View
222
Download
2
Tags:
Embed Size (px)
Citation preview
© 2003, 2004 - Dr. Ernest Cachia
Formal Specification
A Very First Acquaintance
© 2003, 2004 - Dr. Ernest Cachia Slide: 2
What is Formal Specification
The application of set theory, propositional and predicate calculi to the specification of systems.
© 2003, 2004 - Dr. Ernest Cachia Slide: 3
Sets
Are collections of elements Are represented by standard notation Are manipulated by standard elementary
operations Are entities which can interact with each
other
© 2003, 2004 - Dr. Ernest Cachia Slide: 4
Examples of Sets
Notation: { } Set of colours: {green,blue,yellow} Set of sports: {tennis,football,
equestrian} Set of
BCIS SEM tutors: {ernest} Empty set: { } or
© 2003, 2004 - Dr. Ernest Cachia Slide: 5
Set Construction
{ : | }set range condition operation In notational form (aka comprehensive specification):
{Signature | Predicate • Term}
)}()(|:{ xExPXx
Direct (as in previous slide) Operations on other sets according to the form:
The resulting set whose elements are formed by the operation on elements selected by the condition from the original set with elements from range.
Translates to…
© 2003, 2004 - Dr. Ernest Cachia Slide: 6
Set Construction Examples
Alternate even numbers:
{ x : N | x mod 2 = 0 ∙ 2 * x } = {0,4,8,12,16,20,…} Tens:
{ x : N | x ∙ 10 * x } = {0,10,20,30,40,…} Squares of multiples of 4 (excluding zero):
{ x : Z | (x mod 4 = 0) (x > 0) ∙ x * x }
= {16,64,144,256,…}
© 2003, 2004 - Dr. Ernest Cachia Slide: 7
Some Set-Based Specification Exercises
Write 3 elements from the sets specified by the following comprehensive specifications:
{n : N | n < 20 n > 10 • n} {n : N | n3 > 10 • n} {x,y : N | x + y = 100 • (x,y)} {x,y : N | x + y = 5 • x2 + y2}
Interpret the following: {m : monitors | MonitorState(m, on) • m} {f : SysFiles | f DelFiles f ArcFiles • f}
Write the comprehensive specification of:{(10,100),(11,121),(12,144),(13,169),(14,196)}
© 2003, 2004 - Dr. Ernest Cachia Slide: 8
Set Operators Operator list in NCC slide and handout (notes). Examples:
Mosta {Maltese towns} London {Maltese towns} #{joe,veronica,mark} = 3 {paul,richard,claire,george} {Group B} IP{milan,juve} = { { },{milan},{juve},{milan,juve} } {dobie,collie,poodle} {poodle,labrador} =
{dobie,collie,poodle,labrador} {dobie,collie,poodle} {poodle,labrador} = {poodle} {dobie,collie,poodle} \ {poodle,labrador} = {dobie,collie}
© 2003, 2004 - Dr. Ernest Cachia Slide: 9
Propositional Calculus
Deals with logic Basically consists of statements which can be
true or false (Excluded Middle Law) Are mutually exclusive - never true or false at
the same time (Contradiction Law) Is fundamental Is axiomatic In theory, can be used to describe anything
© 2003, 2004 - Dr. Ernest Cachia Slide: 10
Proposition (and not) Examples Some birds can fly The nation Malta is in Asia Dogs are mammals All fish live in water All fish live in sea water Monique is the only lady in our group Cikku qatt ma jgorr
Sit down. How are you today? Get my tea, please. What is the weather like?
ARE
ARE NOT
© 2003, 2004 - Dr. Ernest Cachia Slide: 11
Representing Propositions
Consider the following… 10 is greater than 8 8 is less than 10 8 < 10 10 > 8 There is a positive number such that if we
add it to eight the result would be ten.
All the above are one and the same proposition
© 2003, 2004 - Dr. Ernest Cachia Slide: 12
Propositional Calculus Notation
Please refer to the R. Pressman textbook, or any other Software Engineering textbook containing basic formal specification, for a
listing of basic propositional operators.
