1. Introduction to VDM Copyright, 2003 © Jerzy R. Nawrocki Jerzy.Nawrocki@put.poznan.pl www.cs.put.poznan.pl/jnawrocki/models/ Models and Analysis of Software Lecture 3 Models and Analysis of Software Lecture 3

2. J. Nawrocki, Models... (3) IntroductionIntroduction VDM = Vienna Development Method, IBM Laboratory Model-based: basic types (integer, real,..) and compound types (sets, sequences,..) Implicit specification (what?) and explicit one (how?). No explicit support for concurrency and time. Math & text notations. VDM VDM = Very Difficult Method

3. J. Nawrocki, Models... (3) IntroductionIntroduction add (a, b: N ) result: N post result = a + b add (a, b: N ) result: N post result = a + b Simple example It’s trivial!

4. J. Nawrocki, Models... (3) Plan of the lecture Introduction Identifiers and comments Integer numbers Boolean values Predicates Implicit functions Non-integer numbers Sequences Sets

5. J. Nawrocki, Models... (3) IdentifiersIdentifiers add (a, b: N ) result: N post result = a + b add (a, b: N ) result: N post result = a + b Letter (Letter | Digit | Greek_letter | Underscore)* Letter case is significant. First_element First_Element Value_6  First_element First_Element Value_6 

6. J. Nawrocki, Models... (3) CommentsComments -- adding two numbers add (a, b: N ) result: N post result = a + b -- adding two numbers add (a, b: N ) result: N post result = a + b annotations Author: J.R. Nawrocki Written on: March 6, 2002 end annotations add (a, b: N ) result: N post result = a + b annotations Author: J.R. Nawrocki Written on: March 6, 2002 end annotations add (a, b: N ) result: N post result = a + b I prefer double hyphen.

7. J. Nawrocki, Models... (3) Plan of the lecture Introduction Identifiers and comments Integer numbers Boolean values Predicates Implicit functions Non-integer numbers Sequences Sets

8. J. Nawrocki, Models... (3) Integer numbers Integer types N N Natural numbers (0, 1, 2,..) N1N1 N1N1 Positive integers (1, 2,..) Z Z Integers (.., -2, -1, 0, 1, 2,..)

9. J. Nawrocki, Models... (3) Operators Integer numbers a + b3 + 2 = 5 a - b5 - 2 = 3 a  b3  2 = 6 a / b6 / 4 = 1.5 a div b11 div 4 = 2 a mod b11 mod 4 = 3 a  b2  3 = 8 abs aabs -3 = 3 a + b3 + 2 = 5 a - b5 - 2 = 3 a  b3  2 = 6 a / b6 / 4 = 1.5 a div b11 div 4 = 2 a mod b11 mod 4 = 3 a  b2  3 = 8 abs aabs -3 = 3 Looks like Pascal except for ‘  ’.

10. J. Nawrocki, Models... (3) Example Integer numbers f(0) = 0 f(1) = 1 f(2) = 3 -- f(n) = 1 + 2 +.. + n f (n: N ) res: N post res = (n+1)  n / 2 -- f(n) = 1 + 2 +.. + n f (n: N ) res: N post res = (n+1)  n / 2

11. J. Nawrocki, Models... (3) Plan of the lecture Introduction Identifiers and comments Integer numbers Boolean values Predicates Implicit functions Non-integer numbers Sequences Sets

12. J. Nawrocki, Models... (3) Boolean values a = b a  b a < b a  b a > b a  b a = b a  b a < b a  b a > b a  b Relations true false true false Constants  anot a a  ba and b a  ba or b a  ba implies b a  ba equivalent to b  anot a a  ba and b a  ba or b a  ba implies b a  ba equivalent to b Boolean operators B B Boolean values

13. J. Nawrocki, Models... (3) Example Boolean values Is_CD(12, 16, 4)= true -- CD = Common Divisor -- Is k a CD for a and b? Is_CD (a, b, k: N ) res: B post res  (a mod k = 0  b mod k = 0) -- CD = Common Divisor -- Is k a CD for a and b? Is_CD (a, b, k: N ) res: B post res  (a mod k = 0  b mod k = 0)

14. J. Nawrocki, Models... (3) Plan of the lecture Introduction Identifiers and comments Integer numbers Boolean values Predicates Implicit functions Non-integer numbers Sequences Sets

15. J. Nawrocki, Models... (3) Quantifiers PredicatesPredicates   For all (universal q.)   Exists (existential q.) !! !! Exists one (unique q.)

16. J. Nawrocki, Models... (3) -- A prime number, n, is -- divisible only by 1 and n. IsPrime (n: N 1 ) res: B post res   k  N 1  (1 < k  k < n)  n mod k  0 -- A prime number, n, is -- divisible only by 1 and n. IsPrime (n: N 1 ) res: B post res   k  N 1  (1 < k  k < n)  n mod k  0 Example PredicatesPredicates That’s really different from Pascal!

