Transforming Event B Models into Verified C# Implementations
|
|
|
- Pauline Walsh
- 7 years ago
- Views:
Transcription
1 Transforming Event B Models into Verified C# Implementations Dominique Méry (Université de Lorraine, France) Rosemary Monahan (NUI Maynooth, Ireland ) presented by Geoff Hamilton (DCU, Ireland) First International Workshop on Verification and Program Transformation July 13th and 14th, 2013, Saint Petersburg, Russia LORIA Université de Lorraine NUI Maynooth 1 / 37
2 Summary Introduction Modelling Languages Case study : the binary search problem Deriving the Recursive Program Transforming the recursive algorithm In the Spec# world Conclusion LORIA Université de Lorraine NUI Maynooth 2 / 37
3 Topics LORIA Université de Lorraine NUI Maynooth 3 / 37
4 Topics Combining the efforts of program refinement as supported by Event B and program verification as supported by the Spec# programming system. LORIA Université de Lorraine NUI Maynooth 4 / 37
5 Topics Combining the efforts of program refinement as supported by Event B and program verification as supported by the Spec# programming system. Proposing an architecture Integrated Development Framework, which induces a methodology and which improves the usability of formal verification tools for the specification, the construction and the verification of correct sequential algorithms. LORIA Université de Lorraine NUI Maynooth 5 / 37
6 Topics Combining the efforts of program refinement as supported by Event B and program verification as supported by the Spec# programming system. Proposing an architecture Integrated Development Framework, which induces a methodology and which improves the usability of formal verification tools for the specification, the construction and the verification of correct sequential algorithms. In this paper : we focus on the transformation of the final concrete specification into an executable algorithm : 1. transforming an Event B specification into a recursive algorithm 2. transforming from that recursive program to an iterative version of the same program. LORIA Université de Lorraine NUI Maynooth 6 / 37
7 Integrated Development Framework pre/post (Spec# contract) call as event PREPOST SEES CONTEXT (Event B machine) (Event B context) REFINES EXTENDS PROCESS SEES CONTROL (Event B machine) (Event B context) checking generating-algorithm ALGORITHM (Recursive Algorithm) program (Spec# program) removing recursion translating OPTIMISED ALGORITHM (Iterative Algorithm) LORIA Université de Lorraine NUI Maynooth 7 / 37
8 Event B Modelling LORIA Université de Lorraine NUI Maynooth 8 / 37
9 Event B Modelling any t where G(t, x) then x : (R(x, x, t)) end (t is a local parameter and the event actions establish x : (R(x, x, t))) ( t (G(t, x) R(x, x, t))) LORIA Université de Lorraine NUI Maynooth 9 / 37
10 Event B Modelling any t where G(t, x) then x : (R(x, x, t)) end (t is a local parameter and the event actions establish x : (R(x, x, t))) ( t (G(t, x) R(x, x, t))) LORIA Université de Lorraine NUI Maynooth 10 / 37
11 Event B Modelling any t where G(t, x) then x : (R(x, x, t)) end (t is a local parameter and the event actions establish x : (R(x, x, t))) ( t (G(t, x) R(x, x, t))) MACHINE specquare SEES square0 VARIABLES r INVARIANTS inv1 : r N EVENTS EVENT INITIALISATION begin act1 : r := 0 end EVENT square computing begin act1 : r := n n end END LORIA Université de Lorraine NUI Maynooth 11 / 37
12 Event B Modelling any t where G(t, x) then x : (R(x, x, t)) end (t is a local parameter and the event actions establish x : (R(x, x, t))) ( t (G(t, x) R(x, x, t))) MACHINE specquare SEES square0 VARIABLES r INVARIANTS inv1 : r N EVENTS EVENT INITIALISATION begin act1 : r := 0 end EVENT square computing begin act1 : r := n n end END CONTEXT square0 CONSTANTS n AXIOMS axm1 : n N END LORIA Université de Lorraine NUI Maynooth 12 / 37
13 Event B Modelling any t where G(t, x) then x : (R(x, x, t)) end (t is a local parameter and the event actions establish x : (R(x, x, t))) ( t (G(t, x) R(x, x, t))) MACHINE specquare SEES square0 VARIABLES r INVARIANTS inv1 : r N EVENTS EVENT INITIALISATION begin act1 : r := 0 end EVENT square computing begin act1 : r := n n end END CONTEXT square0 CONSTANTS n AXIOMS axm1 : n N END square0 is a context defining properties of a natural number n LORIA Université de Lorraine NUI Maynooth 13 / 37
14 Event B Modelling any t where G(t, x) then x : (R(x, x, t)) end (t is a local parameter and the event actions establish x : (R(x, x, t))) ( t (G(t, x) R(x, x, t))) MACHINE specquare SEES square0 VARIABLES r INVARIANTS inv1 : r N EVENTS EVENT INITIALISATION begin act1 : r := 0 end EVENT square computing begin act1 : r := n n end END CONTEXT square0 CONSTANTS n AXIOMS axm1 : n N END square0 is a context defining properties of a natural number n specsquare is a machine with an event square computing computing the square function for n and assigning the value to r. LORIA Université de Lorraine NUI Maynooth 14 / 37
15 Event B Modelling any t where G(t, x) then x : (R(x, x, t)) end (t is a local parameter and the event actions establish x : (R(x, x, t))) ( t (G(t, x) R(x, x, t))) MACHINE specquare SEES square0 VARIABLES r INVARIANTS inv1 : r N EVENTS EVENT INITIALISATION begin act1 : r := 0 end EVENT square computing begin act1 : r := n n end END CONTEXT square0 CONSTANTS n AXIOMS axm1 : n N END square0 is a context defining properties of a natural number n specsquare is a machine with an event square computing computing the square function for n and assigning the value to r. The SEES clause related the context and the machine. LORIA Université de Lorraine NUI Maynooth 15 / 37
16 Spec# The Spec# programming language extends C# 2.0 through a rich assertion language that allows the specification of objects through class invariants, field annotations, and method specifications. LORIA Université de Lorraine NUI Maynooth 16 / 37