© 2003, 2004 - Dr. Ernest Cachia Slide: 13
Examples to Discuss
(( ) )
(( ) )
( ( ))
(( ) ( ) ( )) ( )
P Q Q
P Q R P
P P Q P
P Q R S P R Q S
Taking:P as trueQ as falseR as falseS as true
Answers:1. TRUE2. FALSE3. FALSE4. FALSE
Click again for answers…
© 2003, 2004 - Dr. Ernest Cachia Slide: 14
Contradictions and Tautologies A contradiction is a proposition that is always
false for all possible values and variables making it up
A tautology is a proposition that is always true for all possible values and variables making it up
Examples:
contradiction
tautology
( ) ( ) tautology
a a
a a
a b c c a
© 2003, 2004 - Dr. Ernest Cachia Slide: 15
De Morgan’s Laws
( )
( )
P Q P Q
P Q P Q
The above can be summarised (in Maltese) as follows:
Jekk mhux abjad u iswed (it-tnejn me]udin f’daqqa) ifisser li mhuxabjad jew mhux iswed. Mentri, jekk mhux abjad jew iswed (l-ebdawa]da minnhom) ifisser li mhux abjad u mhux iswed.
…g]a[nuha ftit f’mo]]kom!
© 2003, 2004 - Dr. Ernest Cachia Slide: 16
Specifying with PropositionsConsider the following text:The system is in alert state only when it is waiting for an intruder and is on practice alert.alert waiting practice
If the system is in teaching mode and is on practice alert, then it is in alert state.teaching practice alert
The system will be in teaching mode and on practice alert and not waiting for an intruder.teaching practice ¬ alert
Therefore…
© 2003, 2004 - Dr. Ernest Cachia Slide: 17
Detecting ContradictionsFrom the previous system:alert waiting practiceteaching practice alertteaching practice ¬alertThe second and third propositions yield a contradiction:teaching practice alertteaching practice ¬alertalert ¬alert …contradiction!The first proposition yields another contradiction:
teaching practice ¬(waiting practice) eventually simplifies to…
alert ¬waiting …contradiction because alert requires waiting!
© 2003, 2004 - Dr. Ernest Cachia Slide: 18
Predicate Calculus Can be viewed as conditional statements
obeying propositional behaviour with specific values.
Consider a triangle… We can say the following…1. Any side will be greater than zero length;2. The sum of the length of any two sides will
be greater than the length of the remaining side. Therefore…
ab
c
© 2003, 2004 - Dr. Ernest Cachia Slide: 19
Predicate Calculus Example (clarified from NCC material)
0 0 0a b c a b c b c a a c b
In predicate calculus form the basic properties of a trianglecould be written as follows:
Property 1 Property 2
© 2003, 2004 - Dr. Ernest Cachia Slide: 20
Consider This Statement
Fido is a dog, dogs like bones so Fido likes bones.Propositional analysis of this sentence yields:Fido is a dog (propos. 1) PDogs like bones (propos. 2) QFido likes bones (propos. 3) R
Can we derive R from P and Q using only propositional calculus? – No!
Therefore…
© 2003, 2004 - Dr. Ernest Cachia Slide: 21
We Introduce “A Predicate”
Formally a predicate can be seen as direct indicators of object properties.
Examples of unary predicates:
dog(fido) =true;
dog(lecturer) =false Examples of n-ary predicates:
father(john,mary)
team(pawlu,bertu,`ensu)
© 2003, 2004 - Dr. Ernest Cachia Slide: 22
A More Familiar Predicate Form
Consider the predicates:
numerically_bigger_than(x,y)
are_equal(a,b)
Can be written as…
x > y
a = b
© 2003, 2004 - Dr. Ernest Cachia Slide: 23
Quantification
Places bounds on free variables (i.e. names of objects)
( )
( ) ( )
P x
x P x x P x
Is a unary predicate
Are propositions
1. There exists an object ‘x’ to which the predicate ‘P(x)’ applies.2. For all objects ‘x’, the predicate ‘P(x)’ applies.
© 2003, 2004 - Dr. Ernest Cachia Slide: 24
Quantification Examples2:1..10 64
: ( , )
: 10
: ( , )
:1..100; :
( , )
:
i i
proc processors ProcessorState proc active
i i MonitorTemp i
m AllocatedMonitors MonState m ready
i m AllocatedMonitors
activity m functioning AmbientTemp i
r CurrentReac
; :
( , ) ( , )
tors m AllocatedMonitors
MonState m functioning connected r m
© 2003, 2004 - Dr. Ernest Cachia Slide: 25
Say the Following in Natural Language (loosely adopted from Behforooz, A.)
