formal methods 2

CS 315 Spring 2011

1

Lecture 17March 24, 2011

Formal Methods 2

Adapted from slides provided by Jason Hallstrom and Murali Sitaraman (Clemson)

CS 315 Spring 2011

2

Some Mathematics is Implicit We view programming integers as

though they are mathematical integers (subject to bounds, of course)

We associate mathematical operators (e.g., +) with operations we can do on integers in programs (e.g., +)

This association can be made explicit

CS 315 Spring 2011

3

Mathematical Modeling Type Integer is modeled by Z;

For all i: Integer,min_int <= i <= max_int;

CS 315 Spring 2011

4

Alternatively Type Integer is modeled by Z;

Let i be an example;

Constraints for all i: Integer;min_int <= i <= max_int;

CS 315 Spring 2011

5

Alternatively Type Integer is modeled by Z;

exemplar i;constraints min_int <= i <=

max_int;

CS 315 Spring 2011

6

Initial Value Specification Type Integer is modeled by Z;

exemplar i;constraints min_int <= i <=

max_int;initialization ensures i = 0;

CS 315 Spring 2011

7

Specification of Operations Type Integer is modeled by Z;

…

Specification of operations, e.g., i++

Operation Increment (updates i: Integer)

requires i < max_intensures i = #i +1

CS 315 Spring 2011

8

More Examples What is a suitable way to model the

state of a lightbulb?

CS 315 Spring 2011

9

More ExamplesType Light_Bulb_State is modeled by B;

exemplar b;Initialization ensures b = false;

Exercises: specification of operationsTurn_on, Turn_off, and Is_On

CS 315 Spring 2011

10

More Examples How would you model the state of a

traffic light?

Alternative models and discussion

CS 315 Spring 2011

11

More Examples How would you model a paper

weight?

CS 315 Spring 2011

12

Data Abstraction Examples How would you mathematically

model the contents of a stack? Is a set model appropriate? Why or why not?

What about modeling a queue?

CS 315 Spring 2011

13

Mathematical Modeling Summary To write formal specifications, we need to

model the state mathematically

Some objects we use in programming, such as Integers and Reals, have implicit models

For others, such as stacks, queues, lists, etc., we need to conceive explicit mathematical models

CS 315 Spring 2011

14

Formal Specification of Java Interfaces

CS 315 Spring 2011

15

Basics An interface

Describes what classes or components do Does not describe how they should do it

An interface Is a contract between component users

(clients) and developers (implementers) If the users satisfy the requirements for

using the component, the component will provide guarantees

CS 315 Spring 2011

16

Principles of Interface Design Information Hiding

Hide details unnecessary to use the component

Abstraction Provide a “cover story” or explanation in

user-oriented terms so they can understand the interface

CS 315 Spring 2011

17

Contract Specification Requirements and guarantees

Requires clauses are preconditions Ensures clauses are postconditions

Who is responsible for requires clauses?

What are the consequences of this?

CS 315 Spring 2011

18

Specification of Stacks Mathematical modeling

How can we think of stacks “mathematically”?

CS 315 Spring 2011

19

Mathematical Strings Unlike sets, strings have order

Example: Str(Z) for String of integers

Notations Empty string (Written empty_string or L) Concatenation (alpha o beta) Length ( |alpha| ) String containing one entry ( <5>)

CS 315 Spring 2011

20

Specification of IntStack Interface Suppose IntStack is an interface

uses Integer_Theory, String_Theory;

Think of stacks of Integers as “math strings” of integers this: Str(Z);

Specification of Constructor initialization ensures this = empty_string;

Exercises: Specification of other stack operations

CS 315 Spring 2011

21

Specification of IntStack InterfaceOperation push (int x)

updates this; restores x;ensures this = <x> o #this;

int Operation pop ();updates this;requires this /= empty_string;ensures #this = <result of pop()> o this;

bool Operation is_empty();preserves this;ensures result of is_empty = (this = empty_string)

CS 315 Spring 2011

22

Java Specification Questions What is the specification of “=“ to assign one

IntStack object to another?

If you defined a “clone” method, what is its specification?

What are the advantages of using “=“ over “clone”?

What are the advantages of using “clone” over “=“?