1. VDM-SL Case Study Learning Outcomes At the end of this lecture you should be able to: Analyse and informally specify a complete system using UML class diagrams; Develop a formal VDM specification from an informal UML specification. Rigorously interrogate a formal specification

2. The Requirements Definition The software is expected to be able to do the following: create a new account; remove an existing account; record a deposit transaction; record a withdrawal transaction; update the personal details (name, address and so on) of a customer's account; change the overdraft limit associated with an account; produce a statement of transactions associated with an account; display the balance of an account; display the personal details of an account.

3. The UML specification AccountSys accounts : Account [*] addAccount (AccNum, Details, Real) removeAccount (AccNum) deposit(AccNum, Date, Real) withdraw(AccNum, Date, Real) changeDetails(AccNum, Details) changeLimit(AccNum, Real) getAllTransactions(AccNum) : Transaction [*] getBalance(AccNum): Real getAccount(AccNum) : Account getDetails(AccNum) : Details getLimit(AccNum): Real getAllAccounts() : Account [*] contains(AccNum) : Boolean isEmpty() : Boolean getTotal() : Integer

4. Additional types: The Account type Account number: AccNum details : Details balance: Real limit : Real transactions: Transaction [*]

5. Additional types: The Transaction type Transaction date: Date type: TransactionType amount: Real

6. Additional types: The TransactionType type <<enumeration>> TransactionType withdrawal deposit

7. Formally specifying the types in VDM-SL: types AccNum = TOKEN Date = TOKEN Details = TOKEN TransactonType = < withdrawal >|< deposit >

8. Transaction::date : Date amount :  transactionType : TransactionType inv mk-Transaction(-,a,-)  a > 0

9. Account::number : AccNum details : Details balance :  limit :  transactions : Transaction* inv mk-Account(-,-,b,l,t)  l ≥ 0  b ≥ -l  balanceOf(t) = b limit is non-negative balance within limit balance matches transactions

10. Formally specifying the state in VDM-SL state AccountSys of accounts : inv mk-AccountSys(a)  account numbers in domain also in range AccountAccNum init mk-AccountSys(a)  a = {  } end  num  dom a  num = a(num).number

11. Auxiliary functions: balanceOf balanceOf( transIn : Transactions* ) total :  pre true postlet dep = [ transIn(i).amount | i  inds transIn  transIn(i).transactionType = ] inlet withd = [ transIn(i).amount | i  inds transIn  transIn(i).transactionType = ] in total = sum(dep) - sum(withd) ?? ? ?? ? ? ?? true

12. Auxiliary functions: sum sum :  *   sum(seqIn)  if seqIn = [ ] then 0 else hd seqIn + sum(tl seqIn)

13. Operation specifications: addAccount addAccount() ext pre post numberIn : AccNum, detailsIn : Details, limitIn :  AccountAccNum wr {numberIn  mk-Account(numberIn, detailsIn, 0, limitIn, []} accounts =  numberIn  dom accounts  limitIn  0 accounts:

14. Operation specifications: removeAccount removeAccount( ) ext pre post numberIn : AccNum AccountAccNum wr accounts = {numberIn } numberIn  dom accounts accounts:

15. Operation specifications: deposit deposit() ext pre post numberIn : AccNum, dateIn : Date, amountIn :  AccountAccNum wr let bal = ( (numberIn)).balance in let trans = ( (numberIn)).transactions in let newTrans = mk-Transaction(dateIn, amountIn,< deposit>) in accounts = † {numberIn   ( (numberIn), balance  bal + amountIn, transactions  trans ^ [newTrans])} numberIn  dom accounts  amountIn > 0 accounts:

16. Operation specifications: withdraw withdraw() ext pre post numberIn : AccNum, dateIn : Date, amountIn :  AccountAccNum wr let bal = ( (numberIn)).balance in let trans = ( (numberIn)).transactions in let newTrans = mk-Transaction(dateIn, amountIn,< withdrawal >) in accounts = † {numberIn   ( (numberIn), balance  bal - amountIn, transactions  trans ^ [newTrans])} numberIn  dom accounts  amountIn > 0  (accounts(numberIn)).balance - amountIn ≥ - (accounts(numberIn)).limit accounts:

17. Operation specifications: changeDetails changeDetails() ext pre post numberIn : AccNum, detailsIn : Details AccountAccNum wr accounts = † {numberIn   ( (numberIn), details  detailsIn)} numberIn  dom accounts accounts:

18. Operation specifications: changeLimit changeLimit( ) ext pre post numberIn : AccNum, limitIn :  AccountAccNum wr accounts = † {numberIn   ( (numberIn), limit  limitIn)} numberIn  dom accounts  limitIn  0  accounts(numberIn).balance  - limitIn accounts:

19. Operation specifications: getDetails getDetails( ) ext pre post numberIn : AccNumdetailsOut : Details AccountAccNum rd detailsOut = (accounts(numberIn)).details numberIn  dom accounts accounts:

20. Operation specifications: getBalance getBalance( ) ext pre post numberIn : AccNumbalanceOut :  AccountAccNum rd balanceOut = (accounts(numberIn)).balance numberIn  dom accounts accounts:

21. Operation specifications: getLimit getLimit( ) ext pre post numberIn : AccNumlimitOut :  AccountAccNum rd limitOut = (accounts(numberIn)).limit numberIn  dom accounts accounts:

22. Operation specifications: getAllTransactions getAllTransactions( ) ext pre post numberIn : AccNumtransactionsOut : Transaction* AccountAccNum rd transactionsOut = (accounts(numberIn)).transactions numberIn  dom accounts accounts:

23. Operation specifications: contains contains( ) ext pre post numberIn : AccNumquery :  AccountAccNum rd query  numberIn  dom accounts TRUE accounts:

24. Operation specifications: isEmpty isEmpty( ) ext pre post query :  AccountAccNum rd query  accounts = {  } TRUE accounts:

25. Operation specifications: getTotal getTotal( ) ext pre post totalOut :  AccountAccNum rd totalOut = card dom accounts TRUE accounts:

26. Rigorously checking specifications One of the advantages of formal specifications is that they can ‘tested’ before an implementation is developed. Informal Specification Formal Specification CODE Test

27. “If I create a new account with an overdraft limit of £200, I will not be allowed to withdraw £300 until after more money has been deposited.” Example addAccount (AccNum, Details, Real) removeAccount (AccNum) deposit(AccNum, Date, Real) withdraw(AccNum, Date, Real) changeDetails(AccNum, Details) changeLimit(AccNum, Real) getAllTransactions(AccNum) : Transaction [*] getBalance(AccNum): Real getAccount(AccNum) : Account getDetails(AccNum) : Details getLimit(AccNum): Real getAllAccounts() : Account [*] contains(AccNum) : Boolean isEmpty() : Boolean getTotal() : Integer

28. “If I create a new account with an overdraft limit of £200, I will not be allowed to withdraw £300 until after more money has been deposited.” Example addAccount ( AccNum, Details, Real ) ; withdraw( AccNum, Date, Real ); 001200 001300

29. addAccount() ext pre post numberIn : AccNum, detailsIn : Details, limitIn :  AccountAccNum wr { numberIn  mk-Account( numberIn, detailsIn, 0, limitIn, []} accounts =  numberIn  dom accounts  limitIn  0 accounts: withdraw() ext pre numberIn : AccNum, dateIn : Date, amountIn :  AccountAccNum wr numberIn  dom accounts  amountIn > 0  (accounts(numberIn)).balance - amountIn ≥ - (accounts(numberIn)).limit accounts: 001 200 001 300 200