, ,
10 100
,
, {1,2,3,4} {1,2,3,4}
, {1,2,3,4} {1,2,3,4}
~ ( ) ~ ~
0
0 0 0
x y z x y y z x z
x x x y
x y N x y N
x y x y
x y x y x y
p q p q
x y x y
x y x y
All numeric values x, y, and z forwhich x is greater than y and y is greater than z, x is greater than z
There exists a numeric value x, such that either x is greater than 10 or for some value y the sum of x and y is less than 100
If x and y are natural numbers, then x+y is also a natural number
There exist x and y from the set {1,2,3,4} such that the sum of x and y is also a member of the set {1,2,3,4}
For all values x and y from the set {1,2,3,4} for which x is greater than y, the difference between x and y is also an element of the set {1,2,3,4}
The complement (negation of) two logical AND-ed values is the same as the complement of each OR-ed value
The numeric value x is greater than y if and only if the difference between x and y is positiveIf the sum of x and y is positive, it cannot be concluded that both x and y are positive
© 2003, 2004 - Dr. Ernest Cachia Slide: 26
Algebraic Specifications
A specification technique mainly used for abstract data types
Based on a strong mathematical foundation – namely algebra
Have been in use for relatively long periods of time
Are universal in their application Employ fundamental principles
© 2003, 2004 - Dr. Ernest Cachia Slide: 27
Building Algebraic Specifications Clearly comprehend the system to model Determine the operations necessary for the
system you have in mind Specify the relationship between the system’s
operations Write the specification down according to
adopted standard (a popular standard is the Common Algebraic Specification Language – CASL)
© 2003, 2004 - Dr. Ernest Cachia Slide: 28
Algebraic Specification Queue Example (1/2) (loosely adopted from Pressman, R. S.)
A message queue:Operations: add an item [AddItem]
remove an item [RemItem]check if empty [IsEmpty]get first queue item [GetFirst]get last item [GetLast]create a new queue [Create]
© 2003, 2004 - Dr. Ernest Cachia Slide: 29
Algebraic Specification Example (2/2) (loosely adopted from Pressman, R. S.)
Type: queue(Z)Imports: Boolean
Signatures:Create queue(Z)AddItem(Z,queue(Z)) queue(Z)RemItem(Z,queue(Z)) queue(Z)GetFirst(queue(Z)) ZGetLast(queue(Z)) ZIsEmpty(queue(Z)) Boolean
Axioms:IsEmpty(Create)=trueIsEmpty(AddItem(z,q))=falseRemItem(AddItem(z,q),q)=qGetLast(AddItem(z,q))=zGetFirst(AddItem(z,Create)=z
© 2003, 2004 - Dr. Ernest Cachia Slide: 30
Algebraic Specification Table Example (1/4) (loosely adopted from Pressman, R. S.)
A symbol table:Operations: create a new empty table [Create]
add an item [AddItem]remove an item [RemItem]check if a symbol is in a table [InTab]join two tables [Join]get common symbols [Common]check if two tables are identical [IsEqual]check if a table is part of another [IsPartof]check is a table is empty [IsEmpty]
© 2003, 2004 - Dr. Ernest Cachia Slide: 31
Algebraic Specification Table Example (2/4) (loosely adopted from Pressman, R. S.)
Signatures:Create table(Z)AddItem(Z,table(Z)) table(Z)RemItem(Z,table(Z)) table(Z)InTab(Z,table(Z)) BooleanIsPartOf(table(Z),table(Z)) BooleanIsEqual(table(Z),table(Z)) BooleanIsEmpty(table(Z)) BooleanJoin(table(Z),table(Z)) table(Z)Common(table(Z),table(Z)) table(Z)
© 2003, 2004 - Dr. Ernest Cachia Slide: 32
Algebraic Specification Table Example (3/4) (loosely adopted from Pressman, R. S.)
