Formal Techniques (CS340 © John C. Knight 2004) Dependable Computing Formal Techniques Formal Techniques (CS340 © John C. Knight 2004) CS551/651 Fall 2003

Formal Techniques Syntax Checking Formal Specification Type Checking Analysis is possible because of mathematical semantics Formal specification uses a formal language with mathematical semantics Syntax Checking Type Checking Putative Theorems Formal Specification Establish useful properties of the specification Formal Techniques (CS340 © John C. Knight 2004)

Formal Techniques Formal Specification Direct Synthesis Correctness by construction Formal Specification Direct Synthesis Code Create software by a synthesis process Correctness the result of correct synthesis Formal Techniques (CS340 © John C. Knight 2004)

Formal Techniques Formal Specification Design & Code Refinement/Proof Correctness by construction Design & Code Refinement/Proof Create software by a series of refinements Prove that each refinement is correct Design & Code Refinement/Proof Code Formal Techniques (CS340 © John C. Knight 2004)

Formal Techniques (CS340 © John C. Knight 2004) Formal Specification Correctness by chance Correctness proof Conventional Design And Code Formal Verification Correctness Proof Code Proof of partial correctness Proof of total correctness Correctness? Formal Techniques (CS340 © John C. Knight 2004)

Formal Techniques Formal Specification Model Checking Syntax Checking Analysis is possible because of mathematical semantics Model Checking Syntax Checking Type Checking Putative Theorems Formal specification uses a formal language with mathematical semantics Correctness by construction Formal Specification Direct Synthesis Code Correctness by construction Design & Code Refinement/Proof Code Correctness proof Formal Verification Correctness Proof Code Conventional Design And Code Correctness by chance Formal Techniques (CS340 © John C. Knight 2004)

Notations For Formal Specification Any notation with precise semantics can be used Formalism typically applied to just part of a specification Notations often use discrete mathematics, some with graphics Several notations are sometimes used in the same specification: Z or VDM for data manipulation Statecharts for system states and transitions Natural language for non-functional specifications Formal Techniques (CS340 © John C. Knight 2004)

Formal Techniques (CS340 © John C. Knight 2004) Formal Specification There are lots of good notations, e.g.: PVS Statecharts Z SCR RSML Larch Experimental case studies have been quite positive but techniques not perfect Formal Techniques (CS340 © John C. Knight 2004)

Formal Techniques (CS340 © John C. Knight 2004) Formal Specification Goals of formal specification: Complete, consistent, concise, unambiguous specifications Valid specifications—state exactly what the user wants Specifications based on formal semantic model Formal semantics permit dependable communication between all parties Case studies of use are very positive Formal Techniques (CS340 © John C. Knight 2004)

Formal Techniques (CS340 © John C. Knight 2004) Formal Specification High-level language programs are just specifications! So this stuff should be familiar Declarative: Statement of the desired effect on system state Procedural: Statement of desired actions and their sequence Major approaches—declarative: Model-based specification Axiomatic specification Formal Techniques (CS340 © John C. Knight 2004)

Model-Based Specification Literally Build A Model Of The System You Want Components: System State Sets and functions State Changes Pre- & Post Conditions Predicate Calculus This is why and where discrete math comes in A model-based specification is much like a program But a model-based specification is NOT a procedural program Formal Techniques (CS340 © John C. Knight 2004)

Model-Based Specifications State Description (Sets, relations, etc) Invariants (Predicate Calculus) Operation Name & Pre/Post Condx REALLY Important REALLY Important (Pred Calculus) Pre Condition What Has To Be True Before An Operation Can Be Applied Post Condition What Has To Be True After An Operation Is Applied Formal Techniques (CS340 © John C. Knight 2004)

Formal Techniques (CS340 © John C. Knight 2004) Z—Pronounced “Zed” Notation for model-based specification Similar to many other notations, e.g.: PVS VDM Using Z as an example, principles apply to other notations Z relatively popular, especially in Europe (see range of textbooks) Formal Techniques (CS340 © John C. Knight 2004)

Simple Z Example Simple Telephone Database (A. Diller) Add User System State Set of users, map from names to numbers Add User (Pre- And Post-Conditions) Change No. (Pre- And Post-Conditions) Formal Techniques (CS340 © John C. Knight 2004)

Formal Techniques (CS340 © John C. Knight 2004) Simple Z Example Given sets State schema—set and relation Simple invariant Formal Techniques (CS340 © John C. Knight 2004)

Formal Techniques (CS340 © John C. Knight 2004) Simple Z Example Before and after state Pre- and post-conditions Operation schema, one of many Formal Techniques (CS340 © John C. Knight 2004)

Some Other Z Components Functions Sequences Bags Schema calculus: Decoration Inclusion Composition Logical expressions Precondition analysis Formal Techniques (CS340 © John C. Knight 2004)

Formal Techniques (CS340 © John C. Knight 2004) Statecharts Developed for specifying reactive systems Graphic! Overall, its VERY clever stuff First introduced in mid 1980’s Developed by David Harel at the Weizmann institute Original application was avionics for Lavi fighter, Israeli Aircraft Industries Formal Techniques (CS340 © John C. Knight 2004)

Formal Techniques (CS340 © John C. Knight 2004) Statecharts Very Popular In U.S. Industry—Most Used “Formal” Technique Supported By Powerful Toolset: Statemate (iLogix, Inc) Adapted By Other Notations, E.g. RSML Incorporated Wholesale Into Others, E.g. UML Many Extensions Developed Formal Techniques (CS340 © John C. Knight 2004)

Part of Harel’s Stopwatch Formal Techniques (CS340 © John C. Knight 2004)

Basic States, State Transitions, Initial State States A, B, C Transitions r, s, t, u s(Y) Means Event s And Condition Y True Unlabeled Arc Represents Initial Transition (Entry To Initial State) Formal Techniques (CS340 © John C. Knight 2004)

Clustering And Refinement State D Is A Cluster—A State That Has Substates Cluster is XOR—System Will Be In State A Or B, Not Both Transition u Has Been Unified Formal Techniques (CS340 © John C. Knight 2004)

State Transition Example “a” and “d” are watch buttons Complex idea stated simply, easily, precisely Formal Techniques (CS340 © John C. Knight 2004)

Formal Techniques (CS340 © John C. Knight 2004) Orthogonality Dashed Line Reads “AND”—Exactly One State From Each Side Examples: D & A, D & B, D & C, E & B Formal Techniques (CS340 © John C. Knight 2004)

Part of Harel’s Stopwatch (Again) Formal Techniques (CS340 © John C. Knight 2004)