Chapter 25 Formal Methods

BASIC CONCEPTS A method is formal if it has a sound mathematical basis, typically given by a formal specification language. This basis provides a means of precisely defining notions like consistency and completeness, and more relevantly, specification, implementation and correctness. Deficiencies of Less Formal Approaches – Contradictions are sets of statements that are at variance with each other. – Ambiguities are statements that can be interpreted in a number of ways. – Vagueness often occurs because a system specification is a very bulky document. – Incompleteness is probably one of the most frequently occurring problems with system specifications.

– Mixed levels of abstraction occur when very abstract statements are intermixed randomly with statements that are at a much lower level of detail Mathematics in Software Development Formal Methods Concepts

A symbol Table: – The data invariant that holds for the symboltable just discussed has two components: – that the table will contain no more than MaxIds names. – that there will be no duplicate names in the table.

Example 2: A Block Handler One of the more important parts of a computer's operating system is the subsystem that maintains files created by users. Part of the filing subsystem is the block handler.

For this subsystem the state is the collection of free blocks, the collection of used blocks, and the queue of returned blocks.

The data invariant, expressed in natural language, is – No block will be marked as both unused and used. – All the sets of blocks held in the queue will be subsets of the collection of – currently used blocks. – No elements of the queue will contain the same block numbers. – The collection of used blocks and blocks that are unused will be the total collection of blocks that make up files. – The collection of unused blocks will have no duplicate block numbers. – The collection of used blocks will have no duplicate block numbers.

Example : A Print Spooler

The state of the spooler is represented by the four components: queues, output, devices, limits, and sizes The data invariant has five components: – Each output device is associated with an upper limit on print lines. – Each output device is associated with a possibly nonempty queue of files awaiting printing. – Each file is associated with a size. – Each queue associated with an output device contains files that have a size less than the upper limit of the output device. – There will be no more than MaxDevs output devices administered by the spooler.

MATHEMATICAL PRELIMINARIES Sets and Constructive Specification – The elements contained within a set are unique {C++, Pascal, Ada, COBOL, Java} – The order in which the elements appear within a set is immaterial #{A, B, C, D} = 4 The second approach is to create a constructive set specification. The general form of the members of a set is specified using a Boolean expression. Constructive set specification is preferable to enumeration because it enables a succinct definition of large sets. It also explicitly defines the rule that was used in constructing the set. Consider the following constructive specification example: Set Operators – The operator is used to indicate membership of a set. x e X

Logic Operators – Sequences A sequence s is a set of pairs whose elements range from 1 to the highestnumber element. – {(1, Jones), (2, Wilson), (3, Shapiro), (4, Estavez)}

APPLYING MATHEMATICAL NOTATION FOR FORMAL SPECIFICATION FORMAL SPECIFICATION LANGUAGES – a syntax that defines the specific notation with which the specification is represented, – semantics to help define a "universe of objects" that will be used to describe the system – a set of relations that define the rules that indicate which objects properly satisfy the specification. USING Z TO REPRESENT AN EXAMPLE SOFTWARE COMPONENT – Z specifications are structured as a set of schemas—a boxlike structure that introduces variables and specifies the relationship between these variables.

THE TEN COMMANDMENTS OF FORMAL METHODS Thou shalt choose the appropriate notation Thou shalt formalize but not overformalize Thou shalt estimate costs Thou shalt have a formal methods guru on call Thou shalt not abandon thy traditional development methods Thou shalt document sufficiently

Thou shalt not compromise thy quality standards Thou shalt not be dogmatic Thou shalt test, test, and test again Thou shalt reuse