Some applicable axioms (1):AddItem(s2,AddItem(s1,s))=if s1=s2 then AddItem(s1,s) else AddItem(s1,AddItem(s2,s))RemItem(s1,Create)=CreateRemItem(s1,AddItem(s2,s))=if s1=s2 then RemItem(s1,s) else AddItem(s2,RemItem(s1,s))InTab(s1,Create)=falseInTab(s1,AddItem(s2,s))=if s1=s2 then true else InTab(s1,s)Join(s,Create)=sJoin(s, AddItem(s1,t))=AddItem(s1,Join(s,t))
© 2003, 2004 - Dr. Ernest Cachia Slide: 33
Algebraic Specification Table Example (4/4) (loosely adopted from Pressman, R. S.)
Some applicable axioms (2):Common(s,Create)=CreateCommon(s,AddItem(s1,t))=if InTab(s1,s) then
AddItem(s1,common(s,t)) else common(s,t)IsPartOf(Create,s)=trueIsPartOf(AddItems(s1,s),t)=if InTab(s1,t) then
IsPartOf(s,t) else falseIsEqual(s,t)=IsPartOf(s,t)IsPartOf(t,s)IsEmpty(Create)=trueIsEmpty(AddItem(s1,t))=false
© 2003, 2004 - Dr. Ernest Cachia Slide: 34
“Club” Example
“Club” example will be discussed during lectures.
© 2003, 2004 - Dr. Ernest Cachia Slide: 35
The Z-Specification Language
Attempts to place a notational framework on formal system specification
Based on set theory Is model-based (relies on well understood
mathematical entities and their relationship) Equally used to model (specify) state as well
as operations on states
© 2003, 2004 - Dr. Ernest Cachia Slide: 36
Some Basic Z-Schema Examples (1/2)
a is a natural number and b is a set formed of naturalnumbers as shown. a is contained in b.
Note: Generically, to indicate “a set of”, the notation “P (with a hollow stem)”.E.g. b: P NLinear equivalent would be: [a:N; b:{7,1,3,24} | ab]
:
:{7,1,3,24}
a
b
a b
© 2003, 2004 - Dr. Ernest Cachia Slide: 37
Some Basic Z-Schema Examples (2/2)
, :
: P
a b
c
a c
b c
, :
: P
a b
c
a c b c
Is equivalent to…
Or linearly… , : ; : P |a b c a c b c
© 2003, 2004 - Dr. Ernest Cachia Slide: 38
Naming Schemas
:
: P
MonNo
AvailableMonitors
MonNo AvailableMonitors
MonCondition
Or…
[ : ; : P | ]
MonCondition
MonNo AvailableMonitors MonNo AvailableMonitors
© 2003, 2004 - Dr. Ernest Cachia Slide: 39
Z-Schema Decorations
Please refer to R. Pressman or other main-stream Software Engineering textbook.
© 2003, 2004 - Dr. Ernest Cachia Slide: 40
Z-Schema Conventions
Delta Denoted by the Greek literal () Used to extend the schema components to
indicate update operations, i.e. changes in state variables (updating operations).
“Xi” Denoted by the Greek literal () Used to indicate that stored data is not affected,
i.e. enquiry operations.
© 2003, 2004 - Dr. Ernest Cachia Slide: 41
Delta Convention Examples(taken from Ince)
Specify a system which will keep track of students who have handed inAssignments. There are clearly three sets involved…Class (all the students in the class)HandedIn (all the students in the class who have handed in their
assignment)NotHandedIn (all the students in the class who have not handed in their
assignment)
, , : P
', ', ' : P
Class HandedIn NotHandedIn STUDENTS
Class HandedIn NotHandedIn STUDENTS
' ' '' '
HandedIn NotHandedIn ClassHandedIn NotHandedInHandedIn NotHandedIn ClassHandedIn NotHandedIn
Assignment
© 2003, 2004 - Dr. Ernest Cachia Slide: 42
Use of a Delta Schema (based on previous example)
? :stud STUDENTS
Assignment
?' \{ ?}
' { ?}'
Stud NotHandedInNotHandedIn NotHandedIn StudHandedIn HandedIn StudClass Class
HandIn
Model the handing in of a student assignment:
© 2003, 2004 - Dr. Ernest Cachia Slide: 43
Use of a “Xi” Schema (based on previous example)
, , : P
', ', ' : P
Class HandedIn NotHandedIn STUDENTS
Class HandedIn NotHandedIn STUDENTS
''
'
NotHandedIn NotHandedInHandedIn HandedInClass Class
Assignment
Model a query for the number of students who have handed in:
Therefore:
[ !: ; | ! # ]
AssignQuery
HandedIn Assignment HandedIn HandedIn
© 2003, 2004 - Dr. Ernest Cachia Slide: 44
Schema Inclusion
A simple example of this will be presented during lectures.
