1. Formal Techniques (CS340 © John C. Knight 2004)
Dependable Computing
Formal Techniques
Formal Techniques (CS340 © John C. Knight 2004)
CS551/651 Fall 2003

2. Formal Techniques Syntax Checking Formal Specification Type Checking
Analysis is possible because of mathematical semantics
Formal specification uses a formal language with mathematical semantics
Syntax Checking
Type Checking
Putative Theorems
Formal Specification
Establish useful properties of the specification
Formal Techniques (CS340 © John C. Knight 2004)

3. Formal Techniques Formal Specification Direct Synthesis
Correctness by construction
Formal Specification
Direct Synthesis
Code
Create software by a synthesis process
Correctness the result of correct synthesis
Formal Techniques (CS340 © John C. Knight 2004)

4. Formal Techniques Formal Specification Design & Code Refinement/Proof
Correctness by construction
Design & Code
Refinement/Proof
Create software by a series of refinements
Prove that each refinement is correct
Design & Code
Refinement/Proof
Code
Formal Techniques (CS340 © John C. Knight 2004)

5. Formal Techniques (CS340 © John C. Knight 2004)
Formal Specification
Correctness by chance
Correctness proof
Conventional Design
And Code
Formal Verification
Correctness Proof
Code
Proof of partial correctness
Proof of total correctness
Correctness?
Formal Techniques (CS340 © John C. Knight 2004)

6. Formal Techniques Formal Specification Model Checking Syntax Checking
Analysis is possible because of mathematical semantics
Model Checking
Syntax Checking
Type Checking
Putative Theorems
Formal specification uses a formal language with mathematical semantics
Correctness by construction
Formal Specification
Direct Synthesis
Code
Correctness by construction
Design & Code
Refinement/Proof
Code
Correctness proof
Formal Verification
Correctness Proof
Code
Conventional Design
And Code
Correctness by chance
Formal Techniques (CS340 © John C. Knight 2004)

7. Notations For Formal Specification
Any notation with precise semantics can be used
Formalism typically applied to just part of a specification
Notations often use discrete mathematics, some with graphics
Several notations are sometimes used in the same specification:
Z or VDM for data manipulation
Statecharts for system states and transitions
Natural language for non-functional specifications
Formal Techniques (CS340 © John C. Knight 2004)

8. Formal Techniques (CS340 © John C. Knight 2004)
Formal Specification
There are lots of good notations, e.g.:
PVS
Statecharts Z
SCR
RSML
Larch
Experimental case studies have been quite positive but techniques not perfect
Formal Techniques (CS340 © John C. Knight 2004)

9. Formal Techniques (CS340 © John C. Knight 2004)
Formal Specification
Goals of formal specification:
Complete, consistent, concise, unambiguous specifications
Valid specifications—state exactly what the user wants
Specifications based on formal semantic model
Formal semantics permit dependable communication between all parties
Case studies of use are very positive
Formal Techniques (CS340 © John C. Knight 2004)

10. Formal Techniques (CS340 © John C. Knight 2004)
Formal Specification
High-level language programs are just specifications! So this stuff should be familiar
Declarative:
Statement of the desired effect on system state
Procedural:
Statement of desired actions and their sequence
Major approaches—declarative:
Model-based specification
Axiomatic specification
Formal Techniques (CS340 © John C. Knight 2004)

11. Model-Based Specification
Literally Build A Model Of The System You Want
Components:
System State Sets and functions
State Changes Pre- & Post Conditions Predicate Calculus
This is why and where discrete math comes in
A model-based specification is much like a program
But a model-based specification is NOT a procedural program
Formal Techniques (CS340 © John C. Knight 2004)

12. Model-Based Specifications
State Description
(Sets, relations, etc)
Invariants
(Predicate Calculus)
Operation Name
& Pre/Post Condx
REALLY Important
REALLY Important
(Pred Calculus)
Pre Condition
What Has To Be True Before An Operation Can Be Applied
Post Condition
What Has To Be True After An Operation Is Applied
Formal Techniques (CS340 © John C. Knight 2004)

13. Formal Techniques (CS340 © John C. Knight 2004)
Z—Pronounced “Zed”
Notation for model-based specification
Similar to many other notations, e.g.:
PVS
VDM
Using Z as an example, principles apply to other notations
Z relatively popular, especially in Europe (see range of textbooks)
Formal Techniques (CS340 © John C. Knight 2004)

14. Simple Z Example Simple Telephone Database (A. Diller) Add User
System State
Set of users, map from names to numbers
Add User
(Pre- And
Post-Conditions)
Change No.
(Pre- And
Post-Conditions)
Formal Techniques (CS340 © John C. Knight 2004)

15. Formal Techniques (CS340 © John C. Knight 2004)
Simple Z Example
Given sets
State schema—set and relation
Simple invariant
Formal Techniques (CS340 © John C. Knight 2004)

16. Formal Techniques (CS340 © John C. Knight 2004)
Simple Z Example
Before and after state
Pre- and post-conditions
Operation schema, one of many
Formal Techniques (CS340 © John C. Knight 2004)

17. Some Other Z Components
Functions
Sequences
Bags
Schema calculus:
Decoration
Inclusion
Composition
Logical expressions
Precondition analysis
Formal Techniques (CS340 © John C. Knight 2004)

18. Formal Techniques (CS340 © John C. Knight 2004)
Statecharts
Developed for specifying reactive systems
Graphic! Overall, its VERY clever stuff
First introduced in mid 1980’s
Developed by David Harel at the Weizmann institute
Original application was avionics for Lavi fighter, Israeli Aircraft Industries
Formal Techniques (CS340 © John C. Knight 2004)

19. Formal Techniques (CS340 © John C. Knight 2004)
Statecharts
Very Popular In U.S. Industry—Most Used “Formal” Technique
Supported By Powerful Toolset: Statemate (iLogix, Inc)
Adapted By Other Notations, E.g. RSML
Incorporated Wholesale Into Others, E.g. UML
Many Extensions Developed
Formal Techniques (CS340 © John C. Knight 2004)

20. Part of Harel’s Stopwatch
Formal Techniques (CS340 © John C. Knight 2004)

21. Basic States, State Transitions, Initial State
States A, B, C
Transitions r, s, t, u
s(Y) Means Event s And Condition Y True
Unlabeled Arc Represents Initial Transition (Entry To Initial State)
Formal Techniques (CS340 © John C. Knight 2004)

22. Clustering And Refinement
State D Is A Cluster—A State That Has Substates
Cluster is XOR—System Will Be In State A Or B, Not Both
Transition u Has Been Unified
Formal Techniques (CS340 © John C. Knight 2004)

23. State Transition Example
“a” and “d” are watch buttons
Complex idea stated simply, easily, precisely
Formal Techniques (CS340 © John C. Knight 2004)

24. Formal Techniques (CS340 © John C. Knight 2004)
Orthogonality
Dashed Line Reads “AND”—Exactly One State From Each Side
Examples: D & A, D & B, D & C, E & B
Formal Techniques (CS340 © John C. Knight 2004)

25. Part of Harel’s Stopwatch (Again)
Formal Techniques (CS340 © John C. Knight 2004)