17 Spec# The Spec# programming language extends C# 2.0 through a rich assertion language that allows the specification of objects through class invariants, field annotations, and method specifications. The Spec# compiler statically enforces non-null types, emits run-time checks for method contracts and invariants and records the contracts as metadata for consumption by downstream tools. LORIA Université de Lorraine NUI Maynooth 17 / 37
18 Spec# The Spec# programming language extends C# 2.0 through a rich assertion language that allows the specification of objects through class invariants, field annotations, and method specifications. The Spec# compiler statically enforces non-null types, emits run-time checks for method contracts and invariants and records the contracts as metadata for consumption by downstream tools. The Spec# static program verifier (SscBoogie) : generates logical verification conditions from a Spec# program uses an automatic reasoning engine (Z3) to analyse the verification conditions proving the correctness of the program or finding errors. LORIA Université de Lorraine NUI Maynooth 18 / 37
19 Spec# Specification : Sorting an Array public static void sortarray(int[]!st, int[]!pi) requires st!= pi && st.length == pi.length; requires forall{int i in (0:st.Length); st[i] == pi[i]}; modifies st[*]; ensures forall{int j in (1:st.Length);(st[j-1] <= st[j])}; ensures forall{int w in (0:st.Length); (count{int v in (0:st.Length);st[v] == pi[w]} == count{int u in (0:st.Length); pi[u] == pi[w]})}; LORIA Université de Lorraine NUI Maynooth 19 / 37
20 Integrated Development Framework pre/post (Spec# contract) call as event PREPOST SEES CONTEXT (Event B machine) (Event B context) REFINES EXTENDS PROCESS SEES CONTROL (Event B machine) (Event B context) checking generating-algorithm ALGORITHM (Recursive Algorithm) program (Spec# program) removing recursion translating OPTIMISED ALGORITHM (Iterative Algorithm) LORIA Université de Lorraine NUI Maynooth 20 / 37
21 Integrated Development Framework The Event B machine PREPOST contains events, which have the same contract as that expressed in the original pre/post contract. This machine SEES the Event B CONTEXT, which expresses static information about the machine. The Event B machine PROCESS refines PREPOST generating a concrete specification that satisfies the contract. This machine SEES the Event B context CONTROL, which adds control information for the new machine. The labelled actions REFINES, SEES and EXTENDS, are supported by the RODIN platform and are checked completely using the proof assistant provided by RODIN. Transformation of an Event B machine into a concrete recursive algorithm (represented by the arrow labelled generating-algorithm). Transformation of this recursive algorithm into its equivalent partially annotated and iterative algorithm (represented by the arrow labelled removing recursion). LORIA Université de Lorraine NUI Maynooth 21 / 37
22 Integrated Development Framework pre/post (Spec# contract) call as event PREPOST SEES CONTEXT (Event B machine) (Event B context) REFINES EXTENDS PROCESS SEES CONTROL (Event B machine) (Event B context) checking generating-algorithm ALGORITHM (Recursive Algorithm) program (Spec# program) removing recursion translating OPTIMISED ALGORITHM (Iterative Algorithm) LORIA Université de Lorraine NUI Maynooth 22 / 37
23 Implementing Event B models Our integrated development framework for implementing abstract Event B models brings together the strengths of the refinement based approaches and verification based approaches to software development : 1. Splitting the abstract specification to be solved into its component specifications. 2. Refining these specifications into a concrete model using Event B and the RODIN platform. 3. Transforming the concrete model into recursive and iterative algorithms that can be directly implemented as real source code. 4. Verifying the iterative algorithm in the automatic program verification environment of Spec#. ORIA Université de Lorraine NUI Maynooth 23 / 37
24 Specifying the binary search problem PROCEDURE binsearch(t, val, lo, hi, ok, result) t 0..t.Length N k.k lo..hi 1 t(k) t(k + 1) PRE val N l, h 0..t.Length ( lo hi ) ok = TRUE t(result) = val POST ok = FALSE ( i.i lo..hi t(i) val The two possible resulting calls to the procedure binsearch(t, val, lo, hi; ok, result) : EVENT find is binsearch(t, val, lo, hi; ok, result) with ok = TRUE EVENT fail is binsearch(t, val, lo, hi; ok, result) : with ok = FALSE LORIA Université de Lorraine NUI Maynooth 24 / 37
25 Events find and fail EVENT find any j where grd1 : j lo.. hi grd2 : t(j) = val then act1 : ok := TRUE act2 : i := j end EVENT fail when grd1 : k k lo.. hi t(k) val then act1 : ok := FALSE END The two events form the machine called binsearch1 (which corresponds to the PREPOST machine). The machine is refined to obtain binsearch2 (which corresponds to PROCESS). This refined machine contains a new control variable, l, which simulates how the binary search is achieved. LORIA Université de Lorraine NUI Maynooth 25 / 37
26 Refinement for Computation l = start lo = hi t(lo) = val l = start lo = hi t(lo) val ( l = start lo < hi ( m 1 m 2 ) split l = middle lo < hi mi = (lo + hi)/2 val < t(mi) l = end lo = hi ok = TRUE result = lo l = end lo = hi ok = FALSE l = middle lo < hi mi = (lo + hi)/2 l = end ok = TRUE t(result) = val rec(lo,mi 1,val,ok,result) ) LORIA Université de Lorraine NUI Maynooth 26 / 37
27 Refinement for Computation 1. l = middle lo < hi val < t(mi) rec(lo,mi 1,val,ok,result) ( l = end ok = FALSE ( i.i lo..hi t(i) val ) l = middle ( 2. lo < hi m mi = (lo + hi)/2 3 val = t(mi) ( l = middle lo < hi mi = (lo + hi)/2 val > t(mi) l = end ok = TRUE t(result) = val l = middle lo < hi mi = (lo + hi)/2 val > t(mi) ( l = end ok = TRUE result = mi rec(mi+1,hi,val,ok,result) ) rec(mi+1,hi,val,ok,result) l = end ok = FALSE ( i.i lo..hi t(i) val ) ) LORIA Université de Lorraine NUI Maynooth 27 / 37
