Introduction to Z Copyright, 2002 © Jerzy R. Nawrocki Models and Analysis of Software Lecture 5 Models and Analysis of Software Lecture 5

J. Nawrocki, Models &... UML and formal models ReaderAdmin Look-up Change AddRemove Use-case diagram

J. Nawrocki, Models &... UML and formal models PhoneDir Init() Add(name,no) Lookup(name): Num Delete(name) Class diagram 1

J. Nawrocki, Models &... IntroductionIntroduction Model-based: basic types (integer, real,..) and compound types (sets, sequences,..) Implicit specification (what?). No explicit specification (how?). Z resembles VDM

J. Nawrocki, Models & A prime number, n, is -- divisible only by 1 and n. IsPrime (n: N 1 ) res: B post res   k  N 1  (1 < k  k < n)  n mod k  0 -- A prime number, n, is -- divisible only by 1 and n. IsPrime (n: N 1 ) res: B post res   k  N 1  (1 < k  k < n)  n mod k  0 Quantifiers From the previous lecture.. That’s really different from Pascal!

J. Nawrocki, Models &... Pre-conditions From the previous lecture.. Quotient (-6, 2) = 3 Quotient (a, b: Z ) res: N pre b  0 post res = (abs a) div (abs b) Quotient (a, b: Z ) res: N pre b  0 post res = (abs a) div (abs b)

J. Nawrocki, Models &... Sequences (I) From the previous lecture.. -- CDs = sequence of Common Divisors CDs (a, b: N 1 ) res: N 1 + post res = [k | k  N 1  a mod k = 0  b mod k = 0] -- CDs = sequence of Common Divisors CDs (a, b: N 1 ) res: N 1 + post res = [k | k  N 1  a mod k = 0  b mod k = 0]

J. Nawrocki, Models &... Plan of the lecture From the previous lecture.. Sets Characters and strings Type invariants Records Miscellaneous

J. Nawrocki, Models &... B - Boolean (true, false) N 1 - positive integers (1, 2, 3,..) N - natural numbers (including 0) Z - integers Q - rationals R - reals B - Boolean (true, false) N 1 - positive integers (1, 2, 3,..) N - natural numbers (including 0) Z - integers Q - rationals R - reals SetsSets Basic sets x  BasicSet x  BasicSet Basic sets or basic types?

J. Nawrocki, Models &... T-seta finite set of values of type T SetsSets Finite sets N -seta finite set of natural numbers R -seta finite set of reals R -set-seta finite set of finite sets of reals N -seta finite set of natural numbers R -seta finite set of reals R -set-seta finite set of finite sets of reals

J. Nawrocki, Models &... {E | B 1, B 2,..., B n  Boolean_condition } SetsSets Set values { }empty set {0, 2, 4}explicit set value {2,..., 5}= {2, 3, 4, 5} {2  n | n  N  n<3}= {0, 2, 4} { }empty set {0, 2, 4}explicit set value {2,..., 5}= {2, 3, 4, 5} {2  n | n  N  n<3}= {0, 2, 4} {[a, b] | a  N, b  N  b = a  a  a  3} Only finite sets!

J. Nawrocki, Models &... SetsSets Finite set operators (I) x  Sbelongs to x  Sdoes not belong to card Scardinality of S S 1 = S 2 equals S 1  S 2 does not equal S 1  S 2 S 1 is a subset of S 2 S 1  S 2 S 1 is a proper subset of S 2 x  Sbelongs to x  Sdoes not belong to card Scardinality of S S 1 = S 2 equals S 1  S 2 does not equal S 1  S 2 S 1 is a subset of S 2 S 1  S 2 S 1 is a proper subset of S 2 Only finite sets!

J. Nawrocki, Models &... SetsSets Finite set operators (II) S 1  S 2 union S 1  S 2 intersection S 1 \ S 2 difference F S power set of S S 1  S 2 union S 1  S 2 intersection S 1 \ S 2 difference F S power set of S Only finite sets!

J. Nawrocki, Models &... SetsSets A set of decimal digits of a number k digit = {0,..., 9} digits1(k: N ) res: digit-set post res = {k mod 10}  digits1(k div 10) digit = {0,..., 9} digits1(k: N ) res: digit-set post res = {k mod 10}  digits1(k div 10) Does not work!

J. Nawrocki, Models &... SetsSets A set of decimal digits of a number k digits2(k: N ) res: digit-set post (k=0  res { })  (k>0  res = {k mod 10}  digits2(k div 10)) digits2(k: N ) res: digit-set post (k=0  res { })  (k>0  res = {k mod 10}  digits2(k div 10)) What if k=0? digits3(k: N ) res: digit-set post (k=0  res = { 0 })  (k>0  res = digits2(k)) digits3(k: N ) res: digit-set post (k=0  res = { 0 })  (k>0  res = digits2(k))

J. Nawrocki, Models &... Plan of the lecture From the previous lecture.. Sets Characters and strings Type invariants Records Miscellaneous