17. J. Nawrocki, Models... (3) Plan of the lecture Introduction Identifiers and comments Integer numbers Boolean values Predicates Implicit functions Non-integer numbers Sequences Sets

18. J. Nawrocki, Models... (3) General form Implicit functions function_name (Ids 1 : T 1,.., Ids k : T k ) Id_r: T pre B post B’ function_name (Ids 1 : T 1,.., Ids k : T k ) Id_r: T pre B post B’ Optional pre-condition

19. J. Nawrocki, Models... (3) Example Implicit functions Quotient (-6, 2) = 3 Quotient (a, b: Z ) res: N pre b  0 post res = (abs a) div (abs b) Quotient (a, b: Z ) res: N pre b  0 post res = (abs a) div (abs b)

20. J. Nawrocki, Models... (3) Plan of the lecture Introduction Identifiers and comments Integer numbers Boolean values Predicates Implicit functions Non-integer numbers Sequences Sets

21. J. Nawrocki, Models... (3) Non-integer numbers Non-integer types Q Q Rationals (2, 1/4, 3.8,..) R R Real numbers (2.0, 3.8,  2,..)

22. J. Nawrocki, Models... (3) Operators Non-integer numbers a + b3 + 0.2 = 3.2 a - b5 - 0.2 = 4.8 a  b3.1  2 = 6.2 a / b6.0 / 4 = 1.5 a  b2.0  3 = 8.0 abs aabs -3.1 = 3.1 floor afloor 3.9 = 3 a + b3 + 0.2 = 3.2 a - b5 - 0.2 = 4.8 a  b3.1  2 = 6.2 a / b6.0 / 4 = 1.5 a  b2.0  3 = 8.0 abs aabs -3.1 = 3.1 floor afloor 3.9 = 3 Where is div and mod ?

23. J. Nawrocki, Models... (3) Example Non-integer numbers -- CV = Cuboid Volume CV (a, b, h: R ) res: R post res = a  b  h -- CV = Cuboid Volume CV (a, b, h: R ) res: R post res = a  b  h h a b

24. J. Nawrocki, Models... (3) Plan of the lecture Introduction Identifiers and comments Integer numbers Boolean values Predicates Implicit functions Non-integer numbers Sequences Sets

25. J. Nawrocki, Models... (3) SequencesSequences Type constructors T* General sequence (possibly empty) T+T+ T+T+ Non-empty sequence What is a sequence? [ 1, 5, 5, 1] First Second Third

26. J. Nawrocki, Models... (3) Operators SequencesSequences [ ]empty sequence hd Xhd [14, 15, 16] = 14 tl Xtl [14, 15, 16] = [15, 16] len Xlen [14, 15, 16] = 3 inds Xinds [14, 15, 16] = {1, 2, 3} elems Xelems [14, 15, 14] = {14, 15} X(n)[14, 15, 14](2) = 15 X(l,...,u)[14, 15, 16](2,...,3) = [15, 16] [ ]empty sequence hd Xhd [14, 15, 16] = 14 tl Xtl [14, 15, 16] = [15, 16] len Xlen [14, 15, 16] = 3 inds Xinds [14, 15, 16] = {1, 2, 3} elems Xelems [14, 15, 14] = {14, 15} X(n)[14, 15, 14](2) = 15 X(l,...,u)[14, 15, 16](2,...,3) = [15, 16]

27. J. Nawrocki, Models... (3) SequencesSequences s1 s2[6, 5] [2, 4, 9] = [6, 5, 2, 4, 9] Sequence concatenation

28. J. Nawrocki, Models... (3) Sequence comprehension SequencesSequences [ E | Id  S  Boolean_condition ] Expression Subset of R Selects a finite subset of S Evens_to_10 = [ 2  n | n  N 1  n < 6 ] Evens_to_10 = [ 2, 4, 6, 8, 10 ] Evens_to_10 = [ 2  n | n  N 1  n < 6 ] Evens_to_10 = [ 2, 4, 6, 8, 10 ]

29. J. Nawrocki, Models... (3) Example (I) SequencesSequences -- CDs = sequence of Common Divisors CDs (a, b: N 1 ) res: N 1 + post res = [k | k  N 1  a mod k = 0  b mod k = 0] -- CDs = sequence of Common Divisors CDs (a, b: N 1 ) res: N 1 + post res = [k | k  N 1  a mod k = 0  b mod k = 0]

