Sub-system interfaces Sub-system A Sub-system B

Larch Family of Languages Family of Specification Languages Specification components: Larch Shared Language – common to all languages Larch Interface Language – particular to specific PL LSL: an algebraic language LIL: tailored to a programming language

Larch Interface Language (Larch/L) Two-tiered specification in Larch Programming Language L Program unit Implementation satisfies Larch Interface Language (Larch/L) Interface spec Local Specification Based on Root trait Incorporates (includes, imports, or assumes) Larch shared language … Trait Trait Two-tiered specification in Larch

Some Aspects of Larch Languages Composability. Incremental construction of specifications from other specifications Emphasis on Presentation. Readable. Larch composition mechanisms are operations on specification, rather than on theories or models. Suitability for integrated interactive tools. Good for interactive construction and incremental checking of specs. Semantic Checking. Checking of specs when they are being constructed. (i.e. theorem prover for semantic checking)

Trait: is the basic unit of specification in LSL Trait: is the basic unit of specification in LSL. It introduces operators and specifies their properties. Sometimes collection of operators correspond to an ADT. Theory: is a set of theorems that can be proved about the terms defined in a trait. Theory contains equations and inequation (~(true = false)) that can be proved by substituting equal for equal. BUT, if 2 terms can not be proven to be equal then they are not necessarily unequal. Also if two terms are not provably unequal, it does not mean they are equal. Signature: domains and ranges of the operators used for sort-check (similar to type-check in PL). Constraints: limit the operators by means of equations that relate the terms containing them.

Larch Interface Language (LIL) Localized programming language dependencies Each LIL encapsulates features needed to write specifications in a particular Programming Language and incorporates LSL in a uniform way.

Larch Prover (LP) LP is an interactive theorem proving system for multi-sorted first-order logic Assist users in finding and correcting flaws in conjectures Works efficiently on large problems Is not designed to find difficult proofs automatically Checks for syntax and type errors in LSL specifications Two files of input suitable for use with LP: LP axiomatization for an LSL specification LP proof obligations associated with logical claims made by specifiers about the logical properties of their specifications

The Larch Shared Language (LSL) LSL specifications define two kinds of symbols, operators and sorts. operators stand for total functions from tuples of values to values. Sorts stand for disjoint non-empty sets of values, and are used to indicate the domains and ranges of operators. The trait is the basic unit of specification in LSL. A trait introduces some operators and specifies some of their properties. Sometimes the trait defines an abstract type. However, it is frequently useful to define a set of properties that does not fully characterize a type.

Example - Table Table: trait includes Integer introduces new:  Tab add: Tab, Ind, Val  Tab - - : Ind, Tab  Bool lookup: Tab, Ind  Val size: Tab  Int

Example - Table asserts  i, i1: Ind, v: Val, t: Tab (i  new); i  add(t, i1, v) == i = i1  i  t; lookup(add(t, i, v), i1) == if i = i1 then v else lookup(t, i1); size(new) == 0; size(add(t, i, v)) == if i  t then size(t) else size(t) + 1