J. Nawrocki, Models &... Characters and strings char - alfanumeric characters char*- possibly empty sequence of char char+- nonempty sequence of char 'a'- a character literal "ABBA"- a string of chars (text) char - alfanumeric characters char*- possibly empty sequence of char char+- nonempty sequence of char 'a'- a character literal "ABBA"- a string of chars (text) "S. Covey" = ['S', '.', ' ', 'C', 'o', 'v', 'e', 'y'] "S. Covey"(1)= 'S' "S. Covey" = ['S', '.', ' ', 'C', 'o', 'v', 'e', 'y'] "S. Covey"(1)= 'S'

J. Nawrocki, Models &... Characters and strings -- Reversing a string of characters reverse(t: char*) res: char* post (t = [ ]  res = [ ])  (t  [ ]  res = (tl t) [hd t] -- Reversing a string of characters reverse(t: char*) res: char* post (t = [ ]  res = [ ])  (t  [ ]  res = (tl t) [hd t] Reversing a string reverse("top") = "pot"

J. Nawrocki, Models &... Characters and strings -- Reversing a string of characters reverse(t: char*) res: char* post (t = [ ]  res = [ ])  (t  [ ]  res = reverse(tl t) [hd t] -- Reversing a string of characters reverse(t: char*) res: char* post (t = [ ]  res = [ ])  (t  [ ]  res = reverse(tl t) [hd t] Reversing a string reverse("top") = "pot" Important modification

J. Nawrocki, Models &... Characters and strings Integer to text conversion d_seq= ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9'] -- Integer to text conversion i2t(i: N ) t: char + post (i=0  t="0")  (i>0  t=i2t1(i)) i2t1(i: N ) t: char * post (i=0  t= [ ])  (i>0  t=i2t1(i div 10) [d_seq(i mod )]) d_seq= ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9'] -- Integer to text conversion i2t(i: N ) t: char + post (i=0  t="0")  (i>0  t=i2t1(i)) i2t1(i: N ) t: char * post (i=0  t= [ ])  (i>0  t=i2t1(i div 10) [d_seq(i mod )]) Can’t be simpler?

J. Nawrocki, Models &... Plan of the lecture From the previous lecture.. Sets Characters and strings Type invariants Records Miscellaneous

J. Nawrocki, Models &... Type invariants Declaration of invariants Id = T inv Pattern  Boolean_condition Id = T inv Pattern  Boolean_condition Bit = N inv Bit  0  b  b  1 Bit = N inv Bit  0  b  b  1 Bit = {b | b  N  0  b  b  1} 0  b  b  1 resembles 0  b  1

J. Nawrocki, Models &... Type invariants Defining prime numbers Prime = N 1 inv Prime   i  N 1  (1<i  i<a)  a mod i  0 Prime = N 1 inv Prime   i  N 1  (1<i  i<a)  a mod i  0 is_prime(a: N 1 ) res: B post res =  i  N 1  (1<i  i<a)  a mod i  0 Prime = N 1 inv Prime  is_prime(a) is_prime(a: N 1 ) res: B post res =  i  N 1  (1<i  i<a)  a mod i  0 Prime = N 1 inv Prime  is_prime(a) More reusable and readable!

J. Nawrocki, Models &... Type invariants Using prime numbers -- Checking if every even number between a and b -- can be represented as a sum of 2 prime numbers goldbach(a,b: N 1 ) res: B pre a  b post res =  i  N 1  (a  i  i  b  i mod 2 = 0)   x,y: Prime  i= x+y -- Checking if every even number between a and b -- can be represented as a sum of 2 prime numbers goldbach(a,b: N 1 ) res: B pre a  b post res =  i  N 1  (a  i  i  b  i mod 2 = 0)   x,y: Prime  i= x+y Here the defined type is used.

J. Nawrocki, Models &... Plan of the lecture From the previous lecture.. Sets Characters and strings Type invariants Records Miscellaneous

J. Nawrocki, Models &... RecordsRecords Rec:: Field 1 : T 1 Field 2 : T 2... Field n : T n Rec:: Field 1 : T 1 Field 2 : T 2... Field n : T n Record definition Worker::FamilyN: char + FirstN: char + Hours: N Worker::FamilyN: char + FirstN: char + Hours: N ‘FamilyN’ stands for ‘Family Name’

J. Nawrocki, Models &... RecordsRecords Rec.Field Field selection WorkersFile = Worker * total_hours(w: WorkersFile) res: N post (w=[ ]  res = 0)  (w  [ ]  res = (hd w).Hours + total_hours(tl w) WorkersFile = Worker * total_hours(w: WorkersFile) res: N post (w=[ ]  res = 0)  (w  [ ]  res = (hd w).Hours + total_hours(tl w) Selecting the field ‘Hours’.