30. J. Nawrocki, Models... (3) Example (II) SequencesSequences -- Max = maximum element of a sequence Max (s: N 1 + ) m: N 1 post (tl s = [ ]  m = hd s)  (tl s  [ ]  hd s  Max(tl s)  m = hd s)  (tl s  [ ]  hd s < Max(tl s)  m = Max(tl s)) -- Max = maximum element of a sequence Max (s: N 1 + ) m: N 1 post (tl s = [ ]  m = hd s)  (tl s  [ ]  hd s  Max(tl s)  m = hd s)  (tl s  [ ]  hd s < Max(tl s)  m = Max(tl s)) Recursion

31. J. Nawrocki, Models... (3) Example (III) SequencesSequences -- GCD = Greatest Common Divisor GCD (a,b: N 1 ) res: N 1 post res= Max (CDs (a, b)) -- GCD = Greatest Common Divisor GCD (a,b: N 1 ) res: N 1 post res= Max (CDs (a, b)) Is Max necessary? Can’t we make it simpler?

32. J. Nawrocki, Models... (3) Plan of the lecture Introduction Identifiers and comments Integer numbers Boolean values Predicates Implicit functions Non-integer numbers Sequences Sets

33. J. Nawrocki, Models... (3) B - Boolean (true, false) N 1 - positive integers (1, 2, 3,..) N - natural numbers (including 0) Z - integers Q - rationals R - reals B - Boolean (true, false) N 1 - positive integers (1, 2, 3,..) N - natural numbers (including 0) Z - integers Q - rationals R - reals SetsSets Basic sets x  BasicSet x  BasicSet Basic sets or basic types?

34. J. Nawrocki, Models... (3) T-seta finite set of values of type T SetsSets Finite sets N -seta finite set of natural numbers R -seta finite set of reals R -set-seta finite set of finite sets of reals N -seta finite set of natural numbers R -seta finite set of reals R -set-seta finite set of finite sets of reals

35. J. Nawrocki, Models... (3) {E | B 1, B 2,..., B n  Boolean_condition } SetsSets Set values { }empty set {0, 2, 4}explicit set value {2,..., 5}= {2, 3, 4, 5} {2  n | n  N  n<3}= {0, 2, 4} { }empty set {0, 2, 4}explicit set value {2,..., 5}= {2, 3, 4, 5} {2  n | n  N  n<3}= {0, 2, 4} {[a, b] | a  N, b  N  b = a  a  a  3} Only finite sets!

36. J. Nawrocki, Models... (3) SetsSets Finite set operators (I) x  Sbelongs to x  Sdoes not belong to card Scardinality of S S 1 = S 2 equals S 1  S 2 does not equal S 1  S 2 S 1 is a subset of S 2 S 1  S 2 S 1 is a proper subset of S 2 x  Sbelongs to x  Sdoes not belong to card Scardinality of S S 1 = S 2 equals S 1  S 2 does not equal S 1  S 2 S 1 is a subset of S 2 S 1  S 2 S 1 is a proper subset of S 2 Only finite sets!

37. J. Nawrocki, Models... (3) SetsSets Finite set operators (II) S 1  S 2 union S 1  S 2 intersection S 1 \ S 2 difference F S power set of S S 1  S 2 union S 1  S 2 intersection S 1 \ S 2 difference F S power set of S Only finite sets!

38. J. Nawrocki, Models... (3) SetsSets A set of decimal digits of a number k digit = {0,..., 9} digits1(k: N ) res: digit-set post res = {k mod 10}  digits1(k div 10) digit = {0,..., 9} digits1(k: N ) res: digit-set post res = {k mod 10}  digits1(k div 10) Does not work!

39. J. Nawrocki, Models... (3) SetsSets A set of decimal digits of a number k digits2(k: N ) res: digit-set post (k=0  res = { })  (k>0  res = {k mod 10}  digits2(k div 10)) digits2(k: N ) res: digit-set post (k=0  res = { })  (k>0  res = {k mod 10}  digits2(k div 10)) What if k=0? digits3(k: N ) res: digit-set post (k=0  res = { 0 })  (k>0  res = digits2(k)) digits3(k: N ) res: digit-set post (k=0  res = { 0 })  (k>0  res = digits2(k))

40. J. Nawrocki, Models... (3) SummarySummary VDM is a formal method. Its basic types are similar to those in Pascal, C,.. It contains quantifiers. Finite sequence is quite a powerful mechanism. VDM allows for recursion.

41. J. Nawrocki, Models... (3) Further readings A. Harry, Formal Methods Fact File, John Wiley & Sons, Chichester, 1996, pages 93-170. 

42. J. Nawrocki, Models... (3) HomeworkHomework Write a shorter definition of GCD. Specify the factorial. Specify the least common multiply. Specify a function that checks if n is an automorphic number (i.e. if n appears in a decimal representation of its square). Specify a total of decimal digits of a given number n.

43. J. Nawrocki, Models... (3) Quality assessment 1. What is your general impression? (1 - 6) 2. Was it too slow or too fast? 3. What important did you learn during the lecture? 4. What to improve and how?