28 Integrated Development Framework pre/post (Spec# contract) call as event PREPOST SEES CONTEXT (Event B machine) (Event B context) REFINES EXTENDS PROCESS SEES CONTROL (Event B machine) (Event B context) checking generating-algorithm ALGORITHM (Recursive Algorithm) program (Spec# program) removing recursion translating OPTIMISED ALGORITHM (Iterative Algorithm) LORIA Université de Lorraine NUI Maynooth 28 / 37
29 Case 1 :Basic Events EVENT e when l = l 1 g l1,l 2 (x) then l := l 2 x := f l1,l 2 (x) end1 If the event e is a basic event controlling the state of the variable x, guarded by g l1,l 2 (x) and modified by the assignment x := f l1,l 2 where f is a function, the event e takes the form below. the function f l1,l 2 is implementable. If the event e labels the link l 1 l 2 then the statement act l2 is defined as when g l1,l 2 (x) then x := f l1,l 2 (x). e LORIA Université de Lorraine NUI Maynooth 29 / 37
30 Case 2 : Recursive Call of the Procedure EVENT rec%proc(h(x),y)%p(y) any y when l = l 1 g l1,l 2 (x, y) then l := l 2 x := f l1,l 2 (x, y) end1 The definition of the event e is not executable and the translation is driven by instances of the control variable l in the guard (as l = l 1 ) and in the assignment (l := l 2 ). The statement act l2 is therefore defined as : PROC(h(x), y). The choice of the event name is the responsibility of the writer of the Event B models, who must identify the case corresponding to a recursive call. LORIA Université de Lorraine NUI Maynooth 30 / 37
31 Case 3 : Non Recursive Call EVENT call%aproc(h(x),y)%p(y) any y when l = l 1 g l1,l 2 (x, y) then l := l 2 x := f l1,l 2 (x, y) end1 the event e can be transformed into a call of another procedure. The call is expressed by an event e, which we name call%aproc(h(x), y)%p(y) and the statement act l2 is defined as APROC(h(x), y). APROC is defined or to be defined in another framework. LORIA Université de Lorraine NUI Maynooth 31 / 37
32 Integrated Development Framework pre/post (Spec# contract) call as event PREPOST SEES CONTEXT (Event B machine) (Event B context) REFINES EXTENDS PROCESS SEES CONTROL (Event B machine) (Event B context) checking generating-algorithm ALGORITHM (Recursive Algorithm) program (Spec# program) removing recursion translating OPTIMISED ALGORITHM (Iterative Algorithm) LORIA Université de Lorraine NUI Maynooth 32 / 37
33 Problems with the recursive algorithm Correct by construction according to the Event B side Limits of the Spec# tools with verifying recursive program Transforming recursive algorithms into iterative algorithm Applying the Spec# tools LORIA Université de Lorraine NUI Maynooth 33 / 37
34 Transforming the recursive algorithm into an iterative one Theorem The transformation is sound with respect to the pre and post specification. procedure APROC(x; var y) precondition P(x) postcondition Q(x, y) begin local variables z if C(x) then y := g(x); else z := h(x, z); if D(x, z) then y := f (x, z) elseif E(x, z) then APROC(f 1(x), y) else APROC(f 2(x), y) endif end procedure BPROC(x; var y) precondition P(x) postcondition Q(x, y) begin local variables z while not C(x) not D(x, z) do z := h(x, z); if E(x, z) then x := f 1(x); else x := f 2(x); endif enddo if C(x) then y := g(x); elseif D(x, z) then y := f (x, z); elseif E(x, z) then y := f 1(x); else y := f 2(x); endif end LORIA Université de Lorraine NUI Maynooth 34 / 37
35 PROCEDURE binsearch(t,val,lo,hi,ok,result) procedure binsearch(t, val, lo, hi, ok, result) t 0..t.Length N precondition k.k lo..hi 1 t(k) t(k + 1) ( val N lo, hi 0..t.Length lo hi ) ok = TRUE t(result) = val postcondition ok = FALSE ( i.i lo..hi t(i) val begin lo = hi t(lo) = val while not lo = hi t(lo) val lo < hi mi = (lo + hi)/2 t(mi) = val mi := (lo + hi)/2; mi = (lo + hi)/2 middle : val < t(mi) k.k mi..hi t(k) val val > t(mi) k.k lo..mi t(k) val if mi + 1 hi val > t(mi) then lo := mi + 1 elseif lo mi 1 val < t(mi) then hi := mi 1 enddo if lo = hi t(lo) = val then result := lo; ok := true elseif lo = hi t(lo) val then ok := false elseif lo < hi t(mi) = val then result := mi; ok := true else ok := false endif end do LORIA Université de Lorraine NUI Maynooth 35 / 37
36 General Framework Integrated Development Framework pre/post (Spec# contract) call as event PREPOST SEES CONTEXT (Event B machine) (Event B context) REFINES EXTENDS PROCESS SEES CONTROL (Event B machine) (Event B context) checking generating-algorithm ALGORITHM (Recursive Algorithm) program (Spec# program) removing recursion translating OPTIMISED ALGORITHM (Iterative Algorithm) LORIA Université de Lorraine NUI Maynooth 36 / 37
37 Interpreting the algorithms within Spec# This is almost a one-to-one mapping : returning a value of 1 when our iterative algorithm sets OK to false and returning the index where the value is found when our iterative algorithm sets OK to true. The algorithm verified as correct, in less than 2 seconds using the Spec# programming system (version ). No user interaction is required in the verification as all assertions required (preconditions, postconditions and loop invariants) have been generated as part of the refinement and transformation of the initial abstract specification into the final iterative algorithm. Prior to formalising our transformation rules, our initial attempt at writing this iterative C# program contained an error. This error in the loop body, was due to our omission to check that the values of mi + 1 and mi 1 were within the array bounds before narrowing the search space. This error was immediately detected by the Spec# programming system. The automatic verification of the final program is available online at LORIA Université de Lorraine NUI Maynooth 37 / 37
38 Conclusion Our integrated development framework indicates where our transformations are used for producing a program that is correct-by-construction. The translation of the PROCESS machine into a recursive algorithm is straightforward and removes the control variable used to relate events when generating the code. Our experience shows that our approach assists students in developing and understanding the tasks of software specification and verification. It also makes different forms of formal software development more accessible to the Software Engineers, helping them to build correct and reliable software systems. Future work will include the development of adequate plugins, which will integrate and facilitate the co-operation between Spec# tools and Rodin tools. LORIA Université de Lorraine NUI Maynooth 38 / 37
