CS599 Formal Methods in Software Architectures 1 Axiomatic Specification, Examples in ANNA Ebru Dincel Ali Rampurwala

  • View
    216

  • Download
    0

Embed Size (px)

Text of CS599 Formal Methods in Software Architectures 1 Axiomatic Specification, Examples in ANNA Ebru...

  • Axiomatic Specification, Examples in ANNAEbru DincelAli Rampurwala

    CS599 Formal Methods in Software Architectures

  • A Brief Overview of AnnaA Specification Language for ADAExtensions: Generalization of existing constructs eg. subprograms new constructs : eg. exceptions Formal comments:virtual Ada text ( --: ): programming concepts not implemented eg. Length of stackannotations (--| ) : Boolean valued expressionsQuantified expressions: forall, exists

    CS599 Formal Methods in Software Architectures

  • Anna Formal CommentsType: used to constrain a type/subtypeSubtype EVEN is INTEGER;--| where X: EVEN => X mod 2 = 0;Statement: used to specify properties of statementX:=X+1; --| X = in X +1;

    CS599 Formal Methods in Software Architectures

  • Anna Formal CommentsException: Procedure PUSH(E: in ITEM);--| where in STACK.LENGTH=SIZE=>raise OVERFLOW,--| raise OVERFLOW=> STACK= in STACK

    CS599 Formal Methods in Software Architectures

  • Gas Station Example package body STATION is--| limited to TANK_REGULAR_LEFT,TANK_PLUS_LEFT,TANK_PREMIUM_LEFT,THRESHOLD;--| UNDER_THRESHOLD, IOVERPAID: exception;type GRADE is (REGULAR,PLUS,PREMIUM);--:function GET_AMOUNT_LEFT(G:GRADE) return FLOAT;--:function GET_UNIT_PRICE(G:GRADE) return FLOAT;--:function REFILL_TANK_MAX(G:GRADE);

    CS599 Formal Methods in Software Architectures

  • Gas Station Exampletype PUMP is record PUMP_NUMBER : NATURAL range 0..3; GAS_GRADE : GRADE; IS_ENABLED : BOOLEAN := FALSE; IS_GRADE_CHOSEN : BOOLEAN := FALSE; METER_READING : FLOAT := 0; LEVER_POSITION_UP : BOOLEAN := FALSE; CURRENT_SPENT, PAID_AMOUNT: INTEGER; end record;--| where P:PUMP => P.METER_READING
  • Gas Station Exampletype PUMP_GROUP is array (POSITIVE RANGE ) of PUMP;PG : PUMP_GROUP(0..3);for all PG : PUMP_GROUP => PG(I) = PG(J) => I=J procedure enable(P : in out PUMP);--| where in P.IS_ENABLED = FALSE,--| out (P.IS_ENABLED = TRUE and P.METER_READING=0 and P.CURRENT_SPENT=0);

    CS599 Formal Methods in Software Architectures

  • Gas Station Exampleprocedure disable(P : in out PUMP);--| where in P.IS_ENABLED = TRUE,--| out P.IS_ENABLED = FALSE;

    CS599 Formal Methods in Software Architectures

  • Gas Station Exampleprocedure fill(P: in out PUMP; PAID_AMOUNT : in FLOAT) isbegin--| where in (P.IS_ENABLED = TRUE and P.IS_GRADE_CHOSEN = TRUE and P.METER_READING = 0 and P.CURRENT_SPENT = 0 and P.LEVER_POSITION_UP = TRUE);--| where out (P.IS_ENABLED = FALSE and (P.LEVER_POSITION_UP = FALSE or C.TANK_FULL = TRUE or P.CURRENT_SPENT = P.PAID_AMOUNT));--where C is an instance of the car Package While (P.CURRENT_SPENT
  • Gas Station Exampleprocedure fill_discrete(P: in out PUMP; CURRENT_SPENT: in out FLOAT; PAID_AMOUNT : in FLOAT) is begin--| raise UNDER_THRESHOLD => (GET_AMOUNT_LEFT(P.GAS_GRADE) < THRESHOLD) --| where out (P.PAID_AMOUNT> P.CURRENT_SPENT and P.LEVER_POSITION_UP = FALSE) raise IOVERPAID,--| raise IOVERPAID => P.IS_ENABLED = FALSE; CURRENT_SPENT = GET_UNIT_PRICE(P.GAS_GRADE) * P.METER_READING ;end fill_discrete;

    CS599 Formal Methods in Software Architectures

  • Gas Station Exampleprocedure choose_grade(P: in out PUMP); --| where in (P.IS_ENABLED = TRUE)--| out (P.IS_GRADE_CHOSEN = TRUE)

