Formal Methods 2
of 22
/22
Embed Size (px)
description
Formal Methods 2. Lecture 17 March 24, 2011. Adapted from slides provided by Jason Hallstrom and Murali Sitaraman (Clemson). Some Mathematics is Implicit. We view programming integers as though they are mathematical integers (subject to bounds, of course) - PowerPoint PPT Presentation
Transcript of Formal Methods 2
CS 315 Spring 2011
1
Lecture 17March 24, 2011
Formal Methods 2
Adapted from slides provided by Jason Hallstrom and Murali Sitaraman (Clemson)
CS 315 Spring 2011
2
Some Mathematics is Implicit We view programming integers as
though they are mathematical integers (subject to bounds, of course)
We associate mathematical operators (e.g., +) with operations we can do on integers in programs (e.g., +)
This association can be made explicit
CS 315 Spring 2011
3
Mathematical Modeling Type Integer is modeled by Z;
For all i: Integer,min_int <= i <= max_int;
CS 315 Spring 2011
4
Alternatively Type Integer is modeled by Z;
Let i be an example;
Constraints for all i: Integer;min_int <= i <= max_int;
CS 315 Spring 2011
5
Alternatively Type Integer is modeled by Z;
exemplar i;constraints min_int <= i <=
max_int;
CS 315 Spring 2011
6
Initial Value Specification Type Integer is modeled by Z;
exemplar i;constraints min_int <= i <=
max_int;initialization ensures i = 0;
CS 315 Spring 2011
7
Specification of Operations Type Integer is modeled by Z;
…
Specification of operations, e.g., i++
Operation Increment (updates i: Integer)
requires i < max_intensures i = #i +1
CS 315 Spring 2011
8
More Examples What is a suitable way to model the
state of a lightbulb?
CS 315 Spring 2011
9
More ExamplesType Light_Bulb_State is modeled by B;
exemplar b;Initialization ensures b = false;
Exercises: specification of operationsTurn_on, Turn_off, and Is_On
CS 315 Spring 2011
10
More Examples How would you model the state of a
traffic light?
Alternative models and discussion
CS 315 Spring 2011
11
More Examples How would you model a paper
weight?
CS 315 Spring 2011
12
Data Abstraction Examples How would you mathematically
model the contents of a stack? Is a set model appropriate? Why or why not?
What about modeling a queue?
CS 315 Spring 2011
13
Mathematical Modeling Summary To write formal specifications, we need to
model the state mathematically
Some objects we use in programming, such as Integers and Reals, have implicit models
For others, such as stacks, queues, lists, etc., we need to conceive explicit mathematical models
CS 315 Spring 2011
14
Formal Specification of Java Interfaces
CS 315 Spring 2011
15
Basics An interface
Describes what classes or components do Does not describe how they should do it
An interface Is a contract between component users
(clients) and developers (implementers) If the users satisfy the requirements for
using the component, the component will provide guarantees
CS 315 Spring 2011
16
Principles of Interface Design Information Hiding
Hide details unnecessary to use the component
Abstraction Provide a “cover story” or explanation in
user-oriented terms so they can understand the interface
CS 315 Spring 2011
17
Contract Specification Requirements and guarantees
Requires clauses are preconditions Ensures clauses are postconditions
Who is responsible for requires clauses?
What are the consequences of this?
CS 315 Spring 2011
18
Specification of Stacks Mathematical modeling
How can we think of stacks “mathematically”?
CS 315 Spring 2011
19
Mathematical Strings Unlike sets, strings have order
Example: Str(Z) for String of integers
Notations Empty string (Written empty_string or L) Concatenation (alpha o beta) Length ( |alpha| ) String containing one entry ( <5>)
CS 315 Spring 2011
20
Specification of IntStack Interface Suppose IntStack is an interface
uses Integer_Theory, String_Theory;
Think of stacks of Integers as “math strings” of integers this: Str(Z);
Specification of Constructor initialization ensures this = empty_string;
Exercises: Specification of other stack operations
CS 315 Spring 2011
21
Specification of IntStack InterfaceOperation push (int x)
updates this; restores x;ensures this = <x> o #this;
int Operation pop ();updates this;requires this /= empty_string;ensures #this = <result of pop()> o this;
bool Operation is_empty();preserves this;ensures result of is_empty = (this = empty_string)
CS 315 Spring 2011
22
Java Specification Questions What is the specification of “=“ to assign one
IntStack object to another?
If you defined a “clone” method, what is its specification?
What are the advantages of using “=“ over “clone”?
What are the advantages of using “clone” over “=“?