Loop Invariants and Binary Search
Loop Invariants and Binary Search Chapter 4.3.3 and 9.3.1-1 - Outline Ø Iterative Algorithms, Assertions and Proofs of Correctness Ø Binary Search: A Case Study - 2 - Outline Ø Iterative Algorithms, Assertions
StaRVOOrS: A Tool for Combined Static and Runtime Verification of Java
StaRVOOrS: A Tool for Combined Static and Runtime Verification of Java Jesús Mauricio Chimento 1, Wolfgang Ahrendt 1, Gordon J. Pace 2, and Gerardo Schneider 3 1 Chalmers University of Technology, Sweden.
Lecture Notes on Linear Search
Lecture Notes on Linear Search 15-122: Principles of Imperative Computation Frank Pfenning Lecture 5 January 29, 2013 1 Introduction One of the fundamental and recurring problems in computer science is
Computing Concepts with Java Essentials
2008 AGI-Information Management Consultants May be used for personal purporses only or by libraries associated to dandelon.com network. Computing Concepts with Java Essentials 3rd Edition Cay Horstmann
Boogie: A Modular Reusable Verifier for Object-Oriented Programs
Boogie: A Modular Reusable Verifier for Object-Oriented Programs M. Barnett, B.E. Chang, R. DeLine, B. Jacobs, K.R.M. Leino Lorenzo Baesso ETH Zurich Motivation Abstract Domains Modular Architecture Automatic
Regression Verification: Status Report
Regression Verification: Status Report Presentation by Dennis Felsing within the Projektgruppe Formale Methoden der Softwareentwicklung 2013-12-11 1/22 Introduction How to prevent regressions in software
Binary Multiplication
Binary Multiplication Q: How do we multiply two numbers? eg. 12, 345 6, 789 111105 987600 8641500 + 74070000 83, 810, 205 10111 10101 10111 00000 1011100 0000000 + 101110000 111100011 Pad, multiply and
Lecture 9 verifying temporal logic
Basics of advanced software systems Lecture 9 verifying temporal logic formulae with SPIN 21/01/2013 1 Outline for today 1. Introduction: motivations for formal methods, use in industry 2. Developing models
Software Testing. Quality & Testing. Software Testing
Software Testing Software Testing Error: mistake made by the programmer/developer Fault: a incorrect piece of code/document (i.e., bug) Failure: result of a fault Goal of software testing: Cause failures
Investigating a File Transfer Protocol Using CSP and B
Noname manuscript No. (will be inserted by the editor) Investigating a File Transfer Protocol Using CSP and B Neil Evans, Helen Treharne Department of Computer Science, Royal Holloway, University of London
Language-Independent Model Transformation Verification K. Lano, S. Kolahdouz-Rahimi, T. Clark King s College London; University of Middlesex
Language-Independent Model Transformation Verification K. Lano, S. Kolahdouz-Rahimi, T. Clark King s College London; University of Middlesex 1 Language-independent MT verification One hinderance to MT
Formal Verification of Software
Formal Verification of Software Sabine Broda Department of Computer Science/FCUP 12 de Novembro de 2014 Sabine Broda (DCC-FCUP) Formal Verification of Software 12 de Novembro de 2014 1 / 26 Formal Verification
Simple Loop Patterns and Rich Loop Invariants
Simple Loop Patterns and Rich Loop Invariants Marc Sango AdaCore CNAM 05-10-2011 Marc Sango (AdaCore CNAM) Simple Loop Patterns and Rich Loop Invariants 05-10-2011 1 / 17 Contents 1 Motivation 2 Principle
Software Testing & Analysis (F22ST3): Static Analysis Techniques 2. Andrew Ireland
Software Testing & Analysis (F22ST3) Static Analysis Techniques Andrew Ireland School of Mathematical and Computer Science Heriot-Watt University Edinburgh Software Testing & Analysis (F22ST3): Static
Thomas Jefferson High School for Science and Technology Program of Studies Foundations of Computer Science. Unit of Study / Textbook Correlation
Thomas Jefferson High School for Science and Technology Program of Studies Foundations of Computer Science updated 03/08/2012 Unit 1: JKarel 8 weeks http://www.fcps.edu/is/pos/documents/hs/compsci.htm
Software Testing & Verification 2013/2014 Universiteit Utrecht
Software Testing & Verification 2013/2014 Universiteit Utrecht 2nd Jul. 2014, 13:30-16:30, BBL 001 Lecturer: Wishnu Prasetya You are allowed to bring along the Appendix of the LN. Part I [3pt (6 0.5)]
Section IV.1: Recursive Algorithms and Recursion Trees
Section IV.1: Recursive Algorithms and Recursion Trees Definition IV.1.1: A recursive algorithm is an algorithm that solves a problem by (1) reducing it to an instance of the same problem with smaller
Rigorous Software Engineering Hoare Logic and Design by Contracts
Rigorous Software Engineering Hoare Logic and Design by Contracts Simão Melo de Sousa RELEASE (UBI), LIACC (Porto) Computer Science Department University of Beira Interior, Portugal 2010-2011 S. Melo de
How To Write A Program Verification And Programming Book
Jose Bacelar Almeida Maria Joao Frade Jorge Sousa Pinto Simao Melo de Sousa Rigorous Software Development An Introduction to Program Verification & Springer Contents 1 Introduction 1 1.1 A Formal Approach
A Static Analyzer for Large Safety-Critical Software. Considered Programs and Semantics. Automatic Program Verification by Abstract Interpretation
PLDI 03 A Static Analyzer for Large Safety-Critical Software B. Blanchet, P. Cousot, R. Cousot, J. Feret L. Mauborgne, A. Miné, D. Monniaux,. Rival CNRS École normale supérieure École polytechnique Paris
Automated Program Behavior Analysis
Automated Program Behavior Analysis Stacy Prowell sprowell@cs.utk.edu March 2005 SQRL / SEI Motivation: Semantics Development: Most engineering designs are subjected to extensive analysis; software is
Logistics. Software Testing. Logistics. Logistics. Plan for this week. Before we begin. Project. Final exam. Questions?