    --|axiom --| for all SS: STATION'TYPE => --| P.CURRENT_SPENT

  • Cruise Control ExampleAssumptions/Clarification: four CC buttons: CC, set_speed, resume, cruise_accelerateCC turns Cruise Control on, set_speed enables Cruise Control.two pedals: pedal_accelerate, brakepedal_decelerate is releasing the pedal.Exceptions: SpeedTooLow, SpeedTooHigh, CruiseOutofBoundsProcedures: cruise on/off, engine on/off, cruise en/disable, set_speed, pedal/cruise accelerate, brake, pedal_decelerate, resume

    CS599 Formal Methods in Software Architectures

  • Cruise Control ExampleCruise package embodies both the cruise control and the manual operations of the carBOOLEAN IS_ENGINE_ON, IS_CC_ON, IS_ENGINE_ENABLED, IS_CC_ENABLED;INTEGER SPEED, CRUISE_SPEED;--SPEED is the physical speed dynamically updated by calculate_speed function, and CRUISE_SPEED is only set when the Cruise Control is enabled--SpeedTooLowException calls the pedal_accelerate function, SpeedTooHighException calls the brake function internally. Finally, CruiseOutOfBounds calls cruise_disable function

    procedure set_speed;--| where in IS_ENGINE_ON=TRUE AND IS_CC_ON=TRUE AND 30

  • Cruise Control Exampleprocedure pedal_accelerate ;--| where in IS_ENGINE_ON=TRUE ,--| out (if in IS_CC_ON=TRUE AND in IS_CC_ENABLED=TRUE) then--| IS_ENGINE_ON=TRUE AND IS_CC_ON=TRUE AND IS_CC_ENABLED=FALSE AND SPEED > in CRUISE_SPEED,--| else IS_ENGINE_ON=TRUE AND IS_CC_ON=in IS_CC_ON AND IS_CC_ENABLED=in IS_CC_ENABLED AND SPEED> in SPEED;procedure cruise_accelerate ;--| where in IS_ENGINE_ON=TRUE AND IS_CC_ON=TRUE AND IS_CC_ENABLED=TRUE,--| out IS_ENGINE_ON=TRUE AND IS_CC_ON=TRUE AND ((SPEED in CRUISE_SPEED) || (SPEED>=90 AND IS_CC_ENABLED=FALSE AND SPEED> in CRUISE SPEED));

    CS599 Formal Methods in Software Architectures

  • Cruise Control Exampleprocedure brake;--| where in IS_ENGINE_ON=TRUE,--| out (if in IS_ENGINE_ON=TRUE AND in IS_CC_ON=TRUE AND in IS_CC_ENABLED=TRUE) then--| IS_ENGINE_ON=TRUE AND in IS_CC_ON=TRUE AND in IS_CC_ENABLED=FALSE AND SPEED < in CRUISE_SPEED, --| else IS_CC_ON= in IS_CC_ON AND IS_CC_ENABLED = in IS_CC_ENABLED AND SPEED < in SPEED ;procedure resume;--| where in IS_ENGINE_ON=TRUE AND IS_CC_ON=TRUE AND IS_CC_ENABLED=FALSE,--| out IS_ENGINE_ON=TRUE AND in IS_CC_ON=TRUE AND in IS_CC_ENABLED=TRUE AND CRUISE_SPEED= in CRUISE_SPEED ;

    CS599 Formal Methods in Software Architectures

  • Cruise Control Example--| axiom if (speed90) raise CruiseOutofBoundsException;

    procedure adjust (SPEED: in out Integer, CRUISE_SPEED: in out Integer)--| where in IS_ENGINE_ON=TRUE AND IS_CC_ON=TRUE AND IS_CC_ENABLED=TRUE--| if SPEED < CRUISE_SPEED then raise SpeedTooLowException;--| if SPEED > CRUISE_SPEED then raise SpeedTooHighException;

    CS599 Formal Methods in Software Architectures

  • ANNA features utilizedQuantified expressions, most of the annotationsAttempt for package states

    CS599 Formal Methods in Software Architectures

  • Merits of Axiomatic SpecsWidely applicableSemi-Hard to understand Semantics supported by logic/set formalism

    CS599 Formal Methods in Software Architectures

  • Demerits of Axiomatic SpecsNot easily scalableLimit to expressivenessNo visual representation

    CS599 Formal Methods in Software Architectures

  • Experience with Anna Not so hard to understandSupports many program constructsTool support, executable

    CS599 Formal Methods in Software Architectures

  • Experience with Anna, Further info (on going research) not availableWriting annotations takes timeLimited to ADANeed ADA familiarityNo visual representationNo abstraction/decomposition/timing constraints like statechart formalism

    CS599 Formal Methods in Software Architectures

  • Discussion, Q& AOthers: VDM, ZOTHERSANNAPopularDeadMath-likeProgram-likeModel orientedProperty oriented

    CS599 Formal Methods in Software Architectures

    1. Spec of the functional requirements of the program - what the program should do and the domain of the program - which can be used in constructing programs

    Helpful in checking the correctness of the program Provide run time checkingProvide readability to reduce programming errors