1. ALLOY: A Formal Methods Tool Glenn Gordon Indiana University of Pennsylvania COSC 481- Formal Methods Dr. W. Oblitey 26 April 2005

2. Overview What is Alloy What is Alloy The Alloy language, how it works and syntax. The Alloy language, how it works and syntax. The Alloy Analyzer, how it works, and its use of graphics. The Alloy Analyzer, how it works, and its use of graphics. Achievements and Applications of Alloy Achievements and Applications of Alloy Advantages and Disadvantages of using Alloy Advantages and Disadvantages of using Alloy

3. What is Alloy? Alloy is tool for modeling and analyzing systems Alloy is tool for modeling and analyzing systems Alloy consists of two parts: the Alloy language and the Alloy Analyzer Alloy consists of two parts: the Alloy language and the Alloy Analyzer Daniel Jackson, a member of MIT’s Software Design Group, designed Alloy in an attempt to address certain deficiencies in the Z notation. Daniel Jackson, a member of MIT’s Software Design Group, designed Alloy in an attempt to address certain deficiencies in the Z notation.

4. The Alloy Language The Alloy language is a small modeling language that can express the basic structure of a system, as well as constraints and operations specifying how the system may change. The Alloy language is a small modeling language that can express the basic structure of a system, as well as constraints and operations specifying how the system may change. The Alloy language combines Boolean algebra, set theory, quantifiers, and first-order relational logic. The Alloy language combines Boolean algebra, set theory, quantifiers, and first-order relational logic. The Alloy language expresses statements using ASCII text characters. The Alloy language expresses statements using ASCII text characters.

5. Basics of the Alloy Language The Alloy language’s most basic structure is referred to as an atom (or scalar), which is used to express something in the real world or a basic property of a system. The Alloy language’s most basic structure is referred to as an atom (or scalar), which is used to express something in the real world or a basic property of a system. In Alloy, a group of atoms is referred to as a tuple, and a group of tuples is known as a relationship. In Alloy, a group of atoms is referred to as a tuple, and a group of tuples is known as a relationship. The syntax of the Alloy language uses several expressions to describe the use of atoms and relationships in a system. The syntax of the Alloy language uses several expressions to describe the use of atoms and relationships in a system. Some of these expressions are : signatures, facts, assertions, and functions. Some of these expressions are : signatures, facts, assertions, and functions.

6. Expressions in the Alloy Language Signatures- consist of a basic type and a set of atoms. Signatures are declared using the keyword “sig” Signatures- consist of a basic type and a set of atoms. Signatures are declared using the keyword “sig” Ex. sig Person {} Ex. sig Person {} Facts- a fact creates a restriction on relationships that limit the possible values that they may contain. Facts in Alloy are declared with the keyword “fact” Facts- a fact creates a restriction on relationships that limit the possible values that they may contain. Facts in Alloy are declared with the keyword “fact” Ex. fact {Man.spouse in Woman && Woman.spouse in Man} Ex. fact {Man.spouse in Woman && Woman.spouse in Man}

7. Expressions in Alloy cont’d Assertions- Assertions are statements that should be true about the system. Assertions serve as checks to ensure that the system is behaving correctly. Assertions in Alloy are declared using the keyword “assert” Assertions- Assertions are statements that should be true about the system. Assertions serve as checks to ensure that the system is behaving correctly. Assertions in Alloy are declared using the keyword “assert” Ex. assert ChildrenHaveParents {all p: Person | p.parents} Ex. assert ChildrenHaveParents {all p: Person | p.parents}

8. Expressions in Alloy cont’d Functions- A function is a reusable formula that applied to a set of typed parameters. Functions in Alloy are similar to those in programming languages, except that in Alloy they are used to transition from one state to another. Functions in Alloy are declared by the keyword “fun” Functions- A function is a reusable formula that applied to a set of typed parameters. Functions in Alloy are similar to those in programming languages, except that in Alloy they are used to transition from one state to another. Functions in Alloy are declared by the keyword “fun” Ex. fun BusyDay (bb: BirthdayBook, d: Date) { some cards: set Name| Remind (bb, d, cards) &&!sole cards} Ex. fun BusyDay (bb: BirthdayBook, d: Date) { some cards: set Name| Remind (bb, d, cards) &&!sole cards}

9. Operators in the Alloy Language The operators used in the Alloy language are very similar to those used in first-order logic. The operators used in the Alloy language are very similar to those used in first-order logic. There are three categories of operators used in the Alloy language: standard logical operators, quantifiers, and set operators. There are three categories of operators used in the Alloy language: standard logical operators, quantifiers, and set operators. The standard logical operators are a part of Boolean algebra. The standard logical operators are a part of Boolean algebra. These include : disjunction (a || b), conjunction (a && b), negation (!a), implication (a => b), and bi-implication (a b). These include : disjunction (a || b), conjunction (a && b), negation (!a), implication (a => b), and bi-implication (a b).

10. Operators in Alloy cont’d The quantifiers used in the Alloy language come from first-order relational logic. The quantifiers used in the Alloy language come from first-order relational logic. These include: universal (all a), existential (some a), and non-existential (no a). These include: universal (all a), existential (some a), and non-existential (no a). The standard set operators used in the Alloy language come from set theory. The standard set operators used in the Alloy language come from set theory. These include: union (a + b), intersection (a & b), difference (a – b), and membership (a in b). These include: union (a + b), intersection (a & b), difference (a – b), and membership (a in b).

