1. Lecture 17 March 24, 2011 Formal Methods 2 CS 315 Spring 2011 1 Adapted from slides provided by Jason Hallstrom and Murali Sitaraman (Clemson)

2. Some Mathematics is Implicit We view programming integers as though they are mathematical integers (subject to bounds, of course) We associate mathematical operators (e.g., +) with operations we can do on integers in programs (e.g., +) This association can be made explicit CS 315 Spring 2011 2

3. Mathematical Modeling Type Integer is modeled by Z; For all i: Integer, min_int <= i <= max_int; CS 315 Spring 2011 3

4. Alternatively Type Integer is modeled by Z; Let i be an example; Constraints for all i: Integer; min_int <= i <= max_int; CS 315 Spring 2011 4

5. Alternatively Type Integer is modeled by Z; exemplar i; constraints min_int <= i <= max_int; CS 315 Spring 2011 5

6. Initial Value Specification Type Integer is modeled by Z; exemplar i; constraints min_int <= i <= max_int; initialization ensures i = 0; CS 315 Spring 2011 6

7. Specification of Operations Type Integer is modeled by Z; … Specification of operations, e.g., i++ Operation Increment (updates i: Integer) requires i < max_int ensures i = #i +1 CS 315 Spring 2011 7

8. More Examples What is a suitable way to model the state of a lightbulb? CS 315 Spring 2011 8

9. More Examples Type Light_Bulb_State is modeled by B; exemplar b; Initialization ensures b = false; Exercises: specification of operations Turn_on, Turn_off, and Is_On CS 315 Spring 2011 9

10. More Examples How would you model the state of a traffic light? Alternative models and discussion CS 315 Spring 2011 10

11. More Examples How would you model a paper weight? CS 315 Spring 2011 11

12. Data Abstraction Examples How would you mathematically model the contents of a stack? Is a set model appropriate? Why or why not? What about modeling a queue? CS 315 Spring 2011 12

13. Mathematical Modeling Summary To write formal specifications, we need to model the state mathematically Some objects we use in programming, such as Integers and Reals, have implicit models For others, such as stacks, queues, lists, etc., we need to conceive explicit mathematical models CS 315 Spring 2011 13

14. Formal Specification of Java Interfaces CS 315 Spring 2011 14

15. Basics An interface Describes what classes or components do Does not describe how they should do it An interface Is a contract between component users (clients) and developers (implementers) If the users satisfy the requirements for using the component, the component will provide guarantees CS 315 Spring 2011 15

16. Principles of Interface Design Information Hiding Hide details unnecessary to use the component Abstraction Provide a “cover story” or explanation in user- oriented terms so they can understand the interface CS 315 Spring 2011 16

17. Contract Specification Requirements and guarantees Requires clauses are preconditions Ensures clauses are postconditions Who is responsible for requires clauses? What are the consequences of this? CS 315 Spring 2011 17

18. Specification of Stacks Mathematical modeling How can we think of stacks “mathematically”? CS 315 Spring 2011 18

19. Mathematical Strings Unlike sets, strings have order Example: Str(Z) for String of integers Notations Empty string (Written empty_string or  ) Concatenation (alpha o beta) Length ( |alpha| ) String containing one entry ( ) CS 315 Spring 2011 19

20. Specification of IntStack Interface Suppose IntStack is an interface uses Integer_Theory, String_Theory; Think of stacks of Integers as “math strings” of integers this: Str(Z); Specification of Constructor initialization ensures this = empty_string; Exercises: Specification of other stack operations CS 315 Spring 2011 20

21. Specification of IntStack Interface Operation push (int x) updates this; restores x; ensures this = o #this; int Operation pop (); updates this; requires this /= empty_string; ensures #this = o this; bool Operation is_empty(); preserves this; ensures result of is_empty = (this = empty_string) CS 315 Spring 2011 21

22. Java Specification Questions What is the specification of “=“ to assign one IntStack object to another? If you defined a “clone” method, what is its specification? What are the advantages of using “=“ over “clone”? What are the advantages of using “clone” over “=“? CS 315 Spring 2011 22