J. Nawrocki, Models &... Plan of the lecture From the previous lecture.. Sets Characters and strings Type invariants Records Miscellaneous

J. Nawrocki, Models &... UnionsUnions T 1 | T 2 Enumerated types: Signal = RED | AMBER | GREEN T 1 | T 2 Enumerated types: Signal = RED | AMBER | GREEN

J. Nawrocki, Models &... Optional types nil - absence of a value Optional type Optional type: [ ] = | nil Optional type operator Optional type operator: Expression = nil nil - absence of a value Optional type Optional type: [ ] = | nil Optional type operator Optional type operator: Expression = nil if next(P) = nil..  | nil or  [ ]  | nil or  [ ]

J. Nawrocki, Models &... Explicit functions func_name: T 1 x T 2 x.. x T n  T func_name(Id 1, Id 2,.., Id n )  E pre B func_name: T 1 x T 2 x.. x T n  T func_name(Id 1, Id 2,.., Id n )  E pre B max: x x  max (x, y, z)  if (y  x)  (z  x) then x elseif (x  y)  (z  y) then y else z max: x x  max (x, y, z)  if (y  x)  (z  x) then x elseif (x  y)  (z  y) then y else z

J. Nawrocki, Models &... Polymorphic functions max max (x, y, z)  if (y  x)  (z  x) then x elseif (x  y)  (z  y) then y else z max max (x, y, z)  if (y  x)  (z  x) then x elseif (x  y)  (z  y) then y else z result = max [ ] (1, 2, 3) result = max [ ] (1.1, 2.2, 3.3)

J. Nawrocki, Models &... StateState state Id of field_list inv invariant_definition init initialisation end state Id of field_list inv invariant_definition init initialisation end state maximum of max: init mk_maximum(m)  m=0 end state maximum of max: init mk_maximum(m)  m=0 end

J. Nawrocki, Models &... StateState state Id of field_list inv invariant_definition init initialisation end state Id of field_list inv invariant_definition init initialisation end state aircraft of speed: height: inv mk_aircraft(-,h)  (h  0.0) init mk_aircraft(s,h)  (s=0.0)  (h= 0.0) end state aircraft of speed: height: inv mk_aircraft(-,h)  (h  0.0) init mk_aircraft(s,h)  (s=0.0)  (h= 0.0) end Another example

J. Nawrocki, Models &... Implicit operations Op_name (Id 1 : T 1,.., Id k :T k ) Id r : T r ext Access_vars pre B post B’ Op_name (Id 1 : T 1,.., Id k :T k ) Id r : T r ext Access_vars pre B post B’ Access_vars: rd or wr prefix MAX3() ext rd x, y, z: wr max: post (x  max)  (y  max)  (z  max)  (max  {x, y, z}) MAX3() ext rd x, y, z: wr max: post (x  max)  (y  max)  (z  max)  (max  {x, y, z})

J. Nawrocki, Models &... Implicit operations Old state: variable  Old state: variable  MAX_NUM(n: ) ext wr max: post (n  max)  (max = max   max = n) MAX_NUM(n: ) ext wr max: post (n  max)  (max = max   max = n)

J. Nawrocki, Models &... Error definitions PUT_YEAR(year: ) ext wr yr: pre year  1994 post yr = year errs yr2dXIX: 94  year  year  99  yr= year+1900 yr2dXX: year < 94  yr = year+2000 PUT_YEAR(year: ) ext wr yr: pre year  1994 post yr = year errs yr2dXIX: 94  year  year  99  yr= year+1900 yr2dXX: year < 94  yr = year+2000

J. Nawrocki, Models &... Explicit operations OPER_NAME: T 1 x.. x T n  T OPER_NAME (Id 1, Id 2,.., Id n )  Expression pre B OPER_NAME: T 1 x.. x T n  T OPER_NAME (Id 1, Id 2,.., Id n )  Expression pre B o MAX_NUM:  () MAX_NUM (n)  if max < n then max:= n else skip MAX_NUM:  () MAX_NUM (n)  if max < n then max:= n else skip o

J. Nawrocki, Models &... ConditionalsConditionals if B 1 then ES 1 elseif B 2 then ES 2... elseif B n then ES n else ES if B 1 then ES 1 elseif B 2 then ES 2... elseif B n then ES n else ES cases E s : P 1  ES 1... P n  ES n others  ES end cases E s : P 1  ES 1... P n  ES n others  ES end

J. Nawrocki, Models &... Iteration statements for Id= E 1 to E 2 by Inc do St for Id in Sq do St for Id in reverse Sq do St for all Id  E do St while B do St

J. Nawrocki, Models &... SummarySummary Finite sets. Character string = sequence. Type invariants allow to define quite complicated types (e.g. prime numbers). Records allow do specify database-like computations.

J. Nawrocki, Models &... HomeworkHomework Specify a function digit 5 that returns a sequence of decimal digits of a number k (see functions digits3 and digits2). Specify an example of a function that would be an implementation of a JOIN operation in a relational database. Specify a polymorphic projection and selection operation.

J. Nawrocki, Models &... Further readings A. Harry, Formal Methods Fact File, John Wiley & Sons, Chichester, 

J. Nawrocki, Models &... Quality assessment 1. What is your general impression? (1 - 6) 2. Was it too slow or too fast? 3. What important did you learn during the lecture? 4. What to improve and how?