Logistics Project Part 3 (block) due Sunday, Oct 30 Feedback by Monday Logistics Project Part 4 (clock variant) due Sunday, Nov 13 th Individual submission Recommended: Submit by Nov 6 th Scoring Functionality
Reasoning about Safety Critical Java
Reasoning about Safety Critical Java Chris Marriott 27 th January 2011 Motivation Safety critical systems are becoming part of everyday life Failure can potentially lead to serious consequences Verification
Rigorous Software Development CSCI-GA 3033-009
Rigorous Software Development CSCI-GA 3033-009 Instructor: Thomas Wies Spring 2013 Lecture 11 Semantics of Programming Languages Denotational Semantics Meaning of a program is defined as the mathematical
Design by Contract beyond class modelling
Design by Contract beyond class modelling Introduction Design by Contract (DbC) or Programming by Contract is an approach to designing software. It says that designers should define precise and verifiable
Specification and Analysis of Contracts Lecture 1 Introduction
Specification and Analysis of Contracts Lecture 1 Introduction Gerardo Schneider gerardo@ifi.uio.no http://folk.uio.no/gerardo/ Department of Informatics, University of Oslo SEFM School, Oct. 27 - Nov.
Constructing Contracts: Making Discrete Mathematics Relevant to Beginning Programmers
Constructing Contracts: Making Discrete Mathematics Relevant to Beginning Programmers TIMOTHY S. GEGG-HARRISON Winona State University Although computer scientists understand the importance of discrete
Effectively Using JML
Effectively Using JML Software Engineering Processes incorporating Formal Specification Joseph Kiniry University College Dublin Software Engineering Processes old-school processes CRC and state-chart based
What Is Recursion? Recursion. Binary search example postponed to end of lecture
Recursion Binary search example postponed to end of lecture What Is Recursion? Recursive call A method call in which the method being called is the same as the one making the call Direct recursion Recursion
Java 6 'th. Concepts INTERNATIONAL STUDENT VERSION. edition
Java 6 'th edition Concepts INTERNATIONAL STUDENT VERSION CONTENTS PREFACE vii SPECIAL FEATURES xxviii chapter i INTRODUCTION 1 1.1 What Is Programming? 2 J.2 The Anatomy of a Computer 3 1.3 Translating
Know or Go Practical Quest for Reliable Software
Know or Go Practical Quest for Reliable Software Dr.-Ing. Jörg Barrho Dr.-Ing. Ulrich Wünsche AVACS Project meeting 25.09.2014 2014 Rolls-Royce Power Systems AG The information in this document is the
Rigorous Software Development CSCI-GA 3033-009
Rigorous Software Development CSCI-GA 3033-009 Instructor: Thomas Wies Spring 2013 Lecture 5 Disclaimer. These notes are derived from notes originally developed by Joseph Kiniry, Gary Leavens, Erik Poll,
Software Engineering Reference Framework
Software Engineering Reference Framework Michel Chaudron, Jan Friso Groote, Kees van Hee, Kees Hemerik, Lou Somers, Tom Verhoeff. Department of Mathematics and Computer Science Eindhoven University of
National University of Ireland, Maynooth MAYNOOTH, CO. KILDARE, IRELAND. Testing Guidelines for Student Projects
National University of Ireland, Maynooth MAYNOOTH, CO. KILDARE, IRELAND. DEPARTMENT OF COMPUTER SCIENCE, TECHNICAL REPORT SERIES Testing Guidelines for Student Projects Stephen Brown and Rosemary Monahan
Compliance ow - managing the compliance of dynamic and complex processes
Loughborough University Institutional Repository Compliance ow - managing the compliance of dynamic and complex processes This item was submitted to Loughborough University's Institutional Repository by
Software Engineering Techniques
Software Engineering Techniques Low level design issues for programming-in-the-large. Software Quality Design by contract Pre- and post conditions Class invariants Ten do Ten do nots Another type of summary
Chapter 4 Software Lifecycle and Performance Analysis
Chapter 4 Software Lifecycle and Performance Analysis This chapter is aimed at illustrating performance modeling and analysis issues within the software lifecycle. After having introduced software and
UML TUTORIALS THE USE CASE MODEL
UML TUTORIALS THE USE CASE MODEL www.sparxsystems.com.au Sparx Systems 2004 Page 1/5 describes the proposed functionality of the new system. A Use Case represents a discrete unit of interaction between
A Framework for the Semantics of Behavioral Contracts
A Framework for the Semantics of Behavioral Contracts Ashley McNeile Metamaxim Ltd, 48 Brunswick Gardens, London W8 4AN, UK ashley.mcneile@metamaxim.com Abstract. Contracts have proved a powerful concept
Advances in Programming Languages
Advances in Programming Languages Lecture 13: Certifying Correctness Ian Stark School of Informatics The University of Edinburgh Tuesday 4 November 2014 Semester 1 Week 8 http://www.inf.ed.ac.uk/teaching/courses/apl
Chapter 3. Cartesian Products and Relations. 3.1 Cartesian Products
Chapter 3 Cartesian Products and Relations The material in this chapter is the first real encounter with abstraction. Relations are very general thing they are a special type of subset. After introducing
Chair of Software Engineering. Software Verification. Assertion Inference. Carlo A. Furia
Chair of Software Engineering Software Verification Assertion Inference Carlo A. Furia Proving Programs Automatically The Program Verification problem: Given: a program P and a specification S = [Pre,
Model Driven Security: Foundations, Tools, and Practice
