dictionary of
(Name, Value) pairs, called state variables
(Colour, Red) is a variable, where “Colour” isthe name of variable, “Red” is the value
![Page 26: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/26.jpg)
Evolution of State Variables
Names are given by the machine’s symbolic vocabulary
Values are fixed elements, like numbers and strings of characters
The run of a machine is a series ofstates and state transitions that
results from applying operations to each state in succession
![Page 27: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/27.jpg)
ExampleDiagram shows the run of a machine that models how orders mightbe processed
S1
Mode = “Initial”
Orders = 0
Balance = $0
Initialise Process All Orders
S3
Mode = “Final”
Orders = 0
Balance = $500
S2
Mode = “Active”
Orders = 2
Balance = $200
Each transition operation: • can be seen as the result of invoking the machine’s
control logic on the current state • calculates the subsequence state as output
![Page 28: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/28.jpg)
Control Logic
The machine’s control logic behaves like a fix set of transition
rules that say how state may evolve
We can think of the control logic as a text that precisely specifies, for any given state, what the values of the machine’s variables will be in the following step
Typical form of the operational text is:“ if condition then update ”
![Page 29: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/29.jpg)
Control Logic as a Black Box
The two dictionaries S1 and S2 have the same set of keys, but the values associated with each variable name may differ between S1 and S2
The Machine’s Control Logic
…
if mode = “Initial”
then mode := “Active”
mode “Initial”
orders 0
balance $0
Mode “Active”
orders 2
balance $200
input
output
• The machine control logic is a black box that takes as input a state dictionary S1 and gives as output a new dictionary S2
![Page 30: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/30.jpg)
Run of the Machine The run of the machine can be seen as what happens
when the control logic is applied to each state in turn The run starts form initial state
S1 S2 S3 …S1 is given to the black box yielding S2, processing S2 results in S3,
and so on …
When no more changes to state are possible, the run is complete
![Page 31: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/31.jpg)
Update Operations We use the symbol
“: =” (reads as “gets”) to indicate the value that a name will have in the resulting state
For example: mode:=“Active”
Update can be seen only during the following step (this is in contrast to Java, C, Pascal, …)
All changes happen simultaneously, when you moving from one step to another. Then, all updates happen at once. (atomic transaction)
![Page 32: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/32.jpg)
ProgramsExample 1. Hello, world
Main()step WriteLine(“hello, world!”)
ASML uses indentations to denote block structure, and blocks can be places inside other blocks
Statement block affect the scope of variables
White space includes blanks and new-line character, ASML does not recognize tab character for indentation!!!!!!!
An operation names run() gives the top-level operational definition of the model (Main() is like main() in Java and C )
![Page 33: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/33.jpg)
Example 2. Reading a Filevar F as File? = undefvar Fcontents as String = “”var Mode as String = “Initial”Main() step until fixpoint if Mode = “Initial” then F :=open(“mfile.txt”) Mode :=“Reading”
if Mode = “Reading” and length(FContents) =0 then FContents :=fread (F,1)
if Mode = “Reading” and length(FContents) =1 then FContents := FContents + fread (F,1)
if Mode = “Reading” and length(FContents) >1 then WriteLine (FContents) Mode :=“Finished”
![Page 34: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/34.jpg)
Example 2. Graph Representation
S1
F= undef
Fcontents =“”
Mode = Initial
Step 1 Step 2
S3
F= <open file 1>
Fcontents =“a”
Mode = Reading
S2
F= <open file 1>
Fcontents =“”
Mode = Reading
S4
F= <open file 1>
Fcontents =“ab”
Mode = Reading Step 4Step5
S5
F= <open file 1>
Fcontents =“ab”
Mode = Finished
Step 3
![Page 35: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/35.jpg)
Key Points Formal system specification complements
informal specification and modeling techniques. Formal specifications are precise and
unambiguous. They remove areas of doubt in a specification, but still depend on interpretation of terms, inputs and outputs.
Formal specification forces a very detailed analysis of the system requirements at an early stage. Correcting errors at this stage is cheaper.
![Page 36: Formal Specifications](https://reader034.vdocument.in/reader034/viewer/2022042901/56814b0b550346895db82348/html5/thumbnails/36.jpg)
Key Points Formal specification techniques are most applicable in
the development of critical systems and standards. Algebraic techniques are suited to interface specification
where the interface is defined as a set of object classes. Model-based techniques model the system using sets and
functions. This simplifies some types of behavioural specification.
Its not for the faint of heart, you’ll need some special training to go down this path.