Teaching Formal Methods for the Unconquered Territory Nestor Catano Madeira ITI, Portugal Camilo Rueda Pontificia Universidad Javeriana (PUJ), Cali, Colombia

Engineering in Computer Science at PUJ 5 years program – 2 years common trunk in mathematics and physics – 3 years program in computer Science 2 courses in discrete mathematics and logic – ACM/IEEE undergraduate computer science curriculum 2 courses in Software Engineering

Formal Methods Courses Local companies consider the ability to reason about software design as a key competence in young professionals The economic development plan of Cali pointed out at software production as a key strategy, and increasing software quality as the most pressing need in this realm

PUJ and Software Companies Students are encouraged to initiate software start-ups at ParqueSoft through an entrepreneurship joint educational program Students substitute their engineering degree final work with a technical report on their proposed software venture About half of ParqueSoft companies have achieved standard quality assurance certifications

The Courses 1.Program Specification and Verification Course – JML (Java Modeling Language) – The Design-by-Contract 2.Formal Program Development – Refinement calculus theory in B – The parachute strategy for Software development

Our Goals To help students to build skills on formal methods To master formal tools they might use in their future IT software engineering jobs –unconquered territory – Software companies

Program Specification and Verification Program Correctness and WP Calculus Design-by-Contract JML (Java Modeling Language) Software Verification Examples – Smart Card Applications – Bank Applications – Social Network apps

JML-based Software Development Three steps specification approach – informal specification, semi-formal, formal in JML Checking JML Specifications – JML Common Tools, ESC/Java 2 Evolving code + Specifications

Health Card There must not exist duplicated entries for allergies with the same designation code

Health Card If a new allergy is to be added to the list of referenced allergies, and the allergy designation has already been referenced, then the new allergy is not inserted

Health Card requires assignable as, ensures requires assignable ensures public abstract void addAllergy ( byte[] designation, byte[] date) throws RemoteException, UserException;

Health Card: Invariants All allergy designation codes must have a stipulated length

Health Card: Invariants invariant size(des) == CODE_LENGTH

Health Card: Invariants invariant des.size == CODE_LENGTH;

Formal Program Development Role of Predicate + relational calculus in software specifications The Event B method The Refinement model Modeling examples – Physical systems: MIO – Program development: patterns – Software structuring: invoice system

Formal Program Development Building a hierarchy of event B machines Abstract Event B machine – Properties and invariants: pre-condition – A single event: post-condition Refined machines – Proposed invariant determines new variables – Proof obligations determine new progress events – Post-condition ensured by final events

Go-Home Message We should guide students in the process of discovering the close embracing relation between software models and mathematical formalisms

Go-Home Message The JML course allows students to have a first contact with formal specification of programs, and program correctness Students enjoy evolving program and JML specifications

Go-Home Message We endeavor to develop in students a point of complementarity of formal methods with respect to standard software engineering We are careful not to present formal methods as better methodologies that should replace other strategies in all situations We do stress what can be gained by formal thinking in better requirements specification, even for traditional methodologies

Go-Home Message In the event B method we stress the fact that abstract and refined models serve different purposes, for different types of users We give a complementary view of tools, Rodin and ProB, and show their interplay in development Through many examples we endeavor to present formal proofs as aids to program development, rather than requirements of a methodology