Model Driven Security: Foundations, Tools, and Practice David Basin, Manuel Clavel, and ETH Zurich, IMDEA Software Institute Thursday 1st, 2011 Outline I 1 Models Analysis. Types. 2 The Object Constraint
The Classes P and NP
The Classes P and NP We now shift gears slightly and restrict our attention to the examination of two families of problems which are very important to computer scientists. These families constitute the
Department of Computing Science and Mathematics University of Stirling
Department of Computing Science and Mathematics University of Stirling Push-Button Tools for Application Developers, Full Formal Verification for Component Vendors Thomas Wilson, Savi Maharaj, Robert G.
A Case for Static Analyzers in the Cloud (Position paper)
A Case for Static Analyzers in the Cloud (Position paper) Michael Barnett 1 Mehdi Bouaziz 2 Manuel Fähndrich 1 Francesco Logozzo 1 1 Microsoft Research, Redmond, WA (USA) 2 École normale supérieure, Paris
Tool Support for Invariant Based Programming
Tool Support for Invariant Based Programming Ralph-Johan Back and Magnus Myreen Abo Akademi University, Department of Computer Science Lemminkainenkatu 14 A, FIN-20520 Turku, Finland Email: backrj@abo.fi,
Verifying Semantic of System Composition for an Aspect-Oriented Approach
2012 International Conference on System Engineering and Modeling (ICSEM 2012) IPCSIT vol. 34 (2012) (2012) IACSIT Press, Singapore Verifying Semantic of System Composition for an Aspect-Oriented Approach
State of the World - Statically Verifying API Usage Rule
Statically Verifying API Usage Rule using Tracematches Xavier Noumbissi, Patrick Lam University of Waterloo November 4, 2010 (University of Waterloo) Statically Verifying API Usage Rule November 4, 2010
Formal System Modelling Using Abstract Data Types in Event-B
The final publication is available at link.springer.com. http://dx.doi.org/10.1007/978-3-662-43652-3 20 Formal System Modelling Using Abstract Data Types in Event-B Andreas Fürst 1, Thai Son Hoang 1, David
Appendix... B. The Object Constraint
UML 2.0 in a Nutshell Appendix B. The Object Constraint Pub Date: June 2005 Language The Object Constraint Language 2.0 (OCL) is an addition to the UML 2.0 specification that provides you with a way to
Automated Theorem Proving - summary of lecture 1
Automated Theorem Proving - summary of lecture 1 1 Introduction Automated Theorem Proving (ATP) deals with the development of computer programs that show that some statement is a logical consequence of
Analysis of Binary Search algorithm and Selection Sort algorithm
Analysis of Binary Search algorithm and Selection Sort algorithm In this section we shall take up two representative problems in computer science, work out the algorithms based on the best strategy to
µz An Efficient Engine for Fixed points with Constraints
µz An Efficient Engine for Fixed points with Constraints Kryštof Hoder, Nikolaj Bjørner, and Leonardo de Moura Manchester University and Microsoft Research Abstract. The µz tool is a scalable, efficient
VDM vs. Programming Language Extensions or their Integration
VDM vs. Programming Language Extensions or their Integration Alexander A. Koptelov and Alexander K. Petrenko Institute for System Programming of Russian Academy of Sciences (ISPRAS), B. Communisticheskaya,
T-79.232 Safety Critical Systems Case Study 2: B Method - Basic Concepts
T-79.232 Safety Critical Systems Case Study 2: B Method - Basic Concepts February 21, 2008 T-79.5303: Case Study 2: B Method - Basic Concepts 2-1 B method - what is it about? B method describes entities
WESTMORELAND COUNTY PUBLIC SCHOOLS 2011 2012 Integrated Instructional Pacing Guide and Checklist Computer Math
Textbook Correlation WESTMORELAND COUNTY PUBLIC SCHOOLS 2011 2012 Integrated Instructional Pacing Guide and Checklist Computer Math Following Directions Unit FIRST QUARTER AND SECOND QUARTER Logic Unit
Unified Static and Runtime Verification of Object-Oriented Software
Unified Static and Runtime Verification of Object-Oriented Software Wolfgang Ahrendt 1, Mauricio Chimento 1, Gerardo Schneider 2, Gordon J. Pace 3 1 Chalmers University of Technology, Gothenburg, Sweden
Run-Time Monitoring of Goal-Oriented Requirements Specifications
Department of Computer Science University College London University of London Run-Time Monitoring of Goal-Oriented Requirements Specifications Andrew Ross Dingwall-Smith Submitted for the degree of Doctor
Generating Elementary Combinatorial Objects
Fall 2009 Combinatorial Generation Combinatorial Generation: an old subject Excerpt from: D. Knuth, History of Combinatorial Generation, in pre-fascicle 4B, The Art of Computer Programming Vol 4. Combinatorial
Small Maximal Independent Sets and Faster Exact Graph Coloring
Small Maximal Independent Sets and Faster Exact Graph Coloring David Eppstein Univ. of California, Irvine Dept. of Information and Computer Science The Exact Graph Coloring Problem: Given an undirected
Model Checking: An Introduction
Announcements Model Checking: An Introduction Meeting 2 Office hours M 1:30pm-2:30pm W 5:30pm-6:30pm (after class) and by appointment ECOT 621 Moodle problems? Fundamentals of Programming Languages CSCI
SMock A Test Platform for the Evaluation of Monitoring Tools
SMock A Test Platform for the Evaluation of Monitoring Tools User Manual Ruth Mizzi Faculty of ICT University of Malta June 20, 2013 Contents 1 Introduction 3 1.1 The Architecture and Design of SMock................