© 2003, 2004 - Dr. Ernest Cachia Slide: 45
Another Schema Inclusion Example (1/2)
, , : P :
: P :
AllFiles FreeFile FilesInUse FILESFile FILESRegisteredUsers NAMESUser NAMES
\
User RegisteredUsersFile AllFilesAllFiles FreeFiles FilesInUseFreeFile AllFiles FilesInUseFreeFiles FilesInUseFreeFile FilesInUse
FileStatus
: PFileStatusInvalidUsers NAMES
User RegisteredUsersUser InvalidUsersRegisteredUsers InvalidUsers
UserStatus
© 2003, 2004 - Dr. Ernest Cachia Slide: 46
Another Schema Inclusion Example (2/2)
, , : P :
, : P :
AllFiles FreeFile FilesInUse FILESFile FILESRegisteredUser InvalidUser NAMESUser NAMES
\
User RegisteredUsersUser InvalidUsersRegisteredUsers InvalidUsersFile AllFilesAllFiles FreeFiles FilesInUseFreeFile AllFiles FilesInUseFreeFiles FilesInUseFreeFile FilesInUse
FileAndUserStatus
Results in the following schema…
© 2003, 2004 - Dr. Ernest Cachia Slide: 47
Another Schema Inclusion Example (taken from Ince)
, : P :
upper lowerMaxSize
# #upper lower MaxSize
SetInv
: P middleSetInv
middle upper lower
MidInv
The above schemas result in…
: P , : P
:
middleupper lowerMaxSize
# #middle upper lower
upper lower MaxSize
MidInv
© 2003, 2004 - Dr. Ernest Cachia Slide: 48
Practical Z-Spec Example (elevator) (taken from Ghezzi)
This example is produced as a separate MS-Word documentoffered as a separate hand-out which should be circulated with
this material.
© 2003, 2004 - Dr. Ernest Cachia Slide: 49
Sequences
Are not sets Can be viewed as collections with predefined
constraints Exist in different forms Can have operations applied to them Widespread use in computer systems
© 2003, 2004 - Dr. Ernest Cachia Slide: 50
Types of Sequences
Normal (including empty)seq
Non-emptyseq1
Injective (not containing duplicates)iseq
Therefore…
© 2003, 2004 - Dr. Ernest Cachia Slide: 51
Formal Sequence Definitions
Definitions…seq T = = { f : N T | dom f = 1 .. #f }
seq1 T = = { f : seq T | #f > 0 }
iseq T = = seq T (N T )
Some examples…E.g. of (seq N) is {13,29,3 9,4 11}
written as 3,9,9,11E.g. of (iseq files) is {1UpdateFile,2LogFile,3TaxFile}
written as UpdateFile,LogFile,TaxFile
© 2003, 2004 - Dr. Ernest Cachia Slide: 52
Sequences in Z
Examples of these will be presented during lectures.
© 2003, 2004 - Dr. Ernest Cachia Slide: 53
Sequence (in Z) Example
FileQueue
InQueue, OutQueue : seq Files
#InQueue < #OutQueue
Rentals
Pending, Overdue : seq IDMostOverdue!, SoonToBeOverdue! : ID
MostOverdue! = head OverdueSoonToBeOverdue! = head Pending
© 2003, 2004 - Dr. Ernest Cachia Slide: 54
Tippruvawa din?
Can you try to formally define the “head”, “last”, “tail”, and “front” sequence operators using a Z-schema?
[SeqOps]
head, last : seq1 SeqOps SeqOpstail, front : seq1 SeqOps seq SeqOps
s : seq1 SeqOps head s = s(1) last s = s(#s) tail s = ( n : 1 .. #s-1 s(n+1)) front s = (1 .. #s-1) s