11. Modules in the Alloy Language The Alloy language utilizes a simple module system to split specifications into smaller, more manageable and reusable pieces. The Alloy language utilizes a simple module system to split specifications into smaller, more manageable and reusable pieces. A specification may include the text of concepts from other files by using the appropriate modules. A specification may include the text of concepts from other files by using the appropriate modules. Module names are used for scope resolution. Module names are used for scope resolution.

12. The Alloy Analyzer The Alloy Analyzer is a tool that can be used to edit, build, and test specifications written in the Alloy language. The Alloy Analyzer is a tool that can be used to edit, build, and test specifications written in the Alloy language. The Alloy Analyzer is a GUI application that has three main sections: The Alloy Analyzer is a GUI application that has three main sections: A section for editing and modifying specifications A section for editing and modifying specifications A section for displaying information about solutions that th analyzer found A section for displaying information about solutions that th analyzer found A section that indicates information about the internal data structures used by the tool during analysis. A section that indicates information about the internal data structures used by the tool during analysis.

13. How the Alloy Analyzer Works The Alloy analyzer allows the user to edit and save their specifications and modules. The Alloy analyzer allows the user to edit and save their specifications and modules. When the user loads the specification, the Analyzer compiles it and reports run time errors. When the user loads the specification, the Analyzer compiles it and reports run time errors. Finally, the Analyzer locates any commands that exist in the specification and presents them to the user to be executed. Finally, the Analyzer locates any commands that exist in the specification and presents them to the user to be executed.

14. How the Analyzer Works cont’d. The Alloy analyzer has two commands for searching in the specification: check and run. The Alloy analyzer has two commands for searching in the specification: check and run. When the check command is given by the user, the Analyzer searches for a counter-example to the specification, which would refute the specification’s correctness. When the check command is given by the user, the Analyzer searches for a counter-example to the specification, which would refute the specification’s correctness. The run command tells the Analyzer to find an example that satisfies all of the constraints of the given specification, basically providing a simulation of the specification. The run command tells the Analyzer to find an example that satisfies all of the constraints of the given specification, basically providing a simulation of the specification.

15. Graphics in the Alloy Analyzer The Alloy Analyzer has the capabilities to present solutions in graphical format. The Alloy Analyzer has the capabilities to present solutions in graphical format. The graphical representation uses nodes to represent atoms, and lines and arrows to represent relationships between atoms. The graphical representation uses nodes to represent atoms, and lines and arrows to represent relationships between atoms. The graphical representations can be customized by selecting different colors and shapes for the nodes and different colors and fonts for the labels. The graphical representations can be customized by selecting different colors and shapes for the nodes and different colors and fonts for the labels.

16. Graphical Representation in Alloy

17. Achievements and Applications of Alloy Alloy has been taught in over a dozen graduate courses in universities in the United States, Canada, England and Italy. Alloy has been taught in over a dozen graduate courses in universities in the United States, Canada, England and Italy. Alloy has been used for analysis of many types of systems including: Alloy has been used for analysis of many types of systems including: Security systems, network protocols, file synchronizers, software architectures, distributed algorithms, and name servers. Security systems, network protocols, file synchronizers, software architectures, distributed algorithms, and name servers.

18. Advantages of Using Alloy The Alloy language is very expressive and is often very similar to the codes used in programming languages. The Alloy language is very expressive and is often very similar to the codes used in programming languages. The Alloy language will find errors in a specification that were initially overlooked, which will lead to less maintenance of the system. The Alloy language will find errors in a specification that were initially overlooked, which will lead to less maintenance of the system. Alloy produces an abstract model of a system, which will make it much easier to evolve, or expand on that system in the future. Thus, Alloy can check to ensure that new modifications of a system are compatible with its original specification. Alloy produces an abstract model of a system, which will make it much easier to evolve, or expand on that system in the future. Thus, Alloy can check to ensure that new modifications of a system are compatible with its original specification. Alloy’s use of ASCII characters makes it compatible with most computer systems. Alloy’s use of ASCII characters makes it compatible with most computer systems.

19. Advantage of Alloy cont’d. Alloy has its own Analyzer which many formal specification languages lack. Alloy has its own Analyzer which many formal specification languages lack. The counter-examples found by the Alloy Analyzer provide information about flaws in a specification, usually enough information to help determine what went wrong with the specification quickly. The counter-examples found by the Alloy Analyzer provide information about flaws in a specification, usually enough information to help determine what went wrong with the specification quickly. The Analyzer’s graphic representations can help a user to better understand and visualize the specification model. The Analyzer’s graphic representations can help a user to better understand and visualize the specification model. Alloy can be used both before the design stage of a system and in between the design and implementation stages. Alloy can be used both before the design stage of a system and in between the design and implementation stages.

20. Disadvantages of using Alloy The highly technical nature of the Alloy language makes it difficult for users who are not well-educated in mathematical languages. The highly technical nature of the Alloy language makes it difficult for users who are not well-educated in mathematical languages. Analyses in the Alloy Analyzer need to be limited to a specific scope. Analyses in the Alloy Analyzer need to be limited to a specific scope. The Analyzer’s use of counter-examples may show that a system has flaws, but it doesn’t prove that the system works properly. The Analyzer’s use of counter-examples may show that a system has flaws, but it doesn’t prove that the system works properly.

21. Any Questions?