PROPERTECHNIQUEOFSOFTWARE INSPECTIONUSING GUARDED COMMANDLANGUAGE
International Journal of Computer ScienceandCommunication Vol. 2, No. 1, January-June2011, pp. 153-157 PROPERTECHNIQUEOFSOFTWARE INSPECTIONUSING GUARDED COMMANDLANGUAGE Neeraj Kumar Singhania University,
Computer Science 210: Data Structures. Searching
Computer Science 210: Data Structures Searching Searching Given a sequence of elements, and a target element, find whether the target occurs in the sequence Variations: find first occurence; find all occurences
Formal Software Development of Android Games
Formal Software Development of Android Games Salim Perchy Pontificia Universidad Javeriana Cali, Colombia ysperchy@javerianacali.edu.co Néstor Cataño The University of Madeira Carnegie Mellon Portugal
How To Write A Test Engine For A Microsoft Microsoft Web Browser (Php) For A Web Browser For A Non-Procedural Reason)
Praspel: A Specification Language for Contract-Driven Testing in PHP Ivan Enderlin Frédéric Dadeau Alain Giorgetti Abdallah Ben Othman October 27th, 2011 Meetings: LTP MTVV Ivan Enderlin, Frédéric Dadeau,
Verifying Spec# Delegates. Samuele Gantner
Verifying Spec# Delegates Samuele Gantner Master s Thesis Chair of Programming Methodology Department of Computer Science ETH Zurich pm.inf.ethz.ch March 2008 - September 2008 Supervised by: Joseph N.
FROM SAFETY TO SECURITY SOFTWARE ASSESSMENTS AND GUARANTEES FLORENT KIRCHNER (LIST)
FROM SAFETY TO SECURITY SOFTWARE ASSESSMENTS AND GUARANTEES FLORENT KIRCHNER (LIST) M loc 12 ONBOARD SOFTWARE SIZE 10 Volt (2011) F-35 (2012) 8 6 787 (2010) F-35 (2010) 4 2 F-22 (2005) 0 WHY DO WE TRUST
Abstract Data Types in Event-B An Application of Generic Instantiation
Abstract Data Types in Event-B An Application of Generic Instantiation David Basin 1, Andreas Fürst 1, Thai Son Hoang 1, Kunihiko Miyazaki 2, and Naoto Sato 2 1 Institute of Information Security, ETH Zurich
Introduction to Programming System Design. CSCI 455x (4 Units)
Introduction to Programming System Design CSCI 455x (4 Units) Description This course covers programming in Java and C++. Topics include review of basic programming concepts such as control structures,
Programming by Contract. Programming by Contract: Motivation. Programming by Contract: Preconditions and Postconditions
COMP209 Object Oriented Programming Designing Classes 2 Mark Hall Programming by Contract (adapted from slides by Mark Utting) Preconditions Postconditions Class invariants Programming by Contract An agreement
Using B as a High Level Programming Language in an Industrial Project: Roissy VAL
Using B as a High Level Programming Language in an Industrial Project: Roissy VAL ClearSy and Siemens Transportation Systems Abstract. In this article we would like to go back on B used to design software,
Translating to Java. Translation. Input. Many Level Translations. read, get, input, ask, request. Requirements Design Algorithm Java Machine Language
Translation Translating to Java Introduction to Computer Programming The job of a programmer is to translate a problem description into a computer language. You need to be able to convert a problem description
Embedded Systems. Review of ANSI C Topics. A Review of ANSI C and Considerations for Embedded C Programming. Basic features of C
Embedded Systems A Review of ANSI C and Considerations for Embedded C Programming Dr. Jeff Jackson Lecture 2-1 Review of ANSI C Topics Basic features of C C fundamentals Basic data types Expressions Selection
Using UML Part Two Behavioral Modeling Diagrams
UML Tutorials Using UML Part Two Behavioral Modeling Diagrams by Sparx Systems All material Sparx Systems 2007 Sparx Systems 2007 Page 1 Trademarks Object Management Group, OMG, Unified Modeling Language,
Software Engineering
Software Engineering Lecture 04: The B Specification Method Peter Thiemann University of Freiburg, Germany SS 2013 Peter Thiemann (Univ. Freiburg) Software Engineering SWT 1 / 50 The B specification method
Specimen 2015 am/pm Time allowed: 1hr 30mins
SPECIMEN MATERIAL GCSE COMPUTER SCIENCE 8520/1 Paper 1 Specimen 2015 am/pm Time allowed: 1hr 30mins Materials There are no additional materials required for this paper. Instructions Use black ink or black
GRID SEARCHING Novel way of Searching 2D Array
GRID SEARCHING Novel way of Searching 2D Array Rehan Guha Institute of Engineering & Management Kolkata, India Abstract: Linear/Sequential searching is the basic search algorithm used in data structures.
