1. 1 The Extended Example Chapter 5 Formal Specification using Z

2. 2 Full definition of boarding operation The definition of the boarding and disembarking operations did not consider what what was to happen when the precondition of an operation was not fulfilled. To handle this we will include a variable reply of type RESPONSE for each operation. RESPONSE ::= OK | twoErrors | onBoard | full | notOnBoard The reply variable will indicate what is happening during an operation.

3. 3 Full definition of boarding operation Either: p is not on board and the aircraft is not full and p gets included in onboard and reply is OK. OR p is on board and the aircraft is full and onboard is unchanged reply is twoErrors. OR p is on board and the aircraft is not full and onboard is unchanged reply is onBoard. OR p is not on board and the aircraft is full and onboard is unchanged reply is full.

4. 4 Full definition of boarding operation p : PERSON, reply : RESPONSE (p onboard L # onboard < capacity L onboard’ = onboard U { p} L reply = OK) v (p onboard L # onboard = capacity L onboard’ = onboard L reply = twoErrors) v (p onboard L # onboard < capacity L onboard’ = onboard L reply = onBoard) v (p onboard L # onboard = capacity L onboard’ = onboard L reply = full)

5. 5 Full definition of disembark operation Either: p is on board and p gets removed from onboard and reply is OK. OR p is not on board and onboard is unchanged reply is notOnBoard. p : PERSON, reply : RESPONSE (p onboard L onboard’ = onboard \ { p} L reply = OK) v (p onboard L onboard’ = onboard L reply = notOnBoard)

6. 6 Recall from chapter 2 Certain people are registered as users of a computer system. At any given time, some of these users are logged in to the computer. There is a limit (unspecified) to the number of users logged in at any one time. All users are either staff users or customers.

7. 7 Chapter 5 Exercise 1 Practice Referring to question 1 chapter 1, and its development in the exercises of chapter 3 (given on the previous slide), give full descriptions, including possible unfulfilled preconditions, in the manner of this chapter. 1. A suitable type for the response from any of the following operations. 2. The operation to register a new user. 3. The operation to remove a user. 4. The operation to log in. 5. The operation to log out.

8. 8 Chapter 5 Solution Exercise 1 1. A suitable type for the response from any of the following operations. RESPONSE ::= OK | AlreadyAUser | NotAUser | LoggedIn | notLoggedIn

9. 9 Chapter 5 Solution Exercise 2 2. The operation to register a new user. reply: RESPONSE, p:PERSON loggedIn’ = loggedIn L ((p users L users’ = users U {p} L reply = OK) v (p users L users’ = users reply = AlreadyAUser)