Writing in the Computer Science Major
Writing in the Computer Science Major Table of Contents Introduction... 2 Statement of Purpose... 2 Revision History... 2 Writing Tasks in Computer Science... 3 Documentation... 3 Planning to Program:
Delta-oriented Monitor Specification
Delta-oriented Monitor Specification Eric Bodden, Kevin Falzon Ka I Pun, Volker Stolz EC-SPRIDE, Darmstadt Universitetet i Oslo October 2012 GROUP Motivation What is RV? Does ABS support infrastructure
Coverability for Parallel Programs
2015 http://excel.fit.vutbr.cz Coverability for Parallel Programs Lenka Turoňová* Abstract We improve existing method for the automatic verification of systems with parallel running processes. The technique
Visual Data Mining. Motivation. Why Visual Data Mining. Integration of visualization and data mining : Chidroop Madhavarapu CSE 591:Visual Analytics
Motivation Visual Data Mining Visualization for Data Mining Huge amounts of information Limited display capacity of output devices Chidroop Madhavarapu CSE 591:Visual Analytics Visual Data Mining (VDM)
Binary search algorithm
Binary search algorithm Definition Search a sorted array by repeatedly dividing the search interval in half. Begin with an interval covering the whole array. If the value of the search key is less than
Chapter 4, Arithmetic in F [x] Polynomial arithmetic and the division algorithm.
![Chapter 4, Arithmetic in F [x] Polynomial arithmetic and the division algorithm.](/thumbs/26/8276997.jpg "Chapter 4, Arithmetic in F [x] Polynomial arithmetic and the division algorithm.")
Chapter 4, Arithmetic in F [x] Polynomial arithmetic and the division algorithm. We begin by defining the ring of polynomials with coefficients in a ring R. After some preliminary results, we specialize
Biinterpretability up to double jump in the degrees
Biinterpretability up to double jump in the degrees below 0 0 Richard A. Shore Department of Mathematics Cornell University Ithaca NY 14853 July 29, 2013 Abstract We prove that, for every z 0 0 with z
Case Study. Chapter 6. 6.1 Introduction
Chapter 6 Case Study A case study involving the specification and refinement of an Event-B model is presented. This chapter describes how the techniques presented in the previous chapters may be used in
Concurrent Programming
Concurrent Programming Principles and Practice Gregory R. Andrews The University of Arizona Technische Hochschule Darmstadt FACHBEREICH INFCRMATIK BIBLIOTHEK Inventar-Nr.:..ZP.vAh... Sachgebiete:..?r.:..\).
MAT-71506 Program Verication: Exercises
MAT-71506 Program Verication: Exercises Antero Kangas Tampere University of Technology Department of Mathematics September 11, 2014 Accomplishment Exercises are obligatory and probably the grades will
Lecture 1: Oracle Turing Machines
Computational Complexity Theory, Fall 2008 September 10 Lecture 1: Oracle Turing Machines Lecturer: Kristoffer Arnsfelt Hansen Scribe: Casper Kejlberg-Rasmussen Oracle TM Definition 1 Let A Σ. Then a Oracle
Construct by Contract: Construct by Contract: An Approach for Developing Reliable Software
Construct by Contract: Construct by Contract: An Approach for Developing Reliable Software Juan Jose Mendoza Santana Dissertation 2013 Erasmus Mundus MSc in Dependable Software Systems Department of Computer
There is no degree invariant half-jump
There is no degree invariant half-jump Rod Downey Mathematics Department Victoria University of Wellington P O Box 600 Wellington New Zealand Richard A. Shore Mathematics Department Cornell University
LEVERAGING DEDUCTIVE VERIFICATION IN INDUSTRIAL CONTEXTS
LEVERAGING DEDUCTIVE VERIFICATION IN INDUSTRIAL CONTEXTS CEA S SOFTWARE SAFETY LABORATORY 1995: LEAP FROM DYNAMIC TO STATIC CODE ANALYSIS! CAVEAT: ARCHITECTURE C source code VC Generator Formal specifications
A binary search tree or BST is a binary tree that is either empty or in which the data element of each node has a key, and:
Binary Search Trees 1 The general binary tree shown in the previous chapter is not terribly useful in practice. The chief use of binary trees is for providing rapid access to data (indexing, if you will)
How To Improve Software Quality
Software Qualities Quality Assurance Maintainer Go Documentation Readable Ce Go Design Functionality Ease of use Ease of learning User Reliability Correctness Efficiency Low Cost Portability Increased
Algorithms Chapter 12 Binary Search Trees
Algorithms Chapter 1 Binary Search Trees Outline Assistant Professor: Ching Chi Lin 林 清 池 助 理 教 授 chingchi.lin@gmail.com Department of Computer Science and Engineering National Taiwan Ocean University
Chapter 7 Uncomputability
Chapter 7 Uncomputability 190 7.1 Introduction Undecidability of concrete problems. First undecidable problem obtained by diagonalisation. Other undecidable problems obtained by means of the reduction
Introduction to Formal Methods. Các Phương Pháp Hình Thức Cho Phát Triển Phần Mềm
Introduction to Formal Methods Các Phương Pháp Hình Thức Cho Phát Triển Phần Mềm Outline Introduction Formal Specification Formal Verification Model Checking Theorem Proving Introduction Good papers to
CS Matters in Maryland CS Principles Course
CS Matters in Maryland CS Principles Course Curriculum Overview Project Goals Computer Science (CS) Matters in Maryland is an NSF supported effort to increase the availability and quality of high school
1 Lecture: Integration of rational functions by decomposition
Lecture: Integration of rational functions by decomposition into partial fractions Recognize and integrate basic rational functions, except when the denominator is a power of an irreducible quadratic.